Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Filling in the padding slot in the bpf structure as a bug fix in 'ne' overlapped with actually using that padding area for something in 'net-next'. Signed-off-by: David S. Miller <davem@davemloft.net>
author: David S. Miller <davem@davemloft.net> 2018-06-03 09:31:58 -0400
committer: David S. Miller <davem@davemloft.net> 2018-06-03 09:31:58 -0400
commit: 9c54aeb03a6d65a5834bd92376e921cbac6dfb8f (patch)
tree: 70441095d58678711d68cfef4934765251425d1f
parent: eaf47b17a77fda841a1102d76c15161ee438b347 (diff)
parent: 918fe1b3157978ada4267468008c5f89ef101e7d (diff)
145 files changed, 1054 insertions, 565 deletions
diff --git a/Documentation/devicetree/bindings/net/dsa/b53.txt b/Documentation/devicetree/bindings/net/dsa/b53.txt
index 8acf51a4dfa8..47a6a7fe0b86 100644
--- a/Documentation/devicetree/bindings/net/dsa/b53.txt
+++ b/Documentation/devicetree/bindings/net/dsa/b53.txt
@@ -10,6 +10,7 @@ Required properties:
      "brcm,bcm53128"
      "brcm,bcm5365"
      "brcm,bcm5395"
+      "brcm,bcm5389"
      "brcm,bcm5397"
      "brcm,bcm5398"
diff --git a/Documentation/i2c/busses/i2c-ocores b/Documentation/i2c/busses/i2c-ocores
index c269aaa2f26a..9e1dfe7553ad 100644
--- a/Documentation/i2c/busses/i2c-ocores
+++ b/Documentation/i2c/busses/i2c-ocores
@@ -2,7 +2,7 @@ Kernel driver i2c-ocores
 Supported adapters:
  * OpenCores.org I2C controller by Richard Herveille (see datasheet link)
-    Datasheet: http://www.opencores.org/projects.cgi/web/i2c/overview
+    https://opencores.org/project/i2c/overview
 Author: Peter Korsgaard <jacmet@sunsite.dk>
diff --git a/MAINTAINERS b/MAINTAINERS
index e7396119ce58..0ae0dbf0e15e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -15554,6 +15554,14 @@ L:	linux-kernel@vger.kernel.org
 S:      Supported
 F:      drivers/char/xillybus/
+XLP9XX I2C DRIVER
+M:      George Cherian <george.cherian@cavium.com>
+M:      Jan Glauber <jglauber@cavium.com>
+L:      linux-i2c@vger.kernel.org
+W:      http://www.cavium.com
+S:      Supported
+F:      drivers/i2c/busses/i2c-xlp9xx.c
 XRA1403 GPIO EXPANDER
 M:      Nandor Han <nandor.han@ge.com>
 M:      Semi Malinen <semi.malinen@ge.com>
diff --git a/Makefile b/Makefile
index ec6f45928fd4..56ba070dfa09 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Merciless Moray
 # *DOCUMENTATION*
@@ -500,6 +500,9 @@ RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk
 RETPOLINE_CFLAGS := $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG)))
 export RETPOLINE_CFLAGS
+KBUILD_CFLAGS   += $(call cc-option,-fno-PIE)
+KBUILD_AFLAGS   += $(call cc-option,-fno-PIE)
 # check for 'asm goto'
 ifeq ($(call shell-cached,$(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
  CC_HAVE_ASM_GOTO := 1
@@ -621,9 +624,9 @@ endif # $(dot-config)
 # Defaults to vmlinux, but the arch makefile usually adds further targets
 all: vmlinux
-KBUILD_CFLAGS   += $(call cc-option,-fno-PIE)
+CFLAGS_GCOV     := -fprofile-arcs -ftest-coverage \
-KBUILD_AFLAGS   += $(call cc-option,-fno-PIE)
+        $(call cc-option,-fno-tree-loop-im) \
-CFLAGS_GCOV     := -fprofile-arcs -ftest-coverage -fno-tree-loop-im $(call cc-disable-warning,maybe-uninitialized,)
+        $(call cc-disable-warning,maybe-uninitialized,)
 export CFLAGS_GCOV CFLAGS_KCOV
 # The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 77e8436beed4..3a1c6b45c9a1 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -76,7 +76,7 @@
                        allwinner,pipeline = "de_fe0-de_be0-lcd0-hdmi";
                        clocks = <&ccu CLK_AHB_LCD0>, <&ccu CLK_AHB_HDMI0>,
                                 <&ccu CLK_AHB_DE_BE0>, <&ccu CLK_AHB_DE_FE0>,
-                                 <&ccu CLK_DE_BE0>, <&ccu CLK_AHB_DE_FE0>,
+                                 <&ccu CLK_DE_BE0>, <&ccu CLK_DE_FE0>,
                                 <&ccu CLK_TCON0_CH1>, <&ccu CLK_HDMI>,
                                 <&ccu CLK_DRAM_DE_FE0>, <&ccu CLK_DRAM_DE_BE0>;
                        status = "disabled";
@@ -88,7 +88,7 @@
                        allwinner,pipeline = "de_fe0-de_be0-lcd0";
                        clocks = <&ccu CLK_AHB_LCD0>, <&ccu CLK_AHB_DE_BE0>,
                                 <&ccu CLK_AHB_DE_FE0>, <&ccu CLK_DE_BE0>,
-                                 <&ccu CLK_AHB_DE_FE0>, <&ccu CLK_TCON0_CH0>,
+                                 <&ccu CLK_DE_FE0>, <&ccu CLK_TCON0_CH0>,
                                 <&ccu CLK_DRAM_DE_FE0>, <&ccu CLK_DRAM_DE_BE0>;
                        status = "disabled";
                };
@@ -99,7 +99,7 @@
                        allwinner,pipeline = "de_fe0-de_be0-lcd0-tve0";
                        clocks = <&ccu CLK_AHB_TVE0>, <&ccu CLK_AHB_LCD0>,
                                 <&ccu CLK_AHB_DE_BE0>, <&ccu CLK_AHB_DE_FE0>,
-                                 <&ccu CLK_DE_BE0>, <&ccu CLK_AHB_DE_FE0>,
+                                 <&ccu CLK_DE_BE0>, <&ccu CLK_DE_FE0>,
                                 <&ccu CLK_TCON0_CH1>, <&ccu CLK_DRAM_TVE0>,
                                 <&ccu CLK_DRAM_DE_FE0>, <&ccu CLK_DRAM_DE_BE0>;
                        status = "disabled";
diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
index 3328fe583c9b..232f124ce62c 100644
--- a/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
+++ b/arch/arm/boot/dts/sun8i-h3-orangepi-one.dts
@@ -117,6 +117,7 @@
        phy-handle = <&int_mii_phy>;
        phy-mode = "mii";
        allwinner,leds-active-low;
+        status = "okay";
 };
 &hdmi {
diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero-dock.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero-dock.dts
index d1311098ea45..ad173605b1b8 100644
--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero-dock.dts
+++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero-dock.dts
@@ -51,7 +51,7 @@
        leds {
                /* The LEDs use PG0~2 pins, which conflict with MMC1 */
-                status = "disbaled";
+                status = "disabled";
        };
 };
diff --git a/arch/arm/mach-ep93xx/core.c b/arch/arm/mach-ep93xx/core.c
index e70feec6fad5..0581ffbedddd 100644
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -323,7 +323,7 @@ void __init ep93xx_register_eth(struct ep93xx_eth_data *data, int copy_addr)
 /* All EP93xx devices use the same two GPIO pins for I2C bit-banging */
 static struct gpiod_lookup_table ep93xx_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                /* Use local offsets on gpiochip/port "G" */
                GPIO_LOOKUP_IDX("G", 1, NULL, 0,
diff --git a/arch/arm/mach-ixp4xx/avila-setup.c b/arch/arm/mach-ixp4xx/avila-setup.c
index 77def6169f50..44cbbce6bda6 100644
--- a/arch/arm/mach-ixp4xx/avila-setup.c
+++ b/arch/arm/mach-ixp4xx/avila-setup.c
@@ -51,7 +51,7 @@ static struct platform_device avila_flash = {
 };
 static struct gpiod_lookup_table avila_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", AVILA_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-ixp4xx/dsmg600-setup.c b/arch/arm/mach-ixp4xx/dsmg600-setup.c
index 0f5c99941a7d..397190f3a8da 100644
--- a/arch/arm/mach-ixp4xx/dsmg600-setup.c
+++ b/arch/arm/mach-ixp4xx/dsmg600-setup.c
@@ -70,7 +70,7 @@ static struct platform_device dsmg600_flash = {
 };
 static struct gpiod_lookup_table dsmg600_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", DSMG600_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-ixp4xx/fsg-setup.c b/arch/arm/mach-ixp4xx/fsg-setup.c
index 033f79b35d51..f0a152e365b1 100644
--- a/arch/arm/mach-ixp4xx/fsg-setup.c
+++ b/arch/arm/mach-ixp4xx/fsg-setup.c
@@ -56,7 +56,7 @@ static struct platform_device fsg_flash = {
 };
 static struct gpiod_lookup_table fsg_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", FSG_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-ixp4xx/ixdp425-setup.c b/arch/arm/mach-ixp4xx/ixdp425-setup.c
index b168e2fbdbeb..3ec829d52cdd 100644
--- a/arch/arm/mach-ixp4xx/ixdp425-setup.c
+++ b/arch/arm/mach-ixp4xx/ixdp425-setup.c
@@ -124,7 +124,7 @@ static struct platform_device ixdp425_flash_nand = {
 #endif  /* CONFIG_MTD_NAND_PLATFORM */
 static struct gpiod_lookup_table ixdp425_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", IXDP425_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-ixp4xx/nas100d-setup.c b/arch/arm/mach-ixp4xx/nas100d-setup.c
index 76dfff03cb71..4138d6aa4c52 100644
--- a/arch/arm/mach-ixp4xx/nas100d-setup.c
+++ b/arch/arm/mach-ixp4xx/nas100d-setup.c
@@ -102,7 +102,7 @@ static struct platform_device nas100d_leds = {
 };
 static struct gpiod_lookup_table nas100d_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", NAS100D_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-ixp4xx/nslu2-setup.c b/arch/arm/mach-ixp4xx/nslu2-setup.c
index 91da63a7d7b5..341b263482ef 100644
--- a/arch/arm/mach-ixp4xx/nslu2-setup.c
+++ b/arch/arm/mach-ixp4xx/nslu2-setup.c
@@ -70,7 +70,7 @@ static struct platform_device nslu2_flash = {
 };
 static struct gpiod_lookup_table nslu2_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("IXP4XX_GPIO_CHIP", NSLU2_SDA_PIN,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-pxa/palmz72.c b/arch/arm/mach-pxa/palmz72.c
index 5877e547cecd..0adb1bd6208e 100644
--- a/arch/arm/mach-pxa/palmz72.c
+++ b/arch/arm/mach-pxa/palmz72.c
@@ -322,7 +322,7 @@ static struct soc_camera_link palmz72_iclink = {
 };
 static struct gpiod_lookup_table palmz72_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.0",
        .table          = {
                GPIO_LOOKUP_IDX("gpio-pxa", 118, NULL, 0,
                                GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-pxa/viper.c b/arch/arm/mach-pxa/viper.c
index 90d0f277de55..207dcc2e94e7 100644
--- a/arch/arm/mach-pxa/viper.c
+++ b/arch/arm/mach-pxa/viper.c
@@ -460,7 +460,7 @@ static struct platform_device smc91x_device = {
 /* i2c */
 static struct gpiod_lookup_table viper_i2c_gpiod_table = {
-        .dev_id         = "i2c-gpio",
+        .dev_id         = "i2c-gpio.1",
        .table          = {
                GPIO_LOOKUP_IDX("gpio-pxa", VIPER_RTC_I2C_SDA_GPIO,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
@@ -789,7 +789,7 @@ static int __init viper_tpm_setup(char *str)
 __setup("tpm=", viper_tpm_setup);
 struct gpiod_lookup_table viper_tpm_i2c_gpiod_table = {
-        .dev_id = "i2c-gpio",
+        .dev_id = "i2c-gpio.2",
        .table = {
                GPIO_LOOKUP_IDX("gpio-pxa", VIPER_TPM_I2C_SDA_GPIO,
                                NULL, 0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm/mach-sa1100/simpad.c b/arch/arm/mach-sa1100/simpad.c
index ace010479eb6..f45aed2519ba 100644
--- a/arch/arm/mach-sa1100/simpad.c
+++ b/arch/arm/mach-sa1100/simpad.c
@@ -327,7 +327,7 @@ static struct platform_device simpad_gpio_leds = {
 * i2c
 */
 static struct gpiod_lookup_table simpad_i2c_gpiod_table = {
-        .dev_id = "i2c-gpio",
+        .dev_id = "i2c-gpio.0",
        .table = {
                GPIO_LOOKUP_IDX("gpio", 21, NULL, 0,
                                GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index 724a0d3b7683..edb4ee0b8896 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -299,7 +299,6 @@
                /* GPIO blocks 16 thru 19 do not appear to be routed to pins */
                dwmmc_0: dwmmc0@f723d000 {
-                        max-frequency = <150000000>;
                        cap-mmc-highspeed;
                        mmc-hs200-1_8v;
                        non-removable;
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index b9e9bf628849..3775a8d694fb 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
        if (value & ~known_bits)
                return -EOPNOTSUPP;
+        /* Setting FRE without FR is not supported.  */
+        if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE)
+                return -EOPNOTSUPP;
        /* Avoid inadvertently triggering emulation */
        if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
            !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 8d098b9f395c..0c0c23c9c9f5 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -818,7 +818,7 @@ long arch_ptrace(struct task_struct *child, long request,
                                break;
                        }
 #endif
-                        tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
+                        tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
                        break;
                case PC:
                        tmp = regs->cp0_epc;
diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
index 656a137c1fe2..f30c381d3e1c 100644
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -109,7 +109,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
                                                addr & 1);
                                break;
                        }
-                        tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
+                        tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
                        break;
                case PC:
                        tmp = regs->cp0_epc;
diff --git a/arch/nds32/Kconfig b/arch/nds32/Kconfig
index 249f38d3388f..b7404f2dcf5b 100644
--- a/arch/nds32/Kconfig
+++ b/arch/nds32/Kconfig
@@ -9,6 +9,12 @@ config NDS32
        select CLKSRC_MMIO
        select CLONE_BACKWARDS
        select COMMON_CLK
+        select GENERIC_ASHLDI3
+        select GENERIC_ASHRDI3
+        select GENERIC_LSHRDI3
+        select GENERIC_CMPDI2
+        select GENERIC_MULDI3
+        select GENERIC_UCMPDI2
        select GENERIC_ATOMIC64
        select GENERIC_CPU_DEVICES
        select GENERIC_CLOCKEVENTS
@@ -82,6 +88,7 @@ endmenu
 menu "Kernel Features"
 source "kernel/Kconfig.preempt"
+source "kernel/Kconfig.freezer"
 source "mm/Kconfig"
 source "kernel/Kconfig.hz"
 endmenu
diff --git a/arch/nds32/Kconfig.cpu b/arch/nds32/Kconfig.cpu
index ba44cc539da9..b8c8984d1456 100644
--- a/arch/nds32/Kconfig.cpu
+++ b/arch/nds32/Kconfig.cpu
@@ -1,10 +1,11 @@
 comment "Processor Features"
 config CPU_BIG_ENDIAN
-        bool "Big endian"
+        def_bool !CPU_LITTLE_ENDIAN
 config CPU_LITTLE_ENDIAN
-        def_bool !CPU_BIG_ENDIAN
+        bool "Little endian"
+        default y
 config HWZOL
        bool "hardware zero overhead loop support"
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 91f933d5a962..513bb2e9baf9 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -23,9 +23,6 @@ export	TEXTADDR
