299 files changed, 5508 insertions, 1090 deletions
diff --git a/.mailmap b/.mailmap
index 83d7e750c2fc..fd6219293057 100644
--- a/.mailmap
+++ b/.mailmap
@@ -108,6 +108,10 @@ Jason Gunthorpe <jgg@ziepe.ca> <jgg@mellanox.com>
 Jason Gunthorpe <jgg@ziepe.ca> <jgunthorpe@obsidianresearch.com>
 Javi Merino <javi.merino@kernel.org> <javi.merino@arm.com>
 <javier@osg.samsung.com> <javier.martinez@collabora.co.uk>
+Jayachandran C <c.jayachandran@gmail.com> <jayachandranc@netlogicmicro.com>
+Jayachandran C <c.jayachandran@gmail.com> <jchandra@broadcom.com>
+Jayachandran C <c.jayachandran@gmail.com> <jchandra@digeo.com>
+Jayachandran C <c.jayachandran@gmail.com> <jnair@caviumnetworks.com>
 Jean Tourrilhes <jt@hpl.hp.com>
 <jean-philippe@linaro.org> <jean-philippe.brucker@arm.com>
 Jeff Garzik <jgarzik@pretzel.yyz.us>
diff --git a/Documentation/networking/tls-offload.rst b/Documentation/networking/tls-offload.rst
index 0dd3f748239f..f914e81fd3a6 100644
--- a/Documentation/networking/tls-offload.rst
+++ b/Documentation/networking/tls-offload.rst
@@ -436,6 +436,10 @@ by the driver:
   encryption.
 * ``tx_tls_ooo`` - number of TX packets which were part of a TLS stream
   but did not arrive in the expected order.
+ * ``tx_tls_skip_no_sync_data`` - number of TX packets which were part of
+   a TLS stream and arrived out-of-order, but skipped the HW offload routine
+   and went to the regular transmit flow as they were retransmissions of the
+   connection handshake.
 * ``tx_tls_drop_no_sync_data`` - number of TX packets which were part of
   a TLS stream dropped, because they arrived out of order and associated
   record could not be found.
diff --git a/MAINTAINERS b/MAINTAINERS
index cba1095547fd..eb19fad370d7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3053,6 +3053,7 @@ M:	Daniel Borkmann <daniel@iogearbox.net>
 R:      Martin KaFai Lau <kafai@fb.com>
 R:      Song Liu <songliubraving@fb.com>
 R:      Yonghong Song <yhs@fb.com>
+R:      Andrii Nakryiko <andriin@fb.com>
 L:      netdev@vger.kernel.org
 L:      bpf@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
@@ -3737,7 +3738,6 @@ F:	drivers/crypto/cavium/cpt/
 CAVIUM THUNDERX2 ARM64 SOC
 M:      Robert Richter <rrichter@cavium.com>
-M:      Jayachandran C <jnair@caviumnetworks.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm64/boot/dts/cavium/thunder2-99xx*
@@ -10519,8 +10519,12 @@ F:	mm/memblock.c
 F:      Documentation/core-api/boot-time-mm.rst
 MEMORY MANAGEMENT
+M:      Andrew Morton <akpm@linux-foundation.org>
 L:      linux-mm@kvack.org
 W:      http://www.linux-mm.org
+T:      quilt https://ozlabs.org/~akpm/mmotm/
+T:      quilt https://ozlabs.org/~akpm/mmots/
+T:      git git://github.com/hnaz/linux-mm.git
 S:      Maintained
 F:      include/linux/mm.h
 F:      include/linux/gfp.h
@@ -17334,6 +17338,12 @@ F:	include/linux/vbox_utils.h
 F:      include/uapi/linux/vbox*.h
 F:      drivers/virt/vboxguest/
+VIRTUAL BOX SHARED FOLDER VFS DRIVER:
+M:      Hans de Goede <hdegoede@redhat.com>
+L:      linux-fsdevel@vger.kernel.org
+S:      Maintained
+F:      drivers/staging/vboxsf/*
 VIRTUAL SERIO DEVICE DRIVER
 M:      Stephen Chandler Paul <thatslyude@gmail.com>
 S:      Maintained
@@ -18034,6 +18044,7 @@ F:	Documentation/vm/zsmalloc.rst
 ZSWAP COMPRESSED SWAP CACHING
 M:      Seth Jennings <sjenning@redhat.com>
 M:      Dan Streetman <ddstreet@ieee.org>
+M:      Vitaly Wool <vitaly.wool@konsulko.com>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      mm/zswap.c
diff --git a/Makefile b/Makefile
index b37d0e8fc61d..1d5298356ea8 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Kleptomaniac Octopus
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
index 2a6ce87071f9..9e027b9a5f91 100644
--- a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
+++ b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
@@ -328,6 +328,10 @@
        pinctrl-0 = <&pinctrl_pwm3>;
 };
+&snvs_pwrkey {
+        status = "okay";
+};
 &ssi2 {
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index f3404dd10537..cf628465cd0a 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -230,6 +230,8 @@
                        accelerometer@1c {
                                compatible = "fsl,mma8451";
                                reg = <0x1c>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_mma8451_int>;
                                interrupt-parent = <&gpio6>;
                                interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
                        };
@@ -628,6 +630,12 @@
                        >;
                };
+                pinctrl_mma8451_int: mma8451intgrp {
+                        fsl,pins = <
+                                MX6QDL_PAD_EIM_BCLK__GPIO6_IO31         0xb0b1
+                        >;
+                };
                pinctrl_pwm3: pwm1grp {
                        fsl,pins = <
                                MX6QDL_PAD_SD4_DAT1__PWM3_OUT           0x1b0b1
diff --git a/arch/arm/boot/dts/stm32mp157c-ev1.dts b/arch/arm/boot/dts/stm32mp157c-ev1.dts
index 89d29b50c3f4..91fc0a315c49 100644
--- a/arch/arm/boot/dts/stm32mp157c-ev1.dts
+++ b/arch/arm/boot/dts/stm32mp157c-ev1.dts
@@ -183,14 +183,12 @@
        ov5640: camera@3c {
                compatible = "ovti,ov5640";
-                pinctrl-names = "default";
-                pinctrl-0 = <&ov5640_pins>;
                reg = <0x3c>;
                clocks = <&clk_ext_camera>;
                clock-names = "xclk";
                DOVDD-supply = <&v2v8>;
-                powerdown-gpios = <&stmfx_pinctrl 18 GPIO_ACTIVE_HIGH>;
+                powerdown-gpios = <&stmfx_pinctrl 18 (GPIO_ACTIVE_HIGH | GPIO_PUSH_PULL)>;
-                reset-gpios = <&stmfx_pinctrl 19 GPIO_ACTIVE_LOW>;
+                reset-gpios = <&stmfx_pinctrl 19 (GPIO_ACTIVE_LOW | GPIO_PUSH_PULL)>;
                rotation = <180>;
                status = "okay";
@@ -223,15 +221,8 @@
                        joystick_pins: joystick {
                                pins = "gpio0", "gpio1", "gpio2", "gpio3", "gpio4";
-                                drive-push-pull;
                                bias-pull-down;
                        };
-                        ov5640_pins: camera {
-                                pins = "agpio2", "agpio3"; /* stmfx pins 18 & 19 */
-                                drive-push-pull;
-                                output-low;
-                        };
                };
        };
 };
diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
index 9b11654a0a39..f98e0370c0bc 100644
--- a/arch/arm/boot/dts/stm32mp157c.dtsi
+++ b/arch/arm/boot/dts/stm32mp157c.dtsi
@@ -932,7 +932,7 @@
                        interrupt-names = "int0", "int1";
                        clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
                        clock-names = "hclk", "cclk";
-                        bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
+                        bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
                        status = "disabled";
                };
@@ -945,7 +945,7 @@
                        interrupt-names = "int0", "int1";
                        clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
                        clock-names = "hclk", "cclk";
-                        bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
+                        bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
index 568b90ece342..3bec3e0a81b2 100644
--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
@@ -192,6 +192,7 @@
        vqmmc-supply = <&reg_dldo1>;
        non-removable;
        wakeup-source;
+        keep-power-in-suspend;
        status = "okay";
        brcmf: wifi@1 {
diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index 239084cf8192..26cbce135338 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -481,14 +481,18 @@ static void sunxi_mc_smp_cpu_die(unsigned int l_cpu)
 static int sunxi_cpu_powerdown(unsigned int cpu, unsigned int cluster)
 {
        u32 reg;
+        int gating_bit = cpu;
        pr_debug("%s: cluster %u cpu %u\n", __func__, cluster, cpu);
        if (cpu >= SUNXI_CPUS_PER_CLUSTER || cluster >= SUNXI_NR_CLUSTERS)
                return -EINVAL;
+        if (is_a83t && cpu == 0)
+                gating_bit = 4;
        /* gate processor power */
        reg = readl(prcm_base + PRCM_PWROFF_GATING_REG(cluster));
-        reg |= PRCM_PWROFF_GATING_REG_CORE(cpu);
+        reg |= PRCM_PWROFF_GATING_REG_CORE(gating_bit);
        writel(reg, prcm_base + PRCM_PWROFF_GATING_REG(cluster));
        udelay(20);
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
index d98346da01df..078a5010228c 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
@@ -127,7 +127,7 @@
        status = "okay";
        i2c-mux@77 {
-                compatible = "nxp,pca9847";
+                compatible = "nxp,pca9547";
                reg = <0x77>;
                #address-cells = <1>;
                #size-cells = <0>;
diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
index 58b8cd06cae7..23c8fad7932b 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -394,7 +394,7 @@
                        };
                        sdma2: dma-controller@302c0000 {
-                                compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
                                reg = <0x302c0000 0x10000>;
                                interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MM_CLK_SDMA2_ROOT>,
@@ -405,7 +405,7 @@
                        };
                        sdma3: dma-controller@302b0000 {
-                                compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
                                reg = <0x302b0000 0x10000>;
                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MM_CLK_SDMA3_ROOT>,
@@ -737,7 +737,7 @@
                        };
                        sdma1: dma-controller@30bd0000 {
-                                compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
                                reg = <0x30bd0000 0x10000>;
                                interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MM_CLK_SDMA1_ROOT>,
diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
index 98496f570720..43c4db312146 100644
--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
@@ -288,7 +288,7 @@
                        };
                        sdma3: dma-controller@302b0000 {
-                                compatible = "fsl,imx8mn-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mn-sdma", "fsl,imx8mq-sdma";
                                reg = <0x302b0000 0x10000>;
                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MN_CLK_SDMA3_ROOT>,
@@ -299,7 +299,7 @@
                        };
                        sdma2: dma-controller@302c0000 {
-                                compatible = "fsl,imx8mn-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mn-sdma", "fsl,imx8mq-sdma";
                                reg = <0x302c0000 0x10000>;
                                interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MN_CLK_SDMA2_ROOT>,
@@ -612,7 +612,7 @@
                        };
                        sdma1: dma-controller@30bd0000 {
-                                compatible = "fsl,imx8mn-sdma", "fsl,imx7d-sdma";
+                                compatible = "fsl,imx8mn-sdma", "fsl,imx8mq-sdma";
                                reg = <0x30bd0000 0x10000>;
                                interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
                                clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>,
diff --git a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
index 087b5b6ebe89..32ce14936b01 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
@@ -88,7 +88,7 @@
                regulator-name = "0V9_ARM";
                regulator-min-microvolt = <900000>;
                regulator-max-microvolt = <1000000>;
-                gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+                gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>;
                states = <1000000 0x1
                           900000 0x0>;
                regulator-always-on;
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 8330810f699e..565aa45ef134 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -283,23 +283,6 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
        set_pte(ptep, pte);
 }
-#define __HAVE_ARCH_PTE_SAME
-static inline int pte_same(pte_t pte_a, pte_t pte_b)
-{
-        pteval_t lhs, rhs;
-        lhs = pte_val(pte_a);
-        rhs = pte_val(pte_b);
-        if (pte_present(pte_a))
-                lhs &= ~PTE_RDONLY;
-        if (pte_present(pte_b))
-                rhs &= ~PTE_RDONLY;
-        return (lhs == rhs);
-}
 /*
 * Huge pte definitions.
 */
diff --git a/arch/arm64/include/asm/vdso/vsyscall.h b/arch/arm64/include/asm/vdso/vsyscall.h
index 0c731bfc7c8c..0c20a7c1bee5 100644
--- a/arch/arm64/include/asm/vdso/vsyscall.h
+++ b/arch/arm64/include/asm/vdso/vsyscall.h
@@ -31,13 +31,6 @@ int __arm64_get_clock_mode(struct timekeeper *tk)
 #define __arch_get_clock_mode __arm64_get_clock_mode
 static __always_inline
-int __arm64_use_vsyscall(struct vdso_data *vdata)
-{
-        return !vdata[CS_HRES_COARSE].clock_mode;
-}
-#define __arch_use_vsyscall __arm64_use_vsyscall
-static __always_inline
 void __arm64_update_vsyscall(struct vdso_data *vdata, struct timekeeper *tk)
 {
        vdata[CS_HRES_COARSE].mask      = VDSO_PRECISION_MASK;
diff --git a/arch/mips/include/asm/vdso/vsyscall.h b/arch/mips/include/asm/vdso/vsyscall.h
index 195314732233..00d41b94ba31 100644
--- a/arch/mips/include/asm/vdso/vsyscall.h
+++ b/arch/mips/include/asm/vdso/vsyscall.h
@@ -28,13 +28,6 @@ int __mips_get_clock_mode(struct timekeeper *tk)
 }
 #define __arch_get_clock_mode __mips_get_clock_mode
-static __always_inline
-int __mips_use_vsyscall(struct vdso_data *vdata)
-{
-        return (vdata[CS_HRES_COARSE].clock_mode != VDSO_CLOCK_NONE);
-}
-#define __arch_use_vsyscall __mips_use_vsyscall
 /* The asm-generic header needs to be included after the definitions above */
 #include <asm-generic/vdso/vsyscall.h>
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 02a59946a78a..be3517ef0574 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -1142,6 +1142,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
        }
        /*
+         * If we have seen a tail call, we need a second pass.
+         * This is because bpf_jit_emit_common_epilogue() is called
+         * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
+         */
+        if (cgctx.seen & SEEN_TAILCALL) {
+                cgctx.idx = 0;
+                if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
+                        fp = org_fp;
+                        goto out_addrs;
+                }
+        }
+        /*
         * Pretend to build prologue, given the features we've seen.  This will
         * update ctgtx.idx as it pretends to output instructions, then we can
         * calculate total size from idx.
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 9e2dd2b296cd..2b0faf86da1b 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1586,9 +1586,6 @@ static void setup_local_APIC(void)
 {
        int cpu = smp_processor_id();
        unsigned int value;
-#ifdef CONFIG_X86_32
-        int logical_apicid, ldr_apicid;
-#endif
        if (disable_apic) {
                disable_ioapic_support();
@@ -1626,16 +1623,21 @@ static void setup_local_APIC(void)
        apic->init_apic_ldr();
 #ifdef CONFIG_X86_32
-        /*
+        if (apic->dest_logical) {
-         * APIC LDR is initialized.  If logical_apicid mapping was
+                int logical_apicid, ldr_apicid;
-         * initialized during get_smp_config(), make sure it matches the
-         * actual value.
+                /*
-         */
+                 * APIC LDR is initialized.  If logical_apicid mapping was
-        logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
+                 * initialized during get_smp_config(), make sure it matches
-        ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
+                 * the actual value.
-        WARN_ON(logical_apicid != BAD_APICID && logical_apicid != ldr_apicid);
+                 */
-        /* always use the value from LDR */
+                logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
-        early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
+                ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
+                if (logical_apicid != BAD_APICID)
+                        WARN_ON(logical_apicid != ldr_apicid);
+                /* Always use the value from LDR. */
+                early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
+        }
 #endif
        /*
diff --git a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
index efbd54cc4e69..055c8613b531 100644
--- a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
+++ b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
@@ -522,6 +522,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
        int ret = 0;
        rdtgrp = rdtgroup_kn_lock_live(of->kn);
+        if (!rdtgrp) {
+                ret = -ENOENT;
+                goto out;
+        }
        md.priv = of->kn->priv;
        resid = md.u.rid;
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 753b8cfe8b8a..87b97897a881 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -94,6 +94,13 @@ static bool in_exception_stack(unsigned long *stack, struct stack_info *info)
        BUILD_BUG_ON(N_EXCEPTION_STACKS != 6);
        begin = (unsigned long)__this_cpu_read(cea_exception_stacks);
+        /*
+         * Handle the case where stack trace is collected _before_
+         * cea_exception_stacks had been initialized.
