Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

255 files changed, 2845 insertions, 1786 deletions

diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index 6a6d67acaf69..5d54b27c6eba 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -108,12 +108,13 @@ some, but not all of the other indices changing.
 
 Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
 will not need to allocate memory.  The :c:func:`xa_reserve` function
-will store a reserved entry at the indicated index.  Users of the normal
-API will see this entry as containing ``NULL``.  If you do not need to
-use the reserved entry, you can call :c:func:`xa_release` to remove the
-unused entry.  If another user has stored to the entry in the meantime,
-:c:func:`xa_release` will do nothing; if instead you want the entry to
-become ``NULL``, you should use :c:func:`xa_erase`.
+will store a reserved entry at the indicated index.  Users of the
+normal API will see this entry as containing ``NULL``.  If you do
+not need to use the reserved entry, you can call :c:func:`xa_release`
+to remove the unused entry.  If another user has stored to the entry
+in the meantime, :c:func:`xa_release` will do nothing; if instead you
+want the entry to become ``NULL``, you should use :c:func:`xa_erase`.
+Using :c:func:`xa_insert` on a reserved entry will fail.
 
 If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
 will return ``true``.
@@ -183,6 +184,8 @@ Takes xa_lock internally:
  * :c:func:`xa_store_bh`
  * :c:func:`xa_store_irq`
  * :c:func:`xa_insert`
+ * :c:func:`xa_insert_bh`
+ * :c:func:`xa_insert_irq`
  * :c:func:`xa_erase`
  * :c:func:`xa_erase_bh`
  * :c:func:`xa_erase_irq`
diff --git a/Documentation/devicetree/bindings/display/msm/gpu.txt b/Documentation/devicetree/bindings/display/msm/gpu.txt
index ac8df3b871f9..f8759145ce1a 100644
--- a/Documentation/devicetree/bindings/display/msm/gpu.txt
+++ b/Documentation/devicetree/bindings/display/msm/gpu.txt
@@ -27,7 +27,6 @@ Example:
                 reg = <0x04300000 0x20000>;
                 reg-names = "kgsl_3d0_reg_memory";
                 interrupts = <GIC_SPI 80 0>;
-                interrupt-names = "kgsl_3d0_irq";
                 clock-names =
                     "core",
                     "iface",
diff --git a/MAINTAINERS b/MAINTAINERS
index a0245fd1b09a..ecbc22ec2699 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3052,8 +3052,8 @@ F:	include/linux/bcm963xx_nvram.h
 F:      include/linux/bcm963xx_tag.h
 
 BROADCOM BNX2 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      Rasesh Mody <rmody@marvell.com>
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2.*
@@ -3072,9 +3072,9 @@ S:	Supported
 F:      drivers/scsi/bnx2i/
 
 BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-M:      Ariel Elior <ariel.elior@cavium.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
-M:      everest-linux-l2@cavium.com
+M:      Ariel Elior <aelior@marvell.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2x/
@@ -3249,9 +3249,9 @@ S:	Supported
 F:      drivers/scsi/bfa/
 
 BROCADE BNA 10 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      Rasesh Mody <rmody@marvell.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/brocade/bna/
@@ -3978,6 +3978,7 @@ F:	drivers/cpufreq/arm_big_little.c
 CPU POWER MONITORING SUBSYSTEM
 M:      Thomas Renninger <trenn@suse.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
 F:      tools/power/cpupower/
@@ -8265,6 +8266,7 @@ F:	include/uapi/linux/sunrpc/
 
 KERNEL SELFTEST FRAMEWORK
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-kselftest@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git
 Q:      https://patchwork.kernel.org/project/linux-kselftest/list/
@@ -10696,9 +10698,9 @@ S:	Maintained
 F:      drivers/net/netdevsim/*
 
 NETXEN (1/10) GbE SUPPORT
-M:      Manish Chopra <manish.chopra@cavium.com>
-M:      Rahul Verma <rahul.verma@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      Manish Chopra <manishc@marvell.com>
+M:      Rahul Verma <rahulv@marvell.com>
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/netxen/
@@ -12482,8 +12484,8 @@ S:	Supported
 F:      drivers/scsi/qedi/
 
 QLOGIC QL4xxx ETHERNET DRIVER
-M:      Ariel Elior <Ariel.Elior@cavium.com>
-M:      everest-linux-l2@cavium.com
+M:      Ariel Elior <aelior@marvell.com>
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qed/
@@ -12491,8 +12493,8 @@ F:	include/linux/qed/
 F:      drivers/net/ethernet/qlogic/qede/
 
 QLOGIC QL4xxx RDMA DRIVER
-M:      Michal Kalderon <Michal.Kalderon@cavium.com>
-M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      Michal Kalderon <mkalderon@marvell.com>
+M:      Ariel Elior <aelior@marvell.com>
 L:      linux-rdma@vger.kernel.org
 S:      Supported
 F:      drivers/infiniband/hw/qedr/
@@ -12512,7 +12514,7 @@ F:	Documentation/scsi/LICENSE.qla2xxx
 F:      drivers/scsi/qla2xxx/
 
 QLOGIC QLA3XXX NETWORK DRIVER
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      Documentation/networking/device_drivers/qlogic/LICENSE.qla3xxx
@@ -12526,16 +12528,16 @@ F:	Documentation/scsi/LICENSE.qla4xxx
 F:      drivers/scsi/qla4xxx/
 
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
-M:      Shahed Shaikh <Shahed.Shaikh@cavium.com>
-M:      Manish Chopra <manish.chopra@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      Shahed Shaikh <shshaikh@marvell.com>
+M:      Manish Chopra <manishc@marvell.com>
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlcnic/
 
 QLOGIC QLGE 10Gb ETHERNET DRIVER
-M:      Manish Chopra <manish.chopra@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      Manish Chopra <manishc@marvell.com>
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlge/
@@ -15857,6 +15859,7 @@ F:	drivers/usb/common/usb-otg-fsm.c
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/usbip_protocol.txt
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index feed50ce89fa..caa270261521 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -3,23 +3,19 @@ generic-y += bugs.h
 generic-y += compat.h
 generic-y += device.h
 generic-y += div64.h
-generic-y += dma-mapping.h
 generic-y += emergency-restart.h
 generic-y += extable.h
-generic-y += fb.h
 generic-y += ftrace.h
 generic-y += hardirq.h
 generic-y += hw_irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
-generic-y += kmap_types.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += msi.h
 generic-y += parport.h
-generic-y += pci.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += topology.h
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 49bfbd879caa..f1b86cef0905 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -216,6 +216,14 @@ struct bcr_fp_arcv2 {
 #endif
 };
 
+struct bcr_actionpoint {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int pad:21, min:1, num:2, ver:8;
+#else
+        unsigned int ver:8, num:2, min:1, pad:21;
+#endif
+};
+
 #include <soc/arc/timers.h>
 
 struct bcr_bpu_arcompact {
@@ -283,7 +291,7 @@ struct cpuinfo_arc_cache {
 };
 
 struct cpuinfo_arc_bpu {
-        unsigned int ver, full, num_cache, num_pred;
+        unsigned int ver, full, num_cache, num_pred, ret_stk;
 };
 
 struct cpuinfo_arc_ccm {
@@ -302,7 +310,7 @@ struct cpuinfo_arc {
         struct {
                 unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
                              fpu_sp:1, fpu_dp:1, dual:1, dual_enb:1, pad2:4,
-                             debug:1, ap:1, smart:1, rtt:1, pad3:4,
+                             ap_num:4, ap_full:1, smart:1, rtt:1, pad3:1,
                              timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
         } extn;
         struct bcr_mpy extn_mpy;
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index ee9246184033..202b74c339f0 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)
 /*
  * __ffs: Similar to ffs, but zero based (0-31)
  */
-static inline __attribute__ ((const)) int __ffs(unsigned long word)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word)
 {
         if (!word)
                 return word;
@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)
 /*
  * __ffs: Similar to ffs, but zero based (0-31)
  */
-static inline __attribute__ ((const)) int __ffs(unsigned long x)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x)
 {
-        int n;
+        unsigned long n;
 
         asm volatile(
         "       ffs.f   %0, %1          \n"  /* 0:31; 31(Z) if src 0 */
diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
index 9185541035cc..6958545390f0 100644
--- a/arch/arc/include/asm/perf_event.h
+++ b/arch/arc/include/asm/perf_event.h
@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = {
 
         /* counts condition */
         [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
-        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */
+        /* All jump instructions that are taken */
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak",
         [PERF_COUNT_ARC_BPOK]         = "bpok",   /* NP-NT, PT-T, PNT-NT */
 #ifdef CONFIG_ISA_ARCV2
         [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp",
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 8aec462d90fb..861a8aea51f9 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -1,15 +1,10 @@
-/*
- * Linux performance counter support for ARC700 series
- *
- * Copyright (C) 2013-2015 Synopsys, Inc. (www.synopsys.com)
- *
- * This code is inspired by the perf support of various other architectures.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
+// SPDX-License-Identifier: GPL-2.0+
+//
+// Linux performance counter support for ARC CPUs.
+// This code is inspired by the perf support of various other architectures.
+//
+// Copyright (C) 2013-2018 Synopsys, Inc. (www.synopsys.com)
+
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
@@ -19,12 +14,31 @@
 #include <asm/arcregs.h>
 #include <asm/stacktrace.h>
 
+/* HW holds 8 symbols + one for null terminator */
+#define ARCPMU_EVENT_NAME_LEN   9
+
+enum arc_pmu_attr_groups {
+        ARCPMU_ATTR_GR_EVENTS,
+        ARCPMU_ATTR_GR_FORMATS,
+        ARCPMU_NR_ATTR_GR
+};
+
+struct arc_pmu_raw_event_entry {
+        char name[ARCPMU_EVENT_NAME_LEN];
+};
+
 struct arc_pmu {
         struct pmu      pmu;
         unsigned int    irq;
         int             n_counters;
+        int             n_events;
         u64             max_period;
         int             ev_hw_idx[PERF_COUNT_ARC_HW_MAX];
+
+        struct arc_pmu_raw_event_entry  *raw_entry;
+        struct attribute                **attrs;
+        struct perf_pmu_events_attr     *attr;
+        const struct attribute_group    *attr_groups[ARCPMU_NR_ATTR_GR + 1];
 };
 
 struct arc_pmu_cpu {
@@ -49,6 +63,7 @@ static int callchain_trace(unsigned int addr, void *data)
 {
         struct arc_callchain_trace *ctrl = data;
         struct perf_callchain_entry_ctx *entry = ctrl->perf_stuff;
+
         perf_callchain_store(entry, addr);
 
         if (ctrl->depth++ < 3)
@@ -57,8 +72,8 @@ static int callchain_trace(unsigned int addr, void *data)
         return -1;
 }
 
-void
-perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry,
+                           struct pt_regs *regs)
 {
         struct arc_callchain_trace ctrl = {
                 .depth = 0,
@@ -68,8 +83,8 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
         arc_unwind_core(NULL, regs, callchain_trace, &ctrl);
 }
 
-void
-perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
+                         struct pt_regs *regs)
 {
         /*
          * User stack can't be unwound trivially with kernel dwarf unwinder
@@ -82,10 +97,10 @@ static struct arc_pmu *arc_pmu;
 static DEFINE_PER_CPU(struct arc_pmu_cpu, arc_pmu_cpu);
 
 /* read counter #idx; note that counter# != event# on ARC! */
-static uint64_t arc_pmu_read_counter(int idx)
+static u64 arc_pmu_read_counter(int idx)
 {
-        uint32_t tmp;
-        uint64_t result;
+        u32 tmp;
+        u64 result;
 
         /*
          * ARC supports making 'snapshots' of the counters, so we don't
@@ -94,7 +109,7 @@ static uint64_t arc_pmu_read_counter(int idx)
         write_aux_reg(ARC_REG_PCT_INDEX, idx);
         tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
         write_aux_reg(ARC_REG_PCT_CONTROL, tmp | ARC_REG_PCT_CONTROL_SN);
-        result = (uint64_t) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
+        result = (u64) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
         result |= read_aux_reg(ARC_REG_PCT_SNAPL);
 
         return result;
@@ -103,9 +118,9 @@ static uint64_t arc_pmu_read_counter(int idx)
 static void arc_perf_event_update(struct perf_event *event,
                                   struct hw_perf_event *hwc, int idx)
 {
-        uint64_t prev_raw_count = local64_read(&hwc->prev_count);
-        uint64_t new_raw_count = arc_pmu_read_counter(idx);
-        int64_t delta = new_raw_count - prev_raw_count;
+        u64 prev_raw_count = local64_read(&hwc->prev_count);
+        u64 new_raw_count = arc_pmu_read_counter(idx);
+        s64 delta = new_raw_count - prev_raw_count;
 
         /*
          * We aren't afraid of hwc->prev_count changing beneath our feet
@@ -155,7 +170,7 @@ static int arc_pmu_event_init(struct perf_event *event)
         int ret;
 
         if (!is_sampling_event(event)) {
-                hwc->sample_period  = arc_pmu->max_period;
+                hwc->sample_period = arc_pmu->max_period;
                 hwc->last_period = hwc->sample_period;
                 local64_set(&hwc->period_left, hwc->sample_period);
         }
@@ -192,6 +207,18 @@ static int arc_pmu_event_init(struct perf_event *event)
                 pr_debug("init cache event with h/w %08x \'%s\'\n",
                          (int)hwc->config, arc_pmu_ev_hw_map[ret]);
                 return 0;
+
+        case PERF_TYPE_RAW:
+                if (event->attr.config >= arc_pmu->n_events)
+                        return -ENOENT;
+
+                hwc->config |= event->attr.config;
+                pr_debug("init raw event with idx %lld \'%s\'\n",
+                         event->attr.config,
+                         arc_pmu->raw_entry[event->attr.config].name);
+
+                return 0;
+
         default:
                 return -ENOENT;
         }
@@ -200,7 +227,7 @@ static int arc_pmu_event_init(struct perf_event *event)
 /* starts all counters */
 static void arc_pmu_enable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
         tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
         write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x1);
 }
@@ -208,7 +235,7 @@ static void arc_pmu_enable(struct pmu *pmu)
 /* stops all counters */
 static void arc_pmu_disable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
         tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
         write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x0);
 }
@@ -228,7 +255,7 @@ static int arc_pmu_event_set_period(struct perf_event *event)
                 local64_set(&hwc->period_left, left);
                 hwc->last_period = period;
                 overflow = 1;
-        } else  if (unlikely(left <= 0)) {
+        } else if (unlikely(left <= 0)) {
                 /* left underflowed by less than period. */
                 left += period;
                 local64_set(&hwc->period_left, left);
@@ -246,8 +273,8 @@ static int arc_pmu_event_set_period(struct perf_event *event)
         write_aux_reg(ARC_REG_PCT_INDEX, idx);
 
         /* Write value */
-        write_aux_reg(ARC_REG_PCT_COUNTL, (u32)value);
-        write_aux_reg(ARC_REG_PCT_COUNTH, (value >> 32));
+        write_aux_reg(ARC_REG_PCT_COUNTL, lower_32_bits(value));
+        write_aux_reg(ARC_REG_PCT_COUNTH, upper_32_bits(value));
 
         perf_event_update_userpage(event);
 
@@ -277,7 +304,7 @@ static void arc_pmu_start(struct perf_event *event, int flags)
         /* Enable interrupt for this counter */
         if (is_sampling_event(event))
                 write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
 
         /* enable ARC pmu here */
         write_aux_reg(ARC_REG_PCT_INDEX, idx);          /* counter # */
@@ -295,9 +322,9 @@ static void arc_pmu_stop(struct perf_event *event, int flags)
                  * Reset interrupt flag by writing of 1. This is required
                  * to make sure pending interrupt was not left.
                  */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
                 write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~(1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~BIT(idx));
         }
 
         if (!(event->hw.state & PERF_HES_STOPPED)) {
@@ -349,9 +376,10 @@ static int arc_pmu_add(struct perf_event *event, int flags)
 
         if (is_sampling_event(event)) {
                 /* Mimic full counter overflow as other arches do */
-                write_aux_reg(ARC_REG_PCT_INT_CNTL, (u32)arc_pmu->max_period);
+                write_aux_reg(ARC_REG_PCT_INT_CNTL,
+                              lower_32_bits(arc_pmu->max_period));
                 write_aux_reg(ARC_REG_PCT_INT_CNTH,
-                              (arc_pmu->max_period >> 32));
+                              upper_32_bits(arc_pmu->max_period));
         }
 
         write_aux_reg(ARC_REG_PCT_CONFIG, 0);
@@ -392,7 +420,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                 idx = __ffs(active_ints);
 
                 /* Reset interrupt flag by writing of 1 */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
 
                 /*
                  * On reset of "interrupt active" bit corresponding
@@ -400,7 +428,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                  * Now we need to re-enable interrupt for the counter.
                  */
                 write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
 
                 event = pmu_cpu->act_counter[idx];
                 hwc = &event->hw;
@@ -414,7 +442,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                                 arc_pmu_stop(event, 0);
                 }
 
-                active_ints &= ~(1U << idx);
+                active_ints &= ~BIT(idx);
         } while (active_ints);
 
 done:
@@ -441,19 +469,108 @@ static void arc_cpu_pmu_irq_init(void *data)
         write_aux_reg(ARC_REG_PCT_INT_ACT, 0xffffffff);
 }
 
+/* Event field occupies the bottom 15 bits of our config field */
+PMU_FORMAT_ATTR(event, "config:0-14");
+static struct attribute *arc_pmu_format_attrs[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+
+static struct attribute_group arc_pmu_format_attr_gr = {
+        .name = "format",
+        .attrs = arc_pmu_format_attrs,
+};
+
+static ssize_t arc_pmu_events_sysfs_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *page)
+{
+        struct perf_pmu_events_attr *pmu_attr;
+
+        pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
+        return sprintf(page, "event=0x%04llx\n", pmu_attr->id);
+}
+
+/*
+ * We don't add attrs here as we don't have pre-defined list of perf events.
+ * We will generate and add attrs dynamically in probe() after we read HW
+ * configuration.
+ */
+static struct attribute_group arc_pmu_events_attr_gr = {
+        .name = "events",
+};
+
+static void arc_pmu_add_raw_event_attr(int j, char *str)
+{
+        memmove(arc_pmu->raw_entry[j].name, str, ARCPMU_EVENT_NAME_LEN - 1);
+        arc_pmu->attr[j].attr.attr.name = arc_pmu->raw_entry[j].name;
+        arc_pmu->attr[j].attr.attr.mode = VERIFY_OCTAL_PERMISSIONS(0444);
+        arc_pmu->attr[j].attr.show = arc_pmu_events_sysfs_show;
+        arc_pmu->attr[j].id = j;
+        arc_pmu->attrs[j] = &(arc_pmu->attr[j].attr.attr);
+}
+
+static int arc_pmu_raw_alloc(struct device *dev)
+{
+        arc_pmu->attr = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attr), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attr)
+                return -ENOMEM;
+
+        arc_pmu->attrs = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attrs), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attrs)
+                return -ENOMEM;
+
+        arc_pmu->raw_entry = devm_kmalloc_array(dev, arc_pmu->n_events,
+                sizeof(*arc_pmu->raw_entry), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->raw_entry)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static inline bool event_in_hw_event_map(int i, char *name)
+{
+        if (!arc_pmu_ev_hw_map[i])
+                return false;
+
+        if (!strlen(arc_pmu_ev_hw_map[i]))
+                return false;
+
+        if (strcmp(arc_pmu_ev_hw_map[i], name))
+                return false;
+
+        return true;
+}
+
+static void arc_pmu_map_hw_event(int j, char *str)
+{
+        int i;
+
+        /* See if HW condition has been mapped to a perf event_id */
+        for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                if (event_in_hw_event_map(i, str)) {
+                        pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
+                                 i, str, j);
+                        arc_pmu->ev_hw_idx[i] = j;
+                }
+        }
+}
+
 static int arc_pmu_device_probe(struct platform_device *pdev)
 {
         struct arc_reg_pct_build pct_bcr;
         struct arc_reg_cc_build cc_bcr;
-        int i, j, has_interrupts;
+        int i, has_interrupts;
         int counter_size;       /* in bits */
 
         union cc_name {
                 struct {
-                        uint32_t word0, word1;
+                        u32 word0, word1;
                         char sentinel;
                 } indiv;
-                char str[9];
+                char str[ARCPMU_EVENT_NAME_LEN];
         } cc_name;
 
 
@@ -463,15 +580,22 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
         BUILD_BUG_ON(ARC_PERF_MAX_COUNTERS > 32);
-        BUG_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS);
+        if (WARN_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS))
+                return -EINVAL;
 
         READ_BCR(ARC_REG_CC_BUILD, cc_bcr);
-        BUG_ON(!cc_bcr.v); /* Counters exist but No countable conditions ? */
+        if (WARN(!cc_bcr.v, "Counters exist but No countable conditions?"))
+                return -EINVAL;
 
         arc_pmu = devm_kzalloc(&pdev->dev, sizeof(struct arc_pmu), GFP_KERNEL);
         if (!arc_pmu)
                 return -ENOMEM;
 
+        arc_pmu->n_events = cc_bcr.c;
+
+        if (arc_pmu_raw_alloc(&pdev->dev))
+                return -ENOMEM;
+
         has_interrupts = is_isa_arcv2() ? pct_bcr.i : 0;
 
         arc_pmu->n_counters = pct_bcr.c;
@@ -481,30 +605,26 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
 
         pr_info("ARC perf\t: %d counters (%d bits), %d conditions%s\n",
                 arc_pmu->n_counters, counter_size, cc_bcr.c,
-                has_interrupts ? ", [overflow IRQ support]":"");
+                has_interrupts ? ", [overflow IRQ support]" : "");
 
-        cc_name.str[8] = 0;
+        cc_name.str[ARCPMU_EVENT_NAME_LEN - 1] = 0;
         for (i = 0; i < PERF_COUNT_ARC_HW_MAX; i++)
                 arc_pmu->ev_hw_idx[i] = -1;
 
         /* loop thru all available h/w condition indexes */
-        for (j = 0; j < cc_bcr.c; j++) {
-                write_aux_reg(ARC_REG_CC_INDEX, j);
+        for (i = 0; i < cc_bcr.c; i++) {
+                write_aux_reg(ARC_REG_CC_INDEX, i);
                 cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
                 cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
 
-                /* See if it has been mapped to a perf event_id */
-                for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
-                        if (arc_pmu_ev_hw_map[i] &&
-                            !strcmp(arc_pmu_ev_hw_map[i], cc_name.str) &&
-                            strlen(arc_pmu_ev_hw_map[i])) {
-                                pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
-                                         i, cc_name.str, j);
-                                arc_pmu->ev_hw_idx[i] = j;
-                        }
-                }
+                arc_pmu_map_hw_event(i, cc_name.str);
+                arc_pmu_add_raw_event_attr(i, cc_name.str);
         }
 
+        arc_pmu_events_attr_gr.attrs = arc_pmu->attrs;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_EVENTS] = &arc_pmu_events_attr_gr;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_FORMATS] = &arc_pmu_format_attr_gr;
+
         arc_pmu->pmu = (struct pmu) {
                 .pmu_enable     = arc_pmu_enable,
                 .pmu_disable    = arc_pmu_disable,
@@ -514,6 +634,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                 .start          = arc_pmu_start,
                 .stop           = arc_pmu_stop,
                 .read           = arc_pmu_read,
+                .attr_groups    = arc_pmu->attr_groups,
         };
 
         if (has_interrupts) {
@@ -535,17 +656,19 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
         } else
                 arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
 
-        return perf_pmu_register(&arc_pmu->pmu, pdev->name, PERF_TYPE_RAW);
+        /*
+         * perf parser doesn't really like '-' symbol in events name, so let's
+         * use '_' in arc pct name as it goes to kernel PMU event prefix.
+         */
+        return perf_pmu_register(&arc_pmu->pmu, "arc_pct", PERF_TYPE_RAW);
 }
 
-#ifdef CONFIG_OF
 static const struct of_device_id arc_pmu_match[] = {
         { .compatible = "snps,arc700-pct" },
         { .compatible = "snps,archs-pct" },
         {},
 };
 MODULE_DEVICE_TABLE(of, arc_pmu_match);
-#endif
 
 static struct platform_driver arc_pmu_driver = {
         .driver = {
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 2e018b8c2e19..feb90093e6b1 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -123,6 +123,7 @@ static void read_arc_build_cfg_regs(void)
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
         const struct id_to_str *tbl;
         struct bcr_isa_arcv2 isa;
+        struct bcr_actionpoint ap;
 
         FIX_PTR(cpu);
 
@@ -195,6 +196,7 @@ static void read_arc_build_cfg_regs(void)
                 cpu->bpu.full = bpu.ft;
                 cpu->bpu.num_cache = 256 << bpu.bce;
                 cpu->bpu.num_pred = 2048 << bpu.pte;
+                cpu->bpu.ret_stk = 4 << bpu.rse;
 
                 if (cpu->core.family >= 0x54) {
                         unsigned int exec_ctrl;
@@ -207,8 +209,11 @@ static void read_arc_build_cfg_regs(void)
                 }
         }
 
-        READ_BCR(ARC_REG_AP_BCR, bcr);
-        cpu->extn.ap = bcr.ver ? 1 : 0;
+        READ_BCR(ARC_REG_AP_BCR, ap);
+        if (ap.ver) {
+                cpu->extn.ap_num = 2 << ap.num;
+                cpu->extn.ap_full = !!ap.min;
+        }
 
         READ_BCR(ARC_REG_SMART_BCR, bcr);
         cpu->extn.smart = bcr.ver ? 1 : 0;
@@ -216,8 +221,6 @@ static void read_arc_build_cfg_regs(void)
         READ_BCR(ARC_REG_RTT_BCR, bcr);
         cpu->extn.rtt = bcr.ver ? 1 : 0;
 
-        cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
-
         READ_BCR(ARC_REG_ISA_CFG_BCR, isa);
 
         /* some hacks for lack of feature BCR info in old ARC700 cores */
@@ -299,10 +302,10 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 
         if (cpu->bpu.ver)
                 n += scnprintf(buf + n, len - n,
-                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d",
+                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d Return stk: %d",
                               IS_AVAIL1(cpu->bpu.full, "full"),
                               IS_AVAIL1(!cpu->bpu.full, "partial"),
-                              cpu->bpu.num_cache, cpu->bpu.num_pred);
+                              cpu->bpu.num_cache, cpu->bpu.num_pred, cpu->bpu.ret_stk);
 
         if (is_isa_arcv2()) {
                 struct bcr_lpb lpb;
@@ -336,11 +339,17 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                                IS_AVAIL1(cpu->extn.fpu_sp, "SP "),
                                IS_AVAIL1(cpu->extn.fpu_dp, "DP "));
 
-        if (cpu->extn.debug)
-                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s%s\n",
-                               IS_AVAIL1(cpu->extn.ap, "ActionPoint "),
+        if (cpu->extn.ap_num | cpu->extn.smart | cpu->extn.rtt) {
+                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s",
                                IS_AVAIL1(cpu->extn.smart, "smaRT "),
                                IS_AVAIL1(cpu->extn.rtt, "RTT "));
+                if (cpu->extn.ap_num) {
+                        n += scnprintf(buf + n, len - n, "ActionPoint %d/%s",
+                                       cpu->extn.ap_num,
+                                       cpu->extn.ap_full ? "full":"min");
+                }
+                n += scnprintf(buf + n, len - n, "\n");
+        }
 
         if (cpu->dccm.sz || cpu->iccm.sz)
                 n += scnprintf(buf + n, len - n, "Extn [CCM]\t: DCCM @ %x, %d KB / ICCM: @ %x, %d KB\n",
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index e8d9fb452346..215f515442e0 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -18,6 +18,8 @@
 #include <asm/arcregs.h>
 #include <asm/irqflags.h>
 
+#define ARC_PATH_MAX    256
+
 /*
  * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
  *   -Prints 3 regs per line and a CR.
@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs)
         print_reg_file(&(cregs->r13), 13);
 }
 
-static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+static void print_task_path_n_nm(struct task_struct *tsk)
 {
         char *path_nm = NULL;
         struct mm_struct *mm;
         struct file *exe_file;
+        char buf[ARC_PATH_MAX];
 
         mm = get_task_mm(tsk);
         if (!mm)
@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
         mmput(mm);
 
         if (exe_file) {
-                path_nm = file_path(exe_file, buf, 255);
+                path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1);
                 fput(exe_file);
         }
 
@@ -80,10 +83,9 @@ done:
         pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?");
 }
 
-static void show_faulting_vma(unsigned long address, char *buf)
+static void show_faulting_vma(unsigned long address)
 {
         struct vm_area_struct *vma;
-        char *nm = buf;
         struct mm_struct *active_mm = current->active_mm;
 
         /* can't use print_vma_addr() yet as it doesn't check for
@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf)
          * if the container VMA is not found
          */
         if (vma && (vma->vm_start <= address)) {
+                char buf[ARC_PATH_MAX];
+                char *nm = "?";
+
                 if (vma->vm_file) {
-                        nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
+                        nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1);
                         if (IS_ERR(nm))
                                 nm = "?";
                 }
@@ -173,13 +178,14 @@ void show_regs(struct pt_regs *regs)
 {
         struct task_struct *tsk = current;
         struct callee_regs *cregs;
-        char *buf;
 
-        buf = (char *)__get_free_page(GFP_KERNEL);
-        if (!buf)
-                return;
+        /*
+         * generic code calls us with preemption disabled, but some calls
+         * here could sleep, so re-enable to avoid lockdep splat
+         */
+        preempt_enable();
 
-        print_task_path_n_nm(tsk, buf);
+        print_task_path_n_nm(tsk);
         show_regs_print_info(KERN_INFO);
 
         show_ecr_verbose(regs);
@@ -189,7 +195,7 @@ void show_regs(struct pt_regs *regs)
                 (void *)regs->blink, (void *)regs->ret);
 
         if (user_mode(regs))
-                show_faulting_vma(regs->ret, buf); /* faulting code, not data */
+                show_faulting_vma(regs->ret); /* faulting code, not data */
 
         pr_info("[STAT32]: 0x%08lx", regs->status32);
 
@@ -222,7 +228,7 @@ void show_regs(struct pt_regs *regs)
         if (cregs)
                 show_callee_regs(cregs);
 
-        free_page((unsigned long)buf);
+        preempt_disable();
 }
 
 void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
diff --git a/arch/arc/lib/memset-archs.S b/arch/arc/lib/memset-archs.S
index 62ad4bcb841a..f230bb7092fd 100644
--- a/arch/arc/lib/memset-archs.S
+++ b/arch/arc/lib/memset-archs.S
@@ -7,11 +7,39 @@
  */
 
 #include <linux/linkage.h>
+#include <asm/cache.h>
 
-#undef PREALLOC_NOT_AVAIL
+/*
+ * The memset implementation below is optimized to use prefetchw and prealloc
+ * instruction in case of CPU with 64B L1 data cache line (L1_CACHE_SHIFT == 6)
+ * If you want to implement optimized memset for other possible L1 data cache
+ * line lengths (32B and 128B) you should rewrite code carefully checking
+ * we don't call any prefetchw/prealloc instruction for L1 cache lines which
+ * don't belongs to memset area.
+ */
+
+#if L1_CACHE_SHIFT == 6
+
+.macro PREALLOC_INSTR   reg, off
+        prealloc        [\reg, \off]
+.endm
+
+.macro PREFETCHW_INSTR  reg, off
+        prefetchw       [\reg, \off]
+.endm
+
+#else
+
+.macro PREALLOC_INSTR
+.endm
+
+.macro PREFETCHW_INSTR
+.endm
+
+#endif
 
 ENTRY_CFI(memset)
-        prefetchw [r0]          ; Prefetch the write location
+        PREFETCHW_INSTR r0, 0   ; Prefetch the first write location
         mov.f   0, r2
 ;;; if size is zero
         jz.d    [blink]
@@ -48,11 +76,8 @@ ENTRY_CFI(memset)
 
         lpnz    @.Lset64bytes
         ;; LOOP START
-#ifdef PREALLOC_NOT_AVAIL
-        prefetchw [r3, 64]      ;Prefetch the next write location
-#else
-        prealloc  [r3, 64]
-#endif
+        PREALLOC_INSTR  r3, 64  ; alloc next line w/o fetching
+
 #ifdef CONFIG_ARC_HAS_LL64
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
@@ -85,7 +110,6 @@ ENTRY_CFI(memset)
         lsr.f   lp_count, r2, 5 ;Last remaining  max 124 bytes
         lpnz    .Lset32bytes
         ;; LOOP START
-        prefetchw   [r3, 32]    ;Prefetch the next write location
 #ifdef CONFIG_ARC_HAS_LL64
         std.ab  r4, [r3, 8]
         std.ab  r4, [r3, 8]
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index a1d723197084..8df1638259f3 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -141,12 +141,17 @@ good_area:
          */
         fault = handle_mm_fault(vma, address, flags);
 
-        /* If Pagefault was interrupted by SIGKILL, exit page fault "early" */
         if (fatal_signal_pending(current)) {
-                if ((fault & VM_FAULT_ERROR) && !(fault & VM_FAULT_RETRY))
-                        up_read(&mm->mmap_sem);
-                if (user_mode(regs))
+
+                /*
+                 * if fault retry, mmap_sem already relinquished by core mm
+                 * so OK to return to user mode (with signal handled first)
+                 */
+                if (fault & VM_FAULT_RETRY) {
+                        if (!user_mode(regs))
+                                goto no_context;
                         return;
+                }
         }
 
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
index 43bf4c3a1290..e1ab2d7f1d64 100644
--- a/arch/arc/mm/init.c
+++ b/arch/arc/mm/init.c
@@ -119,7 +119,8 @@ void __init setup_arch_memory(void)
          */
 
         memblock_add_node(low_mem_start, low_mem_sz, 0);
-        memblock_reserve(low_mem_start, __pa(_end) - low_mem_start);
+        memblock_reserve(CONFIG_LINUX_LINK_BASE,
+                         __pa(_end) - CONFIG_LINUX_LINK_BASE);
 
 #ifdef CONFIG_BLK_DEV_INITRD
         if (phys_initrd_size) {
diff --git a/arch/arm/include/asm/xen/page-coherent.h b/arch/arm/include/asm/xen/page-coherent.h
index b3ef061d8b74..2c403e7c782d 100644
--- a/arch/arm/include/asm/xen/page-coherent.h
+++ b/arch/arm/include/asm/xen/page-coherent.h
@@ -1 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
+#define _ASM_ARM_XEN_PAGE_COHERENT_H
+
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+
+static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
+{
+        if (dev && dev->archdata.dev_dma_ops)
+                return dev->archdata.dev_dma_ops;
+        return get_arch_dma_ops(NULL);
+}
+
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
+}
+
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can span across
+         * multiple Xen pages, it's not possible for it to contain a
+         * mix of local and foreign Xen pages. So if the first xen_pfn
+         * == mfn the page is local otherwise it's a foreign page
+         * grant-mapped in dom0. If the page is local we can safely
+         * call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (local)
+                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->unmap_page)
+                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
+        } else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
+                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
+                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+
+#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/include/asm/device.h b/arch/arm64/include/asm/device.h
index 3dd3d664c5c5..4658c937e173 100644
--- a/arch/arm64/include/asm/device.h
+++ b/arch/arm64/include/asm/device.h
@@ -20,9 +20,6 @@ struct dev_archdata {
 #ifdef CONFIG_IOMMU_API
         void *iommu;                    /* private IOMMU data */
 #endif
-#ifdef CONFIG_XEN
-        const struct dma_map_ops *dev_dma_ops;
-#endif
 };
 
 struct pdev_archdata {
diff --git a/arch/arm64/include/asm/xen/page-coherent.h b/arch/arm64/include/asm/xen/page-coherent.h
index b3ef061d8b74..d88e56b90b93 100644
--- a/arch/arm64/include/asm/xen/page-coherent.h
+++ b/arch/arm64/include/asm/xen/page-coherent.h
@@ -1 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM64_XEN_PAGE_COHERENT_H
+#define _ASM_ARM64_XEN_PAGE_COHERENT_H
+
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return dma_direct_alloc(hwdev, size, dma_handle, flags, attrs);
+}
+
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        dma_direct_free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_cpu(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_device(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+
+        if (local)
+                dma_direct_map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn))
+                dma_direct_unmap_page(hwdev, handle, size, dir, attrs);
+        else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+
+#endif /* _ASM_ARM64_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index fb0908456a1f..78c0a72f822c 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -466,9 +466,7 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
         __iommu_setup_dma_ops(dev, dma_base, size, iommu);
 
 #ifdef CONFIG_XEN
-        if (xen_initial_domain()) {
-                dev->archdata.dev_dma_ops = dev->dma_ops;
+        if (xen_initial_domain())
                 dev->dma_ops = xen_dma_ops;
-        }
 #endif
 }
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index ccbb53e22024..8d04e6f3f796 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -25,7 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
         atomic_set(&mm->context.flush_count, 0);
         mm->context.gmap_asce = 0;
         mm->context.flush_mm = 0;
-        mm->context.compat_mm = 0;
+        mm->context.compat_mm = test_thread_flag(TIF_31BIT);
 #ifdef CONFIG_PGSTE
         mm->context.alloc_pgste = page_table_allocate_pgste ||
                 test_thread_flag(TIF_PGSTE) ||
@@ -90,8 +90,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
         int cpu = smp_processor_id();
 