 # If we have a machine-specific directory, then include it in the build.
 core-y                          += arch/nds32/kernel/ arch/nds32/mm/
 libs-y                          += arch/nds32/lib/
-LIBGCC_PATH                     := \
-  $(shell $(CC) $(KBUILD_CFLAGS) $(KCFLAGS) -print-libgcc-file-name)
-libs-y                          += $(LIBGCC_PATH)
 ifneq '$(CONFIG_NDS32_BUILTIN_DTB)' '""'
 BUILTIN_DTB := y
@@ -35,8 +32,12 @@ endif
 ifdef CONFIG_CPU_LITTLE_ENDIAN
 KBUILD_CFLAGS   += $(call cc-option, -EL)
+KBUILD_AFLAGS   += $(call cc-option, -EL)
+LDFLAGS         += $(call cc-option, -EL)
 else
 KBUILD_CFLAGS   += $(call cc-option, -EB)
+KBUILD_AFLAGS   += $(call cc-option, -EB)
+LDFLAGS         += $(call cc-option, -EB)
 endif
 boot := arch/nds32/boot
diff --git a/arch/nds32/include/asm/Kbuild b/arch/nds32/include/asm/Kbuild
index 06bdf8167f5a..142e612aa639 100644
--- a/arch/nds32/include/asm/Kbuild
+++ b/arch/nds32/include/asm/Kbuild
@@ -16,6 +16,7 @@ generic-y += dma.h
 generic-y += emergency-restart.h
 generic-y += errno.h
 generic-y += exec.h
+generic-y += export.h
 generic-y += fb.h
 generic-y += fcntl.h
 generic-y += ftrace.h
@@ -49,6 +50,7 @@ generic-y += switch_to.h
 generic-y += timex.h
 generic-y += topology.h
 generic-y += trace_clock.h
+generic-y += xor.h
 generic-y += unaligned.h
 generic-y += user.h
 generic-y += vga.h
diff --git a/arch/nds32/include/asm/bitfield.h b/arch/nds32/include/asm/bitfield.h
index c73f71d67744..8e84fc385b94 100644
--- a/arch/nds32/include/asm/bitfield.h
+++ b/arch/nds32/include/asm/bitfield.h
@@ -336,7 +336,7 @@
 #define INT_MASK_mskIDIVZE      ( 0x1  << INT_MASK_offIDIVZE )
 #define INT_MASK_mskDSSIM       ( 0x1  << INT_MASK_offDSSIM )
-#define INT_MASK_INITAIAL_VAL   0x10003
+#define INT_MASK_INITAIAL_VAL   (INT_MASK_mskDSSIM|INT_MASK_mskIDIVZE)
 /******************************************************************************
 * ir15: INT_PEND (Interrupt Pending Register)
@@ -396,6 +396,7 @@
 #define MMU_CTL_D8KB            1
 #define MMU_CTL_UNA             ( 0x1  << MMU_CTL_offUNA )
+#define MMU_CTL_CACHEABLE_NON   0
 #define MMU_CTL_CACHEABLE_WB    2
 #define MMU_CTL_CACHEABLE_WT    3
diff --git a/arch/nds32/include/asm/cacheflush.h b/arch/nds32/include/asm/cacheflush.h
index 1240f148ec0f..10b48f0d8e85 100644
--- a/arch/nds32/include/asm/cacheflush.h
+++ b/arch/nds32/include/asm/cacheflush.h
@@ -32,6 +32,8 @@ void flush_anon_page(struct vm_area_struct *vma,
 #define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
 void flush_kernel_dcache_page(struct page *page);
+void flush_kernel_vmap_range(void *addr, int size);
+void invalidate_kernel_vmap_range(void *addr, int size);
 void flush_icache_range(unsigned long start, unsigned long end);
 void flush_icache_page(struct vm_area_struct *vma, struct page *page);
 #define flush_dcache_mmap_lock(mapping)   xa_lock_irq(&(mapping)->i_pages)
diff --git a/arch/nds32/include/asm/io.h b/arch/nds32/include/asm/io.h
index 966e71b3c960..71cd226d6863 100644
--- a/arch/nds32/include/asm/io.h
+++ b/arch/nds32/include/asm/io.h
@@ -4,6 +4,8 @@
 #ifndef __ASM_NDS32_IO_H
 #define __ASM_NDS32_IO_H
+#include <linux/types.h>
 extern void iounmap(volatile void __iomem *addr);
 #define __raw_writeb __raw_writeb
 static inline void __raw_writeb(u8 val, volatile void __iomem *addr)
diff --git a/arch/nds32/include/asm/page.h b/arch/nds32/include/asm/page.h
index e27365c097b6..947f0491c9a7 100644
--- a/arch/nds32/include/asm/page.h
+++ b/arch/nds32/include/asm/page.h
@@ -27,6 +27,9 @@ extern void copy_user_highpage(struct page *to, struct page *from,
                               unsigned long vaddr, struct vm_area_struct *vma);
 extern void clear_user_highpage(struct page *page, unsigned long vaddr);
+void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+                    struct page *to);
+void clear_user_page(void *addr, unsigned long vaddr, struct page *page);
 #define __HAVE_ARCH_COPY_USER_HIGHPAGE
 #define clear_user_highpage     clear_user_highpage
 #else
diff --git a/arch/nds32/include/asm/pgtable.h b/arch/nds32/include/asm/pgtable.h
index 6783937edbeb..d3e19a55cf53 100644
--- a/arch/nds32/include/asm/pgtable.h
+++ b/arch/nds32/include/asm/pgtable.h
@@ -152,6 +152,7 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 #define PAGE_CACHE_L1   __pgprot(_HAVE_PAGE_L | _PAGE_V | _PAGE_M_KRW | _PAGE_D | _PAGE_E | _PAGE_G | _PAGE_CACHE)
 #define PAGE_MEMORY     __pgprot(_HAVE_PAGE_L | _PAGE_V | _PAGE_M_KRW | _PAGE_D | _PAGE_E | _PAGE_G | _PAGE_CACHE_SHRD)
 #define PAGE_KERNEL     __pgprot(_PAGE_V | _PAGE_M_KRW | _PAGE_D | _PAGE_E | _PAGE_G | _PAGE_CACHE_SHRD)
+#define PAGE_SHARED     __pgprot(_PAGE_V | _PAGE_M_URW_KRW | _PAGE_D | _PAGE_CACHE_SHRD)
 #define PAGE_DEVICE    __pgprot(_PAGE_V | _PAGE_M_KRW | _PAGE_D | _PAGE_G | _PAGE_C_DEV)
 #endif /* __ASSEMBLY__ */
diff --git a/arch/nds32/kernel/ex-entry.S b/arch/nds32/kernel/ex-entry.S
index a72e83d804f5..b8ae4e9a6b93 100644
--- a/arch/nds32/kernel/ex-entry.S
+++ b/arch/nds32/kernel/ex-entry.S
@@ -118,7 +118,7 @@ common_exception_handler:
        /* interrupt */
 2:
 #ifdef CONFIG_TRACE_IRQFLAGS
-        jal     arch_trace_hardirqs_off
+        jal     trace_hardirqs_off
 #endif
        move    $r0, $sp
        sethi   $lp, hi20(ret_from_intr)
diff --git a/arch/nds32/kernel/head.S b/arch/nds32/kernel/head.S
index 71f57bd70f3b..c5fdae174ced 100644
--- a/arch/nds32/kernel/head.S
+++ b/arch/nds32/kernel/head.S
@@ -57,14 +57,32 @@ _nodtb:
        isb
        mtsr    $r4, $L1_PPTB       ! load page table pointer\n"
-/* set NTC0 cacheable/writeback, mutliple page size in use */
+#ifdef CONFIG_CPU_DCACHE_DISABLE
+        #define MMU_CTL_NTCC MMU_CTL_CACHEABLE_NON
+#else
+        #ifdef CONFIG_CPU_DCACHE_WRITETHROUGH
+                #define MMU_CTL_NTCC MMU_CTL_CACHEABLE_WT
+        #else
+                #define MMU_CTL_NTCC MMU_CTL_CACHEABLE_WB
+        #endif
+#endif
+/* set NTC cacheability, mutliple page size in use */
        mfsr    $r3, $MMU_CTL
-        li      $r0, #~MMU_CTL_mskNTC0
+#if CONFIG_MEMORY_START >= 0xc0000000
-        and     $r3, $r3, $r0
+        ori     $r3, $r3, (MMU_CTL_NTCC << MMU_CTL_offNTC3)
+#elif CONFIG_MEMORY_START >= 0x80000000
+        ori     $r3, $r3, (MMU_CTL_NTCC << MMU_CTL_offNTC2)
+#elif CONFIG_MEMORY_START >= 0x40000000
+        ori     $r3, $r3, (MMU_CTL_NTCC << MMU_CTL_offNTC1)
+#else
+        ori     $r3, $r3, (MMU_CTL_NTCC << MMU_CTL_offNTC0)
+#endif
 #ifdef CONFIG_ANDES_PAGE_SIZE_4KB
-        ori     $r3, $r3, #(MMU_CTL_mskMPZIU|(MMU_CTL_CACHEABLE_WB << MMU_CTL_offNTC0))
+        ori     $r3, $r3, #(MMU_CTL_mskMPZIU)
 #else
-        ori     $r3, $r3, #(MMU_CTL_mskMPZIU|(MMU_CTL_CACHEABLE_WB << MMU_CTL_offNTC0)|MMU_CTL_D8KB)
+        ori     $r3, $r3, #(MMU_CTL_mskMPZIU|MMU_CTL_D8KB)
 #endif
 #ifdef CONFIG_HW_SUPPORT_UNALIGNMENT_ACCESS
        li      $r0, #MMU_CTL_UNA
diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c
index ba910e9e4ecb..2f5b2ccebe47 100644
--- a/arch/nds32/kernel/setup.c
+++ b/arch/nds32/kernel/setup.c
@@ -293,6 +293,9 @@ void __init setup_arch(char **cmdline_p)
        /* paging_init() sets up the MMU and marks all pages as reserved */
        paging_init();
+        /* invalidate all TLB entries because the new mapping is created */
+        __nds32__tlbop_flua();
        /* use generic way to parse */
        parse_early_param();
diff --git a/arch/nds32/kernel/stacktrace.c b/arch/nds32/kernel/stacktrace.c
index bc70113c0e84..8b231e910ea6 100644
--- a/arch/nds32/kernel/stacktrace.c
+++ b/arch/nds32/kernel/stacktrace.c
@@ -9,6 +9,7 @@ void save_stack_trace(struct stack_trace *trace)
 {
        save_stack_trace_tsk(current, trace);
 }
+EXPORT_SYMBOL_GPL(save_stack_trace);
 void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
 {
@@ -45,3 +46,4 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
                fpn = (unsigned long *)fpp;
        }
 }
+EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
diff --git a/arch/nds32/kernel/vdso.c b/arch/nds32/kernel/vdso.c
index f1198d7a5654..016f15891f6d 100644
--- a/arch/nds32/kernel/vdso.c
+++ b/arch/nds32/kernel/vdso.c
@@ -23,7 +23,7 @@
 #include <asm/vdso_timer_info.h>
 #include <asm/cache_info.h>
 extern struct cache_info L1_cache_info[2];
-extern char vdso_start, vdso_end;
+extern char vdso_start[], vdso_end[];
 static unsigned long vdso_pages __ro_after_init;
 static unsigned long timer_mapping_base;
@@ -66,16 +66,16 @@ static int __init vdso_init(void)
        int i;
        struct page **vdso_pagelist;
-        if (memcmp(&vdso_start, "\177ELF", 4)) {
+        if (memcmp(vdso_start, "\177ELF", 4)) {
                pr_err("vDSO is not a valid ELF object!\n");
                return -EINVAL;
        }
        /* Creat a timer io mapping to get clock cycles counter */
        get_timer_node_info();
-        vdso_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT;
+        vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
        pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n",
-                vdso_pages + 1, vdso_pages, &vdso_start, 1L, vdso_data);
+                vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data);
        /* Allocate the vDSO pagelist */
        vdso_pagelist = kcalloc(vdso_pages, sizeof(struct page *), GFP_KERNEL);
@@ -83,7 +83,7 @@ static int __init vdso_init(void)
                return -ENOMEM;
        for (i = 0; i < vdso_pages; i++)
-                vdso_pagelist[i] = virt_to_page(&vdso_start + i * PAGE_SIZE);
+                vdso_pagelist[i] = virt_to_page(vdso_start + i * PAGE_SIZE);
        vdso_spec[1].pages = &vdso_pagelist[0];
        return 0;
diff --git a/arch/nds32/lib/copy_page.S b/arch/nds32/lib/copy_page.S
index 4a2ff85f17ee..f8701ed161a8 100644
--- a/arch/nds32/lib/copy_page.S
+++ b/arch/nds32/lib/copy_page.S
@@ -2,6 +2,7 @@
 // Copyright (C) 2005-2017 Andes Technology Corporation
 #include <linux/linkage.h>
+#include <asm/export.h>
 #include <asm/page.h>
        .text
@@ -16,6 +17,7 @@ ENTRY(copy_page)
        popm    $r2, $r10
        ret
 ENDPROC(copy_page)
+EXPORT_SYMBOL(copy_page)
 ENTRY(clear_page)
        pushm   $r1, $r9
@@ -35,3 +37,4 @@ ENTRY(clear_page)
        popm    $r1, $r9
        ret
 ENDPROC(clear_page)
+EXPORT_SYMBOL(clear_page)
diff --git a/arch/nds32/mm/alignment.c b/arch/nds32/mm/alignment.c
index b96a01b10ca7..e1aed9dc692d 100644
--- a/arch/nds32/mm/alignment.c
+++ b/arch/nds32/mm/alignment.c
@@ -19,7 +19,7 @@
 #define RA(inst)        (((inst) >> 15) & 0x1FUL)
 #define RB(inst)        (((inst) >> 10) & 0x1FUL)
 #define SV(inst)        (((inst) >> 8) & 0x3UL)
-#define IMM(inst)       (((inst) >> 0) & 0x3FFFUL)
+#define IMM(inst)       (((inst) >> 0) & 0x7FFFUL)
 #define RA3(inst)       (((inst) >> 3) & 0x7UL)
 #define RT3(inst)       (((inst) >> 6) & 0x7UL)
@@ -28,6 +28,9 @@
 #define RA5(inst)       (((inst) >> 0) & 0x1FUL)
 #define RT4(inst)       (((inst) >> 5) & 0xFUL)
+#define GET_IMMSVAL(imm_value) \
+        (((imm_value >> 14) & 0x1) ? (imm_value - 0x8000) : imm_value)
 #define __get8_data(val,addr,err)       \
        __asm__(                                        \
        "1:     lbi.bi  %1, [%2], #1\n"                 \
@@ -467,7 +470,7 @@ static inline int do_32(unsigned long inst, struct pt_regs *regs)
        }
        if (imm)
-                shift = IMM(inst) * len;
+                shift = GET_IMMSVAL(IMM(inst)) * len;
        else
                shift = *idx_to_addr(regs, RB(inst)) << SV(inst);
@@ -552,7 +555,7 @@ static struct ctl_table alignment_tbl[3] = {
 static struct ctl_table nds32_sysctl_table[2] = {
        {
-         .procname = "unaligned_acess",
+         .procname = "unaligned_access",
         .mode = 0555,
         .child = alignment_tbl},
        {}
diff --git a/arch/nds32/mm/cacheflush.c b/arch/nds32/mm/cacheflush.c
index 6eb786a399a2..ce8fd34497bf 100644
--- a/arch/nds32/mm/cacheflush.c
+++ b/arch/nds32/mm/cacheflush.c
@@ -147,6 +147,25 @@ void flush_cache_vunmap(unsigned long start, unsigned long end)
        cpu_icache_inval_all();
 }
+void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+                    struct page *to)
+{
+        cpu_dcache_wbinval_page((unsigned long)vaddr);
+        cpu_icache_inval_page((unsigned long)vaddr);
+        copy_page(vto, vfrom);
+        cpu_dcache_wbinval_page((unsigned long)vto);
+        cpu_icache_inval_page((unsigned long)vto);
+}
+void clear_user_page(void *addr, unsigned long vaddr, struct page *page)
+{
+        cpu_dcache_wbinval_page((unsigned long)vaddr);
+        cpu_icache_inval_page((unsigned long)vaddr);
+        clear_page(addr);
+        cpu_dcache_wbinval_page((unsigned long)addr);
+        cpu_icache_inval_page((unsigned long)addr);
+}
 void copy_user_highpage(struct page *to, struct page *from,
                        unsigned long vaddr, struct vm_area_struct *vma)
 {
@@ -156,11 +175,9 @@ void copy_user_highpage(struct page *to, struct page *from,
        pto = page_to_phys(to);
        pfrom = page_to_phys(from);
+        local_irq_save(flags);
        if (aliasing(vaddr, (unsigned long)kfrom))
                cpu_dcache_wb_page((unsigned long)kfrom);
-        if (aliasing(vaddr, (unsigned long)kto))
-                cpu_dcache_inval_page((unsigned long)kto);
-        local_irq_save(flags);
        vto = kremap0(vaddr, pto);
        vfrom = kremap1(vaddr, pfrom);
        copy_page((void *)vto, (void *)vfrom);
@@ -198,21 +215,25 @@ void flush_dcache_page(struct page *page)
        if (mapping && !mapping_mapped(mapping))
                set_bit(PG_dcache_dirty, &page->flags);
        else {
-                int i, pc;
+                unsigned long kaddr, flags;
-                unsigned long vto, kaddr, flags;
                kaddr = (unsigned long)page_address(page);
-                cpu_dcache_wbinval_page(kaddr);
-                pc = CACHE_SET(DCACHE) * CACHE_LINE_SIZE(DCACHE) / PAGE_SIZE;
                local_irq_save(flags);
-                for (i = 0; i < pc; i++) {
+                cpu_dcache_wbinval_page(kaddr);
-                        vto =
+                if (mapping) {
-                            kremap0(kaddr + i * PAGE_SIZE, page_to_phys(page));
+                        unsigned long vaddr, kto;
-                        cpu_dcache_wbinval_page(vto);
-                        kunmap01(vto);
+                        vaddr = page->index << PAGE_SHIFT;
+                        if (aliasing(vaddr, kaddr)) {
+                                kto = kremap0(vaddr, page_to_phys(page));
+                                cpu_dcache_wbinval_page(kto);
+                                kunmap01(kto);
+                        }
                }
                local_irq_restore(flags);
        }
 }
+EXPORT_SYMBOL(flush_dcache_page);
 void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
                       unsigned long vaddr, void *dst, void *src, int len)
@@ -251,7 +272,7 @@ void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
 void flush_anon_page(struct vm_area_struct *vma,
                     struct page *page, unsigned long vaddr)
 {
-        unsigned long flags;
+        unsigned long kaddr, flags, ktmp;
        if (!PageAnon(page))
                return;
@@ -261,7 +282,12 @@ void flush_anon_page(struct vm_area_struct *vma,
        local_irq_save(flags);
        if (vma->vm_flags & VM_EXEC)
                cpu_icache_inval_page(vaddr & PAGE_MASK);
-        cpu_dcache_wbinval_page((unsigned long)page_address(page));
+        kaddr = (unsigned long)page_address(page);
+        if (aliasing(vaddr, kaddr)) {
+                ktmp = kremap0(vaddr, page_to_phys(page));
+                cpu_dcache_wbinval_page(ktmp);
+                kunmap01(ktmp);
+        }
        local_irq_restore(flags);
 }
@@ -272,6 +298,25 @@ void flush_kernel_dcache_page(struct page *page)
        cpu_dcache_wbinval_page((unsigned long)page_address(page));
        local_irq_restore(flags);
 }
+EXPORT_SYMBOL(flush_kernel_dcache_page);
+void flush_kernel_vmap_range(void *addr, int size)
+{
+        unsigned long flags;
+        local_irq_save(flags);
+        cpu_dcache_wb_range((unsigned long)addr, (unsigned long)addr +  size);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(flush_kernel_vmap_range);
+void invalidate_kernel_vmap_range(void *addr, int size)
+{
+        unsigned long flags;
+        local_irq_save(flags);
+        cpu_dcache_inval_range((unsigned long)addr, (unsigned long)addr + size);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(invalidate_kernel_vmap_range);
 void flush_icache_range(unsigned long start, unsigned long end)
 {
@@ -283,6 +328,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
        cpu_cache_wbinval_range(start, end, 1);
        local_irq_restore(flags);
 }
+EXPORT_SYMBOL(flush_icache_range);
 void flush_icache_page(struct vm_area_struct *vma, struct page *page)
 {
diff --git a/arch/nds32/mm/init.c b/arch/nds32/mm/init.c
index 93ee0160720b..c713d2ad55dc 100644
--- a/arch/nds32/mm/init.c
+++ b/arch/nds32/mm/init.c
@@ -30,6 +30,7 @@ extern unsigned long phys_initrd_size;
 * zero-initialized data and COW.
 */
 struct page *empty_zero_page;
+EXPORT_SYMBOL(empty_zero_page);
 static void __init zone_sizes_init(void)
 {
diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
index 4c02a7378d06..e7377b73cfec 100644
--- a/arch/powerpc/include/asm/kvm_book3s.h
+++ b/arch/powerpc/include/asm/kvm_book3s.h
@@ -96,6 +96,7 @@ struct kvmppc_vcore {
        struct kvm_vcpu *runner;
        struct kvm *kvm;
        u64 tb_offset;          /* guest timebase - host timebase */
+        u64 tb_offset_applied;  /* timebase offset currently in force */
        ulong lpcr;
        u32 arch_compat;
        ulong pcr;
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 6bee65f3cfd3..373dc1d6ef44 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -562,6 +562,7 @@ int main(void)
        OFFSET(VCORE_NAPPING_THREADS, kvmppc_vcore, napping_threads);
        OFFSET(VCORE_KVM, kvmppc_vcore, kvm);
        OFFSET(VCORE_TB_OFFSET, kvmppc_vcore, tb_offset);
+        OFFSET(VCORE_TB_OFFSET_APPL, kvmppc_vcore, tb_offset_applied);
        OFFSET(VCORE_LPCR, kvmppc_vcore, lpcr);
        OFFSET(VCORE_PCR, kvmppc_vcore, pcr);
        OFFSET(VCORE_DPDES, kvmppc_vcore, dpdes);
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index a57eafec4dc2..361f42c8c73e 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -162,7 +162,7 @@ static void kvmppc_radix_tlbie_page(struct kvm *kvm, unsigned long addr,
        if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG))
                asm volatile(PPC_TLBIE_5(%0, %1, 0, 0, 1)
                             : : "r" (addr), "r" (kvm->arch.lpid) : "memory");
-        asm volatile("ptesync": : :"memory");
+        asm volatile("eieio ; tlbsync ; ptesync": : :"memory");
 }
 static void kvmppc_radix_flush_pwc(struct kvm *kvm, unsigned long addr)
@@ -173,7 +173,7 @@ static void kvmppc_radix_flush_pwc(struct kvm *kvm, unsigned long addr)
        /* RIC=1 PRS=0 R=1 IS=2 */
        asm volatile(PPC_TLBIE_5(%0, %1, 1, 0, 1)
                     : : "r" (rb), "r" (kvm->arch.lpid) : "memory");
-        asm volatile("ptesync": : :"memory");
+        asm volatile("eieio ; tlbsync ; ptesync": : :"memory");
 }
 unsigned long kvmppc_radix_update_pte(struct kvm *kvm, pte_t *ptep,
@@ -584,7 +584,7 @@ int kvm_unmap_radix(struct kvm *kvm, struct kvm_memory_slot *memslot,
        ptep = __find_linux_pte(kvm->arch.pgtable, gpa, NULL, &shift);
        if (ptep && pte_present(*ptep)) {
-                old = kvmppc_radix_update_pte(kvm, ptep, _PAGE_PRESENT, 0,
+                old = kvmppc_radix_update_pte(kvm, ptep, ~0UL, 0,
                                              gpa, shift);
                kvmppc_radix_tlbie_page(kvm, gpa, shift);
                if ((old & _PAGE_DIRTY) && memslot->dirty_bitmap) {
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 4d07fca5121c..9963f65c212b 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2441,6 +2441,7 @@ static void init_vcore_to_run(struct kvmppc_vcore *vc)
        vc->in_guest = 0;
        vc->napping_threads = 0;
        vc->conferring_threads = 0;
+        vc->tb_offset_applied = 0;
 }
 static bool can_dynamic_split(struct kvmppc_vcore *vc, struct core_info *cip)
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bd63fa8a08b5..07ca1b2a7966 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -692,6 +692,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 22:     ld      r8,VCORE_TB_OFFSET(r5)
        cmpdi   r8,0
        beq     37f
+        std     r8, VCORE_TB_OFFSET_APPL(r5)
        mftb    r6              /* current host timebase */
        add     r8,r8,r6
        mtspr   SPRN_TBU40,r8   /* update upper 40 bits */
@@ -940,18 +941,6 @@ FTR_SECTION_ELSE
 ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
 8:
-        /*
-         * Set the decrementer to the guest decrementer.