+         */
+        if (!begin)
+                return false;
        end = begin + sizeof(struct cea_exception_stacks);
        /* Bail if @stack is outside the exception stack area. */
        if (stk < begin || stk >= end)
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index c59454c382fd..7e322e2daaf5 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1505,6 +1505,9 @@ void __init tsc_init(void)
                return;
        }
+        if (tsc_clocksource_reliable || no_tsc_watchdog)
+                clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
        clocksource_register_khz(&clocksource_tsc_early, tsc_khz);
        detect_art();
 }
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 5d21027b1faf..1eb8895be4c6 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -934,9 +934,14 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
                int i;
                bool has_stats = false;
+                spin_lock_irq(&blkg->q->queue_lock);
+                if (!blkg->online)
+                        goto skip;
                dname = blkg_dev_name(blkg);
                if (!dname)
-                        continue;
+                        goto skip;
                /*
                 * Hooray string manipulation, count is the size written NOT
@@ -946,8 +951,6 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
                 */
                off += scnprintf(buf+off, size-off, "%s ", dname);
-                spin_lock_irq(&blkg->q->queue_lock);
                blkg_rwstat_recursive_sum(blkg, NULL,
                                offsetof(struct blkcg_gq, stat_bytes), &rwstat);
                rbytes = rwstat.cnt[BLKG_RWSTAT_READ];
@@ -960,8 +963,6 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
                wios = rwstat.cnt[BLKG_RWSTAT_WRITE];
                dios = rwstat.cnt[BLKG_RWSTAT_DISCARD];
-                spin_unlock_irq(&blkg->q->queue_lock);
                if (rbytes || wbytes || rios || wios) {
                        has_stats = true;
                        off += scnprintf(buf+off, size-off,
@@ -999,6 +1000,8 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
                                seq_commit(sf, -1);
                        }
                }
+        skip:
+                spin_unlock_irq(&blkg->q->queue_lock);
        }
        rcu_read_unlock();
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 5b248763a672..a18155cdce41 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -786,7 +786,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
        if (nc->tentative && connection->agreed_pro_version < 92) {
                rcu_read_unlock();
-                mutex_unlock(&sock->mutex);
                drbd_err(connection, "--dry-run is not supported by peer");
                return -EOPNOTSUPP;
        }
diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
index 87083b3a2769..37c22667e831 100644
--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -297,7 +297,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
                regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
                if (mcfr & AT91_PMC_MAINRDY)
                        return 0;
-                usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+                if (system_state < SYSTEM_RUNNING)
+                        udelay(MAINF_LOOP_MIN_WAIT);
+                else
+                        usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
        } while (time_before(prep_time, timeout));
        return -ETIMEDOUT;
diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
index 9790ddfa5b3c..86238d5ecb4d 100644
--- a/drivers/clk/at91/sam9x60.c
+++ b/drivers/clk/at91/sam9x60.c
@@ -43,6 +43,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
 };
 static const struct clk_programmable_layout sam9x60_programmable_layout = {
+        .pres_mask = 0xff,
        .pres_shift = 8,
        .css_mask = 0x1f,
        .have_slck_mck = 0,
diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
index 9bfe9a28294a..fac0ca56d42d 100644
--- a/drivers/clk/at91/sckc.c
+++ b/drivers/clk/at91/sckc.c
@@ -76,7 +76,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
        writel(tmp | osc->bits->cr_osc32en, sckcr);
-        usleep_range(osc->startup_usec, osc->startup_usec + 1);
+        if (system_state < SYSTEM_RUNNING)
+                udelay(osc->startup_usec);
+        else
+                usleep_range(osc->startup_usec, osc->startup_usec + 1);
        return 0;
 }
@@ -187,7 +190,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
        writel(readl(sckcr) | osc->bits->cr_rcen, sckcr);
-        usleep_range(osc->startup_usec, osc->startup_usec + 1);
+        if (system_state < SYSTEM_RUNNING)
+                udelay(osc->startup_usec);
+        else
+                usleep_range(osc->startup_usec, osc->startup_usec + 1);
        return 0;
 }
@@ -288,7 +294,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
        writel(tmp, sckcr);
-        usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+        if (system_state < SYSTEM_RUNNING)
+                udelay(SLOWCK_SW_TIME_USEC);
+        else
+                usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
        return 0;
 }
@@ -533,7 +542,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
                return 0;
        }
-        usleep_range(osc->startup_usec, osc->startup_usec + 1);
+        if (system_state < SYSTEM_RUNNING)
+                udelay(osc->startup_usec);
+        else
+                usleep_range(osc->startup_usec, osc->startup_usec + 1);
        osc->prepared = true;
        return 0;
diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
index 1c1bb39bb04e..b1318e6b655b 100644
--- a/drivers/clk/clk-ast2600.c
+++ b/drivers/clk/clk-ast2600.c
@@ -266,10 +266,11 @@ static int aspeed_g6_clk_enable(struct clk_hw *hw)
        /* Enable clock */
        if (gate->flags & CLK_GATE_SET_TO_DISABLE) {
-                regmap_write(gate->map, get_clock_reg(gate), clk);
+                /* Clock is clear to enable, so use set to clear register */
-        } else {
-                /* Use set to clear register */
                regmap_write(gate->map, get_clock_reg(gate) + 0x04, clk);
+        } else {
+                /* Clock is set to enable, so use write to set register */
+                regmap_write(gate->map, get_clock_reg(gate), clk);
        }
        if (gate->reset_idx >= 0) {
diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c
index 067ab876911d..172589e94f60 100644
--- a/drivers/clk/imx/clk-imx8mm.c
+++ b/drivers/clk/imx/clk-imx8mm.c
@@ -638,7 +638,7 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)
                                           clks[IMX8MM_CLK_A53_DIV],
                                           clks[IMX8MM_CLK_A53_SRC],
                                           clks[IMX8MM_ARM_PLL_OUT],
-                                           clks[IMX8MM_CLK_24M]);
+                                           clks[IMX8MM_SYS_PLL1_800M]);
        imx_check_clocks(clks, ARRAY_SIZE(clks));
diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
index 47a4b44ba3cb..58b5acee3830 100644
--- a/drivers/clk/imx/clk-imx8mn.c
+++ b/drivers/clk/imx/clk-imx8mn.c
@@ -610,7 +610,7 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
                                           clks[IMX8MN_CLK_A53_DIV],
                                           clks[IMX8MN_CLK_A53_SRC],
                                           clks[IMX8MN_ARM_PLL_OUT],
-                                           clks[IMX8MN_CLK_24M]);
+                                           clks[IMX8MN_SYS_PLL1_800M]);
        imx_check_clocks(clks, ARRAY_SIZE(clks));
diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
index ea4c791f106d..b3af61cc6fb9 100644
--- a/drivers/clk/meson/g12a.c
+++ b/drivers/clk/meson/g12a.c
@@ -343,6 +343,7 @@ static struct clk_regmap g12a_cpu_clk_premux0 = {
                .offset = HHI_SYS_CPU_CLK_CNTL0,
                .mask = 0x3,
                .shift = 0,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk_dyn0_sel",
@@ -353,8 +354,7 @@ static struct clk_regmap g12a_cpu_clk_premux0 = {
                        { .hw = &g12a_fclk_div3.hw },
                },
                .num_parents = 3,
-                /* This sub-tree is used a parking clock */
+                .flags = CLK_SET_RATE_PARENT,
-                .flags = CLK_SET_RATE_NO_REPARENT,
        },
 };
@@ -410,6 +410,7 @@ static struct clk_regmap g12a_cpu_clk_postmux0 = {
                .offset = HHI_SYS_CPU_CLK_CNTL0,
                .mask = 0x1,
                .shift = 2,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk_dyn0",
@@ -466,6 +467,7 @@ static struct clk_regmap g12a_cpu_clk_dyn = {
                .offset = HHI_SYS_CPU_CLK_CNTL0,
                .mask = 0x1,
                .shift = 10,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk_dyn",
@@ -485,6 +487,7 @@ static struct clk_regmap g12a_cpu_clk = {
                .offset = HHI_SYS_CPU_CLK_CNTL0,
                .mask = 0x1,
                .shift = 11,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk",
@@ -504,6 +507,7 @@ static struct clk_regmap g12b_cpu_clk = {
                .offset = HHI_SYS_CPU_CLK_CNTL0,
                .mask = 0x1,
                .shift = 11,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpu_clk",
@@ -523,6 +527,7 @@ static struct clk_regmap g12b_cpub_clk_premux0 = {
                .offset = HHI_SYS_CPUB_CLK_CNTL,
                .mask = 0x3,
                .shift = 0,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpub_clk_dyn0_sel",
@@ -533,6 +538,7 @@ static struct clk_regmap g12b_cpub_clk_premux0 = {
                        { .hw = &g12a_fclk_div3.hw },
                },
                .num_parents = 3,
+                .flags = CLK_SET_RATE_PARENT,
        },
 };
@@ -567,6 +573,7 @@ static struct clk_regmap g12b_cpub_clk_postmux0 = {
                .offset = HHI_SYS_CPUB_CLK_CNTL,
                .mask = 0x1,
                .shift = 2,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpub_clk_dyn0",
@@ -644,6 +651,7 @@ static struct clk_regmap g12b_cpub_clk_dyn = {
                .offset = HHI_SYS_CPUB_CLK_CNTL,
                .mask = 0x1,
                .shift = 10,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpub_clk_dyn",
@@ -663,6 +671,7 @@ static struct clk_regmap g12b_cpub_clk = {
                .offset = HHI_SYS_CPUB_CLK_CNTL,
                .mask = 0x1,
                .shift = 11,
+                .flags = CLK_MUX_ROUND_CLOSEST,
        },
        .hw.init = &(struct clk_init_data){
                .name = "cpub_clk",
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 7cfb998eeb3e..1f9c056e684c 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -935,6 +935,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
                        &gxbb_sar_adc_clk_sel.hw
                },
                .num_parents = 1,
+                .flags = CLK_SET_RATE_PARENT,
        },
 };
diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 7670cc596c74..31466cd1842f 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -165,12 +165,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
        GATE_BUS_CPU,
        GATE_SCLK_CPU,
        CLKOUT_CMU_CPU,
+        CPLL_CON0,
+        DPLL_CON0,
        EPLL_CON0,
        EPLL_CON1,
        EPLL_CON2,
        RPLL_CON0,
        RPLL_CON1,
        RPLL_CON2,
+        IPLL_CON0,
+        SPLL_CON0,
+        VPLL_CON0,
+        MPLL_CON0,
        SRC_TOP0,
        SRC_TOP1,
        SRC_TOP2,
@@ -1172,8 +1178,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
        GATE(CLK_SCLK_ISP_SENSOR2, "sclk_isp_sensor2", "dout_isp_sensor2",
                        GATE_TOP_SCLK_ISP, 12, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
        /* CDREX */
        GATE(CLK_CLKM_PHY0, "clkm_phy0", "dout_sclk_cdrex",
                        GATE_BUS_CDREX0, 0, 0, 0),
@@ -1248,6 +1252,15 @@ static struct exynos5_subcmu_reg_dump exynos5x_gsc_suspend_regs[] = {
        { DIV2_RATIO0, 0, 0x30 },       /* DIV dout_gscl_blk_300 */
 };
+static const struct samsung_gate_clock exynos5x_g3d_gate_clks[] __initconst = {
+        GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
+};
+static struct exynos5_subcmu_reg_dump exynos5x_g3d_suspend_regs[] = {
+        { GATE_IP_G3D, 0x3ff, 0x3ff },  /* G3D gates */
+        { SRC_TOP5, 0, BIT(16) },       /* MUX mout_user_aclk_g3d */
+};
 static const struct samsung_div_clock exynos5x_mfc_div_clks[] __initconst = {
        DIV(0, "dout_mfc_blk", "mout_user_aclk333", DIV4_RATIO, 0, 2),
 };
@@ -1320,6 +1333,14 @@ static const struct exynos5_subcmu_info exynos5x_gsc_subcmu = {
        .pd_name        = "GSC",
 };
+static const struct exynos5_subcmu_info exynos5x_g3d_subcmu = {
+        .gate_clks      = exynos5x_g3d_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5x_g3d_gate_clks),
+        .suspend_regs   = exynos5x_g3d_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5x_g3d_suspend_regs),
+        .pd_name        = "G3D",
+};
 static const struct exynos5_subcmu_info exynos5x_mfc_subcmu = {
        .div_clks       = exynos5x_mfc_div_clks,
        .nr_div_clks    = ARRAY_SIZE(exynos5x_mfc_div_clks),
@@ -1351,6 +1372,7 @@ static const struct exynos5_subcmu_info exynos5800_mau_subcmu = {
 static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
        &exynos5x_disp_subcmu,
        &exynos5x_gsc_subcmu,
+        &exynos5x_g3d_subcmu,
        &exynos5x_mfc_subcmu,
        &exynos5x_mscl_subcmu,
 };
@@ -1358,6 +1380,7 @@ static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
 static const struct exynos5_subcmu_info *exynos5800_subcmus[] = {
        &exynos5x_disp_subcmu,
        &exynos5x_gsc_subcmu,
+        &exynos5x_g3d_subcmu,
        &exynos5x_mfc_subcmu,
        &exynos5x_mscl_subcmu,
        &exynos5800_mau_subcmu,
diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
index 7824c2ba3d8e..4b1aa9382ad2 100644
--- a/drivers/clk/samsung/clk-exynos5433.c
+++ b/drivers/clk/samsung/clk-exynos5433.c
@@ -13,6 +13,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/slab.h>
 #include <dt-bindings/clock/exynos5433.h>
@@ -5584,6 +5585,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
        data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
                                                    info->nr_clk_regs);
+        if (!data->clk_save)
+                return -ENOMEM;
        data->nr_clk_save = info->nr_clk_regs;
        data->clk_suspend = info->suspend_regs;
        data->nr_clk_suspend = info->nr_suspend_regs;
@@ -5592,12 +5595,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
        if (data->nr_pclks > 0) {
                data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
                                           data->nr_pclks, GFP_KERNEL);
+                if (!data->pclks) {
+                        kfree(data->clk_save);
+                        return -ENOMEM;
+                }
                for (i = 0; i < data->nr_pclks; i++) {
                        struct clk *clk = of_clk_get(dev->of_node, i);
-                        if (IS_ERR(clk))
+                        if (IS_ERR(clk)) {
+                                kfree(data->clk_save);
+                                while (--i >= 0)
+                                        clk_put(data->pclks[i]);
                                return PTR_ERR(clk);
+                        }
                        data->pclks[i] = clk;
                }
        }
diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
index dcac1391767f..ef29582676f6 100644
--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
@@ -1224,7 +1224,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
        /* Enforce d1 = 0, d2 = 0 for Audio PLL */
        val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
-        val &= (BIT(16) & BIT(18));
+        val &= ~(BIT(16) | BIT(18));
        writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
        /* Enforce P = 1 for both CPU cluster PLLs */
diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
index d3a43381a792..27201fd26e44 100644
--- a/drivers/clk/sunxi/clk-sunxi.c
+++ b/drivers/clk/sunxi/clk-sunxi.c
@@ -1080,8 +1080,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
                                                 rate_hw, rate_ops,
                                                 gate_hw, &clk_gate_ops,
                                                 clkflags |
-                                                 data->div[i].critical ?
+                                                 (data->div[i].critical ?
-                                                        CLK_IS_CRITICAL : 0);
+                                                        CLK_IS_CRITICAL : 0));
                WARN_ON(IS_ERR(clk_data->clks[i]));
        }
diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
index a01ca9395179..f65e16c4f3c4 100644
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
        struct clk_init_data init = { NULL };
        const char **parent_names = NULL;
        struct clk *clk;
-        int ret;
        clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
        if (!clk_hw) {
@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
        clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
        if (!IS_ERR(clk)) {
-                ret = ti_clk_add_alias(NULL, clk, node->name);
-                if (ret) {
-                        clk_unregister(clk);
-                        goto cleanup;
-                }
                of_clk_add_provider(node, of_clk_src_simple_get, clk);
                kfree(parent_names);
                return;
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index 975995eea15c..b0c0690a5a12 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
         * can be from a timer that requires pm_runtime access, which
         * will eventually bring us here with timekeeping_suspended,
         * during both suspend entry and resume paths. This happens
-         * at least on am43xx platform.
+         * at least on am43xx platform. Account for flakeyness
+         * with udelay() by multiplying the timeout value by 2.
         */
        if (unlikely(_early_timeout || timekeeping_suspended)) {
                if (time->cycles++ < timeout) {
-                        udelay(1);
+                        udelay(1 * 2);
                        return false;
                }
        } else {
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 354b27d14a19..62812f80b5cc 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -328,12 +328,13 @@ static int sh_mtu2_register(struct sh_mtu2_channel *ch, const char *name)
        return 0;
 }
+static const unsigned int sh_mtu2_channel_offsets[] = {
+        0x300, 0x380, 0x000,
+};
 static int sh_mtu2_setup_channel(struct sh_mtu2_channel *ch, unsigned int index,
                                 struct sh_mtu2_device *mtu)
 {
-        static const unsigned int channel_offsets[] = {
-                0x300, 0x380, 0x000,
-        };
        char name[6];
        int irq;
        int ret;
@@ -356,7 +357,7 @@ static int sh_mtu2_setup_channel(struct sh_mtu2_channel *ch, unsigned int index,
                return ret;
        }
-        ch->base = mtu->mapbase + channel_offsets[index];
+        ch->base = mtu->mapbase + sh_mtu2_channel_offsets[index];
        ch->index = index;
        return sh_mtu2_register(ch, dev_name(&mtu->pdev->dev));
@@ -408,7 +409,12 @@ static int sh_mtu2_setup(struct sh_mtu2_device *mtu,
        }
        /* Allocate and setup the channels. */
-        mtu->num_channels = 3;
+        ret = platform_irq_count(pdev);
+        if (ret < 0)
+                goto err_unmap;
+        mtu->num_channels = min_t(unsigned int, ret,
+                                  ARRAY_SIZE(sh_mtu2_channel_offsets));
        mtu->channels = kcalloc(mtu->num_channels, sizeof(*mtu->channels),
                                GFP_KERNEL);
diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
index a562f491b0f8..9318edcd8963 100644
--- a/drivers/clocksource/timer-mediatek.c
+++ b/drivers/clocksource/timer-mediatek.c
@@ -268,15 +268,12 @@ static int __init mtk_syst_init(struct device_node *node)
        ret = timer_of_init(node, &to);
        if (ret)
-                goto err;
+                return ret;
        clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
                                        TIMER_SYNC_TICKS, 0xffffffff);
        return 0;
-err:
-        timer_of_cleanup(&to);
-        return ret;
 }
 static int __init mtk_gpt_init(struct device_node *node)
@@ -293,7 +290,7 @@ static int __init mtk_gpt_init(struct device_node *node)
        ret = timer_of_init(node, &to);
        if (ret)
-                goto err;
+                return ret;
        /* Configure clock source */
        mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
@@ -311,9 +308,6 @@ static int __init mtk_gpt_init(struct device_node *node)
        mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
        return 0;
-err:
-        timer_of_cleanup(&to);
-        return ret;
 }
 TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
 TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 53a51c169451..8ab31702cf6a 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -847,11 +847,9 @@ static void intel_pstate_hwp_force_min_perf(int cpu)
        value |= HWP_MAX_PERF(min_perf);
        value |= HWP_MIN_PERF(min_perf);
-        /* Set EPP/EPB to min */
+        /* Set EPP to min */
        if (boot_cpu_has(X86_FEATURE_HWP_EPP))
                value |= HWP_ENERGY_PERF_PREFERENCE(HWP_EPP_POWERSAVE);
-        else
-                intel_pstate_set_epb(cpu, HWP_EPP_BALANCE_POWERSAVE);
        wrmsrl_on_cpu(cpu, MSR_HWP_REQUEST, value);
 }
diff --git a/drivers/gpio/gpio-merrifield.c b/drivers/gpio/gpio-merrifield.c
index 2f1e9da81c1e..3302125e5265 100644
--- a/drivers/gpio/gpio-merrifield.c
+++ b/drivers/gpio/gpio-merrifield.c
@@ -362,9 +362,8 @@ static void mrfld_irq_handler(struct irq_desc *desc)
        chained_irq_exit(irqchip, desc);
 }
-static int mrfld_irq_init_hw(struct gpio_chip *chip)
+static void mrfld_irq_init_hw(struct mrfld_gpio *priv)
 {
-        struct mrfld_gpio *priv = gpiochip_get_data(chip);
        void __iomem *reg;
        unsigned int base;
@@ -376,8 +375,6 @@ static int mrfld_irq_init_hw(struct gpio_chip *chip)
                reg = gpio_reg(&priv->chip, base, GFER);
                writel(0, reg);
        }
-        return 0;
 }
 static const char *mrfld_gpio_get_pinctrl_dev_name(struct mrfld_gpio *priv)
@@ -400,7 +397,6 @@ static int mrfld_gpio_probe(struct pci_dev *pdev, const struct pci_device_id *id
 {
        const struct mrfld_gpio_pinrange *range;
        const char *pinctrl_dev_name;
-        struct gpio_irq_chip *girq;
        struct mrfld_gpio *priv;
        u32 gpio_base, irq_base;
        void __iomem *base;
@@ -448,21 +444,6 @@ static int mrfld_gpio_probe(struct pci_dev *pdev, const struct pci_device_id *id
        raw_spin_lock_init(&priv->lock);
-        girq = &priv->chip.irq;
-        girq->chip = &mrfld_irqchip;
-        girq->init_hw = mrfld_irq_init_hw;
-        girq->parent_handler = mrfld_irq_handler;
-        girq->num_parents = 1;
-        girq->parents = devm_kcalloc(&pdev->dev, girq->num_parents,
-                                     sizeof(*girq->parents),
-                                     GFP_KERNEL);
-        if (!girq->parents)
-                return -ENOMEM;
-        girq->parents[0] = pdev->irq;
-        girq->first = irq_base;
-        girq->default_type = IRQ_TYPE_NONE;
-        girq->handler = handle_bad_irq;
        pci_set_drvdata(pdev, priv);
        retval = devm_gpiochip_add_data(&pdev->dev, &priv->chip, priv);
        if (retval) {
@@ -484,6 +465,18 @@ static int mrfld_gpio_probe(struct pci_dev *pdev, const struct pci_device_id *id
                }
        }
+        retval = gpiochip_irqchip_add(&priv->chip, &mrfld_irqchip, irq_base,
+                                      handle_bad_irq, IRQ_TYPE_NONE);
+        if (retval) {
+                dev_err(&pdev->dev, "could not connect irqchip to gpiochip\n");
+                return retval;
+        }
+        mrfld_irq_init_hw(priv);
+        gpiochip_set_chained_irqchip(&priv->chip, &mrfld_irqchip, pdev->irq,
+                                     mrfld_irq_handler);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 6614d8a6f4c8..2cdaf3b2a721 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -604,8 +604,11 @@ void amdgpu_ctx_mgr_entity_fini(struct amdgpu_ctx_mgr *mgr)
                        continue;
                }
-                for (i = 0; i < num_entities; i++)
+                for (i = 0; i < num_entities; i++) {
+                        mutex_lock(&ctx->adev->lock_reset);
                        drm_sched_entity_fini(&ctx->entities[0][i].entity);
+                        mutex_unlock(&ctx->adev->lock_reset);
+                }
        }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 5a1939dbd4e3..7a6c837c0a85 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2885,6 +2885,13 @@ fence_driver_init:
                        DRM_INFO("amdgpu: acceleration disabled, skipping benchmarks\n");
        }
+        /*
+         * Register gpu instance before amdgpu_device_enable_mgpu_fan_boost.
+         * Otherwise the mgpu fan boost feature will be skipped due to the
+         * gpu instance is counted less.
+         */
+        amdgpu_register_gpu_instance(adev);
        /* enable clockgating, etc. after ib tests, etc. since some blocks require
         * explicit gating rather than handling it automatically.