-        if (prev == next)
-                return;
         S390_lowcore.user_asce = next->context.asce;
         cpumask_set_cpu(cpu, &next->context.cpu_attach_mask);
         /* Clear previous user-ASCE from CR1 and CR7 */
@@ -103,7 +101,8 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                 __ctl_load(S390_lowcore.vdso_asce, 7, 7);
                 clear_cpu_flag(CIF_ASCE_SECONDARY);
         }
-        cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
+        if (prev != next)
+                cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
 }
 
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index af5c2b3f7065..a8c7789b246b 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -63,10 +63,10 @@ static noinline __init void detect_machine_type(void)
         if (stsi(vmms, 3, 2, 2) || !vmms->count)
                 return;
 
-        /* Running under KVM? If not we assume z/VM */
+        /* Detect known hypervisors */
         if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
-        else
+        else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4))
                 S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
 }
 
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 72dd23ef771b..7ed90a759135 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -1006,6 +1006,8 @@ void __init setup_arch(char **cmdline_p)
                 pr_info("Linux is running under KVM in 64-bit mode\n");
         else if (MACHINE_IS_LPAR)
                 pr_info("Linux is running natively in 64-bit mode\n");
+        else
+                pr_info("Linux is running as a guest in 64-bit mode\n");
 
         /* Have one command line that is parsed and saved in /proc/cmdline */
         /* boot_command_line has been already set up in early.c */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index f82b3d3c36e2..b198ece2aad6 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -381,8 +381,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data)
  */
 void smp_call_ipl_cpu(void (*func)(void *), void *data)
 {
+        struct lowcore *lc = pcpu_devices->lowcore;
+
+        if (pcpu_devices[0].address == stap())
+                lc = &S390_lowcore;
+
         pcpu_delegate(&pcpu_devices[0], func, data,
-                      pcpu_devices->lowcore->nodat_stack);
+                      lc->nodat_stack);
 }
 
 int smp_find_processor_id(u16 address)
@@ -1166,7 +1171,11 @@ static ssize_t __ref rescan_store(struct device *dev,
 {
         int rc;
 
+        rc = lock_device_hotplug_sysfs();
+        if (rc)
+                return rc;
         rc = smp_rescan_cpus();
+        unlock_device_hotplug();
         return rc ? rc : count;
 }
 static DEVICE_ATTR_WO(rescan);
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index ebe748a9f472..4ff354887db4 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -224,10 +224,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 
         vdso_pages = vdso64_pages;
 #ifdef CONFIG_COMPAT
-        if (is_compat_task()) {
+        mm->context.compat_mm = is_compat_task();
+        if (mm->context.compat_mm)
                 vdso_pages = vdso32_pages;
-                mm->context.compat_mm = 1;
-        }
 #endif
         /*
          * vDSO has a problem and was disabled, just don't "enable" it for
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index ba4bfb7f6a36..5c93a65ee1e5 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -457,6 +457,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
 #else
         u64 ipi_bitmap = 0;
 #endif
+        long ret;
 
         if (cpumask_empty(mask))
                 return;
@@ -482,8 +483,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
                 } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) {
                         max = apic_id < max ? max : apic_id;
                 } else {
-                        kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                        ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                                 (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                        WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
                         min = max = apic_id;
                         ipi_bitmap = 0;
                 }
@@ -491,8 +493,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
         }
 
         if (ipi_bitmap) {
-                kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                         (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
         }
 
         local_irq_restore(flags);
diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile
index 69b3a7c30013..31ecf7a76d5a 100644
--- a/arch/x86/kvm/Makefile
+++ b/arch/x86/kvm/Makefile
@@ -2,10 +2,6 @@
 
 ccflags-y += -Iarch/x86/kvm
 
-CFLAGS_x86.o := -I.
-CFLAGS_svm.o := -I.
-CFLAGS_vmx.o := -I.
-
 KVM := ../../../virt/kvm
 
 kvm-y                   += $(KVM)/kvm_main.o $(KVM)/coalesced_mmio.o \
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index c90a5352d158..89d20ed1d2e8 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1636,7 +1636,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
                 ret = kvm_hvcall_signal_event(vcpu, fast, ingpa);
                 if (ret != HV_STATUS_INVALID_PORT_ID)
                         break;
-                /* maybe userspace knows this conn_id: fall through */
+                /* fall through - maybe userspace knows this conn_id. */
         case HVCALL_POST_MESSAGE:
                 /* don't bother userspace if it has no way to handle it */
                 if (unlikely(rep || !vcpu_to_synic(vcpu)->active)) {
@@ -1832,7 +1832,6 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                         ent->eax |= HV_X64_MSR_VP_INDEX_AVAILABLE;
                         ent->eax |= HV_X64_MSR_RESET_AVAILABLE;
                         ent->eax |= HV_MSR_REFERENCE_TSC_AVAILABLE;
-                        ent->eax |= HV_X64_MSR_GUEST_IDLE_AVAILABLE;
                         ent->eax |= HV_X64_ACCESS_FREQUENCY_MSRS;
                         ent->eax |= HV_X64_ACCESS_REENLIGHTENMENT;
 
@@ -1848,11 +1847,11 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                 case HYPERV_CPUID_ENLIGHTMENT_INFO:
                         ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED;
                         ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED;
-                        ent->eax |= HV_X64_SYSTEM_RESET_RECOMMENDED;
                         ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
                         ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED;
                         ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED;
-                        ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
+                        if (evmcs_ver)
+                                ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
 
                         /*
                          * Default number of spinlock retry attempts, matches
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9f089e2e09d0..4b6c2da7265c 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1035,6 +1035,7 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
         switch (delivery_mode) {
         case APIC_DM_LOWEST:
                 vcpu->arch.apic_arb_prio++;
+                /* fall through */
         case APIC_DM_FIXED:
                 if (unlikely(trig_mode && !level))
                         break;
@@ -1874,6 +1875,7 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
 
         case APIC_LVT0:
                 apic_manage_nmi_watchdog(apic, val);
+                /* fall through */
         case APIC_LVTTHMR:
         case APIC_LVTPC:
         case APIC_LVT1:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index ce770b446238..da9c42349b1f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4371,6 +4371,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
                         rsvd_bits(maxphyaddr, 51);
                 rsvd_check->rsvd_bits_mask[1][4] =
                         rsvd_check->rsvd_bits_mask[0][4];
+                /* fall through */
         case PT64_ROOT_4LEVEL:
                 rsvd_check->rsvd_bits_mask[0][3] = exb_bit_rsvd |
                         nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index a157ca5b6869..f13a3a24d360 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3414,6 +3414,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
         kvm_mmu_reset_context(&svm->vcpu);
         kvm_mmu_load(&svm->vcpu);
 
+        /*
+         * Drop what we picked up for L2 via svm_complete_interrupts() so it
+         * doesn't end up in L1.
+         */
+        svm->vcpu.arch.nmi_injected = false;
+        kvm_clear_exception_queue(&svm->vcpu);
+        kvm_clear_interrupt_queue(&svm->vcpu);
+
         return 0;
 }
 
@@ -4395,7 +4403,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
         case MSR_IA32_APICBASE:
                 if (kvm_vcpu_apicv_active(vcpu))
                         avic_update_vapic_bar(to_svm(vcpu), data);
-                /* Follow through */
+                /* Fall through */
         default:
                 return kvm_set_msr_common(vcpu, msr);
         }
@@ -4504,28 +4512,19 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
                 kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                 break;
         case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
-                int i;
-                struct kvm_vcpu *vcpu;
-                struct kvm *kvm = svm->vcpu.kvm;
                 struct kvm_lapic *apic = svm->vcpu.arch.apic;
 
                 /*
-                 * At this point, we expect that the AVIC HW has already
-                 * set the appropriate IRR bits on the valid target
-                 * vcpus. So, we just need to kick the appropriate vcpu.
+                 * Update ICR high and low, then emulate sending IPI,
+                 * which is handled when writing APIC_ICR.
                  */
-                kvm_for_each_vcpu(i, vcpu, kvm) {
-                        bool m = kvm_apic_match_dest(vcpu, apic,
-                                                     icrl & KVM_APIC_SHORT_MASK,
-                                                     GET_APIC_DEST_FIELD(icrh),
-                                                     icrl & KVM_APIC_DEST_MASK);
-
-                        if (m && !avic_vcpu_is_running(vcpu))
-                                kvm_vcpu_wake_up(vcpu);
-                }
+                kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
+                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                 break;
         }
         case AVIC_IPI_FAILURE_INVALID_TARGET:
+                WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n",
+                          index, svm->vcpu.vcpu_id, icrh, icrl);
                 break;
         case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
                 WARN_ONCE(1, "Invalid backing page\n");
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 705f40ae2532..6432d08c7de7 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -1465,7 +1465,7 @@ TRACE_EVENT(kvm_hv_send_ipi_ex,
 #endif /* _TRACE_KVM_H */
 
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH arch/x86/kvm
+#define TRACE_INCLUDE_PATH ../../arch/x86/kvm
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
 
diff --git a/arch/x86/kvm/vmx/evmcs.c b/arch/x86/kvm/vmx/evmcs.c
index 95bc2247478d..5466c6d85cf3 100644
--- a/arch/x86/kvm/vmx/evmcs.c
+++ b/arch/x86/kvm/vmx/evmcs.c
@@ -332,16 +332,17 @@ int nested_enable_evmcs(struct kvm_vcpu *vcpu,
                         uint16_t *vmcs_version)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool evmcs_already_enabled = vmx->nested.enlightened_vmcs_enabled;
+
+        vmx->nested.enlightened_vmcs_enabled = true;
 
         if (vmcs_version)
                 *vmcs_version = nested_get_evmcs_version(vcpu);
 
         /* We don't support disabling the feature for simplicity. */
-        if (vmx->nested.enlightened_vmcs_enabled)
+        if (evmcs_already_enabled)
                 return 0;
 
-        vmx->nested.enlightened_vmcs_enabled = true;
-
         vmx->nested.msrs.pinbased_ctls_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
         vmx->nested.msrs.entry_ctls_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
         vmx->nested.msrs.exit_ctls_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 2616bd2c7f2c..8ff20523661b 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -55,7 +55,7 @@ static u16 shadow_read_write_fields[] = {
 static int max_shadow_read_write_fields =
         ARRAY_SIZE(shadow_read_write_fields);
 
-void init_vmcs_shadow_fields(void)
+static void init_vmcs_shadow_fields(void)
 {
         int i, j;
 
@@ -4140,11 +4140,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
         if (r < 0)
                 goto out_vmcs02;
 
-        vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
         if (!vmx->nested.cached_vmcs12)
                 goto out_cached_vmcs12;
 
-        vmx->nested.cached_shadow_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
         if (!vmx->nested.cached_shadow_vmcs12)
                 goto out_cached_shadow_vmcs12;
 
@@ -5263,13 +5263,17 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
                         copy_shadow_to_vmcs12(vmx);
         }
 
-        if (copy_to_user(user_kvm_nested_state->data, vmcs12, sizeof(*vmcs12)))
+        /*
+         * Copy over the full allocated size of vmcs12 rather than just the size
+         * of the struct.
+         */
+        if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
                 return -EFAULT;
 
         if (nested_cpu_has_shadow_vmcs(vmcs12) &&
             vmcs12->vmcs_link_pointer != -1ull) {
                 if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
-                                 get_shadow_vmcs12(vcpu), sizeof(*vmcs12)))
+                                 get_shadow_vmcs12(vcpu), VMCS12_SIZE))
                         return -EFAULT;
         }
 
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index f6915f10e584..4341175339f3 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -423,7 +423,7 @@ static void check_ept_pointer_match(struct kvm *kvm)
         to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
 }
 
-int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
+static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
                 void *data)
 {
         struct kvm_tlb_range *range = data;
@@ -1773,7 +1773,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 if (!msr_info->host_initiated &&
                     !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
                         return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
         default:
                 msr = find_msr_entry(vmx, msr_info->index);
                 if (msr) {
@@ -2014,7 +2014,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 /* Check reserved bit, higher 32 bits should be zero */
                 if ((data >> 32) != 0)
                         return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
         default:
                 msr = find_msr_entry(vmx, msr_index);
                 if (msr) {
@@ -2344,7 +2344,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
                 case 37: /* AAT100 */
                 case 44: /* BC86,AAY89,BD102 */
                 case 46: /* BA97 */
-                        _vmexit_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+                        _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
                         _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
                         pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
                                         "does not work properly. Using workaround\n");
@@ -6362,72 +6362,9 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
         vmx->loaded_vmcs->hv_timer_armed = false;
 }
 
-static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
 {
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
-        unsigned long cr3, cr4, evmcs_rsp;
-
-        /* Record the guest's net vcpu time for enforced NMI injections. */
-        if (unlikely(!enable_vnmi &&
-                     vmx->loaded_vmcs->soft_vnmi_blocked))
-                vmx->loaded_vmcs->entry_time = ktime_get();
-
-        /* Don't enter VMX if guest state is invalid, let the exit handler
-           start emulation until we arrive back to a valid state */
-        if (vmx->emulation_required)
-                return;
-
-        if (vmx->ple_window_dirty) {
-                vmx->ple_window_dirty = false;
-                vmcs_write32(PLE_WINDOW, vmx->ple_window);
-        }
-
-        if (vmx->nested.need_vmcs12_sync)
-                nested_sync_from_vmcs12(vcpu);
-
-        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
-        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
-
-        cr3 = __get_current_cr3_fast();
-        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
-                vmcs_writel(HOST_CR3, cr3);
-                vmx->loaded_vmcs->host_state.cr3 = cr3;
-        }
-
-        cr4 = cr4_read_shadow();
-        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
-                vmcs_writel(HOST_CR4, cr4);
-                vmx->loaded_vmcs->host_state.cr4 = cr4;
-        }
-
-        /* When single-stepping over STI and MOV SS, we must clear the
-         * corresponding interruptibility bits in the guest state. Otherwise
-         * vmentry fails as it then expects bit 14 (BS) in pending debug
-         * exceptions being set, but that's not correct for the guest debugging
-         * case. */
-        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
-                vmx_set_interrupt_shadow(vcpu, 0);
-
-        if (static_cpu_has(X86_FEATURE_PKU) &&
-            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
-            vcpu->arch.pkru != vmx->host_pkru)
-                __write_pkru(vcpu->arch.pkru);
-
-        pt_guest_enter(vmx);
-
-        atomic_switch_perf_msrs(vmx);
-
-        vmx_update_hv_timer(vcpu);
-
-        /*
-         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
-         * it's non-zero. Since vmentry is serialising on affected CPUs, there
-         * is no need to worry about the conditional branch over the wrmsr
-         * being speculatively taken.
-         */
-        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+        unsigned long evmcs_rsp;
 
         vmx->__launched = vmx->loaded_vmcs->launched;
 
@@ -6567,6 +6504,77 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
                 , "eax", "ebx", "edi"
 #endif
               );
+}
+STACK_FRAME_NON_STANDARD(__vmx_vcpu_run);
+
+static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        unsigned long cr3, cr4;
+
+        /* Record the guest's net vcpu time for enforced NMI injections. */
+        if (unlikely(!enable_vnmi &&
+                     vmx->loaded_vmcs->soft_vnmi_blocked))
+                vmx->loaded_vmcs->entry_time = ktime_get();
+
+        /* Don't enter VMX if guest state is invalid, let the exit handler
+           start emulation until we arrive back to a valid state */
+        if (vmx->emulation_required)
+                return;
+
+        if (vmx->ple_window_dirty) {
+                vmx->ple_window_dirty = false;
+                vmcs_write32(PLE_WINDOW, vmx->ple_window);
+        }
+
+        if (vmx->nested.need_vmcs12_sync)
+                nested_sync_from_vmcs12(vcpu);
+
+        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
+        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+
+        cr3 = __get_current_cr3_fast();
+        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
+                vmcs_writel(HOST_CR3, cr3);
+                vmx->loaded_vmcs->host_state.cr3 = cr3;
+        }
+
+        cr4 = cr4_read_shadow();
+        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
+                vmcs_writel(HOST_CR4, cr4);
+                vmx->loaded_vmcs->host_state.cr4 = cr4;
+        }
+
+        /* When single-stepping over STI and MOV SS, we must clear the
+         * corresponding interruptibility bits in the guest state. Otherwise
+         * vmentry fails as it then expects bit 14 (BS) in pending debug
+         * exceptions being set, but that's not correct for the guest debugging
+         * case. */
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+                vmx_set_interrupt_shadow(vcpu, 0);
+
+        if (static_cpu_has(X86_FEATURE_PKU) &&
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+            vcpu->arch.pkru != vmx->host_pkru)
+                __write_pkru(vcpu->arch.pkru);
+
+        pt_guest_enter(vmx);
+
+        atomic_switch_perf_msrs(vmx);
+
+        vmx_update_hv_timer(vcpu);
+
+        /*
+         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+         * it's non-zero. Since vmentry is serialising on affected CPUs, there
+         * is no need to worry about the conditional branch over the wrmsr
+         * being speculatively taken.
+         */
+        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+
+        __vmx_vcpu_run(vcpu, vmx);
 
         /*
          * We do not use IBRS in the kernel. If this vCPU has used the
@@ -6648,7 +6656,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
         vmx_recover_nmi_blocking(vmx);
         vmx_complete_interrupts(vmx);
 }
-STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
 
 static struct kvm *vmx_vm_alloc(void)
 {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02c8e095a239..3d27206f6c01 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3834,6 +3834,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
         case KVM_CAP_HYPERV_SYNIC2:
                 if (cap->args[0])
                         return -EINVAL;
+                /* fall through */
+
         case KVM_CAP_HYPERV_SYNIC:
                 if (!irqchip_in_kernel(vcpu->kvm))
                         return -EINVAL;
@@ -6480,8 +6482,7 @@ restart:
                 toggle_interruptibility(vcpu, ctxt->interruptibility);
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                 kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE &&
-                    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
+                if (r == EMULATE_DONE && ctxt->tf)
                         kvm_vcpu_do_singlestep(vcpu, &r);
                 if (!ctxt->have_exception ||
                     exception_type(ctxt->exception.vector) == EXCPT_TRAP)
@@ -7093,10 +7094,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
         case KVM_HC_CLOCK_PAIRING:
                 ret = kvm_pv_clock_pairing(vcpu, a0, a1);
                 break;
+#endif
         case KVM_HC_SEND_IPI:
                 ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
                 break;
-#endif
         default:
                 ret = -KVM_ENOSYS;
                 break;
@@ -7937,6 +7938,7 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
                 vcpu->arch.pv.pv_unhalted = false;
                 vcpu->arch.mp_state =
                         KVM_MP_STATE_RUNNABLE;
+                /* fall through */
         case KVM_MP_STATE_RUNNABLE:
                 vcpu->arch.apf.halted = false;
                 break;
diff --git a/block/blk-core.c b/block/blk-core.c
index 3c5f61ceeb67..1ccec27d20c3 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1083,7 +1083,18 @@ blk_qc_t generic_make_request(struct bio *bio)
                         /* Create a fresh bio_list for all subordinate requests */
                         bio_list_on_stack[1] = bio_list_on_stack[0];
                         bio_list_init(&bio_list_on_stack[0]);
+
+                        /*
+                         * Since we're recursing into make_request here, ensure
+                         * that we mark this bio as already having entered the queue.
+                         * If not, and the queue is going away, we can get stuck
+                         * forever on waiting for the queue reference to drop. But
+                         * that will never happen, as we're already holding a
+                         * reference to it.
+                         */
+                        bio_set_flag(bio, BIO_QUEUE_ENTERED);
                         ret = q->make_request_fn(q, bio);
+                        bio_clear_flag(bio, BIO_QUEUE_ENTERED);
 
                         /* sort new bios into those for a lower level
                          * and those for the same level
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 71e9ac03f621..d79a22f111d1 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -272,16 +272,6 @@ void blk_queue_split(struct request_queue *q, struct bio **bio)
                 /* there isn't chance to merge the splitted bio */
                 split->bi_opf |= REQ_NOMERGE;
 
-                /*
-                 * Since we're recursing into make_request here, ensure
-                 * that we mark this bio as already having entered the queue.
-                 * If not, and the queue is going away, we can get stuck
-                 * forever on waiting for the queue reference to drop. But
-                 * that will never happen, as we're already holding a
-                 * reference to it.
-                 */
-                bio_set_flag(*bio, BIO_QUEUE_ENTERED);
-
                 bio_chain(split, *bio);
                 trace_block_split(q, split, (*bio)->bi_iter.bi_sector);
                 generic_make_request(*bio);
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 90d68760af08..f8120832ca7b 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -308,8 +308,9 @@ static const char *const cmd_flag_name[] = {
         CMD_FLAG_NAME(PREFLUSH),
         CMD_FLAG_NAME(RAHEAD),
         CMD_FLAG_NAME(BACKGROUND),
-        CMD_FLAG_NAME(NOUNMAP),
         CMD_FLAG_NAME(NOWAIT),
+        CMD_FLAG_NAME(NOUNMAP),
+        CMD_FLAG_NAME(HIPRI),
 };
 #undef CMD_FLAG_NAME
 
diff --git a/block/blk-wbt.c b/block/blk-wbt.c
index f0c56649775f..fd166fbb0f65 100644
--- a/block/blk-wbt.c
+++ b/block/blk-wbt.c
@@ -597,7 +597,7 @@ static void wbt_track(struct rq_qos *rqos, struct request *rq, struct bio *bio)
         rq->wbt_flags |= bio_to_wbt_flags(rwb, bio);
 }
 
-void wbt_issue(struct rq_qos *rqos, struct request *rq)
+static void wbt_issue(struct rq_qos *rqos, struct request *rq)
 {
         struct rq_wb *rwb = RQWB(rqos);
 
@@ -617,7 +617,7 @@ void wbt_issue(struct rq_qos *rqos, struct request *rq)
         }
 }
 
-void wbt_requeue(struct rq_qos *rqos, struct request *rq)
+static void wbt_requeue(struct rq_qos *rqos, struct request *rq)
 {
         struct rq_wb *rwb = RQWB(rqos);
         if (!rwb_enabled(rwb))
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 5143e11e3b0f..e18ade5d74e9 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -409,6 +409,32 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
         return true;
 }
 
+static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+                struct nd_cmd_pkg *call_pkg)
+{
+        if (call_pkg) {
+                int i;
+
+                if (nfit_mem->family != call_pkg->nd_family)
+                        return -ENOTTY;
+
+                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+                        if (call_pkg->nd_reserved2[i])
+                                return -EINVAL;
+                return call_pkg->nd_command;
+        }
+
+        /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+        if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+                return cmd;
+
+        /*
+         * Force function number validation to fail since 0 is never
+         * published as a valid function in dsm_mask.
+         */
+        return 0;
+}
+
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
@@ -422,30 +448,23 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         unsigned long cmd_mask, dsm_mask;
         u32 offset, fw_status = 0;
         acpi_handle handle;
-        unsigned int func;
         const guid_t *guid;
-        int rc, i;
+        int func, rc, i;
 
         if (cmd_rc)
                 *cmd_rc = -EINVAL;
-        func = cmd;
-        if (cmd == ND_CMD_CALL) {
-                call_pkg = buf;
-                func = call_pkg->nd_command;
-
-                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
-                        if (call_pkg->nd_reserved2[i])
-                                return -EINVAL;
-        }
 
         if (nvdimm) {
                 struct acpi_device *adev = nfit_mem->adev;
 
                 if (!adev)
                         return -ENOTTY;
-                if (call_pkg && nfit_mem->family != call_pkg->nd_family)
-                        return -ENOTTY;
 
+                if (cmd == ND_CMD_CALL)
+                        call_pkg = buf;
+                func = cmd_to_func(nfit_mem, cmd, call_pkg);
+                if (func < 0)
+                        return func;
                 dimm_name = nvdimm_name(nvdimm);
                 cmd_name = nvdimm_cmd_name(cmd);
                 cmd_mask = nvdimm_cmd_mask(nvdimm);
@@ -456,6 +475,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         } else {
                 struct acpi_device *adev = to_acpi_dev(acpi_desc);
 
+                func = cmd;
                 cmd_name = nvdimm_bus_cmd_name(cmd);
                 cmd_mask = nd_desc->cmd_mask;
                 dsm_mask = cmd_mask;
@@ -470,7 +490,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
         if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
                 return -ENOTTY;
 
-        if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
+        /*
+         * Check for a valid command.  For ND_CMD_CALL, we also have to
+         * make sure that the DSM function is supported.
+         */
+        if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask))
+                return -ENOTTY;
+        else if (!test_bit(cmd, &cmd_mask))
                 return -ENOTTY;
 
         in_obj.type = ACPI_TYPE_PACKAGE;
@@ -1867,6 +1893,13 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                 return 0;
         }
 
+        /*
+         * Function 0 is the command interrogation function, don't
+         * export it to potential userspace use, and enable it to be
+         * used as an error value in acpi_nfit_ctl().
+         */
+        dsm_mask &= ~1UL;
+
         guid = to_nfit_uuid(nfit_mem->family);
         for_each_set_bit(i, &dsm_mask, BITS_PER_LONG)
                 if (acpi_check_dsm(adev_dimm->handle, guid,
@@ -2042,11 +2075,6 @@ static int acpi_nfit_register_dimms(struct acpi_nfit_desc *acpi_desc)
                 if (!nvdimm)
                         continue;
 
-                rc = nvdimm_security_setup_events(nvdimm);
-                if (rc < 0)
-                        dev_warn(acpi_desc->dev,
-                                "security event setup failed: %d\n", rc);
-
                 nfit_kernfs = sysfs_get_dirent(nvdimm_kobj(nvdimm)->sd, "nfit");
                 if (nfit_kernfs)
                         nfit_mem->flags_attr = sysfs_get_dirent(nfit_kernfs,
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 7496b10532aa..6a2185eb66c5 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -11,6 +11,7 @@
 #include <linux/kdev_t.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/namei.h>
 #include <linux/magic.h>
 #include <linux/major.h>
 #include <linux/miscdevice.h>
@@ -20,6 +21,7 @@
 #include <linux/parser.h>
 #include <linux/radix-tree.h>
 #include <linux/sched.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/spinlock_types.h>
 #include <linux/stddef.h>
@@ -30,7 +32,7 @@
 #include <linux/xarray.h>
 #include <uapi/asm-generic/errno-base.h>
 #include <uapi/linux/android/binder.h>
-#include <uapi/linux/android/binder_ctl.h>
+#include <uapi/linux/android/binderfs.h>
 
 #include "binder_internal.h"
 
@@ -39,14 +41,32 @@
 #define INODE_OFFSET 3
 #define INTSTRLEN 21
 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
-
-static struct vfsmount *binderfs_mnt;
+/* Ensure that the initial ipc namespace always has devices available. */
+#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 
 static dev_t binderfs_dev;
 static DEFINE_MUTEX(binderfs_minors_mutex);
 static DEFINE_IDA(binderfs_minors);
 
 /**
+ * binderfs_mount_opts - mount options for binderfs
+ * @max: maximum number of allocatable binderfs binder devices
+ */
+struct binderfs_mount_opts {
+        int max;
+};
+
+enum {
+        Opt_max,
+        Opt_err
+};
+
+static const match_table_t tokens = {
+        { Opt_max, "max=%d" },
+        { Opt_err, NULL     }
+};
+
+/**
  * binderfs_info - information about a binderfs mount
  * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
  * @control_dentry: This records the dentry of this binderfs mount
@@ -55,13 +75,16 @@ static DEFINE_IDA(binderfs_minors);
  *                  created.
  * @root_gid:       gid that needs to be used when a new binder device is
  *                  created.
+ * @mount_opts:     The mount options in use.
+ * @device_count:   The current number of allocated binder devices.
  */
 struct binderfs_info {
         struct ipc_namespace *ipc_ns;
         struct dentry *control_dentry;
         kuid_t root_uid;
         kgid_t root_gid;
-
+        struct binderfs_mount_opts mount_opts;
+        int device_count;
 };
 
 static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
@@ -84,7 +107,7 @@ bool is_binderfs_device(const struct inode *inode)
  * @userp:     buffer to copy information about new device for userspace to
  * @req:       struct binderfs_device as copied from userspace
  *
- * This function allocated a new binder_device and reserves a new minor
+ * This function allocates a new binder_device and reserves a new minor
  * number for it.
  * Minor numbers are limited and tracked globally in binderfs_minors. The
  * function will stash a struct binder_device for the specific binder
@@ -100,20 +123,34 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
                                          struct binderfs_device *req)
 {
         int minor, ret;
-        struct dentry *dentry, *dup, *root;
+        struct dentry *dentry, *root;
         struct binder_device *device;
-        size_t name_len = BINDERFS_MAX_NAME + 1;
         char *name = NULL;
+        size_t name_len;
         struct inode *inode = NULL;
         struct super_block *sb = ref_inode->i_sb;
         struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
 
         /* Reserve new minor number for the new device. */
         mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
-        mutex_unlock(&binderfs_minors_mutex);
-        if (minor < 0)
+        if (++info->device_count <= info->mount_opts.max)
+                minor = ida_alloc_max(&binderfs_minors,
+                                      use_reserve ? BINDERFS_MAX_MINOR :
+                                                    BINDERFS_MAX_MINOR_CAPPED,
+                                      GFP_KERNEL);
+        else
+                minor = -ENOSPC;
+        if (minor < 0) {
+                --info->device_count;
+                mutex_unlock(&binderfs_minors_mutex);
                 return minor;
+        }
+        mutex_unlock(&binderfs_minors_mutex);
 
         ret = -ENOMEM;
         device = kzalloc(sizeof(*device), GFP_KERNEL);
@@ -132,12 +169,13 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
         inode->i_uid = info->root_uid;
         inode->i_gid = info->root_gid;
 
-        name = kmalloc(name_len, GFP_KERNEL);
+        req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
+        name_len = strlen(req->name);
+        /* Make sure to include terminating NUL byte */
+        name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
         if (!name)
                 goto err;
 
-        strscpy(name, req->name, name_len);
-
         device->binderfs_inode = inode;
         device->context.binder_context_mgr_uid = INVALID_UID;
         device->context.name = name;
@@ -156,28 +194,25 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
 
         root = sb->s_root;
         inode_lock(d_inode(root));
-        dentry = d_alloc_name(root, name);
-        if (!dentry) {
+
+        /* look it up */
+        dentry = lookup_one_len(name, root, name_len);
+        if (IS_ERR(dentry)) {
                 inode_unlock(d_inode(root));
-                ret = -ENOMEM;
+                ret = PTR_ERR(dentry);
                 goto err;
         }
 
-        /* Verify that the name userspace gave us is not already in use. */
-        dup = d_lookup(root, &dentry->d_name);
-        if (dup) {
-                if (d_really_is_positive(dup)) {
-                        dput(dup);
-                        dput(dentry);
-                        inode_unlock(d_inode(root));
-                        ret = -EEXIST;
-                        goto err;
-                }
-                dput(dup);
+        if (d_really_is_positive(dentry)) {
+                /* already exists */
+                dput(dentry);
+                inode_unlock(d_inode(root));
+                ret = -EEXIST;
+                goto err;
         }
 
         inode->i_private = device;
-        d_add(dentry, inode);
+        d_instantiate(dentry, inode);
         fsnotify_create(root->d_inode, dentry);
         inode_unlock(d_inode(root));
 
@@ -187,6 +222,7 @@ err:
         kfree(name);
         kfree(device);
         mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
         ida_free(&binderfs_minors, minor);
         mutex_unlock(&binderfs_minors_mutex);
         iput(inode);
@@ -232,6 +268,7 @@ static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
 static void binderfs_evict_inode(struct inode *inode)
 {
         struct binder_device *device = inode->i_private;
+        struct binderfs_info *info = BINDERFS_I(inode);
 
         clear_inode(inode);
 
@@ -239,6 +276,7 @@ static void binderfs_evict_inode(struct inode *inode)
                 return;
 
         mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
         ida_free(&binderfs_minors, device->miscdev.minor);
         mutex_unlock(&binderfs_minors_mutex);
 
@@ -246,43 +284,87 @@ static void binderfs_evict_inode(struct inode *inode)
         kfree(device);
 }
 
+/**
+ * binderfs_parse_mount_opts - parse binderfs mount options
+ * @data: options to set (can be NULL in which case defaults are used)
+ */
+static int binderfs_parse_mount_opts(char *data,
+                                     struct binderfs_mount_opts *opts)
+{
+        char *p;
+        opts->max = BINDERFS_MAX_MINOR;
+
+        while ((p = strsep(&data, ",")) != NULL) {
+                substring_t args[MAX_OPT_ARGS];
+                int token;
+                int max_devices;
+
+                if (!*p)
+                        continue;
+
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_max:
+                        if (match_int(&args[0], &max_devices) ||
+                            (max_devices < 0 ||
+                             (max_devices > BINDERFS_MAX_MINOR)))
+                                return -EINVAL;
+
+                        opts->max = max_devices;
+                        break;
+                default:
+                        pr_err("Invalid mount options\n");
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int binderfs_remount(struct super_block *sb, int *flags, char *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+        return binderfs_parse_mount_opts(data, &info->mount_opts);
+}
+
+static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
+{
+        struct binderfs_info *info;
+
+        info = root->d_sb->s_fs_info;
+        if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
+                seq_printf(seq, ",max=%d", info->mount_opts.max);
+
+        return 0;
+}
+
 static const struct super_operations binderfs_super_ops = {
-        .statfs = simple_statfs,
-        .evict_inode = binderfs_evict_inode,
+        .evict_inode    = binderfs_evict_inode,
+        .remount_fs     = binderfs_remount,
+        .show_options   = binderfs_show_mount_opts,
+        .statfs         = simple_statfs,
 };
 
+static inline bool is_binderfs_control_device(const struct dentry *dentry)
+{
+        struct binderfs_info *info = dentry->d_sb->s_fs_info;
+        return info->control_dentry == dentry;
+}
+
 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                            struct inode *new_dir, struct dentry *new_dentry,
                            unsigned int flags)
 {
-        struct inode *inode = d_inode(old_dentry);
-
-        /* binderfs doesn't support directories. */
-        if (d_is_dir(old_dentry))
+        if (is_binderfs_control_device(old_dentry) ||
+            is_binderfs_control_device(new_dentry))
                 return -EPERM;
 
-        if (flags & ~RENAME_NOREPLACE)
-                return -EINVAL;
-
-        if (!simple_empty(new_dentry))
-                return -ENOTEMPTY;
-
-        if (d_really_is_positive(new_dentry))
-                simple_unlink(new_dir, new_dentry);
-
-        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
-                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
-
-        return 0;
+        return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
 }
 
 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        /*
-         * The control dentry is only ever touched during mount so checking it
-         * here should not require us to take lock.
-         */
-        if (BINDERFS_I(dir)->control_dentry == dentry)
+        if (is_binderfs_control_device(dentry))
                 return -EPERM;
 
         return simple_unlink(dir, dentry);
@@ -318,8 +400,6 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         if (!device)
                 return -ENOMEM;
 
-        inode_lock(d_inode(root));
-
         /* If we have already created a binder-control node, return. */
         if (info->control_dentry) {
                 ret = 0;
@@ -358,12 +438,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
         inode->i_private = device;
         info->control_dentry = dentry;
         d_add(dentry, inode);
-        inode_unlock(d_inode(root));
 
         return 0;
 
 out:
-        inode_unlock(d_inode(root));
         kfree(device);
         iput(inode);
 
@@ -378,12 +456,9 @@ static const struct inode_operations binderfs_dir_inode_operations = {
 
 static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 {
+        int ret;
         struct binderfs_info *info;
-        int ret = -ENOMEM;
         struct inode *inode = NULL;
-        struct ipc_namespace *ipc_ns = sb->s_fs_info;
-
-        get_ipc_ns(ipc_ns);
 
         sb->s_blocksize = PAGE_SIZE;
         sb->s_blocksize_bits = PAGE_SHIFT;
@@ -405,11 +480,17 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_op = &binderfs_super_ops;
         sb->s_time_gran = 1;
 
-        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
-        if (!info)
-                goto err_without_dentry;
+        sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        if (!sb->s_fs_info)
+                return -ENOMEM;
+        info = sb->s_fs_info;
+
+        info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
+
+        ret = binderfs_parse_mount_opts(data, &info->mount_opts);
+        if (ret)
+                return ret;
 
-        info->ipc_ns = ipc_ns;
         info->root_gid = make_kgid(sb->s_user_ns, 0);
         if (!gid_valid(info->root_gid))
                 info->root_gid = GLOBAL_ROOT_GID;
@@ -417,11 +498,9 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
         if (!uid_valid(info->root_uid))
                 info->root_uid = GLOBAL_ROOT_UID;
 