-         */
-        ld      r8,VCPU_DEC_EXPIRES(r4)
-        /* r8 is a host timebase value here, convert to guest TB */
-        ld      r5,HSTATE_KVM_VCORE(r13)
-        ld      r6,VCORE_TB_OFFSET(r5)
-        add     r8,r8,r6
-        mftb    r7
-        subf    r3,r7,r8
-        mtspr   SPRN_DEC,r3
        ld      r5, VCPU_SPRG0(r4)
        ld      r6, VCPU_SPRG1(r4)
        ld      r7, VCPU_SPRG2(r4)
@@ -1005,6 +994,18 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
        mtspr   SPRN_LPCR,r8
        isync
+        /*
+         * Set the decrementer to the guest decrementer.
+         */
+        ld      r8,VCPU_DEC_EXPIRES(r4)
+        /* r8 is a host timebase value here, convert to guest TB */
+        ld      r5,HSTATE_KVM_VCORE(r13)
+        ld      r6,VCORE_TB_OFFSET_APPL(r5)
+        add     r8,r8,r6
+        mftb    r7
+        subf    r3,r7,r8
+        mtspr   SPRN_DEC,r3
        /* Check if HDEC expires soon */
        mfspr   r3, SPRN_HDEC
        EXTEND_HDEC(r3)
@@ -1597,8 +1598,27 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
 guest_bypass:
        stw     r12, STACK_SLOT_TRAP(r1)
-        mr      r3, r12
+        /* Save DEC */
+        /* Do this before kvmhv_commence_exit so we know TB is guest TB */
+        ld      r3, HSTATE_KVM_VCORE(r13)
+        mfspr   r5,SPRN_DEC
+        mftb    r6
+        /* On P9, if the guest has large decr enabled, don't sign extend */
+BEGIN_FTR_SECTION
+        ld      r4, VCORE_LPCR(r3)
+        andis.  r4, r4, LPCR_LD@h
+        bne     16f
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+        extsw   r5,r5
+16:     add     r5,r5,r6
+        /* r5 is a guest timebase value here, convert to host TB */
+        ld      r4,VCORE_TB_OFFSET_APPL(r3)
+        subf    r5,r4,r5
+        std     r5,VCPU_DEC_EXPIRES(r9)
        /* Increment exit count, poke other threads to exit */
+        mr      r3, r12
        bl      kvmhv_commence_exit
        nop
        ld      r9, HSTATE_KVM_VCPU(r13)
@@ -1639,23 +1659,6 @@ guest_bypass:
        mtspr   SPRN_PURR,r3
        mtspr   SPRN_SPURR,r4
-        /* Save DEC */
-        ld      r3, HSTATE_KVM_VCORE(r13)
-        mfspr   r5,SPRN_DEC
-        mftb    r6
-        /* On P9, if the guest has large decr enabled, don't sign extend */
-BEGIN_FTR_SECTION
-        ld      r4, VCORE_LPCR(r3)
-        andis.  r4, r4, LPCR_LD@h
-        bne     16f
-END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
-        extsw   r5,r5
-16:     add     r5,r5,r6
-        /* r5 is a guest timebase value here, convert to host TB */
-        ld      r4,VCORE_TB_OFFSET(r3)
-        subf    r5,r4,r5
-        std     r5,VCPU_DEC_EXPIRES(r9)
 BEGIN_FTR_SECTION
        b       8f
 END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
@@ -1905,6 +1908,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
        cmpwi   cr2, r0, 0
        beq     cr2, 4f
+        /*
+         * Radix: do eieio; tlbsync; ptesync sequence in case we
+         * interrupted the guest between a tlbie and a ptesync.
+         */
+        eieio
+        tlbsync
+        ptesync
        /* Radix: Handle the case where the guest used an illegal PID */
        LOAD_REG_ADDR(r4, mmu_base_pid)
        lwz     r3, VCPU_GUEST_PID(r9)
@@ -2017,9 +2028,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
 27:
        /* Subtract timebase offset from timebase */
-        ld      r8,VCORE_TB_OFFSET(r5)
+        ld      r8, VCORE_TB_OFFSET_APPL(r5)
        cmpdi   r8,0
        beq     17f
+        li      r0, 0
+        std     r0, VCORE_TB_OFFSET_APPL(r5)
        mftb    r6                      /* current guest timebase */
        subf    r8,r8,r6
        mtspr   SPRN_TBU40,r8           /* update upper 40 bits */
@@ -2700,7 +2713,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
        add     r3, r3, r5
        ld      r4, HSTATE_KVM_VCPU(r13)
        ld      r5, HSTATE_KVM_VCORE(r13)
-        ld      r6, VCORE_TB_OFFSET(r5)
+        ld      r6, VCORE_TB_OFFSET_APPL(r5)
        subf    r3, r6, r3      /* convert to host TB value */
        std     r3, VCPU_DEC_EXPIRES(r4)
@@ -2799,7 +2812,7 @@ END_FTR_SECTION(CPU_FTR_TM | CPU_FTR_P9_TM_HV_ASSIST, 0)
        /* Restore guest decrementer */
        ld      r3, VCPU_DEC_EXPIRES(r4)
        ld      r5, HSTATE_KVM_VCORE(r13)
-        ld      r6, VCORE_TB_OFFSET(r5)
+        ld      r6, VCORE_TB_OFFSET_APPL(r5)
        add     r3, r3, r6      /* convert host TB to guest TB value */
        mftb    r7
        subf    r3, r7, r3
@@ -3606,12 +3619,9 @@ kvmppc_fix_pmao:
 */
 kvmhv_start_timing:
        ld      r5, HSTATE_KVM_VCORE(r13)
-        lbz     r6, VCORE_IN_GUEST(r5)
+        ld      r6, VCORE_TB_OFFSET_APPL(r5)
-        cmpwi   r6, 0
+        mftb    r5
-        beq     5f                              /* if in guest, need to */
+        subf    r5, r6, r5      /* subtract current timebase offset */
-        ld      r6, VCORE_TB_OFFSET(r5)         /* subtract timebase offset */
-5:      mftb    r5
-        subf    r5, r6, r5
        std     r3, VCPU_CUR_ACTIVITY(r4)
        std     r5, VCPU_ACTIVITY_START(r4)
        blr
@@ -3622,15 +3632,12 @@ kvmhv_start_timing:
 */
 kvmhv_accumulate_time:
        ld      r5, HSTATE_KVM_VCORE(r13)
-        lbz     r8, VCORE_IN_GUEST(r5)
+        ld      r8, VCORE_TB_OFFSET_APPL(r5)
-        cmpwi   r8, 0
+        ld      r5, VCPU_CUR_ACTIVITY(r4)
-        beq     4f                              /* if in guest, need to */
-        ld      r8, VCORE_TB_OFFSET(r5)         /* subtract timebase offset */
-4:      ld      r5, VCPU_CUR_ACTIVITY(r4)
        ld      r6, VCPU_ACTIVITY_START(r4)
        std     r3, VCPU_CUR_ACTIVITY(r4)
        mftb    r7
-        subf    r7, r8, r7
+        subf    r7, r8, r7      /* subtract current timebase offset */
        std     r7, VCPU_ACTIVITY_START(r4)
        cmpdi   r5, 0
        beqlr
diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c
index c7a5deadd1cc..99c3620b40d9 100644
--- a/arch/powerpc/kvm/book3s_xive_template.c
+++ b/arch/powerpc/kvm/book3s_xive_template.c
@@ -11,6 +11,9 @@
 #define XGLUE(a,b) a##b
 #define GLUE(a,b) XGLUE(a,b)
+/* Dummy interrupt used when taking interrupts out of a queue in H_CPPR */
+#define XICS_DUMMY      1
 static void GLUE(X_PFX,ack_pending)(struct kvmppc_xive_vcpu *xc)
 {
        u8 cppr;
@@ -205,6 +208,10 @@ skip_ipi:
                                goto skip_ipi;
                }
+                /* If it's the dummy interrupt, continue searching */
+                if (hirq == XICS_DUMMY)
+                        goto skip_ipi;
                /* If fetching, update queue pointers */
                if (scan_type == scan_fetch) {
                        q->idx = idx;
@@ -385,9 +392,76 @@ static void GLUE(X_PFX,push_pending_to_hw)(struct kvmppc_xive_vcpu *xc)
        __x_writeb(prio, __x_tima + TM_SPC_SET_OS_PENDING);
 }
+static void GLUE(X_PFX,scan_for_rerouted_irqs)(struct kvmppc_xive *xive,
+                                               struct kvmppc_xive_vcpu *xc)
+{
+        unsigned int prio;
+        /* For each priority that is now masked */
+        for (prio = xc->cppr; prio < KVMPPC_XIVE_Q_COUNT; prio++) {
+                struct xive_q *q = &xc->queues[prio];
+                struct kvmppc_xive_irq_state *state;
+                struct kvmppc_xive_src_block *sb;
+                u32 idx, toggle, entry, irq, hw_num;
+                struct xive_irq_data *xd;
+                __be32 *qpage;
+                u16 src;
+                idx = q->idx;
+                toggle = q->toggle;
+                qpage = READ_ONCE(q->qpage);
+                if (!qpage)
+                        continue;
+                /* For each interrupt in the queue */
+                for (;;) {
+                        entry = be32_to_cpup(qpage + idx);
+                        /* No more ? */
+                        if ((entry >> 31) == toggle)
+                                break;
+                        irq = entry & 0x7fffffff;
+                        /* Skip dummies and IPIs */
+                        if (irq == XICS_DUMMY || irq == XICS_IPI)
+                                goto next;
+                        sb = kvmppc_xive_find_source(xive, irq, &src);
+                        if (!sb)
+                                goto next;
+                        state = &sb->irq_state[src];
+                        /* Has it been rerouted ? */
+                        if (xc->server_num == state->act_server)
+                                goto next;
+                        /*
+                         * Allright, it *has* been re-routed, kill it from
+                         * the queue.
+                         */
+                        qpage[idx] = cpu_to_be32((entry & 0x80000000) | XICS_DUMMY);
+                        /* Find the HW interrupt */
+                        kvmppc_xive_select_irq(state, &hw_num, &xd);
+                        /* If it's not an LSI, set PQ to 11 the EOI will force a resend */
+                        if (!(xd->flags & XIVE_IRQ_FLAG_LSI))
+                                GLUE(X_PFX,esb_load)(xd, XIVE_ESB_SET_PQ_11);
+                        /* EOI the source */
+                        GLUE(X_PFX,source_eoi)(hw_num, xd);
+                next:
+                        idx = (idx + 1) & q->msk;
+                        if (idx == 0)
+                                toggle ^= 1;
+                }
+        }
+}
 X_STATIC int GLUE(X_PFX,h_cppr)(struct kvm_vcpu *vcpu, unsigned long cppr)
 {
        struct kvmppc_xive_vcpu *xc = vcpu->arch.xive_vcpu;
+        struct kvmppc_xive *xive = vcpu->kvm->arch.xive;
        u8 old_cppr;
        pr_devel("H_CPPR(cppr=%ld)\n", cppr);
@@ -407,14 +481,34 @@ X_STATIC int GLUE(X_PFX,h_cppr)(struct kvm_vcpu *vcpu, unsigned long cppr)
         */
        smp_mb();
-        /*
+        if (cppr > old_cppr) {
-         * We are masking less, we need to look for pending things
+                /*
-         * to deliver and set VP pending bits accordingly to trigger
+                 * We are masking less, we need to look for pending things
-         * a new interrupt otherwise we might miss MFRR changes for
+                 * to deliver and set VP pending bits accordingly to trigger
-         * which we have optimized out sending an IPI signal.
+                 * a new interrupt otherwise we might miss MFRR changes for
-         */
+                 * which we have optimized out sending an IPI signal.
-        if (cppr > old_cppr)
+                 */
                GLUE(X_PFX,push_pending_to_hw)(xc);
+        } else {
+                /*
+                 * We are masking more, we need to check the queue for any
+                 * interrupt that has been routed to another CPU, take
+                 * it out (replace it with the dummy) and retrigger it.
+                 *
+                 * This is necessary since those interrupts may otherwise
+                 * never be processed, at least not until this CPU restores
+                 * its CPPR.
+                 *
+                 * This is in theory racy vs. HW adding new interrupts to
+                 * the queue. In practice this works because the interesting
+                 * cases are when the guest has done a set_xive() to move the
+                 * interrupt away, which flushes the xive, followed by the
+                 * target CPU doing a H_CPPR. So any new interrupt coming into
+                 * the queue must still be routed to us and isn't a source
+                 * of concern.
+                 */
+                GLUE(X_PFX,scan_for_rerouted_irqs)(xive, xc);
+        }
        /* Apply new CPPR */
        xc->hw_cppr = cppr;
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 8961e3970901..969882b54266 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -578,7 +578,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
        gpa = READ_ONCE(scb_o->itdba) & ~0xffUL;
        if (gpa && (scb_s->ecb & ECB_TE)) {
-                if (!(gpa & ~0x1fffU)) {
+                if (!(gpa & ~0x1fffUL)) {
                        rc = set_validity_icpt(scb_s, 0x0080U);
                        goto unpin;
                }
diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
index e9525bc1b4a6..1ace023cbdce 100644
--- a/arch/s390/purgatory/Makefile
+++ b/arch/s390/purgatory/Makefile
@@ -21,7 +21,7 @@ LDFLAGS_purgatory.ro += -z nodefaultlib
 KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes
 KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare
 KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding
-KBUILD_CFLAGS += -c -MD -Os -m64
+KBUILD_CFLAGS += -c -MD -Os -m64 -msoft-float
 KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 78decc3e3067..38276f58d3bf 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -942,12 +942,8 @@ static const __initconst struct x86_cpu_id cpu_no_meltdown[] = {
        {}
 };
+/* Only list CPUs which speculate but are non susceptible to SSB */
 static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
-        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_PINEVIEW        },
-        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_LINCROFT        },
-        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_PENWELL         },
-        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_CLOVERVIEW      },
-        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_CEDARVIEW       },
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_SILVERMONT1     },
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_AIRMONT         },
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_ATOM_SILVERMONT2     },
@@ -955,14 +951,10 @@ static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_CORE_YONAH           },
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_XEON_PHI_KNL         },
        { X86_VENDOR_INTEL,     6,      INTEL_FAM6_XEON_PHI_KNM         },
-        { X86_VENDOR_CENTAUR,   5,                                      },
-        { X86_VENDOR_INTEL,     5,                                      },
-        { X86_VENDOR_NSC,       5,                                      },
        { X86_VENDOR_AMD,       0x12,                                   },
        { X86_VENDOR_AMD,       0x11,                                   },
        { X86_VENDOR_AMD,       0x10,                                   },
        { X86_VENDOR_AMD,       0xf,                                    },
-        { X86_VENDOR_ANY,       4,                                      },
        {}
 };
@@ -970,6 +962,12 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 {
        u64 ia32_cap = 0;
+        if (x86_match_cpu(cpu_no_speculation))
+                return;
+        setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+        setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
        if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
                rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
@@ -977,12 +975,6 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
           !(ia32_cap & ARCH_CAP_SSB_NO))
                setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
-        if (x86_match_cpu(cpu_no_speculation))
-                return;
-        setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
-        setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
        if (x86_match_cpu(cpu_no_meltdown))
                return;
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index ced851169730..92bf2f2e7cdd 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -407,8 +407,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
        /* cpuid 7.0.edx*/
        const u32 kvm_cpuid_7_0_edx_x86_features =
-                F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) | F(SSBD) |
+                F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
-                F(ARCH_CAPABILITIES);
+                F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES);
        /* all calls to cpuid_count() should be made on the same cpu */
        get_cpu();
@@ -495,6 +495,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                                entry->ecx &= ~F(PKU);
                        entry->edx &= kvm_cpuid_7_0_edx_x86_features;
                        cpuid_mask(&entry->edx, CPUID_7_EDX);
+                        /*
+                         * We emulate ARCH_CAPABILITIES in software even
+                         * if the host doesn't support it.
+                         */
+                        entry->edx |= F(ARCH_CAPABILITIES);
                } else {
                        entry->ebx = 0;
                        entry->ecx = 0;
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 5708e951a5c6..46ff64da44ca 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1260,14 +1260,18 @@ static void kvm_hv_hypercall_set_result(struct kvm_vcpu *vcpu, u64 result)
        }
 }
-static int kvm_hv_hypercall_complete_userspace(struct kvm_vcpu *vcpu)
+static int kvm_hv_hypercall_complete(struct kvm_vcpu *vcpu, u64 result)
 {
-        struct kvm_run *run = vcpu->run;
+        kvm_hv_hypercall_set_result(vcpu, result);
+        ++vcpu->stat.hypercalls;
-        kvm_hv_hypercall_set_result(vcpu, run->hyperv.u.hcall.result);
        return kvm_skip_emulated_instruction(vcpu);
 }
+static int kvm_hv_hypercall_complete_userspace(struct kvm_vcpu *vcpu)
+{
+        return kvm_hv_hypercall_complete(vcpu, vcpu->run->hyperv.u.hcall.result);
+}
 static u16 kvm_hvcall_signal_event(struct kvm_vcpu *vcpu, bool fast, u64 param)
 {
        struct eventfd_ctx *eventfd;
@@ -1350,7 +1354,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
        /* Hypercall continuation is not supported yet */
        if (rep_cnt || rep_idx) {
                ret = HV_STATUS_INVALID_HYPERCALL_CODE;
-                goto set_result;
+                goto out;
        }
        switch (code) {
@@ -1381,9 +1385,8 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
                break;
        }
-set_result:
+out:
-        kvm_hv_hypercall_set_result(vcpu, ret);
+        return kvm_hv_hypercall_complete(vcpu, ret);
-        return 1;
 }
 void kvm_hv_init_vm(struct kvm *kvm)
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index b74c9c1405b9..3773c4625114 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1522,11 +1522,23 @@ static bool set_target_expiration(struct kvm_lapic *apic)
 static void advance_periodic_target_expiration(struct kvm_lapic *apic)
 {
-        apic->lapic_timer.tscdeadline +=
+        ktime_t now = ktime_get();
-                nsec_to_cycles(apic->vcpu, apic->lapic_timer.period);
+        u64 tscl = rdtsc();
+        ktime_t delta;
+        /*
+         * Synchronize both deadlines to the same time source or
+         * differences in the periods (caused by differences in the
+         * underlying clocks or numerical approximation errors) will
+         * cause the two to drift apart over time as the errors
+         * accumulate.
