Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

The netfilter conflicts were rather simple overlapping
changes.

However, the cls_tcindex.c stuff was a bit more complex.

On the 'net' side, Cong is fixing several races and memory
leaks.  Whilst on the 'net-next' side we have Vlad adding
the rtnl-ness support.

What I've decided to do, in order to resolve this, is revert the
conversion over to using a workqueue that Cong did, bringing us back
to pure RCU.  I did it this way because I believe that either Cong's
races don't apply with have Vlad did things, or Cong will have to
implement the race fix slightly differently.

Signed-off-by: David S. Miller <davem@davemloft.net>

272 files changed, 1962 insertions, 1228 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 7afb2fedde0a..bcf2cd519d1e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1701,12 +1701,11 @@
                         By default, super page will be supported if Intel IOMMU
                         has the capability. With this option, super page will
                         not be supported.
-                sm_off [Default Off]
-                        By default, scalable mode will be supported if the
+                sm_on [Default Off]
+                        By default, scalable mode will be disabled even if the
                         hardware advertises that it has support for the scalable
                         mode translation. With this option set, scalable mode
-                        will not be used even on hardware which claims to support
-                        it.
+                        will be used on hardware which claims to support it.
                 tboot_noforce [Default Off]
                         Do not force the Intel IOMMU enabled under tboot.
                         By default, tboot will force Intel IOMMU on, which
diff --git a/Documentation/networking/operstates.txt b/Documentation/networking/operstates.txt
index 355c6d8ef8ad..b203d1334822 100644
--- a/Documentation/networking/operstates.txt
+++ b/Documentation/networking/operstates.txt
@@ -22,8 +22,9 @@ and changeable from userspace under certain rules.
 2. Querying from userspace
 
 Both admin and operational state can be queried via the netlink
-operation RTM_GETLINK. It is also possible to subscribe to RTMGRP_LINK
-to be notified of updates. This is important for setting from userspace.
+operation RTM_GETLINK. It is also possible to subscribe to RTNLGRP_LINK
+to be notified of updates while the interface is admin up. This is
+important for setting from userspace.
 
 These values contain interface state:
 
@@ -101,8 +102,9 @@ because some driver controlled protocol establishment has to
 complete. Corresponding functions are netif_dormant_on() to set the
 flag, netif_dormant_off() to clear it and netif_dormant() to query.
 
-On device allocation, networking core sets the flags equivalent to
-netif_carrier_ok() and !netif_dormant().
+On device allocation, both flags __LINK_STATE_NOCARRIER and
+__LINK_STATE_DORMANT are cleared, so the effective state is equivalent
+to netif_carrier_ok() and !netif_dormant().
 
 
 Whenever the driver CHANGES one of these flags, a workqueue event is
@@ -133,11 +135,11 @@ netif_carrier_ok() && !netif_dormant() is set by the
 driver. Afterwards, the userspace application can set IFLA_OPERSTATE
 to IF_OPER_DORMANT or IF_OPER_UP as long as the driver does not set
 netif_carrier_off() or netif_dormant_on(). Changes made by userspace
-are multicasted on the netlink group RTMGRP_LINK.
+are multicasted on the netlink group RTNLGRP_LINK.
 
 So basically a 802.1X supplicant interacts with the kernel like this:
 
--subscribe to RTMGRP_LINK
+-subscribe to RTNLGRP_LINK
 -set IFLA_LINKMODE to 1 via RTM_SETLINK
 -query RTM_GETLINK once to get initial state
 -if initial flags are not (IFF_LOWER_UP && !IFF_DORMANT), wait until
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 58649bd4fcfc..ebc679bcb2dc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -80,7 +80,9 @@ nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
 
 nr_negative shows the number of unused dentries that are also
-negative dentries which do not mapped to actual files.
+negative dentries which do not map to any files. Instead,
+they help speeding up rejection of non-existing files provided
+by the users.
 
 ==============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index d7da0618d6b3..8c8f509844c5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5192,7 +5192,7 @@ DRM DRIVERS FOR XEN
 M:      Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
 T:      git git://anongit.freedesktop.org/drm/drm-misc
 L:      dri-devel@lists.freedesktop.org
-L:      xen-devel@lists.xen.org
+L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/gpu/drm/xen/
 F:      Documentation/gpu/xen-front.rst
@@ -6165,7 +6165,7 @@ FREESCALE SOC SOUND DRIVERS
 M:      Timur Tabi <timur@kernel.org>
 M:      Nicolin Chen <nicoleotsuka@gmail.com>
 M:      Xiubo Li <Xiubo.Lee@gmail.com>
-R:      Fabio Estevam <fabio.estevam@nxp.com>
+R:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Maintained
@@ -10913,7 +10913,7 @@ F:	include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
 
 NXP SGTL5000 DRIVER
-M:      Fabio Estevam <fabio.estevam@nxp.com>
+M:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Maintained
 F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -11327,10 +11327,12 @@ F:	include/dt-bindings/
 
 OPENCORES I2C BUS DRIVER
 M:      Peter Korsgaard <peter@korsgaard.com>
+M:      Andrew Lunn <andrew@lunn.ch>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-ocores
 F:      drivers/i2c/busses/i2c-ocores.c
+F:      include/linux/platform_data/i2c-ocores.h
 
 OPENRISC ARCHITECTURE
 M:      Jonas Bonn <jonas@southpole.se>
diff --git a/Makefile b/Makefile
index 3142e67d03f1..86cf35d1d79d 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/irq.h b/arch/alpha/include/asm/irq.h
index 4d17cacd1462..432402c8e47f 100644
--- a/arch/alpha/include/asm/irq.h
+++ b/arch/alpha/include/asm/irq.h
@@ -56,15 +56,15 @@
 
 #elif defined(CONFIG_ALPHA_DP264) || \
       defined(CONFIG_ALPHA_LYNX)  || \
-      defined(CONFIG_ALPHA_SHARK) || \
-      defined(CONFIG_ALPHA_EIGER)
+      defined(CONFIG_ALPHA_SHARK)
 # define NR_IRQS        64
 
 #elif defined(CONFIG_ALPHA_TITAN)
 #define NR_IRQS         80
 
 #elif defined(CONFIG_ALPHA_RAWHIDE) || \
-        defined(CONFIG_ALPHA_TAKARA)
+      defined(CONFIG_ALPHA_TAKARA) || \
+      defined(CONFIG_ALPHA_EIGER)
 # define NR_IRQS        128
 
 #elif defined(CONFIG_ALPHA_WILDFIRE)
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index d73dc473fbb9..188fc9256baf 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *next_mm)
 /* Macro for exception fixup code to access integer registers.  */
 #define dpf_reg(r)                                                      \
         (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 :  \
-                                 (r) <= 18 ? (r)+8 : (r)-10])
+                                 (r) <= 18 ? (r)+10 : (r)-10])
 
 asmlinkage void
 do_page_fault(unsigned long address, unsigned long mmcsr,
diff --git a/arch/arm/boot/dts/am335x-shc.dts b/arch/arm/boot/dts/am335x-shc.dts
index d0fd68873689..5b250060f6dd 100644
--- a/arch/arm/boot/dts/am335x-shc.dts
+++ b/arch/arm/boot/dts/am335x-shc.dts
@@ -215,7 +215,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         bus-width = <0x4>;
-        cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
         cd-inverted;
         max-frequency = <26000000>;
         vmmc-supply = <&vmmcsd_fixed>;
diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
index 47aa53ba6b92..559659b399d0 100644
--- a/arch/arm/boot/dts/da850.dtsi
+++ b/arch/arm/boot/dts/da850.dtsi
@@ -476,7 +476,7 @@
                 clocksource: timer@20000 {
                         compatible = "ti,da830-timer";
                         reg = <0x20000 0x1000>;
-                        interrupts = <12>, <13>;
+                        interrupts = <21>, <22>;
                         interrupt-names = "tint12", "tint34";
                         clocks = <&pll0_auxclk>;
                 };
diff --git a/arch/arm/boot/dts/imx6q-pistachio.dts b/arch/arm/boot/dts/imx6q-pistachio.dts
index 5edf858c8b86..a31b17eaf51c 100644
--- a/arch/arm/boot/dts/imx6q-pistachio.dts
+++ b/arch/arm/boot/dts/imx6q-pistachio.dts
@@ -103,7 +103,7 @@
                 power {
                         label = "Power Button";
                         gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                         linux,code = <KEY_POWER>;
                 };
         };
diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
index d8163705363e..4a31a415f88e 100644
--- a/arch/arm/boot/dts/imx6sll-evk.dts
+++ b/arch/arm/boot/dts/imx6sll-evk.dts
@@ -309,7 +309,7 @@
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
         cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
         keep-power-in-suspend;
-        enable-sdio-wakeup;
+        wakeup-source;
         vmmc-supply = <&reg_sd3_vmmc>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 272ff6133ec1..d1375d3650fd 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -467,7 +467,7 @@
                         };
 
                         gpt: gpt@2098000 {
-                                compatible = "fsl,imx6sx-gpt", "fsl,imx31-gpt";
+                                compatible = "fsl,imx6sx-gpt", "fsl,imx6dl-gpt";
                                 reg = <0x02098000 0x4000>;
                                 interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6SX_CLK_GPT_BUS>,
diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
index e4645f612712..2ab74860d962 100644
--- a/arch/arm/boot/dts/meson.dtsi
+++ b/arch/arm/boot/dts/meson.dtsi
@@ -274,7 +274,7 @@
                         compatible = "amlogic,meson6-dwmac", "snps,dwmac";
                         reg = <0xc9410000 0x10000
                                0xc1108108 0x4>;
-                        interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+                        interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
                         interrupt-names = "macirq";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts
index 0872f6e3abf5..d50fc2f60fa3 100644
--- a/arch/arm/boot/dts/meson8b-ec100.dts
+++ b/arch/arm/boot/dts/meson8b-ec100.dts
@@ -205,8 +205,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&vcc_3v3>;
         };
diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
index 58669abda259..0f0a46ddf3ff 100644
--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
@@ -221,7 +221,6 @@
                 /* Realtek RTL8211F (0x001cc916) */
                 eth_phy: ethernet-phy@0 {
                         reg = <0>;
-                        eee-broken-1000t;
                         interrupt-parent = <&gpio_intc>;
                         /* GPIOH_3 */
                         interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
@@ -273,8 +272,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&tflash_vdd>;
                 vqmmc-supply = <&tf_io>;
diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
index f5853610b20b..6ac02beb5fa7 100644
--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
@@ -206,8 +206,7 @@
                 cap-sd-highspeed;
                 disable-wp;
 
-                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-                cd-inverted;
+                cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
                 vmmc-supply = <&vcc_3v3>;
         };
diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
index ddc7a7bb33c0..f57acf8f66b9 100644
--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
@@ -105,7 +105,7 @@
                         interrupts-extended = <
                                 &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0
                                 &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0
-                                &cpcap 48 1
+                                &cpcap 48 0
                         >;
                         interrupt-names =
                                 "id_ground", "id_float", "se0conn", "vbusvld",
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index e53d32691308..93b420934e8e 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -714,11 +714,7 @@
 
         vdda-supply = <&vdac>;
 
-        #address-cells = <1>;
-        #size-cells = <0>;
-
         port {
-                reg = <0>;
                 venc_out: endpoint {
                         remote-endpoint = <&opa_in>;
                         ti,channels = <1>;
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 182a53991c90..826920e6b878 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -814,7 +814,7 @@
         /* For debugging, it is often good idea to remove this GPIO.
            It means you can remove back cover (to reboot by removing
            battery) and still use the MMC card. */
-        cd-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; /* 160 */
+        cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
 };
 
 /* most boards use vaux3, only some old versions use vmmc2 instead */
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index 0d9b85317529..e142e6c70a59 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -370,6 +370,19 @@
                 compatible = "ti,omap2-onenand";
                 reg = <0 0 0x20000>;    /* CS0, offset 0, IO size 128K */
 
+                /*
+                 * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported
+                 * bootloader set values when booted with v4.19 using both N950
+                 * and N9 devices (OneNAND Manufacturer: Samsung):
+                 *
+                 *   gpmc cs0 before gpmc_cs_program_settings:
+                 *   cs0 GPMC_CS_CONFIG1: 0xfd001202
+                 *   cs0 GPMC_CS_CONFIG2: 0x00181800
+                 *   cs0 GPMC_CS_CONFIG3: 0x00030300
+                 *   cs0 GPMC_CS_CONFIG4: 0x18001804
+                 *   cs0 GPMC_CS_CONFIG5: 0x03171d1d
+                 *   cs0 GPMC_CS_CONFIG6: 0x97080000
+                 */
                 gpmc,sync-read;
                 gpmc,sync-write;
                 gpmc,burst-length = <16>;
@@ -379,26 +392,27 @@
                 gpmc,device-width = <2>;
                 gpmc,mux-add-data = <2>;
                 gpmc,cs-on-ns = <0>;
-                gpmc,cs-rd-off-ns = <87>;
-                gpmc,cs-wr-off-ns = <87>;
+                gpmc,cs-rd-off-ns = <122>;
+                gpmc,cs-wr-off-ns = <122>;
                 gpmc,adv-on-ns = <0>;
-                gpmc,adv-rd-off-ns = <10>;
-                gpmc,adv-wr-off-ns = <10>;
-                gpmc,oe-on-ns = <15>;
-                gpmc,oe-off-ns = <87>;
+                gpmc,adv-rd-off-ns = <15>;
+                gpmc,adv-wr-off-ns = <15>;
+                gpmc,oe-on-ns = <20>;
+                gpmc,oe-off-ns = <122>;
                 gpmc,we-on-ns = <0>;
-                gpmc,we-off-ns = <87>;
-                gpmc,rd-cycle-ns = <112>;
-                gpmc,wr-cycle-ns = <112>;
-                gpmc,access-ns = <81>;
+                gpmc,we-off-ns = <122>;
+                gpmc,rd-cycle-ns = <148>;
+                gpmc,wr-cycle-ns = <148>;
+                gpmc,access-ns = <117>;
                 gpmc,page-burst-access-ns = <15>;
                 gpmc,bus-turnaround-ns = <0>;
                 gpmc,cycle2cycle-delay-ns = <0>;
                 gpmc,wait-monitoring-ns = <0>;
-                gpmc,clk-activation-ns = <5>;
-                gpmc,wr-data-mux-bus-ns = <30>;
-                gpmc,wr-access-ns = <81>;
-                gpmc,sync-clk-ps = <15000>;
+                gpmc,clk-activation-ns = <10>;
+                gpmc,wr-data-mux-bus-ns = <40>;
+                gpmc,wr-access-ns = <117>;
+
+                gpmc,sync-clk-ps = <15000>; /* TBC; Where this value came? */
 
                 /*
                  * MTD partition table corresponding to Nokia's MeeGo 1.2
diff --git a/arch/arm/boot/dts/omap5-l4.dtsi b/arch/arm/boot/dts/omap5-l4.dtsi
index 9c7e309d9c2c..0960348002ad 100644
--- a/arch/arm/boot/dts/omap5-l4.dtsi
+++ b/arch/arm/boot/dts/omap5-l4.dtsi
@@ -1046,8 +1046,6 @@
                                         <SYSC_IDLE_SMART>,
                                         <SYSC_IDLE_SMART_WKUP>;
                         ti,syss-mask = <1>;
-                        ti,no-reset-on-init;
-                        ti,no-idle-on-init;
                         /* Domains (V, P, C): core, core_pwrdm, l4per_clkdm */
                         clocks = <&l4per_clkctrl OMAP5_UART3_CLKCTRL 0>;
                         clock-names = "fck";
diff --git a/arch/arm/boot/dts/r8a7743.dtsi b/arch/arm/boot/dts/r8a7743.dtsi
index 3cc33f7ff7fe..3adc158a40bb 100644
--- a/arch/arm/boot/dts/r8a7743.dtsi
+++ b/arch/arm/boot/dts/r8a7743.dtsi
@@ -1681,15 +1681,12 @@
 
                 du: display@feb00000 {
                         compatible = "renesas,du-r8a7743";
-                        reg = <0 0xfeb00000 0 0x40000>,
-                              <0 0xfeb90000 0 0x1c>;
-                        reg-names = "du", "lvds.0";
+                        reg = <0 0xfeb00000 0 0x40000>;
                         interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
                         clocks = <&cpg CPG_MOD 724>,
-                                 <&cpg CPG_MOD 723>,
-                                 <&cpg CPG_MOD 726>;
-                        clock-names = "du.0", "du.1", "lvds.0";
+                                 <&cpg CPG_MOD 723>;
+                        clock-names = "du.0", "du.1";
                         status = "disabled";
 
                         ports {
@@ -1704,6 +1701,33 @@
                                 port@1 {
                                         reg = <1>;
                                         du_out_lvds0: endpoint {
+                                                remote-endpoint = <&lvds0_in>;
+                                        };
+                                };
+                        };
+                };
+
+                lvds0: lvds@feb90000 {
+                        compatible = "renesas,r8a7743-lvds";
+                        reg = <0 0xfeb90000 0 0x1c>;
+                        clocks = <&cpg CPG_MOD 726>;
+                        power-domains = <&sysc R8A7743_PD_ALWAYS_ON>;
+                        resets = <&cpg 726>;
+                        status = "disabled";
+
+                        ports {
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+
+                                port@0 {
+                                        reg = <0>;
+                                        lvds0_in: endpoint {
+                                                remote-endpoint = <&du_out_lvds0>;
+                                        };
+                                };
+                                port@1 {
+                                        reg = <1>;
+                                        lvds0_out: endpoint {
                                         };
                                 };
                         };
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 353d90f99b40..13304b8c5139 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -216,6 +216,7 @@
                         #clock-cells = <0>;
                         compatible = "fixed-clock";
                         clock-frequency = <24000000>;
+                        clock-output-names = "osc24M";
                 };
 
                 osc32k: clk-32k {
diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
index 5d23667dc2d2..25540b7694d5 100644
--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
@@ -53,7 +53,7 @@
 
         aliases {
                 serial0 = &uart0;
-                /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
+                ethernet0 = &emac;
                 ethernet1 = &sdiowifi;
         };
 
diff --git a/arch/arm/boot/dts/vf610-bk4.dts b/arch/arm/boot/dts/vf610-bk4.dts
index 689c8930dce3..b08d561d6748 100644
--- a/arch/arm/boot/dts/vf610-bk4.dts
+++ b/arch/arm/boot/dts/vf610-bk4.dts
@@ -110,11 +110,11 @@
         bus-num = <3>;
         status = "okay";
         spi-slave;
+        #address-cells = <0>;
 
-        slave@0 {
+        slave {
                 compatible = "lwn,bk4";
                 spi-max-frequency = <30000000>;
-                reg = <0>;
         };
 };
 
diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c
index 3b73813c6b04..23e8c93515d4 100644
--- a/arch/arm/mach-iop32x/n2100.c
+++ b/arch/arm/mach-iop32x/n2100.c
@@ -75,8 +75,7 @@ void __init n2100_map_io(void)
 /*
  * N2100 PCI.
  */
-static int __init
-n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq;
 
diff --git a/arch/arm/mach-tango/pm.c b/arch/arm/mach-tango/pm.c
index 028e50c6383f..a32c3b631484 100644
--- a/arch/arm/mach-tango/pm.c
+++ b/arch/arm/mach-tango/pm.c
@@ -3,6 +3,7 @@
 #include <linux/suspend.h>
 #include <asm/suspend.h>
 #include "smc.h"
+#include "pm.h"
 
 static int tango_pm_powerdown(unsigned long arg)
 {
@@ -24,10 +25,7 @@ static const struct platform_suspend_ops tango_pm_ops = {
         .valid = suspend_valid_only_mem,
 };
 
-static int __init tango_pm_init(void)
+void __init tango_pm_init(void)
 {
         suspend_set_ops(&tango_pm_ops);
-        return 0;
 }
-
-late_initcall(tango_pm_init);
diff --git a/arch/arm/mach-tango/pm.h b/arch/arm/mach-tango/pm.h
new file mode 100644
index 000000000000..35ea705a0ee2
--- /dev/null
+++ b/arch/arm/mach-tango/pm.h
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifdef CONFIG_SUSPEND
+void __init tango_pm_init(void);
+#else
+#define tango_pm_init NULL
+#endif
diff --git a/arch/arm/mach-tango/setup.c b/arch/arm/mach-tango/setup.c
index 677dd7b5efd9..824f90737b04 100644
--- a/arch/arm/mach-tango/setup.c
+++ b/arch/arm/mach-tango/setup.c
@@ -2,6 +2,7 @@
 #include <asm/mach/arch.h>
 #include <asm/hardware/cache-l2x0.h>
 #include "smc.h"
+#include "pm.h"
 
 static void tango_l2c_write(unsigned long val, unsigned int reg)
 {
@@ -15,4 +16,5 @@ DT_MACHINE_START(TANGO_DT, "Sigma Tango DT")
         .dt_compat      = tango_dt_compat,
         .l2c_aux_mask   = ~0,
         .l2c_write_sec  = tango_l2c_write,
+        .init_late      = tango_pm_init,
 MACHINE_END
diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
index ed36dcab80f1..f51919974183 100644
--- a/arch/arm/plat-pxa/ssp.c
+++ b/arch/arm/plat-pxa/ssp.c
@@ -190,8 +190,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
         if (ssp == NULL)
                 return -ENODEV;
 
-        iounmap(ssp->mmio_base);
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(res->start, resource_size(res));
 
@@ -201,7 +199,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
         list_del(&ssp->node);
         mutex_unlock(&ssp_lock);
 
-        kfree(ssp);
         return 0;
 }
 
diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
index cb44aa290e73..e1d44b903dfc 100644
--- a/arch/arm/xen/mm.c
+++ b/arch/arm/xen/mm.c
@@ -7,7 +7,6 @@
 #include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
 #include <linux/swiotlb.h>
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
index b0c64f75792c..8974b5a1d3b1 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
@@ -188,6 +188,7 @@
                 reg = <0x3a3>;
                 interrupt-parent = <&r_intc>;
                 interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+                x-powers,drive-vbus-en; /* set N_VBUSEN as output pin */
         };
 };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 837a03dee875..2abb335145a6 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -390,7 +390,7 @@
                 };
 
                 video-codec@1c0e000 {
-                        compatible = "allwinner,sun50i-h5-video-engine";
+                        compatible = "allwinner,sun50i-a64-video-engine";
                         reg = <0x01c0e000 0x1000>;
                         clocks = <&ccu CLK_BUS_VE>, <&ccu CLK_VE>,
                                  <&ccu CLK_DRAM_VE>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index e14e0ce7e89f..016641a41694 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -187,8 +187,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 8cd50b75171d..ade2ee09ae96 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -305,8 +305,7 @@
         max-frequency = <200000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddio_ao3v3>;
         vqmmc-supply = <&vddio_tf>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
index 4cf7f6e80c6a..25105ac96d55 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
@@ -238,8 +238,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 2e1cd5e3a246..1cc9dc68ef00 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -258,8 +258,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&tflash_vdd>;
         vqmmc-supply = <&tf_io>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
index ce862266b9aa..0be0f2a5d2fe 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
@@ -196,8 +196,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 93a4acf2c46c..ad4d50bd9d77 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -154,8 +154,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vcc_3v3>;
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
index ec09bb5792b7..2d2db783c44c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
@@ -211,8 +211,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vcc_3v3>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
index f1c410e2da2b..796baea7a0bf 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
@@ -131,8 +131,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index db293440e4ca..255cede7b447 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -238,8 +238,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vcc_3v3>;
         vqmmc-supply = <&vcc_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 6739697be1de..9cbdb85fb591 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -183,8 +183,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_card>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index a1b31013ab6e..bc811a2faf42 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -137,8 +137,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 3c3a667a8df8..3f086ed7de05 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -356,8 +356,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index f7a1cffab4a8..8acfd40090d2 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -147,8 +147,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index 7212dc4531e4..7fa20a8ede17 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -170,8 +170,7 @@
         max-frequency = <100000000>;
         disable-wp;
 
-        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
-        cd-inverted;
+        cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
 
         vmmc-supply = <&vddao_3v3>;
         vqmmc-supply = <&vddio_boot>;
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 99b7495455a6..838e32cc14c9 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -404,7 +404,7 @@
                 };
 
                 intc: interrupt-controller@9bc0000 {
-                        compatible = "arm,gic-v3";
+                        compatible = "qcom,msm8996-gic-v3", "arm,gic-v3";
                         #interrupt-cells = <3>;
                         interrupt-controller;
                         #redistributor-regions = <1>;
diff --git a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
index 20745a8528c5..719ed9d9067d 100644
--- a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
@@ -1011,6 +1011,9 @@
                                  <&cpg CPG_CORE R8A774A1_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A774A1_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a7796.dtsi b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
index afedbf5728ec..0648d12778ed 100644
--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
@@ -1262,6 +1262,9 @@
                                  <&cpg CPG_CORE R8A7796_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
index 6dc9b1fef830..4b3730f640ef 100644
--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
@@ -1068,6 +1068,9 @@
                                  <&cpg CPG_CORE R8A77965_CLK_S3D1>,
                                  <&scif_clk>;
                         clock-names = "fck", "brg_int", "scif_clk";
+                        dmas = <&dmac1 0x13>, <&dmac1 0x12>,
+                               <&dmac2 0x13>, <&dmac2 0x12>;
+                        dma-names = "tx", "rx", "tx", "rx";
                         power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
                         resets = <&cpg 310>;
                         status = "disabled";
diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index f2c211a6229b..58871333737a 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -120,10 +120,12 @@ static int create_dtb(struct kimage *image,
 {
         void *buf;
         size_t buf_size;
+        size_t cmdline_len;
         int ret;
 
+        cmdline_len = cmdline ? strlen(cmdline) : 0;
         buf_size = fdt_totalsize(initial_boot_params)
-                        + strlen(cmdline) + DTB_EXTRA_SPACE;
+                        + cmdline_len + DTB_EXTRA_SPACE;
 
         for (;;) {
                 buf = vmalloc(buf_size);
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index fcb1f2a6d7c6..99bb8facb5cb 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,74 +286,73 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start,
+                     unsigned long end)
 {
-        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long addr = start;
+        pte_t *ptep = pte_offset_kernel(pmdp, start);
 
-        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
-                addr = start + i * PAGE_SIZE;
+        do {
                 note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
-        }
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start,
+                     unsigned long end)
 {
-        pmd_t *pmdp = pmd_offset(pudp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long next, addr = start;
+        pmd_t *pmdp = pmd_offset(pudp, start);
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+        do {
                 pmd_t pmd = READ_ONCE(*pmdp);
+                next = pmd_addr_end(addr, end);
 
-                addr = start + i * PMD_SIZE;
                 if (pmd_none(pmd) || pmd_sect(pmd)) {
                         note_page(st, addr, 3, pmd_val(pmd));
                 } else {
                         BUG_ON(pmd_bad(pmd));
-                        walk_pte(st, pmdp, addr);
+                        walk_pte(st, pmdp, addr, next);
                 }
-        }
+        } while (pmdp++, addr = next, addr != end);
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start,
+                     unsigned long end)
 {
-        pud_t *pudp = pud_offset(pgdp, 0UL);
-        unsigned long addr;
-        unsigned i;
+        unsigned long next, addr = start;
+        pud_t *pudp = pud_offset(pgdp, start);
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+        do {
                 pud_t pud = READ_ONCE(*pudp);
+                next = pud_addr_end(addr, end);
 
-                addr = start + i * PUD_SIZE;
                 if (pud_none(pud) || pud_sect(pud)) {
                         note_page(st, addr, 2, pud_val(pud));
                 } else {
                         BUG_ON(pud_bad(pud));
-                        walk_pmd(st, pudp, addr);
+                        walk_pmd(st, pudp, addr, next);
                 }
-        }
+        } while (pudp++, addr = next, addr != end);
 }
 
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgdp = pgd_offset(mm, 0UL);
-        unsigned i;
-        unsigned long addr;
+        unsigned long end = (start < TASK_SIZE_64) ? TASK_SIZE_64 : 0;
+        unsigned long next, addr = start;
+        pgd_t *pgdp = pgd_offset(mm, start);
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+        do {
                 pgd_t pgd = READ_ONCE(*pgdp);
+                next = pgd_addr_end(addr, end);
 
-                addr = start + i * PGDIR_SIZE;
                 if (pgd_none(pgd)) {
                         note_page(st, addr, 1, pgd_val(pgd));
                 } else {
                         BUG_ON(pgd_bad(pgd));
-                        walk_pud(st, pgdp, addr);
+                        walk_pud(st, pgdp, addr, next);
                 }
-        }
+        } while (pgdp++, addr = next, addr != end);
 }
 
 void ptdump_walk_pgd(struct seq_file *m, struct ptdump_info *info)
diff --git a/arch/m68k/emu/nfblock.c b/arch/m68k/emu/nfblock.c
index 38049357d6d3..40712e49381b 100644
--- a/arch/m68k/emu/nfblock.c
+++ b/arch/m68k/emu/nfblock.c
@@ -155,18 +155,22 @@ out:
 static int __init nfhd_init(void)
 {
         u32 blocks, bsize;
+        int ret;
         int i;
 
         nfhd_id = nf_get_id("XHDI");
         if (!nfhd_id)
                 return -ENODEV;
 
-        major_num = register_blkdev(major_num, "nfhd");
-        if (major_num <= 0) {
+        ret = register_blkdev(major_num, "nfhd");
+        if (ret < 0) {
                 pr_warn("nfhd: unable to get major number\n");
-                return major_num;
+                return ret;
         }
 
+        if (!major_num)
+                major_num = ret;
+
         for (i = NFHD_DEV_OFFSET; i < 24; i++) {
                 if (nfhd_get_capacity(i, 0, &blocks, &bsize))
                         continue;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 0d14f51d0002..a84c24d894aa 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1403,6 +1403,21 @@ config LOONGSON3_ENHANCEMENT
           please say 'N' here. If you want a high-performance kernel to run on
           new Loongson 3 machines only, please say 'Y' here.
 