-        sb->s_fs_info = info;
-
         inode = new_inode(sb);
         if (!inode)
-                goto err_without_dentry;
+                return -ENOMEM;
 
         inode->i_ino = FIRST_INODE;
         inode->i_fop = &simple_dir_operations;
@@ -432,79 +511,28 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_root = d_make_root(inode);
         if (!sb->s_root)
-                goto err_without_dentry;
-
-        ret = binderfs_binder_ctl_create(sb);
-        if (ret)
-                goto err_with_dentry;
-
-        return 0;
-
-err_with_dentry:
-        dput(sb->s_root);
-        sb->s_root = NULL;
-
-err_without_dentry:
-        put_ipc_ns(ipc_ns);
-        iput(inode);
-        kfree(info);
-
-        return ret;
-}
-
-static int binderfs_test_super(struct super_block *sb, void *data)
-{
-        struct binderfs_info *info = sb->s_fs_info;
-
-        if (info)
-                return info->ipc_ns == data;
-
-        return 0;
-}
+                return -ENOMEM;
 
-static int binderfs_set_super(struct super_block *sb, void *data)
-{
-        sb->s_fs_info = data;
-        return set_anon_super(sb, NULL);
+        return binderfs_binder_ctl_create(sb);
 }
 
 static struct dentry *binderfs_mount(struct file_system_type *fs_type,
                                      int flags, const char *dev_name,
                                      void *data)
 {
-        struct super_block *sb;
-        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
-
-        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
-                return ERR_PTR(-EPERM);
-
-        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
-                         flags, ipc_ns->user_ns, ipc_ns);
-        if (IS_ERR(sb))
-                return ERR_CAST(sb);
-
-        if (!sb->s_root) {
-                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
-                if (ret) {
-                        deactivate_locked_super(sb);
-                        return ERR_PTR(ret);
-                }
-
-                sb->s_flags |= SB_ACTIVE;
-        }
-
-        return dget(sb->s_root);
+        return mount_nodev(fs_type, flags, data, binderfs_fill_super);
 }
 
 static void binderfs_kill_super(struct super_block *sb)
 {
         struct binderfs_info *info = sb->s_fs_info;
 
+        kill_litter_super(sb);
+
         if (info && info->ipc_ns)
                 put_ipc_ns(info->ipc_ns);
 
         kfree(info);
-        kill_litter_super(sb);
 }
 
 static struct file_system_type binder_fs_type = {
@@ -530,14 +558,6 @@ static int __init init_binderfs(void)
                 return ret;
         }
 
-        binderfs_mnt = kern_mount(&binder_fs_type);
-        if (IS_ERR(binderfs_mnt)) {
-                ret = PTR_ERR(binderfs_mnt);
-                binderfs_mnt = NULL;
-                unregister_filesystem(&binder_fs_type);
-                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
-        }
-
         return ret;
 }
 
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
index 8cc9c429ad95..9e7fc302430f 100644
--- a/drivers/ata/pata_macio.c
+++ b/drivers/ata/pata_macio.c
@@ -915,6 +915,10 @@ static struct scsi_host_template pata_macio_sht = {
         .sg_tablesize           = MAX_DCMDS,
         /* We may not need that strict one */
         .dma_boundary           = ATA_DMA_BOUNDARY,
+        /* Not sure what the real max is but we know it's less than 64K, let's
+         * use 64K minus 256
+         */
+        .max_segment_size       = MAX_DBDMA_SEG,
         .slave_configure        = pata_macio_slave_config,
 };
 
@@ -1044,11 +1048,6 @@ static int pata_macio_common_init(struct pata_macio_priv *priv,
         /* Make sure we have sane initial timings in the cache */
         pata_macio_default_timings(priv);
 
-        /* Not sure what the real max is but we know it's less than 64K, let's
-         * use 64K minus 256
-         */
-        dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG);
-
         /* Allocate libata host for 1 port */
         memset(&pinfo, 0, sizeof(struct ata_port_info));
         pmac_macio_calc_timing_masks(priv, &pinfo);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e0bcf9b2dab0..174e84ce4379 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -245,8 +245,15 @@ struct inic_port_priv {
 
 static struct scsi_host_template inic_sht = {
         ATA_BASE_SHT(DRV_NAME),
-        .sg_tablesize   = LIBATA_MAX_PRD,       /* maybe it can be larger? */
-        .dma_boundary   = INIC_DMA_BOUNDARY,
+        .sg_tablesize           = LIBATA_MAX_PRD, /* maybe it can be larger? */
+
+        /*
+         * This controller is braindamaged.  dma_boundary is 0xffff like others
+         * but it will lock up the whole machine HARD if 65536 byte PRD entry
+         * is fed.  Reduce maximum segment size.
+         */
+        .dma_boundary           = INIC_DMA_BOUNDARY,
+        .max_segment_size       = 65536 - 512,
 };
 
 static const int scr_map[] = {
@@ -868,17 +875,6 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return rc;
         }
 
-        /*
-         * This controller is braindamaged.  dma_boundary is 0xffff
-         * like others but it will lock up the whole machine HARD if
-         * 65536 byte PRD entry is fed. Reduce maximum segment size.
-         */
-        rc = dma_set_max_seg_size(&pdev->dev, 65536 - 512);
-        if (rc) {
-                dev_err(&pdev->dev, "failed to set the maximum segment size\n");
-                return rc;
-        }
-
         rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
         if (rc) {
                 dev_err(&pdev->dev, "failed to initialize controller\n");
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index a74ce885b541..c518659b4d9f 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -32,6 +32,7 @@
 #include <linux/moduleparam.h>
 #include <linux/workqueue.h>
 #include <linux/uuid.h>
+#include <linux/nospec.h>
 
 #define IPMI_DRIVER_VERSION "39.2"
 
@@ -62,7 +63,8 @@ static void ipmi_debug_msg(const char *title, unsigned char *data,
 { }
 #endif
 
-static int initialized;
+static bool initialized;
+static bool drvregistered;
 
 enum ipmi_panic_event_op {
         IPMI_SEND_PANIC_EVENT_NONE,
@@ -612,7 +614,7 @@ static DEFINE_MUTEX(ipmidriver_mutex);
 
 static LIST_HEAD(ipmi_interfaces);
 static DEFINE_MUTEX(ipmi_interfaces_mutex);
-DEFINE_STATIC_SRCU(ipmi_interfaces_srcu);
+struct srcu_struct ipmi_interfaces_srcu;
 
 /*
  * List of watchers that want to know when smi's are added and deleted.
@@ -720,7 +722,15 @@ struct watcher_entry {
 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 {
         struct ipmi_smi *intf;
-        int index;
+        int index, rv;
+
+        /*
+         * Make sure the driver is actually initialized, this handles
+         * problems with initialization order.
+         */
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         mutex_lock(&smi_watchers_mutex);
 
@@ -884,7 +894,7 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
 
                 if (user) {
                         user->handler->ipmi_recv_hndl(msg, user->handler_data);
-                        release_ipmi_user(msg->user, index);
+                        release_ipmi_user(user, index);
                 } else {
                         /* User went away, give up. */
                         ipmi_free_recv_msg(msg);
@@ -1076,7 +1086,7 @@ int ipmi_create_user(unsigned int          if_num,
 {
         unsigned long flags;
         struct ipmi_user *new_user;
-        int           rv = 0, index;
+        int           rv, index;
         struct ipmi_smi *intf;
 
         /*
@@ -1094,18 +1104,9 @@ int ipmi_create_user(unsigned int          if_num,
          * Make sure the driver is actually initialized, this handles
          * problems with initialization order.
          */
-        if (!initialized) {
-                rv = ipmi_init_msghandler();
-                if (rv)
-                        return rv;
-
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
         if (!new_user)
@@ -1183,6 +1184,7 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+        cleanup_srcu_struct(&user->release_barrier);
         kfree(user);
 }
 
@@ -1259,7 +1261,6 @@ int ipmi_destroy_user(struct ipmi_user *user)
 {
         _ipmi_destroy_user(user);
 
-        cleanup_srcu_struct(&user->release_barrier);
         kref_put(&user->refcount, free_user);
 
         return 0;
@@ -1298,10 +1299,12 @@ int ipmi_set_my_address(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 user->intf->addrinfo[channel].address = address;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1318,10 +1321,12 @@ int ipmi_get_my_address(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 *address = user->intf->addrinfo[channel].address;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1338,10 +1343,12 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 user->intf->addrinfo[channel].lun = LUN & 0x3;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -1358,10 +1365,12 @@ int ipmi_get_my_LUN(struct ipmi_user *user,
         if (!user)
                 return -ENODEV;
 
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                 rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                 *address = user->intf->addrinfo[channel].lun;
+        }
         release_ipmi_user(user, index);
 
         return rv;
@@ -2184,6 +2193,7 @@ static int check_addr(struct ipmi_smi  *intf,
 {
         if (addr->channel >= IPMI_MAX_CHANNELS)
                 return -EINVAL;
+        addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
         *lun = intf->addrinfo[addr->channel].lun;
         *saddr = intf->addrinfo[addr->channel].address;
         return 0;
@@ -3291,17 +3301,9 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
          * Make sure the driver is actually initialized, this handles
          * problems with initialization order.
          */
-        if (!initialized) {
-                rv = ipmi_init_msghandler();
-                if (rv)
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
 
         intf = kzalloc(sizeof(*intf), GFP_KERNEL);
         if (!intf)
@@ -5017,6 +5019,22 @@ static int panic_event(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
+/* Must be called with ipmi_interfaces_mutex held. */
+static int ipmi_register_driver(void)
+{
+        int rv;
+
+        if (drvregistered)
+                return 0;
+
+        rv = driver_register(&ipmidriver.driver);
+        if (rv)
+                pr_err("Could not register IPMI driver\n");
+        else
+                drvregistered = true;
+        return rv;
+}
+
 static struct notifier_block panic_block = {
         .notifier_call  = panic_event,
         .next           = NULL,
@@ -5027,66 +5045,75 @@ static int ipmi_init_msghandler(void)
 {
         int rv;
 
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        if (rv)
+                goto out;
         if (initialized)
-                return 0;
-
-        rv = driver_register(&ipmidriver.driver);
-        if (rv) {
-                pr_err("Could not register IPMI driver\n");
-                return rv;
-        }
+                goto out;
 
-        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        init_srcu_struct(&ipmi_interfaces_srcu);
 
         timer_setup(&ipmi_timer, ipmi_timeout, 0);
         mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
 
         atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
 
-        initialized = 1;
+        initialized = true;
 
-        return 0;
+out:
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 
 static int __init ipmi_init_msghandler_mod(void)
 {
-        ipmi_init_msghandler();
-        return 0;
+        int rv;
+
+        pr_info("version " IPMI_DRIVER_VERSION "\n");
+
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        mutex_unlock(&ipmi_interfaces_mutex);
+
+        return rv;
 }
 
 static void __exit cleanup_ipmi(void)
 {
         int count;
 
-        if (!initialized)
-                return;
-
-        atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
+        if (initialized) {
+                atomic_notifier_chain_unregister(&panic_notifier_list,
+                                                 &panic_block);
 
-        /*
-         * This can't be called if any interfaces exist, so no worry
-         * about shutting down the interfaces.
-         */
+                /*
+                 * This can't be called if any interfaces exist, so no worry
+                 * about shutting down the interfaces.
+                 */
 
-        /*
-         * Tell the timer to stop, then wait for it to stop.  This
-         * avoids problems with race conditions removing the timer
-         * here.
-         */
-        atomic_inc(&stop_operation);
-        del_timer_sync(&ipmi_timer);
+                /*
+                 * Tell the timer to stop, then wait for it to stop.  This
+                 * avoids problems with race conditions removing the timer
+                 * here.
+                 */
+                atomic_inc(&stop_operation);
+                del_timer_sync(&ipmi_timer);
 
-        driver_unregister(&ipmidriver.driver);
+                initialized = false;
 
-        initialized = 0;
+                /* Check for buffer leaks. */
+                count = atomic_read(&smi_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("SMI message count %d at exit\n", count);
+                count = atomic_read(&recv_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("recv message count %d at exit\n", count);
 
-        /* Check for buffer leaks. */
-        count = atomic_read(&smi_msg_inuse_count);
-        if (count != 0)
-                pr_warn("SMI message count %d at exit\n", count);
-        count = atomic_read(&recv_msg_inuse_count);
-        if (count != 0)
-                pr_warn("recv message count %d at exit\n", count);
+                cleanup_srcu_struct(&ipmi_interfaces_srcu);
+        }
+        if (drvregistered)
+                driver_unregister(&ipmidriver.driver);
 }
 module_exit(cleanup_ipmi);
 
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index ca9528c4f183..b7a1ae2afaea 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -632,8 +632,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
 
                 /* Remove the multi-part read marker. */
                 len -= 2;
+                data += 2;
                 for (i = 0; i < len; i++)
-                        ssif_info->data[i] = data[i+2];
+                        ssif_info->data[i] = data[i];
                 ssif_info->multi_len = len;
                 ssif_info->multi_pos = 1;
 
@@ -661,8 +662,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 }
 
                 blocknum = data[0];
+                len--;
+                data++;
+
+                if (blocknum != 0xff && len != 31) {
+                    /* All blocks but the last must have 31 data bytes. */
+                        result = -EIO;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Received middle message <31\n");
 
-                if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) {
+                        goto continue_op;
+                }
+
+                if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) {
                         /* Received message too big, abort the operation. */
                         result = -E2BIG;
                         if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
@@ -671,16 +683,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                         goto continue_op;
                 }
 
-                /* Remove the blocknum from the data. */
-                len--;
                 for (i = 0; i < len; i++)
-                        ssif_info->data[i + ssif_info->multi_len] = data[i + 1];
+                        ssif_info->data[i + ssif_info->multi_len] = data[i];
                 ssif_info->multi_len += len;
                 if (blocknum == 0xff) {
                         /* End of read */
                         len = ssif_info->multi_len;
                         data = ssif_info->data;
-                } else if (blocknum + 1 != ssif_info->multi_pos) {
+                } else if (blocknum != ssif_info->multi_pos) {
                         /*
                          * Out of sequence block, just abort.  Block
                          * numbers start at zero for the second block,
@@ -707,6 +717,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 }
         }
 
+ continue_op:
         if (result < 0) {
                 ssif_inc_stat(ssif_info, receive_errors);
         } else {
@@ -714,8 +725,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                 ssif_inc_stat(ssif_info, received_message_parts);
         }
 
-
- continue_op:
         if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
                 pr_info("DONE 1: state = %d, result=%d\n",
                         ssif_info->ssif_state, result);
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index b5e3103c1175..e43c876a9223 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -59,6 +59,7 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/serial_8250.h>
+#include <linux/nospec.h>
 #include "smapi.h"
 #include "mwavedd.h"
 #include "3780i.h"
@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         PRINTK_3(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
                                 " ipcnum %x entry usIntCount %x\n",
@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 " Invalid ipcnum %x\n", ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         PRINTK_3(TRACE_MWAVE,
                                 "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC"
                                 " ipcnum %x, usIntCount %x\n",
@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                 ipcnum);
                                 return -EINVAL;
                         }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                         mutex_lock(&mwave_mutex);
                         if (pDrvData->IPCs[ipcnum].bIsEnabled == true) {
                                 pDrvData->IPCs[ipcnum].bIsEnabled = false;
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index e5b2fe80eab4..d2f0bb5ba47e 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -293,7 +293,6 @@ config COMMON_CLK_BD718XX
 source "drivers/clk/actions/Kconfig"
 source "drivers/clk/bcm/Kconfig"
 source "drivers/clk/hisilicon/Kconfig"
-source "drivers/clk/imx/Kconfig"
 source "drivers/clk/imgtec/Kconfig"
 source "drivers/clk/imx/Kconfig"
 source "drivers/clk/ingenic/Kconfig"
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 5b393e711e94..7d16ab0784ec 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
 
                 if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
                         src = VC5_PRIM_SRC_SHDN_EN_XTAL;
-                if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+                else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
                         src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
+                else /* Invalid; should have been caught by vc5_probe() */
+                        return -EINVAL;
         }
 
         return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 75d13c0eff12..6ccdbedb02f3 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2779,7 +2779,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
         seq_printf(s, "\"protect_count\": %d,", c->protect_count);
         seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
         seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
-        seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
+        seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
         seq_printf(s, "\"duty_cycle\": %u",
                    clk_core_get_scaled_duty_cycle(c, 100000));
 }
diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
index 99c2508de8e5..fb6edf1b8aa2 100644
--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
+++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
@@ -169,6 +169,8 @@ static int imx8qxp_lpcg_clk_probe(struct platform_device *pdev)
                 return -ENODEV;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
         base = devm_ioremap(dev, res->start, resource_size(res));
         if (!base)
                 return -ENOMEM;
diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index 1b1ba54e33dd..1c04575c118f 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -215,6 +215,7 @@ config MSM_MMCC_8996
 
 config MSM_GCC_8998
         tristate "MSM8998 Global Clock Controller"
+        select QCOM_GDSC
         help
           Support for the global clock controller on msm8998 devices.
           Say Y if you want to use peripheral devices such as UART, SPI,
diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
index 2d5d8b43727e..c4d0b6f6abf2 100644
--- a/drivers/clk/socfpga/clk-pll-s10.c
+++ b/drivers/clk/socfpga/clk-pll-s10.c
@@ -43,7 +43,7 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
         /* Read mdiv and fdiv from the fdbck register */
         reg = readl(socfpgaclk->hw.reg + 0x4);
         mdiv = (reg & SOCFPGA_PLL_MDIV_MASK) >> SOCFPGA_PLL_MDIV_SHIFT;
-        vco_freq = (unsigned long long)parent_rate * (mdiv + 6);
+        vco_freq = (unsigned long long)vco_freq * (mdiv + 6);
 
         return (unsigned long)vco_freq;
 }
diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
index 5b238fc314ac..8281dfbf38c2 100644
--- a/drivers/clk/socfpga/clk-s10.c
+++ b/drivers/clk/socfpga/clk-s10.c
@@ -12,17 +12,17 @@
 
 #include "stratix10-clk.h"
 
-static const char * const pll_mux[] = { "osc1", "cb_intosc_hs_div2_clk",
-                                        "f2s_free_clk",};
+static const char * const pll_mux[] = { "osc1", "cb-intosc-hs-div2-clk",
+                                        "f2s-free-clk",};
 static const char * const cntr_mux[] = { "main_pll", "periph_pll",
-                                         "osc1", "cb_intosc_hs_div2_clk",
-                                         "f2s_free_clk"};
-static const char * const boot_mux[] = { "osc1", "cb_intosc_hs_div2_clk",};
+                                         "osc1", "cb-intosc-hs-div2-clk",
+                                         "f2s-free-clk"};
+static const char * const boot_mux[] = { "osc1", "cb-intosc-hs-div2-clk",};
 
 static const char * const noc_free_mux[] = {"main_noc_base_clk",
                                             "peri_noc_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
-                                            "f2s_free_clk"};
+                                            "osc1", "cb-intosc-hs-div2-clk",
+                                            "f2s-free-clk"};
 
 static const char * const emaca_free_mux[] = {"peri_emaca_clk", "boot_clk"};
 static const char * const emacb_free_mux[] = {"peri_emacb_clk", "boot_clk"};
@@ -33,14 +33,14 @@ static const char * const s2f_usr1_free_mux[] = {"peri_s2f_usr1_clk", "boot_clk"
 static const char * const psi_ref_free_mux[] = {"peri_psi_ref_clk", "boot_clk"};
 static const char * const mpu_mux[] = { "mpu_free_clk", "boot_clk",};
 
-static const char * const s2f_usr0_mux[] = {"f2s_free_clk", "boot_clk"};
+static const char * const s2f_usr0_mux[] = {"f2s-free-clk", "boot_clk"};
 static const char * const emac_mux[] = {"emaca_free_clk", "emacb_free_clk"};
 static const char * const noc_mux[] = {"noc_free_clk", "boot_clk"};
 
 static const char * const mpu_free_mux[] = {"main_mpu_base_clk",
                                             "peri_mpu_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
-                                            "f2s_free_clk"};
+                                            "osc1", "cb-intosc-hs-div2-clk",
+                                            "f2s-free-clk"};
 
 /* clocks in AO (always on) controller */
 static const struct stratix10_pll_clock s10_pll_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
index 269d3595758b..edc31bb56674 100644
--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
         struct tegra_dfll_soc_data *soc;
 
         soc = tegra_dfll_unregister(pdev);
-        if (IS_ERR(soc))
+        if (IS_ERR(soc)) {
                 dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
                         PTR_ERR(soc));
+                return PTR_ERR(soc);
+        }
 
         tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
 
diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c
index f65cc0ff76ab..b0908ec62f73 100644
--- a/drivers/clk/zynqmp/clkc.c
+++ b/drivers/clk/zynqmp/clkc.c
@@ -669,8 +669,8 @@ static int zynqmp_clk_setup(struct device_node *np)
         if (ret)
                 return ret;
 
-        zynqmp_data = kzalloc(sizeof(*zynqmp_data) + sizeof(*zynqmp_data) *
-                                                clock_max_idx, GFP_KERNEL);
+        zynqmp_data = kzalloc(struct_size(zynqmp_data, hws, clock_max_idx),
+                              GFP_KERNEL);
         if (!zynqmp_data)
                 return -ENOMEM;
 
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 09b845e90114..a785ffd5af89 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1144,10 +1144,6 @@ static int sbp2_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
         if (device->is_local)
                 return -ENODEV;
 
-        if (dma_get_max_seg_size(device->card->device) > SBP2_MAX_SEG_SIZE)
-                WARN_ON(dma_set_max_seg_size(device->card->device,
-                                             SBP2_MAX_SEG_SIZE));
-
         shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
         if (shost == NULL)
                 return -ENOMEM;
@@ -1610,6 +1606,7 @@ static struct scsi_host_template scsi_driver_template = {
         .eh_abort_handler       = sbp2_scsi_abort,
         .this_id                = -1,
         .sg_tablesize           = SG_ALL,
+        .max_segment_size       = SBP2_MAX_SEG_SIZE,
         .can_queue              = 1,
         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index a028661d9e20..92b11de19581 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -576,6 +576,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
index b8747a5c9204..99d596dc0e89 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
@@ -32,6 +32,7 @@
 #include "vega10_pptable.h"
 
 #define NUM_DSPCLK_LEVELS 8
+#define VEGA10_ENGINECLOCK_HARDMAX 198000
 
 static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
                 enum phm_platform_caps cap)
@@ -258,7 +259,26 @@ static int init_over_drive_limits(
                 struct pp_hwmgr *hwmgr,
                 const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
-        hwmgr->platform_descriptor.overdriveLimit.engineClock =
+        const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
+                        (const ATOM_Vega10_GFXCLK_Dependency_Table *)
+                        (((unsigned long) powerplay_table) +
+                        le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
+        bool is_acg_enabled = false;
+        ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
+
+        if (gfxclk_dep_table->ucRevId == 1) {
+                patom_record_v2 =
+                        (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
+                is_acg_enabled =
+                        (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
+        }
+
+        if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
+                !is_acg_enabled)
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
+                        VEGA10_ENGINECLOCK_HARDMAX;
+        else
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
                         le32_to_cpu(powerplay_table->ulMaxODEngineClock);
         hwmgr->platform_descriptor.overdriveLimit.memoryClock =
                         le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 5567ddc7760f..55bb7885e228 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -332,6 +332,9 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 
         i915_gem_object_unpin_map(wa_ctx->indirect_ctx.obj);
         i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+
+        wa_ctx->indirect_ctx.obj = NULL;
+        wa_ctx->indirect_ctx.shadow_va = NULL;
 }
 
 static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
@@ -911,11 +914,6 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
         list_del_init(&workload->list);
 
-        if (!workload->status) {
-                release_shadow_batch_buffer(workload);
-                release_shadow_wa_ctx(&workload->wa_ctx);
-        }
-
         if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
                 /* if workload->status is not successful means HW GPU
                  * has occurred GPU hang or something wrong with i915/GVT,
@@ -1283,6 +1281,9 @@ void intel_vgpu_destroy_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu_submission *s = &workload->vgpu->submission;
 
+        release_shadow_batch_buffer(workload);
+        release_shadow_wa_ctx(&workload->wa_ctx);
+
         if (workload->shadow_mm)
                 intel_vgpu_mm_put(workload->shadow_mm);
 
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 4796f40a6d4f..eab9341a5152 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -303,6 +303,7 @@ static void __unwind_incomplete_requests(struct intel_engine_cs *engine)
          */
         if (!(prio & I915_PRIORITY_NEWCLIENT)) {
                 prio |= I915_PRIORITY_NEWCLIENT;
+                active->sched.attr.priority = prio;
                 list_move_tail(&active->sched.link,
                                i915_sched_lookup_priolist(engine, prio));
         }
@@ -645,6 +646,9 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
                 int i;
 
                 priolist_for_each_request_consume(rq, rn, p, i) {
+                        GEM_BUG_ON(last &&
+                                   need_preempt(engine, last, rq_prio(rq)));
+
                         /*
                          * Can we combine this request with the current port?
                          * It has to be the same context/ringbuffer and not
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 5beb83d1cf87..ce1b3cc4bf6d 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -944,7 +944,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
         np = dev_pm_opp_get_of_node(opp);
 
         if (np) {
-                of_property_read_u32(np, "qcom,level", &val);
+                of_property_read_u32(np, "opp-level", &val);
                 of_node_put(np);
         }
 
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 2e4372ef17a3..2cfee1a4fe0b 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -765,7 +765,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         adreno_gpu->rev = config->rev;
 
         adreno_gpu_config.ioname = "kgsl_3d0_reg_memory";
-        adreno_gpu_config.irqname = "kgsl_3d0_irq";
 
         adreno_gpu_config.va_start = SZ_16M;
         adreno_gpu_config.va_end = 0xffffffff;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index fd75870eb17f..6aefcd6db46b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -365,19 +365,6 @@ static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane,
                         &pdpu->pipe_qos_cfg);
 }
 
-static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
-{
-        struct dpu_plane *pdpu = to_dpu_plane(plane);
-        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
-
-        if (!pdpu->is_rt_pipe)
-                return;
-
-        pm_runtime_get_sync(&dpu_kms->pdev->dev);
-        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
-        pm_runtime_put_sync(&dpu_kms->pdev->dev);
-}
-
 /**
  * _dpu_plane_set_ot_limit - set OT limit for the given plane
  * @plane:              Pointer to drm plane
@@ -1248,6 +1235,19 @@ static void dpu_plane_reset(struct drm_plane *plane)
 }
 
 #ifdef CONFIG_DEBUG_FS
+static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
+{
+        struct dpu_plane *pdpu = to_dpu_plane(plane);
+        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+
+        if (!pdpu->is_rt_pipe)
+                return;
+
+        pm_runtime_get_sync(&dpu_kms->pdev->dev);
+        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
+        pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
+
 static ssize_t _dpu_plane_danger_read(struct file *file,
                         char __user *buff, size_t count, loff_t *ppos)
 {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 9cd6a96c6bf2..927e5d86f7c1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -250,7 +250,8 @@ void msm_gem_purge_vma(struct msm_gem_address_space *aspace,
 void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma);
 int msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages);
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages);
 void msm_gem_close_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma);
 
@@ -333,6 +334,7 @@ void msm_gem_kernel_put(struct drm_gem_object *bo,
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
                 struct dma_buf *dmabuf, struct sg_table *sgt);
 
+__printf(2, 3)
 void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
 
 int msm_framebuffer_prepare(struct drm_framebuffer *fb,
@@ -396,12 +398,14 @@ void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m);
 int msm_debugfs_late_init(struct drm_device *dev);
 int msm_rd_debugfs_init(struct drm_minor *minor);
 void msm_rd_debugfs_cleanup(struct msm_drm_private *priv);
+__printf(3, 4)
 void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                 const char *fmt, ...);
 int msm_perf_debugfs_init(struct drm_minor *minor);
 void msm_perf_debugfs_cleanup(struct msm_drm_private *priv);
 #else
 static inline int msm_debugfs_late_init(struct drm_device *dev) { return 0; }
+__printf(3, 4)
 static inline void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                 const char *fmt, ...) {}
 static inline void msm_rd_debugfs_cleanup(struct msm_drm_private *priv) {}
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 51a95da694d8..c8886d3071fa 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -391,6 +391,10 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
         struct msm_gem_vma *vma;
         struct page **pages;
+        int prot = IOMMU_READ;
+
+        if (!(msm_obj->flags & MSM_BO_GPU_READONLY))
+                prot |= IOMMU_WRITE;
 
         WARN_ON(!mutex_is_locked(&msm_obj->lock));
 
@@ -405,8 +409,8 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
         if (IS_ERR(pages))
                 return PTR_ERR(pages);
 
-        return msm_gem_map_vma(aspace, vma, msm_obj->sgt,
-                        obj->size >> PAGE_SHIFT);
+        return msm_gem_map_vma(aspace, vma, prot,
+                        msm_obj->sgt, obj->size >> PAGE_SHIFT);
 }
 
 /* get iova and pin it. Should have a matching put */
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 557360788084..49c04829cf34 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -68,7 +68,8 @@ void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
 
 int
 msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages)
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages)
 {
         unsigned size = npages << PAGE_SHIFT;
         int ret = 0;
@@ -86,7 +87,7 @@ msm_gem_map_vma(struct msm_gem_address_space *aspace,
 
         if (aspace->mmu)
                 ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt,
-                                size, IOMMU_READ | IOMMU_WRITE);
+                                size, prot);
 
         if (ret)
                 vma->mapped = false;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 5f3eff304355..10babd18e286 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -900,7 +900,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         }
 
         /* Get Interrupt: */
-        gpu->irq = platform_get_irq_byname(pdev, config->irqname);
+        gpu->irq = platform_get_irq(pdev, 0);
         if (gpu->irq < 0) {
                 ret = gpu->irq;
                 DRM_DEV_ERROR(drm->dev, "failed to get irq: %d\n", ret);
diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
index efb49bb64191..ca17086f72c9 100644
--- a/drivers/gpu/drm/msm/msm_gpu.h
+++ b/drivers/gpu/drm/msm/msm_gpu.h
@@ -31,7 +31,6 @@ struct msm_gpu_state;
 
 struct msm_gpu_config {
         const char *ioname;
-        const char *irqname;
         uint64_t va_start;
         uint64_t va_end;
         unsigned int nr_rings;
@@ -63,7 +62,7 @@ struct msm_gpu_funcs {
         struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
         void (*recover)(struct msm_gpu *gpu);
         void (*destroy)(struct msm_gpu *gpu);
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
         /* show GPU status in debugfs: */
         void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
                         struct drm_printer *p);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 90e9d0a48dc0..d21172933d92 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
                 char *fptr = &fifo->buf[fifo->head];
                 int n;
 
-                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
+                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
+                if (!rd->open)
+                        return;
 
                 /* Note that smp_load_acquire() is not strictly required
                  * as CIRC_SPACE_TO_END() does not access the tail more
@@ -213,7 +215,10 @@ out:
 static int rd_release(struct inode *inode, struct file *file)
 {
         struct msm_rd_state *rd = inode->i_private;
+
         rd->open = false;
+        wake_up_all(&rd->fifo_event);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 061d2e0d9011..416da5376701 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
         val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
         val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
         writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+
+        clk_disable_unprepare(hdmi->tmds_clk);
 }
 
 static void sun4i_hdmi_enable(struct drm_encoder *encoder)
@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
 
+        clk_prepare_enable(hdmi->tmds_clk);
+
         sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
         val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
         val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f41d5fe51abe..9993b692598f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -125,6 +125,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 {
         struct hid_collection *collection;
         unsigned usage;
+        int collection_index;
 
         usage = parser->local.usage[0];
 
@@ -167,13 +168,13 @@ static int open_collection(struct hid_parser *parser, unsigned type)
         parser->collection_stack[parser->collection_stack_ptr++] =
                 parser->device->maxcollection;
 
-        collection = parser->device->collection +
-                parser->device->maxcollection++;
+        collection_index = parser->device->maxcollection++;
+        collection = parser->device->collection + collection_index;
         collection->type = type;
         collection->usage = usage;
         collection->level = parser->collection_stack_ptr - 1;
-        collection->parent = parser->active_collection;
-        parser->active_collection = collection;
+        collection->parent_idx = (collection->level == 0) ? -1 :
+                parser->collection_stack[collection->level - 1];
 
         if (type == HID_COLLECTION_APPLICATION)
                 parser->device->maxapplication++;
@@ -192,8 +193,6 @@ static int close_collection(struct hid_parser *parser)
                 return -EINVAL;
         }
         parser->collection_stack_ptr--;
-        if (parser->active_collection)
-                parser->active_collection = parser->active_collection->parent;
         return 0;
 }
 
@@ -1006,10 +1005,12 @@ static void hid_apply_multiplier_to_field(struct hid_device *hid,
                 usage = &field->usage[i];
 
                 collection = &hid->collection[usage->collection_index];
-                while (collection && collection != multiplier_collection)
-                        collection = collection->parent;
+                while (collection->parent_idx != -1 &&
+                       collection != multiplier_collection)
+                        collection = &hid->collection[collection->parent_idx];
 
-                if (collection || multiplier_collection == NULL)
+                if (collection->parent_idx != -1 ||
+                    multiplier_collection == NULL)
                         usage->resolution_multiplier = effective_multiplier;
 
         }
@@ -1044,9 +1045,9 @@ static void hid_apply_multiplier(struct hid_device *hid,
          * applicable fields later.
          */
         multiplier_collection = &hid->collection[multiplier->usage->collection_index];
-        while (multiplier_collection &&
+        while (multiplier_collection->parent_idx != -1 &&
                multiplier_collection->type != HID_COLLECTION_LOGICAL)
-                multiplier_collection = multiplier_collection->parent;
+                multiplier_collection = &hid->collection[multiplier_collection->parent_idx];
 
         effective_multiplier = hid_calculate_multiplier(hid, multiplier);
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 518fa76414f5..24f846d67478 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -461,6 +461,9 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
 
+#define I2C_VENDOR_ID_GOODIX            0x27c6
+#define I2C_DEVICE_ID_GOODIX_01F0       0x01f0
+
 #define USB_VENDOR_ID_GOODTOUCH         0x1aad
 #define USB_DEVICE_ID_GOODTOUCH_000f    0x000f
 
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 8555ce7e737b..c5edfa966343 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks {
                 I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
         { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
                 I2C_HID_QUIRK_NO_RUNTIME_PM },
+        { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
         { 0, 0 }
 };
 
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index ce0ba2062723..bea4c9850247 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -701,19 +701,12 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
 int vmbus_disconnect_ring(struct vmbus_channel *channel)
 {
         struct vmbus_channel *cur_channel, *tmp;
-        unsigned long flags;
-        LIST_HEAD(list);
         int ret;
 
         if (channel->primary_channel != NULL)
                 return -EINVAL;
 
-        /* Snapshot the list of subchannels */
-        spin_lock_irqsave(&channel->lock, flags);
-        list_splice_init(&channel->sc_list, &list);
-        spin_unlock_irqrestore(&channel->lock, flags);
-
-        list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
+        list_for_each_entry_safe(cur_channel, tmp, &channel->sc_list, sc_list) {
                 if (cur_channel->rescind)
                         wait_for_completion(&cur_channel->rescind_event);
 
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index 5301fef16c31..7c6349a50ef1 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -888,12 +888,14 @@ static unsigned long handle_pg_range(unsigned long pg_start,
                         pfn_cnt -= pgs_ol;
                         /*
                          * Check if the corresponding memory block is already
-                         * online by checking its last previously backed page.
-                         * In case it is we need to bring rest (which was not
-                         * backed previously) online too.
+                         * online. It is possible to observe struct pages still
+                         * being uninitialized here so check section instead.
+                         * In case the section is online we need to bring the
+                         * rest of pfns (which were not backed previously)
+                         * online too.
                          */
                         if (start_pfn > has->start_pfn &&
-                            !PageReserved(pfn_to_page(start_pfn - 1)))
+                            online_section_nr(pfn_to_section_nr(start_pfn)))
                                 hv_bring_pgs_online(has, start_pfn, pgs_ol);
 
                 }
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 64d0c85d5161..1f1a55e07733 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -164,26 +164,25 @@ hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
 }
 
 /* Get various debug metrics for the specified ring buffer. */
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                                 struct hv_ring_buffer_debug_info *debug_info)
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+                                struct hv_ring_buffer_debug_info *debug_info)
 {
         u32 bytes_avail_towrite;
         u32 bytes_avail_toread;
 
-        if (ring_info->ring_buffer) {
-                hv_get_ringbuffer_availbytes(ring_info,
-                                        &bytes_avail_toread,
-                                        &bytes_avail_towrite);
-
-                debug_info->bytes_avail_toread = bytes_avail_toread;
-                debug_info->bytes_avail_towrite = bytes_avail_towrite;
-                debug_info->current_read_index =
-                        ring_info->ring_buffer->read_index;
-                debug_info->current_write_index =
-                        ring_info->ring_buffer->write_index;
-                debug_info->current_interrupt_mask =
-                        ring_info->ring_buffer->interrupt_mask;
-        }
+        if (!ring_info->ring_buffer)
+                return -EINVAL;
+
+        hv_get_ringbuffer_availbytes(ring_info,
+                                     &bytes_avail_toread,
+                                     &bytes_avail_towrite);
+        debug_info->bytes_avail_toread = bytes_avail_toread;
+        debug_info->bytes_avail_towrite = bytes_avail_towrite;
+        debug_info->current_read_index = ring_info->ring_buffer->read_index;
+        debug_info->current_write_index = ring_info->ring_buffer->write_index;
+        debug_info->current_interrupt_mask
+                = ring_info->ring_buffer->interrupt_mask;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo);
 