+         */
        apic->lapic_timer.target_expiration =
                ktime_add_ns(apic->lapic_timer.target_expiration,
                                apic->lapic_timer.period);
+        delta = ktime_sub(apic->lapic_timer.target_expiration, now);
+        apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) +
+                nsec_to_cycles(apic->vcpu, delta);
 }
 static void start_sw_period(struct kvm_lapic *apic)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 22a183aac1c6..71e7cda6d014 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6671,11 +6671,8 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
        unsigned long nr, a0, a1, a2, a3, ret;
        int op_64_bit;
-        if (kvm_hv_hypercall_enabled(vcpu->kvm)) {
+        if (kvm_hv_hypercall_enabled(vcpu->kvm))
-                if (!kvm_hv_hypercall(vcpu))
+                return kvm_hv_hypercall(vcpu);
-                        return 0;
-                goto out;
-        }
        nr = kvm_register_read(vcpu, VCPU_REGS_RAX);
        a0 = kvm_register_read(vcpu, VCPU_REGS_RBX);
@@ -6696,7 +6693,7 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
        if (kvm_x86_ops->get_cpl(vcpu) != 0) {
                ret = -KVM_EPERM;
-                goto out_error;
+                goto out;
        }
        switch (nr) {
@@ -6716,12 +6713,11 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
                ret = -KVM_ENOSYS;
                break;
        }
-out_error:
+out:
        if (!op_64_bit)
                ret = (u32)ret;
        kvm_register_write(vcpu, VCPU_REGS_RAX, ret);
-out:
        ++vcpu->stat.hypercalls;
        return kvm_skip_emulated_instruction(vcpu);
 }
@@ -7980,6 +7976,7 @@ static int __set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
 {
        struct msr_data apic_base_msr;
        int mmu_reset_needed = 0;
+        int cpuid_update_needed = 0;
        int pending_vec, max_bits, idx;
        struct desc_ptr dt;
        int ret = -EINVAL;
@@ -8018,8 +8015,10 @@ static int __set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
        vcpu->arch.cr0 = sregs->cr0;
        mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4;
+        cpuid_update_needed |= ((kvm_read_cr4(vcpu) ^ sregs->cr4) &
+                                (X86_CR4_OSXSAVE | X86_CR4_PKE));
        kvm_x86_ops->set_cr4(vcpu, sregs->cr4);
-        if (sregs->cr4 & (X86_CR4_OSXSAVE | X86_CR4_PKE))
+        if (cpuid_update_needed)
                kvm_update_cpuid(vcpu);
        idx = srcu_read_lock(&vcpu->kvm->srcu);
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 9c9a22958717..a8d2eb0ceb8d 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1151,8 +1151,8 @@ static void eprom_get_byte(struct zatm_dev *zatm_dev, unsigned char *byte,
 }
-static unsigned char eprom_try_esi(struct atm_dev *dev, unsigned short cmd,
+static int eprom_try_esi(struct atm_dev *dev, unsigned short cmd, int offset,
-                                   int offset, int swap)
+                         int swap)
 {
        unsigned char buf[ZEPROM_SIZE];
        struct zatm_dev *zatm_dev;
diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index d4a81be0d7d2..b6be62025325 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -152,8 +152,8 @@ static int eip197_load_firmwares(struct safexcel_crypto_priv *priv)
               EIP197_PE_ICE_SCRATCH_CTRL_CHANGE_ACCESS;
        writel(val, EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_CTRL);
-        memset(EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_RAM, 0,
+        memset_io(EIP197_PE(priv) + EIP197_PE_ICE_SCRATCH_RAM, 0,
-               EIP197_NUM_OF_SCRATCH_BLOCKS * sizeof(u32));
+                  EIP197_NUM_OF_SCRATCH_BLOCKS * sizeof(u32));
        eip197_write_firmware(priv, fw[FW_IFPP], EIP197_PE_ICE_FPP_CTRL,
                              EIP197_PE_ICE_RAM_CTRL_FPP_PROG_EN);
diff --git a/drivers/firmware/qcom_scm-32.c b/drivers/firmware/qcom_scm-32.c
index dfbd894d5bb7..4e24e591ae74 100644
--- a/drivers/firmware/qcom_scm-32.c
+++ b/drivers/firmware/qcom_scm-32.c
@@ -147,7 +147,7 @@ static u32 smc(u32 cmd_addr)
                        "smc    #0      @ switch to secure world\n"
                        : "=r" (r0)
                        : "r" (r0), "r" (r1), "r" (r2)
-                        : "r3");
+                        : "r3", "r12");
        } while (r0 == QCOM_SCM_INTERRUPTED);
        return r0;
@@ -263,7 +263,7 @@ static s32 qcom_scm_call_atomic1(u32 svc, u32 cmd, u32 arg1)
                        "smc    #0      @ switch to secure world\n"
                        : "=r" (r0)
                        : "r" (r0), "r" (r1), "r" (r2)
-                        : "r3");
+                        : "r3", "r12");
        return r0;
 }
@@ -298,7 +298,7 @@ static s32 qcom_scm_call_atomic2(u32 svc, u32 cmd, u32 arg1, u32 arg2)
                        "smc    #0      @ switch to secure world\n"
                        : "=r" (r0)
                        : "r" (r0), "r" (r1), "r" (r2), "r" (r3)
-                        );
+                        : "r12");
        return r0;
 }
@@ -328,7 +328,7 @@ u32 qcom_scm_get_version(void)
                        "smc    #0      @ switch to secure world\n"
                        : "=r" (r0), "=r" (r1)
                        : "r" (r0), "r" (r1)
-                        : "r2", "r3");
+                        : "r2", "r3", "r12");
        } while (r0 == QCOM_SCM_INTERRUPTED);
        version = r1;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 1dd1142246c2..27579443cdc5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4555,8 +4555,8 @@ static int dm_update_crtcs_state(struct dc *dc,
        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
                struct amdgpu_crtc *acrtc = NULL;
                struct amdgpu_dm_connector *aconnector = NULL;
-                struct drm_connector_state *new_con_state = NULL;
+                struct drm_connector_state *drm_new_conn_state = NULL, *drm_old_conn_state = NULL;
-                struct dm_connector_state *dm_conn_state = NULL;
+                struct dm_connector_state *dm_new_conn_state = NULL, *dm_old_conn_state = NULL;
                struct drm_plane_state *new_plane_state = NULL;
                new_stream = NULL;
@@ -4577,19 +4577,23 @@ static int dm_update_crtcs_state(struct dc *dc,
                /* TODO This hack should go away */
                if (aconnector && enable) {
                        // Make sure fake sink is created in plug-in scenario
-                        new_con_state = drm_atomic_get_connector_state(state,
+                        drm_new_conn_state = drm_atomic_get_new_connector_state(state,
                                                                    &aconnector->base);
+                        drm_old_conn_state = drm_atomic_get_old_connector_state(state,
+                                                                    &aconnector->base);
-                        if (IS_ERR(new_con_state)) {
-                                ret = PTR_ERR_OR_ZERO(new_con_state);
+                        if (IS_ERR(drm_new_conn_state)) {
+                                ret = PTR_ERR_OR_ZERO(drm_new_conn_state);
                                break;
                        }
-                        dm_conn_state = to_dm_connector_state(new_con_state);
+                        dm_new_conn_state = to_dm_connector_state(drm_new_conn_state);
+                        dm_old_conn_state = to_dm_connector_state(drm_old_conn_state);
                        new_stream = create_stream_for_sink(aconnector,
                                                             &new_crtc_state->mode,
-                                                            dm_conn_state);
+                                                            dm_new_conn_state);
                        /*
                         * we can have no stream on ACTION_SET if a display
@@ -4695,20 +4699,30 @@ next_crtc:
                 * We want to do dc stream updates that do not require a
                 * full modeset below.
                 */
-                if (!enable || !aconnector || modereset_required(new_crtc_state))
+                if (!(enable && aconnector && new_crtc_state->enable &&
+                      new_crtc_state->active))
                        continue;
                /*
                 * Given above conditions, the dc state cannot be NULL because:
-                 * 1. We're attempting to enable a CRTC. Which has a...
+                 * 1. We're in the process of enabling CRTCs (just been added
-                 * 2. Valid connector attached, and
+                 *    to the dc context, or already is on the context)
-                 * 3. User does not want to reset it (disable or mark inactive,
+                 * 2. Has a valid connector attached, and
-                 *    which can happen on a CRTC that's already disabled).
+                 * 3. Is currently active and enabled.
-                 * => It currently exists.
+                 * => The dc stream state currently exists.
                 */
                BUG_ON(dm_new_crtc_state->stream == NULL);
-                /* Color managment settings */
+                /* Scaling or underscan settings */
-                if (dm_new_crtc_state->base.color_mgmt_changed) {
+                if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state))
+                        update_stream_scaling_settings(
+                                &new_crtc_state->mode, dm_new_conn_state, dm_new_crtc_state->stream);
+                /*
+                 * Color management settings. We also update color properties
+                 * when a modeset is needed, to ensure it gets reprogrammed.
+                 */
+                if (dm_new_crtc_state->base.color_mgmt_changed ||
+                    drm_atomic_crtc_needs_modeset(new_crtc_state)) {
                        ret = amdgpu_dm_set_regamma_lut(dm_new_crtc_state);
                        if (ret)
                                goto fail;
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
index ec8d0006ef7c..3c136f2b954f 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
@@ -2077,7 +2077,7 @@ static irqreturn_t dw_hdmi_hardirq(int irq, void *dev_id)
        return ret;
 }
-void __dw_hdmi_setup_rx_sense(struct dw_hdmi *hdmi, bool hpd, bool rx_sense)
+void dw_hdmi_setup_rx_sense(struct dw_hdmi *hdmi, bool hpd, bool rx_sense)
 {
        mutex_lock(&hdmi->mutex);
@@ -2103,13 +2103,6 @@ void __dw_hdmi_setup_rx_sense(struct dw_hdmi *hdmi, bool hpd, bool rx_sense)
        }
        mutex_unlock(&hdmi->mutex);
 }
-void dw_hdmi_setup_rx_sense(struct device *dev, bool hpd, bool rx_sense)
-{
-        struct dw_hdmi *hdmi = dev_get_drvdata(dev);
-        __dw_hdmi_setup_rx_sense(hdmi, hpd, rx_sense);
-}
 EXPORT_SYMBOL_GPL(dw_hdmi_setup_rx_sense);
 static irqreturn_t dw_hdmi_irq(int irq, void *dev_id)
@@ -2145,9 +2138,9 @@ static irqreturn_t dw_hdmi_irq(int irq, void *dev_id)
         */
        if (intr_stat &
            (HDMI_IH_PHY_STAT0_RX_SENSE | HDMI_IH_PHY_STAT0_HPD)) {
-                __dw_hdmi_setup_rx_sense(hdmi,
+                dw_hdmi_setup_rx_sense(hdmi,
-                                         phy_stat & HDMI_PHY_HPD,
+                                       phy_stat & HDMI_PHY_HPD,
-                                         phy_stat & HDMI_PHY_RX_SENSE);
+                                       phy_stat & HDMI_PHY_RX_SENSE);
                if ((phy_stat & (HDMI_PHY_RX_SENSE | HDMI_PHY_HPD)) == 0)
                        cec_notifier_set_phys_addr(hdmi->cec_notifier,
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index ffe14ec3e7f2..70ae1f232331 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -1145,6 +1145,7 @@ int drm_dp_psr_setup_time(const u8 psr_cap[EDP_PSR_RECEIVER_CAP_SIZE])
        static const u16 psr_setup_time_us[] = {
                PSR_SETUP_TIME(330),
                PSR_SETUP_TIME(275),
+                PSR_SETUP_TIME(220),
                PSR_SETUP_TIME(165),
                PSR_SETUP_TIME(110),
                PSR_SETUP_TIME(55),
diff --git a/drivers/gpu/drm/i915/i915_query.c b/drivers/gpu/drm/i915/i915_query.c
index 3ace929dd90f..3f502eef2431 100644
--- a/drivers/gpu/drm/i915/i915_query.c
+++ b/drivers/gpu/drm/i915/i915_query.c
@@ -4,6 +4,8 @@
 * Copyright © 2018 Intel Corporation
 */
+#include <linux/nospec.h>
 #include "i915_drv.h"
 #include "i915_query.h"
 #include <uapi/drm/i915_drm.h>
@@ -100,7 +102,7 @@ int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        for (i = 0; i < args->num_items; i++, user_item_ptr++) {
                struct drm_i915_query_item item;
-                u64 func_idx;
+                unsigned long func_idx;
                int ret;
                if (copy_from_user(&item, user_item_ptr, sizeof(item)))
@@ -109,12 +111,17 @@ int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
                if (item.query_id == 0)
                        return -EINVAL;
+                if (overflows_type(item.query_id - 1, unsigned long))
+                        return -EINVAL;
                func_idx = item.query_id - 1;
-                if (func_idx < ARRAY_SIZE(i915_query_funcs))
+                ret = -EINVAL;
+                if (func_idx < ARRAY_SIZE(i915_query_funcs)) {
+                        func_idx = array_index_nospec(func_idx,
+                                                      ARRAY_SIZE(i915_query_funcs));
                        ret = i915_query_funcs[func_idx](dev_priv, &item);
-                else
+                }
-                        ret = -EINVAL;
                /* Only write the length back to userspace if they differ. */
                if (ret != item.length && put_user(ret, &user_item_ptr->length))
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 8691c86f579c..e125d16a1aa7 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -574,6 +574,36 @@ exit:
        return NOTIFY_OK;
 }
+static int
+intel_lvds_connector_register(struct drm_connector *connector)
+{
+        struct intel_lvds_connector *lvds = to_lvds_connector(connector);
+        int ret;
+        ret = intel_connector_register(connector);
+        if (ret)
+                return ret;
+        lvds->lid_notifier.notifier_call = intel_lid_notify;
+        if (acpi_lid_notifier_register(&lvds->lid_notifier)) {
+                DRM_DEBUG_KMS("lid notifier registration failed\n");
+                lvds->lid_notifier.notifier_call = NULL;
+        }
+        return 0;
+}
+static void
+intel_lvds_connector_unregister(struct drm_connector *connector)
+{
+        struct intel_lvds_connector *lvds = to_lvds_connector(connector);
+        if (lvds->lid_notifier.notifier_call)
+                acpi_lid_notifier_unregister(&lvds->lid_notifier);
+        intel_connector_unregister(connector);
+}
 /**
 * intel_lvds_destroy - unregister and free LVDS structures
 * @connector: connector to free
@@ -586,9 +616,6 @@ static void intel_lvds_destroy(struct drm_connector *connector)
        struct intel_lvds_connector *lvds_connector =
                to_lvds_connector(connector);
-        if (lvds_connector->lid_notifier.notifier_call)
-                acpi_lid_notifier_unregister(&lvds_connector->lid_notifier);
        if (!IS_ERR_OR_NULL(lvds_connector->base.edid))
                kfree(lvds_connector->base.edid);
@@ -609,8 +636,8 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = {
        .fill_modes = drm_helper_probe_single_connector_modes,
        .atomic_get_property = intel_digital_connector_atomic_get_property,
        .atomic_set_property = intel_digital_connector_atomic_set_property,
-        .late_register = intel_connector_register,
+        .late_register = intel_lvds_connector_register,
-        .early_unregister = intel_connector_unregister,
+        .early_unregister = intel_lvds_connector_unregister,
        .destroy = intel_lvds_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
        .atomic_duplicate_state = intel_digital_connector_duplicate_state,
@@ -827,6 +854,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                        DMI_EXACT_MATCH(DMI_BOARD_NAME, "D525MW"),
                },
        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Radiant P845",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Radiant Systems Inc"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P845"),
+                },
+        },
        { }     /* terminating entry */
 };
@@ -1150,12 +1185,6 @@ out:
        lvds_encoder->a3_power = lvds & LVDS_A3_POWER_MASK;
-        lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
-        if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
-                DRM_DEBUG_KMS("lid notifier registration failed\n");
-                lvds_connector->lid_notifier.notifier_call = NULL;
-        }
        return;
 failed:
diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
index a393095aac1a..c9ad45686e7a 100644
--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
+++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
@@ -529,7 +529,7 @@ static irqreturn_t dw_hdmi_top_thread_irq(int irq, void *dev_id)
                if (stat & HDMITX_TOP_INTR_HPD_RISE)
                        hpd_connected = true;
-                dw_hdmi_setup_rx_sense(dw_hdmi->dev, hpd_connected,
+                dw_hdmi_setup_rx_sense(dw_hdmi->hdmi, hpd_connected,
                                       hpd_connected);
                drm_helper_hpd_irq_event(dw_hdmi->encoder.dev);
diff --git a/drivers/gpu/drm/omapdrm/dss/sdi.c b/drivers/gpu/drm/omapdrm/dss/sdi.c
index 68a40ae26f5b..1e2c931f6acf 100644
--- a/drivers/gpu/drm/omapdrm/dss/sdi.c
+++ b/drivers/gpu/drm/omapdrm/dss/sdi.c
@@ -82,7 +82,7 @@ static int sdi_calc_clock_div(struct sdi_device *sdi, unsigned long pclk,
                              struct dispc_clock_info *dispc_cinfo)
 {
        int i;
-        struct sdi_clk_calc_ctx ctx = { .sdi = sdi };
+        struct sdi_clk_calc_ctx ctx;
        /*
         * DSS fclk gives us very few possibilities, so finding a good pixel
@@ -95,6 +95,9 @@ static int sdi_calc_clock_div(struct sdi_device *sdi, unsigned long pclk,
                bool ok;
                memset(&ctx, 0, sizeof(ctx));
+                ctx.sdi = sdi;
                if (pclk > 1000 * i * i * i)
                        ctx.pck_min = max(pclk - 1000 * i * i * i, 0lu);
                else
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index ede388309376..634f58042c77 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -733,8 +733,8 @@ err_nomem:
                /* Reset the page to write-back before releasing */
                set_memory_wb((unsigned long)win->block[i].bdesc, 1);
 #endif
-                dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc,
+                dma_free_coherent(msc_dev(msc)->parent->parent, size,
-                                  win->block[i].addr);
+                                  win->block[i].bdesc, win->block[i].addr);
        }
        kfree(win);
@@ -769,7 +769,7 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win)
                /* Reset the page to write-back before releasing */
                set_memory_wb((unsigned long)win->block[i].bdesc, 1);
 #endif
-                dma_free_coherent(msc_dev(win->msc), PAGE_SIZE,
+                dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE,
                                  win->block[i].bdesc, win->block[i].addr);
        }
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 05386b76465e..10bcb5d73f90 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -19,6 +19,7 @@
 #include <linux/stm.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
+#include <linux/vmalloc.h>
 #include "stm.h"
 #include <uapi/linux/stm.h>
@@ -674,7 +675,7 @@ static void stm_device_release(struct device *dev)
 {
        struct stm_device *stm = to_stm_device(dev);
-        kfree(stm);
+        vfree(stm);
 }
 int stm_register_device(struct device *parent, struct stm_data *stm_data,
@@ -691,7 +692,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
                return -EINVAL;
        nmasters = stm_data->sw_end - stm_data->sw_start + 1;
-        stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL);
+        stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *));
        if (!stm)
                return -ENOMEM;
@@ -744,7 +745,7 @@ err_device:
        /* matches device_initialize() above */
        put_device(&stm->dev);
 err_free:
-        kfree(stm);
+        vfree(stm);
        return err;
 }
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index 8c42ca7107b2..45ae3c025bf6 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -1,6 +1,6 @@
 /*
 * i2c-ocores.c: I2C bus driver for OpenCores I2C controller
- * (http://www.opencores.org/projects.cgi/web/i2c/overview).