         */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 2a00a36106b2..e1c15721611a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1016,6 +1016,7 @@ static const struct pci_device_id pciidlist[] = {
        {0x1002, 0x7340, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI14|AMD_EXP_HW_SUPPORT},
        {0x1002, 0x7341, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI14|AMD_EXP_HW_SUPPORT},
        {0x1002, 0x7347, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI14|AMD_EXP_HW_SUPPORT},
+        {0x1002, 0x734F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI14|AMD_EXP_HW_SUPPORT},
        /* Renoir */
        {0x1002, 0x1636, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU|AMD_EXP_HW_SUPPORT},
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
index 6ee4021910e2..6d19183b478b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
@@ -289,6 +289,7 @@ struct amdgpu_gfx {
        uint32_t                        mec2_feature_version;
        bool                            mec_fw_write_wait;
        bool                            me_fw_write_wait;
+        bool                            cp_fw_write_wait;
        struct amdgpu_ring              gfx_ring[AMDGPU_MAX_GFX_RINGS];
        unsigned                        num_gfx_rings;
        struct amdgpu_ring              compute_ring[AMDGPU_MAX_COMPUTE_RINGS];
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index d55f5baa83d3..a042ef471fbd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -190,7 +190,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
                pm_runtime_put_autosuspend(dev->dev);
        }
-        amdgpu_register_gpu_instance(adev);
 out:
        if (r) {
                /* balance pm_runtime_get_sync in amdgpu_driver_unload_kms */
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 8dfc775626a7..53090eae0082 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -564,6 +564,32 @@ static void gfx_v10_0_free_microcode(struct amdgpu_device *adev)
        kfree(adev->gfx.rlc.register_list_format);
 }
+static void gfx_v10_0_check_fw_write_wait(struct amdgpu_device *adev)
+{
+        adev->gfx.cp_fw_write_wait = false;
+        switch (adev->asic_type) {
+        case CHIP_NAVI10:
+        case CHIP_NAVI12:
+        case CHIP_NAVI14:
+                if ((adev->gfx.me_fw_version >= 0x00000046) &&
+                    (adev->gfx.me_feature_version >= 27) &&
+                    (adev->gfx.pfp_fw_version >= 0x00000068) &&
+                    (adev->gfx.pfp_feature_version >= 27) &&
+                    (adev->gfx.mec_fw_version >= 0x0000005b) &&
+                    (adev->gfx.mec_feature_version >= 27))
+                        adev->gfx.cp_fw_write_wait = true;
+                break;
+        default:
+                break;
+        }
+        if (adev->gfx.cp_fw_write_wait == false)
+                DRM_WARN_ONCE("Warning: check cp_fw_version and update it to realize \
+                              GRBM requires 1-cycle delay in cp firmware\n");
+}
 static void gfx_v10_0_init_rlc_ext_microcode(struct amdgpu_device *adev)
 {
        const struct rlc_firmware_header_v2_1 *rlc_hdr;
@@ -832,6 +858,7 @@ static int gfx_v10_0_init_microcode(struct amdgpu_device *adev)
                }
        }
+        gfx_v10_0_check_fw_write_wait(adev);
 out:
        if (err) {
                dev_err(adev->dev,
@@ -4765,6 +4792,24 @@ static void gfx_v10_0_ring_emit_reg_wait(struct amdgpu_ring *ring, uint32_t reg,
        gfx_v10_0_wait_reg_mem(ring, 0, 0, 0, reg, 0, val, mask, 0x20);
 }
+static void gfx_v10_0_ring_emit_reg_write_reg_wait(struct amdgpu_ring *ring,
+                                                   uint32_t reg0, uint32_t reg1,
+                                                   uint32_t ref, uint32_t mask)
+{
+        int usepfp = (ring->funcs->type == AMDGPU_RING_TYPE_GFX);
+        struct amdgpu_device *adev = ring->adev;
+        bool fw_version_ok = false;
+        fw_version_ok = adev->gfx.cp_fw_write_wait;
+        if (fw_version_ok)
+                gfx_v10_0_wait_reg_mem(ring, usepfp, 0, 1, reg0, reg1,
+                                       ref, mask, 0x20);
+        else
+                amdgpu_ring_emit_reg_write_reg_wait_helper(ring, reg0, reg1,
+                                                           ref, mask);
+}
 static void
 gfx_v10_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
                                      uint32_t me, uint32_t pipe,
@@ -5155,6 +5200,7 @@ static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_gfx = {
        .emit_tmz = gfx_v10_0_ring_emit_tmz,
        .emit_wreg = gfx_v10_0_ring_emit_wreg,
        .emit_reg_wait = gfx_v10_0_ring_emit_reg_wait,
+        .emit_reg_write_reg_wait = gfx_v10_0_ring_emit_reg_write_reg_wait,
 };
 static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_compute = {
@@ -5188,6 +5234,7 @@ static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_compute = {
        .pad_ib = amdgpu_ring_generic_pad_ib,
        .emit_wreg = gfx_v10_0_ring_emit_wreg,
        .emit_reg_wait = gfx_v10_0_ring_emit_reg_wait,
+        .emit_reg_write_reg_wait = gfx_v10_0_ring_emit_reg_write_reg_wait,
 };
 static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_kiq = {
@@ -5218,6 +5265,7 @@ static const struct amdgpu_ring_funcs gfx_v10_0_ring_funcs_kiq = {
        .emit_rreg = gfx_v10_0_ring_emit_rreg,
        .emit_wreg = gfx_v10_0_ring_emit_wreg,
        .emit_reg_wait = gfx_v10_0_ring_emit_reg_wait,
+        .emit_reg_write_reg_wait = gfx_v10_0_ring_emit_reg_write_reg_wait,
 };
 static void gfx_v10_0_set_ring_funcs(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index dcadc73bffd2..dfca83a2de47 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -973,6 +973,13 @@ static void gfx_v9_0_check_fw_write_wait(struct amdgpu_device *adev)
        adev->gfx.me_fw_write_wait = false;
        adev->gfx.mec_fw_write_wait = false;
+        if ((adev->gfx.mec_fw_version < 0x000001a5) ||
+            (adev->gfx.mec_feature_version < 46) ||
+            (adev->gfx.pfp_fw_version < 0x000000b7) ||
+            (adev->gfx.pfp_feature_version < 46))
+                DRM_WARN_ONCE("Warning: check cp_fw_version and update it to realize \
+                              GRBM requires 1-cycle delay in cp firmware\n");
        switch (adev->asic_type) {
        case CHIP_VEGA10:
                if ((adev->gfx.me_fw_version >= 0x0000009c) &&
@@ -1044,6 +1051,12 @@ static void gfx_v9_0_check_if_need_gfxoff(struct amdgpu_device *adev)
                                AMD_PG_SUPPORT_CP |
                                AMD_PG_SUPPORT_RLC_SMU_HS;
                break;
+        case CHIP_RENOIR:
+                if (adev->pm.pp_feature & PP_GFXOFF_MASK)
+                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_RLC_SMU_HS;
+                break;
        default:
                break;
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
index 354e6200ca9a..5c7d5f73f54f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
@@ -344,11 +344,9 @@ static uint64_t gmc_v10_0_emit_flush_gpu_tlb(struct amdgpu_ring *ring,
        amdgpu_ring_emit_wreg(ring, hub->ctx0_ptb_addr_hi32 + (2 * vmid),
                              upper_32_bits(pd_addr));
-        amdgpu_ring_emit_wreg(ring, hub->vm_inv_eng0_req + eng, req);
+        amdgpu_ring_emit_reg_write_reg_wait(ring, hub->vm_inv_eng0_req + eng,
+                                            hub->vm_inv_eng0_ack + eng,
-        /* wait for the invalidate to complete */
+                                            req, 1 << vmid);
-        amdgpu_ring_emit_reg_wait(ring, hub->vm_inv_eng0_ack + eng,
-                                  1 << vmid, 1 << vmid);
        return pd_addr;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
index 0cf7ef44b4b5..9ed178fa241c 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
@@ -219,6 +219,15 @@ static void mmhub_v9_4_init_cache_regs(struct amdgpu_device *adev, int hubid)
                            hubid * MMHUB_INSTANCE_REGISTER_OFFSET, tmp);
        tmp = mmVML2PF0_VM_L2_CNTL3_DEFAULT;
+        if (adev->gmc.translate_further) {
+                tmp = REG_SET_FIELD(tmp, VML2PF0_VM_L2_CNTL3, BANK_SELECT, 12);
+                tmp = REG_SET_FIELD(tmp, VML2PF0_VM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 9);
+        } else {
+                tmp = REG_SET_FIELD(tmp, VML2PF0_VM_L2_CNTL3, BANK_SELECT, 9);
+                tmp = REG_SET_FIELD(tmp, VML2PF0_VM_L2_CNTL3,
+                                    L2_CACHE_BIGK_FRAGMENT_SIZE, 6);
+        }
        WREG32_SOC15_OFFSET(MMHUB, 0, mmVML2PF0_VM_L2_CNTL3,
                            hubid * MMHUB_INSTANCE_REGISTER_OFFSET, tmp);
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
index f6e81680dd7e..8493bfbbc148 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
@@ -1173,6 +1173,16 @@ static void sdma_v5_0_ring_emit_reg_wait(struct amdgpu_ring *ring, uint32_t reg,
                          SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(10));
 }
+static void sdma_v5_0_ring_emit_reg_write_reg_wait(struct amdgpu_ring *ring,
+                                                   uint32_t reg0, uint32_t reg1,
+                                                   uint32_t ref, uint32_t mask)
+{
+        amdgpu_ring_emit_wreg(ring, reg0, ref);
+        /* wait for a cycle to reset vm_inv_eng*_ack */
+        amdgpu_ring_emit_reg_wait(ring, reg0, 0, 0);
+        amdgpu_ring_emit_reg_wait(ring, reg1, mask, mask);
+}
 static int sdma_v5_0_early_init(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -1588,7 +1598,7 @@ static const struct amdgpu_ring_funcs sdma_v5_0_ring_funcs = {
                6 + /* sdma_v5_0_ring_emit_pipeline_sync */
                /* sdma_v5_0_ring_emit_vm_flush */
                SOC15_FLUSH_GPU_TLB_NUM_WREG * 3 +
-                SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 6 +
+                SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 6 * 2 +
                10 + 10 + 10, /* sdma_v5_0_ring_emit_fence x3 for user fence, vm fence */
        .emit_ib_size = 7 + 6, /* sdma_v5_0_ring_emit_ib */
        .emit_ib = sdma_v5_0_ring_emit_ib,
@@ -1602,6 +1612,7 @@ static const struct amdgpu_ring_funcs sdma_v5_0_ring_funcs = {
        .pad_ib = sdma_v5_0_ring_pad_ib,
        .emit_wreg = sdma_v5_0_ring_emit_wreg,
        .emit_reg_wait = sdma_v5_0_ring_emit_reg_wait,
+        .emit_reg_write_reg_wait = sdma_v5_0_ring_emit_reg_write_reg_wait,
        .init_cond_exec = sdma_v5_0_ring_init_cond_exec,
        .patch_cond_exec = sdma_v5_0_ring_patch_cond_exec,
        .preempt_ib = sdma_v5_0_ring_preempt_ib,
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index f8ab80c8801b..4ccfcdf8f16a 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -1186,11 +1186,6 @@ static int soc15_common_early_init(void *handle)
                                 AMD_PG_SUPPORT_VCN |
                                 AMD_PG_SUPPORT_VCN_DPG;
                adev->external_rev_id = adev->rev_id + 0x91;
-                if (adev->pm.pp_feature & PP_GFXOFF_MASK)
-                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
-                                AMD_PG_SUPPORT_CP |
-                                AMD_PG_SUPPORT_RLC_SMU_HS;
                break;
        default:
                /* FIXME: not supported yet */
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 9c58670d5414..ca20b150afcc 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2767,15 +2767,6 @@ void core_link_enable_stream(
                                        CONTROLLER_DP_TEST_PATTERN_VIDEOMODE,
                                        COLOR_DEPTH_UNDEFINED);
-                /* This second call is needed to reconfigure the DIG
-                 * as a workaround for the incorrect value being applied
-                 * from transmitter control.
-                 */
-                if (!dc_is_virtual_signal(pipe_ctx->stream->signal))
-                        stream->link->link_enc->funcs->setup(
-                                stream->link->link_enc,
-                                pipe_ctx->stream->signal);
 #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
                if (pipe_ctx->stream->timing.flags.DSC) {
                        if (dc_is_dp_signal(pipe_ctx->stream->signal) ||
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index dfb208285a9c..6b2f2f1a1c9c 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -1107,6 +1107,11 @@ struct stream_encoder *dcn20_stream_encoder_create(
        if (!enc1)
                return NULL;
+        if (ASICREV_IS_NAVI14_M(ctx->asic_id.hw_internal_rev)) {
+                if (eng_id >= ENGINE_ID_DIGD)
+                        eng_id++;
+        }
        dcn20_stream_encoder_construct(enc1, ctx, ctx->dc_bios, eng_id,
                                        &stream_enc_regs[eng_id],
                                        &se_shift, &se_mask);
diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
index 0b461404af6b..3ec5a10a7c4d 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
@@ -205,7 +205,7 @@ static struct smu_11_0_cmn2aisc_mapping navi10_workload_map[PP_SMC_POWER_PROFILE
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,          WORKLOAD_PPLIB_POWER_SAVING_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,                WORKLOAD_PPLIB_VIDEO_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,                   WORKLOAD_PPLIB_VR_BIT),
-        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,              WORKLOAD_PPLIB_CUSTOM_BIT),
+        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,              WORKLOAD_PPLIB_COMPUTE_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,               WORKLOAD_PPLIB_CUSTOM_BIT),
 };
diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
index bbd8ebd58434..92c393f613d3 100644
--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
@@ -219,7 +219,7 @@ static struct smu_11_0_cmn2aisc_mapping vega20_workload_map[PP_SMC_POWER_PROFILE
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,          WORKLOAD_PPLIB_POWER_SAVING_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,                WORKLOAD_PPLIB_VIDEO_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,                   WORKLOAD_PPLIB_VR_BIT),
-        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,              WORKLOAD_PPLIB_CUSTOM_BIT),
+        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,              WORKLOAD_PPLIB_COMPUTE_BIT),
        WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,               WORKLOAD_PPLIB_CUSTOM_BIT),
 };
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 3ef2ac52ce94..2dd2cd87cdbb 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1581,8 +1581,11 @@ static void commit_tail(struct drm_atomic_state *old_state)
 {
        struct drm_device *dev = old_state->dev;
        const struct drm_mode_config_helper_funcs *funcs;
+        struct drm_crtc_state *new_crtc_state;
+        struct drm_crtc *crtc;
        ktime_t start;
        s64 commit_time_ms;
+        unsigned int i, new_self_refresh_mask = 0;
        funcs = dev->mode_config.helper_private;
@@ -1602,6 +1605,15 @@ static void commit_tail(struct drm_atomic_state *old_state)
        drm_atomic_helper_wait_for_dependencies(old_state);
+        /*
+         * We cannot safely access new_crtc_state after
+         * drm_atomic_helper_commit_hw_done() so figure out which crtc's have
+         * self-refresh active beforehand:
+         */
+        for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i)
+                if (new_crtc_state->self_refresh_active)
+                        new_self_refresh_mask |= BIT(i);
        if (funcs && funcs->atomic_commit_tail)
                funcs->atomic_commit_tail(old_state);
        else
@@ -1610,7 +1622,8 @@ static void commit_tail(struct drm_atomic_state *old_state)
        commit_time_ms = ktime_ms_delta(ktime_get(), start);
        if (commit_time_ms > 0)
                drm_self_refresh_helper_update_avg_times(old_state,
-                                                 (unsigned long)commit_time_ms);
+                                                 (unsigned long)commit_time_ms,
+                                                 new_self_refresh_mask);
        drm_atomic_helper_commit_cleanup_done(old_state);
diff --git a/drivers/gpu/drm/drm_self_refresh_helper.c b/drivers/gpu/drm/drm_self_refresh_helper.c
index 68f4765a5896..dd33fec5aabd 100644
--- a/drivers/gpu/drm/drm_self_refresh_helper.c
+++ b/drivers/gpu/drm/drm_self_refresh_helper.c
@@ -133,29 +133,33 @@ out_drop_locks:
 * drm_self_refresh_helper_update_avg_times - Updates a crtc's SR time averages
 * @state: the state which has just been applied to hardware
 * @commit_time_ms: the amount of time in ms that this commit took to complete
+ * @new_self_refresh_mask: bitmask of crtc's that have self_refresh_active in
+ *    new state
 *
 * Called after &drm_mode_config_funcs.atomic_commit_tail, this function will
 * update the average entry/exit self refresh times on self refresh transitions.
 * These averages will be used when calculating how long to delay before
 * entering self refresh mode after activity.
 */
-void drm_self_refresh_helper_update_avg_times(struct drm_atomic_state *state,
+void
-                                              unsigned int commit_time_ms)
+drm_self_refresh_helper_update_avg_times(struct drm_atomic_state *state,
+                                         unsigned int commit_time_ms,
+                                         unsigned int new_self_refresh_mask)
 {
        struct drm_crtc *crtc;
-        struct drm_crtc_state *old_crtc_state, *new_crtc_state;
+        struct drm_crtc_state *old_crtc_state;
        int i;
-        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state,
+        for_each_old_crtc_in_state(state, crtc, old_crtc_state, i) {
-                                      new_crtc_state, i) {
+                bool new_self_refresh_active = new_self_refresh_mask & BIT(i);
                struct drm_self_refresh_data *sr_data = crtc->self_refresh_data;
                struct ewma_psr_time *time;
                if (old_crtc_state->self_refresh_active ==
-                    new_crtc_state->self_refresh_active)
+                    new_self_refresh_active)
                        continue;
-                if (new_crtc_state->self_refresh_active)
+                if (new_self_refresh_active)
                        time = &sr_data->entry_avg_ms;
                else
                        time = &sr_data->exit_avg_ms;
diff --git a/drivers/gpu/drm/i915/display/intel_crt.c b/drivers/gpu/drm/i915/display/intel_crt.c
index e6e8d4a82044..0a08354a6183 100644
--- a/drivers/gpu/drm/i915/display/intel_crt.c
+++ b/drivers/gpu/drm/i915/display/intel_crt.c
@@ -864,6 +864,13 @@ load_detect:
 out:
        intel_display_power_put(dev_priv, intel_encoder->power_domain, wakeref);
+        /*
+         * Make sure the refs for power wells enabled during detect are
+         * dropped to avoid a new detect cycle triggered by HPD polling.
+         */
+        intel_display_power_flush_work(dev_priv);
        return status;
 }
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index 57e9f0ba331b..9b15ac4f2fb6 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -1256,6 +1256,9 @@ static u32 skl_get_aux_send_ctl(struct intel_dp *intel_dp,
                                u32 unused)
 {
        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
+        struct drm_i915_private *i915 =
+                        to_i915(intel_dig_port->base.base.dev);
+        enum phy phy = intel_port_to_phy(i915, intel_dig_port->base.port);
        u32 ret;
        ret = DP_AUX_CH_CTL_SEND_BUSY |
@@ -1268,7 +1271,8 @@ static u32 skl_get_aux_send_ctl(struct intel_dp *intel_dp,
              DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL(32) |
              DP_AUX_CH_CTL_SYNC_PULSE_SKL(32);
-        if (intel_dig_port->tc_mode == TC_PORT_TBT_ALT)
+        if (intel_phy_is_tc(i915, phy) &&
+            intel_dig_port->tc_mode == TC_PORT_TBT_ALT)
                ret |= DP_AUX_CH_CTL_TBT_IO;
        return ret;
@@ -5436,6 +5440,12 @@ out:
        if (status != connector_status_connected && !intel_dp->is_mst)
                intel_dp_unset_edid(intel_dp);
+        /*
+         * Make sure the refs for power wells enabled during detect are
+         * dropped to avoid a new detect cycle triggered by HPD polling.
+         */
+        intel_display_power_flush_work(dev_priv);
        return status;
 }
diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
index e02f0faecf02..b030f7ae3302 100644
--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
@@ -2565,6 +2565,12 @@ out:
        if (status != connector_status_connected)
                cec_notifier_phys_addr_invalidate(intel_hdmi->cec_notifier);
+        /*
+         * Make sure the refs for power wells enabled during detect are
+         * dropped to avoid a new detect cycle triggered by HPD polling.
+         */
+        intel_display_power_flush_work(dev_priv);
        return status;
 }
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 460fd98e40a7..a0b382a637a6 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -1958,6 +1958,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                case 0x682C:
                        si_pi->cac_weights = cac_weights_cape_verde_pro;
                        si_pi->dte_data = dte_data_sun_xt;
+                        update_dte_from_pl2 = true;
                        break;
                case 0x6825:
                case 0x6827:
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index d9c55e30f986..04c088131e04 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -447,8 +447,12 @@ static int i2c_hid_hwreset(struct i2c_client *client)
        if (ret) {
                dev_err(&client->dev, "failed to reset device.\n");
                i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+                goto out_unlock;
        }
+        /* At least some SIS devices need this after reset */
+        ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
 out_unlock:
        mutex_unlock(&ihid->reset_lock);
        return ret;
diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h
index 4a7f8d363220..203d27d198b8 100644
--- a/drivers/hid/wacom.h
+++ b/drivers/hid/wacom.h
@@ -202,6 +202,21 @@ static inline void wacom_schedule_work(struct wacom_wac *wacom_wac,
        }
 }
+/*
+ * Convert a signed 32-bit integer to an unsigned n-bit integer. Undoes
+ * the normally-helpful work of 'hid_snto32' for fields that use signed
+ * ranges for questionable reasons.
+ */
+static inline __u32 wacom_s32tou(s32 value, __u8 n)
+{
+        switch (n) {
+        case 8:  return ((__u8)value);
+        case 16: return ((__u16)value);
+        case 32: return ((__u32)value);
+        }
+        return value & (1 << (n - 1)) ? value & (~(~0U << n)) : value;
+}
 extern const struct hid_device_id wacom_ids[];
 void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 2b0a5b8ca6e6..ccb74529bc78 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2303,7 +2303,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
        case HID_DG_TOOLSERIALNUMBER:
                if (value) {
                        wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                        wacom_wac->serial[0] |= (__u32)value;
+                        wacom_wac->serial[0] |= wacom_s32tou(value, field->report_size);
                }
                return;
        case HID_DG_TWIST:
@@ -2319,15 +2319,17 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                return;
        case WACOM_HID_WD_SERIALHI:
                if (value) {
+                        __u32 raw_value = wacom_s32tou(value, field->report_size);
                        wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
-                        wacom_wac->serial[0] |= ((__u64)value) << 32;
+                        wacom_wac->serial[0] |= ((__u64)raw_value) << 32;
                        /*
                         * Non-USI EMR devices may contain additional tool type
                         * information here. See WACOM_HID_WD_TOOLTYPE case for
                         * more details.
                         */
                        if (value >> 20 == 1) {
-                                wacom_wac->id[0] |= value & 0xFFFFF;
+                                wacom_wac->id[0] |= raw_value & 0xFFFFF;
                        }
                }
                return;
@@ -2339,7 +2341,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 * bitwise OR so the complete value can be built
                 * up over time :(
                 */
-                wacom_wac->id[0] |= value;
+                wacom_wac->id[0] |= wacom_s32tou(value, field->report_size);
                return;
        case WACOM_HID_WD_OFFSETLEFT:
                if (features->offset_left && value != features->offset_left)
diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
index fa9d34af87ac..f72803a02391 100644
--- a/drivers/hwtracing/intel_th/gth.c
+++ b/drivers/hwtracing/intel_th/gth.c
@@ -626,6 +626,9 @@ static void intel_th_gth_switch(struct intel_th_device *thdev,
        if (!count)
                dev_dbg(&thdev->dev, "timeout waiting for CTS Trigger\n");
+        /* De-assert the trigger */
+        iowrite32(0, gth->base + REG_CTS_CTL);
        intel_th_gth_stop(gth, output, false);
        intel_th_gth_start(gth, output);
 }
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index fc9f15f36ad4..6d240dfae9d9 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -164,7 +164,7 @@ struct msc {
 };
 static LIST_HEAD(msu_buffer_list);
-static struct mutex msu_buffer_mutex;
+static DEFINE_MUTEX(msu_buffer_mutex);
 /**
 * struct msu_buffer_entry - internal MSU buffer bookkeeping
@@ -327,7 +327,7 @@ static size_t msc_win_total_sz(struct msc_window *win)
                struct msc_block_desc *bdesc = sg_virt(sg);
                if (msc_block_wrapped(bdesc))
-                        return win->nr_blocks << PAGE_SHIFT;
+                        return (size_t)win->nr_blocks << PAGE_SHIFT;
                size += msc_total_sz(bdesc);
                if (msc_block_last_written(bdesc))
@@ -1848,9 +1848,14 @@ mode_store(struct device *dev, struct device_attribute *attr, const char *buf,
                len = cp - buf;
        mode = kstrndup(buf, len, GFP_KERNEL);
+        if (!mode)
+                return -ENOMEM;
        i = match_string(msc_mode, ARRAY_SIZE(msc_mode), mode);
-        if (i >= 0)
+        if (i >= 0) {
+                kfree(mode);
                goto found;
+        }
        /* Buffer sinks only work with a usable IRQ */
        if (!msc->do_irq) {
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 91dfeba62485..03ca5b1bef9f 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -200,6 +200,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                .driver_data = (kernel_ulong_t)&intel_th_2x,
        },
        {
+                /* Comet Lake PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
+        {
                /* Ice Lake NNPI */
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
                .driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -209,6 +214,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
                .driver_data = (kernel_ulong_t)&intel_th_2x,
        },
+        {
+                /* Jasper Lake PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
        { 0 },
 };
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 663f8a5012d6..73aee5949b6b 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1399,7 +1399,7 @@ static int stm32_adc_dma_start(struct iio_dev *indio_dev)
        cookie = dmaengine_submit(desc);
        ret = dma_submit_error(cookie);
        if (ret) {
-                dmaengine_terminate_all(adc->dma_chan);
+                dmaengine_terminate_sync(adc->dma_chan);
                return ret;
        }
@@ -1477,7 +1477,7 @@ static void __stm32_adc_buffer_predisable(struct iio_dev *indio_dev)
                stm32_adc_conv_irq_disable(adc);
        if (adc->dma_chan)
-                dmaengine_terminate_all(adc->dma_chan);
+                dmaengine_terminate_sync(adc->dma_chan);
        if (stm32_adc_set_trig(indio_dev, NULL))
                dev_err(&indio_dev->dev, "Can't clear trigger\n");
diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index b99d73887c9f..8743b2f376e2 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -317,8 +317,11 @@ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
        struct adis16480 *st = iio_priv(indio_dev);
        unsigned int t, reg;
+        if (val < 0 || val2 < 0)
+                return -EINVAL;
        t =  val * 1000 + val2 / 1000;
-        if (t <= 0)
+        if (t == 0)
                return -EINVAL;
        /*
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index b17f060b52fc..868281b8adb0 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -114,54 +114,63 @@ static const struct inv_mpu6050_hw hw_info[] = {
                .name = "MPU6050",
                .reg = &reg_set_6050,
                .config = &chip_config_6050,
+                .fifo_size = 1024,
        },
        {
                .whoami = INV_MPU6500_WHOAMI_VALUE,
                .name = "MPU6500",
                .reg = &reg_set_6500,
                .config = &chip_config_6050,
+                .fifo_size = 512,
        },
        {
                .whoami = INV_MPU6515_WHOAMI_VALUE,
                .name = "MPU6515",
                .reg = &reg_set_6500,
                .config = &chip_config_6050,
+                .fifo_size = 512,
        },
        {
                .whoami = INV_MPU6000_WHOAMI_VALUE,
                .name = "MPU6000",
                .reg = &reg_set_6050,
                .config = &chip_config_6050,
+                .fifo_size = 1024,
        },
        {
                .whoami = INV_MPU9150_WHOAMI_VALUE,
                .name = "MPU9150",
                .reg = &reg_set_6050,
                .config = &chip_config_6050,
+                .fifo_size = 1024,
        },
        {
                .whoami = INV_MPU9250_WHOAMI_VALUE,
                .name = "MPU9250",
                .reg = &reg_set_6500,
                .config = &chip_config_6050,
+                .fifo_size = 512,
        },
        {
                .whoami = INV_MPU9255_WHOAMI_VALUE,
                .name = "MPU9255",
                .reg = &reg_set_6500,
                .config = &chip_config_6050,
+                .fifo_size = 512,
        },
        {
                .whoami = INV_ICM20608_WHOAMI_VALUE,
                .name = "ICM20608",
                .reg = &reg_set_6500,
                .config = &chip_config_6050,
+                .fifo_size = 512,
        },
        {
                .whoami = INV_ICM20602_WHOAMI_VALUE,
                .name = "ICM20602",
                .reg = &reg_set_icm20602,
                .config = &chip_config_6050,
+                .fifo_size = 1008,
        },
 };
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
index db1c6904388b..51235677c534 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -100,12 +100,14 @@ struct inv_mpu6050_chip_config {
 *  @name:      name of the chip.