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index d0ff65675292..403fee01572c 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -313,12 +313,16 @@ static ssize_t out_intr_mask_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(out_intr_mask);
@@ -328,12 +332,15 @@ static ssize_t out_read_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.current_read_index);
 }
 static DEVICE_ATTR_RO(out_read_index);
@@ -344,12 +351,15 @@ static ssize_t out_write_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.current_write_index);
 }
 static DEVICE_ATTR_RO(out_write_index);
@@ -360,12 +370,15 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(out_read_bytes_avail);
@@ -376,12 +389,15 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info outbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
+                                          &outbound);
+        if (ret < 0)
+                return ret;
         return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(out_write_bytes_avail);
@@ -391,12 +407,15 @@ static ssize_t in_intr_mask_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(in_intr_mask);
@@ -406,12 +425,15 @@ static ssize_t in_read_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_read_index);
 }
 static DEVICE_ATTR_RO(in_read_index);
@@ -421,12 +443,15 @@ static ssize_t in_write_index_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.current_write_index);
 }
 static DEVICE_ATTR_RO(in_write_index);
@@ -437,12 +462,15 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(in_read_bytes_avail);
@@ -453,12 +481,15 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
 {
         struct hv_device *hv_dev = device_to_hv_device(dev);
         struct hv_ring_buffer_debug_info inbound;
+        int ret;
 
         if (!hv_dev->channel)
                 return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
+
         return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(in_write_bytes_avail);
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 4c8c7a620d08..a5dc13576394 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -544,7 +544,7 @@ void ide_proc_port_register_devices(ide_hwif_t *hwif)
                 drive->proc = proc_mkdir(drive->name, parent);
                 if (drive->proc) {
                         ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
-                        proc_create_data("setting", S_IFREG|S_IRUSR|S_IWUSR,
+                        proc_create_data("settings", S_IFREG|S_IRUSR|S_IWUSR,
                                         drive->proc, &ide_settings_proc_fops,
                                         drive);
                 }
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index cfc8b94527b9..aa4e431cbcd3 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,8 @@ static const struct xpad_device {
         { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
         { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
         { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+        { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+        { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
         { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
         { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
         { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -428,6 +430,7 @@ static const struct usb_device_id xpad_table[] = {
         XPAD_XBOXONE_VENDOR(0x0e6f),            /* 0x0e6f X-Box One controllers */
         XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
         XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
         XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
         XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
         XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 8ec483e8688b..26ec603fe220 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -39,6 +39,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/overflow.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
 
@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                                    const struct input_absinfo *abs)
 {
-        int min, max;
+        int min, max, range;
 
         min = abs->minimum;
         max = abs->maximum;
@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                 return -EINVAL;
         }
 
-        if (abs->flat > max - min) {
+        if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
                 printk(KERN_DEBUG
                        "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
                        UINPUT_NAME, code, abs->flat, min, max);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index b36084710f69..bae08226e3d9 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -195,6 +195,8 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (!priv)
                 return -ENOMEM;
 
+        priv->dev = &pdev->dev;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         priv->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(priv->base)) {
@@ -248,7 +250,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
                 goto err_irq;
         }
 
-        priv->dev = &pdev->dev;
         device_init_wakeup(priv->dev, 1);
         platform_set_drvdata(pdev, priv);
 
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index af6027cc7bbf..068dbbc610fc 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -698,7 +698,7 @@ config TOUCHSCREEN_EDT_FT5X06
 
 config TOUCHSCREEN_RASPBERRYPI_FW
         tristate "Raspberry Pi's firmware base touch screen support"
-        depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
+        depends on RASPBERRYPI_FIRMWARE || (RASPBERRYPI_FIRMWARE=n && COMPILE_TEST)
         help
           Say Y here if you have the official Raspberry Pi 7 inch screen on
           your system.
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index d8947b28db2d..f04a6df65eb8 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -224,7 +224,7 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
          * If we have reason to believe the IOMMU driver missed the initial
          * probe for dev, replay it to get things in order.
          */
-        if (dev->bus && !device_iommu_mapped(dev))
+        if (!err && dev->bus && !device_iommu_mapped(dev))
                 err = iommu_probe_device(dev);
 
         /* Ignore all other errors apart from EPROBE_DEFER */
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 0ff22159a0ca..47d4e0d30bf0 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2414,9 +2414,21 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
          * capi:cipher_api_spec-iv:ivopts
          */
         tmp = &cipher_in[strlen("capi:")];
-        cipher_api = strsep(&tmp, "-");
-        *ivmode = strsep(&tmp, ":");
-        *ivopts = tmp;
+
+        /* Separate IV options if present, it can contain another '-' in hash name */
+        *ivopts = strrchr(tmp, ':');
+        if (*ivopts) {
+                **ivopts = '\0';
+                (*ivopts)++;
+        }
+        /* Parse IV mode */
+        *ivmode = strrchr(tmp, '-');
+        if (*ivmode) {
+                **ivmode = '\0';
+                (*ivmode)++;
+        }
+        /* The rest is crypto API spec */
+        cipher_api = tmp;
 
         if (*ivmode && !strcmp(*ivmode, "lmk"))
                 cc->tfms_count = 64;
@@ -2486,11 +2498,8 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                 goto bad_mem;
 
         chainmode = strsep(&tmp, "-");
-        *ivopts = strsep(&tmp, "-");
-        *ivmode = strsep(&*ivopts, ":");
-
-        if (tmp)
-                DMWARN("Ignoring unexpected additional cipher options");
+        *ivmode = strsep(&tmp, ":");
+        *ivopts = tmp;
 
         /*
          * For compatibility with the original dm-crypt mapping format, if
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 20b0776e39ef..ed3caceaed07 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1678,7 +1678,7 @@ int dm_thin_remove_range(struct dm_thin_device *td,
         return r;
 }
 
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
 {
         int r;
         uint32_t ref_count;
@@ -1686,7 +1686,7 @@ int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *resu
         down_read(&pmd->root_lock);
         r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
         if (!r)
-                *result = (ref_count != 0);
+                *result = (ref_count > 1);
         up_read(&pmd->root_lock);
 
         return r;
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 35e954ea20a9..f6be0d733c20 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -195,7 +195,7 @@ int dm_pool_get_metadata_dev_size(struct dm_pool_metadata *pmd,
 
 int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
 
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
 
 int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
 int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index dadd9696340c..ca8af21bf644 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1048,7 +1048,7 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
          * passdown we have to check that these blocks are now unused.
          */
         int r = 0;
-        bool used = true;
+        bool shared = true;
         struct thin_c *tc = m->tc;
         struct pool *pool = tc->pool;
         dm_block_t b = m->data_block, e, end = m->data_block + m->virt_end - m->virt_begin;
@@ -1058,11 +1058,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
         while (b != end) {
                 /* find start of unmapped run */
                 for (; b < end; b++) {
-                        r = dm_pool_block_is_used(pool->pmd, b, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, b, &shared);
                         if (r)
                                 goto out;
 
-                        if (!used)
+                        if (!shared)
                                 break;
                 }
 
@@ -1071,11 +1071,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
 
                 /* find end of run */
                 for (e = b + 1; e != end; e++) {
-                        r = dm_pool_block_is_used(pool->pmd, e, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, e, &shared);
                         if (r)
                                 goto out;
 
-                        if (used)
+                        if (shared)
                                 break;
                 }
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d67c95ef8d7e..2b53c3841b53 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1320,7 +1320,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
 
         __bio_clone_fast(clone, bio);
 
-        if (unlikely(bio_integrity(bio) != NULL)) {
+        if (bio_integrity(bio)) {
                 int r;
 
                 if (unlikely(!dm_target_has_integrity(tio->ti->type) &&
@@ -1336,11 +1336,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
                         return r;
         }
 
-        bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
-        clone->bi_iter.bi_size = to_bytes(len);
-
-        if (unlikely(bio_integrity(bio) != NULL))
-                bio_integrity_trim(clone);
+        bio_trim(clone, sector - clone->bi_iter.bi_sector, len);
 
         return 0;
 }
@@ -1588,6 +1584,9 @@ static void init_clone_info(struct clone_info *ci, struct mapped_device *md,
         ci->sector = bio->bi_iter.bi_sector;
 }
 
+#define __dm_part_stat_sub(part, field, subnd)  \
+        (part_stat_get(part, field) -= (subnd))
+
 /*
  * Entry point to split a bio into clones and submit them to the targets.
  */
@@ -1642,7 +1641,21 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                                 struct bio *b = bio_split(bio, bio_sectors(bio) - ci.sector_count,
                                                           GFP_NOIO, &md->queue->bio_split);
                                 ci.io->orig_bio = b;
+
+                                /*
+                                 * Adjust IO stats for each split, otherwise upon queue
+                                 * reentry there will be redundant IO accounting.
+                                 * NOTE: this is a stop-gap fix, a proper fix involves
+                                 * significant refactoring of DM core's bio splitting
+                                 * (by eliminating DM's splitting and just using bio_split)
+                                 */
+                                part_stat_lock();
+                                __dm_part_stat_sub(&dm_disk(md)->part0,
+                                                   sectors[op_stat_group(bio_op(bio))], ci.sector_count);
+                                part_stat_unlock();
+
                                 bio_chain(b, bio);
+                                trace_block_split(md->queue, b, bio->bi_iter.bi_sector);
                                 ret = generic_make_request(bio);
                                 break;
                         }
@@ -1713,6 +1726,15 @@ out:
         return ret;
 }
 
+static blk_qc_t dm_process_bio(struct mapped_device *md,
+                               struct dm_table *map, struct bio *bio)
+{
+        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+                return __process_bio(md, map, bio);
+        else
+                return __split_and_process_bio(md, map, bio);
+}
+
 static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
 {
         struct mapped_device *md = q->queuedata;
@@ -1733,10 +1755,7 @@ static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
                 return ret;
         }
 
-        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
-                ret = __process_bio(md, map, bio);
-        else
-                ret = __split_and_process_bio(md, map, bio);
+        ret = dm_process_bio(md, map, bio);
 
         dm_put_live_table(md, srcu_idx);
         return ret;
@@ -2415,9 +2434,9 @@ static void dm_wq_work(struct work_struct *work)
                         break;
 
                 if (dm_request_based(md))
-                        generic_make_request(c);
+                        (void) generic_make_request(c);
                 else
-                        __split_and_process_bio(md, map, c);
+                        (void) dm_process_bio(md, map, c);
         }
 
         dm_put_live_table(md, srcu_idx);
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index b8aaa684c397..2ed23c99f59f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -820,21 +820,24 @@ static int ibmvmc_send_msg(struct crq_server_adapter *adapter,
  *
  * Return:
  *      0 - Success
+ *      Non-zero - Failure
  */
 static int ibmvmc_open(struct inode *inode, struct file *file)
 {
         struct ibmvmc_file_session *session;
-        int rc = 0;
 
         pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__,
                  (unsigned long)inode, (unsigned long)file,
                  ibmvmc.state);
 
         session = kzalloc(sizeof(*session), GFP_KERNEL);
+        if (!session)
+                return -ENOMEM;
+
         session->file = file;
         file->private_data = session;
 
-        return rc;
+        return 0;
 }
 
 /**
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                 dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
 
                 if (dma_setup_res->status) {
-                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
-                                 dma_setup_res->status,
-                                 mei_hbm_status_str(dma_setup_res->status));
+                        u8 status = dma_setup_res->status;
+
+                        if (status == MEI_HBMS_NOT_ALLOWED) {
+                                dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+                        } else {
+                                dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                         status,
+                                         mei_hbm_status_str(status));
+                        }
                         dev->hbm_f_dr_supported = 0;
                         mei_dmam_ring_free(dev);
                 }
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..23739a60517f 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 
+#define MEI_DEV_ID_DNV_IE     0x19E5  /* Denverton IE */
+
 #define MEI_DEV_ID_GLK        0x319A  /* Gemini Lake */
 
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..e89497f858ae 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,11 +88,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
+
         {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
index 595ac065b401..95ff7c5a1dfb 100644
--- a/drivers/misc/pvpanic.c
+++ b/drivers/misc/pvpanic.c
@@ -70,8 +70,12 @@ pvpanic_walk_resources(struct acpi_resource *res, void *context)
         struct resource r;
 
         if (acpi_dev_resource_io(res, &r)) {
+#ifdef CONFIG_HAS_IOPORT_MAP
                 base = ioport_map(r.start, resource_size(&r));
                 return AE_OK;
+#else
+                return AE_ERROR;
+#endif
         } else if (acpi_dev_resource_memory(res, &r)) {
                 base = ioremap(r.start, resource_size(&r));
                 return AE_OK;
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index e26b8145efb3..a44ec8bb5418 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -116,7 +116,7 @@ config MMC_RICOH_MMC
 
 config MMC_SDHCI_ACPI
         tristate "SDHCI support for ACPI enumerated SDHCI controllers"
-        depends on MMC_SDHCI && ACPI
+        depends on MMC_SDHCI && ACPI && PCI
         select IOSF_MBI if X86
         help
           This selects support for ACPI enumerated SDHCI controllers,
@@ -978,7 +978,7 @@ config MMC_SDHCI_OMAP
         tristate "TI SDHCI Controller Support"
         depends on MMC_SDHCI_PLTFM && OF
         select THERMAL
-        select TI_SOC_THERMAL
+        imply TI_SOC_THERMAL
         help
           This selects the Secure Digital Host Controller Interface (SDHCI)
           support present in TI's DRA7 SOCs. The controller supports
diff --git a/drivers/mmc/host/dw_mmc-bluefield.c b/drivers/mmc/host/dw_mmc-bluefield.c
index ed8f2254b66a..aa38b1a8017e 100644
--- a/drivers/mmc/host/dw_mmc-bluefield.c
+++ b/drivers/mmc/host/dw_mmc-bluefield.c
@@ -1,11 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2018 Mellanox Technologies.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
  */
 
 #include <linux/bitfield.h>
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c2690c1a50ff..f19ec60bcbdc 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -179,6 +179,8 @@ struct meson_host {
         struct sd_emmc_desc *descs;
         dma_addr_t descs_dma_addr;
 
+        int irq;
+
         bool vqmmc_enabled;
 };
 
@@ -738,6 +740,11 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
+        int adj = 0;
+
+        /* enable signal resampling w/o delay */
+        adj = ADJUST_ADJ_EN;
+        writel(adj, host->regs + host->data->adjust);
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -768,6 +775,9 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
+                /* disable signal resampling */
+                writel(0, host->regs + host->data->adjust);
+
                 /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
 
@@ -1166,7 +1176,7 @@ static int meson_mmc_get_cd(struct mmc_host *mmc)
 
 static void meson_mmc_cfg_init(struct meson_host *host)
 {
-        u32 cfg = 0, adj = 0;
+        u32 cfg = 0;
 
         cfg |= FIELD_PREP(CFG_RESP_TIMEOUT_MASK,
                           ilog2(SD_EMMC_CFG_RESP_TIMEOUT));
@@ -1177,10 +1187,6 @@ static void meson_mmc_cfg_init(struct meson_host *host)
         cfg |= CFG_ERR_ABORT;
 
         writel(cfg, host->regs + SD_EMMC_CFG);
-
-        /* enable signal resampling w/o delay */
-        adj = ADJUST_ADJ_EN;
-        writel(adj, host->regs + host->data->adjust);
 }
 
 static int meson_mmc_card_busy(struct mmc_host *mmc)
@@ -1231,7 +1237,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
         struct resource *res;
         struct meson_host *host;
         struct mmc_host *mmc;
-        int ret, irq;
+        int ret;
 
         mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev);
         if (!mmc)
@@ -1276,8 +1282,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                 goto free_host;
         }
 
-        irq = platform_get_irq(pdev, 0);
-        if (irq <= 0) {
+        host->irq = platform_get_irq(pdev, 0);
+        if (host->irq <= 0) {
                 dev_err(&pdev->dev, "failed to get interrupt resource.\n");
                 ret = -EINVAL;
                 goto free_host;
@@ -1331,9 +1337,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
         writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN,
                host->regs + SD_EMMC_IRQ_EN);
 
-        ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq,
-                                        meson_mmc_irq_thread, IRQF_SHARED,
-                                        NULL, host);
+        ret = request_threaded_irq(host->irq, meson_mmc_irq,
+                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
         if (ret)
                 goto err_init_clk;
 
@@ -1351,7 +1356,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
         if (host->bounce_buf == NULL) {
                 dev_err(host->dev, "Unable to map allocate DMA bounce buffer.\n");
                 ret = -ENOMEM;
-                goto err_init_clk;
+                goto err_free_irq;
         }
 
         host->descs = dma_alloc_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
@@ -1370,6 +1375,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
 err_bounce_buf:
         dma_free_coherent(host->dev, host->bounce_buf_size,
                           host->bounce_buf, host->bounce_dma_addr);
+err_free_irq:
+        free_irq(host->irq, host);
 err_init_clk:
         clk_disable_unprepare(host->mmc_clk);
 err_core_clk:
@@ -1387,6 +1394,7 @@ static int meson_mmc_remove(struct platform_device *pdev)
 
         /* disable interrupts */
         writel(0, host->regs + SD_EMMC_IRQ_EN);
+        free_irq(host->irq, host);
 
         dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
                           host->descs, host->descs_dma_addr);
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0db99057c44f..9d12c06c7fd6 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -296,7 +296,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
 
         iproc_host->data = iproc_data;
 
-        mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                goto err;
+
         sdhci_get_property(pdev);
 
         host->mmc->caps |= iproc_host->data->mmc_caps;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3b3f88ffab53..c05e4d50d43d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
 struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
 {
         struct can_priv *priv = netdev_priv(dev);
-        struct sk_buff *skb = priv->echo_skb[idx];
-        struct canfd_frame *cf;
 
         if (idx >= priv->echo_skb_max) {
                 netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
                 return NULL;
         }
 
-        if (!skb) {
-                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
-                           __func__, idx);
-                return NULL;
-        }
+        if (priv->echo_skb[idx]) {
+                /* Using "struct canfd_frame::len" for the frame
+                 * length is supported on both CAN and CANFD frames.
+                 */
+                struct sk_buff *skb = priv->echo_skb[idx];
+                struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+                u8 len = cf->len;
 
-        /* Using "struct canfd_frame::len" for the frame
-         * length is supported on both CAN and CANFD frames.
-         */
-        cf = (struct canfd_frame *)skb->data;
-        *len_ptr = cf->len;
-        priv->echo_skb[idx] = NULL;
+                *len_ptr = len;
+                priv->echo_skb[idx] = NULL;
 
-        return skb;
+                return skb;
+        }
+
+        return NULL;
 }
 
 /*
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 0f36eafe3ac1..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev)
                 }
         } else {
                 /* clear and invalidate unused mailboxes first */
-                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
                         mb = flexcan_get_mb(priv, i);
                         priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
                                     &mb->can_ctrl);
@@ -1432,7 +1432,7 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
         gpr_np = of_find_node_by_phandle(phandle);
         if (!gpr_np) {
                 dev_dbg(&pdev->dev, "could not find gpr node by phandle\n");
-                return PTR_ERR(gpr_np);
+                return -ENODEV;
         }
 
         priv = netdev_priv(dev);
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 02921d877c08..aa1d1f5339d2 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
 
                 phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
                                      priv->phy_iface);
-                if (IS_ERR(phydev))
+                if (IS_ERR(phydev)) {
                         netdev_err(dev, "Could not attach to PHY\n");
+                        phydev = NULL;
+                }
 
         } else {
                 int ret;
diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig
index 809a155eb193..f6d244c663fd 100644
--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig
+++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig
@@ -9,8 +9,9 @@ config FSL_DPAA2_ETH
 
 config FSL_DPAA2_PTP_CLOCK
         tristate "Freescale DPAA2 PTP Clock"
-        depends on FSL_DPAA2_ETH && POSIX_TIMERS
-        select PTP_1588_CLOCK
+        depends on FSL_DPAA2_ETH
+        imply PTP_1588_CLOCK
+        default y
         help
           This driver adds support for using the DPAA2 1588 timer module
           as a PTP clock.
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ae0f88bce9aa..2370dc204202 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3467,7 +3467,7 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_clk_ipg;
 
-        fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
+        fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
         if (!IS_ERR(fep->reg_phy)) {
                 ret = regulator_enable(fep->reg_phy);
                 if (ret) {
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 098d8764c0ea..dd71d5db7274 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1313,7 +1313,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
         unsigned long lpar_rc;
         u16 mss = 0;
 
-restart_poll:
         while (frames_processed < budget) {
                 if (!ibmveth_rxq_pending_buffer(adapter))
                         break;
@@ -1401,7 +1400,6 @@ restart_poll:
                     napi_reschedule(napi)) {
                         lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                                VIO_IRQ_DISABLE);
-                        goto restart_poll;
                 }
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index db909b6069b5..65f8a4b6ed0c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -306,14 +306,16 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size)
 
         if (entries_per_copy < entries) {
                 for (i = 0; i < entries / entries_per_copy; i++) {
-                        err = copy_to_user(buf, init_ents, PAGE_SIZE);
+                        err = copy_to_user((void __user *)buf, init_ents, PAGE_SIZE) ?
+                                -EFAULT : 0;
                         if (err)
                                 goto out;
 
                         buf += PAGE_SIZE;
                 }
         } else {
-                err = copy_to_user(buf, init_ents, entries * cqe_size);
+                err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ?
+                        -EFAULT : 0;
         }
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 7df728f1e5b5..6e501af0e532 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2067,9 +2067,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 {
         struct mlx4_cmd_mailbox *mailbox;
         __be32 *outbox;
+        u64 qword_field;
         u32 dword_field;
-        int err;
+        u16 word_field;
         u8 byte_field;
+        int err;
         static const u8 a0_dmfs_query_hw_steering[] =  {
                 [0] = MLX4_STEERING_DMFS_A0_DEFAULT,
                 [1] = MLX4_STEERING_DMFS_A0_DYNAMIC,
@@ -2097,19 +2099,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 
         /* QPC/EEC/CQC/EQC/RDMARC attributes */
 
-        MLX4_GET(param->qpc_base,      outbox, INIT_HCA_QPC_BASE_OFFSET);
-        MLX4_GET(param->log_num_qps,   outbox, INIT_HCA_LOG_QP_OFFSET);
-        MLX4_GET(param->srqc_base,     outbox, INIT_HCA_SRQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_srqs,  outbox, INIT_HCA_LOG_SRQ_OFFSET);
-        MLX4_GET(param->cqc_base,      outbox, INIT_HCA_CQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_cqs,   outbox, INIT_HCA_LOG_CQ_OFFSET);
-        MLX4_GET(param->altc_base,     outbox, INIT_HCA_ALTC_BASE_OFFSET);
-        MLX4_GET(param->auxc_base,     outbox, INIT_HCA_AUXC_BASE_OFFSET);
-        MLX4_GET(param->eqc_base,      outbox, INIT_HCA_EQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_eqs,   outbox, INIT_HCA_LOG_EQ_OFFSET);
-        MLX4_GET(param->num_sys_eqs,   outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
-        MLX4_GET(param->rdmarc_base,   outbox, INIT_HCA_RDMARC_BASE_OFFSET);
-        MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET);
+        param->qpc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET);
+        param->log_num_qps = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET);
+        param->srqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET);
+        param->log_num_srqs = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET);
+        param->cqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET);
+        param->log_num_cqs = byte_field & 0x1f;
+        MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        param->altc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->auxc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET);
+        param->eqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->log_num_eqs = byte_field & 0x1f;
+        MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        param->num_sys_eqs = word_field & 0xfff;
+        MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->rdmarc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET);
+        param->log_rd_per_qp = byte_field & 0x7;
 
         MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET);
         if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) {
@@ -2128,22 +2143,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
         /* steering attributes */
         if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
                 MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
-                         INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
-                MLX4_GET(param->log_mc_table_sz, outbox,
-                         INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
-                MLX4_GET(byte_field, outbox,
-                         INIT_HCA_FS_A0_OFFSET);
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET);
                 param->dmfs_high_steer_mode =
                         a0_dmfs_query_hw_steering[(byte_field >> 6) & 3];
         } else {
                 MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
-                         INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
-                MLX4_GET(param->log_mc_hash_sz,  outbox,
-                         INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
-                MLX4_GET(param->log_mc_table_sz, outbox,
-                         INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field,  outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
+                param->log_mc_hash_sz = byte_field & 0x1f;
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
         }
 
         /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */
@@ -2167,15 +2181,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
         /* TPT attributes */
 
         MLX4_GET(param->dmpt_base,  outbox, INIT_HCA_DMPT_BASE_OFFSET);
-        MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET);
-        MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET);
+        param->mw_enabled = byte_field >> 7;
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->log_mpt_sz = byte_field & 0x3f;
         MLX4_GET(param->mtt_base,   outbox, INIT_HCA_MTT_BASE_OFFSET);
         MLX4_GET(param->cmpt_base,  outbox, INIT_HCA_CMPT_BASE_OFFSET);
 
         /* UAR attributes */
 
         MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET);
-        MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        param->log_uar_sz = byte_field & 0xf;
 
         /* phv_check enable */
         MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ffc1ada4e6da..d28c8f9ca55b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -343,7 +343,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
         int i;
 
         priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
-                ETH_HLEN + VLAN_HLEN;
+                ETH_HLEN + VLAN_HLEN + sizeof(__sum16);
 
         /* Allocate RX and TX skb rings */
         priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -524,13 +524,15 @@ static void ravb_rx_csum(struct sk_buff *skb)
 {
         u8 *hw_csum;
 
-        /* The hardware checksum is 2 bytes appended to packet data */
-        if (unlikely(skb->len < 2))
+        /* The hardware checksum is contained in sizeof(__sum16) (2) bytes
+         * appended to packet data
+         */
+        if (unlikely(skb->len < sizeof(__sum16)))
                 return;
-        hw_csum = skb_tail_pointer(skb) - 2;
+        hw_csum = skb_tail_pointer(skb) - sizeof(__sum16);
         skb->csum = csum_unfold((__force __sum16)get_unaligned_le16(hw_csum));
         skb->ip_summed = CHECKSUM_COMPLETE;
-        skb_trim(skb, skb->len - 2);
+        skb_trim(skb, skb->len - sizeof(__sum16));
 }
 
 /* Packet receive function for Ethernet AVB */
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index ee42d4a887d7..6062e99fa69b 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6047,22 +6047,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
         { NVRAM_PARTITION_TYPE_ROMCONFIG_DEFAULTS, 0,    0, "sfc_exp_rom_cfg_dflt" },
         { NVRAM_PARTITION_TYPE_STATUS,             0,    0, "sfc_status" },
 };
+#define EF10_NVRAM_PARTITION_COUNT      ARRAY_SIZE(efx_ef10_nvram_types)
 
 static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
                                         struct efx_mcdi_mtd_partition *part,
-                                        unsigned int type)
+                                        unsigned int type,
+                                        unsigned long *found)
 {
         MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
         const struct efx_ef10_nvram_type_info *info;
         size_t size, erase_size, outlen;
+        int type_idx = 0;
         bool protected;
         int rc;
 
-        for (info = efx_ef10_nvram_types; ; info++) {
-                if (info ==
-                    efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
+        for (type_idx = 0; ; type_idx++) {
+                if (type_idx == EF10_NVRAM_PARTITION_COUNT)
                         return -ENODEV;
+                info = efx_ef10_nvram_types + type_idx;
                 if ((type & ~info->type_mask) == info->type)
                         break;
         }
@@ -6082,6 +6085,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
                 /* Protected partitions are read only. */
                 erase_size = 0;
 
+        /* If we've already exposed a partition of this type, hide this
+         * duplicate.  All operations on MTDs are keyed by the type anyway,
+         * so we can't act on the duplicate.
+         */
+        if (__test_and_set_bit(type_idx, found))
+                return -EEXIST;
+
         part->nvram_type = type;
 
         MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
@@ -6113,6 +6123,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
         struct efx_mcdi_mtd_partition *parts;
         size_t outlen, n_parts_total, i, n_parts;
         unsigned int type;
@@ -6141,11 +6152,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
         for (i = 0; i < n_parts_total; i++) {
                 type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
                                         i);
-                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
-                if (rc == 0)
-                        n_parts++;
-                else if (rc != -ENODEV)
+                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
+                                                  found);
+                if (rc == -EEXIST || rc == -ENODEV)
+                        continue;
+                if (rc)
                         goto fail;
+                n_parts++;
         }
 
         rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 9020b084b953..7ec4eb74fe21 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1,22 +1,9 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
  *
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
  * This driver uses the sungem driver (c) David Miller
  * (davem@redhat.com) as its basis.
  *
diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
index 13f3860496a8..ae5f05f03f88 100644
--- a/drivers/net/ethernet/sun/cassini.h
+++ b/drivers/net/ethernet/sun/cassini.h
@@ -1,23 +1,10 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0+ */
 /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
  * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
  *
  * Copyright (C) 2004 Sun Microsystems Inc.
  * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
  * vendor id: 0x108E (Sun Microsystems, Inc.)
  * device id: 0xabba (Cassini)
  * revision ids: 0x01 = Cassini
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index ef6f766f6389..e859ae2e42d5 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
         u32 total_data_buflen;
 };
 
+#define NETVSC_HASH_KEYLEN 40
+
 struct netvsc_device_info {
         unsigned char mac_adr[ETH_ALEN];
         u32  num_chn;
@@ -151,6 +153,8 @@ struct netvsc_device_info {
         u32  recv_sections;
         u32  send_section_size;
         u32  recv_section_size;
+
+        u8 rss_key[NETVSC_HASH_KEYLEN];
 };
 
 enum rndis_device_state {
@@ -160,8 +164,6 @@ enum rndis_device_state {
         RNDIS_DEV_DATAINITIALIZED,
 };
 
-#define NETVSC_HASH_KEYLEN 40
-
 struct rndis_device {
         struct net_device *ndev;
 
@@ -209,7 +211,9 @@ int netvsc_recv_callback(struct net_device *net,
 void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
 
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
@@ -1177,7 +1181,7 @@ enum ndis_per_pkt_info_type {
 
 enum rndis_per_pkt_info_interal_type {
         RNDIS_PKTINFO_ID = 1,
-        /* Add more memebers here */
+        /* Add more members here */
 
         RNDIS_PKTINFO_MAX
 };
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 922054c1d544..813d195bbd57 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
 
         rdev = nvdev->extension;
         if (rdev) {
-                ret = rndis_set_subchannel(rdev->ndev, nvdev);
+                ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
                 if (ret == 0) {
                         netif_device_attach(rdev->ndev);
                 } else {
@@ -1331,7 +1331,7 @@ void netvsc_channel_cb(void *context)
         prefetch(hv_get_ring_buffer(rbi) + rbi->priv_read_index);
 
         if (napi_schedule_prep(&nvchan->napi)) {
-                /* disable interupts from host */
+                /* disable interrupts from host */
                 hv_begin_read(rbi);
 
                 __napi_schedule_irqoff(&nvchan->napi);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 91ed15ea5883..256adbd044f5 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -370,7 +370,7 @@ static u32 fill_pg_buf(struct page *page, u32 offset, u32 len,
 {
         int j = 0;
 
-        /* Deal with compund pages by ignoring unused part
+        /* Deal with compound pages by ignoring unused part
          * of the page.
          */
         page += (offset >> PAGE_SHIFT);
@@ -858,6 +858,39 @@ static void netvsc_get_channels(struct net_device *net,
         }
 }
 
+/* Alloc struct netvsc_device_info, and initialize it from either existing
+ * struct netvsc_device, or from default values.
+ */
+static struct netvsc_device_info *netvsc_devinfo_get
+                        (struct netvsc_device *nvdev)
+{
+        struct netvsc_device_info *dev_info;
+
+        dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
+
+        if (!dev_info)
+                return NULL;
+
+        if (nvdev) {
+                dev_info->num_chn = nvdev->num_chn;
+                dev_info->send_sections = nvdev->send_section_cnt;
+                dev_info->send_section_size = nvdev->send_section_size;
+                dev_info->recv_sections = nvdev->recv_section_cnt;
+                dev_info->recv_section_size = nvdev->recv_section_size;
+
+                memcpy(dev_info->rss_key, nvdev->extension->rss_key,
+                       NETVSC_HASH_KEYLEN);
+        } else {
+                dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
+                dev_info->send_sections = NETVSC_DEFAULT_TX;
+                dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
+                dev_info->recv_sections = NETVSC_DEFAULT_RX;
+                dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
+
+        return dev_info;
+}
+
 static int netvsc_detach(struct net_device *ndev,
                          struct netvsc_device *nvdev)
 {
@@ -909,7 +942,7 @@ static int netvsc_attach(struct net_device *ndev,
                 return PTR_ERR(nvdev);
 
         if (nvdev->num_chn > 1) {
-                ret = rndis_set_subchannel(ndev, nvdev);
+                ret = rndis_set_subchannel(ndev, nvdev, dev_info);
 
                 /* if unavailable, just proceed with one queue */
                 if (ret) {
@@ -943,7 +976,7 @@ static int netvsc_set_channels(struct net_device *net,
         struct net_device_context *net_device_ctx = netdev_priv(net);
         struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
         unsigned int orig, count = channels->combined_count;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         int ret;
 
         /* We do not support separate count for rx, tx, or other */
@@ -962,24 +995,26 @@ static int netvsc_set_channels(struct net_device *net,
 
         orig = nvdev->num_chn;
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = count;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
+        device_info->num_chn = count;
 
         ret = netvsc_detach(net, nvdev);
         if (ret)
-                return ret;
+                goto out;
 
-        ret = netvsc_attach(net, &device_info);
+        ret = netvsc_attach(net, device_info);
         if (ret) {
-                device_info.num_chn = orig;
-                if (netvsc_attach(net, &device_info))
+                device_info->num_chn = orig;
+                if (netvsc_attach(net, device_info))
                         netdev_err(net, "restoring channel setting failed\n");
         }
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -1048,48 +1083,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
         int orig_mtu = ndev->mtu;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         int ret = 0;
 
         if (!nvdev || nvdev->destroy)
                 return -ENODEV;
 
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
         /* Change MTU of underlying VF netdev first. */
         if (vf_netdev) {
                 ret = dev_set_mtu(vf_netdev, mtu);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
-
         ret = netvsc_detach(ndev, nvdev);
         if (ret)
                 goto rollback_vf;
 
         ndev->mtu = mtu;
 
-        ret = netvsc_attach(ndev, &device_info);
-        if (ret)
-                goto rollback;
-
-        return 0;
+        ret = netvsc_attach(ndev, device_info);
+        if (!ret)
+                goto out;
 
-rollback:
         /* Attempt rollback to original MTU */
         ndev->mtu = orig_mtu;
 
-        if (netvsc_attach(ndev, &device_info))
+        if (netvsc_attach(ndev, device_info))
                 netdev_err(ndev, "restoring mtu failed\n");
 rollback_vf:
         if (vf_netdev)
                 dev_set_mtu(vf_netdev, orig_mtu);
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -1674,7 +1706,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
         struct ethtool_ringparam orig;
         u32 new_tx, new_rx;
         int ret = 0;
@@ -1694,26 +1726,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
             new_rx == orig.rx_pending)
                 return 0;        /* no change */
 
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = new_tx;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = new_rx;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info = netvsc_devinfo_get(nvdev);
+
+        if (!device_info)
+                return -ENOMEM;
+
+        device_info->send_sections = new_tx;
+        device_info->recv_sections = new_rx;
 
         ret = netvsc_detach(ndev, nvdev);
         if (ret)
-                return ret;
+                goto out;
 
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
         if (ret) {
-                device_info.send_sections = orig.tx_pending;
-                device_info.recv_sections = orig.rx_pending;
+                device_info->send_sections = orig.tx_pending;
+                device_info->recv_sections = orig.rx_pending;
 
-                if (netvsc_attach(ndev, &device_info))
+                if (netvsc_attach(ndev, device_info))
                         netdev_err(ndev, "restoring ringparam failed");
         }
 
+out:
+        kfree(device_info);
         return ret;
 }
 
@@ -2088,7 +2123,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
         if (!netvsc_dev || rtnl_dereference(net_device_ctx->vf_netdev))
                 return NOTIFY_DONE;
 
-        /* if syntihetic interface is a different namespace,
+        /* if synthetic interface is a different namespace,
          * then move the VF to that namespace; join will be
          * done again in that context.
          */
@@ -2167,7 +2202,7 @@ static int netvsc_probe(struct hv_device *dev,
 {
         struct net_device *net = NULL;
         struct net_device_context *net_device_ctx;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info = NULL;
         struct netvsc_device *nvdev;
         int ret = -ENOMEM;
 
@@ -2214,21 +2249,21 @@ static int netvsc_probe(struct hv_device *dev,
         netif_set_real_num_rx_queues(net, 1);
 