+ * (https://opencores.org/project/i2c/overview)
 *
 * Peter Korsgaard <jacmet@sunsite.dk>
 *
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 15606f237480..9da79070357c 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -158,6 +158,7 @@ config AT91_SAMA5D2_ADC
        depends on ARCH_AT91 || COMPILE_TEST
        depends on HAS_IOMEM
        depends on HAS_DMA
+        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
        help
          Say yes here to build support for Atmel SAMA5D2 ADC which is
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index 801afb61310b..d4bbe5b53318 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avail[16] = {0, 470, 242, 123, 62, 50, 39,
 static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0,
                                        33, 0, 17, 16, 12, 10, 8, 6, 4};
-static ssize_t ad7793_read_frequency(struct device *dev,
-                struct device_attribute *attr,
-                char *buf)
-{
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-        struct ad7793_state *st = iio_priv(indio_dev);
-        return sprintf(buf, "%d\n",
-               st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]);
-}
-static ssize_t ad7793_write_frequency(struct device *dev,
-                struct device_attribute *attr,
-                const char *buf,
-                size_t len)
-{
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-        struct ad7793_state *st = iio_priv(indio_dev);
-        long lval;
-        int i, ret;
-        ret = kstrtol(buf, 10, &lval);
-        if (ret)
-                return ret;
-        if (lval == 0)
-                return -EINVAL;
-        for (i = 0; i < 16; i++)
-                if (lval == st->chip_info->sample_freq_avail[i])
-                        break;
-        if (i == 16)
-                return -EINVAL;
-        ret = iio_device_claim_direct_mode(indio_dev);
-        if (ret)
-                return ret;
-        st->mode &= ~AD7793_MODE_RATE(-1);
-        st->mode |= AD7793_MODE_RATE(i);
-        ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode);
-        iio_device_release_direct_mode(indio_dev);
-        return len;
-}
-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO,
-                ad7793_read_frequency,
-                ad7793_write_frequency);
 static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
        "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4");
@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_scale_available,
                ad7793_show_scale_available, NULL, 0);
 static struct attribute *ad7793_attributes[] = {
-        &iio_dev_attr_sampling_frequency.dev_attr.attr,
        &iio_const_attr_sampling_frequency_available.dev_attr.attr,
        &iio_dev_attr_in_m_in_scale_available.dev_attr.attr,
        NULL
@@ -435,7 +385,6 @@ static const struct attribute_group ad7793_attribute_group = {
 };
 static struct attribute *ad7797_attributes[] = {
-        &iio_dev_attr_sampling_frequency.dev_attr.attr,
        &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr,
        NULL
 };
@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_dev *indio_dev,
                        *val -= offset;
                }
                return IIO_VAL_INT;
+        case IIO_CHAN_INFO_SAMP_FREQ:
+                *val = st->chip_info
+                               ->sample_freq_avail[AD7793_MODE_RATE(st->mode)];
+                return IIO_VAL_INT;
        }
        return -EINVAL;
 }
@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_dev *indio_dev,
                                break;
                        }
                break;
+        case IIO_CHAN_INFO_SAMP_FREQ:
+                if (!val) {
+                        ret = -EINVAL;
+                        break;
+                }
+                for (i = 0; i < 16; i++)
+                        if (val == st->chip_info->sample_freq_avail[i])
+                                break;
+                if (i == 16) {
+                        ret = -EINVAL;
+                        break;
+                }
+                st->mode &= ~AD7793_MODE_RATE(-1);
+                st->mode |= AD7793_MODE_RATE(i);
+                ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode),
+                                st->mode);
+                break;
        default:
                ret = -EINVAL;
        }
diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index 4eff8351ce29..8729d6524b4d 100644
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -333,6 +333,27 @@ static const struct iio_chan_spec at91_adc_channels[] = {
                                + AT91_SAMA5D2_DIFF_CHAN_CNT + 1),
 };
+static int at91_adc_chan_xlate(struct iio_dev *indio_dev, int chan)
+{
+        int i;
+        for (i = 0; i < indio_dev->num_channels; i++) {
+                if (indio_dev->channels[i].scan_index == chan)
+                        return i;
+        }
+        return -EINVAL;
+}
+static inline struct iio_chan_spec const *
+at91_adc_chan_get(struct iio_dev *indio_dev, int chan)
+{
+        int index = at91_adc_chan_xlate(indio_dev, chan);
+        if (index < 0)
+                return NULL;
+        return indio_dev->channels + index;
+}
 static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
 {
        struct iio_dev *indio = iio_trigger_get_drvdata(trig);
@@ -350,8 +371,10 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
        at91_adc_writel(st, AT91_SAMA5D2_TRGR, status);
        for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
-                struct iio_chan_spec const *chan = indio->channels + bit;
+                struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
+                if (!chan)
+                        continue;
                if (state) {
                        at91_adc_writel(st, AT91_SAMA5D2_CHER,
                                        BIT(chan->channel));
@@ -448,7 +471,11 @@ static int at91_adc_dma_start(struct iio_dev *indio_dev)
        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->num_channels) {
-                struct iio_chan_spec const *chan = indio_dev->channels + bit;
+                struct iio_chan_spec const *chan =
+                                         at91_adc_chan_get(indio_dev, bit);
+                if (!chan)
+                        continue;
                st->dma_st.rx_buf_sz += chan->scan_type.storagebits / 8;
        }
@@ -526,8 +553,11 @@ static int at91_adc_buffer_predisable(struct iio_dev *indio_dev)
         */
        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->num_channels) {
-                struct iio_chan_spec const *chan = indio_dev->channels + bit;
+                struct iio_chan_spec const *chan =
+                                        at91_adc_chan_get(indio_dev, bit);
+                if (!chan)
+                        continue;
                if (st->dma_st.dma_chan)
                        at91_adc_readl(st, chan->address);
        }
@@ -587,8 +617,11 @@ static void at91_adc_trigger_handler_nodma(struct iio_dev *indio_dev,
        for_each_set_bit(bit, indio_dev->active_scan_mask,
                         indio_dev->num_channels) {
-                struct iio_chan_spec const *chan = indio_dev->channels + bit;
+                struct iio_chan_spec const *chan =
+                                        at91_adc_chan_get(indio_dev, bit);
+                if (!chan)
+                        continue;
                st->buffer[i] = at91_adc_readl(st, chan->address);
                i++;
        }
diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
index 01422d11753c..b28a716a23b2 100644
--- a/drivers/iio/adc/stm32-dfsdm-adc.c
+++ b/drivers/iio/adc/stm32-dfsdm-adc.c
@@ -144,6 +144,7 @@ static int stm32_dfsdm_set_osrs(struct stm32_dfsdm_filter *fl,
         * Leave as soon as if exact resolution if reached.
         * Otherwise the higher resolution below 32 bits is kept.
         */
+        fl->res = 0;
        for (fosr = 1; fosr <= DFSDM_MAX_FL_OVERSAMPLING; fosr++) {
                for (iosr = 1; iosr <= DFSDM_MAX_INT_OVERSAMPLING; iosr++) {
                        if (fast)
@@ -193,7 +194,7 @@ static int stm32_dfsdm_set_osrs(struct stm32_dfsdm_filter *fl,
                }
        }
-        if (!fl->fosr)
+        if (!fl->res)
                return -EINVAL;
        return 0;
@@ -770,7 +771,7 @@ static int stm32_dfsdm_write_raw(struct iio_dev *indio_dev,
        struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
        struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
        struct stm32_dfsdm_channel *ch = &adc->dfsdm->ch_list[chan->channel];
-        unsigned int spi_freq = adc->spi_freq;
+        unsigned int spi_freq;
        int ret = -EINVAL;
        switch (mask) {
@@ -784,8 +785,18 @@ static int stm32_dfsdm_write_raw(struct iio_dev *indio_dev,
        case IIO_CHAN_INFO_SAMP_FREQ:
                if (!val)
                        return -EINVAL;
-                if (ch->src != DFSDM_CHANNEL_SPI_CLOCK_EXTERNAL)
+                switch (ch->src) {
+                case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL:
                        spi_freq = adc->dfsdm->spi_master_freq;
+                        break;
+                case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_FALLING:
+                case DFSDM_CHANNEL_SPI_CLOCK_INTERNAL_DIV2_RISING:
+                        spi_freq = adc->dfsdm->spi_master_freq / 2;
+                        break;
+                default:
+                        spi_freq = adc->spi_freq;
+                }
                if (spi_freq % val)
                        dev_warn(&indio_dev->dev,
diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c
index 05e0c353e089..b32bf57910ca 100644
--- a/drivers/iio/buffer/industrialio-buffer-dma.c
+++ b/drivers/iio/buffer/industrialio-buffer-dma.c
@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_bytes_per_datum);
 * Should be used as the set_length callback for iio_buffer_access_ops
 * struct for DMA buffers.
 */
-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length)
+int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length)
 {
        /* Avoid an invalid state */
        if (length < 2)
diff --git a/drivers/iio/buffer/kfifo_buf.c b/drivers/iio/buffer/kfifo_buf.c
index 047fe757ab97..70c302a93d7f 100644
--- a/drivers/iio/buffer/kfifo_buf.c
+++ b/drivers/iio/buffer/kfifo_buf.c
@@ -22,11 +22,18 @@ struct iio_kfifo {
 #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer)
 static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
-                                int bytes_per_datum, int length)
+                        size_t bytes_per_datum, unsigned int length)
 {
        if ((length == 0) || (bytes_per_datum == 0))
                return -EINVAL;
+        /*
+         * Make sure we don't overflow an unsigned int after kfifo rounds up to
+         * the next power of 2.
+         */
+        if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum)
+                return -EINVAL;
        return __kfifo_alloc((struct __kfifo *)&buf->kf, length,
                             bytes_per_datum, GFP_KERNEL);
 }
@@ -67,7 +74,7 @@ static int iio_set_bytes_per_datum_kfifo(struct iio_buffer *r, size_t bpd)
        return 0;
 }
-static int iio_set_length_kfifo(struct iio_buffer *r, int length)
+static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length)
 {
        /* Avoid an invalid state */
        if (length < 2)
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index cfb6588565ba..4905a997a7ec 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -178,14 +178,14 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 #ifdef CONFIG_PM
        int ret;
-        atomic_set(&st->user_requested_state, state);
        if (atomic_add_unless(&st->runtime_pm_enable, 1, 1))
                pm_runtime_enable(&st->pdev->dev);
-        if (state)
+        if (state) {
+                atomic_inc(&st->user_requested_state);
                ret = pm_runtime_get_sync(&st->pdev->dev);
-        else {
+        } else {
+                atomic_dec(&st->user_requested_state);
                pm_runtime_mark_last_busy(&st->pdev->dev);
                pm_runtime_use_autosuspend(&st->pdev->dev);
                ret = pm_runtime_put_autosuspend(&st->pdev->dev);
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index fb2d347f760f..ecc55e98ddd3 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -502,7 +502,7 @@ static int __ib_cache_gid_get(struct ib_device *ib_dev, u8 port, int index,
                return -EINVAL;
        if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID)
-                return -EAGAIN;
+                return -EINVAL;
        memcpy(gid, &table->data_vec[index].gid, sizeof(*gid));
        if (attr) {
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index f6c739ec8b62..20b9f31052bf 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -185,12 +185,65 @@ static void bnxt_re_shutdown(void *p)
        bnxt_re_ib_unreg(rdev, false);
 }
+static void bnxt_re_stop_irq(void *handle)
+{
+        struct bnxt_re_dev *rdev = (struct bnxt_re_dev *)handle;
+        struct bnxt_qplib_rcfw *rcfw = &rdev->rcfw;
+        struct bnxt_qplib_nq *nq;
+        int indx;
+        for (indx = BNXT_RE_NQ_IDX; indx < rdev->num_msix; indx++) {
+                nq = &rdev->nq[indx - 1];
+                bnxt_qplib_nq_stop_irq(nq, false);
+        }
+        bnxt_qplib_rcfw_stop_irq(rcfw, false);
+}
+static void bnxt_re_start_irq(void *handle, struct bnxt_msix_entry *ent)
+{
+        struct bnxt_re_dev *rdev = (struct bnxt_re_dev *)handle;
+        struct bnxt_msix_entry *msix_ent = rdev->msix_entries;
+        struct bnxt_qplib_rcfw *rcfw = &rdev->rcfw;
+        struct bnxt_qplib_nq *nq;
+        int indx, rc;
+        if (!ent) {
+                /* Not setting the f/w timeout bit in rcfw.
+                 * During the driver unload the first command
+                 * to f/w will timeout and that will set the
+                 * timeout bit.
+                 */
+                dev_err(rdev_to_dev(rdev), "Failed to re-start IRQs\n");
+                return;
+        }
+        /* Vectors may change after restart, so update with new vectors
+         * in device sctructure.
+         */
+        for (indx = 0; indx < rdev->num_msix; indx++)
+                rdev->msix_entries[indx].vector = ent[indx].vector;
+        bnxt_qplib_rcfw_start_irq(rcfw, msix_ent[BNXT_RE_AEQ_IDX].vector,
+                                  false);
+        for (indx = BNXT_RE_NQ_IDX ; indx < rdev->num_msix; indx++) {
+                nq = &rdev->nq[indx - 1];
+                rc = bnxt_qplib_nq_start_irq(nq, indx - 1,
+                                             msix_ent[indx].vector, false);
+                if (rc)
+                        dev_warn(rdev_to_dev(rdev),
+                                 "Failed to reinit NQ index %d\n", indx - 1);
+        }
+}
 static struct bnxt_ulp_ops bnxt_re_ulp_ops = {
        .ulp_async_notifier = NULL,
        .ulp_stop = bnxt_re_stop,
        .ulp_start = bnxt_re_start,
        .ulp_sriov_config = bnxt_re_sriov_config,
-        .ulp_shutdown = bnxt_re_shutdown
+        .ulp_shutdown = bnxt_re_shutdown,
+        .ulp_irq_stop = bnxt_re_stop_irq,
+        .ulp_irq_restart = bnxt_re_start_irq
 };
 /* RoCE -> Net driver */
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 3a78faba8d91..50d8f1fc98d5 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -336,22 +336,32 @@ static irqreturn_t bnxt_qplib_nq_irq(int irq, void *dev_instance)
        return IRQ_HANDLED;
 }
+void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill)
+{
+        tasklet_disable(&nq->worker);
+        /* Mask h/w interrupt */
+        NQ_DB(nq->bar_reg_iomem, nq->hwq.cons, nq->hwq.max_elements);
+        /* Sync with last running IRQ handler */
+        synchronize_irq(nq->vector);
+        if (kill)
+                tasklet_kill(&nq->worker);
+        if (nq->requested) {
+                irq_set_affinity_hint(nq->vector, NULL);
+                free_irq(nq->vector, nq);
+                nq->requested = false;
+        }
+}
 void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
 {
        if (nq->cqn_wq) {
                destroy_workqueue(nq->cqn_wq);
                nq->cqn_wq = NULL;
        }
        /* Make sure the HW is stopped! */
-        synchronize_irq(nq->vector);
+        bnxt_qplib_nq_stop_irq(nq, true);
-        tasklet_disable(&nq->worker);
-        tasklet_kill(&nq->worker);
-        if (nq->requested) {
-                irq_set_affinity_hint(nq->vector, NULL);
-                free_irq(nq->vector, nq);
-                nq->requested = false;
-        }
        if (nq->bar_reg_iomem)
                iounmap(nq->bar_reg_iomem);
        nq->bar_reg_iomem = NULL;
@@ -361,6 +371,40 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
        nq->vector = 0;
 }
+int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+                            int msix_vector, bool need_init)
+{
+        int rc;
+        if (nq->requested)
+                return -EFAULT;
+        nq->vector = msix_vector;
+        if (need_init)
+                tasklet_init(&nq->worker, bnxt_qplib_service_nq,
+                             (unsigned long)nq);
+        else
+                tasklet_enable(&nq->worker);
+        snprintf(nq->name, sizeof(nq->name), "bnxt_qplib_nq-%d", nq_indx);
+        rc = request_irq(nq->vector, bnxt_qplib_nq_irq, 0, nq->name, nq);
+        if (rc)
+                return rc;
+        cpumask_clear(&nq->mask);
+        cpumask_set_cpu(nq_indx, &nq->mask);
+        rc = irq_set_affinity_hint(nq->vector, &nq->mask);
+        if (rc) {
+                dev_warn(&nq->pdev->dev,
+                         "QPLIB: set affinity failed; vector: %d nq_idx: %d\n",
+                         nq->vector, nq_indx);
+        }
+        nq->requested = true;
+        NQ_DB_REARM(nq->bar_reg_iomem, nq->hwq.cons, nq->hwq.max_elements);
+        return rc;
+}
 int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq,
                         int nq_idx, int msix_vector, int bar_reg_offset,
                         int (*cqn_handler)(struct bnxt_qplib_nq *nq,
@@ -372,41 +416,17 @@ int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq,
        resource_size_t nq_base;
        int rc = -1;
-        nq->pdev = pdev;
-        nq->vector = msix_vector;
        if (cqn_handler)
                nq->cqn_handler = cqn_handler;
        if (srqn_handler)
                nq->srqn_handler = srqn_handler;
-        tasklet_init(&nq->worker, bnxt_qplib_service_nq, (unsigned long)nq);
        /* Have a task to schedule CQ notifiers in post send case */
        nq->cqn_wq  = create_singlethread_workqueue("bnxt_qplib_nq");
        if (!nq->cqn_wq)
-                goto fail;
+                return -ENOMEM;
-        nq->requested = false;
-        memset(nq->name, 0, 32);
-        sprintf(nq->name, "bnxt_qplib_nq-%d", nq_idx);
-        rc = request_irq(nq->vector, bnxt_qplib_nq_irq, 0, nq->name, nq);
-        if (rc) {
-                dev_err(&nq->pdev->dev,
-                        "Failed to request IRQ for NQ: %#x", rc);
-                goto fail;
-        }
-        cpumask_clear(&nq->mask);
-        cpumask_set_cpu(nq_idx, &nq->mask);
-        rc = irq_set_affinity_hint(nq->vector, &nq->mask);
-        if (rc) {
-                dev_warn(&nq->pdev->dev,
-                         "QPLIB: set affinity failed; vector: %d nq_idx: %d\n",
-                         nq->vector, nq_idx);
-        }
-        nq->requested = true;
        nq->bar_reg = NQ_CONS_PCI_BAR_REGION;
        nq->bar_reg_off = bar_reg_offset;
        nq_base = pci_resource_start(pdev, nq->bar_reg);
@@ -419,7 +439,13 @@ int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq,
                rc = -ENOMEM;
                goto fail;
        }
-        NQ_DB_REARM(nq->bar_reg_iomem, nq->hwq.cons, nq->hwq.max_elements);
+        rc = bnxt_qplib_nq_start_irq(nq, nq_idx, msix_vector, true);
+        if (rc) {
+                dev_err(&nq->pdev->dev,
+                        "QPLIB: Failed to request irq for nq-idx %d", nq_idx);
+                goto fail;
+        }
        return 0;
 fail:
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index ade9f13c0fd1..72352ca80ace 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -467,7 +467,10 @@ struct bnxt_qplib_nq_work {
        struct bnxt_qplib_cq    *cq;
 };
+void bnxt_qplib_nq_stop_irq(struct bnxt_qplib_nq *nq, bool kill);
 void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq);
+int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
+                            int msix_vector, bool need_init);
 int bnxt_qplib_enable_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq,
                         int nq_idx, int msix_vector, int bar_reg_offset,
                         int (*cqn_handler)(struct bnxt_qplib_nq *nq,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 80027a494730..2852d350ada1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -582,19 +582,29 @@ fail:
        return -ENOMEM;
 }
-void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
+void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill)
 {
-        unsigned long indx;
-        /* Make sure the HW channel is stopped! */
-        synchronize_irq(rcfw->vector);
        tasklet_disable(&rcfw->worker);
-        tasklet_kill(&rcfw->worker);
+        /* Mask h/w interrupts */
+        CREQ_DB(rcfw->creq_bar_reg_iomem, rcfw->creq.cons,
+                rcfw->creq.max_elements);
+        /* Sync with last running IRQ-handler */
+        synchronize_irq(rcfw->vector);
+        if (kill)
+                tasklet_kill(&rcfw->worker);
        if (rcfw->requested) {
                free_irq(rcfw->vector, rcfw);
                rcfw->requested = false;
        }
+}
+void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
+{
+        unsigned long indx;
+        bnxt_qplib_rcfw_stop_irq(rcfw, true);
        if (rcfw->cmdq_bar_reg_iomem)
                iounmap(rcfw->cmdq_bar_reg_iomem);
        rcfw->cmdq_bar_reg_iomem = NULL;
@@ -614,6 +624,31 @@ void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
        rcfw->vector = 0;
 }
+int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
+                              bool need_init)
+{
+        int rc;
+        if (rcfw->requested)
+                return -EFAULT;
+        rcfw->vector = msix_vector;
+        if (need_init)
+                tasklet_init(&rcfw->worker,
+                             bnxt_qplib_service_creq, (unsigned long)rcfw);
+        else
+                tasklet_enable(&rcfw->worker);
+        rc = request_irq(rcfw->vector, bnxt_qplib_creq_irq, 0,
+                         "bnxt_qplib_creq", rcfw);
+        if (rc)
+                return rc;
+        rcfw->requested = true;
+        CREQ_DB_REARM(rcfw->creq_bar_reg_iomem, rcfw->creq.cons,
+                      rcfw->creq.max_elements);
+        return 0;
+}
 int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
                                   struct bnxt_qplib_rcfw *rcfw,
                                   int msix_vector,
@@ -675,27 +710,17 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
        rcfw->creq_qp_event_processed = 0;
        rcfw->creq_func_event_processed = 0;
-        rcfw->vector = msix_vector;
        if (aeq_handler)
                rcfw->aeq_handler = aeq_handler;
+        init_waitqueue_head(&rcfw->waitq);
-        tasklet_init(&rcfw->worker, bnxt_qplib_service_creq,
+        rc = bnxt_qplib_rcfw_start_irq(rcfw, msix_vector, true);
-                     (unsigned long)rcfw);
-        rcfw->requested = false;
-        rc = request_irq(rcfw->vector, bnxt_qplib_creq_irq, 0,
-                         "bnxt_qplib_creq", rcfw);
        if (rc) {
                dev_err(&rcfw->pdev->dev,
                        "QPLIB: Failed to request IRQ for CREQ rc = 0x%x", rc);
                bnxt_qplib_disable_rcfw_channel(rcfw);
                return rc;
        }
-        rcfw->requested = true;
-        init_waitqueue_head(&rcfw->waitq);
-        CREQ_DB_REARM(rcfw->creq_bar_reg_iomem, 0, rcfw->creq.max_elements);
        init.cmdq_pbl = cpu_to_le64(rcfw->cmdq.pbl[PBL_LVL_0].pg_map_arr[0]);
        init.cmdq_size_cmdq_lvl = cpu_to_le16(
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index c7cce2e4185e..46416dfe8830 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -195,7 +195,10 @@ struct bnxt_qplib_rcfw {
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw);
 int bnxt_qplib_alloc_rcfw_channel(struct pci_dev *pdev,
                                  struct bnxt_qplib_rcfw *rcfw, int qp_tbl_sz);
+void bnxt_qplib_rcfw_stop_irq(struct bnxt_qplib_rcfw *rcfw, bool kill);
 void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw);
+int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
+                              bool need_init);
 int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
                                   struct bnxt_qplib_rcfw *rcfw,
                                   int msix_vector,
diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig
index 25bf6955b6d0..fb8b7182f05e 100644
--- a/drivers/infiniband/ulp/srpt/Kconfig
+++ b/drivers/infiniband/ulp/srpt/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_SRPT
        tristate "InfiniBand SCSI RDMA Protocol target support"
-        depends on INFINIBAND_ADDR_TRANS && TARGET_CORE
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
        ---help---
          Support for the SCSI RDMA Protocol (SRP) Target driver. The
diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index 29f99529b187..cfcb32559925 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -130,7 +130,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client,
                                        bool max_baseline, u8 *value)
 {
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client,
                                          max_baseline ?