+config CPU_LOONGSON3_WORKAROUNDS
+        bool "Old Loongson 3 LLSC Workarounds"
+        default y if SMP
+        depends on CPU_LOONGSON3
+        help
+          Loongson 3 processors have the llsc issues which require workarounds.
+          Without workarounds the system may hang unexpectedly.
+
+          Newer Loongson 3 will fix these issues and no workarounds are needed.
+          The workarounds have no significant side effect on them but may
+          decrease the performance of the system so this option should be
+          disabled unless the kernel is intended to be run on old systems.
+
+          If unsure, please say Y.
+
 config CPU_LOONGSON2E
         bool "Loongson 2E"
         depends on SYS_HAS_CPU_LOONGSON2E
diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
index 50cff3cbcc6d..4f7b1fa31cf5 100644
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -76,7 +76,7 @@
         status = "okay";
 
         pinctrl-names = "default";
-        pinctrl-0 = <&pins_uart2>;
+        pinctrl-0 = <&pins_uart3>;
 };
 
 &uart4 {
@@ -196,9 +196,9 @@
                 bias-disable;
         };
 
-        pins_uart2: uart2 {
-                function = "uart2";
-                groups = "uart2-data", "uart2-hwflow";
+        pins_uart3: uart3 {
+                function = "uart3";
+                groups = "uart3-data", "uart3-hwflow";
                 bias-disable;
         };
 
diff --git a/arch/mips/boot/dts/ingenic/jz4740.dtsi b/arch/mips/boot/dts/ingenic/jz4740.dtsi
index 6fb16fd24035..2beb78a62b7d 100644
--- a/arch/mips/boot/dts/ingenic/jz4740.dtsi
+++ b/arch/mips/boot/dts/ingenic/jz4740.dtsi
@@ -161,7 +161,7 @@
                 #dma-cells = <2>;
 
                 interrupt-parent = <&intc>;
-                interrupts = <29>;
+                interrupts = <20>;
 
                 clocks = <&cgu JZ4740_CLK_DMA>;
 
diff --git a/arch/mips/boot/dts/xilfpga/nexys4ddr.dts b/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
index 2152b7ba65fb..cc8dbea0911f 100644
--- a/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
+++ b/arch/mips/boot/dts/xilfpga/nexys4ddr.dts
@@ -90,11 +90,11 @@
                 interrupts = <0>;
         };
 
-        axi_i2c: i2c@10A00000 {
+        axi_i2c: i2c@10a00000 {
             compatible = "xlnx,xps-iic-2.00.a";
             interrupt-parent = <&axi_intc>;
             interrupts = <4>;
-            reg = < 0x10A00000 0x10000 >;
+            reg = < 0x10a00000 0x10000 >;
             clocks = <&ext>;
             xlnx,clk-freq = <0x5f5e100>;
             xlnx,family = "Artix7";
@@ -106,9 +106,9 @@
             #address-cells = <1>;
             #size-cells = <0>;
 
-            ad7420@4B {
+            ad7420@4b {
                 compatible = "adi,adt7420";
-                reg = <0x4B>;
+                reg = <0x4b>;
             };
         } ;
 };
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 43fcd35e2957..94096299fc56 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -58,6 +58,7 @@ static __inline__ void atomic_##op(int i, atomic_t * v)			      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -85,6 +86,7 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v)	      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -118,6 +120,7 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v)	      \
         if (kernel_uses_llsc) {                                               \
                 int temp;                                                     \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -256,6 +259,7 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v)		      \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -283,6 +287,7 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
@@ -316,6 +321,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v)  \
         if (kernel_uses_llsc) {                                               \
                 long temp;                                                    \
                                                                               \
+                loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
                 "       .set    push                                    \n"   \
                 "       .set    "MIPS_ISA_LEVEL"                        \n"   \
diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
index a5eb1bb199a7..b7f6ac5e513c 100644
--- a/arch/mips/include/asm/barrier.h
+++ b/arch/mips/include/asm/barrier.h
@@ -222,6 +222,42 @@
 #define __smp_mb__before_atomic()       __smp_mb__before_llsc()
 #define __smp_mb__after_atomic()        smp_llsc_mb()
 
+/*
+ * Some Loongson 3 CPUs have a bug wherein execution of a memory access (load,
+ * store or pref) in between an ll & sc can cause the sc instruction to
+ * erroneously succeed, breaking atomicity. Whilst it's unusual to write code
+ * containing such sequences, this bug bites harder than we might otherwise
+ * expect due to reordering & speculation:
+ *
+ * 1) A memory access appearing prior to the ll in program order may actually
+ *    be executed after the ll - this is the reordering case.
+ *
+ *    In order to avoid this we need to place a memory barrier (ie. a sync
+ *    instruction) prior to every ll instruction, in between it & any earlier
+ *    memory access instructions. Many of these cases are already covered by
+ *    smp_mb__before_llsc() but for the remaining cases, typically ones in
+ *    which multiple CPUs may operate on a memory location but ordering is not
+ *    usually guaranteed, we use loongson_llsc_mb() below.
+ *
+ *    This reordering case is fixed by 3A R2 CPUs, ie. 3A2000 models and later.
+ *
+ * 2) If a conditional branch exists between an ll & sc with a target outside
+ *    of the ll-sc loop, for example an exit upon value mismatch in cmpxchg()
+ *    or similar, then misprediction of the branch may allow speculative
+ *    execution of memory accesses from outside of the ll-sc loop.
+ *
+ *    In order to avoid this we need a memory barrier (ie. a sync instruction)
+ *    at each affected branch target, for which we also use loongson_llsc_mb()
+ *    defined below.
+ *
+ *    This case affects all current Loongson 3 CPUs.
+ */
+#ifdef CONFIG_CPU_LOONGSON3_WORKAROUNDS /* Loongson-3's LLSC workaround */
+#define loongson_llsc_mb()      __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
+#else
+#define loongson_llsc_mb()      do { } while (0)
+#endif
+
 #include <asm-generic/barrier.h>
 
 #endif /* __ASM_BARRIER_H */
diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
index c4675957b21b..830c93a010c3 100644
--- a/arch/mips/include/asm/bitops.h
+++ b/arch/mips/include/asm/bitops.h
@@ -69,6 +69,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                 : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m));
 #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       " __LL "%0, %1          # set_bit       \n"
@@ -79,6 +80,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
         } else if (kernel_uses_llsc) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
@@ -123,6 +125,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                 : "ir" (~(1UL << bit)));
 #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
         } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       " __LL "%0, %1          # clear_bit     \n"
@@ -133,6 +136,7 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                 } while (unlikely(!temp));
 #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
         } else if (kernel_uses_llsc) {
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
@@ -193,6 +197,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                 unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
                 unsigned long temp;
 
+                loongson_llsc_mb();
                 do {
                         __asm__ __volatile__(
                         "       .set    push                            \n"
diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
index c14d798f3888..b83b0397462d 100644
--- a/arch/mips/include/asm/futex.h
+++ b/arch/mips/include/asm/futex.h
@@ -50,6 +50,7 @@
                   "i" (-EFAULT)                                         \
                 : "memory");                                            \
         } else if (cpu_has_llsc) {                                      \
+                loongson_llsc_mb();                                     \
                 __asm__ __volatile__(                                   \
                 "       .set    push                            \n"     \
                 "       .set    noat                            \n"     \
@@ -163,6 +164,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                   "i" (-EFAULT)
                 : "memory");
         } else if (cpu_has_llsc) {
+                loongson_llsc_mb();
                 __asm__ __volatile__(
                 "# futex_atomic_cmpxchg_inatomic                        \n"
                 "       .set    push                                    \n"
@@ -192,6 +194,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                 : GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval),
                   "i" (-EFAULT)
                 : "memory");
+                loongson_llsc_mb();
         } else
                 return -ENOSYS;
 
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index 57933fc8fd98..910851c62db3 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -228,6 +228,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
                         : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp)
                         : [global] "r" (page_global));
                 } else if (kernel_uses_llsc) {
+                        loongson_llsc_mb();
                         __asm__ __volatile__ (
                         "       .set    push                            \n"
                         "       .set    "MIPS_ISA_ARCH_LEVEL"           \n"
@@ -242,6 +243,7 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
                         "       .set    pop                             \n"
                         : [buddy] "+m" (buddy->pte), [tmp] "=&r" (tmp)
                         : [global] "r" (page_global));
+                        loongson_llsc_mb();
                 }
 #else /* !CONFIG_SMP */
                 if (pte_none(*buddy))
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index 8f5bd04f320a..7f3f136572de 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -457,5 +457,5 @@ void mips_cm_error_report(void)
         }
 
         /* reprime cause register */
-        write_gcr_error_cause(0);
+        write_gcr_error_cause(cm_error);
 }
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 6829a064aac8..339870ed92f7 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -371,7 +371,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size)
 static int get_frame_info(struct mips_frame_info *info)
 {
         bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
-        union mips_instruction insn, *ip, *ip_end;
+        union mips_instruction insn, *ip;
         const unsigned int max_insns = 128;
         unsigned int last_insn_size = 0;
         unsigned int i;
@@ -384,10 +384,9 @@ static int get_frame_info(struct mips_frame_info *info)
         if (!ip)
                 goto err;
 
-        ip_end = (void *)ip + info->func_size;
-
-        for (i = 0; i < max_insns && ip < ip_end; i++) {
+        for (i = 0; i < max_insns; i++) {
                 ip = (void *)ip + last_insn_size;
+
                 if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
                         insn.word = ip->halfword[0] << 16;
                         last_insn_size = 2;
diff --git a/arch/mips/loongson64/Platform b/arch/mips/loongson64/Platform
index 0fce4608aa88..c1a4d4dc4665 100644
--- a/arch/mips/loongson64/Platform
+++ b/arch/mips/loongson64/Platform
@@ -23,6 +23,29 @@ ifdef CONFIG_CPU_LOONGSON2F_WORKAROUNDS
 endif
 
 cflags-$(CONFIG_CPU_LOONGSON3)  += -Wa,--trap
+
+#
+# Some versions of binutils, not currently mainline as of 2019/02/04, support
+# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction
+# to work around a CPU bug (see loongson_llsc_mb() in asm/barrier.h for a
+# description).
+#
+# We disable this in order to prevent the assembler meddling with the
+# instruction that labels refer to, ie. if we label an ll instruction:
+#
+# 1: ll v0, 0(a0)
+#
+# ...then with the assembler fix applied the label may actually point at a sync
+# instruction inserted by the assembler, and if we were using the label in an
+# exception table the table would no longer contain the address of the ll
+# instruction.
+#
+# Avoid this by explicitly disabling that assembler behaviour. If upstream
+# binutils does not merge support for the flag then we can revisit & remove
+# this later - for now it ensures vendor toolchains don't cause problems.
+#
+cflags-$(CONFIG_CPU_LOONGSON3)  += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,)
+
 #
 # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a
 # as MIPS64 R2; older versions as just R1.  This leaves the possibility open
diff --git a/arch/mips/loongson64/common/reset.c b/arch/mips/loongson64/common/reset.c
index a60715e11306..b26892ce871c 100644
--- a/arch/mips/loongson64/common/reset.c
+++ b/arch/mips/loongson64/common/reset.c
@@ -59,7 +59,12 @@ static void loongson_poweroff(void)
 {
 #ifndef CONFIG_LEFI_FIRMWARE_INTERFACE
         mach_prepare_shutdown();
-        unreachable();
+
+        /*
+         * It needs a wait loop here, but mips/kernel/reset.c already calls
+         * a generic delay loop, machine_hang(), so simply return.
+         */
+        return;
 #else
         void (*fw_poweroff)(void) = (void *)loongson_sysconf.poweroff_addr;
 
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 37b1cb246332..65b6e85447b1 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -932,6 +932,8 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
                  * to mimic that here by taking a load/istream page
                  * fault.
                  */
+                if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                        uasm_i_sync(p, 0);
                 UASM_i_LA(p, ptr, (unsigned long)tlb_do_page_fault_0);
                 uasm_i_jr(p, ptr);
 
@@ -1646,6 +1648,8 @@ static void
 iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr)
 {
 #ifdef CONFIG_SMP
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(p, 0);
 # ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (cpu_has_64bits)
                 uasm_i_lld(p, pte, 0, ptr);
@@ -2259,6 +2263,8 @@ static void build_r4000_tlb_load_handler(void)
 #endif
 
         uasm_l_nopage_tlbl(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_0 & 1) {
@@ -2313,6 +2319,8 @@ static void build_r4000_tlb_store_handler(void)
 #endif
 
         uasm_l_nopage_tlbs(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_1 & 1) {
@@ -2368,6 +2376,8 @@ static void build_r4000_tlb_modify_handler(void)
 #endif
 
         uasm_l_nopage_tlbm(&l, p);
+        if (IS_ENABLED(CONFIG_CPU_LOONGSON3_WORKAROUNDS))
+                uasm_i_sync(&p, 0);
         build_restore_work_registers(&p);
 #ifdef CONFIG_CPU_MICROMIPS
         if ((unsigned long)tlb_do_page_fault_1 & 1) {
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
index 5017d5843c5a..fc29b85cfa92 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
@@ -568,6 +568,11 @@ static int __init octeon_pci_setup(void)
         if (octeon_has_feature(OCTEON_FEATURE_PCIE))
                 return 0;
 
+        if (!octeon_is_pci_host()) {
+                pr_notice("Not in host mode, PCI Controller not initialized\n");
+                return 0;
+        }
+
         /* Point pcibios_map_irq() to the PCI version of it */
         octeon_pcibios_map_irq = octeon_pci_pcibios_map_irq;
 
@@ -579,11 +584,6 @@ static int __init octeon_pci_setup(void)
         else
                 octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_BIG;
 
-        if (!octeon_is_pci_host()) {
-                pr_notice("Not in host mode, PCI Controller not initialized\n");
-                return 0;
-        }
-
         /* PCI I/O and PCI MEM values */
         set_io_port_base(OCTEON_PCI_IOSPACE_BASE);
         ioport_resource.start = 0;
diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
index f6fd340e39c2..0ede4deb8181 100644
--- a/arch/mips/vdso/Makefile
+++ b/arch/mips/vdso/Makefile
@@ -8,6 +8,7 @@ ccflags-vdso := \
         $(filter -E%,$(KBUILD_CFLAGS)) \
         $(filter -mmicromips,$(KBUILD_CFLAGS)) \
         $(filter -march=%,$(KBUILD_CFLAGS)) \
+        $(filter -m%-float,$(KBUILD_CFLAGS)) \
         -D__VDSO__
 
 ifdef CONFIG_CC_IS_CLANG
@@ -129,7 +130,7 @@ $(obj)/%-o32.o: $(src)/%.c FORCE
         $(call cmd,force_checksrc)
         $(call if_changed_rule,cc_o_c)
 
-$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := -mabi=32
+$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=32
 $(obj)/vdso-o32.lds: $(src)/vdso.lds.S FORCE
         $(call if_changed_dep,cpp_lds_S)
 
@@ -169,7 +170,7 @@ $(obj)/%-n32.o: $(src)/%.c FORCE
         $(call cmd,force_checksrc)
         $(call if_changed_rule,cc_o_c)
 
-$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := -mabi=n32
+$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=n32
 $(obj)/vdso-n32.lds: $(src)/vdso.lds.S FORCE
         $(call if_changed_dep,cpp_lds_S)
 
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 2e6ada28da64..c9bfe526ca9d 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1258,21 +1258,13 @@ extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
 
 #define pmd_move_must_withdraw pmd_move_must_withdraw
 struct spinlock;
-static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
-                                         struct spinlock *old_pmd_ptl,
-                                         struct vm_area_struct *vma)
-{
-        if (radix_enabled())
-                return false;
-        /*
-         * Archs like ppc64 use pgtable to store per pmd
-         * specific information. So when we switch the pmd,
-         * we should also withdraw and deposit the pgtable
-         */
-        return true;
-}
-
-
+extern int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+                                  struct spinlock *old_pmd_ptl,
+                                  struct vm_area_struct *vma);
+/*
+ * Hash translation mode use the deposited table to store hash pte
+ * slot information.
+ */
 #define arch_needs_pgtable_deposit arch_needs_pgtable_deposit
 static inline bool arch_needs_pgtable_deposit(void)
 {
diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
index f3c31f5e1026..ecd31569a120 100644
--- a/arch/powerpc/mm/pgtable-book3s64.c
+++ b/arch/powerpc/mm/pgtable-book3s64.c
@@ -400,3 +400,25 @@ void arch_report_meminfo(struct seq_file *m)
                    atomic_long_read(&direct_pages_count[MMU_PAGE_1G]) << 20);
 }
 #endif /* CONFIG_PROC_FS */
+
+/*
+ * For hash translation mode, we use the deposited table to store hash slot
+ * information and they are stored at PTRS_PER_PMD offset from related pmd
+ * location. Hence a pmd move requires deposit and withdraw.
+ *
+ * For radix translation with split pmd ptl, we store the deposited table in the
+ * pmd page. Hence if we have different pmd page we need to withdraw during pmd
+ * move.
+ *
+ * With hash we use deposited table always irrespective of anon or not.
+ * With radix we use deposited table only for anonymous mapping.
+ */
+int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+                           struct spinlock *old_pmd_ptl,
+                           struct vm_area_struct *vma)
+{
+        if (radix_enabled())
+                return (new_pmd_ptl != old_pmd_ptl) && vma_is_anonymous(vma);
+
+        return true;
+}
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
index 7d6457ab5d34..bba281b1fe1b 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
@@ -43,6 +43,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
 {
         unsigned long ret[PLPAR_HCALL_BUFSIZE];
         uint64_t rc, token;
+        uint64_t saved = 0;
 
         /*
          * When the hypervisor cannot map all the requested memory in a single
@@ -56,6 +57,8 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
                 rc = plpar_hcall(H_SCM_BIND_MEM, ret, p->drc_index, 0,
                                 p->blocks, BIND_ANY_ADDR, token);
                 token = ret[0];
+                if (!saved)
+                        saved = ret[1];
                 cond_resched();
         } while (rc == H_BUSY);
 
@@ -64,7 +67,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
                 return -ENXIO;
         }
 
-        p->bound_addr = ret[1];
+        p->bound_addr = saved;
 
         dev_dbg(&p->pdev->dev, "bound drc %x to %pR\n", p->drc_index, &p->res);
 
diff --git a/arch/riscv/include/asm/pgtable-bits.h b/arch/riscv/include/asm/pgtable-bits.h
index 2fa2942be221..470755cb7558 100644
--- a/arch/riscv/include/asm/pgtable-bits.h
+++ b/arch/riscv/include/asm/pgtable-bits.h
@@ -35,6 +35,12 @@
 #define _PAGE_SPECIAL   _PAGE_SOFT
 #define _PAGE_TABLE     _PAGE_PRESENT
 
+/*
+ * _PAGE_PROT_NONE is set on not-present pages (and ignored by the hardware) to
+ * distinguish them from swapped out pages
+ */
+#define _PAGE_PROT_NONE _PAGE_READ
+
 #define _PAGE_PFN_SHIFT 10
 
 /* Set of bits to preserve across pte_modify() */
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 16301966d65b..a8179a8c1491 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -44,7 +44,7 @@
 /* Page protection bits */
 #define _PAGE_BASE      (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER)
 
-#define PAGE_NONE               __pgprot(0)
+#define PAGE_NONE               __pgprot(_PAGE_PROT_NONE)
 #define PAGE_READ               __pgprot(_PAGE_BASE | _PAGE_READ)
 #define PAGE_WRITE              __pgprot(_PAGE_BASE | _PAGE_READ | _PAGE_WRITE)
 #define PAGE_EXEC               __pgprot(_PAGE_BASE | _PAGE_EXEC)
@@ -98,7 +98,7 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
 static inline int pmd_present(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _PAGE_PRESENT);
+        return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pmd_none(pmd_t pmd)
@@ -178,7 +178,7 @@ static inline pte_t *pte_offset_kernel(pmd_t *pmd, unsigned long addr)
 
 static inline int pte_present(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_PRESENT);
+        return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pte_none(pte_t pte)
@@ -380,7 +380,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
  *
  * Format of swap PTE:
  *      bit            0:       _PAGE_PRESENT (zero)
- *      bit            1:       reserved for future use (zero)
+ *      bit            1:       _PAGE_PROT_NONE (zero)
  *      bits      2 to 6:       swap type
  *      bits 7 to XLEN-1:       swap offset
  */
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 1e1395d63dab..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -18,8 +18,6 @@
 #include <asm/cache.h>
 #include <asm/thread_info.h>
 
-#define MAX_BYTES_PER_LONG      0x10
-
 OUTPUT_ARCH(riscv)
 ENTRY(_start)
 
@@ -76,6 +74,8 @@ SECTIONS
                 *(.sbss*)
         }
 
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
+
         EXCEPTION_TABLE(0x10)
         NOTES
 
@@ -83,10 +83,6 @@ SECTIONS
                 *(.rel.dyn*)
         }
 
-        BSS_SECTION(MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG)
-
         _end = .;
 
         STABS_DEBUG
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index 537f97fde37f..b6796e616812 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -30,10 +30,10 @@
         .section .text
 ENTRY(swsusp_arch_suspend)
         lg      %r1,__LC_NODAT_STACK
-        aghi    %r1,-STACK_FRAME_OVERHEAD
         stmg    %r6,%r15,__SF_GPRS(%r1)
+        aghi    %r1,-STACK_FRAME_OVERHEAD
         stg     %r15,__SF_BACKCHAIN(%r1)
-        lgr     %r1,%r15
+        lgr     %r15,%r1
 
         /* Store FPU registers */
         brasl   %r14,save_fpu_regs
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index a966d7bfac57..4266a4de3160 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -382,7 +382,9 @@ static void zpci_irq_handler(struct airq_struct *airq)
                         if (ai == -1UL)
                                 break;
                         inc_irq_stat(IRQIO_MSI);
+                        airq_iv_lock(aibv, ai);
                         generic_handle_irq(airq_iv_get_data(aibv, ai));
+                        airq_iv_unlock(aibv, ai);
                 }
         }
 }
@@ -408,7 +410,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         zdev->aisb = aisb;
 
         /* Create adapter interrupt vector */
-        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA);
+        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK);
         if (!zdev->aibv)
                 return -ENOMEM;
 
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index f105ae8651c9..f62e347862cc 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -602,10 +602,12 @@ ENTRY(trampoline_32bit_src)
 3:
         /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
         pushl   %ecx
+        pushl   %edx
         movl    $MSR_EFER, %ecx
         rdmsr
         btsl    $_EFER_LME, %eax
         wrmsr
+        popl    %edx
         popl    %ecx
 
         /* Enable PAE and LA57 (if required) paging modes */
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 40e12cfc87f6..daafb893449b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,6 +3559,14 @@ static void free_excl_cntrs(int cpu)
 
 static void intel_pmu_cpu_dying(int cpu)
 {
+        fini_debug_store_on_cpu(cpu);
+
+        if (x86_pmu.counter_freezing)
+                disable_counter_freeze();
+}
+
+static void intel_pmu_cpu_dead(int cpu)
+{
         struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
         struct intel_shared_regs *pc;
 
@@ -3570,11 +3578,6 @@ static void intel_pmu_cpu_dying(int cpu)
         }
 
         free_excl_cntrs(cpu);
-
-        fini_debug_store_on_cpu(cpu);
-
-        if (x86_pmu.counter_freezing)
-                disable_counter_freeze();
 }
 
 static void intel_pmu_sched_task(struct perf_event_context *ctx,
@@ -3663,6 +3666,7 @@ static __initconst const struct x86_pmu core_pmu = {
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
+        .cpu_dead               = intel_pmu_cpu_dead,
 };
 
 static struct attribute *intel_pmu_attrs[];
@@ -3703,6 +3707,8 @@ static __initconst const struct x86_pmu intel_pmu = {
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
+        .cpu_dead               = intel_pmu_cpu_dead,
+
         .guest_get_msrs         = intel_guest_get_msrs,
         .sched_task             = intel_pmu_sched_task,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index c07bee31abe8..b10e04387f38 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -1222,6 +1222,8 @@ static struct pci_driver snbep_uncore_pci_driver = {
         .id_table       = snbep_uncore_pci_ids,
 };
 
+#define NODE_ID_MASK    0x7
+
 /*
  * build pci bus to socket mapping
  */
@@ -1243,7 +1245,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool
                 err = pci_read_config_dword(ubox_dev, nodeid_loc, &config);
                 if (err)
                         break;
-                nodeid = config;
+                nodeid = config & NODE_ID_MASK;
                 /* get the Node ID mapping */
                 err = pci_read_config_dword(ubox_dev, idmap_loc, &config);
                 if (err)
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 40616e805292..2779ace16d23 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1065,7 +1065,7 @@ static inline void native_set_pte_at(struct mm_struct *mm, unsigned long addr,
 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                               pmd_t *pmdp, pmd_t pmd)
 {
-        native_set_pmd(pmdp, pmd);
+        set_pmd(pmdp, pmd);
 }
 
 static inline void set_pud_at(struct mm_struct *mm, unsigned long addr,
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 672c7225cb1b..6ce290c506d9 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -784,6 +784,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
                         quirk_no_way_out(i, m, regs);
 
                 if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+                        m->bank = i;
                         mce_read_aux(m, i);
                         *msg = tmp;
                         return 1;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 4f8972311a77..14e6119838a6 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -230,6 +230,29 @@ static bool __cpa_pfn_in_highmap(unsigned long pfn)
 
 #endif
 
+/*
+ * See set_mce_nospec().
+ *
+ * Machine check recovery code needs to change cache mode of poisoned pages to
+ * UC to avoid speculative access logging another error. But passing the
+ * address of the 1:1 mapping to set_memory_uc() is a fine way to encourage a
+ * speculative access. So we cheat and flip the top bit of the address. This
+ * works fine for the code that updates the page tables. But at the end of the
+ * process we need to flush the TLB and cache and the non-canonical address
+ * causes a #GP fault when used by the INVLPG and CLFLUSH instructions.
+ *
+ * But in the common case we already have a canonical address. This code
+ * will fix the top bit if needed and is a no-op otherwise.
+ */
+static inline unsigned long fix_addr(unsigned long addr)
+{
+#ifdef CONFIG_X86_64
+        return (long)(addr << 1) >> 1;
+#else
+        return addr;
+#endif
+}
+
 static unsigned long __cpa_addr(struct cpa_data *cpa, unsigned long idx)
 {
         if (cpa->flags & CPA_PAGES_ARRAY) {
@@ -313,7 +336,7 @@ void __cpa_flush_tlb(void *data)
         unsigned int i;
 
         for (i = 0; i < cpa->numpages; i++)
-                __flush_tlb_one_kernel(__cpa_addr(cpa, i));
+                __flush_tlb_one_kernel(fix_addr(__cpa_addr(cpa, i)));
 }
 
 static void cpa_flush(struct cpa_data *data, int cache)
@@ -347,7 +370,7 @@ static void cpa_flush(struct cpa_data *data, int cache)
                  * Only flush present addresses:
                  */
                 if (pte && (pte_val(*pte) & _PAGE_PRESENT))
-                        clflush_cache_range_opt((void *)addr, PAGE_SIZE);
+                        clflush_cache_range_opt((void *)fix_addr(addr), PAGE_SIZE);
         }
         mb();
 }
@@ -1627,29 +1650,6 @@ out:
         return ret;
 }
 
-/*
- * Machine check recovery code needs to change cache mode of poisoned
- * pages to UC to avoid speculative access logging another error. But
- * passing the address of the 1:1 mapping to set_memory_uc() is a fine
- * way to encourage a speculative access. So we cheat and flip the top
- * bit of the address. This works fine for the code that updates the
- * page tables. But at the end of the process we need to flush the cache
- * and the non-canonical address causes a #GP fault when used by the
- * CLFLUSH instruction.
- *
- * But in the common case we already have a canonical address. This code
- * will fix the top bit if needed and is a no-op otherwise.
- */
-static inline unsigned long make_addr_canonical_again(unsigned long addr)
-{
-#ifdef CONFIG_X86_64
-        return (long)(addr << 1) >> 1;
-#else
-        return addr;
-#endif
-}
-
-
 static int change_page_attr_set_clr(unsigned long *addr, int numpages,
                                     pgprot_t mask_set, pgprot_t mask_clr,
                                     int force_split, int in_flag,
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index fc714ef402a6..2620baa1f699 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -72,6 +72,7 @@
 #include <linux/sched/loadavg.h>
 #include <linux/sched/signal.h>
 #include <trace/events/block.h>
+#include <linux/blk-mq.h>
 #include "blk-rq-qos.h"
 #include "blk-stat.h"
 
@@ -591,6 +592,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
         u64 now = ktime_to_ns(ktime_get());
         bool issue_as_root = bio_issue_as_root_blkg(bio);
         bool enabled = false;
+        int inflight = 0;
 
         blkg = bio->bi_blkg;
         if (!blkg || !bio_flagged(bio, BIO_TRACKED))
@@ -601,6 +603,9 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
                 return;
 
         enabled = blk_iolatency_enabled(iolat->blkiolat);
+        if (!enabled)
+                return;
+
         while (blkg && blkg->parent) {
                 iolat = blkg_to_lat(blkg);
                 if (!iolat) {
@@ -609,8 +614,9 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
                 }
                 rqw = &iolat->rq_wait;
 
-                atomic_dec(&rqw->inflight);
-                if (!enabled || iolat->min_lat_nsec == 0)
+                inflight = atomic_dec_return(&rqw->inflight);
+                WARN_ON_ONCE(inflight < 0);
+                if (iolat->min_lat_nsec == 0)
                         goto next;
                 iolatency_record_time(iolat, &bio->bi_issue, now,
                                       issue_as_root);
@@ -754,10 +760,13 @@ int blk_iolatency_init(struct request_queue *q)
         return 0;
 }
 
-static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+/*
+ * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise
+ * return 0.
+ */
+static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
 {
         struct iolatency_grp *iolat = blkg_to_lat(blkg);
-        struct blk_iolatency *blkiolat = iolat->blkiolat;
         u64 oldval = iolat->min_lat_nsec;
 
         iolat->min_lat_nsec = val;
@@ -766,9 +775,10 @@ static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
                                     BLKIOLATENCY_MAX_WIN_SIZE);
 
         if (!oldval && val)
-                atomic_inc(&blkiolat->enabled);
+                return 1;
         if (oldval && !val)
-                atomic_dec(&blkiolat->enabled);
+                return -1;
+        return 0;
 }
 
 static void iolatency_clear_scaling(struct blkcg_gq *blkg)
@@ -800,6 +810,7 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
         u64 lat_val = 0;
         u64 oldval;
         int ret;
+        int enable = 0;
 
         ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx);
         if (ret)
@@ -834,7 +845,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
         blkg = ctx.blkg;
         oldval = iolat->min_lat_nsec;
 
-        iolatency_set_min_lat_nsec(blkg, lat_val);
+        enable = iolatency_set_min_lat_nsec(blkg, lat_val);
+        if (enable) {
+                WARN_ON_ONCE(!blk_get_queue(blkg->q));
+                blkg_get(blkg);
+        }
+
         if (oldval != iolat->min_lat_nsec) {
                 iolatency_clear_scaling(blkg);
         }
@@ -842,6 +858,24 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
         ret = 0;
 out:
         blkg_conf_finish(&ctx);
+        if (ret == 0 && enable) {
+                struct iolatency_grp *tmp = blkg_to_lat(blkg);
+                struct blk_iolatency *blkiolat = tmp->blkiolat;
+
+                blk_mq_freeze_queue(blkg->q);
+
+                if (enable == 1)
+                        atomic_inc(&blkiolat->enabled);
+                else if (enable == -1)
+                        atomic_dec(&blkiolat->enabled);
+                else
+                        WARN_ON_ONCE(1);
+
+                blk_mq_unfreeze_queue(blkg->q);
+
+                blkg_put(blkg);
+                blk_put_queue(blkg->q);
+        }
         return ret ?: nbytes;
 }
 