         /* Notify the netvsc driver of the new device */
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = VRSS_CHANNEL_DEFAULT;
-        device_info.send_sections = NETVSC_DEFAULT_TX;
-        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
-        device_info.recv_sections = NETVSC_DEFAULT_RX;
-        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
-
-        nvdev = rndis_filter_device_add(dev, &device_info);
+        device_info = netvsc_devinfo_get(NULL);
+
+        if (!device_info) {
+                ret = -ENOMEM;
+                goto devinfo_failed;
+        }
+
+        nvdev = rndis_filter_device_add(dev, device_info);
         if (IS_ERR(nvdev)) {
                 ret = PTR_ERR(nvdev);
                 netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
                 goto rndis_failed;
         }
 
-        memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
+        memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
 
         /* We must get rtnl lock before scheduling nvdev->subchan_work,
          * otherwise netvsc_subchan_work() can get rtnl lock first and wait
@@ -2236,7 +2271,7 @@ static int netvsc_probe(struct hv_device *dev,
          * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
          * -> ... -> device_add() -> ... -> __device_attach() can't get
          * the device lock, so all the subchannels can't be processed --
-         * finally netvsc_subchan_work() hangs for ever.
+         * finally netvsc_subchan_work() hangs forever.
          */
         rtnl_lock();
 
@@ -2266,12 +2301,16 @@ static int netvsc_probe(struct hv_device *dev,
 
         list_add(&net_device_ctx->list, &netvsc_dev_list);
         rtnl_unlock();
+
+        kfree(device_info);
         return 0;
 
 register_failed:
         rtnl_unlock();
         rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
+        kfree(device_info);
+devinfo_failed:
         free_percpu(net_device_ctx->vf_stats);
 no_stats:
         hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 8b537a049c1e..73b60592de06 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -774,8 +774,8 @@ cleanup:
         return ret;
 }
 
-int rndis_filter_set_rss_param(struct rndis_device *rdev,
-                               const u8 *rss_key)
+static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+                                   const u8 *rss_key, u16 flag)
 {
         struct net_device *ndev = rdev->ndev;
         struct rndis_request *request;
@@ -804,7 +804,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
         rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
         rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
         rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
-        rssp->flag = 0;
+        rssp->flag = flag;
         rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
                          NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
                          NDIS_HASH_TCP_IPV6;
@@ -829,9 +829,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
 
         wait_for_completion(&request->wait_event);
         set_complete = &request->response_msg.msg.set_complete;
-        if (set_complete->status == RNDIS_STATUS_SUCCESS)
-                memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
-        else {
+        if (set_complete->status == RNDIS_STATUS_SUCCESS) {
+                if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
+                    !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
+                        memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+
+        } else {
                 netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
                            set_complete->status);
                 ret = -EINVAL;
@@ -842,6 +845,16 @@ cleanup:
         return ret;
 }
 
+int rndis_filter_set_rss_param(struct rndis_device *rdev,
+                               const u8 *rss_key)
+{
+        /* Disable RSS before change */
+        rndis_set_rss_param_msg(rdev, rss_key,
+                                NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
+
+        return rndis_set_rss_param_msg(rdev, rss_key, 0);
+}
+
 static int rndis_filter_query_device_link_status(struct rndis_device *dev,
                                                  struct netvsc_device *net_device)
 {
@@ -1121,7 +1134,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
  * This breaks overlap of processing the host message for the
  * new primary channel with the initialization of sub-channels.
  */
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info)
 {
         struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
         struct net_device_context *ndev_ctx = netdev_priv(ndev);
@@ -1161,8 +1176,11 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
         wait_event(nvdev->subchan_open,
                    atomic_read(&nvdev->open_chn) == nvdev->num_chn);
 
-        /* ignore failues from setting rss parameters, still have channels */
-        rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+        /* ignore failures from setting rss parameters, still have channels */
+        if (dev_info)
+                rndis_filter_set_rss_param(rdev, dev_info->rss_key);
+        else
+                rndis_filter_set_rss_param(rdev, netvsc_hash_key);
 
         netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
         netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
diff --git a/drivers/net/phy/asix.c b/drivers/net/phy/asix.c
index 8ebe7f5484ae..f14ba5366b91 100644
--- a/drivers/net/phy/asix.c
+++ b/drivers/net/phy/asix.c
@@ -1,13 +1,7 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* Driver for Asix PHYs
  *
  * Author: Michael Schmitz <schmitzmic@gmail.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- *
  */
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/drivers/net/phy/mdio-hisi-femac.c b/drivers/net/phy/mdio-hisi-femac.c
index b03fedd6c1d8..287f3ccf1da1 100644
--- a/drivers/net/phy/mdio-hisi-femac.c
+++ b/drivers/net/phy/mdio-hisi-femac.c
@@ -1,20 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Hisilicon Fast Ethernet MDIO Bus Driver
  *
  * Copyright (c) 2016 HiSilicon Technologies Co., Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/clk.h>
@@ -163,4 +151,4 @@ module_platform_driver(hisi_femac_mdio_driver);
 
 MODULE_DESCRIPTION("Hisilicon Fast Ethernet MAC MDIO interface driver");
 MODULE_AUTHOR("Dongpo Li <lidongpo@hisilicon.com>");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/rockchip.c b/drivers/net/phy/rockchip.c
index f1da70b9b55f..95abf7072f32 100644
--- a/drivers/net/phy/rockchip.c
+++ b/drivers/net/phy/rockchip.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /**
  * drivers/net/phy/rockchip.c
  *
@@ -6,12 +7,6 @@
  * Copyright (c) 2017, Fuzhou Rockchip Electronics Co., Ltd
  *
  * David Wu <david.wu@rock-chips.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
  */
 
 #include <linux/ethtool.h>
@@ -229,4 +224,4 @@ MODULE_DEVICE_TABLE(mdio, rockchip_phy_tbl);
 
 MODULE_AUTHOR("David Wu <david.wu@rock-chips.com>");
 MODULE_DESCRIPTION("Rockchip Ethernet PHY driver");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index b654f05b2ccd..3d93993e74da 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
         asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
         chipcode &= AX_CHIPCODE_MASK;
 
-        (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
-                                            ax88772a_hw_reset(dev, 0);
+        ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+                                                  ax88772a_hw_reset(dev, 0);
+
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
+                return ret;
+        }
 
         /* Read PHYID register *AFTER* the PHY was reset properly */
         phyid = asix_get_phyid(dev);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3a4b8786f7ea..320edcac4699 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                         BIT(NL80211_CHAN_WIDTH_160);
         }
 
+        if (!n_limits) {
+                err = -EINVAL;
+                goto failed_hw;
+        }
+
         data->if_combination.n_limits = n_limits;
         data->if_combination.max_interfaces = 2048;
         data->if_combination.limits = data->if_limits;
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index 64b218699656..3a93e4d9828b 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -530,8 +530,10 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
         SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
         dev->ieee80211_ptr = kzalloc(sizeof(*dev->ieee80211_ptr), GFP_KERNEL);
 
-        if (!dev->ieee80211_ptr)
+        if (!dev->ieee80211_ptr) {
+                err = -ENOMEM;
                 goto remove_handler;
+        }
 
         dev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
         dev->ieee80211_ptr->wiphy = common_wiphy;
diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
index 0cf58cabc9ed..3cf50274fadb 100644
--- a/drivers/nvdimm/dimm.c
+++ b/drivers/nvdimm/dimm.c
@@ -26,6 +26,12 @@ static int nvdimm_probe(struct device *dev)
         struct nvdimm_drvdata *ndd;
         int rc;
 
+        rc = nvdimm_security_setup_events(dev);
+        if (rc < 0) {
+                dev_err(dev, "security event setup failed: %d\n", rc);
+                return rc;
+        }
+
         rc = nvdimm_check_config_data(dev);
         if (rc) {
                 /* not required for non-aliased nvdimm, ex. NVDIMM-N */
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 4890310df874..efe412a6b5b9 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -578,13 +578,25 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus,
 }
 EXPORT_SYMBOL_GPL(__nvdimm_create);
 
-int nvdimm_security_setup_events(struct nvdimm *nvdimm)
+static void shutdown_security_notify(void *data)
 {
-        nvdimm->sec.overwrite_state = sysfs_get_dirent(nvdimm->dev.kobj.sd,
-                        "security");
+        struct nvdimm *nvdimm = data;
+
+        sysfs_put(nvdimm->sec.overwrite_state);
+}
+
+int nvdimm_security_setup_events(struct device *dev)
+{
+        struct nvdimm *nvdimm = to_nvdimm(dev);
+
+        if (nvdimm->sec.state < 0 || !nvdimm->sec.ops
+                        || !nvdimm->sec.ops->overwrite)
+                return 0;
+        nvdimm->sec.overwrite_state = sysfs_get_dirent(dev->kobj.sd, "security");
         if (!nvdimm->sec.overwrite_state)
-                return -ENODEV;
-        return 0;
+                return -ENOMEM;
+
+        return devm_add_action_or_reset(dev, shutdown_security_notify, nvdimm);
 }
 EXPORT_SYMBOL_GPL(nvdimm_security_setup_events);
 
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index cfde992684e7..379bf4305e61 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -250,6 +250,7 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
 void nvdimm_set_aliasing(struct device *dev);
 void nvdimm_set_locked(struct device *dev);
 void nvdimm_clear_locked(struct device *dev);
+int nvdimm_security_setup_events(struct device *dev);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
 int nvdimm_security_unlock(struct device *dev);
 #else
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index df4b3a6db51b..b9fff3b8ed1b 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -545,8 +545,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
         timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
         ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
                 ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
-        if (!(ctrl->anacap & (1 << 6)))
-                ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
+        ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
 
         if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
                 dev_err(ctrl->device,
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 0a2fd2949ad7..52abc3a6de12 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -119,6 +119,7 @@ struct nvme_rdma_ctrl {
 
         struct nvme_ctrl        ctrl;
         bool                    use_inline_data;
+        u32                     io_queues[HCTX_MAX_TYPES];
 };
 
 static inline struct nvme_rdma_ctrl *to_rdma_ctrl(struct nvme_ctrl *ctrl)
@@ -165,8 +166,8 @@ static inline int nvme_rdma_queue_idx(struct nvme_rdma_queue *queue)
 static bool nvme_rdma_poll_queue(struct nvme_rdma_queue *queue)
 {
         return nvme_rdma_queue_idx(queue) >
-                queue->ctrl->ctrl.opts->nr_io_queues +
-                queue->ctrl->ctrl.opts->nr_write_queues;
+                queue->ctrl->io_queues[HCTX_TYPE_DEFAULT] +
+                queue->ctrl->io_queues[HCTX_TYPE_READ];
 }
 
 static inline size_t nvme_rdma_inline_data_size(struct nvme_rdma_queue *queue)
@@ -661,8 +662,21 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
         nr_io_queues = min_t(unsigned int, nr_io_queues,
                                 ibdev->num_comp_vectors);
 
-        nr_io_queues += min(opts->nr_write_queues, num_online_cpus());
-        nr_io_queues += min(opts->nr_poll_queues, num_online_cpus());
+        if (opts->nr_write_queues) {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] =
+                                min(opts->nr_write_queues, nr_io_queues);
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        } else {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] = nr_io_queues;
+        }
+
+        ctrl->io_queues[HCTX_TYPE_READ] = nr_io_queues;
+
+        if (opts->nr_poll_queues) {
+                ctrl->io_queues[HCTX_TYPE_POLL] =
+                        min(opts->nr_poll_queues, num_online_cpus());
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_POLL];
+        }
 
         ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
         if (ret)
@@ -1689,18 +1703,28 @@ static enum blk_eh_timer_return
 nvme_rdma_timeout(struct request *rq, bool reserved)
 {
         struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
+        struct nvme_rdma_queue *queue = req->queue;
+        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
 
-        dev_warn(req->queue->ctrl->ctrl.device,
-                 "I/O %d QID %d timeout, reset controller\n",
-                 rq->tag, nvme_rdma_queue_idx(req->queue));
+        dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
+                 rq->tag, nvme_rdma_queue_idx(queue));
 
-        /* queue error recovery */
-        nvme_rdma_error_recovery(req->queue->ctrl);
+        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_rdma_teardown_io_queues(ctrl, false);
+                nvme_rdma_teardown_admin_queue(ctrl, false);
+                return BLK_EH_DONE;
+        }
 
-        /* fail with DNR on cmd timeout */
-        nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+        nvme_rdma_error_recovery(ctrl);
 
-        return BLK_EH_DONE;
+        return BLK_EH_RESET_TIMER;
 }
 
 static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1779,17 +1803,15 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
         struct nvme_rdma_ctrl *ctrl = set->driver_data;
 
         set->map[HCTX_TYPE_DEFAULT].queue_offset = 0;
-        set->map[HCTX_TYPE_READ].nr_queues = ctrl->ctrl.opts->nr_io_queues;
+        set->map[HCTX_TYPE_DEFAULT].nr_queues =
+                        ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        set->map[HCTX_TYPE_READ].nr_queues = ctrl->io_queues[HCTX_TYPE_READ];
         if (ctrl->ctrl.opts->nr_write_queues) {
                 /* separate read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_write_queues;
                 set->map[HCTX_TYPE_READ].queue_offset =
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
         } else {
                 /* mixed read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_io_queues;
                 set->map[HCTX_TYPE_READ].queue_offset = 0;
         }
         blk_mq_rdma_map_queues(&set->map[HCTX_TYPE_DEFAULT],
@@ -1799,12 +1821,12 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
 
         if (ctrl->ctrl.opts->nr_poll_queues) {
                 set->map[HCTX_TYPE_POLL].nr_queues =
-                                ctrl->ctrl.opts->nr_poll_queues;
+                                ctrl->io_queues[HCTX_TYPE_POLL];
                 set->map[HCTX_TYPE_POLL].queue_offset =
-                                ctrl->ctrl.opts->nr_io_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
                 if (ctrl->ctrl.opts->nr_write_queues)
                         set->map[HCTX_TYPE_POLL].queue_offset +=
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_READ];
                 blk_mq_map_queues(&set->map[HCTX_TYPE_POLL]);
         }
         return 0;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 265a0543b381..5f0a00425242 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1948,20 +1948,23 @@ nvme_tcp_timeout(struct request *rq, bool reserved)
         struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
         struct nvme_tcp_cmd_pdu *pdu = req->pdu;
 
-        dev_dbg(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "queue %d: timeout request %#x type %d\n",
-                nvme_tcp_queue_id(req->queue), rq->tag,
-                pdu->hdr.type);
+                nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
 
         if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-                union nvme_result res = {};
-
-                nvme_req(rq)->flags |= NVME_REQ_CANCELLED;
-                nvme_end_request(rq, cpu_to_le16(NVME_SC_ABORT_REQ), res);
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+                nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
                 return BLK_EH_DONE;
         }
 
-        /* queue error recovery */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
         nvme_tcp_error_recovery(&ctrl->ctrl);
 
         return BLK_EH_RESET_TIMER;
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index a8d23eb80192..a884e3a0e8af 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -139,6 +139,10 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
 static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
+static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
+static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
 
 static const struct nvmet_fabrics_ops nvmet_rdma_ops;
 
@@ -182,9 +186,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
         spin_unlock_irqrestore(&queue->rsps_lock, flags);
 
         if (unlikely(!rsp)) {
-                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                int ret;
+
+                rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
                 if (unlikely(!rsp))
                         return NULL;
+                ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
+                if (unlikely(ret)) {
+                        kfree(rsp);
+                        return NULL;
+                }
+
                 rsp->allocated = true;
         }
 
@@ -197,6 +209,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
         unsigned long flags;
 
         if (unlikely(rsp->allocated)) {
+                nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
                 kfree(rsp);
                 return;
         }
diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
index 6fd6e07ab345..09a77e556ece 100644
--- a/drivers/phy/qualcomm/phy-ath79-usb.c
+++ b/drivers/phy/qualcomm/phy-ath79-usb.c
@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
 
         err = reset_control_deassert(priv->reset);
         if (err && priv->no_suspend_override)
-                reset_control_assert(priv->no_suspend_override);
+                reset_control_deassert(priv->no_suspend_override);
 
         return err;
 }
@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
         if (!priv)
                 return -ENOMEM;
 
-        priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
+        priv->reset = devm_reset_control_get(&pdev->dev, "phy");
         if (IS_ERR(priv->reset))
                 return PTR_ERR(priv->reset);
 
diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
index 77fdaa551977..a52c5bb35033 100644
--- a/drivers/phy/ti/phy-gmii-sel.c
+++ b/drivers/phy/ti/phy-gmii-sel.c
@@ -204,11 +204,11 @@ static struct phy *phy_gmii_sel_of_xlate(struct device *dev,
 
         if (args->args_count < 1)
                 return ERR_PTR(-EINVAL);
+        if (!priv || !priv->if_phys)
+                return ERR_PTR(-ENODEV);
         if (priv->soc_data->features & BIT(PHY_GMII_SEL_RMII_IO_CLK_EN) &&
             args->args_count < 2)
                 return ERR_PTR(-EINVAL);
-        if (!priv || !priv->if_phys)
-                return ERR_PTR(-ENODEV);
         if (phy_id > priv->soc_data->num_ports)
                 return ERR_PTR(-EINVAL);
         if (phy_id != priv->if_phys[phy_id - 1].id)
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
index 194ffd5c8580..039b2074db7e 100644
--- a/drivers/s390/char/sclp_config.c
+++ b/drivers/s390/char/sclp_config.c
@@ -60,7 +60,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
 
 static void __ref sclp_cpu_change_notify(struct work_struct *work)
 {
+        lock_device_hotplug();
         smp_rescan_cpus();
+        unlock_device_hotplug();
 }
 
 static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 634ddb90e7aa..7e56a11836c1 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1747,11 +1747,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 shost->max_sectors = (shost->sg_tablesize * 8) + 112;
         }
 
-        error = dma_set_max_seg_size(&pdev->dev,
-                (aac->adapter_info.options & AAC_OPT_NEW_COMM) ?
-                        (shost->max_sectors << 9) : 65536);
-        if (error)
-                goto out_deinit;
+        if (aac->adapter_info.options & AAC_OPT_NEW_COMM)
+                shost->max_segment_size = shost->max_sectors << 9;
+        else
+                shost->max_segment_size = 65536;
 
         /*
          * Firmware printf works only with older firmware.
diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
index 8a004036e3d7..9bd2bd8dc2be 100644
--- a/drivers/scsi/csiostor/csio_attr.c
+++ b/drivers/scsi/csiostor/csio_attr.c
@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
         }
 
         fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
+        ln->fc_vport = fc_vport;
 
         if (csio_fcoe_alloc_vnp(hw, ln))
                 goto error;
 
         *(struct csio_lnode **)fc_vport->dd_data = ln;
-        ln->fc_vport = fc_vport;
         if (!fc_vport->node_name)
                 fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
         if (!fc_vport->port_name)
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 4c66b19e6199..8c9f79042228 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
                          lport);
 
         /* release any threads waiting for the unreg to complete */
-        complete(&lport->lport_unreg_done);
+        if (lport->vport->localport)
+                complete(lport->lport_unreg_cmp);
 }
 
 /* lpfc_nvme_remoteport_delete
@@ -2545,7 +2546,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
  */
 void
 lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
-                           struct lpfc_nvme_lport *lport)
+                           struct lpfc_nvme_lport *lport,
+                           struct completion *lport_unreg_cmp)
 {
 #if (IS_ENABLED(CONFIG_NVME_FC))
         u32 wait_tmo;
@@ -2557,8 +2559,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
          */
         wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
         while (true) {
-                ret = wait_for_completion_timeout(&lport->lport_unreg_done,
-                                                  wait_tmo);
+                ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
                 if (unlikely(!ret)) {
                         lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
                                          "6176 Lport %p Localport %p wait "
@@ -2592,12 +2593,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_ctrl_stat *cstat;
         int ret;
+        DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
 
         if (vport->nvmei_support == 0)
                 return;
 
         localport = vport->localport;
-        vport->localport = NULL;
         lport = (struct lpfc_nvme_lport *)localport->private;
         cstat = lport->cstat;
 
@@ -2608,13 +2609,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         /* lport's rport list is clear.  Unregister
          * lport and release resources.
          */
-        init_completion(&lport->lport_unreg_done);
+        lport->lport_unreg_cmp = &lport_unreg_cmp;
         ret = nvme_fc_unregister_localport(localport);
 
         /* Wait for completion.  This either blocks
          * indefinitely or succeeds
          */
-        lpfc_nvme_lport_unreg_wait(vport, lport);
+        lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
+        vport->localport = NULL;
         kfree(cstat);
 
         /* Regardless of the unregister upcall response, clear
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index cfd4719be25c..b234d0298994 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
 /* Declare nvme-based local and remote port definitions. */
 struct lpfc_nvme_lport {
         struct lpfc_vport *vport;
-        struct completion lport_unreg_done;
+        struct completion *lport_unreg_cmp;
         /* Add stats counters here */
         struct lpfc_nvme_ctrl_stat *cstat;
         atomic_t fc4NvmeLsRequests;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 6245f442d784..95fee83090eb 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
         struct lpfc_nvmet_tgtport *tport = targetport->private;
 
         /* release any threads waiting for the unreg to complete */
-        complete(&tport->tport_unreg_done);
+        if (tport->phba->targetport)
+                complete(tport->tport_unreg_cmp);
 }
 
 static void
@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
         struct lpfc_nvmet_tgtport *tgtp;
         struct lpfc_queue *wq;
         uint32_t qidx;
+        DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
 
         if (phba->nvmet_support == 0)
                 return;
@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                         wq = phba->sli4_hba.nvme_wq[qidx];
                         lpfc_nvmet_wqfull_flush(phba, wq, NULL);
                 }
-                init_completion(&tgtp->tport_unreg_done);
+                tgtp->tport_unreg_cmp = &tport_unreg_cmp;
                 nvmet_fc_unregister_targetport(phba->targetport);
-                wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                wait_for_completion_timeout(&tport_unreg_cmp, 5);
                 lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 1aaff63f1f41..0ec1082ce7ef 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -34,7 +34,7 @@
 /* Used for NVME Target */
 struct lpfc_nvmet_tgtport {
         struct lpfc_hba *phba;
-        struct completion tport_unreg_done;
+        struct completion *tport_unreg_cmp;
 
         /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
         atomic_t rcv_ls_req_in;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b13cc9288ba0..6d65ac584eba 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1842,8 +1842,8 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
         blk_queue_segment_boundary(q, shost->dma_boundary);
         dma_set_seg_boundary(dev, shost->dma_boundary);
 
-        blk_queue_max_segment_size(q,
-                min(shost->max_segment_size, dma_get_max_seg_size(dev)));
+        blk_queue_max_segment_size(q, shost->max_segment_size);
+        dma_set_max_seg_size(dev, shost->max_segment_size);
 
         /*
          * Set a reasonable default alignment:  The larger of 32-byte (dword),
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 71334aaf1447..2ddf24466a62 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -108,13 +108,19 @@
 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
                      const char *prefix)
 {
-        u8 *regs;
+        u32 *regs;
+        size_t pos;
+
+        if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */
+                return -EINVAL;
 
         regs = kzalloc(len, GFP_KERNEL);
         if (!regs)
                 return -ENOMEM;
 
-        memcpy_fromio(regs, hba->mmio_base + offset, len);
+        for (pos = 0; pos < len; pos += 4)
+                regs[pos / 4] = ufshcd_readl(hba, offset + pos);
+
         ufshcd_hex_dump(prefix, regs, len);
         kfree(regs);
 
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a0802de8c3a1..6f5afab7c1a1 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -248,10 +248,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
         struct ion_dma_buf_attachment *a = attachment->priv;
         struct ion_buffer *buffer = dmabuf->priv;
 
-        free_duped_table(a->table);
         mutex_lock(&buffer->lock);
         list_del(&a->list);
         mutex_unlock(&buffer->lock);
+        free_duped_table(a->table);
 
         kfree(a);
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 28cbd6b3d26c..dfee6985efa6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
         {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+        {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
         {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
index bcc8dfa8e672..9efb4dcb9d3a 100644
--- a/drivers/staging/rtl8723bs/include/ieee80211.h
+++ b/drivers/staging/rtl8723bs/include/ieee80211.h
@@ -850,18 +850,18 @@ enum ieee80211_state {
 #define IP_FMT "%pI4"
 #define IP_ARG(x) (x)
 
-extern __inline int is_multicast_mac_addr(const u8 *addr)
+static inline int is_multicast_mac_addr(const u8 *addr)
 {
         return ((addr[0] != 0xff) && (0x01 & addr[0]));
 }
 
-extern __inline int is_broadcast_mac_addr(const u8 *addr)
+static inline int is_broadcast_mac_addr(const u8 *addr)
 {
         return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
                 (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
 }
 
-extern __inline int is_zero_mac_addr(const u8 *addr)
+static inline int is_zero_mac_addr(const u8 *addr)
 {
         return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
                 (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
index 9e17ec651bde..53f5a1cb4636 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -446,6 +446,7 @@ remote_event_wait(wait_queue_head_t *wq, struct remote_event *event)
 static inline void
 remote_event_signal_local(wait_queue_head_t *wq, struct remote_event *event)
 {
+        event->fired = 1;
         event->armed = 0;
         wake_up_all(wq);
 }
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 70c854d939ce..3d0badc34825 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -36,7 +36,7 @@ struct wilc_op_mode {
 struct wilc_reg_frame {
         bool reg;
         u8 reg_id;
-        __le32 frame_type;
+        __le16 frame_type;
 } __packed;
 
 struct wilc_drv_handler {
@@ -1744,7 +1744,6 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                 result = wilc_send_config_pkt(vif, WILC_SET_CFG, wid_list,
                                               ARRAY_SIZE(wid_list),
                                               wilc_get_vif_idx(vif));
-                kfree(gtk_key);
         } else if (mode == WILC_STATION_MODE) {
                 struct wid wid;
 
@@ -1754,9 +1753,9 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                 wid.val = (u8 *)gtk_key;
                 result = wilc_send_config_pkt(vif, WILC_SET_CFG, &wid, 1,
                                               wilc_get_vif_idx(vif));
-                kfree(gtk_key);
         }
 
+        kfree(gtk_key);
         return result;
 }
 
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 3c5e9e030cad..489e5a5038f8 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1252,21 +1252,22 @@ static u32 init_chip(struct net_device *dev)
                 ret = wilc->hif_func->hif_read_reg(wilc, 0x1118, &reg);
                 if (!ret) {
                         netdev_err(dev, "fail read reg 0x1118\n");
-                        return ret;
+                        goto release;
                 }
                 reg |= BIT(0);
                 ret = wilc->hif_func->hif_write_reg(wilc, 0x1118, reg);
                 if (!ret) {
                         netdev_err(dev, "fail write reg 0x1118\n");
-                        return ret;
+                        goto release;
                 }
                 ret = wilc->hif_func->hif_write_reg(wilc, 0xc0000, 0x71);
                 if (!ret) {
                         netdev_err(dev, "fail write reg 0xc0000\n");
-                        return ret;
+                        goto release;
                 }
         }
 
+release:
         release_bus(wilc, WILC_BUS_RELEASE_ONLY);
 
         return ret;
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c34c88ef3319..5831e0eecea1 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1317,12 +1317,13 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                  * target_complete_cmd will translate this to LUN COMM FAILURE
                  */
                 scsi_status = SAM_STAT_CHECK_CONDITION;
+                list_del_init(&cmd->queue_entry);
         } else {
+                list_del_init(&cmd->queue_entry);
                 idr_remove(&udev->commands, id);
                 tcmu_free_cmd(cmd);
                 scsi_status = SAM_STAT_TASK_SET_FULL;
         }
-        list_del_init(&cmd->queue_entry);
 
         pr_debug("Timing out cmd %u on dev %s that is %s.\n",
                  id, udev->name, is_running ? "inflight" : "queued");
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 284cf2c5a8fd..8e1cf4d789be 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
         struct pci_dev *pci_dev; \
         struct platform_device *pdev; \
         struct proc_thermal_device *proc_dev; \
-\
+        \
+        if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
+                dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
+                return 0; \
+        } \
+        \
         if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
                 pdev = to_platform_device(dev); \
                 proc_dev = platform_get_drvdata(pdev); \
@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
         *priv = proc_priv;
 
         ret = proc_thermal_read_ppcc(proc_priv);
-        if (!ret) {
-                ret = sysfs_create_group(&dev->kobj,
-                                         &power_limit_attribute_group);
-
-        }
         if (ret)
                 return ret;
 
@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
 
         proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
         if (IS_ERR(proc_priv->int340x_zone)) {
-                ret = PTR_ERR(proc_priv->int340x_zone);
-                goto remove_group;
+                return PTR_ERR(proc_priv->int340x_zone);
         } else
                 ret = 0;
 
@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
 
 remove_zone:
         int340x_thermal_zone_remove(proc_priv->int340x_zone);
-remove_group:
-        sysfs_remove_group(&proc_priv->dev->kobj,
-                           &power_limit_attribute_group);
 
         return ret;
 }
@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
         platform_set_drvdata(pdev, proc_priv);
         proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
 
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
+
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 
 static int int3401_remove(struct platform_device *pdev)
@@ -423,7 +422,7 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                 proc_priv->soc_dts = intel_soc_dts_iosf_init(
                                         INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
 
-                if (proc_priv->soc_dts && pdev->irq) {
+                if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
                         ret = pci_enable_msi(pdev);
                         if (!ret) {
                                 ret = request_threaded_irq(pdev->irq, NULL,
@@ -441,7 +440,10 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                         dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
         }
 
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
+
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 
 static void  proc_thermal_pci_remove(struct pci_dev *pdev)
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 4164414d4c64..8bdf42bc8fc8 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -597,6 +597,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                                 /* too large for caller's buffer */
                                 ret = -EOVERFLOW;
                         } else {
+                                __set_current_state(TASK_RUNNING);
                                 if (copy_to_user(buf, rbuf->buf, rbuf->count))
                                         ret = -EFAULT;
                                 else
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 189ab1212d9a..e441221e04b9 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1070,15 +1070,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
                         ret = 0;
                 }
-        }
 
-        /* Initialise interrupt backoff work if required */
-        if (up->overrun_backoff_time_ms > 0) {
-                uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
-                INIT_DELAYED_WORK(&uart->overrun_backoff,
-                                  serial_8250_overrun_backoff_work);
-        } else {
-                uart->overrun_backoff_time_ms = 0;
+                /* Initialise interrupt backoff work if required */
+                if (up->overrun_backoff_time_ms > 0) {
+                        uart->overrun_backoff_time_ms =
+                                up->overrun_backoff_time_ms;
+                        INIT_DELAYED_WORK(&uart->overrun_backoff,
+                                        serial_8250_overrun_backoff_work);
+                } else {
+                        uart->overrun_backoff_time_ms = 0;
+                }
         }
 
         mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 241a48e5052c..debdd1b9e01a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
         }
 
         /* ask the core to calculate the divisor */
-        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
 
         spin_lock_irqsave(&sport->port.lock, flags);
 
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index a72d6d9fb983..38016609c7fa 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -225,7 +225,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
         unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
         u32 geni_ios;
 
-        if (uart_console(uport) || !uart_cts_enabled(uport)) {
+        if (uart_console(uport)) {
                 mctrl |= TIOCM_CTS;
         } else {
                 geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
@@ -241,7 +241,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
 {
         u32 uart_manual_rfr = 0;
 
-        if (uart_console(uport) || !uart_cts_enabled(uport))
+        if (uart_console(uport))
                 return;
 
         if (!(mctrl & TIOCM_RTS))
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index d4cca5bdaf1c..5c01bb6d1c24 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -550,10 +550,12 @@ static int uart_put_char(struct tty_struct *tty, unsigned char c)
         int ret = 0;
 
         circ = &state->xmit;
-        if (!circ->buf)
+        port = uart_port_lock(state, flags);
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                 return 0;
+        }
 
-        port = uart_port_lock(state, flags);
         if (port && uart_circ_chars_free(circ) != 0) {
                 circ->buf[circ->head] = c;
                 circ->head = (circ->head + 1) & (UART_XMIT_SIZE - 1);
@@ -586,11 +588,13 @@ static int uart_write(struct tty_struct *tty,
                 return -EL3HLT;
         }
 
+        port = uart_port_lock(state, flags);
         circ = &state->xmit;
-        if (!circ->buf)
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                 return 0;
+        }
 
-        port = uart_port_lock(state, flags);
         while (port) {
                 c = CIRC_SPACE_TO_END(circ->head, circ->tail, UART_XMIT_SIZE);
                 if (count < c)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 23c6fd238422..21ffcce16927 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2189,7 +2189,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
         ld = tty_ldisc_ref_wait(tty);
         if (!ld)
                 return -EIO;
-        ld->ops->receive_buf(tty, &ch, &mbz, 1);
+        if (ld->ops->receive_buf)
+                ld->ops->receive_buf(tty, &ch, &mbz, 1);
         tty_ldisc_deref(ld);
         return 0;
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 41ec8e5010f3..bba75560d11e 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1272,6 +1272,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
         if (con_is_visible(vc))
                 update_screen(vc);
         vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
+        notify_update(vc);
         return err;
 }
 
@@ -2764,8 +2765,8 @@ rescan_last_byte:
         con_flush(vc, draw_from, draw_to, &draw_x);
         vc_uniscr_debug_check(vc);
         console_conditional_schedule();
-        console_unlock();
         notify_update(vc);
+        console_unlock();
         return n;
 }
 
@@ -2884,8 +2885,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
         unsigned char c;
         static DEFINE_SPINLOCK(printing_lock);
         const ushort *start;
-        ushort cnt = 0;
-        ushort myx;
+        ushort start_x, cnt;
         int kmsg_console;
 
         /* console busy or not yet initialized */
@@ -2898,10 +2898,6 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
         if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
                 vc = vc_cons[kmsg_console - 1].d;
 
-        /* read `x' only after setting currcons properly (otherwise
-           the `x' macro will read the x of the foreground console). */
-        myx = vc->vc_x;
-
         if (!vc_cons_allocated(fg_console)) {
                 /* impossible */
                 /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
@@ -2916,53 +2912,41 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
                 hide_cursor(vc);
 
         start = (ushort *)vc->vc_pos;
-
-        /* Contrived structure to try to emulate original need_wrap behaviour
-         * Problems caused when we have need_wrap set on '\n' character */
+        start_x = vc->vc_x;
+        cnt = 0;
         while (count--) {
                 c = *b++;
                 if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) {
-                        if (cnt > 0) {
-                                if (con_is_visible(vc))
-                                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                                vc->vc_x += cnt;
-                                if (vc->vc_need_wrap)
-                                        vc->vc_x--;
-                                cnt = 0;
-                        }
+                        if (cnt && con_is_visible(vc))
+                                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
+                        cnt = 0;
                         if (c == 8) {           /* backspace */
                                 bs(vc);
                                 start = (ushort *)vc->vc_pos;
-                                myx = vc->vc_x;
+                                start_x = vc->vc_x;
                                 continue;
                         }
                         if (c != 13)
                                 lf(vc);
                         cr(vc);
                         start = (ushort *)vc->vc_pos;
-                        myx = vc->vc_x;
+                        start_x = vc->vc_x;
                         if (c == 10 || c == 13)
                                 continue;
                 }
+                vc_uniscr_putc(vc, c);
                 scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
                 notify_write(vc, c);
                 cnt++;
-                if (myx == vc->vc_cols - 1) {
-                        vc->vc_need_wrap = 1;
-                        continue;
-                }
-                vc->vc_pos += 2;
-                myx++;
-        }
-        if (cnt > 0) {
-                if (con_is_visible(vc))
-                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                vc->vc_x += cnt;
-                if (vc->vc_x == vc->vc_cols) {
-                        vc->vc_x--;
+                if (vc->vc_x == vc->vc_cols - 1) {
                         vc->vc_need_wrap = 1;
+                } else {
+                        vc->vc_pos += 2;
+                        vc->vc_x++;
                 }
         }
+        if (cnt && con_is_visible(vc))
+                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
         set_cursor(vc);
         notify_update(vc);
 
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index e81de9ca8729..9b45aa422e69 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -316,7 +316,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
         if (IS_ERR(data->usbmisc_data))
                 return PTR_ERR(data->usbmisc_data);
 
-        if (of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC) {
+        if ((of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC)
+                && data->usbmisc_data) {
                 pdata.flags |= CI_HDRC_IMX_IS_HSIC;
                 data->usbmisc_data->hsic = 1;
                 data->pinctrl = devm_pinctrl_get(dev);
diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c
index dc7f7fd71684..c12ac56606c3 100644
--- a/drivers/usb/core/ledtrig-usbport.c
+++ b/drivers/usb/core/ledtrig-usbport.c
@@ -119,11 +119,6 @@ static const struct attribute_group ports_group = {
         .attrs = ports_attrs,
 };
 