@@ -149,7 +149,7 @@ static int elan_smbus_get_version(struct i2c_client *client,
                                  bool iap, u8 *version)
 {
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client,
                                          iap ? ETP_SMBUS_IAP_VERSION_CMD :
@@ -170,7 +170,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
                                     u8 *clickpad)
 {
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client,
                                          ETP_SMBUS_SM_VERSION_CMD, val);
@@ -188,7 +188,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
 static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
 {
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client,
                                          ETP_SMBUS_UNIQUEID_CMD, val);
@@ -205,7 +205,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client,
                                   bool iap, u16 *csum)
 {
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client,
                                          iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
@@ -226,7 +226,7 @@ static int elan_smbus_get_max(struct i2c_client *client,
 {
        int ret;
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
        if (ret != 3) {
@@ -246,7 +246,7 @@ static int elan_smbus_get_resolution(struct i2c_client *client,
 {
        int ret;
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val);
        if (ret != 3) {
@@ -267,7 +267,7 @@ static int elan_smbus_get_num_traces(struct i2c_client *client,
 {
        int ret;
        int error;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val);
        if (ret != 3) {
@@ -294,7 +294,7 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client,
 {
        int error;
        u16 constant;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
        if (error < 0) {
@@ -345,7 +345,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client)
        int len;
        int error;
        enum tp_mode mode;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        u8 cmd[4] = {0x0F, 0x78, 0x00, 0x06};
        u16 password;
@@ -419,7 +419,7 @@ static int elan_smbus_write_fw_block(struct i2c_client *client,
        struct device *dev = &client->dev;
        int error;
        u16 result;
-        u8 val[3];
+        u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
        /*
         * Due to the limitation of smbus protocol limiting
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 60f2c463d1cc..a9591d278145 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -172,6 +172,12 @@ static const char * const smbus_pnp_ids[] = {
        "LEN0048", /* X1 Carbon 3 */
        "LEN0046", /* X250 */
        "LEN004a", /* W541 */
+        "LEN0071", /* T480 */
+        "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+        "LEN0073", /* X1 Carbon G5 (Elantech) */
+        "LEN0092", /* X1 Carbon 6 */
+        "LEN0096", /* X280 */
+        "LEN0097", /* X280 -> ALPS trackpoint */
        "LEN200f", /* T450s */
        NULL
 };
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 9f561fe505cb..db9a80e1ee14 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1768,6 +1768,18 @@ static const struct b53_chip_data b53_switch_chips[] = {
                .duplex_reg = B53_DUPLEX_STAT_FE,
        },
        {
+                .chip_id = BCM5389_DEVICE_ID,
+                .dev_name = "BCM5389",
+                .vlans = 4096,
+                .enabled_ports = 0x1f,
+                .arl_entries = 4,
+                .cpu_port = B53_CPU_PORT,
+                .vta_regs = B53_VTA_REGS,
+                .duplex_reg = B53_DUPLEX_STAT_GE,
+                .jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+                .jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+        },
+        {
                .chip_id = BCM5395_DEVICE_ID,
                .dev_name = "BCM5395",
                .vlans = 4096,
@@ -2099,6 +2111,7 @@ int b53_switch_detect(struct b53_device *dev)
                else
                        dev->chip_id = BCM5365_DEVICE_ID;
                break;
+        case BCM5389_DEVICE_ID:
        case BCM5395_DEVICE_ID:
        case BCM5397_DEVICE_ID:
        case BCM5398_DEVICE_ID:
diff --git a/drivers/net/dsa/b53/b53_mdio.c b/drivers/net/dsa/b53/b53_mdio.c
index fa7556f5d4fb..a533a90e3904 100644
--- a/drivers/net/dsa/b53/b53_mdio.c
+++ b/drivers/net/dsa/b53/b53_mdio.c
@@ -285,6 +285,7 @@ static const struct b53_io_ops b53_mdio_ops = {
 #define B53_BRCM_OUI_1  0x0143bc00
 #define B53_BRCM_OUI_2  0x03625c00
 #define B53_BRCM_OUI_3  0x00406000
+#define B53_BRCM_OUI_4  0x01410c00
 static int b53_mdio_probe(struct mdio_device *mdiodev)
 {
@@ -311,7 +312,8 @@ static int b53_mdio_probe(struct mdio_device *mdiodev)
         */
        if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 &&
            (phy_id & 0xfffffc00) != B53_BRCM_OUI_2 &&
-            (phy_id & 0xfffffc00) != B53_BRCM_OUI_3) {
+            (phy_id & 0xfffffc00) != B53_BRCM_OUI_3 &&
+            (phy_id & 0xfffffc00) != B53_BRCM_OUI_4) {
                dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id);
                return -ENODEV;
        }
@@ -360,6 +362,7 @@ static const struct of_device_id b53_of_match[] = {
        { .compatible = "brcm,bcm53125" },
        { .compatible = "brcm,bcm53128" },
        { .compatible = "brcm,bcm5365" },
+        { .compatible = "brcm,bcm5389" },
        { .compatible = "brcm,bcm5395" },
        { .compatible = "brcm,bcm5397" },
        { .compatible = "brcm,bcm5398" },
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index cc284a514de9..75d9ffb75da8 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -48,6 +48,7 @@ struct b53_io_ops {
 enum {
        BCM5325_DEVICE_ID = 0x25,
        BCM5365_DEVICE_ID = 0x65,
+        BCM5389_DEVICE_ID = 0x89,
        BCM5395_DEVICE_ID = 0x95,
        BCM5397_DEVICE_ID = 0x97,
        BCM5398_DEVICE_ID = 0x98,
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index c697e79e491e..8f755009ff38 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3309,7 +3309,9 @@ void be_detect_error(struct be_adapter *adapter)
                                if ((val & POST_STAGE_FAT_LOG_START)
                                     != POST_STAGE_FAT_LOG_START &&
                                    (val & POST_STAGE_ARMFW_UE)
-                                     != POST_STAGE_ARMFW_UE)
+                                     != POST_STAGE_ARMFW_UE &&
+                                    (val & POST_STAGE_RECOVERABLE_ERR)
+                                     != POST_STAGE_RECOVERABLE_ERR)
                                        return;
                        }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 031d65c4178d..ba3035c08572 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9049,7 +9049,6 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
 {
        const struct tc_action *a;
        LIST_HEAD(actions);
-        int err;
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
@@ -9070,11 +9069,11 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                        if (!dev)
                                return -EINVAL;
-                        err = handle_redirect_action(adapter, dev->ifindex, queue,
+                        return handle_redirect_action(adapter, dev->ifindex,
-                                                     action);
+                                                      queue, action);
-                        if (err == 0)
-                                return err;
                }
+                return -EINVAL;
        }
        return -EINVAL;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index bb252b36994d..fc39f22e5c70 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4422,6 +4422,11 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                        NL_SET_ERR_MSG_MOD(extack, "Can not put a VLAN on an OVS port");
                        return -EINVAL;
                }
+                if (is_vlan_dev(upper_dev) &&
+                    vlan_dev_vlan_id(upper_dev) == 1) {
+                        NL_SET_ERR_MSG_MOD(extack, "Creating a VLAN device with VID 1 is unsupported: VLAN 1 carries untagged traffic");
+                        return -EINVAL;
+                }
                break;
        case NETDEV_CHANGEUPPER:
                upper_dev = info->upper_dev;
diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index 7ed08486ae23..c805dcbebd02 100644
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -84,7 +84,7 @@ static int sonic_open(struct net_device *dev)
        for (i = 0; i < SONIC_NUM_RRS; i++) {
                dma_addr_t laddr = dma_map_single(lp->device, skb_put(lp->rx_skb[i], SONIC_RBSIZE),
                                                  SONIC_RBSIZE, DMA_FROM_DEVICE);
-                if (!laddr) {
+                if (dma_mapping_error(lp->device, laddr)) {
                        while(i > 0) { /* free any that were mapped successfully */
                                i--;
                                dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE);
diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index aa50331b7607..ce8071fc90c4 100644
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -1681,8 +1681,8 @@ static int netsec_probe(struct platform_device *pdev)
        if (ret)
                goto unreg_napi;
-        if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
+        if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)))
-                dev_warn(&pdev->dev, "Failed to enable 64-bit DMA\n");
+                dev_warn(&pdev->dev, "Failed to set DMA mask\n");
        ret = register_netdev(ndev);
        if (ret) {
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index be0fec17d95d..06d7c9e4dcda 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1873,7 +1873,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
        if (IS_ERR(priv->txchan)) {
                dev_err(&pdev->dev, "error initializing tx dma channel\n");
                rc = PTR_ERR(priv->txchan);
-                goto no_cpdma_chan;
+                goto err_free_dma;
        }
        priv->rxchan = cpdma_chan_create(priv->dma, EMAC_DEF_RX_CH,
@@ -1881,14 +1881,14 @@ static int davinci_emac_probe(struct platform_device *pdev)
        if (IS_ERR(priv->rxchan)) {
                dev_err(&pdev->dev, "error initializing rx dma channel\n");
                rc = PTR_ERR(priv->rxchan);
-                goto no_cpdma_chan;
+                goto err_free_txchan;
        }
        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
        if (!res) {
                dev_err(&pdev->dev, "error getting irq res\n");
                rc = -ENOENT;
-                goto no_cpdma_chan;
+                goto err_free_rxchan;
        }
        ndev->irq = res->start;
@@ -1914,7 +1914,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                pm_runtime_put_noidle(&pdev->dev);
                dev_err(&pdev->dev, "%s: failed to get_sync(%d)\n",
                        __func__, rc);
-                goto no_cpdma_chan;
+                goto err_napi_del;
        }
        /* register the network device */
@@ -1924,7 +1924,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "error in register_netdev\n");
                rc = -ENODEV;
                pm_runtime_put(&pdev->dev);
-                goto no_cpdma_chan;
+                goto err_napi_del;
        }
@@ -1937,11 +1937,13 @@ static int davinci_emac_probe(struct platform_device *pdev)
        return 0;
-no_cpdma_chan:
+err_napi_del:
-        if (priv->txchan)
+        netif_napi_del(&priv->napi);
-                cpdma_chan_destroy(priv->txchan);
+err_free_rxchan:
-        if (priv->rxchan)
+        cpdma_chan_destroy(priv->rxchan);
-                cpdma_chan_destroy(priv->rxchan);
+err_free_txchan:
+        cpdma_chan_destroy(priv->txchan);
+err_free_dma:
        cpdma_ctlr_destroy(priv->dma);
 no_pdata:
        if (of_phy_is_fixed_link(np))
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 2265d2ccea47..c94fffee5ea9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1663,7 +1663,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        else
                *skb_xdp = 0;
-        preempt_disable();
+        local_bh_disable();
        rcu_read_lock();
        xdp_prog = rcu_dereference(tun->xdp_prog);
        if (xdp_prog && !*skb_xdp) {
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                        if (err)
                                goto err_redirect;
                        rcu_read_unlock();
-                        preempt_enable();
+                        local_bh_enable();
                        return NULL;
                case XDP_TX:
                        get_page(alloc_frag->page);
@@ -1697,7 +1697,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                                goto err_redirect;
                        tun_xdp_flush(tun->dev);
                        rcu_read_unlock();
-                        preempt_enable();
+                        local_bh_enable();
                        return NULL;
                case XDP_PASS:
                        delta = orig_data - xdp.data;
@@ -1717,7 +1717,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        skb = build_skb(buf, buflen);
        if (!skb) {
                rcu_read_unlock();
-                preempt_enable();
+                local_bh_enable();
                return ERR_PTR(-ENOMEM);
        }
@@ -1727,7 +1727,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        alloc_frag->offset += buflen;
        rcu_read_unlock();
-        preempt_enable();
+        local_bh_enable();
        return skb;
@@ -1735,7 +1735,7 @@ err_redirect:
        put_page(alloc_frag->page);
 err_xdp:
        rcu_read_unlock();
-        preempt_enable();
+        local_bh_enable();
        this_cpu_inc(tun->pcpu_stats->rx_dropped);
        return NULL;
 }
@@ -1931,16 +1931,19 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                struct bpf_prog *xdp_prog;
                int ret;
+                local_bh_disable();
                rcu_read_lock();
                xdp_prog = rcu_dereference(tun->xdp_prog);
                if (xdp_prog) {
                        ret = do_xdp_generic(xdp_prog, skb);
                        if (ret != XDP_PASS) {
                                rcu_read_unlock();
+                                local_bh_enable();
                                return total_len;
                        }
                }
                rcu_read_unlock();
+                local_bh_enable();
        }
        /* Compute the costly rx hash only if needed for flow updates.
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 7220cd620717..0362acd5cdca 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -609,7 +609,7 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
 */
 static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
        .description = "CDC MBIM",
-        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
        .bind = cdc_mbim_bind,
        .unbind = cdc_mbim_unbind,
        .manage_power = cdc_mbim_manage_power,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 148e78f8b48c..8e8b51f171f4 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1103,6 +1103,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
        {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
+        {QMI_FIXED_INTF(0x0846, 0x68d3, 8)},    /* Netgear Aircard 779S */
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 6e9a9ecfb11c..7229991ae70d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1600,14 +1600,13 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
                                        struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        int max_irqs, num_irqs, i, ret, nr_online_cpus;
+        int max_irqs, num_irqs, i, ret;
        u16 pci_cmd;
        if (!trans->cfg->mq_rx_supported)
                goto enable_msi;
-        nr_online_cpus = num_online_cpus();
+        max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES);
-        max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES);
        for (i = 0; i < max_irqs; i++)
                trans_pcie->msix_entries[i].entry = i;
@@ -1633,16 +1632,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
         * Two interrupts less: non rx causes shared with FBQ and RSS.
         * More than two interrupts: we will use fewer RSS queues.
         */
-        if (num_irqs <= nr_online_cpus) {
+        if (num_irqs <= max_irqs - 2) {
                trans_pcie->trans->num_rx_queues = num_irqs + 1;
                trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX |
                        IWL_SHARED_IRQ_FIRST_RSS;
-        } else if (num_irqs == nr_online_cpus + 1) {
+        } else if (num_irqs == max_irqs - 1) {
                trans_pcie->trans->num_rx_queues = num_irqs;
                trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX;
        } else {
                trans_pcie->trans->num_rx_queues = num_irqs - 1;
        }
+        WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES);
        trans_pcie->alloc_vecs = num_irqs;
        trans_pcie->msix_enabled = true;
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
index 7c1f8f561d4a..710e9641552e 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
        /*
         * Determine IFS values
-         * - Use TXOP_BACKOFF for probe and management frames except beacons
+         * - Use TXOP_BACKOFF for management frames except beacons
         * - Use TXOP_SIFS for fragment bursts
         * - Use TXOP_HTTXOP for everything else
         *
         * Note: rt2800 devices won't use CTS protection (if used)
         * for frames not transmitted with TXOP_HTTXOP
         */
-        if ((ieee80211_is_mgmt(hdr->frame_control) &&
+        if (ieee80211_is_mgmt(hdr->frame_control) &&
-             !ieee80211_is_beacon(hdr->frame_control)) ||
+            !ieee80211_is_beacon(hdr->frame_control))
-            (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
                txdesc->u.ht.txop = TXOP_BACKOFF;
        else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
                txdesc->u.ht.txop = TXOP_SIFS;
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index dbb7464c018c..88a8b5916624 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -27,7 +27,7 @@ config NVME_FABRICS
 config NVME_RDMA
        tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND_ADDR_TRANS && BLOCK
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK
        select NVME_CORE
        select NVME_FABRICS
        select SG_POOL
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 99b857e5a7a9..b9ca782fe82d 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1447,8 +1447,8 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
        if (ns->lba_shift == 0)
                ns->lba_shift = 9;
        ns->noiob = le16_to_cpu(id->noiob);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
        ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
        /* the PI implementation requires metadata equal t10 pi tuple size */
        if (ns->ms == sizeof(struct t10_pi_tuple))
                ns->pi_type = id->dps & NVME_NS_DPS_PI_MASK;
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 7595664ee753..3c7b61ddb0d1 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP
 config NVME_TARGET_RDMA
        tristate "NVMe over Fabrics RDMA target support"
-        depends on INFINIBAND_ADDR_TRANS
+        depends on INFINIBAND && INFINIBAND_ADDR_TRANS
        depends on NVME_TARGET
        select SGL_ALLOC
        help
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index a32c5c00e0e7..ffffb9909ae1 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -163,6 +163,16 @@ MODULE_LICENSE("GPL");
 static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL };
+static bool ashs_present(void)
+{
+        int i = 0;
+        while (ashs_ids[i]) {
+                if (acpi_dev_found(ashs_ids[i++]))
+                        return true;
+        }
+        return false;
+}
 struct bios_args {
        u32 arg0;
        u32 arg1;
@@ -1025,6 +1035,9 @@ static int asus_new_rfkill(struct asus_wmi *asus,
 static void asus_wmi_rfkill_exit(struct asus_wmi *asus)
 {
+        if (asus->driver->wlan_ctrl_by_user && ashs_present())
+                return;
        asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P5");
        asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P6");
        asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P7");
@@ -2121,16 +2134,6 @@ static int asus_wmi_fan_init(struct asus_wmi *asus)
        return 0;
 }
-static bool ashs_present(void)
-{
-        int i = 0;
-        while (ashs_ids[i]) {
-                if (acpi_dev_found(ashs_ids[i++]))
-                        return true;
-        }
-        return false;
-}
 /*
 * WMI Driver
 */
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 04143c08bd6e..02c03e418c27 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3034,7 +3034,8 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx,
        cqr->callback_data = req;
        cqr->status = DASD_CQR_FILLED;
        cqr->dq = dq;
-        req->completion_data = cqr;
+        *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req)) = cqr;
        blk_mq_start_request(req);
        spin_lock(&block->queue_lock);
        list_add_tail(&cqr->blocklist, &block->ccw_queue);
@@ -3058,12 +3059,13 @@ out:
 */
 enum blk_eh_timer_return dasd_times_out(struct request *req, bool reserved)
 {
-        struct dasd_ccw_req *cqr = req->completion_data;
        struct dasd_block *block = req->q->queuedata;
        struct dasd_device *device;
+        struct dasd_ccw_req *cqr;
        unsigned long flags;
        int rc = 0;
+        cqr = *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req));
        if (!cqr)
                return BLK_EH_NOT_HANDLED;
@@ -3169,6 +3171,7 @@ static int dasd_alloc_queue(struct dasd_block *block)
        int rc;
        block->tag_set.ops = &dasd_mq_ops;
+        block->tag_set.cmd_size = sizeof(struct dasd_ccw_req *);
        block->tag_set.nr_hw_queues = DASD_NR_HW_QUEUES;
        block->tag_set.queue_depth = DASD_MAX_LCU_DEV * DASD_REQ_PER_DEV;
        block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index 36f6190931bc..456ce9f19569 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -51,6 +51,8 @@ struct srp_internal {
        struct transport_container rport_attr_cont;
 };
+static int scsi_is_srp_rport(const struct device *dev);
 #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t)
 #define dev_to_rport(d) container_of(d, struct srp_rport, dev)
@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to_shost(struct srp_rport *r)
        return dev_to_shost(r->dev.parent);
 }
+static int find_child_rport(struct device *dev, void *data)
+{
+        struct device **child = data;
+        if (scsi_is_srp_rport(dev)) {
+                WARN_ON_ONCE(*child);
+                *child = dev;
+        }
+        return 0;
+}
 static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost)
 {
-        return transport_class_to_srp_rport(&shost->shost_gendev);
+        struct device *child = NULL;
+        WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child,
+                                           find_child_rport) < 0);
+        return child ? dev_to_rport(child) : NULL;
 }
 /**
@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(struct scsi_cmnd *scmd)
        struct srp_rport *rport = shost_to_rport(shost);
        pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev));
-        return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 &&
+        return rport && rport->fast_io_fail_tmo < 0 &&
+                rport->dev_loss_tmo < 0 &&
                i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ?
                BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED;
 }
diff --git a/drivers/soc/lantiq/gphy.c b/drivers/soc/lantiq/gphy.c
index 8d8659463b3e..feeb17cebc25 100644
--- a/drivers/soc/lantiq/gphy.c
+++ b/drivers/soc/lantiq/gphy.c
@@ -30,7 +30,6 @@ struct xway_gphy_priv {
        struct clk *gphy_clk_gate;
        struct reset_control *gphy_reset;
        struct reset_control *gphy_reset2;
-        struct notifier_block gphy_reboot_nb;
        void __iomem *membase;
        char *fw_name;
 };
@@ -64,24 +63,6 @@ static const struct of_device_id xway_gphy_match[] = {
 };
 MODULE_DEVICE_TABLE(of, xway_gphy_match);
-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb)
-{
-        return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb);
-}
-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb,
-                                   unsigned long code, void *unused)
-{
-        struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb);
-        if (priv) {
-                reset_control_assert(priv->gphy_reset);
-                reset_control_assert(priv->gphy_reset2);
-        }
-        return NOTIFY_DONE;
-}
 static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv,
                          dma_addr_t *dev_addr)
 {
@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platform_device *pdev)
        reset_control_deassert(priv->gphy_reset);
        reset_control_deassert(priv->gphy_reset2);
-        /* assert the gphy reset because it can hang after a reboot: */
-        priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify;
-        priv->gphy_reboot_nb.priority = -1;
-        ret = register_reboot_notifier(&priv->gphy_reboot_nb);
-        if (ret)
-                dev_warn(dev, "Failed to register reboot notifier\n");
        platform_set_drvdata(pdev, priv);
        return ret;
@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platform_device *pdev)
 static int xway_gphy_remove(struct platform_device *pdev)
 {
-        struct device *dev = &pdev->dev;
        struct xway_gphy_priv *priv = platform_get_drvdata(pdev);
-        int ret;
-        reset_control_assert(priv->gphy_reset);
-        reset_control_assert(priv->gphy_reset2);
        iowrite32be(0, priv->membase);
        clk_disable_unprepare(priv->gphy_clk_gate);
-        ret = unregister_reboot_notifier(&priv->gphy_reboot_nb);
-        if (ret)
-                dev_warn(dev, "Failed to unregister reboot notifier\n");
        return 0;
 }
diff --git a/drivers/staging/lustre/lnet/Kconfig b/drivers/staging/lustre/lnet/Kconfig
index f3b1ad4bd3dc..ad049e6f24e4 100644
--- a/drivers/staging/lustre/lnet/Kconfig
+++ b/drivers/staging/lustre/lnet/Kconfig
@@ -34,7 +34,7 @@ config LNET_SELFTEST
 config LNET_XPRT_IB
        tristate "LNET infiniband support"
-        depends on LNET && PCI && INFINIBAND_ADDR_TRANS
+        depends on LNET && PCI && INFINIBAND && INFINIBAND_ADDR_TRANS
        default LNET && INFINIBAND
        help
          This option allows the LNET users to use infiniband as an
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index 2d2ceda9aa26..500911f16498 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -1255,7 +1255,7 @@ static int icm_ar_get_boot_acl(struct tb *tb, uuid_t *uuids, size_t nuuids)
                        /* Map empty entries to null UUID */
                        uuid[0] = 0;
                        uuid[1] = 0;
-                } else {
+                } else if (uuid[0] != 0 || uuid[1] != 0) {
                        /* Upper two DWs are always one's */
                        uuid[2] = 0xffffffff;
                        uuid[3] = 0xffffffff;
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 5c212bf29640..3c082451ab1a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -404,6 +404,7 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
 {
        unsigned long pfn = 0;
        long ret, pinned = 0, lock_acct = 0;
+        bool rsvd;
        dma_addr_t iova = vaddr - dma->vaddr + dma->iova;
        /* This code path is only user initiated */
@@ -414,23 +415,14 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
        if (ret)
                return ret;
-        if (is_invalid_reserved_pfn(*pfn_base)) {
-                struct vm_area_struct *vma;
-                down_read(&current->mm->mmap_sem);
-                vma = find_vma_intersection(current->mm, vaddr, vaddr + 1);
-                pinned = min_t(long, npage, vma_pages(vma));
-                up_read(&current->mm->mmap_sem);
-                return pinned;
-        }
        pinned++;
+        rsvd = is_invalid_reserved_pfn(*pfn_base);
        /*
         * Reserved pages aren't counted against the user, externally pinned
         * pages are already counted against the user.
         */
-        if (!vfio_find_vpfn(dma, iova)) {
+        if (!rsvd && !vfio_find_vpfn(dma, iova)) {
                if (!lock_cap && current->mm->locked_vm + 1 > limit) {
                        put_pfn(*pfn_base, dma->prot);
                        pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__,
@@ -450,12 +442,13 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr,
                if (ret)
                        break;
-                if (pfn != *pfn_base + pinned) {
+                if (pfn != *pfn_base + pinned ||
+                    rsvd != is_invalid_reserved_pfn(pfn)) {
                        put_pfn(pfn, dma->prot);
                        break;
                }
-                if (!vfio_find_vpfn(dma, iova)) {
+                if (!rsvd && !vfio_find_vpfn(dma, iova)) {
                        if (!lock_cap &&
                            current->mm->locked_vm + lock_acct + 1 > limit) {
                                put_pfn(pfn, dma->prot);
@@ -473,8 +466,10 @@ out:
 unpin_out:
        if (ret) {
-                for (pfn = *pfn_base ; pinned ; pfn++, pinned--)
+                if (!rsvd) {
-                        put_pfn(pfn, dma->prot);
+                        for (pfn = *pfn_base ; pinned ; pfn++, pinned--)
+                                put_pfn(pfn, dma->prot);
+                }
                return ret;
        }
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index c4b49fca4871..e7cf7d21cfb5 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -108,7 +108,9 @@ struct vhost_net_virtqueue {
        /* vhost zerocopy support fields below: */
        /* last used idx for outstanding DMA zerocopy buffers */
        int upend_idx;
-        /* first used idx for DMA done zerocopy buffers */
+        /* For TX, first used idx for DMA done zerocopy buffers
+         * For RX, number of batched heads
+         */
        int done_idx;
        /* an array of userspace buffers info */
        struct ubuf_info *ubuf_info;
@@ -629,6 +631,18 @@ static int sk_has_rx_data(struct sock *sk)
        return skb_queue_empty(&sk->sk_receive_queue);
 }
+static void vhost_rx_signal_used(struct vhost_net_virtqueue *nvq)
+{
+        struct vhost_virtqueue *vq = &nvq->vq;
+        struct vhost_dev *dev = vq->dev;
+        if (!nvq->done_idx)
+                return;
+        vhost_add_used_and_signal_n(dev, vq, vq->heads, nvq->done_idx);
+        nvq->done_idx = 0;
+}
 static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
 {
        struct vhost_net_virtqueue *rvq = &net->vqs[VHOST_NET_VQ_RX];
@@ -638,6 +652,8 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
        int len = peek_head_len(rvq, sk);
        if (!len && vq->busyloop_timeout) {
+                /* Flush batched heads first */
+                vhost_rx_signal_used(rvq);
                /* Both tx vq and rx socket were polled here */
                mutex_lock_nested(&vq->mutex, 1);
                vhost_disable_notify(&net->dev, vq);
@@ -765,7 +781,7 @@ static void handle_rx(struct vhost_net *net)
        };
        size_t total_len = 0;
        int err, mergeable;
-        s16 headcount, nheads = 0;
+        s16 headcount;
        size_t vhost_hlen, sock_hlen;
        size_t vhost_len, sock_len;
        struct socket *sock;
@@ -794,8 +810,8 @@ static void handle_rx(struct vhost_net *net)
        while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk))) {
                sock_len += sock_hlen;
                vhost_len = sock_len + vhost_hlen;
-                headcount = get_rx_bufs(vq, vq->heads + nheads, vhost_len,
+                headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
-                                        &in, vq_log, &log,
+                                        vhost_len, &in, vq_log, &log,
                                        likely(mergeable) ? UIO_MAXIOV : 1);
                /* On error, stop handling until the next kick. */
                if (unlikely(headcount < 0))
@@ -866,12 +882,9 @@ static void handle_rx(struct vhost_net *net)
                        vhost_discard_vq_desc(vq, headcount);
                        goto out;
                }
-                nheads += headcount;
+                nvq->done_idx += headcount;
-                if (nheads > VHOST_RX_BATCH) {
+                if (nvq->done_idx > VHOST_RX_BATCH)
-                        vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
+                        vhost_rx_signal_used(nvq);
-                                                    nheads);
-                        nheads = 0;
-                }
                if (unlikely(vq_log))
                        vhost_log_write(vq, vq_log, log, vhost_len);
                total_len += vhost_len;
@@ -883,9 +896,7 @@ static void handle_rx(struct vhost_net *net)
        }
        vhost_net_enable_vq(net, vq);
 out:
-        if (nheads)
+        vhost_rx_signal_used(nvq);
-                vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
-                                            nheads);
        mutex_unlock(&vq->mutex);
 }
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 1992b0ffa543..81dfedb7879f 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -372,18 +372,14 @@ int afs_permission(struct inode *inode, int mask)
               mask, access, S_ISDIR(inode->i_mode) ? "dir" : "file");
        if (S_ISDIR(inode->i_mode)) {
-                if (mask & MAY_EXEC) {
+                if (mask & (MAY_EXEC | MAY_READ | MAY_CHDIR)) {
                        if (!(access & AFS_ACE_LOOKUP))
                                goto permission_denied;
-                } else if (mask & MAY_READ) {
+                }
-                        if (!(access & AFS_ACE_LOOKUP))
+                if (mask & MAY_WRITE) {
-                                goto permission_denied;
-                } else if (mask & MAY_WRITE) {
                        if (!(access & (AFS_ACE_DELETE | /* rmdir, unlink, rename from */
                                        AFS_ACE_INSERT))) /* create, mkdir, symlink, rename to */
                                goto permission_denied;
-                } else {
-                        BUG();
                }
        } else {
                if (!(access & AFS_ACE_LOOKUP))
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index 1ed7e2fd2f35..c3b740813fc7 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -23,7 +23,7 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
        struct afs_uvldbentry__xdr *uvldb;
        struct afs_vldb_entry *entry;
        bool new_only = false;
-        u32 tmp, nr_servers;
+        u32 tmp, nr_servers, vlflags;
        int i, ret;
        _enter("");
@@ -55,6 +55,7 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
                        new_only = true;
        }
+        vlflags = ntohl(uvldb->flags);
        for (i = 0; i < nr_servers; i++) {
                struct afs_uuid__xdr *xdr;
                struct afs_uuid *uuid;
@@ -64,12 +65,13 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
                if (tmp & AFS_VLSF_DONTUSE ||
                    (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
                        continue;
-                if (tmp & AFS_VLSF_RWVOL)
+                if (tmp & AFS_VLSF_RWVOL) {
                        entry->fs_mask[i] |= AFS_VOL_VTM_RW;
+                        if (vlflags & AFS_VLF_BACKEXISTS)
+                                entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
+                }
                if (tmp & AFS_VLSF_ROVOL)
                        entry->fs_mask[i] |= AFS_VOL_VTM_RO;
-                if (tmp & AFS_VLSF_BACKVOL)
-                        entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
                if (!entry->fs_mask[i])
                        continue;
@@ -89,15 +91,14 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
        for (i = 0; i < AFS_MAXTYPES; i++)
                entry->vid[i] = ntohl(uvldb->volumeId[i]);
-        tmp = ntohl(uvldb->flags);
+        if (vlflags & AFS_VLF_RWEXISTS)
-        if (tmp & AFS_VLF_RWEXISTS)
                __set_bit(AFS_VLDB_HAS_RW, &entry->flags);
-        if (tmp & AFS_VLF_ROEXISTS)
+        if (vlflags & AFS_VLF_ROEXISTS)
                __set_bit(AFS_VLDB_HAS_RO, &entry->flags);
-        if (tmp & AFS_VLF_BACKEXISTS)
+        if (vlflags & AFS_VLF_BACKEXISTS)
                __set_bit(AFS_VLDB_HAS_BAK, &entry->flags);
-        if (!(tmp & (AFS_VLF_RWEXISTS | AFS_VLF_ROEXISTS | AFS_VLF_BACKEXISTS))) {
+        if (!(vlflags & (AFS_VLF_RWEXISTS | AFS_VLF_ROEXISTS | AFS_VLF_BACKEXISTS))) {
                entry->error = -ENOMEDIUM;
                __set_bit(AFS_VLDB_QUERY_ERROR, &entry->flags);
        }
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index d61e2de8d0eb..5f132d59dfc2 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -197,7 +197,7 @@ config CIFS_SMB311
 config CIFS_SMB_DIRECT
        bool "SMB Direct support (Experimental)"
-        depends on CIFS=m && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND_ADDR_TRANS=y
+        depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
        help
          Enables SMB Direct experimental support for SMB 3.0, 3.02 and 3.1.1.
          SMB Direct allows transferring SMB packets over RDMA. If unsure,
diff --git a/fs/inode.c b/fs/inode.c
index 13ceb98c3bd3..3b55391072f3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -178,6 +178,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
        mapping->a_ops = &empty_aops;
        mapping->host = inode;
        mapping->flags = 0;
+        mapping->wb_err = 0;
        atomic_set(&mapping->i_mmap_writable, 0);
        mapping_set_gfp_mask(mapping, GFP_HIGHUSER_MOVABLE);
        mapping->private_data = NULL;
diff --git a/include/drm/bridge/dw_hdmi.h b/include/drm/bridge/dw_hdmi.h
index dd2a8cf7d20b..ccb5aa8468e0 100644
--- a/include/drm/bridge/dw_hdmi.h
+++ b/include/drm/bridge/dw_hdmi.h
@@ -151,7 +151,7 @@ struct dw_hdmi *dw_hdmi_bind(struct platform_device *pdev,
                             struct drm_encoder *encoder,
                             const struct dw_hdmi_plat_data *plat_data);
-void dw_hdmi_setup_rx_sense(struct device *dev, bool hpd, bool rx_sense);
+void dw_hdmi_setup_rx_sense(struct dw_hdmi *hdmi, bool hpd, bool rx_sense);
 void dw_hdmi_set_sample_rate(struct dw_hdmi *hdmi, unsigned int rate);
 void dw_hdmi_audio_enable(struct dw_hdmi *hdmi);
diff --git a/include/linux/iio/buffer_impl.h b/include/linux/iio/buffer_impl.h
index b9e22b7e2f28..d1171db23742 100644
--- a/include/linux/iio/buffer_impl.h
+++ b/include/linux/iio/buffer_impl.h
@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs {
        int (*request_update)(struct iio_buffer *buffer);
        int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd);
-        int (*set_length)(struct iio_buffer *buffer, int length);
+        int (*set_length)(struct iio_buffer *buffer, unsigned int length);
        int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
        int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev);
@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs {
 */
 struct iio_buffer {
        /** @length: Number of datums in buffer. */
-        int length;
+        unsigned int length;
        /**  @bytes_per_datum: Size of individual datum including timestamp. */
-        int bytes_per_datum;
+        size_t bytes_per_datum;
        /**
         * @access: Buffer access functions associated with the
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index bc01e06bc716..0be866c91f62 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -435,7 +435,9 @@ TRACE_EVENT(sched_pi_setprio,
                memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN);
                __entry->pid            = tsk->pid;
                __entry->oldprio        = tsk->prio;
-                __entry->newprio        = pi_task ? pi_task->prio : tsk->prio;
+                __entry->newprio        = pi_task ?