@@ -977,8 +1011,14 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd)
 {
         struct iolatency_grp *iolat = pd_to_lat(pd);
         struct blkcg_gq *blkg = lat_to_blkg(iolat);
+        struct blk_iolatency *blkiolat = iolat->blkiolat;
+        int ret;
 
-        iolatency_set_min_lat_nsec(blkg, 0);
+        ret = iolatency_set_min_lat_nsec(blkg, 0);
+        if (ret == 1)
+                atomic_inc(&blkiolat->enabled);
+        if (ret == -1)
+                atomic_dec(&blkiolat->enabled);
         iolatency_clear_scaling(blkg);
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 8f5b533764ca..9437a5eb07cf 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -737,12 +737,20 @@ static void blk_mq_requeue_work(struct work_struct *work)
         spin_unlock_irq(&q->requeue_lock);
 
         list_for_each_entry_safe(rq, next, &rq_list, queuelist) {
-                if (!(rq->rq_flags & RQF_SOFTBARRIER))
+                if (!(rq->rq_flags & (RQF_SOFTBARRIER | RQF_DONTPREP)))
                         continue;
 
                 rq->rq_flags &= ~RQF_SOFTBARRIER;
                 list_del_init(&rq->queuelist);
-                blk_mq_sched_insert_request(rq, true, false, false);
+                /*
+                 * If RQF_DONTPREP, rq has contained some driver specific
+                 * data, so insert it to hctx dispatch list to avoid any
+                 * merge.
+                 */
+                if (rq->rq_flags & RQF_DONTPREP)
+                        blk_mq_request_bypass_insert(rq, false);
+                else
+                        blk_mq_sched_insert_request(rq, true, false, false);
         }
 
         while (!list_empty(&rq_list)) {
diff --git a/block/blk-mq.h b/block/blk-mq.h
index d943d46b0785..d0b3dd54ef8d 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -36,7 +36,6 @@ struct blk_mq_ctx {
         struct kobject          kobj;
 } ____cacheline_aligned_in_smp;
 
-void blk_mq_freeze_queue(struct request_queue *q);
 void blk_mq_free_queue(struct request_queue *q);
 int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
 void blk_mq_wake_waiters(struct request_queue *q);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c093ce01bcd..147f6c7ea59c 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1029,6 +1029,9 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+        /* Initialize debug output. Linux does not use ACPICA defaults */
+        acpi_dbg_level = ACPI_LV_INFO | ACPI_LV_REPAIR;
+
 #ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index b8c3f9e6af89..adf28788cab5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4554,6 +4554,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG SSD PM830 mSATA *",  "CXM13D1Q", ATA_HORKAGE_NOLPM, },
         { "SAMSUNG MZ7TD256HAFV-000L9", NULL,       ATA_HORKAGE_NOLPM, },
+        { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM, },
 
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500IT_*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 6f2856c6d0f2..55481b40df9a 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4075,7 +4075,7 @@ static unsigned int floppy_check_events(struct gendisk *disk,
 
         if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
                 if (lock_fdc(drive))
-                        return -EINTR;
+                        return 0;
                 poll_drive(false, 0);
                 process_fd_request();
         }
diff --git a/drivers/crypto/ccree/cc_driver.c b/drivers/crypto/ccree/cc_driver.c
index 8ada308d72ee..b0125ad65825 100644
--- a/drivers/crypto/ccree/cc_driver.c
+++ b/drivers/crypto/ccree/cc_driver.c
@@ -380,7 +380,7 @@ static int init_cc_resources(struct platform_device *plat_dev)
         rc = cc_ivgen_init(new_drvdata);
         if (rc) {
                 dev_err(dev, "cc_ivgen_init failed\n");
-                goto post_power_mgr_err;
+                goto post_buf_mgr_err;
         }
 
         /* Allocate crypto algs */
@@ -403,6 +403,9 @@ static int init_cc_resources(struct platform_device *plat_dev)
                 goto post_hash_err;
         }
 
+        /* All set, we can allow autosuspend */
+        cc_pm_go(new_drvdata);
+
         /* If we got here and FIPS mode is enabled
          * it means all FIPS test passed, so let TEE
          * know we're good.
@@ -417,8 +420,6 @@ post_cipher_err:
         cc_cipher_free(new_drvdata);
 post_ivgen_err:
         cc_ivgen_fini(new_drvdata);
-post_power_mgr_err:
-        cc_pm_fini(new_drvdata);
 post_buf_mgr_err:
          cc_buffer_mgr_fini(new_drvdata);
 post_req_mgr_err:
diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
index d990f472e89f..6ff7e75ad90e 100644
--- a/drivers/crypto/ccree/cc_pm.c
+++ b/drivers/crypto/ccree/cc_pm.c
@@ -100,20 +100,19 @@ int cc_pm_put_suspend(struct device *dev)
 
 int cc_pm_init(struct cc_drvdata *drvdata)
 {
-        int rc = 0;
         struct device *dev = drvdata_to_dev(drvdata);
 
         /* must be before the enabling to avoid resdundent suspending */
         pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
         pm_runtime_use_autosuspend(dev);
         /* activate the PM module */
-        rc = pm_runtime_set_active(dev);
-        if (rc)
-                return rc;
-        /* enable the PM module*/
-        pm_runtime_enable(dev);
+        return pm_runtime_set_active(dev);
+}
 
-        return rc;
+/* enable the PM module*/
+void cc_pm_go(struct cc_drvdata *drvdata)
+{
+        pm_runtime_enable(drvdata_to_dev(drvdata));
 }
 
 void cc_pm_fini(struct cc_drvdata *drvdata)
diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
index 020a5403c58b..f62624357020 100644
--- a/drivers/crypto/ccree/cc_pm.h
+++ b/drivers/crypto/ccree/cc_pm.h
@@ -16,6 +16,7 @@
 extern const struct dev_pm_ops ccree_pm;
 
 int cc_pm_init(struct cc_drvdata *drvdata);
+void cc_pm_go(struct cc_drvdata *drvdata);
 void cc_pm_fini(struct cc_drvdata *drvdata);
 int cc_pm_suspend(struct device *dev);
 int cc_pm_resume(struct device *dev);
@@ -29,6 +30,8 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
         return 0;
 }
 
+static void cc_pm_go(struct cc_drvdata *drvdata) {}
+
 static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
 
 static inline int cc_pm_suspend(struct device *dev)
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 4e557684f792..fe69dccfa0c0 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -203,6 +203,7 @@ struct at_xdmac_chan {
         u32                             save_cim;
         u32                             save_cnda;
         u32                             save_cndc;
+        u32                             irq_status;
         unsigned long                   status;
         struct tasklet_struct           tasklet;
         struct dma_slave_config         sconfig;
@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)
         struct at_xdmac_desc    *desc;
         u32                     error_mask;
 
-        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
-                 __func__, atchan->status);
+        dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n",
+                __func__, atchan->irq_status);
 
         error_mask = AT_XDMAC_CIS_RBEIS
                      | AT_XDMAC_CIS_WBEIS
@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)
 
         if (at_xdmac_chan_is_cyclic(atchan)) {
                 at_xdmac_handle_cyclic(atchan);
-        } else if ((atchan->status & AT_XDMAC_CIS_LIS)
-                   || (atchan->status & error_mask)) {
+        } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS)
+                   || (atchan->irq_status & error_mask)) {
                 struct dma_async_tx_descriptor  *txd;
 
-                if (atchan->status & AT_XDMAC_CIS_RBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_RBEIS)
                         dev_err(chan2dev(&atchan->chan), "read bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_WBEIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_WBEIS)
                         dev_err(chan2dev(&atchan->chan), "write bus error!!!");
-                if (atchan->status & AT_XDMAC_CIS_ROIS)
+                if (atchan->irq_status & AT_XDMAC_CIS_ROIS)
                         dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
 
                 spin_lock(&atchan->lock);
@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                         atchan = &atxdmac->chan[i];
                         chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
                         chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
-                        atchan->status = chan_status & chan_imr;
+                        atchan->irq_status = chan_status & chan_imr;
                         dev_vdbg(atxdmac->dma.dev,
                                  "%s: chan%d: imr=0x%x, status=0x%x\n",
                                  __func__, i, chan_imr, chan_status);
@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
                                  at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
 
-                        if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+                        if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
                                 at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
 
                         tasklet_schedule(&atchan->tasklet);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 1a44c8086d77..ae10f5614f95 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -406,38 +406,32 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
         }
 }
 
-static int bcm2835_dma_abort(void __iomem *chan_base)
+static int bcm2835_dma_abort(struct bcm2835_chan *c)
 {
-        unsigned long cs;
+        void __iomem *chan_base = c->chan_base;
         long int timeout = 10000;
 
-        cs = readl(chan_base + BCM2835_DMA_CS);
-        if (!(cs & BCM2835_DMA_ACTIVE))
+        /*
+         * A zero control block address means the channel is idle.
+         * (The ACTIVE flag in the CS register is not a reliable indicator.)
+         */
+        if (!readl(chan_base + BCM2835_DMA_ADDR))
                 return 0;
 
         /* Write 0 to the active bit - Pause the DMA */
         writel(0, chan_base + BCM2835_DMA_CS);
 
         /* Wait for any current AXI transfer to complete */
-        while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
+        while ((readl(chan_base + BCM2835_DMA_CS) &
+                BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
                 cpu_relax();
-                cs = readl(chan_base + BCM2835_DMA_CS);
-        }
 
-        /* We'll un-pause when we set of our next DMA */
+        /* Peripheral might be stuck and fail to signal AXI write responses */
         if (!timeout)
-                return -ETIMEDOUT;
-
-        if (!(cs & BCM2835_DMA_ACTIVE))
-                return 0;
-
-        /* Terminate the control block chain */
-        writel(0, chan_base + BCM2835_DMA_NEXTCB);
-
-        /* Abort the whole DMA */
-        writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
-               chan_base + BCM2835_DMA_CS);
+                dev_err(c->vc.chan.device->dev,
+                        "failed to complete outstanding writes\n");
 
+        writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
         return 0;
 }
 
@@ -476,8 +470,15 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
 
         spin_lock_irqsave(&c->vc.lock, flags);
 
-        /* Acknowledge interrupt */
-        writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
+        /*
+         * Clear the INT flag to receive further interrupts. Keep the channel
+         * active in case the descriptor is cyclic or in case the client has
+         * already terminated the descriptor and issued a new one. (May happen
+         * if this IRQ handler is threaded.) If the channel is finished, it
+         * will remain idle despite the ACTIVE flag being set.
+         */
+        writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
+               c->chan_base + BCM2835_DMA_CS);
 
         d = c->desc;
 
@@ -485,11 +486,7 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
                 if (d->cyclic) {
                         /* call the cyclic callback */
                         vchan_cyclic_callback(&d->vd);
-
-                        /* Keep the DMA engine running */
-                        writel(BCM2835_DMA_ACTIVE,
-                               c->chan_base + BCM2835_DMA_CS);
-                } else {
+                } else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
                         vchan_cookie_complete(&c->desc->vd);
                         bcm2835_dma_start_desc(c);
                 }
@@ -779,7 +776,6 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
         struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
         unsigned long flags;
-        int timeout = 10000;
         LIST_HEAD(head);
 
         spin_lock_irqsave(&c->vc.lock, flags);
@@ -789,27 +785,11 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
         list_del_init(&c->node);
         spin_unlock(&d->lock);
 
-        /*
-         * Stop DMA activity: we assume the callback will not be called
-         * after bcm_dma_abort() returns (even if it does, it will see
-         * c->desc is NULL and exit.)
-         */
+        /* stop DMA activity */
         if (c->desc) {
                 vchan_terminate_vdesc(&c->desc->vd);
                 c->desc = NULL;
-                bcm2835_dma_abort(c->chan_base);
-
-                /* Wait for stopping */
-                while (--timeout) {
-                        if (!(readl(c->chan_base + BCM2835_DMA_CS) &
-                                                BCM2835_DMA_ACTIVE))
-                                break;
-
-                        cpu_relax();
-                }
-
-                if (!timeout)
-                        dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
+                bcm2835_dma_abort(c);
         }
 
         vchan_get_all_descriptors(&c->vc, &head);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 2eea4ef72915..6511928b4cdf 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -711,11 +711,9 @@ static int dmatest_func(void *data)
                         srcs[i] = um->addr[i] + src_off;
                         ret = dma_mapping_error(dev->dev, um->addr[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("src mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->to_cnt++;
                 }
@@ -730,11 +728,9 @@ static int dmatest_func(void *data)
                                                DMA_BIDIRECTIONAL);
                         ret = dma_mapping_error(dev->dev, dsts[i]);
                         if (ret) {
-                                dmaengine_unmap_put(um);
                                 result("dst mapping error", total_tests,
                                        src_off, dst_off, len, ret);
-                                failed_tests++;
-                                continue;
+                                goto error_unmap_continue;
                         }
                         um->bidi_cnt++;
                 }
@@ -762,12 +758,10 @@ static int dmatest_func(void *data)
                 }
 
                 if (!tx) {
-                        dmaengine_unmap_put(um);
                         result("prep error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
                 done->done = false;
@@ -776,12 +770,10 @@ static int dmatest_func(void *data)
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
-                        dmaengine_unmap_put(um);
                         result("submit error", total_tests, src_off,
                                dst_off, len, ret);
                         msleep(100);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
                 dma_async_issue_pending(chan);
 
@@ -790,22 +782,20 @@ static int dmatest_func(void *data)
 
                 status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
 
-                dmaengine_unmap_put(um);
-
                 if (!done->done) {
                         result("test timed out", total_tests, src_off, dst_off,
                                len, 0);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 } else if (status != DMA_COMPLETE) {
                         result(status == DMA_ERROR ?
                                "completion error status" :
                                "completion busy status", total_tests, src_off,
                                dst_off, len, ret);
-                        failed_tests++;
-                        continue;
+                        goto error_unmap_continue;
                 }
 
+                dmaengine_unmap_put(um);
+
                 if (params->noverify) {
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
@@ -846,6 +836,12 @@ static int dmatest_func(void *data)
                         verbose_result("test passed", total_tests, src_off,
                                        dst_off, len, 0);
                 }
+
+                continue;
+
+error_unmap_continue:
+                dmaengine_unmap_put(um);
+                failed_tests++;
         }
         ktime = ktime_sub(ktime_get(), ktime);
         ktime = ktime_sub(ktime, comparetime);
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index c2fff3f6c9ca..4a09af3cd546 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long data)
 {
         struct imxdma_channel *imxdmac = (void *)data;
         struct imxdma_engine *imxdma = imxdmac->imxdma;
-        struct imxdma_desc *desc;
+        struct imxdma_desc *desc, *next_desc;
         unsigned long flags;
 
         spin_lock_irqsave(&imxdma->lock, flags);
@@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long data)
         list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
 
         if (!list_empty(&imxdmac->ld_queue)) {
-                desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
-                                        node);
+                next_desc = list_first_entry(&imxdmac->ld_queue,
+                                             struct imxdma_desc, node);
                 list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
-                if (imxdma_xfer_desc(desc) < 0)
+                if (imxdma_xfer_desc(next_desc) < 0)
                         dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
                                  __func__, imxdmac->channel);
         }
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 472c88ae1c0f..92f843eaf1e0 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -119,6 +119,11 @@ void scmi_driver_unregister(struct scmi_driver *driver)
 }
 EXPORT_SYMBOL_GPL(scmi_driver_unregister);
 
+static void scmi_device_release(struct device *dev)
+{
+        kfree(to_scmi_dev(dev));
+}
+
 struct scmi_device *
 scmi_device_create(struct device_node *np, struct device *parent, int protocol)
 {
@@ -138,6 +143,7 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
         scmi_dev->dev.parent = parent;
         scmi_dev->dev.of_node = np;
         scmi_dev->dev.bus = &scmi_bus_type;
+        scmi_dev->dev.release = scmi_device_release;
         dev_set_name(&scmi_dev->dev, "scmi_dev.%d", id);
 
         retval = device_register(&scmi_dev->dev);
@@ -156,9 +162,8 @@ free_mem:
 void scmi_device_destroy(struct scmi_device *scmi_dev)
 {
         scmi_handle_put(scmi_dev->handle);
-        device_unregister(&scmi_dev->dev);
         ida_simple_remove(&scmi_bus_id, scmi_dev->id);
-        kfree(scmi_dev);
+        device_unregister(&scmi_dev->dev);
 }
 
 void scmi_set_handle(struct scmi_device *scmi_dev)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 8fab0d637ee5..3a9b48b227ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -90,8 +90,10 @@ static int psp_sw_fini(void *handle)
         adev->psp.sos_fw = NULL;
         release_firmware(adev->psp.asd_fw);
         adev->psp.asd_fw = NULL;
-        release_firmware(adev->psp.ta_fw);
-        adev->psp.ta_fw = NULL;
+        if (adev->psp.ta_fw) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+        }
         return 0;
 }
 
@@ -435,6 +437,9 @@ static int psp_xgmi_initialize(struct psp_context *psp)
         struct ta_xgmi_shared_memory *xgmi_cmd;
         int ret;
 
+        if (!psp->adev->psp.ta_fw)
+                return -ENOENT;
+
         if (!psp->xgmi_context.initialized) {
                 ret = psp_xgmi_init_shared_buf(psp);
                 if (ret)
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index 0c6e7f9b143f..189fcb004579 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -152,18 +152,22 @@ static int psp_v11_0_init_microcode(struct psp_context *psp)
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ta.bin", chip_name);
         err = request_firmware(&adev->psp.ta_fw, fw_name, adev->dev);
-        if (err)
-                goto out2;
-
-        err = amdgpu_ucode_validate(adev->psp.ta_fw);
-        if (err)
-                goto out2;
-
-        ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
-        adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
-        adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
-        adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
-                le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        if (err) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+                dev_info(adev->dev,
+                         "psp v11.0: Failed to load firmware \"%s\"\n", fw_name);
+        } else {
+                err = amdgpu_ucode_validate(adev->psp.ta_fw);
+                if (err)
+                        goto out2;
+
+                ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
+                adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
+                adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
+                adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
+                        le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        }
 
         return 0;
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 9a7ac58eb18e..ddd75a4d8ba5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -671,6 +671,25 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us
         return bytes_from_user;
 }
 
+/*
+ * Returns the min and max vrr vfreq through the connector's debugfs file.
+ * Example usage: cat /sys/kernel/debug/dri/0/DP-1/vrr_range
+ */
+static int vrr_range_show(struct seq_file *m, void *data)
+{
+        struct drm_connector *connector = m->private;
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+        if (connector->status != connector_status_connected)
+                return -ENODEV;
+
+        seq_printf(m, "Min: %u\n", (unsigned int)aconnector->min_vfreq);
+        seq_printf(m, "Max: %u\n", (unsigned int)aconnector->max_vfreq);
+
+        return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(vrr_range);
+
 static const struct file_operations dp_link_settings_debugfs_fops = {
         .owner = THIS_MODULE,
         .read = dp_link_settings_read,
@@ -697,7 +716,8 @@ static const struct {
 } dp_debugfs_entries[] = {
                 {"link_settings", &dp_link_settings_debugfs_fops},
                 {"phy_settings", &dp_phy_settings_debugfs_fop},
-                {"test_pattern", &dp_phy_test_pattern_fops}
+                {"test_pattern", &dp_phy_test_pattern_fops},
+                {"vrr_range", &vrr_range_fops}
 };
 
 int connector_debugfs_init(struct amdgpu_dm_connector *connector)
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 99cba8ea5d82..5df1256618cc 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -528,7 +528,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 
         object_count = cl->object_count;
 
-        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids), object_count * sizeof(__u32));
+        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
+                        array_size(object_count, sizeof(__u32)));
         if (IS_ERR(object_ids))
                 return PTR_ERR(object_ids);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 216f52b744a6..c882ea94172c 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1824,6 +1824,16 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static inline bool
+__vma_matches(struct vm_area_struct *vma, struct file *filp,
+              unsigned long addr, unsigned long size)
+{
+        if (vma->vm_file != filp)
+                return false;
+
+        return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
+}
+
 /**
  * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
  *                       it is mapped to.
@@ -1882,7 +1892,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
                         return -EINTR;
                 }
                 vma = find_vma(mm, addr);
-                if (vma)
+                if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
                         vma->vm_page_prot =
                                 pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
                 else
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index d6c8f8fdfda5..017fc602a10e 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -594,7 +594,8 @@ static void i915_pmu_enable(struct perf_event *event)
          * Update the bitmask of enabled events and increment
          * the event reference counter.
          */
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        BUILD_BUG_ON(ARRAY_SIZE(i915->pmu.enable_count) != I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == ~0);
         i915->pmu.enable |= BIT_ULL(bit);
         i915->pmu.enable_count[bit]++;
@@ -615,11 +616,16 @@ static void i915_pmu_enable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                engine->pmu.enable |= BIT(sample);
 
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.enable_count) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.sample) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
+
+                engine->pmu.enable |= BIT(sample);
                 engine->pmu.enable_count[sample]++;
         }
 
@@ -649,9 +655,11 @@ static void i915_pmu_disable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == 0);
+
                 /*
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
@@ -660,7 +668,7 @@ static void i915_pmu_disable(struct perf_event *event)
                         engine->pmu.enable &= ~BIT(sample);
         }
 
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == 0);
         /*
          * Decrement the reference count and clear the enabled
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 7f164ca3db12..b3728c5f13e7 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -31,6 +31,8 @@ enum {
         ((1 << I915_PMU_SAMPLE_BITS) + \
          (I915_PMU_LAST + 1 - __I915_PMU_OTHER(0)))
 
+#define I915_ENGINE_SAMPLE_COUNT (I915_SAMPLE_SEMA + 1)
+
 struct i915_pmu_sample {
         u64 cur;
 };
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 0a7d60509ca7..067054cf4a86 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1790,7 +1790,7 @@ enum i915_power_well_id {
 #define _CNL_PORT_TX_C_LN0_OFFSET               0x162C40
 #define _CNL_PORT_TX_D_LN0_OFFSET               0x162E40
 #define _CNL_PORT_TX_F_LN0_OFFSET               0x162840
-#define _CNL_PORT_TX_DW_GRP(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_GRP(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
@@ -1798,7 +1798,7 @@ enum i915_power_well_id {
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_F_GRP_OFFSET) + \
                                                4 * (dw))
-#define _CNL_PORT_TX_DW_LN0(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_LN0(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
@@ -1834,9 +1834,9 @@ enum i915_power_well_id {
 
 #define _CNL_PORT_TX_DW4_LN0_AE         0x162450
 #define _CNL_PORT_TX_DW4_LN1_AE         0x1624D0
-#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 4))
-#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 4))
-#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0((port), 4) + \
+#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(4, (port)))
+#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)))
+#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)) + \
                                            ((ln) * (_CNL_PORT_TX_DW4_LN1_AE - \
                                                     _CNL_PORT_TX_DW4_LN0_AE)))
 #define ICL_PORT_TX_DW4_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(4, port))
@@ -1864,8 +1864,12 @@ enum i915_power_well_id {
 #define   RTERM_SELECT(x)               ((x) << 3)
 #define   RTERM_SELECT_MASK             (0x7 << 3)
 
-#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 7))
-#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 7))
+#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(7, (port)))
+#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(7, (port)))
+#define ICL_PORT_TX_DW7_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(7, port))
+#define ICL_PORT_TX_DW7_GRP(port)       _MMIO(_ICL_PORT_TX_DW_GRP(7, port))
+#define ICL_PORT_TX_DW7_LN0(port)       _MMIO(_ICL_PORT_TX_DW_LN(7, 0, port))
+#define ICL_PORT_TX_DW7_LN(port, ln)    _MMIO(_ICL_PORT_TX_DW_LN(7, ln, port))
 #define   N_SCALAR(x)                   ((x) << 24)
 #define   N_SCALAR_MASK                 (0x7F << 24)
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4079050f9d6c..7edce1b7b348 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -494,103 +494,58 @@ static const struct cnl_ddi_buf_trans cnl_ddi_translations_edp_1_05V[] = {
         { 0x2, 0x7F, 0x3F, 0x00, 0x00 },        /* 400   400      0.0   */
 };
 
-struct icl_combo_phy_ddi_buf_trans {
-        u32 dw2_swing_select;
-        u32 dw2_swing_scalar;
-        u32 dw4_scaling;
-};
-
-/* Voltage Swing Programming for VccIO 0.85V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0xB, 0x70, 0x0018 },  /* 600         0.0   */
-        { 0xB, 0x70, 0x3015 },  /* 600         3.5   */
-        { 0xB, 0x70, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x00, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x00, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
-};
-
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.85V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
-};
-
-/* Voltage Swing Programming for VccIO 0.95V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x76, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x76, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+/* icl_combo_phy_ddi_translations */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.95V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0x0, 0x7F, 0x3F, 0x00, 0x00 },        /* 200   200      0.0   */
+        { 0x8, 0x7F, 0x38, 0x00, 0x07 },        /* 200   250      1.9   */
+        { 0x1, 0x7F, 0x33, 0x00, 0x0C },        /* 200   300      3.5   */
+        { 0x9, 0x7F, 0x31, 0x00, 0x0E },        /* 200   350      4.9   */
+        { 0x8, 0x7F, 0x3F, 0x00, 0x00 },        /* 250   250      0.0   */
+        { 0x1, 0x7F, 0x38, 0x00, 0x07 },        /* 250   300      1.6   */
+        { 0x9, 0x7F, 0x35, 0x00, 0x0A },        /* 250   350      2.9   */
+        { 0x1, 0x7F, 0x3F, 0x00, 0x00 },        /* 300   300      0.0   */
+        { 0x9, 0x7F, 0x38, 0x00, 0x07 },        /* 300   350      1.3   */
+        { 0x9, 0x7F, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
 };
 
-/* Voltage Swing Programming for VccIO 1.05V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x71, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x71, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr3[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 1.05V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_hdmi[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x60, 0x3F, 0x00, 0x00 },        /* 450   450      0.0   */
+        { 0xB, 0x73, 0x36, 0x00, 0x09 },        /* 450   650      3.2   */
+        { 0x6, 0x7F, 0x31, 0x00, 0x0E },        /* 450   850      5.5   */
+        { 0xB, 0x73, 0x3F, 0x00, 0x00 },        /* 650   650      0.0   ALS */
+        { 0x6, 0x7F, 0x37, 0x00, 0x08 },        /* 650   850      2.3   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 850   850      0.0   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   850      3.0   */
 };
 
 struct icl_mg_phy_ddi_buf_trans {
@@ -871,43 +826,23 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv, int *n_entries)
         }
 }
 
-static const struct icl_combo_phy_ddi_buf_trans *
+static const struct cnl_ddi_buf_trans *
 icl_get_combo_buf_trans(struct drm_i915_private *dev_priv, enum port port,
-                        int type, int *n_entries)
+                        int type, int rate, int *n_entries)
 {
-        u32 voltage = I915_READ(ICL_PORT_COMP_DW3(port)) & VOLTAGE_INFO_MASK;
-
-        if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_85V);
-                        return icl_combo_phy_ddi_translations_edp_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_95V);
-                        return icl_combo_phy_ddi_translations_edp_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_1_05V);
-                        return icl_combo_phy_ddi_translations_edp_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
-        } else {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_85V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_95V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_1_05V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
+        if (type == INTEL_OUTPUT_HDMI) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_hdmi);
+                return icl_combo_phy_ddi_translations_hdmi;
+        } else if (rate > 540000 && type == INTEL_OUTPUT_EDP) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr3);
+                return icl_combo_phy_ddi_translations_edp_hbr3;
+        } else if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr2);
+                return icl_combo_phy_ddi_translations_edp_hbr2;
         }
+
+        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hbr2);
+        return icl_combo_phy_ddi_translations_dp_hbr2;
 }
 
 static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
@@ -918,8 +853,8 @@ static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port por
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
-                        icl_get_combo_buf_trans(dev_priv, port,
-                                                INTEL_OUTPUT_HDMI, &n_entries);
+                        icl_get_combo_buf_trans(dev_priv, port, INTEL_OUTPUT_HDMI,
+                                                0, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
                 default_entry = n_entries - 1;
@@ -2275,13 +2210,14 @@ static void bxt_ddi_vswing_sequence(struct intel_encoder *encoder,
 u8 intel_ddi_dp_voltage_max(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+        struct intel_dp *intel_dp = enc_to_intel_dp(&encoder->base);
         enum port port = encoder->port;
         int n_entries;
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
                         icl_get_combo_buf_trans(dev_priv, port, encoder->type,
-                                                &n_entries);
+                                                intel_dp->link_rate, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
         } else if (IS_CANNONLAKE(dev_priv)) {
@@ -2462,14 +2398,15 @@ static void cnl_ddi_vswing_sequence(struct intel_encoder *encoder,
 }
 
 static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
-                                         u32 level, enum port port, int type)
+                                        u32 level, enum port port, int type,
+                                        int rate)
 {
-        const struct icl_combo_phy_ddi_buf_trans *ddi_translations = NULL;
+        const struct cnl_ddi_buf_trans *ddi_translations = NULL;
         u32 n_entries, val;
         int ln;
 
         ddi_translations = icl_get_combo_buf_trans(dev_priv, port, type,
-                                                   &n_entries);
+                                                   rate, &n_entries);
         if (!ddi_translations)
                 return;
 
@@ -2478,34 +2415,23 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 level = n_entries - 1;
         }
 
-        /* Set PORT_TX_DW5 Rterm Sel to 110b. */
+        /* Set PORT_TX_DW5 */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        val &= ~RTERM_SELECT_MASK;
+        val &= ~(SCALING_MODE_SEL_MASK | RTERM_SELECT_MASK |
+                  TAP2_DISABLE | TAP3_DISABLE);
+        val |= SCALING_MODE_SEL(0x2);
         val |= RTERM_SELECT(0x6);
-        I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
-
-        /* Program PORT_TX_DW5 */
-        val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        /* Set DisableTap2 and DisableTap3 if MIPI DSI
-         * Clear DisableTap2 and DisableTap3 for all other Ports
-         */
-        if (type == INTEL_OUTPUT_DSI) {
-                val |= TAP2_DISABLE;
-                val |= TAP3_DISABLE;
-        } else {
-                val &= ~TAP2_DISABLE;
-                val &= ~TAP3_DISABLE;
-        }
+        val |= TAP3_DISABLE;
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* Program PORT_TX_DW2 */
         val = I915_READ(ICL_PORT_TX_DW2_LN0(port));
         val &= ~(SWING_SEL_LOWER_MASK | SWING_SEL_UPPER_MASK |
                  RCOMP_SCALAR_MASK);
-        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_select);
-        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_select);
+        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_sel);
+        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_sel);
         /* Program Rcomp scalar for every table entry */
-        val |= RCOMP_SCALAR(ddi_translations[level].dw2_swing_scalar);
+        val |= RCOMP_SCALAR(0x98);
         I915_WRITE(ICL_PORT_TX_DW2_GRP(port), val);
 