-static const struct attribute_group *ports_groups[] = {
-        &ports_group,
-        NULL
-};
-
 /***************************************
  * Adding & removing ports
  ***************************************/
@@ -307,6 +302,7 @@ static int usbport_trig_notify(struct notifier_block *nb, unsigned long action,
 static int usbport_trig_activate(struct led_classdev *led_cdev)
 {
         struct usbport_trig_data *usbport_data;
+        int err;
 
         usbport_data = kzalloc(sizeof(*usbport_data), GFP_KERNEL);
         if (!usbport_data)
@@ -315,6 +311,9 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
 
         /* List of ports */
         INIT_LIST_HEAD(&usbport_data->ports);
+        err = sysfs_create_group(&led_cdev->dev->kobj, &ports_group);
+        if (err)
+                goto err_free;
         usb_for_each_dev(usbport_data, usbport_trig_add_usb_dev_ports);
         usbport_trig_update_count(usbport_data);
 
@@ -322,8 +321,11 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
         usbport_data->nb.notifier_call = usbport_trig_notify;
         led_set_trigger_data(led_cdev, usbport_data);
         usb_register_notify(&usbport_data->nb);
-
         return 0;
+
+err_free:
+        kfree(usbport_data);
+        return err;
 }
 
 static void usbport_trig_deactivate(struct led_classdev *led_cdev)
@@ -335,6 +337,8 @@ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
                 usbport_trig_remove_port(usbport_data, port);
         }
 
+        sysfs_remove_group(&led_cdev->dev->kobj, &ports_group);
+
         usb_unregister_notify(&usbport_data->nb);
 
         kfree(usbport_data);
@@ -344,7 +348,6 @@ static struct led_trigger usbport_led_trigger = {
         .name     = "usbport",
         .activate = usbport_trig_activate,
         .deactivate = usbport_trig_deactivate,
-        .groups = ports_groups,
 };
 
 static int __init usbport_trig_init(void)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 68ad75a7460d..55ef3cc2701b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -261,7 +261,7 @@ static void dwc2_gadget_wkup_alert_handler(struct dwc2_hsotg *hsotg)
 
         if (gintsts2 & GINTSTS2_WKUP_ALERT_INT) {
                 dev_dbg(hsotg->dev, "%s: Wkup_Alert_Int\n", __func__);
-                dwc2_clear_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
+                dwc2_set_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
                 dwc2_set_bit(hsotg, DCTL, DCTL_RMTWKUPSIG);
         }
 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07bd31bb2f8a..bed2ff42780b 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
         req->started = false;
         list_del(&req->list);
         req->remaining = 0;
+        req->needs_extra_trb = false;
 
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
@@ -1984,6 +1985,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
 
         /* begin to receive SETUP packets */
         dwc->ep0state = EP0_SETUP_PHASE;
+        dwc->link_state = DWC3_LINK_STATE_SS_DIS;
         dwc3_ep0_out_start(dwc);
 
         dwc3_gadget_enable_irq(dwc);
@@ -3379,6 +3381,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
         dwc3_disconnect_gadget(dwc);
         __dwc3_gadget_stop(dwc);
 
+        synchronize_irq(dwc->irq_gadget);
+
         return 0;
 }
 
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index 9cdef108fb1b..ed68a4860b7d 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
 
         ss = kzalloc(sizeof(*ss), GFP_KERNEL);
         if (!ss)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         ss_opts =  container_of(fi, struct f_ss_opts, func_inst);
 
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f26109eafdbf..66ec1fdf9fe7 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -302,3 +302,4 @@ MODULE_AUTHOR("Chao Xie <chao.xie@marvell.com>");
 MODULE_AUTHOR("Neil Zhang <zhangwm@marvell.com>");
 MODULE_ALIAS("mv-ehci");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ehci_mv_dt_ids);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ab2a6191013..77ef4c481f3c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1783,6 +1783,10 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
         int result;
         u16 val;
 
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
+
         val = (mode << 8) | (priv->gpio_output << 4) | priv->gpio_value;
         result = usb_control_msg(serial->dev,
                                  usb_sndctrlpipe(serial->dev, 0),
@@ -1795,6 +1799,8 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
                         val, result);
         }
 
+        usb_autopm_put_interface(serial->interface);
+
         return result;
 }
 
@@ -1846,9 +1852,15 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
         unsigned char *buf;
         int result;
 
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
+
         buf = kmalloc(1, GFP_KERNEL);
-        if (!buf)
+        if (!buf) {
+                usb_autopm_put_interface(serial->interface);
                 return -ENOMEM;
+        }
 
         result = usb_control_msg(serial->dev,
                                  usb_rcvctrlpipe(serial->dev, 0),
@@ -1863,6 +1875,7 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
         }
 
         kfree(buf);
+        usb_autopm_put_interface(serial->interface);
 
         return result;
 }
diff --git a/drivers/usb/serial/keyspan_usa26msg.h b/drivers/usb/serial/keyspan_usa26msg.h
index 09e21e84fc4e..a68f1fb25b8a 100644
--- a/drivers/usb/serial/keyspan_usa26msg.h
+++ b/drivers/usb/serial/keyspan_usa26msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa26msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa28msg.h b/drivers/usb/serial/keyspan_usa28msg.h
index dee454c4609a..a19f3fe5d98d 100644
--- a/drivers/usb/serial/keyspan_usa28msg.h
+++ b/drivers/usb/serial/keyspan_usa28msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa28msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa49msg.h b/drivers/usb/serial/keyspan_usa49msg.h
index 163b2dea2ec5..8c3970fdd868 100644
--- a/drivers/usb/serial/keyspan_usa49msg.h
+++ b/drivers/usb/serial/keyspan_usa49msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa49msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa67msg.h b/drivers/usb/serial/keyspan_usa67msg.h
index 20fa3e2f7187..dcf502fdbb44 100644
--- a/drivers/usb/serial/keyspan_usa67msg.h
+++ b/drivers/usb/serial/keyspan_usa67msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa67msg.h
 
diff --git a/drivers/usb/serial/keyspan_usa90msg.h b/drivers/usb/serial/keyspan_usa90msg.h
index 86708ecd8735..c4ca0f631d20 100644
--- a/drivers/usb/serial/keyspan_usa90msg.h
+++ b/drivers/usb/serial/keyspan_usa90msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
         usa90msg.h
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 98e7a5df0f6d..bb3f9aa4a909 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -46,6 +46,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 4e2554d55362..559941ca884d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -8,6 +8,7 @@
 
 #define PL2303_VENDOR_ID        0x067b
 #define PL2303_PRODUCT_ID       0x2303
+#define PL2303_PRODUCT_ID_TB            0x2304
 #define PL2303_PRODUCT_ID_RSAQ2         0x04bb
 #define PL2303_PRODUCT_ID_DCU11         0x1234
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
@@ -20,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 #define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 
+
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4d0273508043..edbbb13d6de6 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -85,7 +85,8 @@ DEVICE(moto_modem, MOTO_IDS);
 /* Motorola Tetra driver */
 #define MOTOROLA_TETRA_IDS()                    \
         { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
-        { USB_DEVICE(0x0cad, 0x9012) }  /* MTP6550 */
+        { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
+        { USB_DEVICE(0x0cad, 0x9016) }  /* TPG2200 */
 DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
 
 /* Novatel Wireless GPS driver */
diff --git a/drivers/usb/usbip/README b/drivers/usb/usbip/README
deleted file mode 100644
index 41a2cf2e77a6..000000000000
--- a/drivers/usb/usbip/README
+++ /dev/null
@@ -1,7 +0,0 @@
-TODO:
-        - more discussion about the protocol
-        - testing
-        - review of the userspace interface
-        - document the protocol
-
-Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/vfio/pci/trace.h b/drivers/vfio/pci/trace.h
index 4d13e510590e..b2aa986ab9ed 100644
--- a/drivers/vfio/pci/trace.h
+++ b/drivers/vfio/pci/trace.h
@@ -1,13 +1,9 @@
-/* SPDX-License-Identifier: GPL-2.0+ */
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
  * VFIO PCI mmap/mmap_fault tracepoints
  *
  * Copyright (C) 2018 IBM Corp.  All rights reserved.
  *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #undef TRACE_SYSTEM
diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
index 054a2cf9dd8e..32f695ffe128 100644
--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -1,14 +1,10 @@
-// SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0-only
 /*
  * VFIO PCI NVIDIA Whitherspoon GPU support a.k.a. NVLink2.
  *
  * Copyright (C) 2018 IBM Corp.  All rights reserved.
  *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
  * Register an on-GPU RAM region for cacheable access.
  *
  * Derived from original vfio_pci_igd.c:
@@ -178,11 +174,11 @@ static int vfio_pci_nvgpu_add_capability(struct vfio_pci_device *vdev,
                 struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
         struct vfio_pci_nvgpu_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt cap = { 0 };
-
-        cap.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        cap.header.version = 1;
-        cap.tgt = data->gpu_tgt;
+        struct vfio_region_info_cap_nvlink2_ssatgt cap = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
 
         return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
 }
@@ -365,18 +361,18 @@ static int vfio_pci_npu2_add_capability(struct vfio_pci_device *vdev,
                 struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
         struct vfio_pci_npu2_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt captgt = { 0 };
-        struct vfio_region_info_cap_nvlink2_lnkspd capspd = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt captgt = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
+        struct vfio_region_info_cap_nvlink2_lnkspd capspd = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD,
+                .header.version = 1,
+                .link_speed = data->link_speed
+        };
         int ret;
 
-        captgt.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        captgt.header.version = 1;
-        captgt.tgt = data->gpu_tgt;
-
-        capspd.header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD;
-        capspd.header.version = 1;
-        capspd.link_speed = data->link_speed;
-
         ret = vfio_info_add_capability(caps, &captgt.header, sizeof(captgt));
         if (ret)
                 return ret;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 09731b2f6815..c6b3bdbbdbc9 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -271,6 +271,7 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 
 static void vgacon_restore_screen(struct vc_data *c)
 {
+        c->vc_origin = c->vc_visible_origin;
         vgacon_scrollback_cur->save = 0;
 
         if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
@@ -287,8 +288,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
         int start, end, count, soff;
 
         if (!lines) {
-                c->vc_visible_origin = c->vc_origin;
-                vga_set_mem_top(c);
+                vgacon_restore_screen(c);
                 return;
         }
 
@@ -298,6 +298,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
         if (!vgacon_scrollback_cur->save) {
                 vgacon_cursor(c, CM_ERASE);
                 vgacon_save_screen(c);
+                c->vc_origin = (unsigned long)c->vc_screenbuf;
                 vgacon_scrollback_cur->save = 1;
         }
 
@@ -335,7 +336,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
                 int copysize;
 
                 int diff = c->vc_rows - count;
-                void *d = (void *) c->vc_origin;
+                void *d = (void *) c->vc_visible_origin;
                 void *s = (void *) c->vc_screenbuf;
 
                 count *= c->vc_size_row;
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 989cf872b98c..bb7888429be6 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -645,7 +645,7 @@ xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
                      void *cpu_addr, dma_addr_t dma_addr, size_t size,
                      unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
         if (xen_get_dma_ops(dev)->mmap)
                 return xen_get_dma_ops(dev)->mmap(dev, vma, cpu_addr,
                                                     dma_addr, size, attrs);
@@ -662,7 +662,7 @@ xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
                         void *cpu_addr, dma_addr_t handle, size_t size,
                         unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
         if (xen_get_dma_ops(dev)->get_sgtable) {
 #if 0
         /*
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 94c026bba2c2..bba28a5034ba 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1035,6 +1035,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
         list_del_init(&ci->i_snap_realm_item);
         ci->i_snap_realm_counter++;
         ci->i_snap_realm = NULL;
+        if (realm->ino == ci->i_vino.ino)
+                realm->inode = NULL;
         spin_unlock(&realm->inodes_with_caps_lock);
         ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
                             realm);
diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
index 03f4d24db8fe..9455d3aef0c3 100644
--- a/fs/ceph/quota.c
+++ b/fs/ceph/quota.c
@@ -3,19 +3,6 @@
  * quota.c - CephFS quota
  *
  * Copyright (C) 2017-2018 SUSE
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/statfs.h>
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 593fb422d0f3..e92a2fee3c57 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -252,6 +252,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
         seq_printf(m, ",ACL");
 #endif
         seq_putc(m, '\n');
+        seq_printf(m, "CIFSMaxBufSize: %d\n", CIFSMaxBufSize);
         seq_printf(m, "Active VFS Requests: %d\n", GlobalTotalActiveXid);
         seq_printf(m, "Servers:");
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index e18915415e13..bb54ccf8481c 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1549,18 +1549,26 @@ cifs_discard_remaining_data(struct TCP_Server_Info *server)
 }
 
 static int
-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+__cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+                     bool malformed)
 {
         int length;
-        struct cifs_readdata *rdata = mid->callback_data;
 
         length = cifs_discard_remaining_data(server);
-        dequeue_mid(mid, rdata->result);
+        dequeue_mid(mid, malformed);
         mid->resp_buf = server->smallbuf;
         server->smallbuf = NULL;
         return length;
 }
 
+static int
+cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+{
+        struct cifs_readdata *rdata = mid->callback_data;
+
+        return  __cifs_readv_discard(server, mid, rdata->result);
+}
+
 int
 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 {
@@ -1602,12 +1610,23 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                 return -1;
         }
 
+        /* set up first two iov for signature check and to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len = server->total_read - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
+
         /* Was the SMB read successful? */
         rdata->result = server->ops->map_error(buf, false);
         if (rdata->result != 0) {
                 cifs_dbg(FYI, "%s: server returned error %d\n",
                          __func__, rdata->result);
-                return cifs_readv_discard(server, mid);
+                /* normal error on read response */
+                return __cifs_readv_discard(server, mid, false);
         }
 
         /* Is there enough to get to the rest of the READ_RSP header? */
@@ -1651,14 +1670,6 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                 server->total_read += length;
         }
 
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->total_read - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%u\n",
-                 rdata->iov[0].iov_base, server->total_read);
-
         /* how much data is in the response? */
 #ifdef CONFIG_CIFS_SMB_DIRECT
         use_rdma_mr = rdata->mr;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 683310f26171..8463c940e0e5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -720,6 +720,21 @@ server_unresponsive(struct TCP_Server_Info *server)
         return false;
 }
 
+static inline bool
+zero_credits(struct TCP_Server_Info *server)
+{
+        int val;
+
+        spin_lock(&server->req_lock);
+        val = server->credits + server->echo_credits + server->oplock_credits;
+        if (server->in_flight == 0 && val == 0) {
+                spin_unlock(&server->req_lock);
+                return true;
+        }
+        spin_unlock(&server->req_lock);
+        return false;
+}
+
 static int
 cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 {
@@ -732,6 +747,12 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
         for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
                 try_to_freeze();
 
+                /* reconnect if no credits and no requests in flight */
+                if (zero_credits(server)) {
+                        cifs_reconnect(server);
+                        return -ECONNABORTED;
+                }
+
                 if (server_unresponsive(server))
                         return -ECONNABORTED;
                 if (cifs_rdma_enabled(server) && server->smbd_conn)
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index f14533da3a93..01a76bccdb8d 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -293,6 +293,8 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
         int rc;
         struct smb2_file_all_info *smb2_data;
         __u32 create_options = 0;
+        struct cifs_fid fid;
+        bool no_cached_open = tcon->nohandlecache;
 
         *adjust_tz = false;
         *symlink = false;
@@ -301,6 +303,21 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
                             GFP_KERNEL);
         if (smb2_data == NULL)
                 return -ENOMEM;
+
+        /* If it is a root and its handle is cached then use it */
+        if (!strlen(full_path) && !no_cached_open) {
+                rc = open_shroot(xid, tcon, &fid);
+                if (rc)
+                        goto out;
+                rc = SMB2_query_info(xid, tcon, fid.persistent_fid,
+                                     fid.volatile_fid, smb2_data);
+                close_shroot(&tcon->crfid);
+                if (rc)
+                        goto out;
+                move_smb2_info_to_cifs(data, smb2_data);
+                goto out;
+        }
+
         if (backup_cred(cifs_sb))
                 create_options |= CREATE_OPEN_BACKUP_INTENT;
 
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 6a9c47541c53..7b8b58fb4d3f 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -648,6 +648,13 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
         if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
                 return false;
 
+        if (rsp->sync_hdr.CreditRequest) {
+                spin_lock(&server->req_lock);
+                server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                spin_unlock(&server->req_lock);
+                wake_up(&server->request_q);
+        }
+
         if (rsp->StructureSize !=
                                 smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
                 if (le16_to_cpu(rsp->StructureSize) == 44)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index cf7eb891804f..153238fc4fa9 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -34,6 +34,7 @@
 #include "cifs_ioctl.h"
 #include "smbdirect.h"
 
+/* Change credits for different ops and return the total number of credits */
 static int
 change_conf(struct TCP_Server_Info *server)
 {
@@ -41,17 +42,15 @@ change_conf(struct TCP_Server_Info *server)
         server->oplock_credits = server->echo_credits = 0;
         switch (server->credits) {
         case 0:
-                return -1;
+                return 0;
         case 1:
                 server->echoes = false;
                 server->oplocks = false;
-                cifs_dbg(VFS, "disabling echoes and oplocks\n");
                 break;
         case 2:
                 server->echoes = true;
                 server->oplocks = false;
                 server->echo_credits = 1;
-                cifs_dbg(FYI, "disabling oplocks\n");
                 break;
         default:
                 server->echoes = true;
@@ -64,14 +63,15 @@ change_conf(struct TCP_Server_Info *server)
                 server->echo_credits = 1;
         }
         server->credits -= server->echo_credits + server->oplock_credits;
-        return 0;
+        return server->credits + server->echo_credits + server->oplock_credits;
 }
 
 static void
 smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
                  const int optype)
 {
-        int *val, rc = 0;
+        int *val, rc = -1;
+
         spin_lock(&server->req_lock);
         val = server->ops->get_credits_field(server, optype);
 
@@ -101,8 +101,26 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
         }
         spin_unlock(&server->req_lock);
         wake_up(&server->request_q);
-        if (rc)
-                cifs_reconnect(server);
+
+        if (server->tcpStatus == CifsNeedReconnect)
+                return;
+
+        switch (rc) {
+        case -1:
+                /* change_conf hasn't been executed */
+                break;
+        case 0:
+                cifs_dbg(VFS, "Possible client or server bug - zero credits\n");
+                break;
+        case 1:
+                cifs_dbg(VFS, "disabling echoes and oplocks\n");
+                break;
+        case 2:
+                cifs_dbg(FYI, "disabling oplocks\n");
+                break;
+        default:
+                cifs_dbg(FYI, "add %u credits total=%d\n", add, rc);
+        }
 }
 
 static void
@@ -136,7 +154,11 @@ smb2_get_credits(struct mid_q_entry *mid)
 {
         struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)mid->resp_buf;
 
-        return le16_to_cpu(shdr->CreditRequest);
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
+                return le16_to_cpu(shdr->CreditRequest);
+
+        return 0;
 }
 
 static int
@@ -165,14 +187,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
 
                         scredits = server->credits;
                         /* can deadlock with reopen */
-                        if (scredits == 1) {
+                        if (scredits <= 8) {
                                 *num = SMB2_MAX_BUFFER_SIZE;
                                 *credits = 0;
                                 break;
                         }
 
-                        /* leave one credit for a possible reopen */
-                        scredits--;
+                        /* leave some credits for reopen and other ops */
+                        scredits -= 8;
                         *num = min_t(unsigned int, size,
                                      scredits * SMB2_MAX_BUFFER_SIZE);
 
@@ -3189,11 +3211,23 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                         server->ops->is_status_pending(buf, server, 0))
                 return -1;
 
-        rdata->result = server->ops->map_error(buf, false);
+        /* set up first two iov to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len =
+                min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
+
+        rdata->result = server->ops->map_error(buf, true);
         if (rdata->result != 0) {
                 cifs_dbg(FYI, "%s: server returned error %d\n",
                          __func__, rdata->result);
-                dequeue_mid(mid, rdata->result);
+                /* normal error on read response */
+                dequeue_mid(mid, false);
                 return 0;
         }
 
@@ -3266,14 +3300,6 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                 return 0;
         }
 
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->vals->read_rsp_size - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
-                 rdata->iov[0].iov_base, server->vals->read_rsp_size);
-
         length = rdata->copy_into_pages(server, rdata, &iter);
 
         kfree(bvec);
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 50811a7dc0e0..2ff209ec4fab 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2816,6 +2816,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
         int resp_buftype = CIFS_NO_BUFFER;
         struct cifs_ses *ses = tcon->ses;
         int flags = 0;
+        bool allocated = false;
 
         cifs_dbg(FYI, "Query Info\n");
 
@@ -2855,14 +2856,21 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
                                         "Error %d allocating memory for acl\n",
                                         rc);
                                 *dlen = 0;
+                                rc = -ENOMEM;
                                 goto qinf_exit;
                         }
+                        allocated = true;
                 }
         }
 
         rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
                                         le32_to_cpu(rsp->OutputBufferLength),
                                         &rsp_iov, min_len, *data);
+        if (rc && allocated) {
+                kfree(*data);
+                *data = NULL;
+                *dlen = 0;
+        }
 
 qinf_exit:
         SMB2_query_info_free(&rqst);
@@ -2916,9 +2924,10 @@ smb2_echo_callback(struct mid_q_entry *mid)
 {
         struct TCP_Server_Info *server = mid->callback_data;
         struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
 
-        if (mid->mid_state == MID_RESPONSE_RECEIVED)
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
                 credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
 
         DeleteMidQEntry(mid);
@@ -3175,7 +3184,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
         struct TCP_Server_Info *server = tcon->ses->server;
         struct smb2_sync_hdr *shdr =
                                 (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
         struct smb_rqst rqst = { .rq_iov = rdata->iov,
                                  .rq_nvec = 2,
                                  .rq_pages = rdata->pages,
@@ -3214,6 +3223,9 @@ smb2_readv_callback(struct mid_q_entry *mid)
                 task_io_account_read(rdata->got_bytes);
                 cifs_stats_bytes_read(tcon, rdata->got_bytes);
                 break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(shdr->CreditRequest);
+                /* fall through */
         default:
                 if (rdata->result != -ENODATA)
                         rdata->result = -EIO;
@@ -3399,7 +3411,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
         unsigned int written;
         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
 
         switch (mid->mid_state) {
         case MID_RESPONSE_RECEIVED:
@@ -3427,6 +3439,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
         case MID_RETRY_NEEDED:
                 wdata->result = -EAGAIN;
                 break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                /* fall through */
         default:
                 wdata->result = -EIO;
                 break;
diff --git a/fs/cifs/trace.c b/fs/cifs/trace.c
index bd4a546feec1..465483787193 100644
--- a/fs/cifs/trace.c
+++ b/fs/cifs/trace.c
@@ -3,16 +3,6 @@
  *   Copyright (C) 2018, Microsoft Corporation.
  *
  *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
  */
 #define CREATE_TRACE_POINTS
 #include "trace.h"
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index fb049809555f..59be48206932 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -3,16 +3,6 @@
  *   Copyright (C) 2018, Microsoft Corporation.
  *
  *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
  */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM cifs
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 202e0e84efdd..53532bd3f50d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -786,17 +786,8 @@ static void
 cifs_compound_callback(struct mid_q_entry *mid)
 {
         struct TCP_Server_Info *server = mid->server;
-        unsigned int optype = mid->optype;
-        unsigned int credits_received = 0;
 
-        if (mid->mid_state == MID_RESPONSE_RECEIVED) {
-                if (mid->resp_buf)
-                        credits_received = server->ops->get_credits(mid);
-                else
-                        cifs_dbg(FYI, "Bad state for cancelled MID\n");
-        }
-
-        add_credits(server, credits_received, optype);
+        add_credits(server, server->ops->get_credits(mid), mid->optype);
 }
 
 static void
diff --git a/fs/direct-io.c b/fs/direct-io.c
index dbc1a1f080ce..ec2fb6fe6d37 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
         unsigned long fs_count; /* Number of filesystem-sized blocks */
         int create;
         unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor;
+        loff_t i_size;
 
         /*
          * If there was a memory error and we've overwritten all the
@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
                  */
                 create = dio->op == REQ_OP_WRITE;
                 if (dio->flags & DIO_SKIP_HOLES) {
-                        if (fs_startblk <= ((i_size_read(dio->inode) - 1) >>
-                                                        i_blkbits))
+                        i_size = i_size_read(dio->inode);
+                        if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits)
                                 create = 0;
                 }
 
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b40168fcc94a..36855c1f8daf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -331,11 +331,22 @@ struct inode_switch_wbs_context {
         struct work_struct      work;
 };
 
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        down_write(&bdi->wb_switch_rwsem);
+}
+
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        up_write(&bdi->wb_switch_rwsem);
+}
+
 static void inode_switch_wbs_work_fn(struct work_struct *work)
 {
         struct inode_switch_wbs_context *isw =
                 container_of(work, struct inode_switch_wbs_context, work);
         struct inode *inode = isw->inode;
+        struct backing_dev_info *bdi = inode_to_bdi(inode);
         struct address_space *mapping = inode->i_mapping;
         struct bdi_writeback *old_wb = inode->i_wb;
         struct bdi_writeback *new_wb = isw->new_wb;
@@ -344,6 +355,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
         bool switched = false;
 
         /*
+         * If @inode switches cgwb membership while sync_inodes_sb() is
+         * being issued, sync_inodes_sb() might miss it.  Synchronize.
+         */
+        down_read(&bdi->wb_switch_rwsem);
+
+        /*
          * By the time control reaches here, RCU grace period has passed
          * since I_WB_SWITCH assertion and all wb stat update transactions
          * between unlocked_inode_to_wb_begin/end() are guaranteed to be
@@ -428,6 +445,8 @@ skip_switch:
         spin_unlock(&new_wb->list_lock);
         spin_unlock(&old_wb->list_lock);
 
+        up_read(&bdi->wb_switch_rwsem);
+
         if (switched) {
                 wb_wakeup(new_wb);
                 wb_put(old_wb);
@@ -468,9 +487,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
         if (inode->i_state & I_WB_SWITCH)
                 return;
 
+        /*
+         * Avoid starting new switches while sync_inodes_sb() is in
+         * progress.  Otherwise, if the down_write protected issue path
+         * blocks heavily, we might end up starting a large number of
+         * switches which will block on the rwsem.
+         */
+        if (!down_read_trylock(&bdi->wb_switch_rwsem))
+                return;
+
         isw = kzalloc(sizeof(*isw), GFP_ATOMIC);
         if (!isw)
-                return;
+                goto out_unlock;
 
         /* find and pin the new wb */
         rcu_read_lock();
@@ -504,12 +532,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
          * Let's continue after I_WB_SWITCH is guaranteed to be visible.
          */
         call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
-        return;
+        goto out_unlock;
 
 out_free:
         if (isw->new_wb)
                 wb_put(isw->new_wb);
         kfree(isw);
+out_unlock:
+        up_read(&bdi->wb_switch_rwsem);
 }
 
 /**
@@ -887,6 +917,9 @@ fs_initcall(cgroup_writeback_init);
 
 #else   /* CONFIG_CGROUP_WRITEBACK */
 
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
+
 static struct bdi_writeback *
 locked_inode_to_wb_and_lock_list(struct inode *inode)
         __releases(&inode->i_lock)
@@ -2413,8 +2446,11 @@ void sync_inodes_sb(struct super_block *sb)
                 return;
         WARN_ON(!rwsem_is_locked(&sb->s_umount));
 
+        /* protect against inode wb switch, see inode_switch_wbs_work_fn() */
+        bdi_down_write_wb_switch_rwsem(bdi);
         bdi_split_work_to_wbs(bdi, &work, false);
         wb_wait_for_completion(bdi, &done);
+        bdi_up_write_wb_switch_rwsem(bdi);
 
         wait_sb_inodes(sb);
 }
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 105576daca4a..798f1253141a 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -724,8 +724,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
                 return -EBADF;
 
         /* IN_MASK_ADD and IN_MASK_CREATE don't make sense together */
-        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE)))
-                return -EINVAL;
+        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE))) {
+                ret = -EINVAL;
+                goto fput_and_out;
+        }
 
         /* verify that this is indeed an inotify instance */
         if (unlikely(f.file->f_op != &inotify_fops)) {
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index c31157135598..07e02d6df5ad 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -190,6 +190,7 @@ struct backing_dev_info {
         struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
         struct rb_root cgwb_congested_tree; /* their congested states */
         struct mutex cgwb_release_mutex;  /* protect shutdown of wb structs */
+        struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */
 #else
         struct bdi_writeback_congested *wb_congested;
 #endif
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 5c7e7f859a24..d66bf5f32610 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -287,7 +287,7 @@ enum req_opf {
         REQ_OP_DISCARD          = 3,
         /* securely erase sectors */
         REQ_OP_SECURE_ERASE     = 5,
-        /* seset a zone write pointer */
+        /* reset a zone write pointer */
         REQ_OP_ZONE_RESET       = 6,
         /* write the same sector many times */
         REQ_OP_WRITE_SAME       = 7,
diff --git a/include/linux/hid.h b/include/linux/hid.h
index d99287327ef2..f9707d1dcb58 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -430,7 +430,7 @@ struct hid_local {
  */
 
 struct hid_collection {
-        struct hid_collection *parent;
+        int parent_idx; /* device->collection */
         unsigned type;
         unsigned usage;
         unsigned level;
@@ -658,7 +658,6 @@ struct hid_parser {
         unsigned int         *collection_stack;
         unsigned int          collection_stack_ptr;
         unsigned int          collection_stack_size;
-        struct hid_collection *active_collection;
         struct hid_device    *device;
         unsigned int          scan_flags;
 };
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index f0885cc01db6..dcb6977afce9 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1159,8 +1159,9 @@ struct hv_ring_buffer_debug_info {
         u32 bytes_avail_towrite;
 };
 
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                            struct hv_ring_buffer_debug_info *debug_info);
+
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+                                struct hv_ring_buffer_debug_info *debug_info);
 
 /* Vmbus interface */
 #define vmbus_driver_register(driver)   \
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 6756fea18b69..e44746de95cd 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
         case ARPHRD_IPGRE:
         case ARPHRD_VOID:
         case ARPHRD_NONE:
+        case ARPHRD_RAWIP:
                 return false;
         default:
                 return true;
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 7315977b64da..ad609617aeb8 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -235,7 +235,6 @@ static inline struct nvdimm *nvdimm_create(struct nvdimm_bus *nvdimm_bus,
                         cmd_mask, num_flush, flush_wpq, NULL, NULL);
 }
 
-int nvdimm_security_setup_events(struct nvdimm *nvdimm);
 const struct nd_cmd_desc *nd_cmd_dimm_desc(int cmd);
 const struct nd_cmd_desc *nd_cmd_bus_desc(int cmd);
 u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index f492e21c4aa2..5d9d318bcf7a 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -176,7 +176,8 @@ static inline bool xa_is_internal(const void *entry)
  */
 static inline bool xa_is_err(const void *entry)
 {
-        return unlikely(xa_is_internal(entry));
+        return unlikely(xa_is_internal(entry) &&
+                        entry >= xa_mk_internal(-MAX_ERRNO));
 }
 
 /**
@@ -286,7 +287,6 @@ struct xarray {
  */
 #define DEFINE_XARRAY_ALLOC(name) DEFINE_XARRAY_FLAGS(name, XA_FLAGS_ALLOC)
 
-void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *xa_erase(struct xarray *, unsigned long index);
@@ -304,6 +304,24 @@ unsigned int xa_extract(struct xarray *, void **dst, unsigned long start,
 void xa_destroy(struct xarray *);
 
 /**
+ * xa_init_flags() - Initialise an empty XArray with flags.
+ * @xa: XArray.
+ * @flags: XA_FLAG values.
+ *
+ * If you need to initialise an XArray with special flags (eg you need
+ * to take the lock from interrupt context), use this function instead
+ * of xa_init().
+ *
+ * Context: Any context.
+ */
+static inline void xa_init_flags(struct xarray *xa, gfp_t flags)
+{
+        spin_lock_init(&xa->xa_lock);
+        xa->xa_flags = flags;
+        xa->xa_head = NULL;
+}
+
+/**
  * xa_init() - Initialise an empty XArray.
  * @xa: XArray.
  *
@@ -342,20 +360,45 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 
 /**
- * xa_for_each() - Iterate over a portion of an XArray.
+ * xa_for_each_start() - Iterate over a portion of an XArray.
  * @xa: XArray.
+ * @index: Index of @entry.
  * @entry: Entry retrieved from array.
+ * @start: First index to retrieve from array.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  You may modify @index during the iteration if you
+ * want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set
+ * to NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_start() is O(n.log(n)) while xas_for_each() is O(n).  You have
+ * to handle your own locking with xas_for_each(), and if you have to unlock
+ * after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_start() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each() iterator instead.
+ * The xas_for_each() iterator will expand into more inline code than
+ * xa_for_each_start().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_start(xa, index, entry, start)                      \
+        for (index = start,                                             \
+             entry = xa_find(xa, &index, ULONG_MAX, XA_PRESENT);        \
+             entry;                                                     \
+             entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT))
+
+/**
+ * xa_for_each() - Iterate over present entries in an XArray.
+ * @xa: XArray.
  * @index: Index of @entry.
- * @max: Maximum index to retrieve from array.
- * @filter: Selection criterion.
+ * @entry: Entry retrieved from array.
  *
- * Initialise @index to the lowest index you want to retrieve from the
- * array.  During the iteration, @entry will have the value of the entry
- * stored in @xa at @index.  The iteration will skip all entries in the
- * array which do not match @filter.  You may modify @index during the
- * iteration if you want to skip or reprocess indices.  It is safe to modify
- * the array during the iteration.  At the end of the iteration, @entry will
- * be set to NULL and @index will have a value less than or equal to max.
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  You may modify @index during the iteration if you want
+ * to skip or reprocess indices.  It is safe to modify the array during the
+ * iteration.  At the end of the iteration, @entry will be set to NULL and
+ * @index will have a value less than or equal to max.
  *
  * xa_for_each() is O(n.log(n)) while xas_for_each() is O(n).  You have
  * to handle your own locking with xas_for_each(), and if you have to unlock
@@ -366,9 +409,36 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
  *
  * Context: Any context.  Takes and releases the RCU lock.
  */
-#define xa_for_each(xa, entry, index, max, filter) \
-        for (entry = xa_find(xa, &index, max, filter); entry; \
-             entry = xa_find_after(xa, &index, max, filter))
+#define xa_for_each(xa, index, entry) \
+        xa_for_each_start(xa, index, entry, 0)
+
+/**
+ * xa_for_each_marked() - Iterate over marked entries in an XArray.
+ * @xa: XArray.
+ * @index: Index of @entry.
+ * @entry: Entry retrieved from array.
+ * @filter: Selection criterion.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  The iteration will skip all entries in the array
+ * which do not match @filter.  You may modify @index during the iteration
+ * if you want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set to
+ * NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_marked() is O(n.log(n)) while xas_for_each_marked() is O(n).
+ * You have to handle your own locking with xas_for_each(), and if you have
+ * to unlock after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_marked() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each_marked() iterator
+ * instead.  The xas_for_each_marked() iterator will expand into more inline
+ * code than xa_for_each_marked().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_marked(xa, index, entry, filter) \
+        for (index = 0, entry = xa_find(xa, &index, ULONG_MAX, filter); \
+             entry; entry = xa_find_after(xa, &index, ULONG_MAX, filter))
 
 #define xa_trylock(xa)          spin_trylock(&(xa)->xa_lock)
 #define xa_lock(xa)             spin_lock(&(xa)->xa_lock)
@@ -393,40 +463,13 @@ void *__xa_erase(struct xarray *, unsigned long index);
 void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                 void *entry, gfp_t);
+int __xa_insert(struct xarray *, unsigned long index, void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
 int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 
 /**
- * __xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use __xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Any context.  Expects xa_lock to be held on entry.  May
- *          release and reacquire xa_lock if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int __xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = __xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-
-/**
  * xa_store_bh() - Store this entry in the XArray.
  * @xa: XArray.
  * @index: Index into array.
@@ -453,7 +496,7 @@ static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
 }
 
 /**
- * xa_store_irq() - Erase this entry from the XArray.
+ * xa_store_irq() - Store this entry in the XArray.
  * @xa: XArray.
  * @index: Index into array.
  * @entry: New entry.
@@ -615,24 +658,83 @@ static inline void *xa_cmpxchg_irq(struct xarray *xa, unsigned long index,
  * @entry: New entry.
  * @gfp: Memory allocation flags.
  *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
  *
- * Context: Process context.  Takes and releases the xa_lock.
- *          May sleep if the @gfp flags permit.
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep if
+ * the @gfp flags permit.
  * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
  * -ENOMEM if memory could not be allocated.
  */
 static inline int xa_insert(struct xarray *xa, unsigned long index,
                 void *entry, gfp_t gfp)
 {
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
+        int err;
+
+        xa_lock(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock(xa);
+
+        return err;
+}
+
+/**
+ * xa_insert_bh() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+
+        xa_lock_bh(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+
+        return err;
+}
+
+/**
+ * xa_insert_irq() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+
+        xa_lock_irq(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+
+        return err;
 }
 
 /**
@@ -970,8 +1072,8 @@ static inline bool xa_is_sibling(const void *entry)
                 (entry < xa_mk_sibling(XA_CHUNK_SIZE - 1));
 }
 