 *  @reg:   register map of the chip.
 *  @config:    configuration of the chip.
+ *  @fifo_size: size of the FIFO in bytes.
 */
 struct inv_mpu6050_hw {
        u8 whoami;
        u8 *name;
        const struct inv_mpu6050_reg_map *reg;
        const struct inv_mpu6050_chip_config *config;
+        size_t fifo_size;
 };
 /*
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
index 5f9a5de0bab4..72d8c5790076 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -180,9 +180,6 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
                        "failed to ack interrupt\n");
                goto flush_fifo;
        }
-        /* handle fifo overflow by reseting fifo */
-        if (int_status & INV_MPU6050_BIT_FIFO_OVERFLOW_INT)
-                goto flush_fifo;
        if (!(int_status & INV_MPU6050_BIT_RAW_DATA_RDY_INT)) {
                dev_warn(regmap_get_device(st->map),
                        "spurious interrupt with status 0x%x\n", int_status);
@@ -211,6 +208,18 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
        if (result)
                goto end_session;
        fifo_count = get_unaligned_be16(&data[0]);
+        /*
+         * Handle fifo overflow by resetting fifo.
+         * Reset if there is only 3 data set free remaining to mitigate
+         * possible delay between reading fifo count and fifo data.
+         */
+        nb = 3 * bytes_per_datum;
+        if (fifo_count >= st->hw->fifo_size - nb) {
+                dev_warn(regmap_get_device(st->map), "fifo overflow reset\n");
+                goto flush_fifo;
+        }
        /* compute and process all complete datum */
        nb = fifo_count / bytes_per_datum;
        inv_mpu6050_update_period(st, pf->timestamp, nb);
diff --git a/drivers/iio/proximity/srf04.c b/drivers/iio/proximity/srf04.c
index 8b50d56b0a03..01eb8cc63076 100644
--- a/drivers/iio/proximity/srf04.c
+++ b/drivers/iio/proximity/srf04.c
@@ -110,7 +110,7 @@ static int srf04_read(struct srf04_data *data)
        udelay(data->cfg->trigger_pulse_us);
        gpiod_set_value(data->gpiod_trig, 0);
-        /* it cannot take more than 20 ms */
+        /* it should not take more than 20 ms until echo is rising */
        ret = wait_for_completion_killable_timeout(&data->rising, HZ/50);
        if (ret < 0) {
                mutex_unlock(&data->lock);
@@ -120,7 +120,8 @@ static int srf04_read(struct srf04_data *data)
                return -ETIMEDOUT;
        }
-        ret = wait_for_completion_killable_timeout(&data->falling, HZ/50);
+        /* it cannot take more than 50 ms until echo is falling */
+        ret = wait_for_completion_killable_timeout(&data->falling, HZ/20);
        if (ret < 0) {
                mutex_unlock(&data->lock);
                return ret;
@@ -135,19 +136,19 @@ static int srf04_read(struct srf04_data *data)
        dt_ns = ktime_to_ns(ktime_dt);
        /*
-         * measuring more than 3 meters is beyond the capabilities of
+         * measuring more than 6,45 meters is beyond the capabilities of
-         * the sensor
+         * the supported sensors
         * ==> filter out invalid results for not measuring echos of
         *     another us sensor
         *
         * formula:
-         *         distance       3 m
+         *         distance     6,45 * 2 m
-         * time = ---------- = --------- = 9404389 ns
+         * time = ---------- = ------------ = 40438871 ns
-         *          speed       319 m/s
+         *          speed         319 m/s
         *
         * using a minimum speed at -20 °C of 319 m/s
         */
-        if (dt_ns > 9404389)
+        if (dt_ns > 40438871)
                return -EIO;
        time_ns = dt_ns;
@@ -159,20 +160,20 @@ static int srf04_read(struct srf04_data *data)
         *   with Temp in °C
         *   and speed in m/s
         *
-         * use 343 m/s as ultrasonic speed at 20 °C here in absence of the
+         * use 343,5 m/s as ultrasonic speed at 20 °C here in absence of the
         * temperature
         *
         * therefore:
-         *             time     343
+         *             time     343,5     time * 106
-         * distance = ------ * -----
+         * distance = ------ * ------- = ------------
-         *             10^6       2
+         *             10^6         2         617176
         *   with time in ns
         *   and distance in mm (one way)
         *
-         * because we limit to 3 meters the multiplication with 343 just
+         * because we limit to 6,45 meters the multiplication with 106 just
         * fits into 32 bit
         */
-        distance_mm = time_ns * 343 / 2000000;
+        distance_mm = time_ns * 106 / 617176;
        return distance_mm;
 }
diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
index 7b971228df38..c498796adc07 100644
--- a/drivers/interconnect/core.c
+++ b/drivers/interconnect/core.c
@@ -405,8 +405,12 @@ void icc_set_tag(struct icc_path *path, u32 tag)
        if (!path)
                return;
+        mutex_lock(&icc_lock);
        for (i = 0; i < path->num_nodes; i++)
                path->reqs[i].tag = tag;
+        mutex_unlock(&icc_lock);
 }
 EXPORT_SYMBOL_GPL(icc_set_tag);
diff --git a/drivers/interconnect/qcom/qcs404.c b/drivers/interconnect/qcom/qcs404.c
index 910081d6ddc0..b4966d8f3348 100644
--- a/drivers/interconnect/qcom/qcs404.c
+++ b/drivers/interconnect/qcom/qcs404.c
@@ -433,7 +433,8 @@ static int qnoc_probe(struct platform_device *pdev)
        if (!qp)
                return -ENOMEM;
-        data = devm_kcalloc(dev, num_nodes, sizeof(*node), GFP_KERNEL);
+        data = devm_kzalloc(dev, struct_size(data, nodes, num_nodes),
+                            GFP_KERNEL);
        if (!data)
                return -ENOMEM;
diff --git a/drivers/interconnect/qcom/sdm845.c b/drivers/interconnect/qcom/sdm845.c
index 57955596bb59..502a6c22b41e 100644
--- a/drivers/interconnect/qcom/sdm845.c
+++ b/drivers/interconnect/qcom/sdm845.c
@@ -790,7 +790,8 @@ static int qnoc_probe(struct platform_device *pdev)
        if (!qp)
                return -ENOMEM;
-        data = devm_kcalloc(&pdev->dev, num_nodes, sizeof(*node), GFP_KERNEL);
+        data = devm_kzalloc(&pdev->dev, struct_size(data, nodes, num_nodes),
+                            GFP_KERNEL);
        if (!data)
                return -ENOMEM;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 480f9459b402..62f65573eb04 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2083,8 +2083,7 @@ static int bond_miimon_inspect(struct bonding *bond)
        ignore_updelay = !rcu_dereference(bond->curr_active_slave);
        bond_for_each_slave_rcu(bond, slave, iter) {
-                slave->new_link = BOND_LINK_NOCHANGE;
+                bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
-                slave->link_new_state = slave->link;
                link_state = bond_check_dev_link(bond, slave->dev, 0);
@@ -2118,7 +2117,7 @@ static int bond_miimon_inspect(struct bonding *bond)
                        }
                        if (slave->delay <= 0) {
-                                slave->new_link = BOND_LINK_DOWN;
+                                bond_propose_link_state(slave, BOND_LINK_DOWN);
                                commit++;
                                continue;
                        }
@@ -2155,7 +2154,7 @@ static int bond_miimon_inspect(struct bonding *bond)
                                slave->delay = 0;
                        if (slave->delay <= 0) {
-                                slave->new_link = BOND_LINK_UP;
+                                bond_propose_link_state(slave, BOND_LINK_UP);
                                commit++;
                                ignore_updelay = false;
                                continue;
@@ -2193,7 +2192,7 @@ static void bond_miimon_commit(struct bonding *bond)
        struct slave *slave, *primary;
        bond_for_each_slave(bond, slave, iter) {
-                switch (slave->new_link) {
+                switch (slave->link_new_state) {
                case BOND_LINK_NOCHANGE:
                        /* For 802.3ad mode, check current slave speed and
                         * duplex again in case its port was disabled after
@@ -2265,8 +2264,8 @@ static void bond_miimon_commit(struct bonding *bond)
                default:
                        slave_err(bond->dev, slave->dev, "invalid new link %d on slave\n",
-                                  slave->new_link);
+                                  slave->link_new_state);
-                        slave->new_link = BOND_LINK_NOCHANGE;
+                        bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
                        continue;
                }
@@ -2674,13 +2673,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
        bond_for_each_slave_rcu(bond, slave, iter) {
                unsigned long trans_start = dev_trans_start(slave->dev);
-                slave->new_link = BOND_LINK_NOCHANGE;
+                bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
                if (slave->link != BOND_LINK_UP) {
                        if (bond_time_in_interval(bond, trans_start, 1) &&
                            bond_time_in_interval(bond, slave->last_rx, 1)) {
-                                slave->new_link = BOND_LINK_UP;
+                                bond_propose_link_state(slave, BOND_LINK_UP);
                                slave_state_changed = 1;
                                /* primary_slave has no meaning in round-robin
@@ -2705,7 +2704,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                        if (!bond_time_in_interval(bond, trans_start, 2) ||
                            !bond_time_in_interval(bond, slave->last_rx, 2)) {
-                                slave->new_link = BOND_LINK_DOWN;
+                                bond_propose_link_state(slave, BOND_LINK_DOWN);
                                slave_state_changed = 1;
                                if (slave->link_failure_count < UINT_MAX)
@@ -2736,8 +2735,8 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                        goto re_arm;
                bond_for_each_slave(bond, slave, iter) {
-                        if (slave->new_link != BOND_LINK_NOCHANGE)
+                        if (slave->link_new_state != BOND_LINK_NOCHANGE)
-                                slave->link = slave->new_link;
+                                slave->link = slave->link_new_state;
                }
                if (slave_state_changed) {
@@ -2760,9 +2759,9 @@ re_arm:
 }
 /* Called to inspect slaves for active-backup mode ARP monitor link state
- * changes.  Sets new_link in slaves to specify what action should take
+ * changes.  Sets proposed link state in slaves to specify what action
- * place for the slave.  Returns 0 if no changes are found, >0 if changes
+ * should take place for the slave.  Returns 0 if no changes are found, >0
- * to link states must be committed.
+ * if changes to link states must be committed.
 *
 * Called with rcu_read_lock held.
 */
@@ -2774,12 +2773,12 @@ static int bond_ab_arp_inspect(struct bonding *bond)
        int commit = 0;
        bond_for_each_slave_rcu(bond, slave, iter) {
-                slave->new_link = BOND_LINK_NOCHANGE;
+                bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
                last_rx = slave_last_rx(bond, slave);
                if (slave->link != BOND_LINK_UP) {
                        if (bond_time_in_interval(bond, last_rx, 1)) {
-                                slave->new_link = BOND_LINK_UP;
+                                bond_propose_link_state(slave, BOND_LINK_UP);
                                commit++;
                        }
                        continue;
@@ -2807,7 +2806,7 @@ static int bond_ab_arp_inspect(struct bonding *bond)
                if (!bond_is_active_slave(slave) &&
                    !rcu_access_pointer(bond->current_arp_slave) &&
                    !bond_time_in_interval(bond, last_rx, 3)) {
-                        slave->new_link = BOND_LINK_DOWN;
+                        bond_propose_link_state(slave, BOND_LINK_DOWN);
                        commit++;
                }
@@ -2820,7 +2819,7 @@ static int bond_ab_arp_inspect(struct bonding *bond)
                if (bond_is_active_slave(slave) &&
                    (!bond_time_in_interval(bond, trans_start, 2) ||
                     !bond_time_in_interval(bond, last_rx, 2))) {
-                        slave->new_link = BOND_LINK_DOWN;
+                        bond_propose_link_state(slave, BOND_LINK_DOWN);
                        commit++;
                }
        }
@@ -2840,7 +2839,7 @@ static void bond_ab_arp_commit(struct bonding *bond)
        struct slave *slave;
        bond_for_each_slave(bond, slave, iter) {
-                switch (slave->new_link) {
+                switch (slave->link_new_state) {
                case BOND_LINK_NOCHANGE:
                        continue;
@@ -2890,8 +2889,9 @@ static void bond_ab_arp_commit(struct bonding *bond)
                        continue;
                default:
-                        slave_err(bond->dev, slave->dev, "impossible: new_link %d on slave\n",
+                        slave_err(bond->dev, slave->dev,
-                                  slave->new_link);
+                                  "impossible: link_new_state %d on slave\n",
+                                  slave->link_new_state);
                        continue;
                }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 606b7d8ffe13..8e9f5620c9a2 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -52,6 +52,7 @@
 #define CONTROL_EX_PDR          BIT(8)
 /* control register */
+#define CONTROL_SWR             BIT(15)
 #define CONTROL_TEST            BIT(7)
 #define CONTROL_CCE             BIT(6)
 #define CONTROL_DISABLE_AR      BIT(5)
@@ -97,6 +98,9 @@
 #define BTR_TSEG2_SHIFT         12
 #define BTR_TSEG2_MASK          (0x7 << BTR_TSEG2_SHIFT)
+/* interrupt register */
+#define INT_STS_PENDING         0x8000
 /* brp extension register */
 #define BRP_EXT_BRPE_MASK       0x0f
 #define BRP_EXT_BRPE_SHIFT      0
@@ -569,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
                                   IF_MCONT_RCV_EOB);
 }
+static int c_can_software_reset(struct net_device *dev)
+{
+        struct c_can_priv *priv = netdev_priv(dev);
+        int retry = 0;
+        if (priv->type != BOSCH_D_CAN)
+                return 0;
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
+        while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
+                msleep(20);
+                if (retry++ > 100) {
+                        netdev_err(dev, "CCTRL: software reset failed\n");
+                        return -EIO;
+                }
+        }
+        return 0;
+}
 /*
 * Configure C_CAN chip:
 * - enable/disable auto-retransmission
@@ -578,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
 static int c_can_chip_config(struct net_device *dev)
 {
        struct c_can_priv *priv = netdev_priv(dev);
+        int err;
+        err = c_can_software_reset(dev);
+        if (err)
+                return err;
        /* enable automatic retransmission */
        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
@@ -886,6 +915,9 @@ static int c_can_handle_state_change(struct net_device *dev,
        struct can_berr_counter bec;
        switch (error_type) {
+        case C_CAN_NO_ERROR:
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                break;
        case C_CAN_ERROR_WARNING:
                /* error warning state */
                priv->can.can_stats.error_warning++;
@@ -916,6 +948,13 @@ static int c_can_handle_state_change(struct net_device *dev,
                                ERR_CNT_RP_SHIFT;
        switch (error_type) {
+        case C_CAN_NO_ERROR:
+                /* error warning state */
+                cf->can_id |= CAN_ERR_CRTL;
+                cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+                cf->data[6] = bec.txerr;
+                cf->data[7] = bec.rxerr;
+                break;
        case C_CAN_ERROR_WARNING:
                /* error warning state */
                cf->can_id |= CAN_ERR_CRTL;
@@ -1029,10 +1068,16 @@ static int c_can_poll(struct napi_struct *napi, int quota)
        u16 curr, last = priv->last_status;
        int work_done = 0;
-        priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
+        /* Only read the status register if a status interrupt was pending */
-        /* Ack status on C_CAN. D_CAN is self clearing */
+        if (atomic_xchg(&priv->sie_pending, 0)) {
-        if (priv->type != BOSCH_D_CAN)
+                priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
-                priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+                /* Ack status on C_CAN. D_CAN is self clearing */
+                if (priv->type != BOSCH_D_CAN)
+                        priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+        } else {
+                /* no change detected ... */
+                curr = last;
+        }
        /* handle state changes */
        if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
@@ -1054,11 +1099,17 @@ static int c_can_poll(struct napi_struct *napi, int quota)
        /* handle bus recovery events */
        if ((!(curr & STATUS_BOFF)) && (last & STATUS_BOFF)) {
                netdev_dbg(dev, "left bus off state\n");
-                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_PASSIVE);
        }
        if ((!(curr & STATUS_EPASS)) && (last & STATUS_EPASS)) {
                netdev_dbg(dev, "left error passive state\n");
-                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                work_done += c_can_handle_state_change(dev, C_CAN_ERROR_WARNING);
+        }
+        if ((!(curr & STATUS_EWARN)) && (last & STATUS_EWARN)) {
+                netdev_dbg(dev, "left error warning state\n");
+                work_done += c_can_handle_state_change(dev, C_CAN_NO_ERROR);
        }
        /* handle lec errors on the bus */
@@ -1083,10 +1134,16 @@ static irqreturn_t c_can_isr(int irq, void *dev_id)
 {
        struct net_device *dev = (struct net_device *)dev_id;
        struct c_can_priv *priv = netdev_priv(dev);
+        int reg_int;
-        if (!priv->read_reg(priv, C_CAN_INT_REG))
+        reg_int = priv->read_reg(priv, C_CAN_INT_REG);
+        if (!reg_int)
                return IRQ_NONE;
+        /* save for later use */
+        if (reg_int & INT_STS_PENDING)
+                atomic_set(&priv->sie_pending, 1);
        /* disable all interrupts and schedule the NAPI */
        c_can_irq_control(priv, false);
        napi_schedule(&priv->napi);
diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
index 8acdc7fa4792..d5567a7c1c6d 100644
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -198,6 +198,7 @@ struct c_can_priv {
        struct net_device *dev;
        struct device *device;
        atomic_t tx_active;
+        atomic_t sie_pending;
        unsigned long tx_dir;
        int last_status;
        u16 (*read_reg) (const struct c_can_priv *priv, enum reg index);
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index ac86be52b461..1c88c361938c 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -848,6 +848,7 @@ void of_can_transceiver(struct net_device *dev)
                return;
        ret = of_property_read_u32(dn, "max-bitrate", &priv->bitrate_max);
+        of_node_put(dn);
        if ((ret && ret != -EINVAL) || (!ret && !priv->bitrate_max))
                netdev_warn(dev, "Invalid value for transceiver max bitrate. Ignoring bitrate limit.\n");
 }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index dc5695dffc2e..57f9a2f51085 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -677,6 +677,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
        struct can_frame *cf;
        bool rx_errors = false, tx_errors = false;
        u32 timestamp;
+        int err;
        timestamp = priv->read(&regs->timer) << 16;
@@ -725,7 +726,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
        if (tx_errors)
                dev->stats.tx_errors++;
-        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+        err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+        if (err)
+                dev->stats.rx_fifo_errors++;
 }
 static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
@@ -738,6 +741,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
        int flt;
        struct can_berr_counter bec;
        u32 timestamp;
+        int err;
        timestamp = priv->read(&regs->timer) << 16;
@@ -769,7 +773,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
        if (unlikely(new_state == CAN_STATE_BUS_OFF))
                can_bus_off(dev);
-        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+        err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+        if (err)
+                dev->stats.rx_fifo_errors++;
 }
 static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
@@ -1188,6 +1194,7 @@ static int flexcan_chip_start(struct net_device *dev)
                reg_mecr = priv->read(&regs->mecr);
                reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS;
                priv->write(reg_mecr, &regs->mecr);
+                reg_mecr |= FLEXCAN_MECR_ECCDIS;
                reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK |
                              FLEXCAN_MECR_FANCEI_MSK);
                priv->write(reg_mecr, &regs->mecr);
diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
index e6a668ee7730..84cae167e42f 100644
--- a/drivers/net/can/rx-offload.c
+++ b/drivers/net/can/rx-offload.c
@@ -107,37 +107,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
        return cb_b->timestamp - cb_a->timestamp;
 }
-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+/**
+ * can_rx_offload_offload_one() - Read one CAN frame from HW
+ * @offload: pointer to rx_offload context
+ * @n: number of mailbox to read
+ *
+ * The task of this function is to read a CAN frame from mailbox @n
+ * from the device and return the mailbox's content as a struct
+ * sk_buff.
+ *
+ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
+ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
+ * allocated, the mailbox contents is discarded by reading it into an
+ * overflow buffer. This way the mailbox is marked as free by the
+ * driver.
+ *
+ * Return: A pointer to skb containing the CAN frame on success.
+ *
+ *         NULL if the mailbox @n is empty.
+ *
+ *         ERR_PTR() in case of an error
+ */
+static struct sk_buff *
+can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb = NULL, *skb_error = NULL;
        struct can_rx_offload_cb *cb;
        struct can_frame *cf;
        int ret;
-        /* If queue is full or skb not available, read to discard mailbox */
+        if (likely(skb_queue_len(&offload->skb_queue) <
-        if (likely(skb_queue_len(&offload->skb_queue) <=
+                   offload->skb_queue_len_max)) {
-                   offload->skb_queue_len_max))
                skb = alloc_can_skb(offload->dev, &cf);
+                if (unlikely(!skb))
+                        skb_error = ERR_PTR(-ENOMEM);   /* skb alloc failed */
+        } else {
+                skb_error = ERR_PTR(-ENOBUFS);          /* skb_queue is full */
+        }
-        if (!skb) {
+        /* If queue is full or skb not available, drop by reading into
+         * overflow buffer.
+         */
+        if (unlikely(skb_error)) {
                struct can_frame cf_overflow;
                u32 timestamp;
                ret = offload->mailbox_read(offload, &cf_overflow,
                                            &timestamp, n);
-                if (ret)
-                        offload->dev->stats.rx_dropped++;
-                return NULL;
+                /* Mailbox was empty. */
+                if (unlikely(!ret))
+                        return NULL;
+                /* Mailbox has been read and we're dropping it or
+                 * there was a problem reading the mailbox.
+                 *
+                 * Increment error counters in any case.
+                 */
+                offload->dev->stats.rx_dropped++;
+                offload->dev->stats.rx_fifo_errors++;
+                /* There was a problem reading the mailbox, propagate
+                 * error value.