         /* Program PORT_TX_DW4 */
@@ -2514,9 +2440,17 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 val = I915_READ(ICL_PORT_TX_DW4_LN(port, ln));
                 val &= ~(POST_CURSOR_1_MASK | POST_CURSOR_2_MASK |
                          CURSOR_COEFF_MASK);
-                val |= ddi_translations[level].dw4_scaling;
+                val |= POST_CURSOR_1(ddi_translations[level].dw4_post_cursor_1);
+                val |= POST_CURSOR_2(ddi_translations[level].dw4_post_cursor_2);
+                val |= CURSOR_COEFF(ddi_translations[level].dw4_cursor_coeff);
                 I915_WRITE(ICL_PORT_TX_DW4_LN(port, ln), val);
         }
+
+        /* Program PORT_TX_DW7 */
+        val = I915_READ(ICL_PORT_TX_DW7_LN0(port));
+        val &= ~N_SCALAR_MASK;
+        val |= N_SCALAR(ddi_translations[level].dw7_n_scalar);
+        I915_WRITE(ICL_PORT_TX_DW7_GRP(port), val);
 }
 
 static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
@@ -2581,7 +2515,7 @@ static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* 5. Program swing and de-emphasis */
-        icl_ddi_combo_vswing_program(dev_priv, level, port, type);
+        icl_ddi_combo_vswing_program(dev_priv, level, port, type, rate);
 
         /* 6. Set training enable to trigger update */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index fdd2cbc56fa3..22a74608c6e4 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -304,9 +304,11 @@ static int cnl_max_source_rate(struct intel_dp *intel_dp)
 static int icl_max_source_rate(struct intel_dp *intel_dp)
 {
         struct intel_digital_port *dig_port = dp_to_dig_port(intel_dp);
+        struct drm_i915_private *dev_priv = to_i915(dig_port->base.base.dev);
         enum port port = dig_port->base.port;
 
-        if (port == PORT_B)
+        if (intel_port_is_combophy(dev_priv, port) &&
+            !intel_dp_is_edp(intel_dp))
                 return 540000;
 
         return 810000;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f94a04b4ad87..e9ddeaf05a14 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -209,6 +209,16 @@ struct intel_fbdev {
         unsigned long vma_flags;
         async_cookie_t cookie;
         int preferred_bpp;
+
+        /* Whether or not fbdev hpd processing is temporarily suspended */
+        bool hpd_suspended : 1;
+        /* Set when a hotplug was received while HPD processing was
+         * suspended
+         */
+        bool hpd_waiting : 1;
+
+        /* Protects hpd_suspended */
+        struct mutex hpd_lock;
 };
 
 struct intel_encoder {
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index fb5bb5b32a60..7f365ac0b549 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -679,6 +679,7 @@ int intel_fbdev_init(struct drm_device *dev)
         if (ifbdev == NULL)
                 return -ENOMEM;
 
+        mutex_init(&ifbdev->hpd_lock);
         drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
 
         if (!intel_fbdev_init_bios(dev, ifbdev))
@@ -752,6 +753,26 @@ void intel_fbdev_fini(struct drm_i915_private *dev_priv)
         intel_fbdev_destroy(ifbdev);
 }
 
+/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
+ * processing, fbdev will perform a full connector reprobe if a hotplug event
+ * was received while HPD was suspended.
+ */
+static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
+{
+        bool send_hpd = false;
+
+        mutex_lock(&ifbdev->hpd_lock);
+        ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
+        send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
+        ifbdev->hpd_waiting = false;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd) {
+                DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
+                drm_fb_helper_hotplug_event(&ifbdev->helper);
+        }
+}
+
 void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -773,6 +794,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
                  */
                 if (state != FBINFO_STATE_RUNNING)
                         flush_work(&dev_priv->fbdev_suspend_work);
+
                 console_lock();
         } else {
                 /*
@@ -800,17 +822,26 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
 
         drm_fb_helper_set_suspend(&ifbdev->helper, state);
         console_unlock();
+
+        intel_fbdev_hpd_set_suspend(ifbdev, state);
 }
 
 void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
         struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
+        bool send_hpd;
 
         if (!ifbdev)
                 return;
 
         intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma || ifbdev->helper.deferred_setup)
+
+        mutex_lock(&ifbdev->hpd_lock);
+        send_hpd = !ifbdev->hpd_suspended;
+        ifbdev->hpd_waiting = true;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd && (ifbdev->vma || ifbdev->helper.deferred_setup))
                 drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b8f106d9ecf8..3ac20153705a 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -55,7 +55,12 @@
 struct opregion_header {
         u8 signature[16];
         u32 size;
-        u32 opregion_ver;
+        struct {
+                u8 rsvd;
+                u8 revision;
+                u8 minor;
+                u8 major;
+        }  __packed over;
         u8 bios_ver[32];
         u8 vbios_ver[16];
         u8 driver_ver[16];
@@ -119,7 +124,8 @@ struct opregion_asle {
         u64 fdss;
         u32 fdsp;
         u32 stat;
-        u64 rvda;       /* Physical address of raw vbt data */
+        u64 rvda;       /* Physical (2.0) or relative from opregion (2.1+)
+                         * address of raw VBT data. */
         u32 rvds;       /* Size of raw vbt data */
         u8 rsvd[58];
 } __packed;
@@ -925,6 +931,11 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         opregion->header = base;
         opregion->lid_state = base + ACPI_CLID;
 
+        DRM_DEBUG_DRIVER("ACPI OpRegion version %u.%u.%u\n",
+                         opregion->header->over.major,
+                         opregion->header->over.minor,
+                         opregion->header->over.revision);
+
         mboxes = opregion->header->mboxes;
         if (mboxes & MBOX_ACPI) {
                 DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
@@ -953,11 +964,26 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         if (dmi_check_system(intel_no_opregion_vbt))
                 goto out;
 
-        if (opregion->header->opregion_ver >= 2 && opregion->asle &&
+        if (opregion->header->over.major >= 2 && opregion->asle &&
             opregion->asle->rvda && opregion->asle->rvds) {
-                opregion->rvda = memremap(opregion->asle->rvda,
-                                          opregion->asle->rvds,
+                resource_size_t rvda = opregion->asle->rvda;
+
+                /*
+                 * opregion 2.0: rvda is the physical VBT address.
+                 *
+                 * opregion 2.1+: rvda is unsigned, relative offset from
+                 * opregion base, and should never point within opregion.
+                 */
+                if (opregion->header->over.major > 2 ||
+                    opregion->header->over.minor >= 1) {
+                        WARN_ON(rvda < OPREGION_SIZE);
+
+                        rvda += asls;
+                }
+
+                opregion->rvda = memremap(rvda, opregion->asle->rvds,
                                           MEMREMAP_WB);
+
                 vbt = opregion->rvda;
                 vbt_size = opregion->asle->rvds;
                 if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
@@ -967,6 +993,8 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
                         goto out;
                 } else {
                         DRM_DEBUG_KMS("Invalid VBT in ACPI OpRegion (RVDA)\n");
+                        memunmap(opregion->rvda);
+                        opregion->rvda = NULL;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 72edaa7ff411..a1a7cc29fdd1 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -415,16 +415,17 @@ struct intel_engine_cs {
                 /**
                  * @enable_count: Reference count for the enabled samplers.
                  *
-                 * Index number corresponds to the bit number from @enable.
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-                unsigned int enable_count[I915_PMU_SAMPLE_BITS];
+                unsigned int enable_count[I915_ENGINE_SAMPLE_COUNT];
                 /**
                  * @sample: Counter values for sampling events.
                  *
                  * Our internal timer stores the current counters in this field.
+                 *
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-#define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
-                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
+                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_COUNT];
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 2c5bbe317353..e31e263cf86b 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -643,8 +643,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 int bus_format;
 
                 ret = of_property_read_u32(child, "reg", &i);
-                if (ret || i < 0 || i > 1)
-                        return -EINVAL;
+                if (ret || i < 0 || i > 1) {
+                        ret = -EINVAL;
+                        goto free_child;
+                }
 
                 if (!of_device_is_available(child))
                         continue;
@@ -657,7 +659,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 channel = &imx_ldb->channel[i];
                 channel->ldb = imx_ldb;
                 channel->chno = i;
-                channel->child = child;
 
                 /*
                  * The output port is port@4 with an external 4-port mux or
@@ -667,13 +668,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
                 if (ret && ret != -ENODEV)
-                        return ret;
+                        goto free_child;
 
                 /* panel ddc only if there is no bridge */
                 if (!channel->bridge) {
                         ret = imx_ldb_panel_ddc(dev, channel, child);
                         if (ret)
-                                return ret;
+                                goto free_child;
                 }
 
                 bus_format = of_get_bus_format(dev, child);
@@ -689,18 +690,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 if (bus_format < 0) {
                         dev_err(dev, "could not determine data mapping: %d\n",
                                 bus_format);
-                        return bus_format;
+                        ret = bus_format;
+                        goto free_child;
                 }
                 channel->bus_format = bus_format;
+                channel->child = child;
 
                 ret = imx_ldb_register(drm, channel);
-                if (ret)
-                        return ret;
+                if (ret) {
+                        channel->child = NULL;
+                        goto free_child;
+                }
         }
 
         dev_set_drvdata(dev, imx_ldb);
 
         return 0;
+
+free_child:
+        of_node_put(child);
+        return ret;
 }
 
 static void imx_ldb_unbind(struct device *dev, struct device *master,
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index c390924de93d..21e964f6ab5c 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -370,9 +370,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
         if (ret)
                 return ret;
 
-        /* CRTC should be enabled */
+        /* nothing to check when disabling or disabled */
         if (!crtc_state->enable)
-                return -EINVAL;
+                return 0;
 
         switch (plane->type) {
         case DRM_PLANE_TYPE_PRIMARY:
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 4463d3826ecb..e2942c9a11a7 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -440,13 +440,10 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)
 
         while ((entity->dependency =
                         sched->ops->dependency(sched_job, entity))) {
+                trace_drm_sched_job_wait_dep(sched_job, entity->dependency);
 
-                if (drm_sched_entity_add_dependency_cb(entity)) {
-
-                        trace_drm_sched_job_wait_dep(sched_job,
-                                                     entity->dependency);
+                if (drm_sched_entity_add_dependency_cb(entity))
                         return NULL;
-                }
         }
 
         /* skip jobs from entity that marked guilty */
diff --git a/drivers/gpu/drm/vkms/vkms_crc.c b/drivers/gpu/drm/vkms/vkms_crc.c
index 9d9e8146db90..d7b409a3c0f8 100644
--- a/drivers/gpu/drm/vkms/vkms_crc.c
+++ b/drivers/gpu/drm/vkms/vkms_crc.c
@@ -1,4 +1,5 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
+
 #include "vkms_drv.h"
 #include <linux/crc32.h>
 #include <drm/drm_atomic.h>
diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
index 177bbcb38306..eb56ee893761 100644
--- a/drivers/gpu/drm/vkms/vkms_crtc.c
+++ b/drivers/gpu/drm/vkms/vkms_crtc.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_atomic_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 83087877565c..7dcbecb5fac2 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -1,9 +1,4 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 /**
  * DOC: vkms (Virtual Kernel Modesetting)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
index e4469cd3d254..81f1cfbeb936 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.h
+++ b/drivers/gpu/drm/vkms/vkms_drv.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
 #ifndef _VKMS_DRV_H_
 #define _VKMS_DRV_H_
 
diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
index 80311daed47a..138b0bb325cf 100644
--- a/drivers/gpu/drm/vkms/vkms_gem.c
+++ b/drivers/gpu/drm/vkms/vkms_gem.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include <linux/shmem_fs.h>
 
diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
index 271a0eb9042c..4173e4f48334 100644
--- a/drivers/gpu/drm/vkms/vkms_output.c
+++ b/drivers/gpu/drm/vkms/vkms_output.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_crtc_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
index 418817600ad1..0e67d2d42f0c 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_plane_helper.h>
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 474b00e19697..0a7d4395d427 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
         .cpmem_ofs = 0x1f000000,
         .srm_ofs = 0x1f040000,
         .tpm_ofs = 0x1f060000,
-        .csi0_ofs = 0x1f030000,
-        .csi1_ofs = 0x1f038000,
+        .csi0_ofs = 0x1e030000,
+        .csi1_ofs = 0x1e038000,
         .ic_ofs = 0x1e020000,
         .disp0_ofs = 0x1e040000,
         .disp1_ofs = 0x1e048000,
@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
         .cpmem_ofs = 0x07000000,
         .srm_ofs = 0x07040000,
         .tpm_ofs = 0x07060000,
-        .csi0_ofs = 0x07030000,
-        .csi1_ofs = 0x07038000,
+        .csi0_ofs = 0x06030000,
+        .csi1_ofs = 0x06038000,
         .ic_ofs = 0x06020000,
         .disp0_ofs = 0x06040000,
         .disp1_ofs = 0x06048000,
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index 2f8db9d62551..4a28f3fbb0a2 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -106,6 +106,7 @@ struct ipu_pre {
         void                    *buffer_virt;
         bool                    in_use;
         unsigned int            safe_window_end;
+        unsigned int            last_bufaddr;
 };
 
 static DEFINE_MUTEX(ipu_pre_list_mutex);
@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
 
         writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
               IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
         unsigned short current_yblock;
         u32 val;
 
+        if (bufaddr == pre->last_bufaddr)
+                return;
+
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         do {
                 if (time_after(jiffies, timeout)) {
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 4adec4ab7d06..59ee01f3d022 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -3594,7 +3594,8 @@ nct6775_check_fan_inputs(struct nct6775_data *data)
                         fan5pin |= cr1b & BIT(5);
                         fan5pin |= creb & BIT(5);
 
-                        fan6pin = creb & BIT(3);
+                        fan6pin = !dsw_en && (cr2d & BIT(1));
+                        fan6pin |= creb & BIT(3);
 
                         pwm5pin |= cr2d & BIT(7);
                         pwm5pin |= (creb & BIT(4)) && !(cr2a & BIT(0));
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index b1086bfb0465..cd9c65f3d404 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1500,8 +1500,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int omap_i2c_runtime_suspend(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_suspend(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1527,7 +1526,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)
         return 0;
 }
 
-static int omap_i2c_runtime_resume(struct device *dev)
+static int __maybe_unused omap_i2c_runtime_resume(struct device *dev)
 {
         struct omap_i2c_dev *omap = dev_get_drvdata(dev);
 
@@ -1542,20 +1541,18 @@ static int omap_i2c_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops omap_i2c_pm_ops = {
+        SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                      pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(omap_i2c_runtime_suspend,
                            omap_i2c_runtime_resume, NULL)
 };
-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
-#else
-#define OMAP_I2C_PM_OPS NULL
-#endif /* CONFIG_PM */
 
 static struct platform_driver omap_i2c_driver = {
         .probe          = omap_i2c_probe,
         .remove         = omap_i2c_remove,
         .driver         = {
                 .name   = "omap_i2c",
-                .pm     = OMAP_I2C_PM_OPS,
+                .pm     = &omap_i2c_pm_ops,
                 .of_match_table = of_match_ptr(omap_i2c_of_match),
         },
 };
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 1457f931218e..78188bf7e90d 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -363,7 +363,7 @@ static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
 static int intel_iommu_superpage = 1;
-static int intel_iommu_sm = 1;
+static int intel_iommu_sm;
 static int iommu_identity_mapping;
 
 #define IDENTMAP_ALL            1
@@ -456,9 +456,9 @@ static int __init intel_iommu_setup(char *str)
                 } else if (!strncmp(str, "sp_off", 6)) {
                         pr_info("Disable supported super page\n");
                         intel_iommu_superpage = 0;
-                } else if (!strncmp(str, "sm_off", 6)) {
-                        pr_info("Intel-IOMMU: disable scalable mode support\n");
-                        intel_iommu_sm = 0;
+                } else if (!strncmp(str, "sm_on", 5)) {
+                        pr_info("Intel-IOMMU: scalable mode supported\n");
+                        intel_iommu_sm = 1;
                 } else if (!strncmp(str, "tboot_noforce", 13)) {
                         printk(KERN_INFO
                                 "Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7f2a45445b00..c3aba3fc818d 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -97,9 +97,14 @@ struct its_device;
  * The ITS structure - contains most of the infrastructure, with the
  * top-level MSI domain, the command queue, the collections, and the
  * list of devices writing to it.
+ *
+ * dev_alloc_lock has to be taken for device allocations, while the
+ * spinlock must be taken to parse data structures such as the device
+ * list.
  */
 struct its_node {
         raw_spinlock_t          lock;
+        struct mutex            dev_alloc_lock;
         struct list_head        entry;
         void __iomem            *base;
         phys_addr_t             phys_base;
@@ -156,6 +161,7 @@ struct its_device {
         void                    *itt;
         u32                     nr_ites;
         u32                     device_id;
+        bool                    shared;
 };
 
 static struct {
@@ -1580,6 +1586,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)
                 nr_irqs /= 2;
         } while (nr_irqs > 0);
 
+        if (!nr_irqs)
+                err = -ENOSPC;
+
         if (err)
                 goto out;
 
@@ -2059,6 +2068,29 @@ static int __init allocate_lpi_tables(void)
         return 0;
 }
 
+static u64 its_clear_vpend_valid(void __iomem *vlpi_base)
+{
+        u32 count = 1000000;    /* 1s! */
+        bool clean;
+        u64 val;
+
+        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+        val &= ~GICR_VPENDBASER_Valid;
+        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
+
+        do {
+                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+                clean = !(val & GICR_VPENDBASER_Dirty);
+                if (!clean) {
+                        count--;
+                        cpu_relax();
+                        udelay(1);
+                }
+        } while (!clean && count);
+
+        return val;
+}
+
 static void its_cpu_init_lpis(void)
 {
         void __iomem *rbase = gic_data_rdist_rd_base();
@@ -2144,6 +2176,30 @@ static void its_cpu_init_lpis(void)
         val |= GICR_CTLR_ENABLE_LPIS;
         writel_relaxed(val, rbase + GICR_CTLR);
 
+        if (gic_rdists->has_vlpis) {
+                void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
+
+                /*
+                 * It's possible for CPU to receive VLPIs before it is
+                 * sheduled as a vPE, especially for the first CPU, and the
+                 * VLPI with INTID larger than 2^(IDbits+1) will be considered
+                 * as out of range and dropped by GIC.
+                 * So we initialize IDbits to known value to avoid VLPI drop.
+                 */
+                val = (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK;
+                pr_debug("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n",
+                        smp_processor_id(), val);
+                gits_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER);
+
+                /*
+                 * Also clear Valid bit of GICR_VPENDBASER, in case some
+                 * ancient programming gets left in and has possibility of
+                 * corrupting memory.
+                 */
+                val = its_clear_vpend_valid(vlpi_base);
+                WARN_ON(val & GICR_VPENDBASER_Dirty);
+        }
+
         /* Make sure the GIC has seen the above */
         dsb(sy);
 out:
@@ -2422,6 +2478,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
         struct its_device *its_dev;
         struct msi_domain_info *msi_info;
         u32 dev_id;
+        int err = 0;
 
         /*
          * We ignore "dev" entierely, and rely on the dev_id that has
@@ -2444,6 +2501,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                 return -EINVAL;
         }
 
+        mutex_lock(&its->dev_alloc_lock);
         its_dev = its_find_device(its, dev_id);
         if (its_dev) {
                 /*
@@ -2451,18 +2509,22 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                  * another alias (PCI bridge of some sort). No need to
                  * create the device.
                  */
+                its_dev->shared = true;
                 pr_debug("Reusing ITT for devID %x\n", dev_id);
                 goto out;
         }
 
         its_dev = its_create_device(its, dev_id, nvec, true);
-        if (!its_dev)
-                return -ENOMEM;
+        if (!its_dev) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         pr_debug("ITT %d entries, %d bits\n", nvec, ilog2(nvec));
 out:
+        mutex_unlock(&its->dev_alloc_lock);
         info->scratchpad[0].ptr = its_dev;
-        return 0;
+        return err;
 }
 
 static struct msi_domain_ops its_msi_domain_ops = {
@@ -2566,6 +2628,7 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
 {
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+        struct its_node *its = its_dev->its;
         int i;
 
         for (i = 0; i < nr_irqs; i++) {
@@ -2580,8 +2643,14 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 irq_domain_reset_irq_data(data);
         }
 
-        /* If all interrupts have been freed, start mopping the floor */
-        if (bitmap_empty(its_dev->event_map.lpi_map,
+        mutex_lock(&its->dev_alloc_lock);
+
+        /*
+         * If all interrupts have been freed, start mopping the
+         * floor. This is conditionned on the device not being shared.
+         */
+        if (!its_dev->shared &&
+            bitmap_empty(its_dev->event_map.lpi_map,
                          its_dev->event_map.nr_lpis)) {
                 its_lpi_free(its_dev->event_map.lpi_map,
                              its_dev->event_map.lpi_base,
@@ -2593,6 +2662,8 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 its_free_device(its_dev);
         }
 
+        mutex_unlock(&its->dev_alloc_lock);
+
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
@@ -2755,26 +2826,11 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
         void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
-        u32 count = 1000000;    /* 1s! */
-        bool clean;
         u64 val;
 
-        /* We're being scheduled out */
-        val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-        val &= ~GICR_VPENDBASER_Valid;
-        gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
-
-        do {
-                val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
-                clean = !(val & GICR_VPENDBASER_Dirty);
-                if (!clean) {
-                        count--;
-                        cpu_relax();
-                        udelay(1);
-                }
-        } while (!clean && count);
+        val = its_clear_vpend_valid(vlpi_base);
 
-        if (unlikely(!clean && !count)) {
+        if (unlikely(val & GICR_VPENDBASER_Dirty)) {
                 pr_err_ratelimited("ITS virtual pending table not cleaning\n");
                 vpe->idai = false;
                 vpe->pending_last = true;
@@ -3517,6 +3573,7 @@ static int __init its_probe_one(struct resource *res,
         }
 
         raw_spin_lock_init(&its->lock);
+        mutex_init(&its->dev_alloc_lock);
         INIT_LIST_HEAD(&its->entry);
         INIT_LIST_HEAD(&its->its_device_list);
         typer = gic_read_typer(its_base + GITS_TYPER);
diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
index 25f32e1d7764..3496b61a312a 100644
--- a/drivers/irqchip/irq-mmp.c
+++ b/drivers/irqchip/irq-mmp.c
@@ -34,6 +34,9 @@
 #define SEL_INT_PENDING         (1 << 6)
 #define SEL_INT_NUM_MASK        0x3f
 
+#define MMP2_ICU_INT_ROUTE_PJ4_IRQ      (1 << 5)
+#define MMP2_ICU_INT_ROUTE_PJ4_FIQ      (1 << 6)
+
 struct icu_chip_data {
         int                     nr_irqs;
         unsigned int            virq_base;
@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {
 static const struct mmp_intc_conf mmp2_conf = {
         .conf_enable    = 0x20,
         .conf_disable   = 0x0,
-        .conf_mask      = 0x7f,
+        .conf_mask      = MMP2_ICU_INT_ROUTE_PJ4_IRQ |
+                          MMP2_ICU_INT_ROUTE_PJ4_FIQ,
 };
 
 static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 47d4e0d30bf0..dd538e6b2748 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -932,7 +932,7 @@ static int dm_crypt_integrity_io_alloc(struct dm_crypt_io *io, struct bio *bio)
         if (IS_ERR(bip))
                 return PTR_ERR(bip);
 
-        tag_len = io->cc->on_disk_tag_size * bio_sectors(bio);
+        tag_len = io->cc->on_disk_tag_size * (bio_sectors(bio) >> io->cc->sector_shift);
 
         bip->bip_iter.bi_size = tag_len;
         bip->bip_iter.bi_sector = io->cc->start + io->sector;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ca8af21bf644..e83b63608262 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -257,6 +257,7 @@ struct pool {
 
         spinlock_t lock;
         struct bio_list deferred_flush_bios;
+        struct bio_list deferred_flush_completions;
         struct list_head prepared_mappings;
         struct list_head prepared_discards;
         struct list_head prepared_discards_pt2;
@@ -956,6 +957,39 @@ static void process_prepared_mapping_fail(struct dm_thin_new_mapping *m)
         mempool_free(m, &m->tc->pool->mapping_pool);
 }
 
+static void complete_overwrite_bio(struct thin_c *tc, struct bio *bio)
+{
+        struct pool *pool = tc->pool;
+        unsigned long flags;
+
+        /*
+         * If the bio has the REQ_FUA flag set we must commit the metadata
+         * before signaling its completion.
+         */
+        if (!bio_triggers_commit(tc, bio)) {
+                bio_endio(bio);
+                return;
+        }
+
+        /*
+         * Complete bio with an error if earlier I/O caused changes to the
+         * metadata that can't be committed, e.g, due to I/O errors on the
+         * metadata device.
+         */
+        if (dm_thin_aborted_changes(tc->td)) {
+                bio_io_error(bio);
+                return;
+        }
+
+        /*
+         * Batch together any bios that trigger commits and then issue a
+         * single commit for them in process_deferred_bios().
+         */
+        spin_lock_irqsave(&pool->lock, flags);
+        bio_list_add(&pool->deferred_flush_completions, bio);
+        spin_unlock_irqrestore(&pool->lock, flags);
+}
+
 static void process_prepared_mapping(struct dm_thin_new_mapping *m)
 {
         struct thin_c *tc = m->tc;
@@ -988,7 +1022,7 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
          */
         if (bio) {
                 inc_remap_and_issue_cell(tc, m->cell, m->data_block);
-                bio_endio(bio);
+                complete_overwrite_bio(tc, bio);
         } else {
                 inc_all_io_entry(tc->pool, m->cell->holder);
                 remap_and_issue(tc, m->cell->holder, m->data_block);
@@ -2317,7 +2351,7 @@ static void process_deferred_bios(struct pool *pool)
 {
         unsigned long flags;
         struct bio *bio;
-        struct bio_list bios;
+        struct bio_list bios, bio_completions;
         struct thin_c *tc;
 
         tc = get_first_thin(pool);
@@ -2328,26 +2362,36 @@ static void process_deferred_bios(struct pool *pool)
         }
 
         /*
-         * If there are any deferred flush bios, we must commit
-         * the metadata before issuing them.
+         * If there are any deferred flush bios, we must commit the metadata
+         * before issuing them or signaling their completion.
          */
         bio_list_init(&bios);
+        bio_list_init(&bio_completions);
+
         spin_lock_irqsave(&pool->lock, flags);
         bio_list_merge(&bios, &pool->deferred_flush_bios);
         bio_list_init(&pool->deferred_flush_bios);
+
+        bio_list_merge(&bio_completions, &pool->deferred_flush_completions);
+        bio_list_init(&pool->deferred_flush_completions);
         spin_unlock_irqrestore(&pool->lock, flags);
 
-        if (bio_list_empty(&bios) &&
+        if (bio_list_empty(&bios) && bio_list_empty(&bio_completions) &&
             !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
                 return;
 
         if (commit(pool)) {
+                bio_list_merge(&bios, &bio_completions);
+
                 while ((bio = bio_list_pop(&bios)))
                         bio_io_error(bio);
                 return;
         }
         pool->last_commit_jiffies = jiffies;
 
+        while ((bio = bio_list_pop(&bio_completions)))
+                bio_endio(bio);
+
         while ((bio = bio_list_pop(&bios)))
                 generic_make_request(bio);
 }
@@ -2954,6 +2998,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
         INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
         spin_lock_init(&pool->lock);
         bio_list_init(&pool->deferred_flush_bios);
+        bio_list_init(&pool->deferred_flush_completions);
         INIT_LIST_HEAD(&pool->prepared_mappings);
         INIT_LIST_HEAD(&pool->prepared_discards);
         INIT_LIST_HEAD(&pool->prepared_discards_pt2);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 1d54109071cc..fa47249fa3e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1863,6 +1863,20 @@ static void end_sync_read(struct bio *bio)
                 reschedule_retry(r1_bio);
 }
 
+static void abort_sync_write(struct mddev *mddev, struct r1bio *r1_bio)
+{
+        sector_t sync_blocks = 0;
+        sector_t s = r1_bio->sector;
+        long sectors_to_go = r1_bio->sectors;
+
+        /* make sure these bits don't get cleared. */
+        do {
+                md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
+                s += sync_blocks;
+                sectors_to_go -= sync_blocks;
+        } while (sectors_to_go > 0);
+}
+
 static void end_sync_write(struct bio *bio)
 {
         int uptodate = !bio->bi_status;
@@ -1874,15 +1888,7 @@ static void end_sync_write(struct bio *bio)
         struct md_rdev *rdev = conf->mirrors[find_bio_disk(r1_bio, bio)].rdev;
 
         if (!uptodate) {
-                sector_t sync_blocks = 0;
-                sector_t s = r1_bio->sector;
-                long sectors_to_go = r1_bio->sectors;
-                /* make sure these bits doesn't get cleared. */
-                do {
-                        md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
-                        s += sync_blocks;
-                        sectors_to_go -= sync_blocks;
-                } while (sectors_to_go > 0);
+                abort_sync_write(mddev, r1_bio);
                 set_bit(WriteErrorSeen, &rdev->flags);
                 if (!test_and_set_bit(WantReplacement, &rdev->flags))
                         set_bit(MD_RECOVERY_NEEDED, &
@@ -2172,8 +2178,10 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio)
                      (i == r1_bio->read_disk ||
                       !test_bit(MD_RECOVERY_SYNC, &mddev->recovery))))
                         continue;
-                if (test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+                if (test_bit(Faulty, &conf->mirrors[i].rdev->flags)) {
+                        abort_sync_write(mddev, r1_bio);
                         continue;
+                }
 
                 bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
                 if (test_bit(FailFast, &conf->mirrors[i].rdev->flags))
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index aef1185f383d..14f3fdb8c6bb 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2112,7 +2112,7 @@ static void mmc_blk_mq_req_done(struct mmc_request *mrq)
                 if (waiting)
                         wake_up(&mq->wait);
                 else
-                        kblockd_schedule_work(&mq->complete_work);
+                        queue_work(mq->card->complete_wq, &mq->complete_work);
 
                 return;
         }
@@ -2924,6 +2924,13 @@ static int mmc_blk_probe(struct mmc_card *card)
 
         mmc_fixup_device(card, mmc_blk_fixups);
 
+        card->complete_wq = alloc_workqueue("mmc_complete",
+                                        WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+        if (unlikely(!card->complete_wq)) {
+                pr_err("Failed to create mmc completion workqueue");
+                return -ENOMEM;
+        }
+
         md = mmc_blk_alloc(card);
         if (IS_ERR(md))
                 return PTR_ERR(md);
@@ -2987,6 +2994,7 @@ static void mmc_blk_remove(struct mmc_card *card)
         pm_runtime_put_noidle(&card->dev);
         mmc_blk_remove_req(md);
         dev_set_drvdata(&card->dev, NULL);
+        destroy_workqueue(card->complete_wq);
 }
 
 static int _mmc_blk_suspend(struct mmc_card *card)
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index f19ec60bcbdc..2eba507790e4 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -1338,7 +1338,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                host->regs + SD_EMMC_IRQ_EN);
 
         ret = request_threaded_irq(host->irq, meson_mmc_irq,
-                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
+                                   meson_mmc_irq_thread, IRQF_SHARED,
+                                   dev_name(&pdev->dev), host);
         if (ret)
                 goto err_init_clk;
 
diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index 279e326e397e..70fadc976795 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -1399,13 +1399,37 @@ static int sunxi_mmc_probe(struct platform_device *pdev)
         mmc->caps              |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                                   MMC_CAP_ERASE | MMC_CAP_SDIO_IRQ;
 