-#define XA_ZERO_ENTRY           xa_mk_internal(256)
-#define XA_RETRY_ENTRY          xa_mk_internal(257)
+#define XA_RETRY_ENTRY          xa_mk_internal(256)
+#define XA_ZERO_ENTRY           xa_mk_internal(257)
 
 /**
  * xa_is_zero() - Is the entry a zero entry?
@@ -996,6 +1098,17 @@ static inline bool xa_is_retry(const void *entry)
 }
 
 /**
+ * xa_is_advanced() - Is the entry only permitted for the advanced API?
+ * @entry: Entry to be stored in the XArray.
+ *
+ * Return: %true if the entry cannot be stored by the normal API.
+ */
+static inline bool xa_is_advanced(const void *entry)
+{
+        return xa_is_internal(entry) && (entry <= XA_RETRY_ENTRY);
+}
+
+/**
  * typedef xa_update_node_t - A callback function from the XArray.
  * @node: The node which is being processed
  *
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 3f9aea8087e3..8b7eb46ad72d 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -201,6 +201,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt)
 
 void __ax25_put_route(ax25_route *ax25_rt);
 
+extern rwlock_t ax25_route_lock;
+
+static inline void ax25_route_lock_use(void)
+{
+        read_lock(&ax25_route_lock);
+}
+
+static inline void ax25_route_lock_unuse(void)
+{
+        read_unlock(&ax25_route_lock);
+}
+
 static inline void ax25_put_route(ax25_route *ax25_rt)
 {
         if (refcount_dec_and_test(&ax25_rt->refcount))
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 8ec1de856ee7..e665f111b0d2 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -985,6 +985,12 @@ struct snd_soc_dai_link {
         /* Do not create a PCM for this DAI link (Backend link) */
         unsigned int ignore:1;
 
+        /*
+         * This driver uses legacy platform naming. Set by the core, machine
+         * drivers should not modify this value.
+         */
+        unsigned int legacy_platform:1;
+
         struct list_head list; /* DAI link list of the soc card */
         struct snd_soc_dobj dobj; /* For topology */
 };
diff --git a/include/uapi/linux/android/binder_ctl.h b/include/uapi/linux/android/binderfs.h
index 65b2efd1a0a5..87410477aea9 100644
--- a/include/uapi/linux/android/binder_ctl.h
+++ b/include/uapi/linux/android/binderfs.h
@@ -4,8 +4,8 @@
  *
  */
 
-#ifndef _UAPI_LINUX_BINDER_CTL_H
-#define _UAPI_LINUX_BINDER_CTL_H
+#ifndef _UAPI_LINUX_BINDERFS_H
+#define _UAPI_LINUX_BINDERFS_H
 
 #include <linux/android/binder.h>
 #include <linux/types.h>
@@ -22,8 +22,8 @@
  */
 struct binderfs_device {
         char name[BINDERFS_MAX_NAME + 1];
-        __u8 major;
-        __u8 minor;
+        __u32 major;
+        __u32 minor;
 };
 
 /**
@@ -31,5 +31,5 @@ struct binderfs_device {
  */
 #define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device)
 
-#endif /* _UAPI_LINUX_BINDER_CTL_H */
+#endif /* _UAPI_LINUX_BINDERFS_H */
 
diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h
index 6fa38d001d84..498eec813494 100644
--- a/include/uapi/linux/blkzoned.h
+++ b/include/uapi/linux/blkzoned.h
@@ -138,6 +138,7 @@ struct blk_zone_range {
  * @BLKRESETZONE: Reset the write pointer of the zones in the specified
  *                sector range. The sector range must be zone aligned.
  * @BLKGETZONESZ: Get the device zone size in number of 512 B sectors.
+ * @BLKGETNRZONES: Get the total number of zones of the device.
  */
 #define BLKREPORTZONE   _IOWR(0x12, 130, struct blk_zone_report)
 #define BLKRESETZONE    _IOW(0x12, 131, struct blk_zone_range)
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index fb78f6f500f3..f056b2a00d5c 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -26,13 +26,17 @@
  */
 
 struct input_event {
-#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL)
+#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL__)
         struct timeval time;
 #define input_event_sec time.tv_sec
 #define input_event_usec time.tv_usec
 #else
         __kernel_ulong_t __sec;
+#if defined(__sparc__) && defined(__arch64__)
+        unsigned int __usec;
+#else
         __kernel_ulong_t __usec;
+#endif
 #define input_event_sec  __sec
 #define input_event_usec __usec
 #endif
diff --git a/include/xen/arm/page-coherent.h b/include/xen/arm/page-coherent.h
index 59a260712a56..2ca9164a79bf 100644
--- a/include/xen/arm/page-coherent.h
+++ b/include/xen/arm/page-coherent.h
@@ -1,17 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
-#define _ASM_ARM_XEN_PAGE_COHERENT_H
-
-#include <asm/page.h>
-#include <asm/dma-mapping.h>
-#include <linux/dma-mapping.h>
-
-static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
-{
-        if (dev && dev->archdata.dev_dma_ops)
-                return dev->archdata.dev_dma_ops;
-        return get_arch_dma_ops(NULL);
-}
+#ifndef _XEN_ARM_PAGE_COHERENT_H
+#define _XEN_ARM_PAGE_COHERENT_H
 
 void __xen_dma_map_page(struct device *hwdev, struct page *page,
              dma_addr_t dev_addr, unsigned long offset, size_t size,
@@ -21,87 +10,7 @@ void __xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                 unsigned long attrs);
 void __xen_dma_sync_single_for_cpu(struct device *hwdev,
                 dma_addr_t handle, size_t size, enum dma_data_direction dir);
-
 void __xen_dma_sync_single_for_device(struct device *hwdev,
                 dma_addr_t handle, size_t size, enum dma_data_direction dir);
 
-static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
-                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
-{
-        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
-}
-
-static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
-                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
-{
-        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
-}
-
-static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             dma_addr_t dev_addr, unsigned long offset, size_t size,
-             enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long page_pfn = page_to_xen_pfn(page);
-        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
-        unsigned long compound_pages =
-                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
-        bool local = (page_pfn <= dev_pfn) &&
-                (dev_pfn - page_pfn < compound_pages);
-
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can span across
-         * multiple Xen pages, it's not possible for it to contain a
-         * mix of local and foreign Xen pages. So if the first xen_pfn
-         * == mfn the page is local otherwise it's a foreign page
-         * grant-mapped in dom0. If the page is local we can safely
-         * call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (local)
-                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
-        else
-                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
-}
-
-static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
-         * multiple Xen page, it's not possible to have a mix of local and
-         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
-         * foreign mfn will always return false. If the page is local we can
-         * safely call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->unmap_page)
-                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
-        } else
-                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
-}
-
-static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
-                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
-}
-
-static inline void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
-                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
-}
-
-#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
+#endif /* _XEN_ARM_PAGE_COHERENT_H */
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 4676c0a1eeca..c596a957f764 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -199,7 +199,7 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                 XA_BUG_ON(xa, xa_store_index(xa, index + 1, GFP_KERNEL));
                 xa_set_mark(xa, index + 1, XA_MARK_0);
                 XA_BUG_ON(xa, xa_store_index(xa, index + 2, GFP_KERNEL));
-                xa_set_mark(xa, index + 2, XA_MARK_1);
+                xa_set_mark(xa, index + 2, XA_MARK_2);
                 XA_BUG_ON(xa, xa_store_index(xa, next, GFP_KERNEL));
                 xa_store_order(xa, index, order, xa_mk_index(index),
                                 GFP_KERNEL);
@@ -209,8 +209,8 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                         void *entry;
 
                         XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_0));
-                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_1));
-                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
+                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_1));
+                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_2));
 
                         /* We should see two elements in the array */
                         rcu_read_lock();
@@ -357,7 +357,7 @@ static noinline void check_cmpxchg(struct xarray *xa)
 static noinline void check_reserve(struct xarray *xa)
 {
         void *entry;
-        unsigned long index = 0;
+        unsigned long index;
 
         /* An array with a reserved entry is not empty */
         XA_BUG_ON(xa, !xa_empty(xa));
@@ -382,10 +382,12 @@ static noinline void check_reserve(struct xarray *xa)
         xa_erase_index(xa, 12345678);
         XA_BUG_ON(xa, !xa_empty(xa));
 
-        /* And so does xa_insert */
+        /* But xa_insert does not */
         xa_reserve(xa, 12345678, GFP_KERNEL);
-        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
-        xa_erase_index(xa, 12345678);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) !=
+                        -EEXIST);
+        XA_BUG_ON(xa, xa_empty(xa));
+        XA_BUG_ON(xa, xa_erase(xa, 12345678) != NULL);
         XA_BUG_ON(xa, !xa_empty(xa));
 
         /* Can iterate through a reserved entry */
@@ -393,7 +395,7 @@ static noinline void check_reserve(struct xarray *xa)
         xa_reserve(xa, 6, GFP_KERNEL);
         xa_store_index(xa, 7, GFP_KERNEL);
 
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                 XA_BUG_ON(xa, index != 5 && index != 7);
         }
         xa_destroy(xa);
@@ -812,17 +814,16 @@ static noinline void check_find_1(struct xarray *xa)
 static noinline void check_find_2(struct xarray *xa)
 {
         void *entry;
-        unsigned long i, j, index = 0;
+        unsigned long i, j, index;
 
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                 XA_BUG_ON(xa, true);
         }
 
         for (i = 0; i < 1024; i++) {
                 xa_store_index(xa, index, GFP_KERNEL);
                 j = 0;
-                index = 0;
-                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+                xa_for_each(xa, index, entry) {
                         XA_BUG_ON(xa, xa_mk_index(index) != entry);
                         XA_BUG_ON(xa, index != j++);
                 }
@@ -839,6 +840,7 @@ static noinline void check_find_3(struct xarray *xa)
 
         for (i = 0; i < 100; i++) {
                 for (j = 0; j < 100; j++) {
+                        rcu_read_lock();
                         for (k = 0; k < 100; k++) {
                                 xas_set(&xas, j);
                                 xas_for_each_marked(&xas, entry, k, XA_MARK_0)
@@ -847,6 +849,7 @@ static noinline void check_find_3(struct xarray *xa)
                                         XA_BUG_ON(xa,
                                                 xas.xa_node != XAS_RESTART);
                         }
+                        rcu_read_unlock();
                 }
                 xa_store_index(xa, i, GFP_KERNEL);
                 xa_set_mark(xa, i, XA_MARK_0);
@@ -1183,6 +1186,35 @@ static noinline void check_store_range(struct xarray *xa)
         }
 }
 
+static void check_align_1(struct xarray *xa, char *name)
+{
+        int i;
+        unsigned int id;
+        unsigned long index;
+        void *entry;
+
+        for (i = 0; i < 8; i++) {
+                id = 0;
+                XA_BUG_ON(xa, xa_alloc(xa, &id, UINT_MAX, name + i, GFP_KERNEL)
+                                != 0);
+                XA_BUG_ON(xa, id != i);
+        }
+        xa_for_each(xa, index, entry)
+                XA_BUG_ON(xa, xa_is_err(entry));
+        xa_destroy(xa);
+}
+
+static noinline void check_align(struct xarray *xa)
+{
+        char name[] = "Motorola 68000";
+
+        check_align_1(xa, name);
+        check_align_1(xa, name + 1);
+        check_align_1(xa, name + 2);
+        check_align_1(xa, name + 3);
+//      check_align_2(xa, name);
+}
+
 static LIST_HEAD(shadow_nodes);
 
 static void test_update_node(struct xa_node *node)
@@ -1332,6 +1364,7 @@ static int xarray_checks(void)
         check_create_range(&array);
         check_store_range(&array);
         check_store_iter(&array);
+        check_align(&xa0);
 
         check_workingset(&array, 0);
         check_workingset(&array, 64);
diff --git a/lib/xarray.c b/lib/xarray.c
index 5f3f9311de89..81c3171ddde9 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -232,6 +232,8 @@ void *xas_load(struct xa_state *xas)
                 if (xas->xa_shift > node->shift)
                         break;
                 entry = xas_descend(xas, node);
+                if (node->shift == 0)
+                        break;
         }
         return entry;
 }
@@ -506,7 +508,7 @@ static void xas_free_nodes(struct xa_state *xas, struct xa_node *top)
         for (;;) {
                 void *entry = xa_entry_locked(xas->xa, node, offset);
 
-                if (xa_is_node(entry)) {
+                if (node->shift && xa_is_node(entry)) {
                         node = xa_to_node(entry);
                         offset = 0;
                         continue;
@@ -604,6 +606,7 @@ static int xas_expand(struct xa_state *xas, void *head)
 /*
  * xas_create() - Create a slot to store an entry in.
  * @xas: XArray operation state.
+ * @allow_root: %true if we can store the entry in the root directly
  *
  * Most users will not need to call this function directly, as it is called
  * by xas_store().  It is useful for doing conditional store operations
@@ -613,7 +616,7 @@ static int xas_expand(struct xa_state *xas, void *head)
  * If the slot was newly created, returns %NULL.  If it failed to create the
  * slot, returns %NULL and indicates the error in @xas.
  */
-static void *xas_create(struct xa_state *xas)
+static void *xas_create(struct xa_state *xas, bool allow_root)
 {
         struct xarray *xa = xas->xa;
         void *entry;
@@ -628,6 +631,8 @@ static void *xas_create(struct xa_state *xas)
                 shift = xas_expand(xas, entry);
                 if (shift < 0)
                         return NULL;
+                if (!shift && !allow_root)
+                        shift = XA_CHUNK_SHIFT;
                 entry = xa_head_locked(xa);
                 slot = &xa->xa_head;
         } else if (xas_error(xas)) {
@@ -687,7 +692,7 @@ void xas_create_range(struct xa_state *xas)
         xas->xa_sibs = 0;
 
         for (;;) {
-                xas_create(xas);
+                xas_create(xas, true);
                 if (xas_error(xas))
                         goto restore;
                 if (xas->xa_index <= (index | XA_CHUNK_MASK))
@@ -754,7 +759,7 @@ void *xas_store(struct xa_state *xas, void *entry)
         bool value = xa_is_value(entry);
 
         if (entry)
-                first = xas_create(xas);
+                first = xas_create(xas, !xa_is_node(entry));
         else
                 first = xas_load(xas);
 
@@ -1251,35 +1256,6 @@ void *xas_find_conflict(struct xa_state *xas)
 EXPORT_SYMBOL_GPL(xas_find_conflict);
 
 /**
- * xa_init_flags() - Initialise an empty XArray with flags.
- * @xa: XArray.
- * @flags: XA_FLAG values.
- *
- * If you need to initialise an XArray with special flags (eg you need
- * to take the lock from interrupt context), use this function instead
- * of xa_init().
- *
- * Context: Any context.
- */
-void xa_init_flags(struct xarray *xa, gfp_t flags)
-{
-        unsigned int lock_type;
-        static struct lock_class_key xa_lock_irq;
-        static struct lock_class_key xa_lock_bh;
-
-        spin_lock_init(&xa->xa_lock);
-        xa->xa_flags = flags;
-        xa->xa_head = NULL;
-
-        lock_type = xa_lock_type(xa);
-        if (lock_type == XA_LOCK_IRQ)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_irq);
-        else if (lock_type == XA_LOCK_BH)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_bh);
-}
-EXPORT_SYMBOL(xa_init_flags);
-
-/**
  * xa_load() - Load an entry from an XArray.
  * @xa: XArray.
  * @index: index into array.
@@ -1308,7 +1284,6 @@ static void *xas_result(struct xa_state *xas, void *curr)
 {
         if (xa_is_zero(curr))
                 return NULL;
-        XA_NODE_BUG_ON(xas->xa_node, xa_is_internal(curr));
         if (xas_error(xas))
                 curr = xas->xa_node;
         return curr;
@@ -1378,7 +1353,7 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
         XA_STATE(xas, xa, index);
         void *curr;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                 return XA_ERROR(-EINVAL);
         if (xa_track_free(xa) && !entry)
                 entry = XA_ZERO_ENTRY;
@@ -1444,7 +1419,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
         XA_STATE(xas, xa, index);
         void *curr;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                 return XA_ERROR(-EINVAL);
         if (xa_track_free(xa) && !entry)
                 entry = XA_ZERO_ENTRY;
@@ -1465,6 +1440,47 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 
 /**
+ * __xa_insert() - Store this entry in the XArray if no entry is present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Expects xa_lock to be held on entry.  May
+ * release and reacquire xa_lock if @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+int __xa_insert(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+{
+        XA_STATE(xas, xa, index);
+        void *curr;
+
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
+                return -EINVAL;
+        if (!entry)
+                entry = XA_ZERO_ENTRY;
+
+        do {
+                curr = xas_load(&xas);
+                if (!curr) {
+                        xas_store(&xas, entry);
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                } else {
+                        xas_set_err(&xas, -EEXIST);
+                }
+        } while (__xas_nomem(&xas, gfp));
+
+        return xas_error(&xas);
+}
+EXPORT_SYMBOL(__xa_insert);
+
+/**
  * __xa_reserve() - Reserve this index in the XArray.
  * @xa: XArray.
  * @index: Index into array.
@@ -1567,7 +1583,7 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
                         if (last + 1)
                                 order = __ffs(last + 1);
                         xas_set_order(&xas, last, order);
-                        xas_create(&xas);
+                        xas_create(&xas, true);
                         if (xas_error(&xas))
                                 goto unlock;
                 }
@@ -1609,7 +1625,7 @@ int __xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry, gfp_t gfp)
         XA_STATE(xas, xa, 0);
         int err;
 
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                 return -EINVAL;
         if (WARN_ON_ONCE(!xa_track_free(xa)))
                 return -EINVAL;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 8a8bb8796c6c..72e6d0c55cfa 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
         INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
         bdi->cgwb_congested_tree = RB_ROOT;
         mutex_init(&bdi->cgwb_release_mutex);
+        init_rwsem(&bdi->wb_switch_rwsem);
 
         ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
         if (!ret) {
diff --git a/mm/mincore.c b/mm/mincore.c
index f0f91461a9f4..218099b5ed31 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -42,14 +42,72 @@ static int mincore_hugetlb(pte_t *pte, unsigned long hmask, unsigned long addr,
         return 0;
 }
 
-static int mincore_unmapped_range(unsigned long addr, unsigned long end,
-                                   struct mm_walk *walk)
+/*
+ * Later we can get more picky about what "in core" means precisely.
+ * For now, simply check to see if the page is in the page cache,
+ * and is up to date; i.e. that no page-in operation would be required
+ * at this time if an application were to map and access this page.
+ */
+static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
+{
+        unsigned char present = 0;
+        struct page *page;
+
+        /*
+         * When tmpfs swaps out a page from a file, any process mapping that
+         * file will not get a swp_entry_t in its pte, but rather it is like
+         * any other file mapping (ie. marked !present and faulted in with
+         * tmpfs's .fault). So swapped out tmpfs mappings are tested here.
+         */
+#ifdef CONFIG_SWAP
+        if (shmem_mapping(mapping)) {
+                page = find_get_entry(mapping, pgoff);
+                /*
+                 * shmem/tmpfs may return swap: account for swapcache
+                 * page too.
+                 */
+                if (xa_is_value(page)) {
+                        swp_entry_t swp = radix_to_swp_entry(page);
+                        page = find_get_page(swap_address_space(swp),
+                                             swp_offset(swp));
+                }
+        } else
+                page = find_get_page(mapping, pgoff);
+#else
+        page = find_get_page(mapping, pgoff);
+#endif
+        if (page) {
+                present = PageUptodate(page);
+                put_page(page);
+        }
+
+        return present;
+}
+
+static int __mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                struct vm_area_struct *vma, unsigned char *vec)
 {
-        unsigned char *vec = walk->private;
         unsigned long nr = (end - addr) >> PAGE_SHIFT;
+        int i;
 
-        memset(vec, 0, nr);
-        walk->private += nr;
+        if (vma->vm_file) {
+                pgoff_t pgoff;
+
+                pgoff = linear_page_index(vma, addr);
+                for (i = 0; i < nr; i++, pgoff++)
+                        vec[i] = mincore_page(vma->vm_file->f_mapping, pgoff);
+        } else {
+                for (i = 0; i < nr; i++)
+                        vec[i] = 0;
+        }
+        return nr;
+}
+
+static int mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                   struct mm_walk *walk)
+{
+        walk->private += __mincore_unmapped_range(addr, end,
+                                                  walk->vma, walk->private);
         return 0;
 }
 
@@ -69,9 +127,8 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                 goto out;
         }
 
-        /* We'll consider a THP page under construction to be there */
         if (pmd_trans_unstable(pmd)) {
-                memset(vec, 1, nr);
+                __mincore_unmapped_range(addr, end, vma, vec);
                 goto out;
         }
 
@@ -80,17 +137,28 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                 pte_t pte = *ptep;
 
                 if (pte_none(pte))
-                        *vec = 0;
+                        __mincore_unmapped_range(addr, addr + PAGE_SIZE,
+                                                 vma, vec);
                 else if (pte_present(pte))
                         *vec = 1;
                 else { /* pte is a swap entry */
                         swp_entry_t entry = pte_to_swp_entry(pte);
 
-                        /*
-                         * migration or hwpoison entries are always
-                         * uptodate
-                         */
-                        *vec = !!non_swap_entry(entry);
+                        if (non_swap_entry(entry)) {
+                                /*
+                                 * migration or hwpoison entries are always
+                                 * uptodate
+                                 */
+                                *vec = 1;
+                        } else {
+#ifdef CONFIG_SWAP
+                                *vec = mincore_page(swap_address_space(entry),
+                                                    swp_offset(entry));
+#else
+                                WARN_ON(1);
+                                *vec = 1;
+#endif
+                        }
                 }
                 vec++;
         }
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index 70417e9b932d..314bbc8010fb 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
         dst = (ax25_address *)(bp + 1);
         src = (ax25_address *)(bp + 8);
 
+        ax25_route_lock_use();
         route = ax25_get_route(dst, NULL);
         if (route) {
                 digipeat = route->digipeat;
@@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
         ax25_queue_xmit(skb, dev);
 
 put:
-        if (route)
-                ax25_put_route(route);
 
+        ax25_route_lock_unuse();
         return NETDEV_TX_OK;
 }
 
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index a0eff323af12..66f74c85cf6b 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -40,7 +40,7 @@
 #include <linux/export.h>
 
 static ax25_route *ax25_route_list;
-static DEFINE_RWLOCK(ax25_route_lock);
+DEFINE_RWLOCK(ax25_route_lock);
 
 void ax25_rt_device_down(struct net_device *dev)
 {
@@ -335,6 +335,7 @@ const struct seq_operations ax25_rt_seqops = {
  *      Find AX.25 route
  *
  *      Only routes with a reference count of zero can be destroyed.
+ *      Must be called with ax25_route_lock read locked.
  */
 ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
 {
@@ -342,7 +343,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
         ax25_route *ax25_def_rt = NULL;
         ax25_route *ax25_rt;
 
-        read_lock(&ax25_route_lock);
         /*
          *      Bind to the physical interface we heard them on, or the default
          *      route if none is found;
@@ -365,11 +365,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
         if (ax25_spe_rt != NULL)
                 ax25_rt = ax25_spe_rt;
 
-        if (ax25_rt != NULL)
-                ax25_hold_route(ax25_rt);
-
-        read_unlock(&ax25_route_lock);
-
         return ax25_rt;
 }
 
@@ -400,9 +395,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
         ax25_route *ax25_rt;
         int err = 0;
 
-        if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
+        ax25_route_lock_use();
+        ax25_rt = ax25_get_route(addr, NULL);
+        if (!ax25_rt) {
+                ax25_route_lock_unuse();
                 return -EHOSTUNREACH;
-
+        }
         if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
                 err = -EHOSTUNREACH;
                 goto put;
@@ -437,8 +435,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
         }
 
 put:
-        ax25_put_route(ax25_rt);
-
+        ax25_route_lock_unuse();
         return err;
 }
 
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..79bb8afa9c0c 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
  */
 #define MAX_NFRAMES 256
 
+/* limit timers to 400 days for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
+
 /* use of last_frames[index].flags */
 #define RX_RECV    0x40 /* received data for this element */
 #define RX_THR     0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
         return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
 }
 
+/* check limitations for timeval provided by user */
+static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+        if ((msg_head->ival1.tv_sec < 0) ||
+            (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival1.tv_usec < 0) ||
+            (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+            (msg_head->ival2.tv_sec < 0) ||
+            (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival2.tv_usec < 0) ||
+            (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+                return true;
+
+        return false;
+}
+
 #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
 #define OPSIZ sizeof(struct bcm_op)
 #define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
         if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
                 return -EINVAL;
 
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
+
         /* check the given can_id */
         op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
         if (op) {
@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
              (!(msg_head->can_id & CAN_RTR_FLAG))))
                 return -EINVAL;
 
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
+
         /* check the given can_id */
         op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
         if (op) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index d5718284db57..3661cdd927f1 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3206,9 +3206,10 @@ void ceph_con_keepalive(struct ceph_connection *con)
         dout("con_keepalive %p\n", con);
         mutex_lock(&con->mutex);
         clear_standby(con);
+        con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
         mutex_unlock(&con->mutex);
-        if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
-            con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+
+        if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
                 queue_con(con);
 }
 EXPORT_SYMBOL(ceph_con_keepalive);
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index a4bf22ee3aed..7c4a41dc04bb 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -25,6 +25,7 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 #include <net/gre.h>
+#include <net/erspan.h>
 
 #include <net/icmp.h>
 #include <net/route.h>
@@ -119,6 +120,22 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         hdr_len += 4;
         }
         tpi->hdr_len = hdr_len;
+
+        /* ERSPAN ver 1 and 2 protocol sets GRE key field
+         * to 0 and sets the configured key in the
+         * inner erspan header field
+         */
+        if (greh->protocol == htons(ETH_P_ERSPAN) ||
+            greh->protocol == htons(ETH_P_ERSPAN2)) {
+                struct erspan_base_hdr *ershdr;
+
+                if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
+                        return -EINVAL;
+
+                ershdr = (struct erspan_base_hdr *)options;
+                tpi->key = cpu_to_be32(get_session_id(ershdr));
+        }
+
         return hdr_len;
 }
 EXPORT_SYMBOL(gre_parse_header);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb1af42e374b..d1cef66820d3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -268,20 +268,11 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         int len;
 
         itn = net_generic(net, erspan_net_id);
-        len = gre_hdr_len + sizeof(*ershdr);
-
-        /* Check based hdr len */
-        if (unlikely(!pskb_may_pull(skb, len)))
-                return PACKET_REJECT;
 
         iph = ip_hdr(skb);
         ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
         ver = ershdr->ver;
 
-        /* The original GRE header does not have key field,
-         * Use ERSPAN 10-bit session ID as key.
-         */
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                   tpi->flags | TUNNEL_KEY,
                                   iph->saddr, iph->daddr, tpi->key);
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 3a15ee1a775e..893f013d5369 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -671,13 +671,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
         dst = tnl_params->daddr;
         if (dst == 0) {
                 /* NBMA tunnel */
+                struct ip_tunnel_info *tun_info;
 
                 if (!skb_dst(skb)) {
                         dev->stats.tx_fifo_errors++;
                         goto tx_error;
                 }
 
-                if (skb->protocol == htons(ETH_P_IP)) {
+                tun_info = skb_tunnel_info(skb);
+                if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
+                    ip_tunnel_info_af(tun_info) == AF_INET &&
+                    tun_info->key.u.ipv4.dst)
+                        dst = tun_info->key.u.ipv4.dst;
+                else if (skb->protocol == htons(ETH_P_IP)) {
                         rt = skb_rtable(skb);
                         dst = rt_nexthop(rt, inner_iph->daddr);
                 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 48cd36311901..dcb1d434f7da 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3530,8 +3530,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 
                         if (!addrconf_link_ready(dev)) {
                                 /* device is not ready yet. */
-                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
-                                        dev->name);
+                                pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+                                         dev->name);
                                 break;
                         }
 
@@ -5155,6 +5155,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                         if (idev) {
                                 err = in6_dump_addrs(idev, skb, cb, s_ip_idx,
                                                      &fillargs);
+                                if (err > 0)
+                                        err = 0;
                         }
                         goto put_tgt_net;
                 }
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c465d8a102f2..e081e69d534e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -534,13 +534,9 @@ static int ip6erspan_rcv(struct sk_buff *skb,
         struct ip6_tnl *tunnel;
         u8 ver;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
-                return PACKET_REJECT;
-
         ipv6h = ipv6_hdr(skb);
         ershdr = (struct erspan_base_hdr *)skb->data;
         ver = ershdr->ver;
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
 
         tunnel = ip6gre_tunnel_lookup(skb->dev,
                                       &ipv6h->saddr, &ipv6h->daddr, tpi->key,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index de65fe3ed9cc..2493c74c2d37 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1490,6 +1490,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                 sta->sta.tdls = true;
 
+        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
+
         err = sta_apply_parameters(local, sta, params);
         if (err) {
                 sta_info_free(local, sta);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 45aad3d3108c..bb4d71efb6fb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -231,7 +231,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_hdr_3addr hdr;
                 u8 category;
                 u8 action_code;
-        } __packed action;
+        } __packed __aligned(2) action;
 
         if (!sdata)
                 return;
@@ -2723,7 +2723,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         skb_set_queue_mapping(skb, q);
 
         if (!--mesh_hdr->ttl) {
-                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+                if (!is_multicast_ether_addr(hdr->addr1))
+                        IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+                                                     dropped_frames_ttl);
                 goto out;
         }
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index ed8e006dae85..6200cd2b4b99 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -280,7 +280,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
 
         if (saddr) {
                 fl6->saddr = saddr->v6.sin6_addr;
-                fl6->fl6_sport = saddr->v6.sin6_port;
+                if (!fl6->fl6_sport)
+                        fl6->fl6_sport = saddr->v6.sin6_port;
 
                 pr_debug("src=%pI6 - ", &fl6->saddr);
         }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 4e0eeb113ef5..6abc8b274270 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -440,7 +440,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         }
         if (saddr) {
                 fl4->saddr = saddr->v4.sin_addr.s_addr;
-                fl4->fl4_sport = saddr->v4.sin_port;
+                if (!fl4->fl4_sport)
+                        fl4->fl4_sport = saddr->v4.sin_port;
         }
 
         pr_debug("%s: dst:%pI4, src:%pI4 - ", __func__, &fl4->daddr,
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f4ac6c592e13..d05c57664e36 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -495,7 +495,10 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
          *
          * [INIT ACK back to where the INIT came from.]
          */
-        retval->transport = chunk->transport;
+        if (chunk->transport)
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
 
         retval->subh.init_hdr =
                 sctp_addto_chunk(retval, sizeof(initack), &initack);
@@ -642,8 +645,10 @@ struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
          *
          * [COOKIE ACK back to where the COOKIE ECHO came from.]
          */
-        if (retval && chunk)
-                retval->transport = chunk->transport;
+        if (retval && chunk && chunk->transport)
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
 
         return retval;
 }
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 3892e7630f3a..80e0ae5534ec 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -585,9 +585,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
         struct sctp_strreset_outreq *outreq = param.v;
         struct sctp_stream *stream = &asoc->stream;
         __u32 result = SCTP_STRRESET_DENIED;
-        __u16 i, nums, flags = 0;
         __be16 *str_p = NULL;
         __u32 request_seq;
+        __u16 i, nums;
 
         request_seq = ntohl(outreq->request_seq);
 
@@ -615,6 +615,15 @@ struct sctp_chunk *sctp_process_strreset_outreq(
         if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_STREAM_REQ))
                 goto out;
 
+        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        str_p = outreq->list_of_streams;
+        for (i = 0; i < nums; i++) {
+                if (ntohs(str_p[i]) >= stream->incnt) {
+                        result = SCTP_STRRESET_ERR_WRONG_SSN;
+                        goto out;
+                }
+        }
+
         if (asoc->strreset_chunk) {
                 if (!sctp_chunk_lookup_strreset_param(
                                 asoc, outreq->response_seq,
@@ -637,32 +646,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
                         sctp_chunk_put(asoc->strreset_chunk);
                         asoc->strreset_chunk = NULL;
                 }
-
-                flags = SCTP_STREAM_RESET_INCOMING_SSN;
         }
 
-        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
-        if (nums) {
-                str_p = outreq->list_of_streams;
-                for (i = 0; i < nums; i++) {
-                        if (ntohs(str_p[i]) >= stream->incnt) {
-                                result = SCTP_STRRESET_ERR_WRONG_SSN;
-                                goto out;
-                        }
-                }
-
+        if (nums)
                 for (i = 0; i < nums; i++)
                         SCTP_SI(stream, ntohs(str_p[i]))->mid = 0;
-        } else {
+        else
                 for (i = 0; i < stream->incnt; i++)
                         SCTP_SI(stream, i)->mid = 0;
-        }
 
         result = SCTP_STRRESET_PERFORMED;
 
         *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                flags | SCTP_STREAM_RESET_OUTGOING_SSN, nums, str_p,
-                GFP_ATOMIC);
+                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
 
 out:
         sctp_update_strreset_result(asoc, result);
@@ -738,9 +734,6 @@ struct sctp_chunk *sctp_process_strreset_inreq(
 
         result = SCTP_STRRESET_PERFORMED;
 
-        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
-
 out:
         sctp_update_strreset_result(asoc, result);
 err:
@@ -873,6 +866,14 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
         if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
                 goto out;
 
+        in = ntohs(addstrm->number_of_streams);
+        incnt = stream->incnt + in;
+        if (!in || incnt > SCTP_MAX_STREAM)
+                goto out;
+
+        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
+                goto out;
+
         if (asoc->strreset_chunk) {
                 if (!sctp_chunk_lookup_strreset_param(
                         asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
@@ -896,14 +897,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
                 }
         }
 
-        in = ntohs(addstrm->number_of_streams);
-        incnt = stream->incnt + in;
-        if (!in || incnt > SCTP_MAX_STREAM)
-                goto out;
-
-        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
-                goto out;
-
         stream->incnt = incnt;
 
         result = SCTP_STRRESET_PERFORMED;
@@ -973,9 +966,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
 
         result = SCTP_STRRESET_PERFORMED;
 
-        *evp = sctp_ulpevent_make_stream_change_event(asoc,
-                0, 0, ntohs(addstrm->number_of_streams), GFP_ATOMIC);
-
 out:
         sctp_update_strreset_result(asoc, result);
 err:
@@ -1036,10 +1026,10 @@ struct sctp_chunk *sctp_process_strreset_resp(
                                         sout->mid_uo = 0;
                                 }
                         }
-
-                        flags = SCTP_STREAM_RESET_OUTGOING_SSN;
                 }
 
+                flags |= SCTP_STREAM_RESET_OUTGOING_SSN;
+
                 for (i = 0; i < stream->outcnt; i++)
                         SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
 
@@ -1058,6 +1048,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
                 nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
                        sizeof(__u16);
 
+                flags |= SCTP_STREAM_RESET_INCOMING_SSN;
+
                 *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
                         nums, str_p, GFP_ATOMIC);
         } else if (req->type == SCTP_PARAM_RESET_TSN_REQUEST) {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5e49492d5911..74150ad95823 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -555,7 +555,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
         },
         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
         [NL80211_ATTR_PEER_MEASUREMENTS] =
-                NLA_POLICY_NESTED(NL80211_PMSR_FTM_REQ_ATTR_MAX,
+                NLA_POLICY_NESTED(NL80211_PMSR_ATTR_MAX,
                                   nl80211_pmsr_attr_policy),
 };
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ecfb1a06dbb2..dd58b9909ac9 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1024,8 +1024,13 @@ static void regdb_fw_cb(const struct firmware *fw, void *context)
         }
 
         rtnl_lock();
-        if (WARN_ON(regdb && !IS_ERR(regdb))) {
-                /* just restore and free new db */
+        if (regdb && !IS_ERR(regdb)) {
+                /* negative case - a bug
+                 * positive case - can happen due to race in case of multiple cb's in
+                 * queue, due to usage of asynchronous callback
+                 *
+                 * Either case, just restore and free new db.
+                 */
         } else if (set_error) {
                 regdb = ERR_PTR(set_error);
         } else if (fw) {
@@ -1255,7 +1260,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
  * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
  * however it is safe for now to assume that a frequency rule should not be
  * part of a frequency's band if the start freq or end freq are off by more
- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the
+ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
  * 60 GHz band.
  * This resolution can be lowered and should be considered as we add
  * regulatory rule support for other "bands".
@@ -1270,7 +1275,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
          * with the Channel starting frequency above 45 GHz.
          */
         u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
-                        10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
+                        20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
         if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
                 return true;
         if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index a5b09e75e787..f7d2b373da0a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -541,7 +541,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
         /* first let's check the buffer parameter's */
         if (params->buffer.fragment_size == 0 ||
-            params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
+            params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+            params->buffer.fragments == 0)
                 return -EINVAL;
 