+                 */
+                if (unlikely(ret < 0))
+                        return ERR_PTR(ret);
+                return skb_error;
        }
        cb = can_rx_offload_get_cb(skb);
        ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
-        if (!ret) {
+        /* Mailbox was empty. */
+        if (unlikely(!ret)) {
                kfree_skb(skb);
                return NULL;
        }
+        /* There was a problem reading the mailbox, propagate error value. */
+        if (unlikely(ret < 0)) {
+                kfree_skb(skb);
+                offload->dev->stats.rx_dropped++;
+                offload->dev->stats.rx_fifo_errors++;
+                return ERR_PTR(ret);
+        }
+        /* Mailbox was read. */
        return skb;
 }
@@ -157,8 +215,8 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
                        continue;
                skb = can_rx_offload_offload_one(offload, i);
-                if (!skb)
+                if (IS_ERR_OR_NULL(skb))
-                        break;
+                        continue;
                __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
        }
@@ -188,7 +246,13 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
        struct sk_buff *skb;
        int received = 0;
-        while ((skb = can_rx_offload_offload_one(offload, 0))) {
+        while (1) {
+                skb = can_rx_offload_offload_one(offload, 0);
+                if (IS_ERR(skb))
+                        continue;
+                if (!skb)
+                        break;
                skb_queue_tail(&offload->skb_queue, skb);
                received++;
        }
@@ -207,8 +271,10 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
        unsigned long flags;
        if (skb_queue_len(&offload->skb_queue) >
-            offload->skb_queue_len_max)
+            offload->skb_queue_len_max) {
-                return -ENOMEM;
+                kfree_skb(skb);
+                return -ENOBUFS;
+        }
        cb = can_rx_offload_get_cb(skb);
        cb->timestamp = timestamp;
@@ -250,8 +316,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
                              struct sk_buff *skb)
 {
        if (skb_queue_len(&offload->skb_queue) >
-            offload->skb_queue_len_max)
+            offload->skb_queue_len_max) {
-                return -ENOMEM;
+                kfree_skb(skb);
+                return -ENOBUFS;
+        }
        skb_queue_tail(&offload->skb_queue, skb);
        can_rx_offload_schedule(offload);
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index bee9f7b8dad6..bb20a9b75cc6 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -717,6 +717,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
        if (priv->after_suspend) {
                mcp251x_hw_reset(spi);
                mcp251x_setup(net, spi);
+                priv->force_quit = 0;
                if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
                        mcp251x_set_normal_mode(spi);
                } else if (priv->after_suspend & AFTER_SUSPEND_UP) {
@@ -728,7 +729,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
                        mcp251x_hw_sleep(spi);
                }
                priv->after_suspend = 0;
-                priv->force_quit = 0;
        }
        if (priv->restart_tx) {
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f8b19eef5d26..31ad364a89bb 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -73,6 +73,7 @@ MODULE_VERSION(HECC_MODULE_VERSION);
 */
 #define HECC_MAX_RX_MBOX        (HECC_MAX_MAILBOXES - HECC_MAX_TX_MBOX)
 #define HECC_RX_FIRST_MBOX      (HECC_MAX_MAILBOXES - 1)
+#define HECC_RX_LAST_MBOX       (HECC_MAX_TX_MBOX)
 /* TI HECC module registers */
 #define HECC_CANME              0x0     /* Mailbox enable */
@@ -82,7 +83,7 @@ MODULE_VERSION(HECC_MODULE_VERSION);
 #define HECC_CANTA              0x10    /* Transmission acknowledge */
 #define HECC_CANAA              0x14    /* Abort acknowledge */
 #define HECC_CANRMP             0x18    /* Receive message pending */
-#define HECC_CANRML             0x1C    /* Remote message lost */
+#define HECC_CANRML             0x1C    /* Receive message lost */
 #define HECC_CANRFP             0x20    /* Remote frame pending */
 #define HECC_CANGAM             0x24    /* SECC only:Global acceptance mask */
 #define HECC_CANMC              0x28    /* Master control */
@@ -149,6 +150,8 @@ MODULE_VERSION(HECC_MODULE_VERSION);
 #define HECC_BUS_ERROR          (HECC_CANES_FE | HECC_CANES_BE |\
                                HECC_CANES_CRCE | HECC_CANES_SE |\
                                HECC_CANES_ACKE)
+#define HECC_CANES_FLAGS        (HECC_BUS_ERROR | HECC_CANES_BO |\
+                                HECC_CANES_EP | HECC_CANES_EW)
 #define HECC_CANMCF_RTR         BIT(4)  /* Remote transmit request */
@@ -382,8 +385,18 @@ static void ti_hecc_start(struct net_device *ndev)
                hecc_set_bit(priv, HECC_CANMIM, mbx_mask);
        }
-        /* Prevent message over-write & Enable interrupts */
+        /* Enable tx interrupts */
-        hecc_write(priv, HECC_CANOPC, HECC_SET_REG);
+        hecc_set_bit(priv, HECC_CANMIM, BIT(HECC_MAX_TX_MBOX) - 1);
+        /* Prevent message over-write to create a rx fifo, but not for
+         * the lowest priority mailbox, since that allows detecting
+         * overflows instead of the hardware silently dropping the
+         * messages.
+         */
+        mbx_mask = ~BIT(HECC_RX_LAST_MBOX);
+        hecc_write(priv, HECC_CANOPC, mbx_mask);
+        /* Enable interrupts */
        if (priv->use_hecc1int) {
                hecc_write(priv, HECC_CANMIL, HECC_SET_REG);
                hecc_write(priv, HECC_CANGIM, HECC_CANGIM_DEF_MASK |
@@ -400,6 +413,9 @@ static void ti_hecc_stop(struct net_device *ndev)
 {
        struct ti_hecc_priv *priv = netdev_priv(ndev);
+        /* Disable the CPK; stop sending, erroring and acking */
+        hecc_set_bit(priv, HECC_CANMC, HECC_CANMC_CCR);
        /* Disable interrupts and disable mailboxes */
        hecc_write(priv, HECC_CANGIM, 0);
        hecc_write(priv, HECC_CANMIM, 0);
@@ -508,8 +524,6 @@ static netdev_tx_t ti_hecc_xmit(struct sk_buff *skb, struct net_device *ndev)
        hecc_set_bit(priv, HECC_CANME, mbx_mask);
        spin_unlock_irqrestore(&priv->mbx_lock, flags);
-        hecc_clear_bit(priv, HECC_CANMD, mbx_mask);
-        hecc_set_bit(priv, HECC_CANMIM, mbx_mask);
        hecc_write(priv, HECC_CANTRS, mbx_mask);
        return NETDEV_TX_OK;
@@ -526,8 +540,10 @@ static unsigned int ti_hecc_mailbox_read(struct can_rx_offload *offload,
                                         u32 *timestamp, unsigned int mbxno)
 {
        struct ti_hecc_priv *priv = rx_offload_to_priv(offload);
-        u32 data;
+        u32 data, mbx_mask;
+        int ret = 1;
+        mbx_mask = BIT(mbxno);
        data = hecc_read_mbx(priv, mbxno, HECC_CANMID);
        if (data & HECC_CANMID_IDE)
                cf->can_id = (data & CAN_EFF_MASK) | CAN_EFF_FLAG;
@@ -548,7 +564,25 @@ static unsigned int ti_hecc_mailbox_read(struct can_rx_offload *offload,
        *timestamp = hecc_read_stamp(priv, mbxno);
-        return 1;
+        /* Check for FIFO overrun.
+         *
+         * All but the last RX mailbox have activated overwrite
+         * protection. So skip check for overrun, if we're not
+         * handling the last RX mailbox.
+         *
+         * As the overwrite protection for the last RX mailbox is
+         * disabled, the CAN core might update while we're reading
+         * it. This means the skb might be inconsistent.
+         *
+         * Return an error to let rx-offload discard this CAN frame.
+         */
+        if (unlikely(mbxno == HECC_RX_LAST_MBOX &&
+                     hecc_read(priv, HECC_CANRML) & mbx_mask))
+                ret = -ENOBUFS;
+        hecc_write(priv, HECC_CANRMP, mbx_mask);
+        return ret;
 }
 static int ti_hecc_error(struct net_device *ndev, int int_status,
@@ -558,92 +592,73 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
        struct can_frame *cf;
        struct sk_buff *skb;
        u32 timestamp;
+        int err;
-        /* propagate the error condition to the can stack */
+        if (err_status & HECC_BUS_ERROR) {
-        skb = alloc_can_err_skb(ndev, &cf);
+                /* propagate the error condition to the can stack */
-        if (!skb) {
+                skb = alloc_can_err_skb(ndev, &cf);
-                if (printk_ratelimit())
+                if (!skb) {
-                        netdev_err(priv->ndev,
+                        if (net_ratelimit())
-                                   "%s: alloc_can_err_skb() failed\n",
+                                netdev_err(priv->ndev,
-                                   __func__);
+                                           "%s: alloc_can_err_skb() failed\n",
-                return -ENOMEM;
+                                           __func__);
-        }
+                        return -ENOMEM;
-        if (int_status & HECC_CANGIF_WLIF) { /* warning level int */
-                if ((int_status & HECC_CANGIF_BOIF) == 0) {
-                        priv->can.state = CAN_STATE_ERROR_WARNING;
-                        ++priv->can.can_stats.error_warning;
-                        cf->can_id |= CAN_ERR_CRTL;
-                        if (hecc_read(priv, HECC_CANTEC) > 96)
-                                cf->data[1] |= CAN_ERR_CRTL_TX_WARNING;
-                        if (hecc_read(priv, HECC_CANREC) > 96)
-                                cf->data[1] |= CAN_ERR_CRTL_RX_WARNING;
-                }
-                hecc_set_bit(priv, HECC_CANES, HECC_CANES_EW);
-                netdev_dbg(priv->ndev, "Error Warning interrupt\n");
-                hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_CCR);
-        }
-        if (int_status & HECC_CANGIF_EPIF) { /* error passive int */
-                if ((int_status & HECC_CANGIF_BOIF) == 0) {
-                        priv->can.state = CAN_STATE_ERROR_PASSIVE;
-                        ++priv->can.can_stats.error_passive;
-                        cf->can_id |= CAN_ERR_CRTL;
-                        if (hecc_read(priv, HECC_CANTEC) > 127)
-                                cf->data[1] |= CAN_ERR_CRTL_TX_PASSIVE;
-                        if (hecc_read(priv, HECC_CANREC) > 127)
-                                cf->data[1] |= CAN_ERR_CRTL_RX_PASSIVE;
                }
-                hecc_set_bit(priv, HECC_CANES, HECC_CANES_EP);
-                netdev_dbg(priv->ndev, "Error passive interrupt\n");
-                hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_CCR);
-        }
-        /* Need to check busoff condition in error status register too to
-         * ensure warning interrupts don't hog the system
-         */
-        if ((int_status & HECC_CANGIF_BOIF) || (err_status & HECC_CANES_BO)) {
-                priv->can.state = CAN_STATE_BUS_OFF;
-                cf->can_id |= CAN_ERR_BUSOFF;
-                hecc_set_bit(priv, HECC_CANES, HECC_CANES_BO);
-                hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_CCR);
-                /* Disable all interrupts in bus-off to avoid int hog */
-                hecc_write(priv, HECC_CANGIM, 0);
-                ++priv->can.can_stats.bus_off;
-                can_bus_off(ndev);
-        }
-        if (err_status & HECC_BUS_ERROR) {
                ++priv->can.can_stats.bus_error;
                cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_PROT;
-                if (err_status & HECC_CANES_FE) {
+                if (err_status & HECC_CANES_FE)
-                        hecc_set_bit(priv, HECC_CANES, HECC_CANES_FE);
                        cf->data[2] |= CAN_ERR_PROT_FORM;
-                }
+                if (err_status & HECC_CANES_BE)
-                if (err_status & HECC_CANES_BE) {
-                        hecc_set_bit(priv, HECC_CANES, HECC_CANES_BE);
                        cf->data[2] |= CAN_ERR_PROT_BIT;
-                }
+                if (err_status & HECC_CANES_SE)
-                if (err_status & HECC_CANES_SE) {
-                        hecc_set_bit(priv, HECC_CANES, HECC_CANES_SE);
                        cf->data[2] |= CAN_ERR_PROT_STUFF;
-                }
+                if (err_status & HECC_CANES_CRCE)
-                if (err_status & HECC_CANES_CRCE) {
-                        hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
                        cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
-                }
+                if (err_status & HECC_CANES_ACKE)
-                if (err_status & HECC_CANES_ACKE) {
-                        hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
                        cf->data[3] = CAN_ERR_PROT_LOC_ACK;
-                }
+                timestamp = hecc_read(priv, HECC_CANLNT);
+                err = can_rx_offload_queue_sorted(&priv->offload, skb,
+                                                  timestamp);
+                if (err)
+                        ndev->stats.rx_fifo_errors++;
        }
-        timestamp = hecc_read(priv, HECC_CANLNT);
+        hecc_write(priv, HECC_CANES, HECC_CANES_FLAGS);
-        can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
        return 0;
 }
+static void ti_hecc_change_state(struct net_device *ndev,
+                                 enum can_state rx_state,
+                                 enum can_state tx_state)
+{
+        struct ti_hecc_priv *priv = netdev_priv(ndev);
+        struct can_frame *cf;
+        struct sk_buff *skb;
+        u32 timestamp;
+        int err;
+        skb = alloc_can_err_skb(priv->ndev, &cf);
+        if (unlikely(!skb)) {
+                priv->can.state = max(tx_state, rx_state);
+                return;
+        }
+        can_change_state(priv->ndev, cf, tx_state, rx_state);
+        if (max(tx_state, rx_state) != CAN_STATE_BUS_OFF) {
+                cf->data[6] = hecc_read(priv, HECC_CANTEC);
+                cf->data[7] = hecc_read(priv, HECC_CANREC);
+        }
+        timestamp = hecc_read(priv, HECC_CANLNT);
+        err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+        if (err)
+                ndev->stats.rx_fifo_errors++;
+}
 static irqreturn_t ti_hecc_interrupt(int irq, void *dev_id)
 {
        struct net_device *ndev = (struct net_device *)dev_id;
@@ -651,6 +666,7 @@ static irqreturn_t ti_hecc_interrupt(int irq, void *dev_id)
        struct net_device_stats *stats = &ndev->stats;
        u32 mbxno, mbx_mask, int_status, err_status, stamp;
        unsigned long flags, rx_pending;
+        u32 handled = 0;
        int_status = hecc_read(priv,
                               priv->use_hecc1int ?
@@ -660,17 +676,66 @@ static irqreturn_t ti_hecc_interrupt(int irq, void *dev_id)
                return IRQ_NONE;
        err_status = hecc_read(priv, HECC_CANES);
-        if (err_status & (HECC_BUS_ERROR | HECC_CANES_BO |
+        if (unlikely(err_status & HECC_CANES_FLAGS))
-                          HECC_CANES_EP | HECC_CANES_EW))
                ti_hecc_error(ndev, int_status, err_status);
+        if (unlikely(int_status & HECC_CANGIM_DEF_MASK)) {
+                enum can_state rx_state, tx_state;
+                u32 rec = hecc_read(priv, HECC_CANREC);
+                u32 tec = hecc_read(priv, HECC_CANTEC);
+                if (int_status & HECC_CANGIF_WLIF) {
+                        handled |= HECC_CANGIF_WLIF;
+                        rx_state = rec >= tec ? CAN_STATE_ERROR_WARNING : 0;
+                        tx_state = rec <= tec ? CAN_STATE_ERROR_WARNING : 0;
+                        netdev_dbg(priv->ndev, "Error Warning interrupt\n");
+                        ti_hecc_change_state(ndev, rx_state, tx_state);
+                }
+                if (int_status & HECC_CANGIF_EPIF) {
+                        handled |= HECC_CANGIF_EPIF;
+                        rx_state = rec >= tec ? CAN_STATE_ERROR_PASSIVE : 0;
+                        tx_state = rec <= tec ? CAN_STATE_ERROR_PASSIVE : 0;
+                        netdev_dbg(priv->ndev, "Error passive interrupt\n");
+                        ti_hecc_change_state(ndev, rx_state, tx_state);
+                }
+                if (int_status & HECC_CANGIF_BOIF) {
+                        handled |= HECC_CANGIF_BOIF;
+                        rx_state = CAN_STATE_BUS_OFF;
+                        tx_state = CAN_STATE_BUS_OFF;
+                        netdev_dbg(priv->ndev, "Bus off interrupt\n");
+                        /* Disable all interrupts */
+                        hecc_write(priv, HECC_CANGIM, 0);
+                        can_bus_off(ndev);
+                        ti_hecc_change_state(ndev, rx_state, tx_state);
+                }
+        } else if (unlikely(priv->can.state != CAN_STATE_ERROR_ACTIVE)) {
+                enum can_state new_state, tx_state, rx_state;
+                u32 rec = hecc_read(priv, HECC_CANREC);
+                u32 tec = hecc_read(priv, HECC_CANTEC);
+                if (rec >= 128 || tec >= 128)
+                        new_state = CAN_STATE_ERROR_PASSIVE;
+                else if (rec >= 96 || tec >= 96)
+                        new_state = CAN_STATE_ERROR_WARNING;
+                else
+                        new_state = CAN_STATE_ERROR_ACTIVE;
+                if (new_state < priv->can.state) {
+                        rx_state = rec >= tec ? new_state : 0;
+                        tx_state = rec <= tec ? new_state : 0;
+                        ti_hecc_change_state(ndev, rx_state, tx_state);
+                }
+        }
        if (int_status & HECC_CANGIF_GMIF) {
                while (priv->tx_tail - priv->tx_head > 0) {
                        mbxno = get_tx_tail_mb(priv);
                        mbx_mask = BIT(mbxno);
                        if (!(mbx_mask & hecc_read(priv, HECC_CANTA)))
                                break;
-                        hecc_clear_bit(priv, HECC_CANMIM, mbx_mask);
                        hecc_write(priv, HECC_CANTA, mbx_mask);
                        spin_lock_irqsave(&priv->mbx_lock, flags);
                        hecc_clear_bit(priv, HECC_CANME, mbx_mask);
@@ -695,16 +760,15 @@ static irqreturn_t ti_hecc_interrupt(int irq, void *dev_id)
                while ((rx_pending = hecc_read(priv, HECC_CANRMP))) {
                        can_rx_offload_irq_offload_timestamp(&priv->offload,
                                                             rx_pending);
-                        hecc_write(priv, HECC_CANRMP, rx_pending);
                }
        }
        /* clear all interrupt conditions - read back to avoid spurious ints */
        if (priv->use_hecc1int) {
-                hecc_write(priv, HECC_CANGIF1, HECC_SET_REG);
+                hecc_write(priv, HECC_CANGIF1, handled);
                int_status = hecc_read(priv, HECC_CANGIF1);
        } else {
-                hecc_write(priv, HECC_CANGIF0, HECC_SET_REG);
+                hecc_write(priv, HECC_CANGIF0, handled);
                int_status = hecc_read(priv, HECC_CANGIF0);
        }
@@ -877,7 +941,7 @@ static int ti_hecc_probe(struct platform_device *pdev)
        priv->offload.mailbox_read = ti_hecc_mailbox_read;
        priv->offload.mb_first = HECC_RX_FIRST_MBOX;
-        priv->offload.mb_last = HECC_MAX_TX_MBOX;
+        priv->offload.mb_last = HECC_RX_LAST_MBOX;
        err = can_rx_offload_add_timestamp(ndev, &priv->offload);
        if (err) {
                dev_err(&pdev->dev, "can_rx_offload_add_timestamp() failed\n");
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index bd6eb9967630..2f74f6704c12 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -623,6 +623,7 @@ static int gs_can_open(struct net_device *netdev)
                                           rc);
                                usb_unanchor_urb(urb);
+                                usb_free_urb(urb);
                                break;
                        }
diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 19a702ac49e4..21faa2ec4632 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -876,9 +876,8 @@ static void mcba_usb_disconnect(struct usb_interface *intf)
        netdev_info(priv->netdev, "device disconnected\n");
        unregister_candev(priv->netdev);
-        free_candev(priv->netdev);
        mcba_urb_unlink(priv);
+        free_candev(priv->netdev);
 }
 static struct usb_driver mcba_usb_driver = {
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 617da295b6c1..d2539c95adb6 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -100,7 +100,7 @@ struct pcan_usb_msg_context {
        u8 *end;
        u8 rec_cnt;
        u8 rec_idx;
-        u8 rec_data_idx;
+        u8 rec_ts_idx;
        struct net_device *netdev;
        struct pcan_usb *pdev;
 };
@@ -436,8 +436,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
                }
                if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
                        /* no error (back to active state) */
-                        mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+                        new_state = CAN_STATE_ERROR_ACTIVE;
-                        return 0;
+                        break;
                }
                break;
@@ -460,9 +460,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
                }
                if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
-                        /* no error (back to active state) */
+                        /* no error (back to warning state) */
-                        mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+                        new_state = CAN_STATE_ERROR_WARNING;
-                        return 0;
+                        break;
                }
                break;
@@ -501,6 +501,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
                mc->pdev->dev.can.can_stats.error_warning++;
                break;
+        case CAN_STATE_ERROR_ACTIVE:
+                cf->can_id |= CAN_ERR_CRTL;
+                cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+                break;
        default:
                /* CAN_STATE_MAX (trick to handle other errors) */
                cf->can_id |= CAN_ERR_CRTL;
@@ -547,10 +552,15 @@ static int pcan_usb_decode_status(struct pcan_usb_msg_context *mc,
        mc->ptr += PCAN_USB_CMD_ARGS;
        if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) {
-                int err = pcan_usb_decode_ts(mc, !mc->rec_idx);
+                int err = pcan_usb_decode_ts(mc, !mc->rec_ts_idx);
                if (err)
                        return err;
+                /* Next packet in the buffer will have a timestamp on a single
+                 * byte
+                 */
+                mc->rec_ts_idx++;
        }
        switch (f) {
@@ -632,10 +642,13 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
        cf->can_dlc = get_can_dlc(rec_len);
-        /* first data packet timestamp is a word */
+        /* Only first packet timestamp is a word */
-        if (pcan_usb_decode_ts(mc, !mc->rec_data_idx))
+        if (pcan_usb_decode_ts(mc, !mc->rec_ts_idx))
                goto decode_failed;
+        /* Next packet in the buffer will have a timestamp on a single byte */
+        mc->rec_ts_idx++;
        /* read data */
        memset(cf->data, 0x0, sizeof(cf->data));
        if (status_len & PCAN_USB_STATUSLEN_RTR) {
@@ -688,7 +701,6 @@ static int pcan_usb_decode_msg(struct peak_usb_device *dev, u8 *ibuf, u32 lbuf)
                /* handle normal can frames here */
                } else {
                        err = pcan_usb_decode_data(&mc, sl);
-                        mc.rec_data_idx++;
                }
        }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 65dce642b86b..0b7766b715fd 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -750,7 +750,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
        dev = netdev_priv(netdev);
        /* allocate a buffer large enough to send commands */
-        dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