-        if (host->cfg->clk_delays || host->use_new_timings)
+        /*
+         * Some H5 devices do not have signal traces precise enough to
+         * use HS DDR mode for their eMMC chips.
+         *
+         * We still enable HS DDR modes for all the other controller
+         * variants that support them.
+         */
+        if ((host->cfg->clk_delays || host->use_new_timings) &&
+            !of_device_is_compatible(pdev->dev.of_node,
+                                     "allwinner,sun50i-h5-emmc"))
                 mmc->caps      |= MMC_CAP_1_8V_DDR | MMC_CAP_3_3V_DDR;
 
         ret = mmc_of_parse(mmc);
         if (ret)
                 goto error_free_dma;
 
+        /*
+         * If we don't support delay chains in the SoC, we can't use any
+         * of the higher speed modes. Mask them out in case the device
+         * tree specifies the properties for them, which gets added to
+         * the caps by mmc_of_parse() above.
+         */
+        if (!(host->cfg->clk_delays || host->use_new_timings)) {
+                mmc->caps &= ~(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR |
+                               MMC_CAP_1_2V_DDR | MMC_CAP_UHS);
+                mmc->caps2 &= ~MMC_CAP2_HS200;
+        }
+
+        /* TODO: This driver doesn't support HS400 mode yet */
+        mmc->caps2 &= ~MMC_CAP2_HS400;
+
         ret = sunxi_mmc_init_host(host);
         if (ret)
                 goto error_free_dma;
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 60104e1079c5..37f174ccbcec 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -480,6 +480,10 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 /* let's register it anyway to preserve ordering */
                 slave->offset = 0;
                 slave->mtd.size = 0;
+
+                /* Initialize ->erasesize to make add_mtd_device() happy. */
+                slave->mtd.erasesize = parent->erasesize;
+
                 printk(KERN_ERR"mtd: partition \"%s\" is out of reach -- disabled\n",
                         part->name);
                 goto out_register;
@@ -632,7 +636,6 @@ err_remove_part:
         mutex_unlock(&mtd_partitions_mutex);
 
         free_partition(new);
-        pr_info("%s:%i\n", __func__, __LINE__);
 
         return ret;
 }
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
index bd4cfac6b5aa..a4768df5083f 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
@@ -155,9 +155,10 @@ int gpmi_init(struct gpmi_nand_data *this)
 
         /*
          * Reset BCH here, too. We got failures otherwise :(
-         * See later BCH reset for explanation of MX23 handling
+         * See later BCH reset for explanation of MX23 and MX28 handling
          */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
@@ -263,12 +264,10 @@ int bch_set_geometry(struct gpmi_nand_data *this)
         /*
         * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
         * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
-        * On the other hand, the MX28 needs the reset, because one case has been
-        * seen where the BCH produced ECC errors constantly after 10000
-        * consecutive reboots. The latter case has not been seen on the MX23
-        * yet, still we don't know if it could happen there as well.
+        * and MX28.
         */
-        ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+        ret = gpmi_reset_block(r->bch_regs,
+                               GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
         if (ret)
                 goto err_out;
 
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index cca4b24d2ffa..839494ac457c 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -410,6 +410,7 @@ static int nand_check_wp(struct nand_chip *chip)
 
 /**
  * nand_fill_oob - [INTERN] Transfer client buffer to oob
+ * @chip: NAND chip object
  * @oob: oob data buffer
  * @len: oob data write length
  * @ops: oob ops structure
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index 1b722fe9213c..19a2b563acdf 100644
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -158,7 +158,7 @@ static u32 add_marker_len(struct nand_bbt_descr *td)
 
 /**
  * read_bbt - [GENERIC] Read the bad block table starting from page
- * @chip: NAND chip object
+ * @this: NAND chip object
  * @buf: temporary buffer
  * @page: the starting page
  * @num: the number of bbt descriptors to read
diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 479c2f2cf17f..fa87ae28cdfe 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -304,24 +304,30 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
         struct nand_device *nand = spinand_to_nand(spinand);
         struct mtd_info *mtd = nanddev_to_mtd(nand);
         struct nand_page_io_req adjreq = *req;
-        unsigned int nbytes = 0;
-        void *buf = NULL;
+        void *buf = spinand->databuf;
+        unsigned int nbytes;
         u16 column = 0;
         int ret;
 
-        memset(spinand->databuf, 0xff,
-               nanddev_page_size(nand) +
-               nanddev_per_page_oobsize(nand));
+        /*
+         * Looks like PROGRAM LOAD (AKA write cache) does not necessarily reset
+         * the cache content to 0xFF (depends on vendor implementation), so we
+         * must fill the page cache entirely even if we only want to program
+         * the data portion of the page, otherwise we might corrupt the BBM or
+         * user data previously programmed in OOB area.
+         */
+        nbytes = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
+        memset(spinand->databuf, 0xff, nbytes);
+        adjreq.dataoffs = 0;
+        adjreq.datalen = nanddev_page_size(nand);
+        adjreq.databuf.out = spinand->databuf;
+        adjreq.ooblen = nanddev_per_page_oobsize(nand);
+        adjreq.ooboffs = 0;
+        adjreq.oobbuf.out = spinand->oobbuf;
 
-        if (req->datalen) {
+        if (req->datalen)
                 memcpy(spinand->databuf + req->dataoffs, req->databuf.out,
                        req->datalen);
-                adjreq.dataoffs = 0;
-                adjreq.datalen = nanddev_page_size(nand);
-                adjreq.databuf.out = spinand->databuf;
-                nbytes = adjreq.datalen;
-                buf = spinand->databuf;
-        }
 
         if (req->ooblen) {
                 if (req->mode == MTD_OPS_AUTO_OOB)
@@ -332,14 +338,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
                 else
                         memcpy(spinand->oobbuf + req->ooboffs, req->oobbuf.out,
                                req->ooblen);
-
-                adjreq.ooblen = nanddev_per_page_oobsize(nand);
-                adjreq.ooboffs = 0;
-                nbytes += nanddev_per_page_oobsize(nand);
-                if (!buf) {
-                        buf = spinand->oobbuf;
-                        column = nanddev_page_size(nand);
-                }
         }
 
         spinand_cache_op_adjust_colum(spinand, &adjreq, &column);
@@ -370,8 +368,8 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
 
                 /*
                  * We need to use the RANDOM LOAD CACHE operation if there's
-                 * more than one iteration, because the LOAD operation resets
-                 * the cache to 0xff.
+                 * more than one iteration, because the LOAD operation might
+                 * reset the cache to 0xff.
                  */
                 if (nbytes) {
                         column = op.addr.val;
@@ -1018,11 +1016,11 @@ static int spinand_init(struct spinand_device *spinand)
         for (i = 0; i < nand->memorg.ntargets; i++) {
                 ret = spinand_select_target(spinand, i);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
 
                 ret = spinand_lock_block(spinand, BL_ALL_UNLOCKED);
                 if (ret)
-                        goto err_free_bufs;
+                        goto err_manuf_cleanup;
         }
 
         ret = nanddev_init(nand, &spinand_ops, THIS_MODULE);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 6f561767b45e..6210757772ed 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -200,9 +200,9 @@ config VXLAN
 
 config GENEVE
        tristate "Generic Network Virtualization Encapsulation"
-       depends on INET && NET_UDP_TUNNEL
+       depends on INET
        depends on IPV6 || !IPV6
-       select NET_IP_TUNNEL
+       select NET_UDP_TUNNEL
        select GRO_CELLS
        ---help---
           This allows one to create geneve virtual interfaces that provide
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 5193da67dcdc..98696a88fa1c 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -690,7 +690,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
          * port, the other ones have already been disabled during
          * bcm_sf2_sw_setup
          */
-        for (port = 0; port < DSA_MAX_PORTS; port++) {
+        for (port = 0; port < ds->num_ports; port++) {
                 if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port))
                         bcm_sf2_port_disable(ds, port, NULL);
         }
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 39c780363764..32e7af5caa69 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -261,6 +261,7 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         unsigned int sub_irq;
         unsigned int n;
         u16 reg;
+        u16 ctl1;
         int err;
 
         mutex_lock(&chip->reg_lock);
@@ -270,13 +271,28 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         if (err)
                 goto out;
 
-        for (n = 0; n < chip->g1_irq.nirqs; ++n) {
-                if (reg & (1 << n)) {
-                        sub_irq = irq_find_mapping(chip->g1_irq.domain, n);
-                        handle_nested_irq(sub_irq);
-                        ++nhandled;
+        do {
+                for (n = 0; n < chip->g1_irq.nirqs; ++n) {
+                        if (reg & (1 << n)) {
+                                sub_irq = irq_find_mapping(chip->g1_irq.domain,
+                                                           n);
+                                handle_nested_irq(sub_irq);
+                                ++nhandled;
+                        }
                 }
-        }
+
+                mutex_lock(&chip->reg_lock);
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &ctl1);
+                if (err)
+                        goto unlock;
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &reg);
+unlock:
+                mutex_unlock(&chip->reg_lock);
+                if (err)
+                        goto out;
+                ctl1 &= GENMASK(chip->g1_irq.nirqs, 0);
+        } while (reg & ctl1);
+
 out:
         return (nhandled > 0 ? IRQ_HANDLED : IRQ_NONE);
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index a70bb1bb90e7..a6eacf2099c3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2663,11 +2663,6 @@ static int ena_restore_device(struct ena_adapter *adapter)
                 goto err_device_destroy;
         }
 
-        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
-        /* Make sure we don't have a race with AENQ Links state handler */
-        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
-                netif_carrier_on(adapter->netdev);
-
         rc = ena_enable_msix_and_set_admin_interrupts(adapter,
                                                       adapter->num_queues);
         if (rc) {
@@ -2684,6 +2679,11 @@ static int ena_restore_device(struct ena_adapter *adapter)
         }
 
         set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
+
+        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
+                netif_carrier_on(adapter->netdev);
+
         mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
         dev_err(&pdev->dev,
                 "Device reset completed successfully, Driver info: %s\n",
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index dc8b6173d8d8..63870072cbbd 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 3
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 2370dc204202..697c2427f2b7 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2098,6 +2098,7 @@ static int fec_enet_get_regs_len(struct net_device *ndev)
 #if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || \
         defined(CONFIG_M520x) || defined(CONFIG_M532x) || defined(CONFIG_ARM) || \
         defined(CONFIG_ARM64) || defined(CONFIG_COMPILE_TEST)
+static __u32 fec_enet_register_version = 2;
 static u32 fec_enet_register_offset[] = {
         FEC_IEVENT, FEC_IMASK, FEC_R_DES_ACTIVE_0, FEC_X_DES_ACTIVE_0,
         FEC_ECNTRL, FEC_MII_DATA, FEC_MII_SPEED, FEC_MIB_CTRLSTAT, FEC_R_CNTRL,
@@ -2128,6 +2129,7 @@ static u32 fec_enet_register_offset[] = {
         IEEE_R_FDXFC, IEEE_R_OCTETS_OK
 };
 #else
+static __u32 fec_enet_register_version = 1;
 static u32 fec_enet_register_offset[] = {
         FEC_ECNTRL, FEC_IEVENT, FEC_IMASK, FEC_IVEC, FEC_R_DES_ACTIVE_0,
         FEC_R_DES_ACTIVE_1, FEC_R_DES_ACTIVE_2, FEC_X_DES_ACTIVE_0,
@@ -2149,6 +2151,8 @@ static void fec_enet_get_regs(struct net_device *ndev,
         u32 *buf = (u32 *)regbuf;
         u32 i, off;
 
+        regs->version = fec_enet_register_version;
+
         memset(buf, 0, regs->len);
 
         for (i = 0; i < ARRAY_SIZE(fec_enet_register_offset); i++) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 3b9e74be5fbd..b8155f5e71b4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         dsaf_dev = dev_get_drvdata(&pdev->dev);
         if (!dsaf_dev) {
                 dev_err(&pdev->dev, "dsaf_dev is NULL\n");
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         if (AE_IS_VER1(dsaf_dev->dsaf_ver)) {
                 dev_err(dsaf_dev->dev, "%s v1 chip doesn't support RoCE!\n",
                         dsaf_dev->ae_dev.name);
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3e0fa8a8077b..e267ff93e8a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1583,6 +1583,24 @@ no_trig:
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 }
 
+void mlx5_cmd_flush(struct mlx5_core_dev *dev)
+{
+        struct mlx5_cmd *cmd = &dev->cmd;
+        int i;
+
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                while (down_trylock(&cmd->sem))
+                        mlx5_cmd_trigger_completions(dev);
+
+        while (down_trylock(&cmd->pages_sem))
+                mlx5_cmd_trigger_completions(dev);
+
+        /* Unlock cmdif */
+        up(&cmd->pages_sem);
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                up(&cmd->sem);
+}
+
 static int status_to_err(u8 status)
 {
         return status ? -1 : 0; /* TBD more meaningful codes */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 66e510b16243..e9acfa9aa069 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -655,6 +655,7 @@ struct mlx5e_channel_stats {
 enum {
         MLX5E_STATE_OPENED,
         MLX5E_STATE_DESTROYING,
+        MLX5E_STATE_XDP_TX_ENABLED,
 };
 
 struct mlx5e_rqt {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 3740177eed09..03b2a9f9c589 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -365,7 +365,8 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
         int sq_num;
         int i;
 
-        if (unlikely(!test_bit(MLX5E_STATE_OPENED, &priv->state)))
+        /* this flag is sufficient, no need to test internal sq state */
+        if (unlikely(!mlx5e_xdp_tx_is_enabled(priv)))
                 return -ENETDOWN;
 
         if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
@@ -378,9 +379,6 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
 
         sq = &priv->channels.c[sq_num]->xdpsq;
 
-        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
-                return -ENETDOWN;
-
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
                 struct mlx5e_xdp_info xdpi;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
index 3a67cb3cd179..ee27a7c8cd87 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
@@ -50,6 +50,23 @@ void mlx5e_xdp_rx_poll_complete(struct mlx5e_rq *rq);
 int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
                    u32 flags);
 
+static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv)
+{
+        set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
+static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
+{
+        clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+        /* let other device's napi(s) see our new state */
+        synchronize_rcu();
+}
+
+static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
+{
+        return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
 static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq)
 {
         if (sq->doorbell_cseg) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3bbccead2f63..47233b9a4f81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -354,9 +354,6 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
 
         new_channels.params = priv->channels.params;
         new_channels.params.num_channels = count;
-        if (!netif_is_rxfh_configured(priv->netdev))
-                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
-                                              MLX5E_INDIR_RQT_SIZE, count);
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
@@ -372,6 +369,10 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
         if (arfs_enabled)
                 mlx5e_arfs_disable(priv);
 
+        if (!netif_is_rxfh_configured(priv->netdev))
+                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, count);
+
         /* Switch to new channels, set new parameters and close old ones */
         mlx5e_switch_priv_channels(priv, &new_channels, NULL);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index d81ebba7c04e..83510ca0bcd8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2859,6 +2859,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
 
         mlx5e_build_tx2sq_maps(priv);
         mlx5e_activate_channels(&priv->channels);
+        mlx5e_xdp_tx_enable(priv);
         netif_tx_start_all_queues(priv->netdev);
 
         if (mlx5e_is_vport_rep(priv))
@@ -2880,6 +2881,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv)
          */
         netif_tx_stop_all_queues(priv->netdev);
         netif_tx_disable(priv->netdev);
+        mlx5e_xdp_tx_disable(priv);
         mlx5e_deactivate_channels(&priv->channels);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c
index fbc42b7252a9..503035469d2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/events.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c
@@ -211,11 +211,10 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
         enum port_module_event_status_type module_status;
         enum port_module_event_error_type error_type;
         struct mlx5_eqe_port_module *module_event_eqe;
-        const char *status_str, *error_str;
+        const char *status_str;
         u8 module_num;
 
         module_event_eqe = &eqe->data.port_module;
-        module_num = module_event_eqe->module;
         module_status = module_event_eqe->module_status &
                         PORT_MODULE_EVENT_MODULE_STATUS_MASK;
         error_type = module_event_eqe->error_type &
@@ -223,25 +222,27 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
 
         if (module_status < MLX5_MODULE_STATUS_NUM)
                 events->pme_stats.status_counters[module_status]++;
-        status_str = mlx5_pme_status_to_string(module_status);
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+        if (module_status == MLX5_MODULE_STATUS_ERROR)
                 if (error_type < MLX5_MODULE_EVENT_ERROR_NUM)
                         events->pme_stats.error_counters[error_type]++;
-                error_str = mlx5_pme_error_to_string(error_type);
-        }
 
         if (!printk_ratelimit())
                 return NOTIFY_OK;
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR)
+        module_num = module_event_eqe->module;
+        status_str = mlx5_pme_status_to_string(module_status);
+        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+                const char *error_str = mlx5_pme_error_to_string(error_type);
+
                 mlx5_core_err(events->dev,
                               "Port module event[error]: module %u, %s, %s\n",
                               module_num, status_str, error_str);
-        else
+        } else {
                 mlx5_core_info(events->dev,
                                "Port module event: module %u, %s\n",
                                module_num, status_str);
+        }
 
         return NOTIFY_OK;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 196c07383082..cb9fa3430c53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -103,7 +103,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
         mlx5_core_err(dev, "start\n");
         if (pci_channel_offline(dev->pdev) || in_fatal(dev) || force) {
                 dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
-                mlx5_cmd_trigger_completions(dev);
+                mlx5_cmd_flush(dev);
         }
 
         mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 5300b0b6d836..4fdac020b795 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -126,6 +126,7 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev,
                              struct ptp_system_timestamp *sts);
 
 void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev);
+void mlx5_cmd_flush(struct mlx5_core_dev *dev);
 int mlx5_cq_debugfs_init(struct mlx5_core_dev *dev);
 void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev);
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 1dd72137fd53..10bab1f7150a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1288,11 +1288,13 @@ static u8 rtl8168d_efuse_read(struct rtl8169_private *tp, int reg_addr)
 static void rtl_ack_events(struct rtl8169_private *tp, u16 bits)
 {
         RTL_W16(tp, IntrStatus, bits);
+        mmiowb();
 }
 
 static void rtl_irq_disable(struct rtl8169_private *tp)
 {
         RTL_W16(tp, IntrMask, 0);
+        mmiowb();
 }
 
 #define RTL_EVENT_NAPI_RX       (RxOK | RxErr)
@@ -6192,7 +6194,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         struct device *d = tp_to_dev(tp);
         dma_addr_t mapping;
         u32 opts[2], len;
-        bool stop_queue;
         int frags;
 
         if (unlikely(!rtl_tx_slots_avail(tp, skb_shinfo(skb)->nr_frags))) {
@@ -6234,6 +6235,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         txd->opts2 = cpu_to_le32(opts[1]);
 
+        netdev_sent_queue(dev, skb->len);
+
         skb_tx_timestamp(skb);
 
         /* Force memory writes to complete before releasing descriptor */
@@ -6246,14 +6249,16 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         tp->cur_tx += frags + 1;
 
-        stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS);
-        if (unlikely(stop_queue))
-                netif_stop_queue(dev);
+        RTL_W8(tp, TxPoll, NPQ);
 
-        if (__netdev_sent_queue(dev, skb->len, skb->xmit_more))
-                RTL_W8(tp, TxPoll, NPQ);
+        mmiowb();
 
-        if (unlikely(stop_queue)) {
+        if (!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) {
+                /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
+                 * not miss a ring update when it notices a stopped queue.
+                 */
+                smp_wmb();
+                netif_stop_queue(dev);
                 /* Sync with rtl_tx:
                  * - publish queue status and cur_tx ring index (write barrier)
                  * - refresh dirty_tx ring index (read barrier).
@@ -6592,7 +6597,9 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete_done(napi, work_done);
+
                 rtl_irq_enable(tp);
+                mmiowb();
         }
 
         return work_done;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index bc92d73047c6..e888b479c596 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6125,7 +6125,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
-        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
         struct efx_mcdi_mtd_partition *parts;
         size_t outlen, n_parts_total, i, n_parts;
         unsigned int type;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 89ead29cec68..69dc64a4dbf8 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -543,7 +543,7 @@ int phy_start_aneg(struct phy_device *phydev)
         if (err < 0)
                 goto out_unlock;
 
-        if (__phy_is_started(phydev)) {
+        if (phy_is_started(phydev)) {
                 if (phydev->autoneg == AUTONEG_ENABLE) {
                         err = phy_check_link_status(phydev);
                 } else {
@@ -699,7 +699,7 @@ void phy_stop_machine(struct phy_device *phydev)
         cancel_delayed_work_sync(&phydev->state_queue);
 
         mutex_lock(&phydev->lock);
-        if (__phy_is_started(phydev))
+        if (phy_is_started(phydev))
                 phydev->state = PHY_UP;
         mutex_unlock(&phydev->lock);
 }
@@ -752,9 +752,6 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
 {
         struct phy_device *phydev = phy_dat;
 
-        if (!phy_is_started(phydev))
-                return IRQ_NONE;                /* It can't be ours.  */
-
         if (phydev->drv->did_interrupt && !phydev->drv->did_interrupt(phydev))
                 return IRQ_NONE;
 
@@ -813,15 +810,14 @@ EXPORT_SYMBOL(phy_request_interrupt);
  */
 void phy_stop(struct phy_device *phydev)
 {
-        mutex_lock(&phydev->lock);
-
-        if (!__phy_is_started(phydev)) {
+        if (!phy_is_started(phydev)) {
                 WARN(1, "called from state %s\n",
                      phy_state_to_str(phydev->state));
-                mutex_unlock(&phydev->lock);
                 return;
         }
 
+        mutex_lock(&phydev->lock);
+
         if (phy_interrupt_is_valid(phydev))
                 phy_disable_interrupts(phydev);
 
@@ -961,8 +957,10 @@ void phy_state_machine(struct work_struct *work)
          * state machine would be pointless and possibly error prone when
          * called from phy_disconnect() synchronously.
          */
+        mutex_lock(&phydev->lock);
         if (phy_polling_mode(phydev) && phy_is_started(phydev))
                 phy_queue_state_machine(phydev, PHY_STATE_TIME);
+        mutex_unlock(&phydev->lock);
 }
 
 /**
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 33f66dcd369a..59d175a5ba54 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -478,6 +478,17 @@ static void phylink_run_resolve(struct phylink *pl)
                 queue_work(system_power_efficient_wq, &pl->resolve);
 }
 
+static void phylink_run_resolve_and_disable(struct phylink *pl, int bit)
+{
+        unsigned long state = pl->phylink_disable_state;
+
+        set_bit(bit, &pl->phylink_disable_state);
+        if (state == 0) {
+                queue_work(system_power_efficient_wq, &pl->resolve);
+                flush_work(&pl->resolve);
+        }
+}
+
 static void phylink_fixed_poll(struct timer_list *t)
 {
         struct phylink *pl = container_of(t, struct phylink, link_poll);
@@ -927,9 +938,7 @@ void phylink_stop(struct phylink *pl)
         if (pl->link_an_mode == MLO_AN_FIXED && !IS_ERR(pl->link_gpio))
                 del_timer_sync(&pl->link_poll);
 
-        set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED);
 }
 EXPORT_SYMBOL_GPL(phylink_stop);
 
@@ -1653,9 +1662,7 @@ static void phylink_sfp_link_down(void *upstream)
 
         ASSERT_RTNL();
 
-        set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK);
 }
 
 static void phylink_sfp_link_up(void *upstream)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index ad9db652874d..fef701bfad62 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -347,6 +347,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
                                 return ret;
                 }
         }
+        bus->socket_ops->attach(bus->sfp);
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
         bus->netdev->sfp_bus = bus;
@@ -362,6 +363,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
         if (bus->registered) {
                 if (bus->started)
                         bus->socket_ops->stop(bus->sfp);
+                bus->socket_ops->detach(bus->sfp);
                 if (bus->phydev && ops && ops->disconnect_phy)
                         ops->disconnect_phy(bus->upstream);
         }
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 298ab7546929..d4635c2178d1 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -185,6 +185,7 @@ struct sfp {
 
         struct gpio_desc *gpio[GPIO_MAX];
 
+        bool attached;
         unsigned int state;
         struct delayed_work poll;
         struct delayed_work timeout;
@@ -1476,7 +1477,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
          */
         switch (sfp->sm_mod_state) {
         default:
-                if (event == SFP_E_INSERT) {
+                if (event == SFP_E_INSERT && sfp->attached) {
                         sfp_module_tx_disable(sfp);
                         sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT);
                 }
@@ -1608,6 +1609,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
         mutex_unlock(&sfp->sm_mutex);
 }
 
+static void sfp_attach(struct sfp *sfp)
+{
+        sfp->attached = true;
+        if (sfp->state & SFP_F_PRESENT)
+                sfp_sm_event(sfp, SFP_E_INSERT);
+}
+
+static void sfp_detach(struct sfp *sfp)
+{
+        sfp->attached = false;
+        sfp_sm_event(sfp, SFP_E_REMOVE);
+}
+
 static void sfp_start(struct sfp *sfp)
 {
         sfp_sm_event(sfp, SFP_E_DEV_UP);
@@ -1668,6 +1682,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee,
 }
 
 static const struct sfp_socket_ops sfp_module_ops = {
+        .attach = sfp_attach,
+        .detach = sfp_detach,
         .start = sfp_start,
         .stop = sfp_stop,
         .module_info = sfp_module_info,
@@ -1835,10 +1851,6 @@ static int sfp_probe(struct platform_device *pdev)
         dev_info(sfp->dev, "Host maximum power %u.%uW\n",
                  sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10);
 
-        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
-        if (!sfp->sfp_bus)
-                return -ENOMEM;
-
         /* Get the initial state, and always signal TX disable,
          * since the network interface will not be up.
          */
@@ -1849,10 +1861,6 @@ static int sfp_probe(struct platform_device *pdev)
                 sfp->state |= SFP_F_RATE_SELECT;
         sfp_set_state(sfp, sfp->state);
         sfp_module_tx_disable(sfp);
-        rtnl_lock();
-        if (sfp->state & SFP_F_PRESENT)
-                sfp_sm_event(sfp, SFP_E_INSERT);
-        rtnl_unlock();
 
         for (i = 0; i < GPIO_MAX; i++) {
                 if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i])
@@ -1885,6 +1893,10 @@ static int sfp_probe(struct platform_device *pdev)
                 dev_warn(sfp->dev,
                          "No tx_disable pin: SFP modules will always be emitting.\n");
 
+        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
+        if (!sfp->sfp_bus)
+                return -ENOMEM;
+
         return 0;
 }
 
diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
index 31b0acf337e2..64f54b0bbd8c 100644
--- a/drivers/net/phy/sfp.h
+++ b/drivers/net/phy/sfp.h
@@ -7,6 +7,8 @@
 struct sfp;
 
 struct sfp_socket_ops {
+        void (*attach)(struct sfp *sfp);
+        void (*detach)(struct sfp *sfp);
         void (*start)(struct sfp *sfp);
         void (*stop)(struct sfp *sfp);
         int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index afd9d25d1992..958f1cf67282 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
         }
 }
 
-static bool __team_option_inst_tmp_find(const struct list_head *opts,
-                                        const struct team_option_inst *needle)
-{
-        struct team_option_inst *opt_inst;
-
-        list_for_each_entry(opt_inst, opts, tmp_list)
-                if (opt_inst == needle)
-                        return true;
-        return false;
-}
-
 static int __team_options_register(struct team *team,
                                    const struct team_option *option,
                                    size_t option_count)
@@ -2460,7 +2449,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
         int err = 0;
         int i;
         struct nlattr *nl_option;
-        LIST_HEAD(opt_inst_list);
 
         rtnl_lock();
 
@@ -2480,6 +2468,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                 struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
                 struct nlattr *attr;
                 struct nlattr *attr_data;
+                LIST_HEAD(opt_inst_list);
                 enum team_option_type opt_type;
                 int opt_port_ifindex = 0; /* != 0 for per-port options */
                 u32 opt_array_index = 0;
@@ -2584,23 +2573,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                         if (err)
                                 goto team_put;
                         opt_inst->changed = true;
-
-                        /* dumb/evil user-space can send us duplicate opt,
-                         * keep only the last one
-                         */
-                        if (__team_option_inst_tmp_find(&opt_inst_list,
-                                                        opt_inst))
-                                continue;
-
                         list_add(&opt_inst->tmp_list, &opt_inst_list);
                 }
                 if (!opt_found) {
                         err = -ENOENT;
                         goto team_put;
                 }
-        }
 
-        err = team_nl_send_event_options_get(team, &opt_inst_list);
+                err = team_nl_send_event_options_get(team, &opt_inst_list);
+                if (err)
+                        break;
+        }
 
 team_put:
         team_nl_team_put(team);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index c0cd1c022e77..33edc78e818d 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2293,7 +2293,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
         struct pcpu_sw_netstats *tx_stats, *rx_stats;
         union vxlan_addr loopback;
         union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
-        struct net_device *dev = skb->dev;
+        struct net_device *dev;
         int len = skb->len;
 
         tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
@@ -2313,9 +2313,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
 #endif
         }
 
+        rcu_read_lock();
+        dev = skb->dev;
+        if (unlikely(!(dev->flags & IFF_UP))) {
+                kfree_skb(skb);
+                goto drop;
+        }
+
         if (dst_vxlan->cfg.flags & VXLAN_F_LEARN)
-                vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0,
-                            vni);
+                vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
 
         u64_stats_update_begin(&tx_stats->syncp);
         tx_stats->tx_packets++;
@@ -2328,8 +2334,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
                 rx_stats->rx_bytes += len;
                 u64_stats_update_end(&rx_stats->syncp);
         } else {
+drop:
                 dev->stats.rx_dropped++;
         }
+        rcu_read_unlock();
 }
 
 static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 150e49723c15..6a9dd68c0f4f 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1253,6 +1253,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
          * effects say only one namespace is affected.
          */
         if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+                mutex_lock(&ctrl->scan_lock);
                 nvme_start_freeze(ctrl);
                 nvme_wait_freeze(ctrl);
         }
@@ -1281,8 +1282,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
          */
         if (effects & NVME_CMD_EFFECTS_LBCC)
                 nvme_update_formats(ctrl);
-        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK))
+        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                 nvme_unfreeze(ctrl);
+                mutex_unlock(&ctrl->scan_lock);
+        }
         if (effects & NVME_CMD_EFFECTS_CCC)
                 nvme_init_identify(ctrl);
         if (effects & (NVME_CMD_EFFECTS_NIC | NVME_CMD_EFFECTS_NCC))
@@ -3401,6 +3404,7 @@ static void nvme_scan_work(struct work_struct *work)
         if (nvme_identify_ctrl(ctrl, &id))
                 return;
 