+                                min(tsk->normal_prio, pi_task->prio) :
+                                tsk->normal_prio;
                /* XXX SCHED_DEADLINE bits missing */
        ),
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 9b8c6e310e9a..671486133988 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2332,6 +2332,7 @@ struct bpf_map_info {
        __u32 map_flags;
        char  name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+        __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
        __u32 btf_id;
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 2017a39ab490..481951bf091d 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -193,7 +193,7 @@ EXPORT_SYMBOL_GPL(kthread_parkme);
 void kthread_park_complete(struct task_struct *k)
 {
-        complete(&to_kthread(k)->parked);
+        complete_all(&to_kthread(k)->parked);
 }
 static int kthread(void *_create)
@@ -459,6 +459,7 @@ void kthread_unpark(struct task_struct *k)
        if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
                __kthread_bind(k, kthread->cpu, TASK_PARKED);
+        reinit_completion(&kthread->parked);
        clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
        wake_up_state(k, TASK_PARKED);
 }
@@ -483,9 +484,6 @@ int kthread_park(struct task_struct *k)
        if (WARN_ON(k->flags & PF_EXITING))
                return -ENOSYS;
-        if (WARN_ON_ONCE(test_bit(KTHREAD_SHOULD_PARK, &kthread->flags)))
-                return -EBUSY;
        set_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
        if (k != current) {
                wake_up_process(k);
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 64cc564f5255..61a1125c1ae4 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1708,7 +1708,7 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att
        rcu_read_unlock();
        if (rq && sched_debug_enabled) {
-                pr_info("span: %*pbl (max cpu_capacity = %lu)\n",
+                pr_info("root domain span: %*pbl (max cpu_capacity = %lu)\n",
                        cpumask_pr_args(cpu_map), rq->rd->max_cpu_capacity);
        }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 414d7210b2ec..bcd93031d042 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -893,7 +893,7 @@ int __trace_bputs(unsigned long ip, const char *str)
 EXPORT_SYMBOL_GPL(__trace_bputs);
 #ifdef CONFIG_TRACER_SNAPSHOT
-static void tracing_snapshot_instance(struct trace_array *tr)
+void tracing_snapshot_instance(struct trace_array *tr)
 {
        struct tracer *tracer = tr->current_trace;
        unsigned long flags;
@@ -949,7 +949,7 @@ static int resize_buffer_duplicate_size(struct trace_buffer *trace_buf,
                                        struct trace_buffer *size_buf, int cpu_id);
 static void set_buffer_entries(struct trace_buffer *buf, unsigned long val);
-static int alloc_snapshot(struct trace_array *tr)
+int tracing_alloc_snapshot_instance(struct trace_array *tr)
 {
        int ret;
@@ -995,7 +995,7 @@ int tracing_alloc_snapshot(void)
        struct trace_array *tr = &global_trace;
        int ret;
-        ret = alloc_snapshot(tr);
+        ret = tracing_alloc_snapshot_instance(tr);
        WARN_ON(ret < 0);
        return ret;
@@ -5408,7 +5408,7 @@ static int tracing_set_tracer(struct trace_array *tr, const char *buf)
 #ifdef CONFIG_TRACER_MAX_TRACE
        if (t->use_max_tr && !had_max_tr) {
-                ret = alloc_snapshot(tr);
+                ret = tracing_alloc_snapshot_instance(tr);
                if (ret < 0)
                        goto out;
        }
@@ -6451,7 +6451,7 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
                }
 #endif
                if (!tr->allocated_snapshot) {
-                        ret = alloc_snapshot(tr);
+                        ret = tracing_alloc_snapshot_instance(tr);
                        if (ret < 0)
                                break;
                }
@@ -7179,7 +7179,7 @@ ftrace_trace_snapshot_callback(struct trace_array *tr, struct ftrace_hash *hash,
                return ret;
 out_reg:
-        ret = alloc_snapshot(tr);
+        ret = tracing_alloc_snapshot_instance(tr);
        if (ret < 0)
                goto out;
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 6fb46a06c9dc..507954b4e058 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1817,6 +1817,17 @@ static inline void __init trace_event_init(void) { }
 static inline void trace_event_eval_update(struct trace_eval_map **map, int len) { }
 #endif
+#ifdef CONFIG_TRACER_SNAPSHOT
+void tracing_snapshot_instance(struct trace_array *tr);
+int tracing_alloc_snapshot_instance(struct trace_array *tr);
+#else
+static inline void tracing_snapshot_instance(struct trace_array *tr) { }
+static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
+{
+        return 0;
+}
+#endif
 extern struct trace_iterator *tracepoint_print_iter;
 #endif /* _LINUX_KERNEL_TRACE_H */
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index d251cabcf69a..8b5bdcf64871 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -483,9 +483,10 @@ clear_event_triggers(struct trace_array *tr)
        struct trace_event_file *file;
        list_for_each_entry(file, &tr->events, list) {
-                struct event_trigger_data *data;
+                struct event_trigger_data *data, *n;
-                list_for_each_entry_rcu(data, &file->triggers, list) {
+                list_for_each_entry_safe(data, n, &file->triggers, list) {
                        trace_event_trigger_enable_disable(file, 0);
+                        list_del_rcu(&data->list);
                        if (data->ops->free)
                                data->ops->free(data->ops, data);
                }
@@ -642,6 +643,7 @@ event_trigger_callback(struct event_command *cmd_ops,
        trigger_data->count = -1;
        trigger_data->ops = trigger_ops;
        trigger_data->cmd_ops = cmd_ops;
+        trigger_data->private_data = file;
        INIT_LIST_HEAD(&trigger_data->list);
        INIT_LIST_HEAD(&trigger_data->named_list);
@@ -1053,7 +1055,12 @@ static void
 snapshot_trigger(struct event_trigger_data *data, void *rec,
                 struct ring_buffer_event *event)
 {
-        tracing_snapshot();
+        struct trace_event_file *file = data->private_data;
+        if (file)
+                tracing_snapshot_instance(file->tr);
+        else
+                tracing_snapshot();
 }
 static void
@@ -1076,7 +1083,7 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops,
 {
        int ret = register_trigger(glob, ops, data, file);
-        if (ret > 0 && tracing_alloc_snapshot() != 0) {
+        if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) {
                unregister_trigger(glob, ops, data, file);
                ret = 0;
        }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index a3a1815f8e11..b9f3dbd885bd 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2431,7 +2431,7 @@ static void __split_huge_page(struct page *page, struct list_head *list,
                __split_huge_page_tail(head, i, lruvec, list);
                /* Some pages can be beyond i_size: drop them from page cache */
                if (head[i].index >= end) {
-                        __ClearPageDirty(head + i);
+                        ClearPageDirty(head + i);
                        __delete_from_page_cache(head + i, NULL);
                        if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head))
                                shmem_uncharge(head->mapping->host, 1);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 9b697323a88c..9270a4370d54 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1418,7 +1418,7 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode)
                                return ret;
                        mapping = page_mapping(page);
-                        migrate_dirty = mapping && mapping->a_ops->migratepage;
+                        migrate_dirty = !mapping || mapping->a_ops->migratepage;
                        unlock_page(page);
                        if (!migrate_dirty)
                                return ret;
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 46c39f7da444..e6014e0e51f7 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -32,7 +32,7 @@ config NET_9P_XEN
 config NET_9P_RDMA
-        depends on INET && INFINIBAND_ADDR_TRANS
+        depends on INET && INFINIBAND && INFINIBAND_ADDR_TRANS
        tristate "9P RDMA Transport (Experimental)"
        help
          This builds support for an RDMA transport.
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index b286ed5596c3..c2138e7e8263 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1949,7 +1949,8 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
        int off, pad = 0;
        unsigned int size_kern, match_size = mwt->match_size;
-        strlcpy(name, mwt->u.name, sizeof(name));
+        if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
+                return -EINVAL;
        if (state->buf_kern_start)
                dst = state->buf_kern_start + state->buf_kern_offset;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c476f0794132..bb7e80f4ced3 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1214,9 +1214,6 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
        cpumask_var_t mask;
        unsigned long index;
-        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
-                return -ENOMEM;
        index = get_netdev_queue_index(queue);
        if (dev->num_tc) {
@@ -1226,6 +1223,9 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
                        return -EINVAL;
        }
+        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
        rcu_read_lock();
        dev_maps = rcu_dereference(dev->xps_maps);
        if (dev_maps) {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 6b0e362cc99b..38d906baf1df 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -328,7 +328,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
        if (tdev) {
                hlen = tdev->hard_header_len + tdev->needed_headroom;
-                mtu = tdev->mtu;
+                mtu = min(tdev->mtu, IP_MAX_MTU);
        }
        dev->needed_headroom = t_hlen + hlen;
@@ -362,7 +362,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
        nt = netdev_priv(dev);
        t_hlen = nt->hlen + sizeof(struct iphdr);
        dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        dev->max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
        ip_tunnel_add(itn, nt);
        return nt;
@@ -930,7 +930,7 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        int t_hlen = tunnel->hlen + sizeof(struct iphdr);
-        int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        int max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
        if (new_mtu < ETH_MIN_MTU)
                return -EINVAL;
@@ -1107,7 +1107,7 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
        mtu = ip_tunnel_bind_dev(dev);
        if (tb[IFLA_MTU]) {
-                unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen;
+                unsigned int max = IP_MAX_MTU - dev->hard_header_len - nt->hlen;
                mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
                            (unsigned int)(max - sizeof(struct iphdr)));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index da66aaac51ce..00e138a44cbb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1692,8 +1692,13 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
                if (new_mtu < ETH_MIN_MTU)
                        return -EINVAL;
        }
-        if (new_mtu > 0xFFF8 - dev->hard_header_len)
+        if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
-                return -EINVAL;
+                if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        } else {
+                if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        }
        dev->mtu = new_mtu;
        return 0;
 }
@@ -1841,7 +1846,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                dev->mtu -= 8;
        dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len;
+        dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
        return 0;
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index eab39bd91548..19ccf0dc996c 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -122,7 +122,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
        hdrlen = (osrh->hdrlen + 1) << 3;
        tot_len = hdrlen + sizeof(*hdr);
-        err = skb_cow_head(skb, tot_len);
+        err = skb_cow_head(skb, tot_len + skb->mac_len);
        if (unlikely(err))
                return err;
@@ -181,7 +181,7 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh)
        hdrlen = (osrh->hdrlen + 1) << 3;
-        err = skb_cow_head(skb, hdrlen);
+        err = skb_cow_head(skb, hdrlen + skb->mac_len);
        if (unlikely(err))
                return err;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2afce37a7177..e9400ffa7875 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1371,7 +1371,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
        dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
        dev->mtu                = ETH_DATA_LEN - t_hlen;
        dev->min_mtu            = IPV6_MIN_MTU;
-        dev->max_mtu            = 0xFFF8 - t_hlen;
+        dev->max_mtu            = IP6_MAX_MTU - t_hlen;
        dev->flags              = IFF_NOARP;
        netif_keep_dst(dev);
        dev->addr_len           = 4;
@@ -1583,7 +1583,8 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
        if (tb[IFLA_MTU]) {
                u32 mtu = nla_get_u32(tb[IFLA_MTU]);
-                if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+                if (mtu >= IPV6_MIN_MTU &&
+                    mtu <= IP6_MAX_MTU - dev->hard_header_len)
                        dev->mtu = mtu;
        }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 2cff209d0fc1..ef3defaf43b9 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -124,7 +124,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
        struct flowi6 *fl6 = &fl->u.ip6;
        int onlyproto = 0;
        const struct ipv6hdr *hdr = ipv6_hdr(skb);
-        u16 offset = sizeof(*hdr);
+        u32 offset = sizeof(*hdr);
        struct ipv6_opt_hdr *exthdr;
        const unsigned char *nh = skb_network_header(skb);
        u16 nhoff = IP6CB(skb)->nhoff;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index dc76bc346829..d3601d421571 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock)
        __module_get(newsock->ops->owner);
        newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
-                         &kcm_proto, true);
+                         &kcm_proto, false);
        if (!newsk) {
                sock_release(newsock);
                return ERR_PTR(-ENOMEM);
diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 99f4c22e2c8f..82e6edf9c5d9 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -208,7 +208,7 @@ err:
 static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
                                struct netlink_callback *cb)
 {
-        struct nlattr *attrs[NCSI_ATTR_MAX];
+        struct nlattr *attrs[NCSI_ATTR_MAX + 1];
        struct ncsi_package *np, *package;
        struct ncsi_dev_priv *ndp;
        unsigned int package_id;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index d4f68d0f7df7..af89bb5ffac7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2385,8 +2385,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                        struct ipvs_sync_daemon_cfg cfg;
                        memset(&cfg, 0, sizeof(cfg));
-                        strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
+                        ret = -EINVAL;
-                                sizeof(cfg.mcast_ifn));
+                        if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
+                                    sizeof(cfg.mcast_ifn)) <= 0)
+                                goto out_dec;
                        cfg.syncid = dm->syncid;
                        ret = start_sync_thread(ipvs, &cfg, dm->state);
                } else {
@@ -2424,12 +2426,19 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                }
        }
+        if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
+            strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
+            IP_VS_SCHEDNAME_MAXLEN) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
        /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
        if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
            usvc.protocol != IPPROTO_SCTP) {
-                pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+                pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
                       usvc.protocol, &usvc.addr.ip,
-                       ntohs(usvc.port), usvc.sched_name);
+                       ntohs(usvc.port));
                ret = -EFAULT;
                goto out_unlock;
        }
@@ -2851,7 +2860,7 @@ static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
        [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
        [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_IFNAME_MAXLEN },
+                                            .len = IP_VS_IFNAME_MAXLEN - 1 },
        [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
        [IPVS_DAEMON_ATTR_SYNC_MAXLEN]  = { .type = NLA_U16 },
        [IPVS_DAEMON_ATTR_MCAST_GROUP]  = { .type = NLA_U32 },
@@ -2869,7 +2878,7 @@ static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
        [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
        [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
        [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_SCHEDNAME_MAXLEN },
+                                            .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
        [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
                                            .len = IP_VS_PENAME_MAXLEN },
        [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2e8fd961746d..ca4c4d994ddb 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1336,8 +1336,10 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
                rcu_assign_pointer(chain->stats, newstats);
                synchronize_rcu();
                free_percpu(oldstats);
-        } else
+        } else {
                rcu_assign_pointer(chain->stats, newstats);
+                static_branch_inc(&nft_counters_enabled);
+        }
 }
 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
@@ -4944,7 +4946,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
                        if (idx > s_idx)
                                memset(&cb->args[1], 0,
                                       sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                            strcmp(filter->table, table->name))
                                goto cont;
                        if (filter &&
@@ -5624,7 +5626,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
                        if (idx > s_idx)
                                memset(&cb->args[1], 0,
                                       sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                            strcmp(filter->table, table->name))
                                goto cont;
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 47cf667b15ca..deff10adef9c 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -104,15 +104,15 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
        if (!base_chain->stats)
                return;
+        local_bh_disable();
        stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
        if (stats) {
-                local_bh_disable();
                u64_stats_update_begin(&stats->syncp);
                stats->pkts++;
                stats->bytes += pkt->skb->len;
                u64_stats_update_end(&stats->syncp);
-                local_bh_enable();
        }
+        local_bh_enable();
 }
 struct nft_jumpstack {
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 6ddf89183e7b..a0e5adf0b3b6 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
                nfacct->flags = flags;
        }
-        nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
+        nla_strlcpy(nfacct->name, tb[NFACCT_NAME], NFACCT_NAME_MAX);
        if (tb[NFACCT_BYTES]) {
                atomic64_set(&nfacct->bytes,
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index fa026b269b36..cb5b5f207777 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -150,7 +150,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
                return -EINVAL;
        nla_strlcpy(expect_policy->name,
-                    nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
        expect_policy->max_expected =
                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
        if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -235,7 +235,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                goto err1;
        nla_strlcpy(helper->name,
-                    nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
        size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
        if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
                ret = -ENOMEM;
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index f8b19eacfa0c..1435ffc5f57e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -881,22 +881,26 @@ static int nft_ct_helper_obj_dump(struct sk_buff *skb,
                                  struct nft_object *obj, bool reset)
 {
        const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
-        const struct nf_conntrack_helper *helper = priv->helper4;
+        const struct nf_conntrack_helper *helper;
        u16 family;
+        if (priv->helper4 && priv->helper6) {
+                family = NFPROTO_INET;
+                helper = priv->helper4;
+        } else if (priv->helper6) {
+                family = NFPROTO_IPV6;
+                helper = priv->helper6;
+        } else {
+                family = NFPROTO_IPV4;
+                helper = priv->helper4;
+        }
        if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
                return -1;
        if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
                return -1;
-        if (priv->helper4 && priv->helper6)
-                family = NFPROTO_INET;
-        else if (priv->helper6)
-                family = NFPROTO_IPV6;
-        else
-                family = NFPROTO_IPV4;
        if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
                return -1;
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index a9fc298ef4c3..72f13a1144dd 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -51,10 +51,13 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
        return !limit->invert;
 }
+/* Use same default as in iptables. */
+#define NFT_LIMIT_PKT_BURST_DEFAULT     5
 static int nft_limit_init(struct nft_limit *limit,
-                          const struct nlattr * const tb[])
+                          const struct nlattr * const tb[], bool pkts)
 {
-        u64 unit;
+        u64 unit, tokens;
        if (tb[NFTA_LIMIT_RATE] == NULL ||
            tb[NFTA_LIMIT_UNIT] == NULL)
@@ -68,18 +71,25 @@ static int nft_limit_init(struct nft_limit *limit,
        if (tb[NFTA_LIMIT_BURST])
                limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
-        else
-                limit->burst = 0;
+        if (pkts && limit->burst == 0)
+                limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
        if (limit->rate + limit->burst < limit->rate)
                return -EOVERFLOW;
-        /* The token bucket size limits the number of tokens can be
+        if (pkts) {
-         * accumulated. tokens_max specifies the bucket size.
+                tokens = div_u64(limit->nsecs, limit->rate) * limit->burst;
-         * tokens_max = unit * (rate + burst) / rate.
+        } else {
-         */
+                /* The token bucket size limits the number of tokens can be
-        limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
+                 * accumulated. tokens_max specifies the bucket size.
-                                limit->rate);
+                 * tokens_max = unit * (rate + burst) / rate.
+                 */
+                tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
+                                 limit->rate);
+        }
+        limit->tokens = tokens;
        limit->tokens_max = limit->tokens;
        if (tb[NFTA_LIMIT_FLAGS]) {
@@ -144,7 +154,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
        struct nft_limit_pkts *priv = nft_expr_priv(expr);
        int err;
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
        if (err < 0)
                return err;
@@ -185,7 +195,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
 {
        struct nft_limit *priv = nft_expr_priv(expr);
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 static int nft_limit_bytes_dump(struct sk_buff *skb,
@@ -246,7 +256,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
        struct nft_limit_pkts *priv = nft_obj_data(obj);
        int err;
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
        if (err < 0)
                return err;
@@ -289,7 +299,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
 {
        struct nft_limit *priv = nft_obj_data(obj);
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 5348bd058c88..1105a23bda5e 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -259,7 +259,7 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
        struct sk_buff *skb = pkt->skb;
        u32 *sreg = &regs->data[meta->sreg];
        u32 value = *sreg;
-        u8 pkt_type;
+        u8 value8;
        switch (meta->key) {
        case NFT_META_MARK:
@@ -269,15 +269,17 @@ static void nft_meta_set_eval(const struct nft_expr *expr,
                skb->priority = value;
                break;
        case NFT_META_PKTTYPE:
-                pkt_type = nft_reg_load8(sreg);
+                value8 = nft_reg_load8(sreg);
-                if (skb->pkt_type != pkt_type &&
+                if (skb->pkt_type != value8 &&
-                    skb_pkt_type_ok(pkt_type) &&
+                    skb_pkt_type_ok(value8) &&
                    skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = pkt_type;
+                        skb->pkt_type = value8;
                break;
        case NFT_META_NFTRACE:
-                skb->nf_trace = !!value;
+                value8 = nft_reg_load8(sreg);
+                skb->nf_trace = !!value8;
                break;
        default:
                WARN_ON(1);
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index 1a31502ee7db..bffde4b46c5d 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -8,7 +8,7 @@ config RDS
 config RDS_RDMA
        tristate "RDS over Infiniband"
-        depends on RDS && INFINIBAND_ADDR_TRANS
+        depends on RDS && INFINIBAND && INFINIBAND_ADDR_TRANS
        ---help---
          Allow RDS to use Infiniband as a transport.
          This transport supports RDMA operations.
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 4e74508515f4..3786feab0b83 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1028,7 +1028,7 @@ errout_mask:
        fl_mask_put(head, fnew->mask, false);
 errout_idr:
-        if (fnew->handle)
+        if (!fold)
                idr_remove(&head->handle_idr, fnew->handle);
 errout:
        tcf_exts_destroy(&fnew->exts);
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 6358e5271070..ac09ca803296 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -50,7 +50,7 @@ config SUNRPC_DEBUG
 config SUNRPC_XPRT_RDMA
        tristate "RPC-over-RDMA transport"
-        depends on SUNRPC && INFINIBAND_ADDR_TRANS
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
        default SUNRPC && INFINIBAND
        select SG_POOL
        help
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 40b54cc64243..5f48251c1319 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len;
        }
-out:
        return &xdst0->u.dst;
 put_states:
@@ -1667,8 +1666,8 @@ put_states:
 free_dst:
        if (xdst0)
                dst_release_immediate(&xdst0->u.dst);
-        xdst0 = ERR_PTR(err);
-        goto out;
+        return ERR_PTR(err);
 }
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 8057e19dc15f..3ce225e3f142 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1494,7 +1494,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
                                      scontext_len, &context, def_sid);
        if (rc == -EINVAL && force) {
                context.str = str;
-                context.len = scontext_len;
+                context.len = strlen(str) + 1;
                str = NULL;
        } else if (rc)
                goto out_unlock;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 9b8c6e310e9a..671486133988 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2332,6 +2332,7 @@ struct bpf_map_info {
        __u32 map_flags;
        char  name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+        __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
        __u32 btf_id;
author	David S. Miller <davem@davemloft.net>	2018-06-03 09:31:58 -0400
committer	David S. Miller <davem@davemloft.net>	2018-06-03 09:31:58 -0400
commit	9c54aeb03a6d65a5834bd92376e921cbac6dfb8f (patch)
tree	70441095d58678711d68cfef4934765251425d1f
parent	eaf47b17a77fda841a1102d76c15161ee438b347 (diff)
parent	918fe1b3157978ada4267468008c5f89ef101e7d (diff)