+        dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
        if (!dev->cmd_buf) {
                err = -ENOMEM;
                goto lbl_free_candev;
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index d596a2ad7f78..8fa224b28218 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -996,9 +996,8 @@ static void usb_8dev_disconnect(struct usb_interface *intf)
                netdev_info(priv->netdev, "device disconnected\n");
                unregister_netdev(priv->netdev);
-                free_candev(priv->netdev);
                unlink_all_urbs(priv);
+                free_candev(priv->netdev);
        }
 }
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 911b34316c9d..7c482b2d78d2 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -1599,7 +1599,6 @@ static const struct xcan_devtype_data xcan_zynq_data = {
 static const struct xcan_devtype_data xcan_axi_data = {
        .cantype = XAXI_CAN,
-        .flags = XCAN_FLAG_TXFEMP,
        .bittiming_const = &xcan_bittiming_const,
        .btr_ts2_shift = XCAN_BTR_TS2_SHIFT,
        .btr_sjw_shift = XCAN_BTR_SJW_SHIFT,
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index d44651ad520c..69fc13046ac7 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -1215,10 +1215,10 @@ static int bcm_sf2_sw_remove(struct platform_device *pdev)
        struct bcm_sf2_priv *priv = platform_get_drvdata(pdev);
        priv->wol_ports_mask = 0;
+        /* Disable interrupts */
+        bcm_sf2_intr_disable(priv);
        dsa_unregister_switch(priv->dev->ds);
        bcm_sf2_cfp_exit(priv->dev->ds);
-        /* Disable all ports and interrupts */
-        bcm_sf2_sw_suspend(priv->dev->ds);
        bcm_sf2_mdio_unregister(priv);
        return 0;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 0f138280315a..1de51811fcb4 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1996,8 +1996,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
        /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
        bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
-        udelay(2);
-        bcmgenet_umac_writel(priv, 0, UMAC_CMD);
 }
 static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -2614,8 +2612,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
        spin_unlock_irq(&priv->lock);
        if (status & UMAC_IRQ_PHY_DET_R &&
-            priv->dev->phydev->autoneg != AUTONEG_ENABLE)
+            priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
                phy_init_hw(priv->dev->phydev);
+                genphy_config_aneg(priv->dev->phydev);
+        }
        /* Link UP/DOWN event */
        if (status & UMAC_IRQ_LINK_EVENT)
@@ -2879,12 +2879,6 @@ static int bcmgenet_open(struct net_device *dev)
        if (priv->internal_phy)
                bcmgenet_power_up(priv, GENET_POWER_PASSIVE);
-        ret = bcmgenet_mii_connect(dev);
-        if (ret) {
-                netdev_err(dev, "failed to connect to PHY\n");
-                goto err_clk_disable;
-        }
        /* take MAC out of reset */
        bcmgenet_umac_reset(priv);
@@ -2894,12 +2888,6 @@ static int bcmgenet_open(struct net_device *dev)
        reg = bcmgenet_umac_readl(priv, UMAC_CMD);
        priv->crc_fwd_en = !!(reg & CMD_CRC_FWD);
-        ret = bcmgenet_mii_config(dev, true);
-        if (ret) {
-                netdev_err(dev, "unsupported PHY\n");
-                goto err_disconnect_phy;
-        }
        bcmgenet_set_hw_addr(priv, dev->dev_addr);
        if (priv->internal_phy) {
@@ -2915,7 +2903,7 @@ static int bcmgenet_open(struct net_device *dev)
        ret = bcmgenet_init_dma(priv);
        if (ret) {
                netdev_err(dev, "failed to initialize DMA\n");
-                goto err_disconnect_phy;
+                goto err_clk_disable;
        }
        /* Always enable ring 16 - descriptor ring */
@@ -2938,19 +2926,25 @@ static int bcmgenet_open(struct net_device *dev)
                goto err_irq0;
        }
+        ret = bcmgenet_mii_probe(dev);
+        if (ret) {
+                netdev_err(dev, "failed to connect to PHY\n");
+                goto err_irq1;
+        }
        bcmgenet_netif_start(dev);
        netif_tx_start_all_queues(dev);
        return 0;
+err_irq1:
+        free_irq(priv->irq1, priv);
 err_irq0:
        free_irq(priv->irq0, priv);
 err_fini_dma:
        bcmgenet_dma_teardown(priv);
        bcmgenet_fini_dma(priv);
-err_disconnect_phy:
-        phy_disconnect(dev->phydev);
 err_clk_disable:
        if (priv->internal_phy)
                bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
@@ -3631,8 +3625,6 @@ static int bcmgenet_resume(struct device *d)
        if (priv->internal_phy)
                bcmgenet_power_up(priv, GENET_POWER_PASSIVE);
-        phy_init_hw(dev->phydev);
        bcmgenet_umac_reset(priv);
        init_umac(priv);
@@ -3641,7 +3633,10 @@ static int bcmgenet_resume(struct device *d)
        if (priv->wolopts)
                clk_disable_unprepare(priv->clk_wol);
+        phy_init_hw(dev->phydev);
        /* Speed settings must be restored */
+        genphy_config_aneg(dev->phydev);
        bcmgenet_mii_config(priv->dev, false);
        bcmgenet_set_hw_addr(priv, dev->dev_addr);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 7fbf573d8d52..dbc69d8fa05f 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -720,8 +720,8 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF);
 /* MDIO routines */
 int bcmgenet_mii_init(struct net_device *dev);
-int bcmgenet_mii_connect(struct net_device *dev);
 int bcmgenet_mii_config(struct net_device *dev, bool init);
+int bcmgenet_mii_probe(struct net_device *dev);
 void bcmgenet_mii_exit(struct net_device *dev);
 void bcmgenet_phy_power_set(struct net_device *dev, bool enable);
 void bcmgenet_mii_setup(struct net_device *dev);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 17bb8d60a157..dbe18cdf6c1b 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -173,46 +173,6 @@ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
                                          bcmgenet_fixed_phy_link_update);
 }
-int bcmgenet_mii_connect(struct net_device *dev)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        struct device_node *dn = priv->pdev->dev.of_node;
-        struct phy_device *phydev;
-        u32 phy_flags = 0;
-        int ret;
-        /* Communicate the integrated PHY revision */
-        if (priv->internal_phy)
-                phy_flags = priv->gphy_rev;
-        /* Initialize link state variables that bcmgenet_mii_setup() uses */
-        priv->old_link = -1;
-        priv->old_speed = -1;
-        priv->old_duplex = -1;
-        priv->old_pause = -1;
-        if (dn) {
-                phydev = of_phy_connect(dev, priv->phy_dn, bcmgenet_mii_setup,
-                                        phy_flags, priv->phy_interface);
-                if (!phydev) {
-                        pr_err("could not attach to PHY\n");
-                        return -ENODEV;
-                }
-        } else {
-                phydev = dev->phydev;
-                phydev->dev_flags = phy_flags;
-                ret = phy_connect_direct(dev, phydev, bcmgenet_mii_setup,
-                                         priv->phy_interface);
-                if (ret) {
-                        pr_err("could not attach to PHY\n");
-                        return -ENODEV;
-                }
-        }
-        return 0;
-}
 int bcmgenet_mii_config(struct net_device *dev, bool init)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
@@ -221,8 +181,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
        const char *phy_name = NULL;
        u32 id_mode_dis = 0;
        u32 port_ctrl;
+        int bmcr = -1;
+        int ret;
        u32 reg;
+        /* MAC clocking workaround during reset of umac state machines */
+        reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+        if (reg & CMD_SW_RESET) {
+                /* An MII PHY must be isolated to prevent TXC contention */
+                if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
+                        ret = phy_read(phydev, MII_BMCR);
+                        if (ret >= 0) {
+                                bmcr = ret;
+                                ret = phy_write(phydev, MII_BMCR,
+                                                bmcr | BMCR_ISOLATE);
+                        }
+                        if (ret) {
+                                netdev_err(dev, "failed to isolate PHY\n");
+                                return ret;
+                        }
+                }
+                /* Switch MAC clocking to RGMII generated clock */
+                bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
+                /* Ensure 5 clks with Rx disabled
+                 * followed by 5 clks with Reset asserted
+                 */
+                udelay(4);
+                reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
+                bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+                /* Ensure 5 more clocks before Rx is enabled */
+                udelay(2);
+        }
        priv->ext_phy = !priv->internal_phy &&
                        (priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
@@ -254,6 +244,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
                phy_set_max_speed(phydev, SPEED_100);
                bcmgenet_sys_writel(priv,
                                    PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
+                /* Restore the MII PHY after isolation */
+                if (bmcr >= 0)
+                        phy_write(phydev, MII_BMCR, bmcr);
                break;
        case PHY_INTERFACE_MODE_REVMII:
@@ -306,21 +299,71 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
                bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
        }
-        if (init) {
+        if (init)
-                linkmode_copy(phydev->advertising, phydev->supported);
+                dev_info(kdev, "configuring instance for %s\n", phy_name);
-                /* The internal PHY has its link interrupts routed to the
+        return 0;
-                 * Ethernet MAC ISRs. On GENETv5 there is a hardware issue
+}
-                 * that prevents the signaling of link UP interrupts when
-                 * the link operates at 10Mbps, so fallback to polling for
-                 * those versions of GENET.
-                 */
-                if (priv->internal_phy && !GENET_IS_V5(priv))
-                        phydev->irq = PHY_IGNORE_INTERRUPT;
-                dev_info(kdev, "configuring instance for %s\n", phy_name);
+int bcmgenet_mii_probe(struct net_device *dev)
+{
+        struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
+        struct phy_device *phydev;
+        u32 phy_flags = 0;
+        int ret;
+        /* Communicate the integrated PHY revision */
+        if (priv->internal_phy)
+                phy_flags = priv->gphy_rev;
+        /* Initialize link state variables that bcmgenet_mii_setup() uses */
+        priv->old_link = -1;
+        priv->old_speed = -1;
+        priv->old_duplex = -1;
+        priv->old_pause = -1;
+        if (dn) {
+                phydev = of_phy_connect(dev, priv->phy_dn, bcmgenet_mii_setup,
+                                        phy_flags, priv->phy_interface);
+                if (!phydev) {
+                        pr_err("could not attach to PHY\n");
+                        return -ENODEV;
+                }
+        } else {
+                phydev = dev->phydev;
+                phydev->dev_flags = phy_flags;
+                ret = phy_connect_direct(dev, phydev, bcmgenet_mii_setup,
+                                         priv->phy_interface);
+                if (ret) {
+                        pr_err("could not attach to PHY\n");
+                        return -ENODEV;
+                }
        }
+        /* Configure port multiplexer based on what the probed PHY device since
+         * reading the 'max-speed' property determines the maximum supported
+         * PHY speed which is needed for bcmgenet_mii_config() to configure
+         * things appropriately.
+         */
+        ret = bcmgenet_mii_config(dev, true);
+        if (ret) {
+                phy_disconnect(dev->phydev);
+                return ret;
+        }
+        linkmode_copy(phydev->advertising, phydev->supported);
+        /* The internal PHY has its link interrupts routed to the
+         * Ethernet MAC ISRs. On GENETv5 there is a hardware issue
+         * that prevents the signaling of link UP interrupts when
+         * the link operates at 10Mbps, so fallback to polling for
+         * those versions of GENET.
+         */
+        if (priv->internal_phy && !GENET_IS_V5(priv))
+                dev->phydev->irq = PHY_IGNORE_INTERRUPT;
        return 0;
 }
diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 0e5de88fd6e8..cdd7e5da4a74 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -1499,7 +1499,7 @@ static int octeon_mgmt_probe(struct platform_device *pdev)
        netdev->ethtool_ops = &octeon_mgmt_ethtool_ops;
        netdev->min_mtu = 64 - OCTEON_MGMT_RX_HEADROOM;
-        netdev->max_mtu = 16383 - OCTEON_MGMT_RX_HEADROOM;
+        netdev->max_mtu = 16383 - OCTEON_MGMT_RX_HEADROOM - VLAN_HLEN;
        mac = of_get_mac_address(pdev->dev.of_node);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 22c01b224baa..a9c386b63581 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3645,6 +3645,8 @@ fec_drv_remove(struct platform_device *pdev)
                regulator_disable(fep->reg_phy);
        pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
+        clk_disable_unprepare(fep->clk_ahb);
+        clk_disable_unprepare(fep->clk_ipg);
        if (of_phy_is_fixed_link(np))
                of_phy_deregister_fixed_link(np);
        of_node_put(fep->phy_node);
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index 6d0457eb4faa..08339278c722 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -199,7 +199,6 @@ hnae_init_ring(struct hnae_queue *q, struct hnae_ring *ring, int flags)
        ring->q = q;
        ring->flags = flags;
-        spin_lock_init(&ring->lock);
        ring->coal_param = q->handle->coal_param;
        assert(!ring->desc && !ring->desc_cb && !ring->desc_dma_addr);
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index e9c67c06bfd2..6ab9458302e1 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -274,9 +274,6 @@ struct hnae_ring {
        /* statistic */
        struct ring_stats stats;
-        /* ring lock for poll one */
-        spinlock_t lock;
        dma_addr_t desc_dma_addr;
        u32 buf_size;       /* size for hnae_desc->addr, preset by AE */
        u16 desc_num;       /* total number of desc */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index a48396dd4ebb..14ab20491fd0 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -943,15 +943,6 @@ static int is_valid_clean_head(struct hnae_ring *ring, int h)
        return u > c ? (h > c && h <= u) : (h > c || h <= u);
 }
-/* netif_tx_lock will turn down the performance, set only when necessary */
-#ifdef CONFIG_NET_POLL_CONTROLLER
-#define NETIF_TX_LOCK(ring) spin_lock(&(ring)->lock)
-#define NETIF_TX_UNLOCK(ring) spin_unlock(&(ring)->lock)
-#else
-#define NETIF_TX_LOCK(ring)
-#define NETIF_TX_UNLOCK(ring)
-#endif
 /* reclaim all desc in one budget
 * return error or number of desc left
 */
@@ -965,21 +956,16 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
        int head;
        int bytes, pkts;
-        NETIF_TX_LOCK(ring);
        head = readl_relaxed(ring->io_base + RCB_REG_HEAD);
        rmb(); /* make sure head is ready before touch any data */
-        if (is_ring_empty(ring) || head == ring->next_to_clean) {
+        if (is_ring_empty(ring) || head == ring->next_to_clean)
-                NETIF_TX_UNLOCK(ring);
                return 0; /* no data to poll */
-        }
        if (!is_valid_clean_head(ring, head)) {
                netdev_err(ndev, "wrong head (%d, %d-%d)\n", head,
                           ring->next_to_use, ring->next_to_clean);
                ring->stats.io_err_cnt++;
-                NETIF_TX_UNLOCK(ring);
                return -EIO;
        }
@@ -994,8 +980,6 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
        ring->stats.tx_pkts += pkts;
        ring->stats.tx_bytes += bytes;
-        NETIF_TX_UNLOCK(ring);
        dev_queue = netdev_get_tx_queue(ndev, ring_data->queue_index);
        netdev_tx_completed_queue(dev_queue, pkts, bytes);
@@ -1055,16 +1039,12 @@ static void hns_nic_tx_clr_all_bufs(struct hns_nic_ring_data *ring_data)
        int head;
        int bytes, pkts;
-        NETIF_TX_LOCK(ring);
        head = ring->next_to_use; /* ntu :soft setted ring position*/
        bytes = 0;
        pkts = 0;
        while (head != ring->next_to_clean)
                hns_nic_reclaim_one_desc(ring, &bytes, &pkts);
-        NETIF_TX_UNLOCK(ring);
        dev_queue = netdev_get_tx_queue(ndev, ring_data->queue_index);
        netdev_tx_reset_queue(dev_queue);
 }
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index 75ccc1e7076b..a0998937727d 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HNAE3_H
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index 2110fa3b4479..5d468ed404a6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HNS3_ENET_H
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 4821fe08b5e4..1426eb5ddf3d 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HCLGE_CMD_H
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.h
index 278f21e02736..b04702e65689 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HCLGE_DCB_H__
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index e02e01bd9eff..16f7d0e15b4f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3587,12 +3587,28 @@ static int hclge_set_rst_done(struct hclge_dev *hdev)
 {
        struct hclge_pf_rst_done_cmd *req;
        struct hclge_desc desc;
+        int ret;
        req = (struct hclge_pf_rst_done_cmd *)desc.data;
        hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_PF_RST_DONE, false);
        req->pf_rst_done |= HCLGE_PF_RESET_DONE_BIT;
-        return hclge_cmd_send(&hdev->hw, &desc, 1);
+        ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+        /* To be compatible with the old firmware, which does not support
+         * command HCLGE_OPC_PF_RST_DONE, just print a warning and
+         * return success
+         */
+        if (ret == -EOPNOTSUPP) {
+                dev_warn(&hdev->pdev->dev,
+                         "current firmware does not support command(0x%x)!\n",
+                         HCLGE_OPC_PF_RST_DONE);
+                return 0;
+        } else if (ret) {
+                dev_err(&hdev->pdev->dev, "assert PF reset done fail %d!\n",
+                        ret);
+        }
+        return ret;
 }
 static int hclge_reset_prepare_up(struct hclge_dev *hdev)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index c3d56b872ed7..59b824347ba4 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HCLGE_MAIN_H
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
index ef095d9c566f..dd9a1218a7b0 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HCLGE_MDIO_H
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
index 818610988d34..260f22d19d81 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0+
+/* SPDX-License-Identifier: GPL-2.0+ */
 // Copyright (c) 2016-2017 Hisilicon Limited.
 #ifndef __HCLGE_TM_H
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
index 530613f31527..69a2daaca5c5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
@@ -20,6 +20,8 @@
 /* API version 1.7 implements additional link and PHY-specific APIs  */
 #define I40E_MINOR_VER_GET_LINK_INFO_XL710 0x0007
+/* API version 1.9 for X722 implements additional link and PHY-specific APIs */
+#define I40E_MINOR_VER_GET_LINK_INFO_X722 0x0009
 /* API version 1.6 for X722 devices adds ability to stop FW LLDP agent */
 #define I40E_MINOR_VER_FW_LLDP_STOPPABLE_X722 0x0006
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index d37c6e0e5f08..7560f06768e0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1876,7 +1876,8 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
             hw->aq.fw_min_ver < 40)) && hw_link_info->phy_type == 0xE)
                hw_link_info->phy_type = I40E_PHY_TYPE_10GBASE_SFPP_CU;
-        if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE) {
+        if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE &&
+            hw->mac.type != I40E_MAC_X722) {
                __le32 tmp;
                memcpy(&tmp, resp->link_type, sizeof(tmp));
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index a05dfecdd9b4..d07e1a890428 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -689,8 +689,6 @@ static bool i40e_xmit_zc(struct i40e_ring *xdp_ring, unsigned int budget)
                i40e_xdp_ring_update_tail(xdp_ring);
                xsk_umem_consume_tx_done(xdp_ring->xsk_umem);
-                if (xsk_umem_uses_need_wakeup(xdp_ring->xsk_umem))
-                        xsk_clear_tx_need_wakeup(xdp_ring->xsk_umem);
        }
        return !!budget && work_done;
@@ -769,12 +767,8 @@ bool i40e_clean_xdp_tx_irq(struct i40e_vsi *vsi,
        i40e_update_tx_stats(tx_ring, completed_frames, total_bytes);
 out_xmit:
-        if (xsk_umem_uses_need_wakeup(tx_ring->xsk_umem)) {
+        if (xsk_umem_uses_need_wakeup(tx_ring->xsk_umem))
-                if (tx_ring->next_to_clean == tx_ring->next_to_use)
+                xsk_set_tx_need_wakeup(tx_ring->xsk_umem);
-                        xsk_set_tx_need_wakeup(tx_ring->xsk_umem);
-                else
-                        xsk_clear_tx_need_wakeup(tx_ring->xsk_umem);
-        }
        xmit_done = i40e_xmit_zc(tx_ring, budget);
diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index 8f310e520b06..821987da5698 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -314,7 +314,7 @@ iavf_map_vector_to_rxq(struct iavf_adapter *adapter, int v_idx, int r_idx)
        q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
        q_vector->ring_mask |= BIT(r_idx);
        wr32(hw, IAVF_VFINT_ITRN1(IAVF_RX_ITR, q_vector->reg_idx),
-             q_vector->rx.current_itr);
+             q_vector->rx.current_itr >> 1);
        q_vector->rx.current_itr = q_vector->rx.target_itr;
 }
@@ -340,7 +340,7 @@ iavf_map_vector_to_txq(struct iavf_adapter *adapter, int v_idx, int t_idx)
        q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
        q_vector->num_ringpairs++;
        wr32(hw, IAVF_VFINT_ITRN1(IAVF_TX_ITR, q_vector->reg_idx),
-             q_vector->tx.target_itr);
+             q_vector->tx.target_itr >> 1);
        q_vector->tx.current_itr = q_vector->tx.target_itr;
 }
diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index fc624b73d05d..2fde9653a608 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -1036,7 +1036,7 @@ enum ice_status ice_sched_query_res_alloc(struct ice_hw *hw)
        struct ice_aqc_query_txsched_res_resp *buf;
        enum ice_status status = 0;
        __le16 max_sibl;
-        u8 i;
+        u16 i;
        if (hw->layer_info)
                return status;
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 9148c62d9ac5..ed7e667d7eb2 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5675,8 +5675,8 @@ static void igb_tx_ctxtdesc(struct igb_ring *tx_ring,
         * should have been handled by the upper layers.
         */
        if (tx_ring->launchtime_enable) {
-                ts = ns_to_timespec64(first->skb->tstamp);
+                ts = ktime_to_timespec64(first->skb->tstamp);
-                first->skb->tstamp = 0;
+                first->skb->tstamp = ktime_set(0, 0);
                context_desc->seqnum_seed = cpu_to_le32(ts.tv_nsec / 32);
        } else {
                context_desc->seqnum_seed = 0;
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 8e424dfab12e..24888676f69b 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -824,8 +824,8 @@ static void igc_tx_ctxtdesc(struct igc_ring *tx_ring,
         * should have been handled by the upper layers.