+        mutex_lock(&ctrl->scan_lock);
         nn = le32_to_cpu(id->nn);
         if (ctrl->vs >= NVME_VS(1, 1, 0) &&
             !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
@@ -3409,6 +3413,7 @@ static void nvme_scan_work(struct work_struct *work)
         }
         nvme_scan_ns_sequential(ctrl, nn);
 out_free_id:
+        mutex_unlock(&ctrl->scan_lock);
         kfree(id);
         down_write(&ctrl->namespaces_rwsem);
         list_sort(NULL, &ctrl->namespaces, ns_cmp);
@@ -3652,6 +3657,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
 
         ctrl->state = NVME_CTRL_NEW;
         spin_lock_init(&ctrl->lock);
+        mutex_init(&ctrl->scan_lock);
         INIT_LIST_HEAD(&ctrl->namespaces);
         init_rwsem(&ctrl->namespaces_rwsem);
         ctrl->dev = dev;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index ab961bdeea89..c4a1bb41abf0 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -154,6 +154,7 @@ struct nvme_ctrl {
         enum nvme_ctrl_state state;
         bool identified;
         spinlock_t lock;
+        struct mutex scan_lock;
         const struct nvme_ctrl_ops *ops;
         struct request_queue *admin_q;
         struct request_queue *connect_q;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9bc585415d9b..7fee665ec45e 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2557,27 +2557,18 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        /*
-         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
-         * initializing procedure here.
-         */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
-                dev_warn(dev->ctrl.device,
-                        "failed to mark controller CONNECTING\n");
-                goto out;
-        }
-
+        mutex_lock(&dev->shutdown_lock);
         result = nvme_pci_enable(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         result = nvme_pci_configure_admin_queue(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         result = nvme_alloc_admin_tags(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         /*
          * Limit the max command size to prevent iod->sg allocations going
@@ -2585,6 +2576,17 @@ static void nvme_reset_work(struct work_struct *work)
          */
         dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1;
         dev->ctrl.max_segments = NVME_MAX_SEGS;
+        mutex_unlock(&dev->shutdown_lock);
+
+        /*
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
+         * initializing procedure here.
+         */
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
+                dev_warn(dev->ctrl.device,
+                        "failed to mark controller CONNECTING\n");
+                goto out;
+        }
 
         result = nvme_init_identify(&dev->ctrl);
         if (result)
@@ -2649,6 +2651,8 @@ static void nvme_reset_work(struct work_struct *work)
         nvme_start_ctrl(&dev->ctrl);
         return;
 
+ out_unlock:
+        mutex_unlock(&dev->shutdown_lock);
  out:
         nvme_remove_dead_ctrl(dev, result);
 }
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b0a413f3f7ca..e2a879e93d86 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -639,8 +639,9 @@ static void quirk_synopsys_haps(struct pci_dev *pdev)
                 break;
         }
 }
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
-                         quirk_synopsys_haps);
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, PCI_ANY_ID,
+                               PCI_CLASS_SERIAL_USB_XHCI, 0,
+                               quirk_synopsys_haps);
 
 /*
  * Let's make the southbridge information explicit instead of having to
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 4e7b55a14b1a..6e294b4d3635 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
                 usrparm.psf_data &= 0x7fffffffULL;
                 usrparm.rssd_result &= 0x7fffffffULL;
         }
+        /* at least 2 bytes are accessed and should be allocated */
+        if (usrparm.psf_data_len < 2) {
+                DBF_DEV_EVENT(DBF_WARNING, device,
+                              "Symmetrix ioctl invalid data length %d",
+                              usrparm.psf_data_len);
+                rc = -EINVAL;
+                goto out;
+        }
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 48ea0004a56d..5a699746c357 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -248,7 +248,8 @@ static inline int ap_test_config(unsigned int *field, unsigned int nr)
 static inline int ap_test_config_card_id(unsigned int id)
 {
         if (!ap_configuration)  /* QCI not supported */
-                return 1;
+                /* only ids 0...3F may be probed */
+                return id < 0x40 ? 1 : 0;
         return ap_test_config(ap_configuration->apm, id);
 }
 
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index f83f79b07b50..07efcb9b5b94 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -280,7 +280,7 @@ static ssize_t asd_show_dev_rev(struct device *dev,
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         asd_dev_rev[asd_ha->revision_id]);
 }
-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
+static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
 
 static ssize_t asd_show_dev_bios_build(struct device *dev,
                                        struct device_attribute *attr,char *buf)
@@ -477,7 +477,7 @@ static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
 {
         int err;
 
-        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         if (err)
                 return err;
 
@@ -499,13 +499,13 @@ err_update_bios:
 err_biosb:
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
 err_rev:
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         return err;
 }
 
 static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
 {
-        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
+        device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
         device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);
diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
index bfa13e3b191c..c8bad2c093b8 100644
--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -3687,6 +3687,7 @@ static int cxlflash_probe(struct pci_dev *pdev,
         host->max_cmd_len = CXLFLASH_MAX_CDB_LEN;
 
         cfg = shost_priv(host);
+        cfg->state = STATE_PROBING;
         cfg->host = host;
         rc = alloc_mem(cfg);
         if (rc) {
@@ -3775,6 +3776,7 @@ out:
         return rc;
 
 out_remove:
+        cfg->state = STATE_PROBED;
         cxlflash_remove(pdev);
         goto out;
 }
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 9192a1d9dec6..dfba4921b265 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref)
         struct fc_rport_priv *rdata;
 
         rdata = container_of(kref, struct fc_rport_priv, kref);
-        WARN_ON(!list_empty(&rdata->peers));
         kfree_rcu(rdata, rcu);
 }
 EXPORT_SYMBOL(fc_rport_destroy);
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 83365b29a4d8..fff86940388b 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -462,12 +462,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
         sdkp->device->use_10_for_rw = 0;
 
         /*
-         * If something changed, revalidate the disk zone bitmaps once we have
-         * the capacity, that is on the second revalidate execution during disk
-         * scan and always during normal revalidate.
+         * Revalidate the disk zone bitmaps once the block device capacity is
+         * set on the second revalidate execution during disk scan and if
+         * something changed when executing a normal revalidate.
          */
-        if (sdkp->first_scan)
+        if (sdkp->first_scan) {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->nr_zones = nr_zones;
                 return 0;
+        }
+
         if (sdkp->zone_blocks != zone_blocks ||
             sdkp->nr_zones != nr_zones ||
             disk->queue->nr_zones != nr_zones) {
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index 52c153cd795a..636f83f781f5 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -1143,18 +1143,19 @@ static void qm_mr_process_task(struct work_struct *work);
 static irqreturn_t portal_isr(int irq, void *ptr)
 {
         struct qman_portal *p = ptr;
-
-        u32 clear = QM_DQAVAIL_MASK | p->irq_sources;
         u32 is = qm_in(&p->p, QM_REG_ISR) & p->irq_sources;
+        u32 clear = 0;
 
         if (unlikely(!is))
                 return IRQ_NONE;
 
         /* DQRR-handling if it's interrupt-driven */
-        if (is & QM_PIRQ_DQRI)
+        if (is & QM_PIRQ_DQRI) {
                 __poll_portal_fast(p, QMAN_POLL_LIMIT);
+                clear = QM_DQAVAIL_MASK | QM_PIRQ_DQRI;
+        }
         /* Handling of anything else that's interrupt-driven */
-        clear |= __poll_portal_slow(p, is);
+        clear |= __poll_portal_slow(p, is) & QM_PIRQ_SLOW;
         qm_out(&p->p, QM_REG_ISR, clear);
         return IRQ_HANDLED;
 }
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 72016d0dfca5..8e7fffbb8802 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -852,6 +852,12 @@ static ssize_t pi_prot_type_store(struct config_item *item,
         return count;
 }
 
+/* always zero, but attr needs to remain RW to avoid userspace breakage */
+static ssize_t pi_prot_format_show(struct config_item *item, char *page)
+{
+        return snprintf(page, PAGE_SIZE, "0\n");
+}
+
 static ssize_t pi_prot_format_store(struct config_item *item,
                 const char *page, size_t count)
 {
@@ -1132,7 +1138,7 @@ CONFIGFS_ATTR(, emulate_3pc);
 CONFIGFS_ATTR(, emulate_pr);
 CONFIGFS_ATTR(, pi_prot_type);
 CONFIGFS_ATTR_RO(, hw_pi_prot_type);
-CONFIGFS_ATTR_WO(, pi_prot_format);
+CONFIGFS_ATTR(, pi_prot_format);
 CONFIGFS_ATTR(, pi_prot_verify);
 CONFIGFS_ATTR(, enforce_pr_isids);
 CONFIGFS_ATTR(, is_nonrot);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index dfd23245f778..6fff16113628 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -774,7 +774,7 @@ of_cpufreq_cooling_register(struct cpufreq_policy *policy)
 
                 cdev = __cpufreq_cooling_register(np, policy, capacitance);
                 if (IS_ERR(cdev)) {
-                        pr_err("cpu_cooling: cpu%d is not running as cooling device: %ld\n",
+                        pr_err("cpu_cooling: cpu%d failed to register as cooling device: %ld\n",
                                policy->cpu, PTR_ERR(cdev));
                         cdev = NULL;
                 }
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 4bfdb4a1e47d..2df059cc07e2 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -867,14 +867,14 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
 
         ret = of_property_read_u32(np, "polling-delay-passive", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay-passive property\n");
+                pr_err("%pOFn: missing polling-delay-passive property\n", np);
                 goto free_tz;
         }
         tz->passive_delay = prop;
 
         ret = of_property_read_u32(np, "polling-delay", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay property\n");
+                pr_err("%pOFn: missing polling-delay property\n", np);
                 goto free_tz;
         }
         tz->polling_delay = prop;
diff --git a/fs/aio.c b/fs/aio.c
index b906ff70c90f..aaaaf4d12c73 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1436,6 +1436,7 @@ static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb)
         if (unlikely(!req->ki_filp))
                 return -EBADF;
         req->ki_complete = aio_complete_rw;
+        req->private = NULL;
         req->ki_pos = iocb->aio_offset;
         req->ki_flags = iocb_flags(req->ki_filp);
         if (iocb->aio_flags & IOCB_FLAG_RESFD)
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index d0078cbb718b..7cde3f46ad26 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
         fput(bprm->file);
         bprm->file = NULL;
 
-        for (cp = bprm->buf+2;; cp++) {
-                if (cp >= bprm->buf + BINPRM_BUF_SIZE)
-                        return -ENOEXEC;
-                if (!*cp || (*cp == '\n'))
-                        break;
-        }
+        bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
+        if ((cp = strchr(bprm->buf, '\n')) == NULL)
+                cp = bprm->buf+BINPRM_BUF_SIZE-1;
         *cp = '\0';
-
         while (cp > bprm->buf) {
                 cp--;
                 if ((*cp == ' ') || (*cp == '\t'))
diff --git a/fs/buffer.c b/fs/buffer.c
index 52d024bfdbc1..48318fb74938 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -200,6 +200,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
         struct buffer_head *head;
         struct page *page;
         int all_mapped = 1;
+        static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1);
 
         index = block >> (PAGE_SHIFT - bd_inode->i_blkbits);
         page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED);
@@ -227,15 +228,15 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
          * file io on the block device and getblk.  It gets dealt with
          * elsewhere, don't buffer_error if we had some unmapped buffers
          */
-        if (all_mapped) {
-                printk("__find_get_block_slow() failed. "
-                        "block=%llu, b_blocknr=%llu\n",
-                        (unsigned long long)block,
-                        (unsigned long long)bh->b_blocknr);
-                printk("b_state=0x%08lx, b_size=%zu\n",
-                        bh->b_state, bh->b_size);
-                printk("device %pg blocksize: %d\n", bdev,
-                        1 << bd_inode->i_blkbits);
+        ratelimit_set_flags(&last_warned, RATELIMIT_MSG_ON_RELEASE);
+        if (all_mapped && __ratelimit(&last_warned)) {
+                printk("__find_get_block_slow() failed. block=%llu, "
+                       "b_blocknr=%llu, b_state=0x%08lx, b_size=%zu, "
+                       "device %pg blocksize: %d\n",
+                       (unsigned long long)block,
+                       (unsigned long long)bh->b_blocknr,
+                       bh->b_state, bh->b_size, bdev,
+                       1 << bd_inode->i_blkbits);
         }
 out_unlock:
         spin_unlock(&bd_mapping->private_lock);
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 712f00995390..5508baa11bb6 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -116,16 +116,8 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
-        ret = file_write_and_wait_range(file, start, end);
-        if (ret)
-                return ret;
-
         if (!journal) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL
-                };
-
-                ret = ext4_write_inode(inode, &wbc);
+                ret = __generic_file_fsync(file, start, end, datasync);
                 if (!ret)
                         ret = ext4_sync_parent(inode);
                 if (test_opt(inode->i_sb, BARRIER))
@@ -133,6 +125,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
+        ret = file_write_and_wait_range(file, start, end);
+        if (ret)
+                return ret;
         /*
          * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index f15b4c57c4bd..78510ab91835 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -28,7 +28,6 @@
 #include "util.h"
 #include "trans.h"
 #include "dir.h"
-#include "lops.h"
 
 struct workqueue_struct *gfs2_freeze_wq;
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 5bfaf381921a..b8830fda51e8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -733,7 +733,7 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
         lh->lh_crc = cpu_to_be32(crc);
 
         gfs2_log_write(sdp, page, sb->s_blocksize, 0, addr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE | op_flags);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, op_flags);
         log_flush_wait(sdp);
 }
 
@@ -810,7 +810,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 
         gfs2_ordered_write(sdp);
         lops_before_commit(sdp, tr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, 0);
 
         if (sdp->sd_log_head != sdp->sd_log_flush_head) {
                 log_flush_wait(sdp);
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 94dcab655bc0..2295042bc625 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -17,9 +17,7 @@
 #include <linux/bio.h>
 #include <linux/fs.h>
 #include <linux/list_sort.h>
-#include <linux/blkdev.h>
 
-#include "bmap.h"
 #include "dir.h"
 #include "gfs2.h"
 #include "incore.h"
@@ -195,6 +193,7 @@ static void gfs2_end_log_write_bh(struct gfs2_sbd *sdp, struct bio_vec *bvec,
 /**
  * gfs2_end_log_write - end of i/o to the log
  * @bio: The bio
+ * @error: Status of i/o request
  *
  * Each bio_vec contains either data from the pagecache or data
  * relating to the log itself. Here we iterate over the bio_vec
@@ -231,19 +230,20 @@ static void gfs2_end_log_write(struct bio *bio)
 /**
  * gfs2_log_submit_bio - Submit any pending log bio
  * @biop: Address of the bio pointer
- * @opf: REQ_OP | op_flags
+ * @op: REQ_OP
+ * @op_flags: req_flag_bits
  *
  * Submit any pending part-built or full bio to the block device. If
  * there is no pending bio, then this is a no-op.
  */
 
-void gfs2_log_submit_bio(struct bio **biop, int opf)
+void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags)
 {
         struct bio *bio = *biop;
         if (bio) {
                 struct gfs2_sbd *sdp = bio->bi_private;
                 atomic_inc(&sdp->sd_log_in_flight);
-                bio->bi_opf = opf;
+                bio_set_op_attrs(bio, op, op_flags);
                 submit_bio(bio);
                 *biop = NULL;
         }
@@ -304,7 +304,7 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
                 nblk >>= sdp->sd_fsb2bb_shift;
                 if (blkno == nblk && !flush)
                         return bio;
-                gfs2_log_submit_bio(biop, op);
+                gfs2_log_submit_bio(biop, op, 0);
         }
 
         *biop = gfs2_log_alloc_bio(sdp, blkno, end_io);
@@ -375,184 +375,6 @@ void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page)
                        gfs2_log_bmap(sdp));
 }
 
-/**
- * gfs2_end_log_read - end I/O callback for reads from the log
- * @bio: The bio
- *
- * Simply unlock the pages in the bio. The main thread will wait on them and
- * process them in order as necessary.
- */
-
-static void gfs2_end_log_read(struct bio *bio)
-{
-        struct page *page;
-        struct bio_vec *bvec;
-        int i;
-
-        bio_for_each_segment_all(bvec, bio, i) {
-                page = bvec->bv_page;
-                if (bio->bi_status) {
-                        int err = blk_status_to_errno(bio->bi_status);
-
-                        SetPageError(page);
-                        mapping_set_error(page->mapping, err);
-                }
-                unlock_page(page);
-        }
-
-        bio_put(bio);
-}
-
-/**
- * gfs2_jhead_pg_srch - Look for the journal head in a given page.
- * @jd: The journal descriptor
- * @page: The page to look in
- *
- * Returns: 1 if found, 0 otherwise.
- */
-
-static bool gfs2_jhead_pg_srch(struct gfs2_jdesc *jd,
-                              struct gfs2_log_header_host *head,
-                              struct page *page)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct gfs2_log_header_host uninitialized_var(lh);
-        void *kaddr = kmap_atomic(page);
-        unsigned int offset;
-        bool ret = false;
-
-        for (offset = 0; offset < PAGE_SIZE; offset += sdp->sd_sb.sb_bsize) {
-                if (!__get_log_header(sdp, kaddr + offset, 0, &lh)) {
-                        if (lh.lh_sequence > head->lh_sequence)
-                                *head = lh;
-                        else {
-                                ret = true;
-                                break;
-                        }
-                }
-        }
-        kunmap_atomic(kaddr);
-        return ret;
-}
-
-/**
- * gfs2_jhead_process_page - Search/cleanup a page
- * @jd: The journal descriptor
- * @index: Index of the page to look into
- * @done: If set, perform only cleanup, else search and set if found.
- *
- * Find the page with 'index' in the journal's mapping. Search the page for
- * the journal head if requested (cleanup == false). Release refs on the
- * page so the page cache can reclaim it (put_page() twice). We grabbed a
- * reference on this page two times, first when we did a find_or_create_page()
- * to obtain the page to add it to the bio and second when we do a
- * find_get_page() here to get the page to wait on while I/O on it is being
- * completed.
- * This function is also used to free up a page we might've grabbed but not
- * used. Maybe we added it to a bio, but not submitted it for I/O. Or we
- * submitted the I/O, but we already found the jhead so we only need to drop
- * our references to the page.
- */
-
-static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
-                                    struct gfs2_log_header_host *head,
-                                    bool *done)
-{
-        struct page *page;
-
-        page = find_get_page(jd->jd_inode->i_mapping, index);
-        wait_on_page_locked(page);
-
-        if (PageError(page))
-                *done = true;
-
-        if (!*done)
-                *done = gfs2_jhead_pg_srch(jd, head, page);
-
-        put_page(page); /* Once for find_get_page */
-        put_page(page); /* Once more for find_or_create_page */
-}
-
-/**
- * gfs2_find_jhead - find the head of a log
- * @jd: The journal descriptor
- * @head: The log descriptor for the head of the log is returned here
- *
- * Do a search of a journal by reading it in large chunks using bios and find
- * the valid log entry with the highest sequence number.  (i.e. the log head)
- *
- * Returns: 0 on success, errno otherwise
- */
-
-int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct address_space *mapping = jd->jd_inode->i_mapping;
-        struct gfs2_journal_extent *je;
-        u32 block, read_idx = 0, submit_idx = 0, index = 0;
-        int shift = PAGE_SHIFT - sdp->sd_sb.sb_bsize_shift;
-        int blocks_per_page = 1 << shift, sz, ret = 0;
-        struct bio *bio = NULL;
-        struct page *page;
-        bool done = false;
-        errseq_t since;
-
-        memset(head, 0, sizeof(*head));
-        if (list_empty(&jd->extent_list))
-                gfs2_map_journal_extents(sdp, jd);
-
-        since = filemap_sample_wb_err(mapping);
-        list_for_each_entry(je, &jd->extent_list, list) {
-                for (block = 0; block < je->blocks; block += blocks_per_page) {
-                        index = (je->lblock + block) >> shift;
-
-                        page = find_or_create_page(mapping, index, GFP_NOFS);
-                        if (!page) {
-                                ret = -ENOMEM;
-                                done = true;
-                                goto out;
-                        }
-
-                        if (bio) {
-                                sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                                if (sz == PAGE_SIZE)
-                                        goto page_added;
-                                submit_idx = index;
-                                submit_bio(bio);
-                                bio = NULL;
-                        }
-
-                        bio = gfs2_log_alloc_bio(sdp,
-                                                 je->dblock + (index << shift),
-                                                 gfs2_end_log_read);
-                        bio->bi_opf = REQ_OP_READ;
-                        sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                        gfs2_assert_warn(sdp, sz == PAGE_SIZE);
-
-page_added:
-                        if (submit_idx <= read_idx + BIO_MAX_PAGES) {
-                                /* Keep at least one bio in flight */
-                                continue;
-                        }
-
-                        gfs2_jhead_process_page(jd, read_idx++, head, &done);
-                        if (done)
-                                goto out;  /* found */
-                }
-        }
-
-out:
-        if (bio)
-                submit_bio(bio);
-        while (read_idx <= index)
-                gfs2_jhead_process_page(jd, read_idx++, head, &done);
-
-        if (!ret)
-                ret = filemap_check_wb_err(mapping, since);
-
-        return ret;
-}
-
 static struct page *gfs2_get_log_desc(struct gfs2_sbd *sdp, u32 ld_type,
                                       u32 ld_length, u32 ld_data1)
 {
diff --git a/fs/gfs2/lops.h b/fs/gfs2/lops.h
index 331160fc568b..711c4d89c063 100644
--- a/fs/gfs2/lops.h
+++ b/fs/gfs2/lops.h
@@ -30,10 +30,8 @@ extern u64 gfs2_log_bmap(struct gfs2_sbd *sdp);
 extern void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
                            unsigned size, unsigned offset, u64 blkno);
 extern void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page);
-extern void gfs2_log_submit_bio(struct bio **biop, int opf);
+extern void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags);
 extern void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
-extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
-                           struct gfs2_log_header_host *head);
 
 static inline unsigned int buf_limit(struct gfs2_sbd *sdp)
 {
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 1179763f6370..b041cb8ae383 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -41,7 +41,6 @@
 #include "dir.h"
 #include "meta_io.h"
 #include "trace_gfs2.h"
-#include "lops.h"
 
 #define DO 0
 #define UNDO 1
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 7389e445a7a7..2dac43065382 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -182,6 +182,129 @@ static int get_log_header(struct gfs2_jdesc *jd, unsigned int blk,
 }
 
 /**
+ * find_good_lh - find a good log header
+ * @jd: the journal
+ * @blk: the segment to start searching from
+ * @lh: the log header to fill in
+ * @forward: if true search forward in the log, else search backward
+ *
+ * Call get_log_header() to get a log header for a segment, but if the
+ * segment is bad, either scan forward or backward until we find a good one.
+ *
+ * Returns: errno
+ */
+
+static int find_good_lh(struct gfs2_jdesc *jd, unsigned int *blk,
+                        struct gfs2_log_header_host *head)
+{
+        unsigned int orig_blk = *blk;
+        int error;
+
+        for (;;) {
+                error = get_log_header(jd, *blk, head);
+                if (error <= 0)
+                        return error;
+
+                if (++*blk == jd->jd_blocks)
+                        *blk = 0;
+
+                if (*blk == orig_blk) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+        }
+}
+
+/**
+ * jhead_scan - make sure we've found the head of the log
+ * @jd: the journal
+ * @head: this is filled in with the log descriptor of the head
+ *
+ * At this point, seg and lh should be either the head of the log or just
+ * before.  Scan forward until we find the head.
+ *
+ * Returns: errno
+ */
+
+static int jhead_scan(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        unsigned int blk = head->lh_blkno;
+        struct gfs2_log_header_host lh;
+        int error;
+
+        for (;;) {
+                if (++blk == jd->jd_blocks)
+                        blk = 0;
+
+                error = get_log_header(jd, blk, &lh);
+                if (error < 0)
+                        return error;
+                if (error == 1)
+                        continue;
+
+                if (lh.lh_sequence == head->lh_sequence) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+                if (lh.lh_sequence < head->lh_sequence)
+                        break;
+
+                *head = lh;
+        }
+
+        return 0;
+}
+
+/**
+ * gfs2_find_jhead - find the head of a log
+ * @jd: the journal
+ * @head: the log descriptor for the head of the log is returned here
+ *
+ * Do a binary search of a journal and find the valid log entry with the
+ * highest sequence number.  (i.e. the log head)
+ *
+ * Returns: errno
+ */
+
+int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        struct gfs2_log_header_host lh_1, lh_m;
+        u32 blk_1, blk_2, blk_m;
+        int error;
+
+        blk_1 = 0;
+        blk_2 = jd->jd_blocks - 1;
+
+        for (;;) {
+                blk_m = (blk_1 + blk_2) / 2;
+
+                error = find_good_lh(jd, &blk_1, &lh_1);
+                if (error)
+                        return error;
+
+                error = find_good_lh(jd, &blk_m, &lh_m);
+                if (error)
+                        return error;
+
+                if (blk_1 == blk_m || blk_m == blk_2)
+                        break;
+
+                if (lh_1.lh_sequence <= lh_m.lh_sequence)
+                        blk_1 = blk_m;
+                else
+                        blk_2 = blk_m;
+        }
+
+        error = jhead_scan(jd, &lh_1);
+        if (error)
+                return error;
+
+        *head = lh_1;
+
+        return error;
+}
+
+/**
  * foreach_descriptor - go through the active part of the log
  * @jd: the journal
  * @start: the first log header in the active region
diff --git a/fs/gfs2/recovery.h b/fs/gfs2/recovery.h
index 99575ab81202..11d81248be85 100644
--- a/fs/gfs2/recovery.h
+++ b/fs/gfs2/recovery.h
@@ -27,6 +27,8 @@ extern int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where)
 extern int gfs2_revoke_check(struct gfs2_jdesc *jd, u64 blkno, unsigned int where);
 extern void gfs2_revoke_clean(struct gfs2_jdesc *jd);
 
+extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
+                    struct gfs2_log_header_host *head);
 extern int gfs2_recover_journal(struct gfs2_jdesc *gfs2_jd, bool wait);
 extern void gfs2_recover_func(struct work_struct *work);
 extern int __get_log_header(struct gfs2_sbd *sdp,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index d4b11c903971..ca71163ff7cf 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -45,7 +45,6 @@
 #include "util.h"
 #include "sys.h"
 #include "xattr.h"
-#include "lops.h"
 
 #define args_neq(a1, a2, x) ((a1)->ar_##x != (a2)->ar_##x)
 
diff --git a/fs/inode.c b/fs/inode.c
index 0cd47fe0dbe5..73432e64f874 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -730,11 +730,8 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
                 return LRU_REMOVED;
         }
 
-        /*
-         * Recently referenced inodes and inodes with many attached pages
-         * get one more pass.
-         */
-        if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
+        /* recently referenced inodes get one more pass */
+        if (inode->i_state & I_REFERENCED) {
                 inode->i_state &= ~I_REFERENCED;
                 spin_unlock(&inode->i_lock);
                 return LRU_ROTATE;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f0ec9edab2f3..85b0ef890b28 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -423,7 +423,7 @@ struct mem_size_stats {
 };
 
 static void smaps_account(struct mem_size_stats *mss, struct page *page,
-                bool compound, bool young, bool dirty)
+                bool compound, bool young, bool dirty, bool locked)
 {
         int i, nr = compound ? 1 << compound_order(page) : 1;
         unsigned long size = nr * PAGE_SIZE;
@@ -450,24 +450,31 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page,
                 else
                         mss->private_clean += size;
                 mss->pss += (u64)size << PSS_SHIFT;
+                if (locked)
+                        mss->pss_locked += (u64)size << PSS_SHIFT;
                 return;
         }
 
         for (i = 0; i < nr; i++, page++) {
                 int mapcount = page_mapcount(page);
+                unsigned long pss = (PAGE_SIZE << PSS_SHIFT);
 
                 if (mapcount >= 2) {
                         if (dirty || PageDirty(page))
                                 mss->shared_dirty += PAGE_SIZE;
                         else
                                 mss->shared_clean += PAGE_SIZE;
-                        mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
+                        mss->pss += pss / mapcount;
+                        if (locked)
+                                mss->pss_locked += pss / mapcount;
                 } else {
                         if (dirty || PageDirty(page))
                                 mss->private_dirty += PAGE_SIZE;
                         else
                                 mss->private_clean += PAGE_SIZE;
-                        mss->pss += PAGE_SIZE << PSS_SHIFT;
+                        mss->pss += pss;
+                        if (locked)
+                                mss->pss_locked += pss;
                 }
         }
 }
@@ -490,6 +497,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page = NULL;
 
         if (pte_present(*pte)) {
@@ -532,7 +540,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
         if (!page)
                 return;
 
-        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte));
+        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -541,6 +549,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page;
 
         /* FOLL_DUMP will return -EFAULT on huge zero page */
@@ -555,7 +564,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
-        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
+        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked);
 }
 #else
 static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
@@ -737,11 +746,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
                 }
         }
 #endif
-
         /* mmap_sem is held in m_start */
         walk_page_vma(vma, &smaps_walk);
-        if (vma->vm_flags & VM_LOCKED)
-                mss->pss_locked += mss->pss;
 }
 
 #define SEQ_PUT_DEC(str, val) \
diff --git a/include/uapi/asm-generic/shmparam.h b/include/asm-generic/shmparam.h
index 8b78c0ba08b1..8b78c0ba08b1 100644
--- a/include/uapi/asm-generic/shmparam.h
+++ b/include/asm-generic/shmparam.h
diff --git a/include/dt-bindings/clock/imx8mq-clock.h b/include/dt-bindings/clock/imx8mq-clock.h
index b53be41929be..04f7ac345984 100644
--- a/include/dt-bindings/clock/imx8mq-clock.h
+++ b/include/dt-bindings/clock/imx8mq-clock.h
@@ -350,7 +350,7 @@
 #define IMX8MQ_CLK_VPU_G2_ROOT                  241
 
 /* SCCG PLL GATE */
-#define IMX8MQ_SYS1_PLL_OUT                     232
+#define IMX8MQ_SYS1_PLL_OUT                     242
 #define IMX8MQ_SYS2_PLL_OUT                     243
 #define IMX8MQ_SYS3_PLL_OUT                     244
 #define IMX8MQ_DRAM_PLL_OUT                     245
@@ -372,24 +372,24 @@
 /* txesc clock */
 #define IMX8MQ_CLK_DSI_IPG_DIV                  256
 
-#define IMX8MQ_CLK_TMU_ROOT                     265
+#define IMX8MQ_CLK_TMU_ROOT                     257
 