         /* now codec parameters */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 51cc6589443f..152f54137082 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -931,6 +931,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+        SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0b3e7a18ca78..b4f472157ebd 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6926,7 +6926,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
         {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
         {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
-        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc255-dell1"},
+        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
         {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
         {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
         {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
index 022a8912c8a2..3d58338fa3cf 100644
--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
+++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
@@ -611,14 +611,16 @@ static int acp3x_audio_probe(struct platform_device *pdev)
         }
         irqflags = *((unsigned int *)(pdev->dev.platform_data));
 
-        adata = devm_kzalloc(&pdev->dev, sizeof(struct i2s_dev_data),
-                             GFP_KERNEL);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(&pdev->dev, "IORESOURCE_IRQ FAILED\n");
                         return -ENODEV;
         }
 
+        adata = devm_kzalloc(&pdev->dev, sizeof(*adata), GFP_KERNEL);
+        if (!adata)
+                return -ENOMEM;
+
         adata->acp3x_base = devm_ioremap(&pdev->dev, res->start,
                                          resource_size(res));
 
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 3ab2949c1dfa..b19d7a3e7a2c 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1890,51 +1890,31 @@ static void hdmi_codec_remove(struct snd_soc_component *component)
         pm_runtime_disable(&hdev->dev);
 }
 
-#ifdef CONFIG_PM
-static int hdmi_codec_prepare(struct device *dev)
-{
-        struct hdac_device *hdev = dev_to_hdac_dev(dev);
-
-        pm_runtime_get_sync(&hdev->dev);
-
-        /*
-         * Power down afg.
-         * codec_read is preferred over codec_write to set the power state.
-         * This way verb is send to set the power state and response
-         * is received. So setting power state is ensured without using loop
-         * to read the state.
-         */
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
-                                                        AC_PWRST_D3);
-
-        return 0;
-}
-
-static void hdmi_codec_complete(struct device *dev)
+#ifdef CONFIG_PM_SLEEP
+static int hdmi_codec_resume(struct device *dev)
 {
         struct hdac_device *hdev = dev_to_hdac_dev(dev);
         struct hdac_hdmi_priv *hdmi = hdev_to_hdmi_priv(hdev);
+        int ret;
 
-        /* Power up afg */
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
-                                                        AC_PWRST_D0);
-
-        hdac_hdmi_skl_enable_all_pins(hdev);
-        hdac_hdmi_skl_enable_dp12(hdev);
-
+        ret = pm_runtime_force_resume(dev);
+        if (ret < 0)
+                return ret;
         /*
          * As the ELD notify callback request is not entertained while the
          * device is in suspend state. Need to manually check detection of
          * all pins here. pin capablity change is not support, so use the
          * already set pin caps.
+         *
+         * NOTE: this is safe to call even if the codec doesn't actually resume.
+         * The pin check involves only with DRM audio component hooks, so it
+         * works even if the HD-audio side is still dreaming peacefully.
          */
         hdac_hdmi_present_sense_all_pins(hdev, hdmi, false);
-
-        pm_runtime_put_sync(&hdev->dev);
+        return 0;
 }
 #else
-#define hdmi_codec_prepare NULL
-#define hdmi_codec_complete NULL
+#define hdmi_codec_resume NULL
 #endif
 
 static const struct snd_soc_component_driver hdmi_hda_codec = {
@@ -2135,75 +2115,6 @@ static int hdac_hdmi_dev_remove(struct hdac_device *hdev)
 }
 
 #ifdef CONFIG_PM
-/*
- * Power management sequences
- * ==========================
- *
- * The following explains the PM handling of HDAC HDMI with its parent
- * device SKL and display power usage
- *
- * Probe
- * -----
- * In SKL probe,
- * 1. skl_probe_work() powers up the display (refcount++ -> 1)
- * 2. enumerates the codecs on the link
- * 3. powers down the display  (refcount-- -> 0)
- *
- * In HDAC HDMI probe,
- * 1. hdac_hdmi_dev_probe() powers up the display (refcount++ -> 1)
- * 2. probe the codec
- * 3. put the HDAC HDMI device to runtime suspend
- * 4. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- *
- * Once children are runtime suspended, SKL device also goes to runtime
- * suspend
- *
- * HDMI Playback
- * -------------
- * Open HDMI device,
- * 1. skl_runtime_resume() invoked
- * 2. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- *
- * Close HDMI device,
- * 1. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 2. skl_runtime_suspend() invoked
- *
- * S0/S3 Cycle with playback in progress
- * -------------------------------------
- * When the device is opened for playback, the device is runtime active
- * already and the display refcount is 1 as explained above.
- *
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec which just
- *    increments the PM runtime usage count of the codec since the device
- *    is in use already
- * 2. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec which just
- *    decrements the PM runtime usage count of the codec since the device
- *    is in use already
- *
- * Once playback is stopped, the display refcount is set to 0 as explained
- * above in the HDMI playback sequence. The PM handlings are designed in
- * such way that to balance the refcount of display power when the codec
- * device put to S3 while playback is going on.
- *
- * S0/S3 Cycle without playback in progress
- * ----------------------------------------
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec
- * 2. skl_runtime_resume() invoked
- * 3. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- * 4. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec
- * 3. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 4. skl_runtime_suspend() invoked
- */
 static int hdac_hdmi_runtime_suspend(struct device *dev)
 {
         struct hdac_device *hdev = dev_to_hdac_dev(dev);
@@ -2277,8 +2188,7 @@ static int hdac_hdmi_runtime_resume(struct device *dev)
 
 static const struct dev_pm_ops hdac_hdmi_pm = {
         SET_RUNTIME_PM_OPS(hdac_hdmi_runtime_suspend, hdac_hdmi_runtime_resume, NULL)
-        .prepare = hdmi_codec_prepare,
-        .complete = hdmi_codec_complete,
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, hdmi_codec_resume)
 };
 
 static const struct hda_device_id hdmi_list[] = {
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 6cb1653be804..4cc24a5d5c31 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1400,24 +1400,20 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                 if (ret != 0) {
                         dev_err(component->dev,
                                 "Failed to set digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
-                        return ret;
+                        goto unlock;
                 }
 
                 regmap_read_poll_timeout(pcm512x->regmap,
                                          PCM512x_ANALOG_MUTE_DET,
                                          mute_det, (mute_det & 0x3) == 0,
                                          200, 10000);
-
-                mutex_unlock(&pcm512x->mutex);
         } else {
                 pcm512x->mute &= ~0x1;
                 ret = pcm512x_update_mute(pcm512x);
                 if (ret != 0) {
                         dev_err(component->dev,
                                 "Failed to update digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
-                        return ret;
+                        goto unlock;
                 }
 
                 regmap_read_poll_timeout(pcm512x->regmap,
@@ -1428,9 +1424,10 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                                          200, 10000);
         }
 
+unlock:
         mutex_unlock(&pcm512x->mutex);
 
-        return 0;
+        return ret;
 }
 
 static const struct snd_soc_dai_ops pcm512x_dai_ops = {
diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
index 0ef966d56bac..e2855ab9a2c6 100644
--- a/sound/soc/codecs/rt274.c
+++ b/sound/soc/codecs/rt274.c
@@ -1128,8 +1128,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c,
                 return ret;
         }
 
-        regmap_read(rt274->regmap,
+        ret = regmap_read(rt274->regmap,
                 RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
+        if (ret)
+                return ret;
+
         if (val != RT274_VENDOR_ID) {
                 dev_err(&i2c->dev,
                         "Device with ID register %#x is not rt274\n", val);
diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
index 4d46f4567c3a..bec2eefa8b0f 100644
--- a/sound/soc/codecs/rt5514-spi.c
+++ b/sound/soc/codecs/rt5514-spi.c
@@ -280,6 +280,8 @@ static int rt5514_spi_pcm_probe(struct snd_soc_component *component)
 
         rt5514_dsp = devm_kzalloc(component->dev, sizeof(*rt5514_dsp),
                         GFP_KERNEL);
+        if (!rt5514_dsp)
+                return -ENOMEM;
 
         rt5514_dsp->dev = &rt5514_spi->dev;
         mutex_init(&rt5514_dsp->dma_lock);
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 34cfaf8f6f34..89c43b26c379 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -2512,6 +2512,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682)
         regmap_write(rt5682->regmap, RT5682_PWR_DIG_1, 0x0000);
         regmap_write(rt5682->regmap, RT5682_CHOP_DAC, 0x2000);
         regmap_write(rt5682->regmap, RT5682_CALIB_ADC_CTRL, 0x2005);
+        regmap_write(rt5682->regmap, RT5682_STO1_ADC_MIXER, 0xc0c4);
 
         mutex_unlock(&rt5682->calibrate_mutex);
 
diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h
index d82a8301fd74..96944cff0ed7 100644
--- a/sound/soc/codecs/rt5682.h
+++ b/sound/soc/codecs/rt5682.h
@@ -849,18 +849,18 @@
 #define RT5682_SCLK_SRC_PLL2                    (0x2 << 13)
 #define RT5682_SCLK_SRC_SDW                     (0x3 << 13)
 #define RT5682_SCLK_SRC_RCCLK                   (0x4 << 13)
-#define RT5682_PLL1_SRC_MASK                    (0x3 << 10)
-#define RT5682_PLL1_SRC_SFT                     10
-#define RT5682_PLL1_SRC_MCLK                    (0x0 << 10)
-#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 10)
-#define RT5682_PLL1_SRC_SDW                     (0x2 << 10)
-#define RT5682_PLL1_SRC_RC                      (0x3 << 10)
-#define RT5682_PLL2_SRC_MASK                    (0x3 << 8)
-#define RT5682_PLL2_SRC_SFT                     8
-#define RT5682_PLL2_SRC_MCLK                    (0x0 << 8)
-#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 8)
-#define RT5682_PLL2_SRC_SDW                     (0x2 << 8)
-#define RT5682_PLL2_SRC_RC                      (0x3 << 8)
+#define RT5682_PLL2_SRC_MASK                    (0x3 << 10)
+#define RT5682_PLL2_SRC_SFT                     10
+#define RT5682_PLL2_SRC_MCLK                    (0x0 << 10)
+#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 10)
+#define RT5682_PLL2_SRC_SDW                     (0x2 << 10)
+#define RT5682_PLL2_SRC_RC                      (0x3 << 10)
+#define RT5682_PLL1_SRC_MASK                    (0x3 << 8)
+#define RT5682_PLL1_SRC_SFT                     8
+#define RT5682_PLL1_SRC_MCLK                    (0x0 << 8)
+#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 8)
+#define RT5682_PLL1_SRC_SDW                     (0x2 << 8)
+#define RT5682_PLL1_SRC_RC                      (0x3 << 8)
 
 
 
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index e2b5a11b16d1..f03195d2ab2e 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -822,6 +822,10 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
         case SND_SOC_BIAS_PREPARE:
                 break;
         case SND_SOC_BIAS_STANDBY:
+                /* Initial cold start */
+                if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
+                        break;
+
                 /* Switch off BCLK_N Divider */
                 snd_soc_component_update_bits(component, AIC32X4_BCLKN,
                                     AIC32X4_BCLKEN, 0);
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index 392d5eef356d..99e07b01a2ce 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
-        ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+        ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
                        pdcr, ptcr);
 
         if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 "TxFS output from %s, ",
                                 audmux_port_string((ptcr >> 27) & 0x7));
         else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 "TxFS input, ");
 
         if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 "TxClk output from %s",
                                 audmux_port_string((ptcr >> 22) & 0x7));
         else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 "TxClk input");
 
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
 
         if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) {
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 "Port is symmetric");
         } else {
                 if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                         "RxFS output from %s, ",
                                         audmux_port_string((ptcr >> 17) & 0x7));
                 else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                         "RxFS input, ");
 
                 if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                         "RxClk output from %s",
                                         audmux_port_string((ptcr >> 12) & 0x7));
                 else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                         "RxClk input");
         }
 
-        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                         "\nData received from %s\n",
                         audmux_port_string((pdcr >> 13) & 0x7));
 
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 99a62ba409df..bd9fd2035c55 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -91,7 +91,7 @@ config SND_SST_ATOM_HIFI2_PLATFORM_PCI
 config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
         tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms"
         default ACPI
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
         select SND_SST_IPC_ACPI
         select SND_SST_ATOM_HIFI2_PLATFORM
         select SND_SOC_ACPI_INTEL_MATCH
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index afc559866095..91a2436ce952 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -399,7 +399,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream,
                                 struct snd_pcm_hw_params *params,
                                 struct snd_soc_dai *dai)
 {
-        snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
+        int ret;
+
+        ret =
+                snd_pcm_lib_malloc_pages(substream,
+                                params_buffer_bytes(params));
+        if (ret)
+                return ret;
         memset(substream->runtime->dma_area, 0, params_buffer_bytes(params));
         return 0;
 }
diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
index 68e6543e6cb0..99f2a0156ae8 100644
--- a/sound/soc/intel/boards/broadwell.c
+++ b/sound/soc/intel/boards/broadwell.c
@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = {
                 .stream_name = "Loopback",
                 .cpu_dai_name = "Loopback Pin",
                 .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c
index c74c4f17316f..8f83b182c4f9 100644
--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c
+++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c
@@ -55,39 +55,6 @@ enum {
         GLK_DPCM_AUDIO_HDMI3_PB,
 };
 
-static int platform_clock_control(struct snd_soc_dapm_widget *w,
-                                        struct snd_kcontrol *k, int  event)
-{
-        struct snd_soc_dapm_context *dapm = w->dapm;
-        struct snd_soc_card *card = dapm->card;
-        struct snd_soc_dai *codec_dai;
-        int ret = 0;
-
-        codec_dai = snd_soc_card_get_codec_dai(card, GLK_REALTEK_CODEC_DAI);
-        if (!codec_dai) {
-                dev_err(card->dev, "Codec dai not found; Unable to set/unset codec pll\n");
-                return -EIO;
-        }
-
-        if (SND_SOC_DAPM_EVENT_OFF(event)) {
-                ret = snd_soc_dai_set_sysclk(codec_dai, 0, 0, 0);
-                if (ret)
-                        dev_err(card->dev, "failed to stop sysclk: %d\n", ret);
-        } else if (SND_SOC_DAPM_EVENT_ON(event)) {
-                ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
-                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
-                if (ret < 0) {
-                        dev_err(card->dev, "can't set codec pll: %d\n", ret);
-                        return ret;
-                }
-        }
-
-        if (ret)
-                dev_err(card->dev, "failed to start internal clk: %d\n", ret);
-
-        return ret;
-}
-
 static const struct snd_kcontrol_new geminilake_controls[] = {
         SOC_DAPM_PIN_SWITCH("Headphone Jack"),
         SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -102,14 +69,10 @@ static const struct snd_soc_dapm_widget geminilake_widgets[] = {
         SND_SOC_DAPM_SPK("HDMI1", NULL),
         SND_SOC_DAPM_SPK("HDMI2", NULL),
         SND_SOC_DAPM_SPK("HDMI3", NULL),
-        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
-                        platform_clock_control, SND_SOC_DAPM_PRE_PMU |
-                        SND_SOC_DAPM_POST_PMD),
 };
 
 static const struct snd_soc_dapm_route geminilake_map[] = {
         /* HP jack connectors - unknown if we have jack detection */
-        { "Headphone Jack", NULL, "Platform Clock" },
         { "Headphone Jack", NULL, "HPOL" },
         { "Headphone Jack", NULL, "HPOR" },
 
@@ -117,7 +80,6 @@ static const struct snd_soc_dapm_route geminilake_map[] = {
         { "Spk", NULL, "Speaker" },
 
         /* other jacks */
-        { "Headset Mic", NULL, "Platform Clock" },
         { "IN1P", NULL, "Headset Mic" },
 
         /* digital mics */
@@ -177,6 +139,13 @@ static int geminilake_rt5682_codec_init(struct snd_soc_pcm_runtime *rtd)
         struct snd_soc_jack *jack;
         int ret;
 
+        ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
+                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set codec pll: %d\n", ret);
+                return ret;
+        }
+
         /* Configure sysclk for codec */
         ret = snd_soc_dai_set_sysclk(codec_dai, RT5682_SCLK_S_PLL1,
                                         RT5682_PLL_FREQ, SND_SOC_CLOCK_IN);
diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
index eab1f439dd3f..a4022983a7ce 100644
--- a/sound/soc/intel/boards/haswell.c
+++ b/sound/soc/intel/boards/haswell.c
@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = {
                 .stream_name = "Loopback",
                 .cpu_dai_name = "Loopback Pin",
                 .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                 .codec_name = "snd-soc-dummy",
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 60c94836bf5b..4ed5b7e17d44 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -336,9 +336,6 @@ static int skl_suspend(struct device *dev)
                 skl->skl_sst->fw_loaded = false;
         }
 
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
-
         return 0;
 }
 
@@ -350,10 +347,6 @@ static int skl_resume(struct device *dev)
         struct hdac_ext_link *hlink = NULL;
         int ret;
 
-        /* Turned OFF in HDMI codec driver after codec reconfiguration */
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, true);
-
         /*
          * resume only when we are not in suspend active, otherwise need to
          * restore the device
@@ -446,8 +439,10 @@ static int skl_free(struct hdac_bus *bus)
         snd_hdac_ext_bus_exit(bus);
 
         cancel_work_sync(&skl->probe_work);
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
                 snd_hdac_i915_exit(bus);
+        }
 
         return 0;
 }
@@ -814,7 +809,7 @@ static void skl_probe_work(struct work_struct *work)
         err = skl_platform_register(bus->dev);
         if (err < 0) {
                 dev_err(bus->dev, "platform register failed: %d\n", err);
-                return;
+                goto out_err;
         }
 
         err = skl_machine_device_register(skl);
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index 5b986b74dd36..548eb4fa2da6 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -570,10 +570,10 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
         prtd->audio_client = q6asm_audio_client_alloc(dev,
                                         (q6asm_cb)compress_event_handler,
                                         prtd, stream_id, LEGACY_PCM_MODE);
-        if (!prtd->audio_client) {
+        if (IS_ERR(prtd->audio_client)) {
                 dev_err(dev, "Could not allocate memory\n");
-                kfree(prtd);
-                return -ENOMEM;
+                ret = PTR_ERR(prtd->audio_client);
+                goto free_prtd;
         }
 
         size = COMPR_PLAYBACK_MAX_FRAGMENT_SIZE *
@@ -582,7 +582,7 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
                                   &prtd->dma_buffer);
         if (ret) {
                 dev_err(dev, "Cannot allocate buffer(s)\n");
-                return ret;
+                goto free_client;
         }
 
         if (pdata->sid < 0)
@@ -595,6 +595,13 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
         runtime->private_data = prtd;
 
         return 0;
+
+free_client:
+        q6asm_audio_client_free(prtd->audio_client);
+free_prtd:
+        kfree(prtd);
+
+        return ret;
 }
 
 static int q6asm_dai_compr_free(struct snd_compr_stream *stream)
@@ -874,7 +881,7 @@ static int of_q6asm_parse_dai_data(struct device *dev,
 
         for_each_child_of_node(dev->of_node, node) {
                 ret = of_property_read_u32(node, "reg", &id);
-                if (ret || id > MAX_SESSIONS || id < 0) {
+                if (ret || id >= MAX_SESSIONS || id < 0) {
                         dev_err(dev, "valid dai id not found:%d\n", ret);
                         continue;
                 }
diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
index 1db8ef668223..6f66a58e23ca 100644
--- a/sound/soc/qcom/sdm845.c
+++ b/sound/soc/qcom/sdm845.c
@@ -158,17 +158,24 @@ static int sdm845_snd_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
+static void sdm845_jack_free(struct snd_jack *jack)
+{
+        struct snd_soc_component *component = jack->private_data;
+
+        snd_soc_component_set_jack(component, NULL, NULL);
+}
+
 static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
         struct snd_soc_component *component;
-        struct snd_soc_dai_link *dai_link = rtd->dai_link;
         struct snd_soc_card *card = rtd->card;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
         struct sdm845_snd_data *pdata = snd_soc_card_get_drvdata(card);
-        int i, rval;
+        struct snd_jack *jack;
+        int rval;
 
         if (!pdata->jack_setup) {
-                struct snd_jack *jack;
-
                 rval = snd_soc_card_jack_new(card, "Headset Jack",
                                 SND_JACK_HEADSET |
                                 SND_JACK_HEADPHONE |
@@ -190,16 +197,22 @@ static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
                 pdata->jack_setup = true;
         }
 
-        for (i = 0 ; i < dai_link->num_codecs; i++) {
-                struct snd_soc_dai *dai = rtd->codec_dais[i];
+        switch (cpu_dai->id) {
+        case PRIMARY_MI2S_RX:
+                jack  = pdata->jack.jack;
+                component = codec_dai->component;
 
-                component = dai->component;
-                rval = snd_soc_component_set_jack(
-                                component, &pdata->jack, NULL);
+                jack->private_data = component;
+                jack->private_free = sdm845_jack_free;
+                rval = snd_soc_component_set_jack(component,
+                                                  &pdata->jack, NULL);
                 if (rval != 0 && rval != -ENOTSUPP) {
                         dev_warn(card->dev, "Failed to set jack: %d\n", rval);
                         return rval;
                 }
+                break;
+        default:
+                break;
         }
 
         return 0;
diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
index 922fb6aa3ed1..5aee11c94f2a 100644
--- a/sound/soc/sh/dma-sh7760.c
+++ b/sound/soc/sh/dma-sh7760.c
@@ -202,7 +202,7 @@ static int camelot_prepare(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct camelot_pcm *cam = &cam_pcm_data[rtd->cpu_dai->id];
 
-        pr_debug("PCM data: addr 0x%08ulx len %d\n",
+        pr_debug("PCM data: addr 0x%08lx len %d\n",
                  (u32)runtime->dma_addr, runtime->dma_bytes);
  
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 0462b3ec977a..aae450ba4f08 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -742,7 +742,7 @@ static struct snd_soc_component *soc_find_component(
                 if (of_node) {
                         if (component->dev->of_node == of_node)
                                 return component;
-                } else if (strcmp(component->name, name) == 0) {
+                } else if (name && strcmp(component->name, name) == 0) {
                         return component;
                 }
         }
@@ -1034,17 +1034,18 @@ static int snd_soc_init_platform(struct snd_soc_card *card,
          * this function should be removed in the future
          */
         /* convert Legacy platform link */
-        if (!platform) {
+        if (!platform || dai_link->legacy_platform) {
                 platform = devm_kzalloc(card->dev,
                                 sizeof(struct snd_soc_dai_link_component),
                                 GFP_KERNEL);
                 if (!platform)
                         return -ENOMEM;
 
-                dai_link->platform      = platform;
-                platform->name          = dai_link->platform_name;
-                platform->of_node       = dai_link->platform_of_node;
-                platform->dai_name      = NULL;
+                dai_link->platform        = platform;
+                dai_link->legacy_platform = 1;
+                platform->name            = dai_link->platform_name;
+                platform->of_node         = dai_link->platform_of_node;
+                platform->dai_name        = NULL;
         }
 
         /* if there's no platform we match on the empty platform */
@@ -1129,6 +1130,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                         link->name);
                 return -EINVAL;
         }
+
+        /*
+         * Defer card registartion if platform dai component is not added to
+         * component list.
+         */
+        if ((link->platform->of_node || link->platform->name) &&
+            !soc_find_component(link->platform->of_node, link->platform->name))
+                return -EPROBE_DEFER;
+
         /*
          * CPU device may be specified by either name or OF node, but
          * can be left unspecified, and will be matched based on DAI
@@ -1140,6 +1150,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                         link->name);
                 return -EINVAL;
         }
+
+        /*
+         * Defer card registartion if cpu dai component is not added to
+         * component list.
+         */
+        if ((link->cpu_of_node || link->cpu_name) &&
+            !soc_find_component(link->cpu_of_node, link->cpu_name))
+                return -EPROBE_DEFER;
+
         /*
          * At least one of CPU DAI name or CPU device name/node must be
          * specified
@@ -2739,15 +2758,18 @@ int snd_soc_register_card(struct snd_soc_card *card)
         if (!card->name || !card->dev)
                 return -EINVAL;
 
+        mutex_lock(&client_mutex);
         for_each_card_prelinks(card, i, link) {
 
                 ret = soc_init_dai_link(card, link);
                 if (ret) {
                         dev_err(card->dev, "ASoC: failed to init link %s\n",
                                 link->name);
+                        mutex_unlock(&client_mutex);
                         return ret;
                 }
         }
+        mutex_unlock(&client_mutex);
 
         dev_set_drvdata(card->dev, card);
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index a5178845065b..2c4c13419539 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2019,19 +2019,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                 out = is_connected_output_ep(w, NULL, NULL);
         }
 
-        ret = snprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
+        ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
                        w->name, w->power ? "On" : "Off",
                        w->force ? " (forced)" : "", in, out);
 
         if (w->reg >= 0)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                 " - R%d(0x%x) mask 0x%x",
                                 w->reg, w->reg, w->mask << w->shift);
 
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
 
         if (w->sname)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
                                 w->sname,
                                 w->active ? "active" : "inactive");
 
@@ -2044,7 +2044,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                         if (!p->connect)
                                 continue;
 
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                         " %s  \"%s\" \"%s\"\n",
                                         (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out",
                                         p->name ? p->name : "static",
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index eeda6d5565bc..a10fcb5963c6 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -108,7 +108,7 @@ struct davinci_mcasp {
         /* Used for comstraint setting on the second stream */
         u32     channels;
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
         struct davinci_mcasp_context context;
 #endif
 
@@ -1486,74 +1486,6 @@ static int davinci_mcasp_dai_probe(struct snd_soc_dai *dai)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int davinci_mcasp_suspend(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-
-        context->pm_state = pm_runtime_active(mcasp->dev);
-        if (!context->pm_state)
-                pm_runtime_get_sync(mcasp->dev);
-
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
-
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
-        }
-
-        for (i = 0; i < mcasp->num_serializer; i++)
-                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
-                                                DAVINCI_MCASP_XRSRCTL_REG(i));
-
-        pm_runtime_put_sync(mcasp->dev);
-
-        return 0;
-}
-
-static int davinci_mcasp_resume(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-
-        pm_runtime_get_sync(mcasp->dev);
-
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
-
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
-        }
-
-        for (i = 0; i < mcasp->num_serializer; i++)
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
-                              context->xrsr_regs[i]);
-
-        if (!context->pm_state)
-                pm_runtime_put_sync(mcasp->dev);
-
-        return 0;
-}
-#else
-#define davinci_mcasp_suspend NULL
-#define davinci_mcasp_resume NULL
-#endif
-
 #define DAVINCI_MCASP_RATES     SNDRV_PCM_RATE_8000_192000
 
 #define DAVINCI_MCASP_PCM_FMTS (SNDRV_PCM_FMTBIT_S8 | \
@@ -1571,8 +1503,6 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
         {
                 .name           = "davinci-mcasp.0",
                 .probe          = davinci_mcasp_dai_probe,
-                .suspend        = davinci_mcasp_suspend,
-                .resume         = davinci_mcasp_resume,
                 .playback       = {
                         .channels_min   = 1,
                         .channels_max   = 32 * 16,
@@ -1976,7 +1906,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
         }
 
         mcasp->num_serializer = pdata->num_serializer;
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
         mcasp->context.xrsr_regs = devm_kcalloc(&pdev->dev,
                                         mcasp->num_serializer, sizeof(u32),
                                         GFP_KERNEL);
@@ -2196,11 +2126,73 @@ static int davinci_mcasp_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM
+static int davinci_mcasp_runtime_suspend(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
+
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
+        }
+
+        for (i = 0; i < mcasp->num_serializer; i++)
+                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
+                                                DAVINCI_MCASP_XRSRCTL_REG(i));
+
+        return 0;
+}
+
+static int davinci_mcasp_runtime_resume(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
+
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
+        }
+
+        for (i = 0; i < mcasp->num_serializer; i++)
+                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
+                              context->xrsr_regs[i]);
+
+        return 0;
+}
+
+#endif
+
+static const struct dev_pm_ops davinci_mcasp_pm_ops = {
+        SET_RUNTIME_PM_OPS(davinci_mcasp_runtime_suspend,
+                           davinci_mcasp_runtime_resume,
+                           NULL)
+};
+
 static struct platform_driver davinci_mcasp_driver = {
         .probe          = davinci_mcasp_probe,
         .remove         = davinci_mcasp_remove,
         .driver         = {
                 .name   = "davinci-mcasp",
+                .pm     = &davinci_mcasp_pm_ops,
                 .of_match_table = mcasp_dt_ids,
         },
 };
diff --git a/sound/soc/xilinx/Kconfig b/sound/soc/xilinx/Kconfig
index 25e287feb58c..723a583a8d57 100644
--- a/sound/soc/xilinx/Kconfig
+++ b/sound/soc/xilinx/Kconfig
@@ -1,5 +1,5 @@
 config SND_SOC_XILINX_I2S
-        tristate "Audio support for the the Xilinx I2S"
+        tristate "Audio support for the Xilinx I2S"
         help
           Select this option to enable Xilinx I2S Audio. This enables
           I2S playback and capture using xilinx soft IP. In transmitter
diff --git a/sound/soc/xilinx/xlnx_i2s.c b/sound/soc/xilinx/xlnx_i2s.c
index d4ae9eff41ce..8b353166ad44 100644
--- a/sound/soc/xilinx/xlnx_i2s.c
+++ b/sound/soc/xilinx/xlnx_i2s.c
@@ -1,12 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0
-/*
- * Xilinx ASoC I2S audio support
- *
- * Copyright (C) 2018 Xilinx, Inc.
- *
- * Author: Praveen Vuppala <praveenv@xilinx.com>
- * Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
- */
+//
+// Xilinx ASoC I2S audio support
+//
+// Copyright (C) 2018 Xilinx, Inc.
+//
+// Author: Praveen Vuppala <praveenv@xilinx.com>
+// Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
 
 #include <linux/io.h>
 #include <linux/module.h>
diff --git a/tools/testing/nvdimm/dimm_devs.c b/tools/testing/nvdimm/dimm_devs.c
index e75238404555..2d4baf57822f 100644
--- a/tools/testing/nvdimm/dimm_devs.c
+++ b/tools/testing/nvdimm/dimm_devs.c
@@ -18,8 +18,8 @@ ssize_t security_show(struct device *dev,
          * For the test version we need to poll the "hardware" in order
          * to get the updated status for unlock testing.
          */
-        nvdimm->sec.state = nvdimm_security_state(nvdimm, false);
-        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, true);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
+        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, NVDIMM_MASTER);
 
         switch (nvdimm->sec.state) {
         case NVDIMM_SECURITY_DISABLED:
diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
index f8d468f54e98..aaa1e9f083c3 100644
--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
         struct libmnt_table *tb;
         struct libmnt_iter *itr = NULL;
         struct libmnt_fs *fs;
-        int found = 0;
+        int found = 0, ret;
 
         cxt = mnt_new_context();
         if (!cxt)
@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
                         break;
                 }
         }
-        if (found)
-                asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+        if (found) {
+                ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                if (ret < 0)
+                        err(EXIT_FAILURE, "failed to format string");
+        }
 
         mnt_free_iter(itr);
         mnt_free_context(cxt);
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 23022e9d32eb..b52cfdefecbf 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -571,7 +571,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
          * already exist.
          */
         region = (struct userspace_mem_region *) userspace_mem_region_find(
-                vm, guest_paddr, guest_paddr + npages * vm->page_size);
+                vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
         if (region != NULL)
                 TEST_ASSERT(false, "overlapping userspace_mem_region already "
                         "exists\n"
@@ -587,15 +587,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
                 region = region->next) {
                 if (region->region.slot == slot)
                         break;
-                if ((guest_paddr <= (region->region.guest_phys_addr
-                                + region->region.memory_size))
-                        && ((guest_paddr + npages * vm->page_size)
-                                >= region->region.guest_phys_addr))
-                        break;
         }
         if (region != NULL)
                 TEST_ASSERT(false, "A mem region with the requested slot "
-                        "or overlapping physical memory range already exists.\n"
+                        "already exists.\n"
                         "  requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
                         "  existing slot: %u paddr: 0x%lx size: 0x%lx",
                         slot, guest_paddr, npages,
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index ea3c73e8f4f6..c49c2a28b0eb 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -103,6 +103,12 @@ int main(int argc, char *argv[])
 
         vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
 
+        /* KVM should return supported EVMCS version range */
+        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
+                    (evmcs_ver & 0xff) > 0,
+                    "Incorrect EVMCS version range: %x:%x\n",
+                    evmcs_ver & 0xff, evmcs_ver >> 8);
+
         run = vcpu_state(vm, VCPU_ID);
 
         vcpu_regs_get(vm, VCPU_ID, &regs1);
diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
index e20b017e7073..b2065536d407 100644
--- a/tools/testing/selftests/rtc/rtctest.c
+++ b/tools/testing/selftests/rtc/rtctest.c
@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
 
         rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
         ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
 
         /* Disable alarm interrupts */
         rc = ioctl(self->fd, RTC_AIE_OFF, 0);
         ASSERT_NE(-1, rc);
 
-        if (rc == 0)
-                return;
-
         rc = read(self->fd, &data, sizeof(unsigned long));
         ASSERT_NE(-1, rc);
         TH_LOG("data: %lx", data);
@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) {
 
         rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
         ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
+
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+
+TEST_F(rtc, alarm_alm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        unsigned long data;
+        struct rtc_time tm;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
+        gmtime_r(&secs, (struct tm *)&tm);
+
+        rc = ioctl(self->fd, RTC_ALM_SET, &tm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+
+        rc = ioctl(self->fd, RTC_ALM_READ, &tm);
+        ASSERT_NE(-1, rc);
+
+        TH_LOG("Alarm time now set to %02d:%02d:%02d.",
+               tm.tm_hour, tm.tm_min, tm.tm_sec);
+
+        /* Enable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_ON, 0);
+        ASSERT_NE(-1, rc);
+
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
+
+        /* Disable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+        ASSERT_NE(-1, rc);
+
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        TH_LOG("data: %lx", data);
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+
+TEST_F(rtc, alarm_wkalm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        struct rtc_wkalrm alarm = { 0 };
+        struct rtc_time tm;
+        unsigned long data;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+
+        rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
+        ASSERT_NE(-1, rc);
+
+        secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
+        gmtime_r(&secs, (struct tm *)&alarm.time);
+
+        alarm.enabled = 1;
+
+        rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+
+        rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
+        ASSERT_NE(-1, rc);
+
+        TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
+               alarm.time.tm_mday, alarm.time.tm_mon + 1,
+               alarm.time.tm_year + 1900, alarm.time.tm_hour,
+               alarm.time.tm_min, alarm.time.tm_sec);
+
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
 
         rc = read(self->fd, &data, sizeof(unsigned long));
         ASSERT_NE(-1, rc);
diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index fce7f4ce0692..1760b3e39730 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
 CFLAGS += -Wl,-no-as-needed -Wall
 
 seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
-        $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+        $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
 
 TEST_PROGS += $(BINARIES)
 EXTRA_CLEAN := $(BINARIES)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 067cb4607d6c..496a9a8c773a 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -3044,7 +3044,7 @@ TEST(user_notification_basic)
         /* Check that the basic notification machinery works */
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /* Installing a second listener in the chain should EBUSY */
         EXPECT_EQ(user_trap_syscall(__NR_getpid,
@@ -3103,7 +3103,7 @@ TEST(user_notification_kill_in_middle)
 
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /*
          * Check that nothing bad happens when we kill the task in the middle
@@ -3152,7 +3152,7 @@ TEST(user_notification_signal)
 
         listener = user_trap_syscall(__NR_gettid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         pid = fork();
         ASSERT_GE(pid, 0);
@@ -3215,7 +3215,7 @@ TEST(user_notification_closed_listener)
 
         listener = user_trap_syscall(__NR_getpid,
                                      SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
 
         /*
          * Check that we get an ENOSYS when the listener is closed.
@@ -3376,7 +3376,7 @@ TEST(seccomp_get_notif_sizes)
 {
         struct seccomp_notif_sizes sizes;
 
-        EXPECT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
+        ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
         EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
         EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
 }
diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index 880b96fc80d4..c0534e298b51 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -25,6 +25,7 @@ struct gup_benchmark {
         __u64 size;
         __u32 nr_pages_per_call;
         __u32 flags;
+        __u64 expansion[10];    /* For future use */
 };
 
 int main(int argc, char **argv)
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index 50f7e9272481..bf1bb15b6fbe 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -1503,7 +1503,7 @@ exit:
                 exit(20);
         }
         if (successes != total_nr_tests) {
-                eprintf("ERROR: succeded fewer than number of tries (%d != %d)\n",
+                eprintf("ERROR: succeeded fewer than number of tries (%d != %d)\n",
                                 successes, total_nr_tests);
                 exit(21);
         }
diff --git a/tools/testing/selftests/x86/unwind_vdso.c b/tools/testing/selftests/x86/unwind_vdso.c
index 00a26a82fa98..97311333700e 100644
--- a/tools/testing/selftests/x86/unwind_vdso.c
+++ b/tools/testing/selftests/x86/unwind_vdso.c
@@ -44,7 +44,6 @@ int main()
 #include <stdbool.h>
 #include <sys/ptrace.h>
 #include <sys/user.h>
-#include <sys/ucontext.h>
 #include <link.h>
 #include <sys/auxv.h>
 #include <dlfcn.h>