         */
        if (tx_ring->launchtime_enable) {
-                ts = ns_to_timespec64(first->skb->tstamp);
+                ts = ktime_to_timespec64(first->skb->tstamp);
-                first->skb->tstamp = 0;
+                first->skb->tstamp = ktime_set(0, 0);
                context_desc->launch_time = cpu_to_le32(ts.tv_nsec / 32);
        } else {
                context_desc->launch_time = 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
index 100ac89b345d..d6feaacfbf89 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
@@ -622,8 +622,6 @@ static bool ixgbe_xmit_zc(struct ixgbe_ring *xdp_ring, unsigned int budget)
        if (tx_desc) {
                ixgbe_xdp_ring_update_tail(xdp_ring);
                xsk_umem_consume_tx_done(xdp_ring->xsk_umem);
-                if (xsk_umem_uses_need_wakeup(xdp_ring->xsk_umem))
-                        xsk_clear_tx_need_wakeup(xdp_ring->xsk_umem);
        }
        return !!budget && work_done;
@@ -691,12 +689,8 @@ bool ixgbe_clean_xdp_tx_irq(struct ixgbe_q_vector *q_vector,
        if (xsk_frames)
                xsk_umem_complete_tx(umem, xsk_frames);
-        if (xsk_umem_uses_need_wakeup(tx_ring->xsk_umem)) {
+        if (xsk_umem_uses_need_wakeup(tx_ring->xsk_umem))
-                if (tx_ring->next_to_clean == tx_ring->next_to_use)
+                xsk_set_tx_need_wakeup(tx_ring->xsk_umem);
-                        xsk_set_tx_need_wakeup(tx_ring->xsk_umem);
-                else
-                        xsk_clear_tx_need_wakeup(tx_ring->xsk_umem);
-        }
        return ixgbe_xmit_zc(tx_ring, q_vector->tx.work_limit);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index fce9b3a24347..69bb6bb06e76 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -514,8 +514,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
        dev->caps.max_rq_desc_sz     = dev_cap->max_rq_desc_sz;
        /*
         * Subtract 1 from the limit because we need to allocate a
-         * spare CQE so the HCA HW can tell the difference between an
+         * spare CQE to enable resizing the CQ.
-         * empty CQ and a full CQ.
         */
        dev->caps.max_cqes           = dev_cap->max_cq_sz - 1;
        dev->caps.reserved_cqs       = dev_cap->reserved_cqs;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 369499e88fe8..9004a07e457a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1079,7 +1079,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
                            MLX5_CAP_GEN(dev, max_flow_counter_15_0);
        fdb_max = 1 << MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size);
-        esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(2^%d))\n",
+        esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(%d))\n",
                  MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size),
                  max_flow_counter, ESW_OFFLOADS_NUM_GROUPS,
                  fdb_max);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
index 7879e1746297..366bda1bb1c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
@@ -183,7 +183,8 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
        u32 port_mask, port_value;
        if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
-                return spec->flow_context.flow_source == MLX5_VPORT_UPLINK;
+                return spec->flow_context.flow_source ==
+                                        MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
        port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
                             misc_parameters.source_port);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
index b74b7d0f6590..004c56c2fc0c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
@@ -1577,6 +1577,7 @@ int mlx5dr_action_destroy(struct mlx5dr_action *action)
                break;
        case DR_ACTION_TYP_MODIFY_HDR:
                mlx5dr_icm_free_chunk(action->rewrite.chunk);
+                kfree(action->rewrite.data);
                refcount_dec(&action->rewrite.dmn->refcount);
                break;
        default:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
index e8b656075c6f..5dcb8baf491a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
@@ -1096,6 +1096,8 @@ dr_rule_create_rule_nic(struct mlx5dr_rule *rule,
        if (htbl)
                mlx5dr_htbl_put(htbl);
+        kfree(hw_ste_arr);
        return 0;
 free_ste:
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 344539c0d3aa..672ea1342add 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -1680,9 +1680,6 @@ static int ocelot_netdevice_port_event(struct net_device *dev,
        struct ocelot_port *ocelot_port = netdev_priv(dev);
        int err = 0;
-        if (!ocelot_netdevice_dev_check(dev))
-                return 0;
        switch (event) {
        case NETDEV_CHANGEUPPER:
                if (netif_is_bridge_master(info->upper_dev)) {
@@ -1719,12 +1716,16 @@ static int ocelot_netdevice_event(struct notifier_block *unused,
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        int ret = 0;
+        if (!ocelot_netdevice_dev_check(dev))
+                return 0;
        if (event == NETDEV_PRECHANGEUPPER &&
            netif_is_lag_master(info->upper_dev)) {
                struct netdev_lag_upper_info *lag_upper_info = info->upper_info;
                struct netlink_ext_ack *extack;
-                if (lag_upper_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
+                if (lag_upper_info &&
+                    lag_upper_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
                        extack = netdev_notifier_info_to_extack(&info->info);
                        NL_SET_ERR_MSG_MOD(extack, "LAG device using unsupported Tx type");
diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
index e40773c01a44..06ac806052bc 100644
--- a/drivers/net/ethernet/mscc/ocelot.h
+++ b/drivers/net/ethernet/mscc/ocelot.h
@@ -523,7 +523,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
 #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
 #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
+void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
                     u32 offset);
 #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
 #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 8d1c208f778f..a220cc7c947a 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -1208,8 +1208,16 @@ enum qede_remove_mode {
 static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)
 {
        struct net_device *ndev = pci_get_drvdata(pdev);
-        struct qede_dev *edev = netdev_priv(ndev);
+        struct qede_dev *edev;
-        struct qed_dev *cdev = edev->cdev;
+        struct qed_dev *cdev;
+        if (!ndev) {
+                dev_info(&pdev->dev, "Device has already been removed\n");
+                return;
+        }
+        edev = netdev_priv(ndev);
+        cdev = edev->cdev;
        DP_INFO(edev, "Starting qede_remove\n");
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 9c54b715228e..06de59521fc4 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -57,10 +57,10 @@ static int rmnet_unregister_real_device(struct net_device *real_dev,
        if (port->nr_rmnet_devs)
                return -EINVAL;
-        kfree(port);
        netdev_rx_handler_unregister(real_dev);
+        kfree(port);
        /* release reference on real_dev */
        dev_put(real_dev);
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 5064c292b873..c4e961ea44d5 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -916,6 +916,9 @@ static void r8168g_mdio_write(struct rtl8169_private *tp, int reg, int value)
 static int r8168g_mdio_read(struct rtl8169_private *tp, int reg)
 {
+        if (reg == 0x1f)
+                return tp->ocp_base == OCP_STD_PHY_BASE ? 0 : tp->ocp_base >> 4;
        if (tp->ocp_base != OCP_STD_PHY_BASE)
                reg -= 0x10;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 5a7b0aca1d31..66e60c7e9850 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -432,7 +432,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
                         * bits used depends on the hardware configuration
                         * selected at core configuration time.
                         */
-                        int bit_nr = bitrev32(~crc32_le(~0, ha->addr,
+                        u32 bit_nr = bitrev32(~crc32_le(~0, ha->addr,
                                        ETH_ALEN)) >> (32 - mcbitslog2);
                        /* The most significant bit determines the register to
                         * use (H/L) while the other 5 bits determine the bit
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index 5031398e612c..070bd7d1ae4c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -224,6 +224,7 @@ static void dwxgmac2_config_cbs(struct mac_device_info *hw,
        writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(queue));
        value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
+        value &= ~XGMAC_TSA;
        value |= XGMAC_CC | XGMAC_CBS;
        writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
 }
@@ -463,7 +464,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw,
                value |= XGMAC_FILTER_HMC;
                netdev_for_each_mc_addr(ha, dev) {
-                        int nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
+                        u32 nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
                                        (32 - mcbitslog2));
                        mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
                }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index ae48154f933c..bd5838ce1e8a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -288,7 +288,8 @@ static int dwxgmac2_get_rx_hash(struct dma_desc *p, u32 *hash,
 static int dwxgmac2_get_rx_header_len(struct dma_desc *p, unsigned int *len)
 {
-        *len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
+        if (le32_to_cpu(p->des3) & XGMAC_RDES3_L34T)
+                *len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
        return 0;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index 965cbe3e6f51..f70ca5300b82 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -369,7 +369,7 @@ static void dwxgmac2_get_hw_feature(void __iomem *ioaddr,
        dma_cap->eee = (hw_cap & XGMAC_HWFEAT_EEESEL) >> 13;
        dma_cap->atime_stamp = (hw_cap & XGMAC_HWFEAT_TSSEL) >> 12;
        dma_cap->av = (hw_cap & XGMAC_HWFEAT_AVSEL) >> 11;
-        dma_cap->av &= !(hw_cap & XGMAC_HWFEAT_RAVSEL) >> 10;
+        dma_cap->av &= !((hw_cap & XGMAC_HWFEAT_RAVSEL) >> 10);
        dma_cap->arpoffsel = (hw_cap & XGMAC_HWFEAT_ARPOFFSEL) >> 9;
        dma_cap->rmon = (hw_cap & XGMAC_HWFEAT_MMCSEL) >> 8;
        dma_cap->pmt_magic_frame = (hw_cap & XGMAC_HWFEAT_MGKSEL) >> 7;
@@ -470,6 +470,7 @@ static void dwxgmac2_enable_tso(void __iomem *ioaddr, bool en, u32 chan)
 static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
 {
        u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+        u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
        value &= ~XGMAC_TXQEN;
        if (qmode != MTL_QUEUE_AVB) {
@@ -477,6 +478,7 @@ static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
                writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel));
        } else {
                value |= 0x1 << XGMAC_TXQEN_SHIFT;
+                writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL);
        }
        writel(value, ioaddr +  XGMAC_MTL_TXQ_OPMODE(channel));
diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
index a223584f5f9a..252cf48c5816 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
@@ -176,6 +176,7 @@
 #define MMC_XGMAC_RX_PKT_SMD_ERR        0x22c
 #define MMC_XGMAC_RX_PKT_ASSEMBLY_OK    0x230
 #define MMC_XGMAC_RX_FPE_FRAG           0x234
+#define MMC_XGMAC_RX_IPC_INTR_MASK      0x25c
 static void dwmac_mmc_ctrl(void __iomem *mmcaddr, unsigned int mode)
 {
@@ -333,8 +334,9 @@ static void dwxgmac_mmc_ctrl(void __iomem *mmcaddr, unsigned int mode)
 static void dwxgmac_mmc_intr_all_mask(void __iomem *mmcaddr)
 {
-        writel(MMC_DEFAULT_MASK, mmcaddr + MMC_RX_INTR_MASK);
+        writel(0x0, mmcaddr + MMC_RX_INTR_MASK);
-        writel(MMC_DEFAULT_MASK, mmcaddr + MMC_TX_INTR_MASK);
+        writel(0x0, mmcaddr + MMC_TX_INTR_MASK);
+        writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_IPC_INTR_MASK);
 }
 static void dwxgmac_read_mmc_reg(void __iomem *addr, u32 reg, u32 *dest)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 4e9c848c67cc..f826365c979d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2996,6 +2996,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
                stmmac_set_desc_addr(priv, first, des);
                tmp_pay_len = pay_len;
                des += proto_hdr_len;
+                pay_len = 0;
        }
        stmmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue);
@@ -3023,6 +3024,19 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Only the last descriptor gets to point to the skb. */
        tx_q->tx_skbuff[tx_q->cur_tx] = skb;
+        /* Manage tx mitigation */
+        tx_q->tx_count_frames += nfrags + 1;
+        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
+            !((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+              priv->hwts_tx_en)) {
+                stmmac_tx_timer_arm(priv, queue);
+        } else {
+                desc = &tx_q->dma_tx[tx_q->cur_tx];
+                tx_q->tx_count_frames = 0;
+                stmmac_set_tx_ic(priv, desc);
+                priv->xstats.tx_set_ic_bit++;
+        }
        /* We've used all descriptors we need for this skb, however,
         * advance cur_tx so that it references a fresh descriptor.
         * ndo_start_xmit will fill this descriptor the next time it's
@@ -3040,19 +3054,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
        priv->xstats.tx_tso_frames++;
        priv->xstats.tx_tso_nfrags += nfrags;
-        /* Manage tx mitigation */
-        tx_q->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
-            !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
-            (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
-            priv->hwts_tx_en)) {
-                stmmac_tx_timer_arm(priv, queue);
-        } else {
-                tx_q->tx_count_frames = 0;
-                stmmac_set_tx_ic(priv, desc);
-                priv->xstats.tx_set_ic_bit++;
-        }
        if (priv->sarc_type)
                stmmac_set_desc_sarc(priv, first, priv->sarc_type);
@@ -3224,6 +3225,27 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Only the last descriptor gets to point to the skb. */
        tx_q->tx_skbuff[entry] = skb;
+        /* According to the coalesce parameter the IC bit for the latest
+         * segment is reset and the timer re-started to clean the tx status.
+         * This approach takes care about the fragments: desc is the first
+         * element in case of no SG.
+         */
+        tx_q->tx_count_frames += nfrags + 1;
+        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
+            !((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+              priv->hwts_tx_en)) {
+                stmmac_tx_timer_arm(priv, queue);
+        } else {
+                if (likely(priv->extend_desc))
+                        desc = &tx_q->dma_etx[entry].basic;
+                else
+                        desc = &tx_q->dma_tx[entry];
+                tx_q->tx_count_frames = 0;
+                stmmac_set_tx_ic(priv, desc);
+                priv->xstats.tx_set_ic_bit++;
+        }
        /* We've used all descriptors we need for this skb, however,
         * advance cur_tx so that it references a fresh descriptor.
         * ndo_start_xmit will fill this descriptor the next time it's
@@ -3259,23 +3281,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->stats.tx_bytes += skb->len;
-        /* According to the coalesce parameter the IC bit for the latest
-         * segment is reset and the timer re-started to clean the tx status.
-         * This approach takes care about the fragments: desc is the first
-         * element in case of no SG.
-         */
-        tx_q->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
-            !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
-            (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
-            priv->hwts_tx_en)) {
-                stmmac_tx_timer_arm(priv, queue);
-        } else {
-                tx_q->tx_count_frames = 0;
-                stmmac_set_tx_ic(priv, desc);
-                priv->xstats.tx_set_ic_bit++;
-        }
        if (priv->sarc_type)
                stmmac_set_desc_sarc(priv, first, priv->sarc_type);
@@ -3506,8 +3511,6 @@ read_again:
                if (unlikely(status & dma_own))
                        break;
-                count++;
                rx_q->cur_rx = STMMAC_GET_ENTRY(rx_q->cur_rx, DMA_RX_SIZE);
                next_entry = rx_q->cur_rx;
@@ -3534,6 +3537,7 @@ read_again:
                        goto read_again;
                if (unlikely(error)) {
                        dev_kfree_skb(skb);
+                        count++;
                        continue;
                }
@@ -3573,6 +3577,7 @@ read_again:
                        skb = napi_alloc_skb(&ch->rx_napi, len);
                        if (!skb) {
                                priv->dev->stats.rx_dropped++;
+                                count++;
                                continue;
                        }
@@ -3638,6 +3643,7 @@ read_again:
                priv->dev->stats.rx_packets++;
                priv->dev->stats.rx_bytes += len;
+                count++;
        }
        if (status & rx_not_ls) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
index e4ac3c401432..ac3f658105c0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
@@ -6,7 +6,9 @@
 * Author: Jose Abreu <joabreu@synopsys.com>
 */
+#include <linux/bitrev.h>
 #include <linux/completion.h>
+#include <linux/crc32.h>
 #include <linux/ethtool.h>
 #include <linux/ip.h>
 #include <linux/phy.h>
@@ -485,12 +487,48 @@ static int stmmac_filter_check(struct stmmac_priv *priv)
        return -EOPNOTSUPP;
 }
+static bool stmmac_hash_check(struct stmmac_priv *priv, unsigned char *addr)
+{
+        int mc_offset = 32 - priv->hw->mcast_bits_log2;
+        struct netdev_hw_addr *ha;
+        u32 hash, hash_nr;
+        /* First compute the hash for desired addr */
+        hash = bitrev32(~crc32_le(~0, addr, 6)) >> mc_offset;
+        hash_nr = hash >> 5;
+        hash = 1 << (hash & 0x1f);
+        /* Now, check if it collides with any existing one */
+        netdev_for_each_mc_addr(ha, priv->dev) {
+                u32 nr = bitrev32(~crc32_le(~0, ha->addr, ETH_ALEN)) >> mc_offset;
+                if (((nr >> 5) == hash_nr) && ((1 << (nr & 0x1f)) == hash))
+                        return false;
+        }
+        /* No collisions, address is good to go */
+        return true;
+}
+static bool stmmac_perfect_check(struct stmmac_priv *priv, unsigned char *addr)
+{
+        struct netdev_hw_addr *ha;
+        /* Check if it collides with any existing one */
+        netdev_for_each_uc_addr(ha, priv->dev) {
+                if (!memcmp(ha->addr, addr, ETH_ALEN))
+                        return false;
+        }
+        /* No collisions, address is good to go */
+        return true;
+}
 static int stmmac_test_hfilt(struct stmmac_priv *priv)
 {
-        unsigned char gd_addr[ETH_ALEN] = {0x01, 0xee, 0xdd, 0xcc, 0xbb, 0xaa};
+        unsigned char gd_addr[ETH_ALEN] = {0xf1, 0xee, 0xdd, 0xcc, 0xbb, 0xaa};
-        unsigned char bd_addr[ETH_ALEN] = {0x01, 0x01, 0x02, 0x03, 0x04, 0x05};
+        unsigned char bd_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
        struct stmmac_packet_attrs attr = { };
-        int ret;
+        int ret, tries = 256;
        ret = stmmac_filter_check(priv);
        if (ret)
@@ -499,6 +537,16 @@ static int stmmac_test_hfilt(struct stmmac_priv *priv)
        if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
                return -EOPNOTSUPP;
+        while (--tries) {
+                /* We only need to check the bd_addr for collisions */
+                bd_addr[ETH_ALEN - 1] = tries;
+                if (stmmac_hash_check(priv, bd_addr))
+                        break;
+        }
+        if (!tries)
+                return -EOPNOTSUPP;
        ret = dev_mc_add(priv->dev, gd_addr);
        if (ret)
                return ret;
@@ -523,13 +571,25 @@ cleanup:
 static int stmmac_test_pfilt(struct stmmac_priv *priv)
 {
-        unsigned char gd_addr[ETH_ALEN] = {0x00, 0x01, 0x44, 0x55, 0x66, 0x77};
+        unsigned char gd_addr[ETH_ALEN] = {0xf0, 0x01, 0x44, 0x55, 0x66, 0x77};
-        unsigned char bd_addr[ETH_ALEN] = {0x08, 0x00, 0x22, 0x33, 0x44, 0x55};
+        unsigned char bd_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
        struct stmmac_packet_attrs attr = { };
-        int ret;
+        int ret, tries = 256;
        if (stmmac_filter_check(priv))
                return -EOPNOTSUPP;
+        if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
+                return -EOPNOTSUPP;
+        while (--tries) {
+                /* We only need to check the bd_addr for collisions */
+                bd_addr[ETH_ALEN - 1] = tries;
+                if (stmmac_perfect_check(priv, bd_addr))
+                        break;
+        }
+        if (!tries)
+                return -EOPNOTSUPP;
        ret = dev_uc_add(priv->dev, gd_addr);
        if (ret)
@@ -553,39 +613,31 @@ cleanup:
        return ret;
 }
-static int stmmac_dummy_sync(struct net_device *netdev, const u8 *addr)
-{
-        return 0;
-}
-static void stmmac_test_set_rx_mode(struct net_device *netdev)
-{
-        /* As we are in test mode of ethtool we already own the rtnl lock
-         * so no address will change from user. We can just call the
-         * ndo_set_rx_mode() callback directly */
-        if (netdev->netdev_ops->ndo_set_rx_mode)
-                netdev->netdev_ops->ndo_set_rx_mode(netdev);
-}
 static int stmmac_test_mcfilt(struct stmmac_priv *priv)
 {
-        unsigned char uc_addr[ETH_ALEN] = {0x00, 0x01, 0x44, 0x55, 0x66, 0x77};
+        unsigned char uc_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
-        unsigned char mc_addr[ETH_ALEN] = {0x01, 0x01, 0x44, 0x55, 0x66, 0x77};
+        unsigned char mc_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
        struct stmmac_packet_attrs attr = { };
-        int ret;
+        int ret, tries = 256;
        if (stmmac_filter_check(priv))
                return -EOPNOTSUPP;
-        if (!priv->hw->multicast_filter_bins)
+        if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
                return -EOPNOTSUPP;
-        /* Remove all MC addresses */
+        while (--tries) {
-        __dev_mc_unsync(priv->dev, NULL);
+                /* We only need to check the mc_addr for collisions */
-        stmmac_test_set_rx_mode(priv->dev);
+                mc_addr[ETH_ALEN - 1] = tries;
+                if (stmmac_hash_check(priv, mc_addr))
+                        break;
+        }
+        if (!tries)
+                return -EOPNOTSUPP;
        ret = dev_uc_add(priv->dev, uc_addr);
        if (ret)
-                goto cleanup;
+                return ret;
        attr.dst = uc_addr;
@@ -602,30 +654,34 @@ static int stmmac_test_mcfilt(struct stmmac_priv *priv)
 cleanup:
        dev_uc_del(priv->dev, uc_addr);
-        __dev_mc_sync(priv->dev, stmmac_dummy_sync, NULL);
-        stmmac_test_set_rx_mode(priv->dev);
        return ret;
 }
 static int stmmac_test_ucfilt(struct stmmac_priv *priv)
 {
-        unsigned char uc_addr[ETH_ALEN] = {0x00, 0x01, 0x44, 0x55, 0x66, 0x77};
+        unsigned char uc_addr[ETH_ALEN] = {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff};
-        unsigned char mc_addr[ETH_ALEN] = {0x01, 0x01, 0x44, 0x55, 0x66, 0x77};
+        unsigned char mc_addr[ETH_ALEN] = {0xf1, 0xff, 0xff, 0xff, 0xff, 0xff};
        struct stmmac_packet_attrs attr = { };
-        int ret;
+        int ret, tries = 256;
        if (stmmac_filter_check(priv))
                return -EOPNOTSUPP;
-        if (!priv->hw->multicast_filter_bins)
+        if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
                return -EOPNOTSUPP;
-        /* Remove all UC addresses */
+        while (--tries) {
-        __dev_uc_unsync(priv->dev, NULL);
+                /* We only need to check the uc_addr for collisions */
-        stmmac_test_set_rx_mode(priv->dev);
+                uc_addr[ETH_ALEN - 1] = tries;
+                if (stmmac_perfect_check(priv, uc_addr))
+                        break;
+        }
+        if (!tries)
+                return -EOPNOTSUPP;
        ret = dev_mc_add(priv->dev, mc_addr);
        if (ret)
-                goto cleanup;
+                return ret;
        attr.dst = mc_addr;
@@ -642,8 +698,6 @@ static int stmmac_test_ucfilt(struct stmmac_priv *priv)
 cleanup:
        dev_mc_del(priv->dev, mc_addr);
-        __dev_uc_sync(priv->dev, stmmac_dummy_sync, NULL);
-        stmmac_test_set_rx_mode(priv->dev);
        return ret;
 }
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 00cab3f43a4c..a245597a3902 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -578,8 +578,8 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
        /* read current mtu value from device */
        err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
                              USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
-                              0, iface_no, &max_datagram_size, 2);
+                              0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
-        if (err < 0) {
+        if (err < sizeof(max_datagram_size)) {
                dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
                goto out;
        }
@@ -590,7 +590,7 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
        max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
        err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE,
                               USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE,
-                               0, iface_no, &max_datagram_size, 2);
+                               0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
        if (err < 0)
                dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n");
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 596428ec71df..56d334b9ad45 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1362,6 +1362,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
        {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
        {QMI_FIXED_INTF(0x413c, 0x81d7, 0)},    /* Dell Wireless 5821e */
+        {QMI_FIXED_INTF(0x413c, 0x81e0, 0)},    /* Dell Wireless 5821e with eSIM support*/
        {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
        {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE */
        {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index 1cd113c8d7cb..ad0abb1f0bae 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -259,7 +259,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
                                                  *fw_vsc_cfg, len);
                if (r) {
-                        devm_kfree(dev, fw_vsc_cfg);
+                        devm_kfree(dev, *fw_vsc_cfg);
                        goto vsc_read_err;
                }
        } else {
diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c
index f9ac176cf257..2ce17932a073 100644
--- a/drivers/nfc/st21nfca/core.c
+++ b/drivers/nfc/st21nfca/core.c
@@ -708,6 +708,7 @@ static int st21nfca_hci_complete_target_discovered(struct nfc_hci_dev *hdev,
                                                        NFC_PROTO_FELICA_MASK;
                } else {
                        kfree_skb(nfcid_skb);
+                        nfcid_skb = NULL;
                        /* P2P in type A */
                        r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_F_GATE,
                                        ST21NFCA_RF_READER_F_NFCID1,
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index fc99a40c1ec4..e0f064dcbd02 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -158,9 +158,11 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
        struct nvme_ns *ns;
        mutex_lock(&ctrl->scan_lock);
+        down_read(&ctrl->namespaces_rwsem);
        list_for_each_entry(ns, &ctrl->namespaces, list)
                if (nvme_mpath_clear_current_path(ns))
                        kblockd_schedule_work(&ns->head->requeue_work);
+        up_read(&ctrl->namespaces_rwsem);
        mutex_unlock(&ctrl->scan_lock);
 }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index f19a28b4e997..cb4c3000a57e 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -2133,8 +2133,16 @@ err_unreg_client:
 static void __exit nvme_rdma_cleanup_module(void)
 {
+        struct nvme_rdma_ctrl *ctrl;
        nvmf_unregister_transport(&nvme_rdma_transport);
        ib_unregister_client(&nvme_rdma_ib_client);
+        mutex_lock(&nvme_rdma_ctrl_mutex);
+        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
+                nvme_delete_ctrl(&ctrl->ctrl);
+        mutex_unlock(&nvme_rdma_ctrl_mutex);
+        flush_workqueue(nvme_delete_wq);
 }
 module_init(nvme_rdma_init_module);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index c6251eac8946..2c419fa5d1c1 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -147,6 +147,7 @@ struct chv_pin_context {
 * @pctldesc: Pin controller description
 * @pctldev: Pointer to the pin controller device
 * @chip: GPIO chip in this pin controller
+ * @irqchip: IRQ chip in this pin controller
 * @regs: MMIO registers
 * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
 *              offset (in GPIO number space)
@@ -162,6 +163,7 @@ struct chv_pinctrl {
        struct pinctrl_desc pctldesc;
        struct pinctrl_dev *pctldev;
        struct gpio_chip chip;
+        struct irq_chip irqchip;
        void __iomem *regs;
        unsigned intr_lines[16];
        const struct chv_community *community;
@@ -1466,16 +1468,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned int type)
        return 0;
 }
-static struct irq_chip chv_gpio_irqchip = {
-        .name = "chv-gpio",
-        .irq_startup = chv_gpio_irq_startup,
-        .irq_ack = chv_gpio_irq_ack,
-        .irq_mask = chv_gpio_irq_mask,
-        .irq_unmask = chv_gpio_irq_unmask,
-        .irq_set_type = chv_gpio_irq_type,
-        .flags = IRQCHIP_SKIP_SET_WAKE,
-};
 static void chv_gpio_irq_handler(struct irq_desc *desc)
 {
        struct gpio_chip *gc = irq_desc_get_handler_data(desc);
@@ -1559,7 +1551,7 @@ static void chv_init_irq_valid_mask(struct gpio_chip *chip,
                intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
                if (intsel >= community->nirqs)
-                        clear_bit(i, valid_mask);
+                        clear_bit(desc->number, valid_mask);
        }
 }
@@ -1625,7 +1617,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                }
        }
-        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+        pctrl->irqchip.name = "chv-gpio";
+        pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
+        pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
+        pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
+        pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
+        pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
+        pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
+        ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
                                   handle_bad_irq, IRQ_TYPE_NONE);
        if (ret) {
                dev_err(pctrl->dev, "failed to add IRQ chip\n");
@@ -1642,7 +1642,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                }
        }
-        gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
+        gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
                                     chv_gpio_irq_handler);
        return 0;
 }
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index bc013599a9a3..83981ad66a71 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -52,6 +52,7 @@
 #define PADCFG0_GPIROUTNMI              BIT(17)
 #define PADCFG0_PMODE_SHIFT             10
 #define PADCFG0_PMODE_MASK              GENMASK(13, 10)
+#define PADCFG0_PMODE_GPIO              0
 #define PADCFG0_GPIORXDIS               BIT(9)
 #define PADCFG0_GPIOTXDIS               BIT(8)
 #define PADCFG0_GPIORXSTATE             BIT(1)
@@ -332,7 +333,7 @@ static void intel_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
        cfg1 = readl(intel_get_padcfg(pctrl, pin, PADCFG1));
        mode = (cfg0 & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
-        if (!mode)
+        if (mode == PADCFG0_PMODE_GPIO)
                seq_puts(s, "GPIO ");
        else
                seq_printf(s, "mode %d ", mode);
@@ -458,6 +459,11 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
        writel(value, padcfg0);
 }
+static int intel_gpio_get_gpio_mode(void __iomem *padcfg0)
+{
+        return (readl(padcfg0) & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
+}
 static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
 {
        u32 value;
@@ -491,7 +497,20 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
        }
        padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
+        /*
+         * If pin is already configured in GPIO mode, we assume that
+         * firmware provides correct settings. In such case we avoid
+         * potential glitches on the pin. Otherwise, for the pin in
+         * alternative mode, consumer has to supply respective flags.