 /* Display root clocks */
-#define IMX8MQ_CLK_DISP_AXI_ROOT                266
-#define IMX8MQ_CLK_DISP_APB_ROOT                267
-#define IMX8MQ_CLK_DISP_RTRM_ROOT               268
+#define IMX8MQ_CLK_DISP_AXI_ROOT                258
+#define IMX8MQ_CLK_DISP_APB_ROOT                259
+#define IMX8MQ_CLK_DISP_RTRM_ROOT               260
 
-#define IMX8MQ_CLK_OCOTP_ROOT                   269
+#define IMX8MQ_CLK_OCOTP_ROOT                   261
 
-#define IMX8MQ_CLK_DRAM_ALT_ROOT                270
-#define IMX8MQ_CLK_DRAM_CORE                    271
+#define IMX8MQ_CLK_DRAM_ALT_ROOT                262
+#define IMX8MQ_CLK_DRAM_CORE                    263
 
-#define IMX8MQ_CLK_MU_ROOT                      272
-#define IMX8MQ_VIDEO2_PLL_OUT                   273
+#define IMX8MQ_CLK_MU_ROOT                      264
+#define IMX8MQ_VIDEO2_PLL_OUT                   265
 
-#define IMX8MQ_CLK_CLKO2                        274
+#define IMX8MQ_CLK_CLKO2                        266
 
-#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK   275
+#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK   267
 
-#define IMX8MQ_CLK_END                          276
+#define IMX8MQ_CLK_END                          268
 #endif /* __DT_BINDINGS_CLOCK_IMX8MQ_H */
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 8804753805ac..7bb2d8de9f30 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes);
 
 static inline sector_t blk_rq_trace_sector(struct request *rq)
 {
-        return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq);
+        /*
+         * Tracing should ignore starting sector for passthrough requests and
+         * requests where starting sector didn't get set.
+         */
+        if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1)
+                return 0;
+        return blk_rq_pos(rq);
 }
 
 static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq)
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 071b4cbdf010..c848a7cc502e 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -319,7 +319,7 @@
 #define GITS_TYPER_PLPIS                (1UL << 0)
 #define GITS_TYPER_VLPIS                (1UL << 1)
 #define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4
-#define GITS_TYPER_ITT_ENTRY_SIZE(r)    ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
+#define GITS_TYPER_ITT_ENTRY_SIZE(r)    ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)
 #define GITS_TYPER_IDBITS_SHIFT         8
 #define GITS_TYPER_DEVBITS_SHIFT        13
 #define GITS_TYPER_DEVBITS(r)           ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index de7377815b6b..8ef330027b13 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -308,6 +308,7 @@ struct mmc_card {
         unsigned int    nr_parts;
 
         unsigned int            bouncesz;       /* Bounce buffer size */
+        struct workqueue_struct *complete_wq;   /* Private workqueue */
 };
 
 static inline bool mmc_large_sector(struct mmc_card *card)
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 177a330d84e5..bf1070c2a53b 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -676,26 +676,13 @@ size_t phy_speeds(unsigned int *speeds, size_t size,
 void of_set_phy_supported(struct phy_device *phydev);
 void of_set_phy_eee_broken(struct phy_device *phydev);
 
-static inline bool __phy_is_started(struct phy_device *phydev)
-{
-        WARN_ON(!mutex_is_locked(&phydev->lock));
-
-        return phydev->state >= PHY_UP;
-}
-
 /**
  * phy_is_started - Convenience function to check whether PHY is started
  * @phydev: The phy_device struct
  */
 static inline bool phy_is_started(struct phy_device *phydev)
 {
-        bool started;
-
-        mutex_lock(&phydev->lock);
-        started = __phy_is_started(phydev);
-        mutex_unlock(&phydev->lock);
-
-        return started;
+        return phydev->state >= PHY_UP;
 }
 
 void phy_resolve_aneg_linkmode(struct phy_device *phydev);
diff --git a/include/linux/signal.h b/include/linux/signal.h
index cc7e2c1cd444..9702016734b1 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -392,7 +392,7 @@ extern bool unhandled_signal(struct task_struct *tsk, int sig);
 #endif
 
 #define siginmask(sig, mask) \
-        ((sig) < SIGRTMIN && (rt_sigmask(sig) & (mask)))
+        ((sig) > 0 && (sig) < SIGRTMIN && (rt_sigmask(sig) & (mask)))
 
 #define SIG_KERNEL_ONLY_MASK (\
         rt_sigmask(SIGKILL)   |  rt_sigmask(SIGSTOP))
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 00b5e7825508..74ff688568a0 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -39,6 +39,7 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
+        u32                     n_redirects;
         unsigned long           rate_last;
         /*
          * Once inet_peer is queued for deletion (refcnt == 0), following field
diff --git a/include/net/sock.h b/include/net/sock.h
index 6679f3c120b0..328cb7cb7b0b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1278,7 +1278,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
         percpu_counter_inc(sk->sk_prot->sockets_allocated);
 }
 
-static inline int
+static inline u64
 sk_sockets_allocated_read_positive(struct sock *sk)
 {
         return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 14565d703291..e8baca85bac6 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -137,15 +137,21 @@ enum {
         INET_DIAG_TCLASS,
         INET_DIAG_SKMEMINFO,
         INET_DIAG_SHUTDOWN,
-        INET_DIAG_DCTCPINFO,
-        INET_DIAG_PROTOCOL,  /* response attribute only */
+
+        /*
+         * Next extenstions cannot be requested in struct inet_diag_req_v2:
+         * its field idiag_ext has only 8 bits.
+         */
+
+        INET_DIAG_DCTCPINFO,    /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_PROTOCOL,     /* response attribute only */
         INET_DIAG_SKV6ONLY,
         INET_DIAG_LOCALS,
         INET_DIAG_PEERS,
         INET_DIAG_PAD,
-        INET_DIAG_MARK,
-        INET_DIAG_BBRINFO,
-        INET_DIAG_CLASS_ID,
+        INET_DIAG_MARK,         /* only with CAP_NET_ADMIN */
+        INET_DIAG_BBRINFO,      /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_CLASS_ID,     /* request as INET_DIAG_TCLASS */
         INET_DIAG_MD5SIG,
         __INET_DIAG_MAX,
 };
diff --git a/init/main.c b/init/main.c
index e2e80ca3165a..c86a1c8f19f4 100644
--- a/init/main.c
+++ b/init/main.c
@@ -695,7 +695,6 @@ asmlinkage __visible void __init start_kernel(void)
                 initrd_start = 0;
         }
 #endif
-        page_ext_init();
         kmemleak_init();
         setup_per_cpu_pageset();
         numa_policy_init();
@@ -1131,6 +1130,8 @@ static noinline void __init kernel_init_freeable(void)
         sched_init_smp();
 
         page_alloc_init_late();
+        /* Initialize page ext after all struct pages are initialized. */
+        page_ext_init();
 
         do_basic_setup();
 
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 4a9937076331..309ef5a64af5 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -734,6 +734,9 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
         size = sizeof(struct ring_buffer);
         size += nr_pages * sizeof(void *);
 
+        if (order_base_2(size) >= MAX_ORDER)
+                goto fail;
+
         rb = kzalloc(size, GFP_KERNEL);
         if (!rb)
                 goto fail;
diff --git a/kernel/futex.c b/kernel/futex.c
index fdd312da0992..a0514e01c3eb 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2221,11 +2221,11 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
          * decrement the counter at queue_unlock() when some error has
          * occurred and we don't end up adding the task to the list.
          */
-        hb_waiters_inc(hb);
+        hb_waiters_inc(hb); /* implies smp_mb(); (A) */
 
         q->lock_ptr = &hb->lock;
 
-        spin_lock(&hb->lock); /* implies smp_mb(); (A) */
+        spin_lock(&hb->lock);
         return hb;
 }
 
@@ -2861,35 +2861,39 @@ retry_private:
          * and BUG when futex_unlock_pi() interleaves with this.
          *
          * Therefore acquire wait_lock while holding hb->lock, but drop the
-         * latter before calling rt_mutex_start_proxy_lock(). This still fully
-         * serializes against futex_unlock_pi() as that does the exact same
-         * lock handoff sequence.
+         * latter before calling __rt_mutex_start_proxy_lock(). This
+         * interleaves with futex_unlock_pi() -- which does a similar lock
+         * handoff -- such that the latter can observe the futex_q::pi_state
+         * before __rt_mutex_start_proxy_lock() is done.
          */
         raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
         spin_unlock(q.lock_ptr);
+        /*
+         * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
+         * such that futex_unlock_pi() is guaranteed to observe the waiter when
+         * it sees the futex_q::pi_state.
+         */
         ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
         raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
 
         if (ret) {
                 if (ret == 1)
                         ret = 0;
-
-                spin_lock(q.lock_ptr);
-                goto no_block;
+                goto cleanup;
         }
 
-
         if (unlikely(to))
                 hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
 
         ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
 
+cleanup:
         spin_lock(q.lock_ptr);
         /*
-         * If we failed to acquire the lock (signal/timeout), we must
+         * If we failed to acquire the lock (deadlock/signal/timeout), we must
          * first acquire the hb->lock before removing the lock from the
-         * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
-         * wait lists consistent.
+         * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
+         * lists consistent.
          *
          * In particular; it is important that futex_unlock_pi() can not
          * observe this inconsistency.
@@ -3013,6 +3017,10 @@ retry:
                  * there is no point where we hold neither; and therefore
                  * wake_futex_pi() must observe a state consistent with what we
                  * observed.
+                 *
+                 * In particular; this forces __rt_mutex_start_proxy() to
+                 * complete such that we're guaranteed to observe the
+                 * rt_waiter. Also see the WARN in wake_futex_pi().
                  */
                 raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 581edcc63c26..978d63a8261c 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1726,12 +1726,33 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock,
         rt_mutex_set_owner(lock, NULL);
 }
 
+/**
+ * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task
+ * @lock:               the rt_mutex to take
+ * @waiter:             the pre-initialized rt_mutex_waiter
+ * @task:               the task to prepare
+ *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: does _NOT_ remove the @waiter on failure; must either call
+ * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this.
+ *
+ * Returns:
+ *  0 - task blocked on lock
+ *  1 - acquired the lock for task, caller should wake it up
+ * <0 - error
+ *
+ * Special API call for PI-futex support.
+ */
 int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                               struct rt_mutex_waiter *waiter,
                               struct task_struct *task)
 {
         int ret;
 
+        lockdep_assert_held(&lock->wait_lock);
+
         if (try_to_take_rt_mutex(lock, task, NULL))
                 return 1;
 
@@ -1749,9 +1770,6 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                 ret = 0;
         }
 
-        if (unlikely(ret))
-                remove_waiter(lock, waiter);
-
         debug_rt_mutex_print_deadlock(waiter);
 
         return ret;
@@ -1763,12 +1781,18 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
  * @waiter:             the pre-initialized rt_mutex_waiter
  * @task:               the task to prepare
  *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter
+ * on failure.
+ *
  * Returns:
  *  0 - task blocked on lock
  *  1 - acquired the lock for task, caller should wake it up
  * <0 - error
  *
- * Special API call for FUTEX_REQUEUE_PI support.
+ * Special API call for PI-futex support.
  */
 int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
                               struct rt_mutex_waiter *waiter,
@@ -1778,6 +1802,8 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock_irq(&lock->wait_lock);
         ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+        if (unlikely(ret))
+                remove_waiter(lock, waiter);
         raw_spin_unlock_irq(&lock->wait_lock);
 
         return ret;
@@ -1845,7 +1871,8 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
  * @lock:               the rt_mutex we were woken on
  * @waiter:             the pre-initialized rt_mutex_waiter
  *
- * Attempt to clean up after a failed rt_mutex_wait_proxy_lock().
+ * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or
+ * rt_mutex_wait_proxy_lock().
  *
  * Unless we acquired the lock; we're still enqueued on the wait-list and can
  * in fact still be granted ownership until we're removed. Therefore we can
diff --git a/kernel/signal.c b/kernel/signal.c
index e1d7ad8e6ab1..57b7771e20d7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -688,6 +688,48 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, kernel_siginfo_t *in
 }
 EXPORT_SYMBOL_GPL(dequeue_signal);
 
+static int dequeue_synchronous_signal(kernel_siginfo_t *info)
+{
+        struct task_struct *tsk = current;
+        struct sigpending *pending = &tsk->pending;
+        struct sigqueue *q, *sync = NULL;
+
+        /*
+         * Might a synchronous signal be in the queue?
+         */
+        if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK))
+                return 0;
+
+        /*
+         * Return the first synchronous signal in the queue.
+         */
+        list_for_each_entry(q, &pending->list, list) {
+                /* Synchronous signals have a postive si_code */
+                if ((q->info.si_code > SI_USER) &&
+                    (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
+                        sync = q;
+                        goto next;
+                }
+        }
+        return 0;
+next:
+        /*
+         * Check if there is another siginfo for the same signal.
+         */
+        list_for_each_entry_continue(q, &pending->list, list) {
+                if (q->info.si_signo == sync->info.si_signo)
+                        goto still_pending;
+        }
+
+        sigdelset(&pending->signal, sync->info.si_signo);
+        recalc_sigpending();
+still_pending:
+        list_del_init(&sync->list);
+        copy_siginfo(info, &sync->info);
+        __sigqueue_free(sync);
+        return info->si_signo;
+}
+
 /*
  * Tell a process that it has a new active signal..
  *
@@ -1057,10 +1099,9 @@ static int __send_signal(int sig, struct kernel_siginfo *info, struct task_struc
 
         result = TRACE_SIGNAL_DELIVERED;
         /*
-         * Skip useless siginfo allocation for SIGKILL SIGSTOP,
-         * and kernel threads.
+         * Skip useless siginfo allocation for SIGKILL and kernel threads.
          */
-        if (sig_kernel_only(sig) || (t->flags & PF_KTHREAD))
+        if ((sig == SIGKILL) || (t->flags & PF_KTHREAD))
                 goto out_set;
 
         /*
@@ -2394,6 +2435,14 @@ relock:
                 goto relock;
         }
 
+        /* Has this task already been marked for death? */
+        if (signal_group_exit(signal)) {
+                ksig->info.si_signo = signr = SIGKILL;
+                sigdelset(&current->pending.signal, SIGKILL);
+                recalc_sigpending();
+                goto fatal;
+        }
+
         for (;;) {
                 struct k_sigaction *ka;
 
@@ -2407,7 +2456,15 @@ relock:
                         goto relock;
                 }
 
-                signr = dequeue_signal(current, &current->blocked, &ksig->info);
+                /*
+                 * Signals generated by the execution of an instruction
+                 * need to be delivered before any other pending signals
+                 * so that the instruction pointer in the signal stack
+                 * frame points to the faulting instruction.
+                 */
+                signr = dequeue_synchronous_signal(&ksig->info);
+                if (!signr)
+                        signr = dequeue_signal(current, &current->blocked, &ksig->info);
 
                 if (!signr)
                         break; /* will return 0 */
@@ -2489,6 +2546,7 @@ relock:
                         continue;
                 }
 
+        fatal:
                 spin_unlock_irq(&sighand->siglock);
 
                 /*
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index 5c56afc17cf8..4737bb8c07a3 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -180,10 +180,12 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs,
                 if (unlikely(arg->dynamic))
                         *dl = make_data_loc(maxlen, dyndata - base);
                 ret = process_fetch_insn(arg->code, regs, dl, base);
-                if (unlikely(ret < 0 && arg->dynamic))
+                if (unlikely(ret < 0 && arg->dynamic)) {
                         *dl = make_data_loc(0, dyndata - base);
-                else
+                } else {
                         dyndata += ret;
+                        maxlen -= ret;
+                }
         }
 }
 
diff --git a/mm/gup.c b/mm/gup.c
index 05acd7e2eb22..75029649baca 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1674,7 +1674,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                 if (!pmd_present(pmd))
                         return 0;
 
-                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) {
+                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) ||
+                             pmd_devmap(pmd))) {
                         /*
                          * NUMA hinting faults need to be handled in the GUP
                          * slowpath for accounting purposes and so that they
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 35fdde041f5c..46285d28e43b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4675,11 +4675,11 @@ refill:
                 /* Even if we own the page, we do not use atomic_set().
                  * This would break get_page_unless_zero() users.
                  */
-                page_ref_add(page, size - 1);
+                page_ref_add(page, size);
 
                 /* reset page count bias and offset to start of new frag */
                 nc->pfmemalloc = page_is_pfmemalloc(page);
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = size + 1;
                 nc->offset = size;
         }
 
@@ -4695,10 +4695,10 @@ refill:
                 size = nc->size;
 #endif
                 /* OK, page count is 0, we can safely set it */
-                set_page_count(page, size);
+                set_page_count(page, size + 1);
 
                 /* reset page count bias and offset to start of new frag */
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = size + 1;
                 offset = size - fragsz;
         }
 
diff --git a/mm/page_ext.c b/mm/page_ext.c
index ae44f7adbe07..8c78b8d45117 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -398,10 +398,8 @@ void __init page_ext_init(void)
                          * We know some arch can have a nodes layout such as
                          * -------------pfn-------------->
                          * N0 | N1 | N2 | N0 | N1 | N2|....
-                         *
-                         * Take into account DEFERRED_STRUCT_PAGE_INIT.
                          */
-                        if (early_pfn_to_nid(pfn) != nid)
+                        if (pfn_to_nid(pfn) != nid)
                                 continue;
                         if (init_section_page_ext(pfn, nid))
                                 goto oom;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a714c4f800e9..e979705bbf32 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -491,16 +491,6 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl,
                 delta = freeable / 2;
         }
 
-        /*
-         * Make sure we apply some minimal pressure on default priority
-         * even on small cgroups. Stale objects are not only consuming memory
-         * by themselves, but can also hold a reference to a dying cgroup,
-         * preventing it from being reclaimed. A dying cgroup with all
-         * corresponding structures like per-cpu stats and kmem caches
-         * can be really big, so it may lead to a significant waste of memory.
-         */
-        delta = max_t(unsigned long long, delta, min(freeable, batch_size));
-
         total_scan += delta;
         if (total_scan < 0) {
                 pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 5cb4a2f53a2f..2e367230376b 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -230,6 +230,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 
         switch (ntohs(proto)) {
         case ETH_P_8021Q:
+                if (!pskb_may_pull(skb, sizeof(*vhdr)))
+                        goto dropped;
                 vhdr = vlan_eth_hdr(skb);
                 proto = vhdr->h_vlan_encapsulated_proto;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 71ded4d8025c..d9f0a817dca8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2475,7 +2475,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
         }
 
         if (sk_has_memory_pressure(sk)) {
-                int alloc;
+                u64 alloc;
 
                 if (!sk_under_memory_pressure(sk))
                         return 1;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 1a4e9ff02762..5731670c560b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -108,6 +108,7 @@ static size_t inet_sk_attr_size(struct sock *sk,
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
                 + nla_total_size(sizeof(struct inet_diag_msg))
                 + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
@@ -287,12 +288,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto errout;
         }
 
-        if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) {
+        if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
+            ext & (1 << (INET_DIAG_TCLASS - 1))) {
                 u32 classid = 0;
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
                 classid = sock_cgroup_classid(&sk->sk_cgrp_data);
 #endif
+                /* Fallback to socket priority if class id isn't set.
+                 * Classful qdiscs use it as direct reference to class.
+                 * For cgroup2 classid is always zero.
+                 */
+                if (!classid)
+                        classid = sk->sk_priority;
 
                 if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
                         goto errout;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d757b9642d0d..be778599bfed 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -216,6 +216,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
                         atomic_set(&p->rid, 0);
                         p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
                         p->rate_tokens = 0;
+                        p->n_redirects = 0;
                         /* 60*HZ is arbitrary, but chosen enough high so that the first
                          * calculation of tokens is at its maximum.
                          */
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index e26165af45cb..4b07eb8a9b18 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -215,6 +215,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
 
         /* Change outer to look like the reply to an incoming packet */
         nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMP;
         if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
index a0aa13bcabda..0a8a60c1bf9a 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
@@ -105,6 +105,8 @@ static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
 int snmp_version(void *context, size_t hdrlen, unsigned char tag,
                  const void *data, size_t datalen)
 {
+        if (datalen != 1)
+                return -EINVAL;
         if (*(unsigned char *)data > 1)
                 return -ENOTSUPP;
         return 1;
@@ -114,8 +116,11 @@ int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
                 const void *data, size_t datalen)
 {
         struct snmp_ctx *ctx = (struct snmp_ctx *)context;
-        __be32 *pdata = (__be32 *)data;
+        __be32 *pdata;
 
+        if (datalen != 4)
+                return -EINVAL;
+        pdata = (__be32 *)data;
         if (*pdata == ctx->from) {
                 pr_debug("%s: %pI4 to %pI4\n", __func__,
                          (void *)&ctx->from, (void *)&ctx->to);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 16259ea9df54..ecc12a768191 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -887,13 +887,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
         /* No redirected packets during ip_rt_redirect_silence;
          * reset the algorithm.
          */
-        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
+        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
                 peer->rate_tokens = 0;
+                peer->n_redirects = 0;
+        }
 
         /* Too many ignored redirects; do not send anything
          * set dst.rate_last to the last seen redirected packet.
          */
-        if (peer->rate_tokens >= ip_rt_redirect_number) {
+        if (peer->n_redirects >= ip_rt_redirect_number) {
                 peer->rate_last = jiffies;
                 goto out_put_peer;
         }
@@ -910,6 +912,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
                 peer->rate_last = jiffies;
                 ++peer->rate_tokens;
+                ++peer->n_redirects;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
                 if (log_martians &&
                     peer->rate_tokens == ip_rt_redirect_number)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index dcb1d434f7da..da5a21050ba9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1200,7 +1200,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                 if (ifa == ifp)
                         continue;
-                if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+                if (ifa->prefix_len != ifp->prefix_len ||
+                    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                        ifp->prefix_len))
                         continue;
                 if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 9c914db44bec..f0ec31933c15 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -226,6 +226,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
         }
 
         nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMPV6;
         if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 8d0ba757a46c..9b2f272ca164 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
         rcu_read_unlock();
 
         genlmsg_end(msg, hdr);
-        genlmsg_reply(msg, info);
-
-        return 0;
+        return genlmsg_reply(msg, info);
 
 nla_put_failure:
         rcu_read_unlock();
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index e94b1a0407af..2c4cd4183bf9 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
+        ieee80211_agg_stop_txq(sta, tid);
+
         spin_unlock_bh(&sta->lock);
 
         ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d0eb38b890aa..ba950ae974fc 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright (C) 2015-2017      Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -2146,6 +2146,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
                         break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (sdata->vif.bss_conf.ibss_joined)
+                                WARN_ON(drv_join_ibss(local, sdata));
+                        /* fall through */
                 default:
                         ieee80211_reconfig_stations(sdata);
                         /* fall through */
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index cad48d07c818..8401cefd9f65 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -29,6 +29,7 @@ config	IP_VS_IPV6
         bool "IPv6 support for IPVS"
         depends on IPV6 = y || IP_VS = IPV6
         select IP6_NF_IPTABLES
+        select NF_DEFRAG_IPV6
         ---help---
           Add IPv6 support to IPVS.
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index e969dad66991..43bbaa32b1d6 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1566,14 +1566,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
                 /* sorry, all this trouble for a no-hit :) */
                 IP_VS_DBG_PKT(12, af, pp, skb, iph->off,
                               "ip_vs_in: packet continues traversal as normal");
-                if (iph->fragoffs) {
-                        /* Fragment that couldn't be mapped to a conn entry
-                         * is missing module nf_defrag_ipv6
-                         */
-                        IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n");
+
+                /* Fragment couldn't be mapped to a conn entry */
+                if (iph->fragoffs)
                         IP_VS_DBG_PKT(7, af, pp, skb, iph->off,
                                       "unhandled fragment");
-                }
+
                 *verdict = NF_ACCEPT;
                 return 0;
         }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7d6318664eb2..86afacb07e5f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -43,6 +43,7 @@
 #ifdef CONFIG_IP_VS_IPV6
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #endif
 #include <net/route.h>
 #include <net/sock.h>
@@ -895,6 +896,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 {
         struct ip_vs_dest *dest;
         unsigned int atype, i;
+        int ret = 0;
 
         EnterFunction(2);
 
@@ -905,6 +907,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
                         atype & IPV6_ADDR_LINKLOCAL) &&
                         !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
                         return -EINVAL;
+
+                ret = nf_defrag_ipv6_enable(svc->ipvs->net);
+                if (ret)
+                        return ret;
         } else
 #endif
         {
@@ -1228,6 +1234,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
                         ret = -EINVAL;
                         goto out_err;
                 }
+
+                ret = nf_defrag_ipv6_enable(ipvs->net);
+                if (ret)
+                        goto out_err;
         }
 #endif
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index fe64df848365..0a4bad55a8aa 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -315,6 +315,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
         void *info = nft_expr_priv(expr);
+        struct module *me = target->me;
         struct xt_tgdtor_param par;
 
         par.net = ctx->net;
@@ -325,7 +326,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
                 par.target->destroy(&par);
 
         if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
-                module_put(target->me);
+                module_put(me);
 }
 
 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index aecadd471e1d..13e1ac333fa4 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1899,7 +1899,7 @@ static int __init xt_init(void)
                 seqcount_init(&per_cpu(xt_recseq, i));
         }
 
-        xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
+        xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
         if (!xt)
                 return -ENOMEM;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3b1a78906bc0..1cd1d83a4be0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4292,7 +4292,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                 if (unlikely(rb->frames_per_block == 0))
                         goto out;
-                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
                         goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 14d6b4058045..e1981628047b 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -275,7 +275,7 @@ static void tcindex_free_perfect_hash(struct tcindex_data *cp)
         kfree(cp->perfect);
 }
 
-static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
+static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
 {
         int i, err = 0;
 
@@ -289,6 +289,9 @@ static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
                                     TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
                 if (err < 0)
                         goto errout;
+#ifdef CONFIG_NET_CLS_ACT
+                cp->perfect[i].exts.net = net;
+#endif
         }
 
         return 0;
@@ -305,9 +308,9 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                   struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
 {
         struct tcindex_filter_result new_filter_result, *old_r = r;
-        struct tcindex_filter_result cr;
         struct tcindex_data *cp = NULL, *oldp;
         struct tcindex_filter *f = NULL; /* make gcc behave */
+        struct tcf_result cr = {};
         int err, balloc = 0;
         struct tcf_exts e;
 
@@ -337,7 +340,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         if (p->perfect) {
                 int i;
 
-                if (tcindex_alloc_perfect_hash(cp) < 0)
+                if (tcindex_alloc_perfect_hash(net, cp) < 0)
                         goto errout;
                 for (i = 0; i < cp->hash; i++)
                         cp->perfect[i].res = p->perfect[i].res;
@@ -348,11 +351,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = tcindex_filter_result_init(&new_filter_result);
         if (err < 0)
                 goto errout1;
-        err = tcindex_filter_result_init(&cr);
-        if (err < 0)
-                goto errout1;
         if (old_r)
-                cr.res = r->res;
+                cr = r->res;
 
         if (tb[TCA_TCINDEX_HASH])
                 cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
@@ -406,7 +406,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = -ENOMEM;
         if (!cp->perfect && !cp->h) {
                 if (valid_perfect_hash(cp)) {
-                        if (tcindex_alloc_perfect_hash(cp) < 0)
+                        if (tcindex_alloc_perfect_hash(net, cp) < 0)
                                 goto errout_alloc;
                         balloc = 1;
                 } else {
@@ -443,8 +443,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         if (tb[TCA_TCINDEX_CLASSID]) {
-                cr.res.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
-                tcf_bind_filter(tp, &cr.res, base);
+                cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
+                tcf_bind_filter(tp, &cr, base);
         }
 
         if (old_r && old_r != r) {
@@ -456,7 +456,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         oldp = p;
-        r->res = cr.res;
+        r->res = cr;
         tcf_exts_change(&r->exts, &e);
 
         rcu_assign_pointer(tp->root, cp);
@@ -475,6 +475,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                                 ; /* nothing */
 
                 rcu_assign_pointer(*fp, f);
+        } else {
+                tcf_exts_destroy(&new_filter_result.exts);
         }
 
         if (oldp)
@@ -487,7 +489,6 @@ errout_alloc:
         else if (balloc == 2)
                 kfree(cp->h);
 errout1:
-        tcf_exts_destroy(&cr.exts);
         tcf_exts_destroy(&new_filter_result.exts);
 errout:
         kfree(cp);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index e24568f9246c..38e5add14fab 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -500,7 +500,7 @@ static void dev_watchdog_down(struct net_device *dev)
  *      netif_carrier_on - set carrier
  *      @dev: network device
  *
- * Device has detected that carrier.
+ * Device has detected acquisition of carrier.
  */
 void netif_carrier_on(struct net_device *dev)
 {
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 078f01a8d582..435847d98b51 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -256,6 +256,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(addrlen * asoc->peer.transport_count)
                 + nla_total_size(addrlen * addrcnt)
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 123e9f2dc226..edfcf16e704c 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb)
 {
         skb->ip_summed = CHECKSUM_NONE;
         skb->csum_not_inet = 0;
+        gso_reset_checksum(skb, ~0);
         return sctp_compute_cksum(skb, skb_transport_offset(skb));
 }
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f24633114dfd..2936ed17bf9e 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -144,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                 }
         }
 
-        for (i = outcnt; i < stream->outcnt; i++)
+        for (i = outcnt; i < stream->outcnt; i++) {
                 kfree(SCTP_SO(stream, i)->ext);
+                SCTP_SO(stream, i)->ext = NULL;
+        }
 }
 
 static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 28bbdb04bc35..d0b0f4c865b4 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -101,9 +101,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
 
         conn->tx_cdc_seq++;
         conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
-        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
-                            &conn->local_tx_ctrl, conn);
-        smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
+        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
         rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
         if (!rc) {
                 smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index e3b6b367f3b6..861dc24c588c 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -211,26 +211,27 @@ static inline int smc_curs_diff_large(unsigned int size,
 
 static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
                                           union smc_host_cursor *local,
+                                          union smc_host_cursor *save,
                                           struct smc_connection *conn)
 {
-        union smc_host_cursor temp;
-
-        smc_curs_copy(&temp, local, conn);
-        peer->count = htonl(temp.count);
-        peer->wrap = htons(temp.wrap);
+        smc_curs_copy(save, local, conn);
+        peer->count = htonl(save->count);
+        peer->wrap = htons(save->wrap);
         /* peer->reserved = htons(0); must be ensured by caller */
 }
 
 static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
-                                       struct smc_host_cdc_msg *local,
-                                       struct smc_connection *conn)
+                                       struct smc_connection *conn,
+                                       union smc_host_cursor *save)
 {
+        struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
+
         peer->common.type = local->common.type;
         peer->len = local->len;
         peer->seqno = htons(local->seqno);
         peer->token = htonl(local->token);
-        smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
-        smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
+        smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
+        smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
         peer->prod_flags = local->prod_flags;
         peer->conn_state_flags = local->conn_state_flags;
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ac306d17f8ad..341ecd796aa4 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         default:
                 pr_warn("Dropping received illegal msg type\n");
                 kfree_skb(skb);
-                return false;
+                return true;
         };
 }
 
@@ -1425,6 +1425,10 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 l->rcv_unacked = 0;
         } else {
                 /* RESET_MSG or ACTIVATE_MSG */
+                if (mtyp == ACTIVATE_MSG) {
+                        msg_set_dest_session_valid(hdr, 1);
+                        msg_set_dest_session(hdr, l->peer_session);
+                }
                 msg_set_max_pkt(hdr, l->advertised_mtu);
                 strcpy(data, l->if_name);
                 msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
@@ -1642,6 +1646,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                         break;
                 }
+
+                /* If this endpoint was re-created while peer was ESTABLISHING
+                 * it doesn't know current session number. Force re-synch.
+                 */
+                if (mtyp == ACTIVATE_MSG && msg_dest_session_valid(hdr) &&
+                    l->session != msg_dest_session(hdr)) {
+                        if (less(l->session, msg_dest_session(hdr)))
+                                l->session = msg_dest_session(hdr) + 1;
+                        break;
+                }
+
                 /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
                 if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a0924956bb61..d7e4b8b93f9d 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -360,6 +360,28 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u16 n)
         msg_set_bits(m, 1, 0, 0xffff, n);
 }
 
+/* Note: reusing bits in word 1 for ACTIVATE_MSG only, to re-synch
+ * link peer session number
+ */
+static inline bool msg_dest_session_valid(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 16, 0x1);
+}
+
+static inline void msg_set_dest_session_valid(struct tipc_msg *m, bool valid)
+{
+        msg_set_bits(m, 1, 16, 0x1, valid);
+}
+
+static inline u16 msg_dest_session(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_dest_session(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
 
 /*
  * Word 2
diff --git a/net/tipc/node.c b/net/tipc/node.c
index db2a6c3e0be9..2dc4919ab23c 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -830,15 +830,16 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_node_write_lock(n);
         if (!tipc_link_is_establishing(l)) {
                 __tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
-                if (delete) {
-                        kfree(l);
-                        le->link = NULL;
-                        n->link_cnt--;
-                }
         } else {
                 /* Defuse pending tipc_node_link_up() */
+                tipc_link_reset(l);
                 tipc_link_fsm_evt(l, LINK_RESET_EVT);
         }
+        if (delete) {
+                kfree(l);
+                le->link = NULL;
+                n->link_cnt--;
+        }
         trace_tipc_node_link_down(n, true, "node link down or deleted!");
         tipc_node_write_unlock(n);
         if (delete)
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index c361ce782412..c3d5ab01fba7 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1651,6 +1651,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
 
 static void vmci_transport_destruct(struct vsock_sock *vsk)
 {
+        /* transport can be NULL if we hit a failure at init() time */
+        if (!vmci_trans(vsk))
+                return;
+
         /* Ensure that the detach callback doesn't use the sk/vsk
          * we are about to destruct.
          */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 623dfe5e211c..b36ad8efb5e5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1068,6 +1068,8 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync)
 
         ASSERT_RTNL();
 
+        flush_work(&wdev->pmsr_free_wk);
+
         nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
 
         list_del_rcu(&wdev->list);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a3cc039b9f55..e36437abc45a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -250,7 +250,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
                 NLA_POLICY_MAX(NLA_U8, 15),
         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
-                NLA_POLICY_MAX(NLA_U8, 15),
+                NLA_POLICY_MAX(NLA_U8, 31),
         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index de9286703280..0216ab555249 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -256,8 +256,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         goto out_err;
         } else {
-                memcpy(req->mac_addr, nla_data(info->attrs[NL80211_ATTR_MAC]),
-                       ETH_ALEN);
+                memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
                 memset(req->mac_addr_mask, 0xff, ETH_ALEN);
         }
 
@@ -272,6 +271,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 
         req->n_peers = count;
         req->cookie = cfg80211_assign_cookie(rdev);
+        req->nl_portid = info->snd_portid;
 
         err = rdev_start_pmsr(rdev, wdev, req);
         if (err)
@@ -530,14 +530,14 @@ free:
 }
 EXPORT_SYMBOL_GPL(cfg80211_pmsr_report);
 
-void cfg80211_pmsr_free_wk(struct work_struct *work)
+static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
 {
-        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
-                                                 pmsr_free_wk);
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_pmsr_request *req, *tmp;
         LIST_HEAD(free_list);
 
+        lockdep_assert_held(&wdev->mtx);
+
         spin_lock_bh(&wdev->pmsr_lock);
         list_for_each_entry_safe(req, tmp, &wdev->pmsr_list, list) {
                 if (req->nl_portid)
@@ -547,14 +547,22 @@ void cfg80211_pmsr_free_wk(struct work_struct *work)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         list_for_each_entry_safe(req, tmp, &free_list, list) {
-                wdev_lock(wdev);
                 rdev_abort_pmsr(rdev, wdev, req);
-                wdev_unlock(wdev);
 
                 kfree(req);
         }
 }
 
+void cfg80211_pmsr_free_wk(struct work_struct *work)
+{
+        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
+                                                 pmsr_free_wk);
+
+        wdev_lock(wdev);
+        cfg80211_pmsr_process_abort(wdev);
+        wdev_unlock(wdev);
+}
+
 void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 {
         struct cfg80211_pmsr_request *req;
@@ -568,8 +576,8 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         if (found)
-                schedule_work(&wdev->pmsr_free_wk);
-        flush_work(&wdev->pmsr_free_wk);
+                cfg80211_pmsr_process_abort(wdev);
+
         WARN_ON(!list_empty(&wdev->pmsr_list));
 }
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index cd48cdd582c0..ec30e3732c7b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007-2009  Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright 2017       Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  */
 #include <linux/export.h>
 #include <linux/bitops.h>
@@ -19,6 +19,7 @@
 #include <linux/mpls.h>
 #include <linux/gcd.h>
 #include <linux/bitfield.h>
+#include <linux/nospec.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -715,20 +716,25 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 {
         unsigned int dscp;
         unsigned char vlan_priority;
+        unsigned int ret;
 
         /* skb->priority values from 256->263 are magic values to
          * directly indicate a specific 802.1d priority.  This is used
          * to allow 802.1d priority to be passed directly in from VLAN
          * tags, etc.
          */
-        if (skb->priority >= 256 && skb->priority <= 263)
-                return skb->priority - 256;
+        if (skb->priority >= 256 && skb->priority <= 263) {
+                ret = skb->priority - 256;
+                goto out;
+        }
 
         if (skb_vlan_tag_present(skb)) {
                 vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
                         >> VLAN_PRIO_SHIFT;
-                if (vlan_priority > 0)
-                        return vlan_priority;
+                if (vlan_priority > 0) {
+                        ret = vlan_priority;
+                        goto out;
+                }
         }
 
         switch (skb->protocol) {
@@ -747,8 +753,9 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 if (!mpls)
                         return 0;
 
-                return (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
+                ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
                         >> MPLS_LS_TC_SHIFT;
+                goto out;
         }
         case htons(ETH_P_80221):
                 /* 802.21 is always network control traffic */
@@ -761,18 +768,24 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 unsigned int i, tmp_dscp = dscp >> 2;
 
                 for (i = 0; i < qos_map->num_des; i++) {
-                        if (tmp_dscp == qos_map->dscp_exception[i].dscp)
-                                return qos_map->dscp_exception[i].up;
+                        if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
+                                ret = qos_map->dscp_exception[i].up;
+                                goto out;
+                        }
                 }
 
                 for (i = 0; i < 8; i++) {
                         if (tmp_dscp >= qos_map->up[i].low &&
-                            tmp_dscp <= qos_map->up[i].high)
-                                return i;
+                            tmp_dscp <= qos_map->up[i].high) {
+                                ret = i;
+                                goto out;
+                        }
                 }
         }
 
-        return dscp >> 5;
+        ret = dscp >> 5;
+out:
+        return array_index_nospec(ret, IEEE80211_NUM_TIDS);
 }
 EXPORT_SYMBOL(cfg80211_classify8021d);
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 5121729b8b63..ec3a828672ef 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
         unsigned int lci = 1;
         struct sock *sk;
 
-        read_lock_bh(&x25_list_lock);
-
-        while ((sk = __x25_find_socket(lci, nb)) != NULL) {
+        while ((sk = x25_find_socket(lci, nb)) != NULL) {
                 sock_put(sk);
                 if (++lci == 4096) {
                         lci = 0;
                         break;
                 }
+                cond_resched();
         }
 
-        read_unlock_bh(&x25_list_lock);
         return lci;
 }
 
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 6c99fa8ac5fa..6c0b30391ba9 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2112,13 +2112,6 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
         return 0;
 }
 
-/* allow waiting for a capture stream that hasn't been started */
-#if IS_ENABLED(CONFIG_SND_PCM_OSS)
-#define wait_capture_start(substream)   ((substream)->oss.oss)
-#else
-#define wait_capture_start(substream)   false
-#endif
-
 /* the common loop for read/write data */
 snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                                      void *data, bool interleaved,
@@ -2184,16 +2177,11 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                 snd_pcm_update_hw_ptr(substream);
 
         if (!is_playback &&
-            runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
-                if (size >= runtime->start_threshold) {
-                        err = snd_pcm_start(substream);
-                        if (err < 0)
-                                goto _end_unlock;
-                } else if (!wait_capture_start(substream)) {
-                        /* nothing to do */
-                        err = 0;
+            runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
+            size >= runtime->start_threshold) {
+                err = snd_pcm_start(substream);
+                if (err < 0)
                         goto _end_unlock;
-                }
         }
 
         avail = snd_pcm_avail(substream);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 152f54137082..a4ee7656d9ee 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -924,6 +924,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index d00734d31e04..e5b6769b9797 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -795,6 +795,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         if (hcd->spdif)
                 hcp->daidrv[i] = hdmi_spdif_dai;
 
+        dev_set_drvdata(dev, hcp);
+
         ret = devm_snd_soc_register_component(dev, &hdmi_driver, hcp->daidrv,
                                      dai_count);
         if (ret) {
@@ -802,8 +804,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                         __func__, ret);
                 return ret;
         }
-
-        dev_set_drvdata(dev, hcp);
         return 0;
 }
 
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 89c43b26c379..a9b91bcfcc09 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -1778,7 +1778,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
         {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc},
         {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
         {"ADC STO1 ASRC", NULL, "AD ASRC"},
+        {"ADC STO1 ASRC", NULL, "DA ASRC"},
         {"ADC STO1 ASRC", NULL, "CLKDET"},
+        {"DAC STO1 ASRC", NULL, "AD ASRC"},
         {"DAC STO1 ASRC", NULL, "DA ASRC"},
         {"DAC STO1 ASRC", NULL, "CLKDET"},
 
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index d6c62aa13041..ce00fe2f6aae 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -700,6 +700,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
 {
         struct i2s_dai *i2s = to_info(dai);
         u32 mod, mask = 0, val = 0;
+        struct clk *rclksrc;
         unsigned long flags;
 
         WARN_ON(!pm_runtime_active(dai->dev));
@@ -782,6 +783,10 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
 
         i2s->frmclk = params_rate(params);
 
+        rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
+        if (rclksrc && !IS_ERR(rclksrc))
+                i2s->rclk_srcrate = clk_get_rate(rclksrc);
+
         return 0;
 }
 
@@ -886,11 +891,6 @@ static int config_setup(struct i2s_dai *i2s)
                 return 0;
 
         if (!(i2s->quirks & QUIRK_NO_MUXPSR)) {
-                struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
-
-                if (rclksrc && !IS_ERR(rclksrc))
-                        i2s->rclk_srcrate = clk_get_rate(rclksrc);
-
                 psr = i2s->rclk_srcrate / i2s->frmclk / rfs;
                 writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR);
                 dev_dbg(&i2s->pdev->dev,
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 59e250cc2e9d..e819e965e1db 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1526,14 +1526,14 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
         int ret;
 
         /*
-         * 1) Avoid duplicate register (ex. MIXer case)
-         * 2) re-register if card was rebinded
+         * 1) Avoid duplicate register for DVC with MIX case
+         * 2) Allow duplicate register for MIX
+         * 3) re-register if card was rebinded
          */
         list_for_each_entry(kctrl, &card->controls, list) {
                 struct rsnd_kctrl_cfg *c = kctrl->private_data;
 
-                if (strcmp(kctrl->id.name, name) == 0 &&
-                    c->mod == mod)
+                if (c == cfg)
                         return 0;
         }
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 45ef295743ec..f5afab631abb 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -286,7 +286,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         if (rsnd_ssi_is_multi_slave(mod, io))
                 return 0;
 
-        if (ssi->usrcnt > 1) {
+        if (ssi->usrcnt > 0) {
                 if (ssi->rate != rate) {
                         dev_err(dev, "SSI parent/child should use same rate\n");
                         return -EINVAL;
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index c5934adcfd01..c74991dd18ab 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -79,7 +79,7 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod,
                 break;
         case 9:
                 for (i = 0; i < 4; i++)
-                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << (id * 4));
+                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << 4);
                 break;
         }
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae450ba4f08..50617db05c46 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -735,12 +735,17 @@ static struct snd_soc_component *soc_find_component(
         const struct device_node *of_node, const char *name)
 {
         struct snd_soc_component *component;
+        struct device_node *component_of_node;
 
         lockdep_assert_held(&client_mutex);
 
         for_each_component(component) {
                 if (of_node) {
-                        if (component->dev->of_node == of_node)
+                        component_of_node = component->dev->of_node;
+                        if (!component_of_node && component->dev->parent)
+                                component_of_node = component->dev->parent->of_node;
+
+                        if (component_of_node == of_node)
                                 return component;
                 } else if (name && strcmp(component->name, name) == 0) {
                         return component;
@@ -951,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
 {
         int err;
 
-        if (!dai || !dai->probed ||
+        if (!dai || !dai->probed || !dai->driver ||
             dai->driver->remove_order != order)
                 return;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 2c4c13419539..20bad755888b 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -70,12 +70,16 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_clock_supply] = 1,
         [snd_soc_dapm_supply] = 2,
         [snd_soc_dapm_micbias] = 3,
+        [snd_soc_dapm_vmid] = 3,
         [snd_soc_dapm_dai_link] = 2,
         [snd_soc_dapm_dai_in] = 4,
         [snd_soc_dapm_dai_out] = 4,
         [snd_soc_dapm_aif_in] = 4,
         [snd_soc_dapm_aif_out] = 4,
         [snd_soc_dapm_mic] = 5,
+        [snd_soc_dapm_siggen] = 5,
+        [snd_soc_dapm_input] = 5,
+        [snd_soc_dapm_output] = 5,
         [snd_soc_dapm_mux] = 6,
         [snd_soc_dapm_demux] = 6,
         [snd_soc_dapm_dac] = 7,
@@ -83,11 +87,19 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_mixer] = 8,
         [snd_soc_dapm_mixer_named_ctl] = 8,
         [snd_soc_dapm_pga] = 9,
+        [snd_soc_dapm_buffer] = 9,
+        [snd_soc_dapm_scheduler] = 9,
+        [snd_soc_dapm_effect] = 9,
+        [snd_soc_dapm_src] = 9,
+        [snd_soc_dapm_asrc] = 9,
+        [snd_soc_dapm_encoder] = 9,
+        [snd_soc_dapm_decoder] = 9,
         [snd_soc_dapm_adc] = 10,
         [snd_soc_dapm_out_drv] = 11,
         [snd_soc_dapm_hp] = 11,
         [snd_soc_dapm_spk] = 11,
         [snd_soc_dapm_line] = 11,
+        [snd_soc_dapm_sink] = 11,
         [snd_soc_dapm_kcontrol] = 12,
         [snd_soc_dapm_post] = 13,
 };
@@ -100,13 +112,25 @@ static int dapm_down_seq[] = {
         [snd_soc_dapm_spk] = 3,
         [snd_soc_dapm_line] = 3,
         [snd_soc_dapm_out_drv] = 3,
+        [snd_soc_dapm_sink] = 3,
         [snd_soc_dapm_pga] = 4,
+        [snd_soc_dapm_buffer] = 4,
+        [snd_soc_dapm_scheduler] = 4,
+        [snd_soc_dapm_effect] = 4,
+        [snd_soc_dapm_src] = 4,
+        [snd_soc_dapm_asrc] = 4,
+        [snd_soc_dapm_encoder] = 4,
+        [snd_soc_dapm_decoder] = 4,
         [snd_soc_dapm_switch] = 5,
         [snd_soc_dapm_mixer_named_ctl] = 5,
         [snd_soc_dapm_mixer] = 5,
         [snd_soc_dapm_dac] = 6,
         [snd_soc_dapm_mic] = 7,
+        [snd_soc_dapm_siggen] = 7,
+        [snd_soc_dapm_input] = 7,
+        [snd_soc_dapm_output] = 7,
         [snd_soc_dapm_micbias] = 8,
+        [snd_soc_dapm_vmid] = 8,
         [snd_soc_dapm_mux] = 9,
         [snd_soc_dapm_demux] = 9,
         [snd_soc_dapm_aif_in] = 10,
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 045ef136903d..fc79ec6927e3 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
 {
         struct snd_soc_dai_driver *dai_drv =
                 container_of(dobj, struct snd_soc_dai_driver, dobj);
+        struct snd_soc_dai *dai;
 
         if (pass != SOC_TPLG_PASS_PCM_DAI)
                 return;
@@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
         if (dobj->ops && dobj->ops->dai_unload)
                 dobj->ops->dai_unload(comp, dobj);
 
+        list_for_each_entry(dai, &comp->dai_list, list)
+                if (dai->driver == dai_drv)
+                        dai->driver = NULL;
+
         kfree(dai_drv->name);
         list_del(&dobj->list);
         kfree(dai_drv);
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 382847154227..db114f3977e0 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -314,6 +314,9 @@ static int search_roland_implicit_fb(struct usb_device *dev, int ifnum,
         return 0;
 }
 
+/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
+ * applies. Returns 1 if a quirk was found.
+ */
 static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
                                          struct usb_device *dev,
                                          struct usb_interface_descriptor *altsd,
@@ -384,7 +387,7 @@ add_sync_ep:
 
         subs->data_endpoint->sync_master = subs->sync_endpoint;
 
-        return 0;
+        return 1;
 }
 
 static int set_sync_endpoint(struct snd_usb_substream *subs,
@@ -423,6 +426,10 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
         if (err < 0)
                 return err;
 
+        /* endpoint set by quirk */
+        if (err > 0)
+                return 0;
+
         if (altsd->bNumEndpoints < 2)
                 return 0;
 
diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
index fd92ce8388fc..57aaeaf8e192 100644
--- a/tools/include/uapi/asm/bitsperlong.h
+++ b/tools/include/uapi/asm/bitsperlong.h
@@ -15,6 +15,8 @@
 #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
 #elif defined(__riscv)
 #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
+#elif defined(__alpha__)
+#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
 #else
 #include <asm-generic/bitsperlong.h>
 #endif
diff --git a/tools/include/uapi/linux/in.h b/tools/include/uapi/linux/in.h
index f6052e70bf40..a55cb8b10165 100644
--- a/tools/include/uapi/linux/in.h
+++ b/tools/include/uapi/linux/in.h
@@ -268,7 +268,7 @@ struct sockaddr_in {
 #define IN_MULTICAST(a)         IN_CLASSD(a)
 #define IN_MULTICAST_NET        0xe0000000
 
-#define IN_BADCLASS(a)          ((((long int) (a) ) == 0xffffffff)
+#define IN_BADCLASS(a)          (((long int) (a) ) == (long int)0xffffffff)
 #define IN_EXPERIMENTAL(a)      IN_BADCLASS((a))
 
 #define IN_CLASSE(a)            ((((long int) (a)) & 0xf0000000) == 0xf0000000)
diff --git a/tools/perf/Documentation/perf-c2c.txt b/tools/perf/Documentation/perf-c2c.txt
index 095aebdc5bb7..e6150f21267d 100644
--- a/tools/perf/Documentation/perf-c2c.txt
+++ b/tools/perf/Documentation/perf-c2c.txt
@@ -19,8 +19,11 @@ C2C stands for Cache To Cache.
 The perf c2c tool provides means for Shared Data C2C/HITM analysis. It allows
 you to track down the cacheline contentions.
 
-The tool is based on x86's load latency and precise store facility events
-provided by Intel CPUs. These events provide:
+On x86, the tool is based on load latency and precise store facility events
+provided by Intel CPUs. On PowerPC, the tool uses random instruction sampling
+with thresholding feature.
+
+These events provide:
   - memory address of the access
   - type of the access (load and store details)
   - latency (in cycles) of the load access
@@ -46,7 +49,7 @@ RECORD OPTIONS
 
 -l::
 --ldlat::
-        Configure mem-loads latency.
+        Configure mem-loads latency. (x86 only)
 
 -k::
 --all-kernel::
@@ -119,11 +122,16 @@ Following perf record options are configured by default:
   -W,-d,--phys-data,--sample-cpu
 
 Unless specified otherwise with '-e' option, following events are monitored by
-default:
+default on x86:
 
   cpu/mem-loads,ldlat=30/P
   cpu/mem-stores/P
 
+and following on PowerPC:
+
+  cpu/mem-loads/
+  cpu/mem-stores/
+
 User can pass any 'perf record' option behind '--' mark, like (to enable
 callchains and system wide monitoring):
 
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index f8d2167cf3e7..199ea0f0a6c0 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -82,7 +82,7 @@ RECORD OPTIONS
         Be more verbose (show counter open errors, etc)
 
 --ldlat <n>::
-        Specify desired latency for loads event.
+        Specify desired latency for loads event. (x86 only)
 
 In addition, for report all perf report options are valid, and for record
 all perf record options.
diff --git a/tools/perf/arch/powerpc/util/Build b/tools/perf/arch/powerpc/util/Build
index 2e6595310420..ba98bd006488 100644
--- a/tools/perf/arch/powerpc/util/Build
+++ b/tools/perf/arch/powerpc/util/Build
@@ -2,6 +2,7 @@ libperf-y += header.o
 libperf-y += sym-handling.o
 libperf-y += kvm-stat.o
 libperf-y += perf_regs.o
+libperf-y += mem-events.o
 
 libperf-$(CONFIG_DWARF) += dwarf-regs.o
 libperf-$(CONFIG_DWARF) += skip-callchain-idx.o
diff --git a/tools/perf/arch/powerpc/util/mem-events.c b/tools/perf/arch/powerpc/util/mem-events.c
new file mode 100644
index 000000000000..d08311f04e95
--- /dev/null
+++ b/tools/perf/arch/powerpc/util/mem-events.c
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "mem-events.h"
+
+/* PowerPC does not support 'ldlat' parameter. */
+char *perf_mem_events__name(int i)
+{
+        if (i == PERF_MEM_EVENTS__LOAD)
+                return (char *) "cpu/mem-loads/";
+
+        return (char *) "cpu/mem-stores/";
+}
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index ed4583128b9c..b36061cd1ab8 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2514,19 +2514,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
 
 static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
 {
-        struct perf_evsel *evsel = perf_evsel__newtp("probe", "vfs_getname");
+        bool found = false;
+        struct perf_evsel *evsel, *tmp;
+        struct parse_events_error err = { .idx = 0, };
+        int ret = parse_events(evlist, "probe:vfs_getname*", &err);
 
-        if (IS_ERR(evsel))
+        if (ret)
                 return false;
 
-        if (perf_evsel__field(evsel, "pathname") == NULL) {
+        evlist__for_each_entry_safe(evlist, evsel, tmp) {
+                if (!strstarts(perf_evsel__name(evsel), "probe:vfs_getname"))
+                        continue;
+
+                if (perf_evsel__field(evsel, "pathname")) {
+                        evsel->handler = trace__vfs_getname;
+                        found = true;
+                        continue;
+                }
+
+                list_del_init(&evsel->node);
+                evsel->evlist = NULL;
                 perf_evsel__delete(evsel);
-                return false;
         }
 
-        evsel->handler = trace__vfs_getname;
-        perf_evlist__add(evlist, evsel);
-        return true;
+        return found;
 }
 
 static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
index 44090a9a19f3..e952127e4fb0 100644
--- a/tools/perf/tests/attr.py
+++ b/tools/perf/tests/attr.py
@@ -1,6 +1,8 @@
 #! /usr/bin/python
 # SPDX-License-Identifier: GPL-2.0
 
+from __future__ import print_function
+
 import os
 import sys
 import glob
@@ -8,7 +10,11 @@ import optparse
 import tempfile
 import logging
 import shutil
-import ConfigParser
+
+try:
+    import configparser
+except ImportError:
+    import ConfigParser as configparser
 
 def data_equal(a, b):
     # Allow multiple values in assignment separated by '|'
@@ -100,20 +106,20 @@ class Event(dict):
     def equal(self, other):
         for t in Event.terms:
             log.debug("      [%s] %s %s" % (t, self[t], other[t]));
-            if not self.has_key(t) or not other.has_key(t):
+            if t not in self or t not in other:
                 return False
             if not data_equal(self[t], other[t]):
                 return False
         return True
 
     def optional(self):
-        if self.has_key('optional') and self['optional'] == '1':
+        if 'optional' in self and self['optional'] == '1':
             return True
         return False
 
     def diff(self, other):
         for t in Event.terms:
-            if not self.has_key(t) or not other.has_key(t):
+            if t not in self or t not in other:
                 continue
             if not data_equal(self[t], other[t]):
                 log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
@@ -134,7 +140,7 @@ class Event(dict):
 #   - expected values assignments
 class Test(object):
     def __init__(self, path, options):
-        parser = ConfigParser.SafeConfigParser()
+        parser = configparser.SafeConfigParser()
         parser.read(path)
 
         log.warning("running '%s'" % path)
@@ -193,7 +199,7 @@ class Test(object):
         return True
 
     def load_events(self, path, events):
-        parser_event = ConfigParser.SafeConfigParser()
+        parser_event = configparser.SafeConfigParser()
         parser_event.read(path)
 
         # The event record section header contains 'event' word,
@@ -207,7 +213,7 @@ class Test(object):
             # Read parent event if there's any
             if (':' in section):
                 base = section[section.index(':') + 1:]
-                parser_base = ConfigParser.SafeConfigParser()
+                parser_base = configparser.SafeConfigParser()
                 parser_base.read(self.test_dir + '/' + base)
                 base_items = parser_base.items('event')
 
@@ -322,9 +328,9 @@ def run_tests(options):
     for f in glob.glob(options.test_dir + '/' + options.test):
         try:
             Test(f, options).run()
-        except Unsup, obj:
+        except Unsup as obj:
             log.warning("unsupp  %s" % obj.getMsg())
-        except Notest, obj:
+        except Notest as obj:
             log.warning("skipped %s" % obj.getMsg())
 
 def setup_log(verbose):
@@ -363,7 +369,7 @@ def main():
     parser.add_option("-p", "--perf",
                       action="store", type="string", dest="perf")
     parser.add_option("-v", "--verbose",
-                      action="count", dest="verbose")
+                      default=0, action="count", dest="verbose")
 
     options, args = parser.parse_args()
     if args:
@@ -373,7 +379,7 @@ def main():
     setup_log(options.verbose)
 
     if not options.test_dir:
-        print 'FAILED no -d option specified'
+        print('FAILED no -d option specified')
         sys.exit(-1)
 
     if not options.test:
@@ -382,8 +388,8 @@ def main():
     try:
         run_tests(options)
 
-    except Fail, obj:
-        print "FAILED %s" % obj.getMsg();
+    except Fail as obj:
+        print("FAILED %s" % obj.getMsg())
         sys.exit(-1)
 
     sys.exit(0)
diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
index 5f8501c68da4..5cbba70bcdd0 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -17,7 +17,7 @@ static int perf_evsel__test_field(struct perf_evsel *evsel, const char *name,
                 return -1;
         }
 
-        is_signed = !!(field->flags | TEP_FIELD_IS_SIGNED);
+        is_signed = !!(field->flags & TEP_FIELD_IS_SIGNED);
         if (should_be_signed && !is_signed) {
                 pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n",
                          evsel->name, name, is_signed, should_be_signed);
diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp
index 89512504551b..39c0004f2886 100644
--- a/tools/perf/util/c++/clang.cpp
+++ b/tools/perf/util/c++/clang.cpp
@@ -160,7 +160,7 @@ getBPFObjectFromModule(llvm::Module *Module)
         }
         PM.run(*Module);
 
-        return std::move(Buffer);
+        return Buffer;
 }
 
 }
diff --git a/tools/perf/util/mem-events.c b/tools/perf/util/mem-events.c
index 93f74d8d3cdd..42c3e5a229d2 100644
--- a/tools/perf/util/mem-events.c
+++ b/tools/perf/util/mem-events.c
@@ -28,7 +28,7 @@ struct perf_mem_event perf_mem_events[PERF_MEM_EVENTS__MAX] = {
 static char mem_loads_name[100];
 static bool mem_loads_name__init;
 
-char *perf_mem_events__name(int i)
+char * __weak perf_mem_events__name(int i)
 {
         if (i == PERF_MEM_EVENTS__LOAD) {
                 if (!mem_loads_name__init) {
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 66a84d5846c8..dca7dfae69ad 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -19,6 +19,20 @@
 #define EM_AARCH64      183  /* ARM 64 bit */
 #endif
 
+#ifndef ELF32_ST_VISIBILITY
+#define ELF32_ST_VISIBILITY(o)  ((o) & 0x03)
+#endif
+
+/* For ELF64 the definitions are the same.  */
+#ifndef ELF64_ST_VISIBILITY
+#define ELF64_ST_VISIBILITY(o)  ELF32_ST_VISIBILITY (o)
+#endif
+
+/* How to extract information held in the st_other field.  */
+#ifndef GELF_ST_VISIBILITY
+#define GELF_ST_VISIBILITY(val) ELF64_ST_VISIBILITY (val)
+#endif
+
 typedef Elf64_Nhdr GElf_Nhdr;
 
 #ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
@@ -87,6 +101,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)
         return GELF_ST_TYPE(sym->st_info);
 }
 
+static inline uint8_t elf_sym__visibility(const GElf_Sym *sym)
+{
+        return GELF_ST_VISIBILITY(sym->st_other);
+}
+
 #ifndef STT_GNU_IFUNC
 #define STT_GNU_IFUNC 10
 #endif
@@ -111,7 +130,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)
         return elf_sym__type(sym) == STT_NOTYPE &&
                 sym->st_name != 0 &&
                 sym->st_shndx != SHN_UNDEF &&
-                sym->st_shndx != SHN_ABS;
+                sym->st_shndx != SHN_ABS &&
+                elf_sym__visibility(sym) != STV_HIDDEN &&
+                elf_sym__visibility(sym) != STV_INTERNAL;
 }
 
 static bool elf_sym__filter(GElf_Sym *sym)
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 9050eeea5f5f..1de8bd8ccf5d 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -9,6 +9,3 @@ all: $(TEST_PROGS)
 top_srcdir = ../../../../..
 KSFT_KHDR_INSTALL := 1
 include ../../lib.mk
-
-clean:
-        rm -fr $(TEST_GEN_FILES)