+         */
+        if (intel_gpio_get_gpio_mode(padcfg0) == PADCFG0_PMODE_GPIO) {
+                raw_spin_unlock_irqrestore(&pctrl->lock, flags);
+                return 0;
+        }
        intel_gpio_set_gpio_mode(padcfg0);
        /* Disable TX buffer and enable RX (this will be input) */
        __intel_gpio_set_direction(padcfg0, true);
diff --git a/drivers/pinctrl/pinctrl-stmfx.c b/drivers/pinctrl/pinctrl-stmfx.c
index 564660028fcc..ccdf0bb21414 100644
--- a/drivers/pinctrl/pinctrl-stmfx.c
+++ b/drivers/pinctrl/pinctrl-stmfx.c
@@ -585,19 +585,6 @@ static int stmfx_pinctrl_gpio_function_enable(struct stmfx_pinctrl *pctl)
        return stmfx_function_enable(pctl->stmfx, func);
 }
-static int stmfx_pinctrl_gpio_init_valid_mask(struct gpio_chip *gc,
-                                              unsigned long *valid_mask,
-                                              unsigned int ngpios)
-{
-        struct stmfx_pinctrl *pctl = gpiochip_get_data(gc);
-        u32 n;
-        for_each_clear_bit(n, &pctl->gpio_valid_mask, ngpios)
-                clear_bit(n, valid_mask);
-        return 0;
-}
 static int stmfx_pinctrl_probe(struct platform_device *pdev)
 {
        struct stmfx *stmfx = dev_get_drvdata(pdev->dev.parent);
@@ -660,7 +647,6 @@ static int stmfx_pinctrl_probe(struct platform_device *pdev)
        pctl->gpio_chip.ngpio = pctl->pctl_desc.npins;
        pctl->gpio_chip.can_sleep = true;
        pctl->gpio_chip.of_node = np;
-        pctl->gpio_chip.init_valid_mask = stmfx_pinctrl_gpio_init_valid_mask;
        ret = devm_gpiochip_add_data(pctl->dev, &pctl->gpio_chip, pctl);
        if (ret) {
diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
index 56c38cfae92c..1f829edd8ee7 100644
--- a/drivers/pwm/pwm-bcm-iproc.c
+++ b/drivers/pwm/pwm-bcm-iproc.c
@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 static const struct pwm_ops iproc_pwm_ops = {
        .apply = iproc_pwmc_apply,
        .get_state = iproc_pwmc_get_state,
+        .owner = THIS_MODULE,
 };
 static int iproc_pwmc_probe(struct platform_device *pdev)
diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index 213ff40dda11..3c9a64c1b7a8 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -76,7 +76,6 @@ static const char *rcdev_name(struct reset_controller_dev *rcdev)
 * of_reset_simple_xlate - translate reset_spec to the reset line number
 * @rcdev: a pointer to the reset controller device
 * @reset_spec: reset line specifier as found in the device tree
- * @flags: a flags pointer to fill in (optional)
 *
 * This simple translation function should be used for reset controllers
 * with 1:1 mapping, where reset lines can be indexed by number without gaps.
@@ -748,6 +747,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
        for (i = 0; i < resets->num_rstcs; i++)
                __reset_control_put_internal(resets->rstc[i]);
        mutex_unlock(&reset_list_mutex);
+        kfree(resets);
 }
 /**
@@ -825,9 +825,10 @@ int __device_reset(struct device *dev, bool optional)
 }
 EXPORT_SYMBOL_GPL(__device_reset);
-/**
+/*
 * APIs to manage an array of reset controls.
 */
 /**
 * of_reset_control_get_count - Count number of resets available with a device
 *
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 6afad68e5ba2..238240984bc1 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -76,9 +76,11 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t *vha)
         * ensures no active vp_list traversal while the vport is removed
         * from the queue)
         */
-        for (i = 0; i < 10 && atomic_read(&vha->vref_count); i++)
+        for (i = 0; i < 10; i++) {
-                wait_event_timeout(vha->vref_waitq,
+                if (wait_event_timeout(vha->vref_waitq,
-                    atomic_read(&vha->vref_count), HZ);
+                    !atomic_read(&vha->vref_count), HZ) > 0)
+                        break;
+        }
        spin_lock_irqsave(&ha->vport_slock, flags);
        if (atomic_read(&vha->vref_count)) {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 337162ac3a77..726ad4cbf4a6 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1119,9 +1119,11 @@ qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
        qla2x00_mark_all_devices_lost(vha, 0);
-        for (i = 0; i < 10; i++)
+        for (i = 0; i < 10; i++) {
-                wait_event_timeout(vha->fcport_waitQ, test_fcport_count(vha),
+                if (wait_event_timeout(vha->fcport_waitQ,
-                    HZ);
+                    test_fcport_count(vha), HZ) > 0)
+                        break;
+        }
        flush_workqueue(vha->hw->wq);
 }
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 5447738906ac..91c007d26c1e 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1883,7 +1883,8 @@ int scsi_mq_setup_tags(struct Scsi_Host *shost)
 {
        unsigned int cmd_size, sgl_size;
-        sgl_size = scsi_mq_inline_sgl_size(shost);
+        sgl_size = max_t(unsigned int, sizeof(struct scatterlist),
+                                scsi_mq_inline_sgl_size(shost));
        cmd_size = sizeof(struct scsi_cmnd) + shost->hostt->cmd_size + sgl_size;
        if (scsi_host_get_prot(shost))
                cmd_size += sizeof(struct scsi_data_buffer) +
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index de4019dc0f0b..1efc69e194f8 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -263,25 +263,16 @@ void sd_zbc_complete(struct scsi_cmnd *cmd, unsigned int good_bytes,
        int result = cmd->result;
        struct request *rq = cmd->request;
-        switch (req_op(rq)) {
+        if (req_op(rq) == REQ_OP_ZONE_RESET &&
-        case REQ_OP_ZONE_RESET:
+            result &&
-        case REQ_OP_ZONE_RESET_ALL:
+            sshdr->sense_key == ILLEGAL_REQUEST &&
+            sshdr->asc == 0x24) {
-                if (result &&
+                /*
-                    sshdr->sense_key == ILLEGAL_REQUEST &&
+                 * INVALID FIELD IN CDB error: reset of a conventional
-                    sshdr->asc == 0x24)
+                 * zone was attempted. Nothing to worry about, so be
-                        /*
+                 * quiet about the error.
-                         * INVALID FIELD IN CDB error: reset of a conventional
+                 */
-                         * zone was attempted. Nothing to worry about, so be
+                rq->rq_flags |= RQF_QUIET;
-                         * quiet about the error.
-                         */
-                        rq->rq_flags |= RQF_QUIET;
-                break;
-        case REQ_OP_WRITE:
-        case REQ_OP_WRITE_ZEROES:
-        case REQ_OP_WRITE_SAME:
-                break;
        }
 }
diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index d9231bd3c691..98b9d9a902ae 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -249,13 +249,13 @@ static struct genpd_power_state imx6_pm_domain_pu_state = {
 };
 static struct imx_pm_domain imx_gpc_domains[] = {
-        [GPC_PGC_DOMAIN_ARM] {
+        [GPC_PGC_DOMAIN_ARM] = {
                .base = {
                        .name = "ARM",
                        .flags = GENPD_FLAG_ALWAYS_ON,
                },
        },
-        [GPC_PGC_DOMAIN_PU] {
+        [GPC_PGC_DOMAIN_PU] = {
                .base = {
                        .name = "PU",
                        .power_off = imx6_pm_domain_power_off,
@@ -266,7 +266,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
                .reg_offs = 0x260,
                .cntr_pdn_bit = 0,
        },
-        [GPC_PGC_DOMAIN_DISPLAY] {
+        [GPC_PGC_DOMAIN_DISPLAY] = {
                .base = {
                        .name = "DISPLAY",
                        .power_off = imx6_pm_domain_power_off,
@@ -275,7 +275,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
                .reg_offs = 0x240,
                .cntr_pdn_bit = 4,
        },
-        [GPC_PGC_DOMAIN_PCI] {
+        [GPC_PGC_DOMAIN_PCI] = {
                .base = {
                        .name = "PCI",
                        .power_off = imx6_pm_domain_power_off,
diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
index f518273cfbe3..c8c80df090d1 100644
--- a/drivers/soundwire/Kconfig
+++ b/drivers/soundwire/Kconfig
@@ -5,6 +5,7 @@
 menuconfig SOUNDWIRE
        tristate "SoundWire support"
+        depends on ACPI || OF
        help
          SoundWire is a 2-Pin interface with data and clock line ratified
          by the MIPI Alliance. SoundWire is used for transporting data
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index f1e38a293967..13c54eac0cc3 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -900,7 +900,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
        /* Create PCM DAIs */
        stream = &cdns->pcm;
-        ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, stream->num_in,
+        ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, cdns->pcm.num_in,
                               off, stream->num_ch_in, true);
        if (ret)
                return ret;
@@ -931,7 +931,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
        if (ret)
                return ret;
-        off += cdns->pdm.num_bd;
+        off += cdns->pdm.num_out;
        ret = intel_create_dai(cdns, dais, INTEL_PDI_BD, cdns->pdm.num_bd,
                               off, stream->num_ch_bd, false);
        if (ret)
diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c
index 48a63ca130d2..6473fa602f82 100644
--- a/drivers/soundwire/slave.c
+++ b/drivers/soundwire/slave.c
@@ -128,7 +128,8 @@ int sdw_of_find_slaves(struct sdw_bus *bus)
        struct device_node *node;
        for_each_child_of_node(bus->dev->of_node, node) {
-                int link_id, sdw_version, ret, len;
+                int link_id, ret, len;
+                unsigned int sdw_version;
                const char *compat = NULL;
                struct sdw_slave_id id;
                const __be32 *addr;
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 6f1fa4c849a1..927d29eb92c6 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -125,4 +125,6 @@ source "drivers/staging/exfat/Kconfig"
 source "drivers/staging/qlge/Kconfig"
+source "drivers/staging/vboxsf/Kconfig"
 endif # STAGING
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index a90f9b308c8d..f01f04199073 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -53,3 +53,4 @@ obj-$(CONFIG_UWB)		+= uwb/
 obj-$(CONFIG_USB_WUSB)          += wusbcore/
 obj-$(CONFIG_EXFAT_FS)          += exfat/
 obj-$(CONFIG_QLGE)              += qlge/
+obj-$(CONFIG_VBOXSF_FS)         += vboxsf/
diff --git a/drivers/staging/vboxsf/Kconfig b/drivers/staging/vboxsf/Kconfig
new file mode 100644
index 000000000000..b84586ae08b3
--- /dev/null
+++ b/drivers/staging/vboxsf/Kconfig
@@ -0,0 +1,10 @@
+config VBOXSF_FS
+        tristate "VirtualBox guest shared folder (vboxsf) support"
+        depends on X86 && VBOXGUEST
+        select NLS
+        help
+          VirtualBox hosts can share folders with guests, this driver
+          implements the Linux-guest side of this allowing folders exported
+          by the host to be mounted under Linux.
+          If you want to use shared folders in VirtualBox guests, answer Y or M.
diff --git a/drivers/staging/vboxsf/Makefile b/drivers/staging/vboxsf/Makefile
new file mode 100644
index 000000000000..9e4328e79623
--- /dev/null
+++ b/drivers/staging/vboxsf/Makefile
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: MIT
+obj-$(CONFIG_VBOXSF_FS) += vboxsf.o
+vboxsf-y := dir.o file.o utils.o vboxsf_wrappers.o super.o
diff --git a/drivers/staging/vboxsf/TODO b/drivers/staging/vboxsf/TODO
new file mode 100644
index 000000000000..8b9193d0d4f0
--- /dev/null
+++ b/drivers/staging/vboxsf/TODO
@@ -0,0 +1,7 @@
+TODO:
+- Find a file-system developer to review this and give their Reviewed-By
+- Address any items coming up during review
+- Move to fs/vboxfs
+Please send any patches to Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+and Hans de Goede <hdegoede@redhat.com>
diff --git a/drivers/staging/vboxsf/dir.c b/drivers/staging/vboxsf/dir.c
new file mode 100644
index 000000000000..f260b5cc1646
--- /dev/null
+++ b/drivers/staging/vboxsf/dir.c
@@ -0,0 +1,418 @@
+// SPDX-License-Identifier: MIT
+/*
+ * VirtualBox Guest Shared Folders support: Directory inode and file operations
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#include <linux/namei.h>
+#include <linux/vbox_utils.h>
+#include "vfsmod.h"
+static int vboxsf_dir_open(struct inode *inode, struct file *file)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(inode->i_sb);
+        struct shfl_createparms params = {};
+        struct vboxsf_dir_info *sf_d;
+        int err;
+        sf_d = vboxsf_dir_info_alloc();
+        if (!sf_d)
+                return -ENOMEM;
+        params.handle = SHFL_HANDLE_NIL;
+        params.create_flags = SHFL_CF_DIRECTORY | SHFL_CF_ACT_OPEN_IF_EXISTS |
+                              SHFL_CF_ACT_FAIL_IF_NEW | SHFL_CF_ACCESS_READ;
+        err = vboxsf_create_at_dentry(file_dentry(file), &params);
+        if (err)
+                goto err_free_dir_info;
+        if (params.result != SHFL_FILE_EXISTS) {
+                err = -ENOENT;
+                goto err_close;
+        }
+        err = vboxsf_dir_read_all(sbi, sf_d, params.handle);
+        if (err)
+                goto err_close;
+        vboxsf_close(sbi->root, params.handle);
+        file->private_data = sf_d;
+        return 0;
+err_close:
+        vboxsf_close(sbi->root, params.handle);
+err_free_dir_info:
+        vboxsf_dir_info_free(sf_d);
+        return err;
+}
+static int vboxsf_dir_release(struct inode *inode, struct file *file)
+{
+        if (file->private_data)
+                vboxsf_dir_info_free(file->private_data);
+        return 0;
+}
+static unsigned int vboxsf_get_d_type(u32 mode)
+{
+        unsigned int d_type;
+        switch (mode & SHFL_TYPE_MASK) {
+        case SHFL_TYPE_FIFO:
+                d_type = DT_FIFO;
+                break;
+        case SHFL_TYPE_DEV_CHAR:
+                d_type = DT_CHR;
+                break;
+        case SHFL_TYPE_DIRECTORY:
+                d_type = DT_DIR;
+                break;
+        case SHFL_TYPE_DEV_BLOCK:
+                d_type = DT_BLK;
+                break;
+        case SHFL_TYPE_FILE:
+                d_type = DT_REG;
+                break;
+        case SHFL_TYPE_SYMLINK:
+                d_type = DT_LNK;
+                break;
+        case SHFL_TYPE_SOCKET:
+                d_type = DT_SOCK;
+                break;
+        case SHFL_TYPE_WHITEOUT:
+                d_type = DT_WHT;
+                break;
+        default:
+                d_type = DT_UNKNOWN;
+                break;
+        }
+        return d_type;
+}
+static bool vboxsf_dir_emit(struct file *dir, struct dir_context *ctx)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(file_inode(dir)->i_sb);
+        struct vboxsf_dir_info *sf_d = dir->private_data;
+        struct shfl_dirinfo *info;
+        struct vboxsf_dir_buf *b;
+        unsigned int d_type;
+        loff_t i, cur = 0;
+        ino_t fake_ino;
+        size_t size;
+        int err;
+        list_for_each_entry(b, &sf_d->info_list, head) {
+try_next_entry:
+                if (ctx->pos >= cur + b->entries) {
+                        cur += b->entries;
+                        continue;
+                }
+                /*
+                 * Note the vboxsf_dir_info objects we are iterating over here
+                 * are variable sized, so the info pointer may end up being
+                 * unaligned. This is how we get the data from the host.
+                 * Since vboxsf is only supported on x86 machines this is not
+                 * a problem.
+                 */
+                for (i = 0, info = b->buf; i < ctx->pos - cur; i++) {
+                        size = offsetof(struct shfl_dirinfo, name.string) +
+                               info->name.size;
+                        info = (struct shfl_dirinfo *)((uintptr_t)info + size);
+                }
+                /* Info now points to the right entry, emit it. */
+                d_type = vboxsf_get_d_type(info->info.attr.mode);
+                /*
+                 * On 32 bit systems pos is 64 signed, while ino is 32 bit
+                 * unsigned so fake_ino may overflow, check for this.
+                 */
+                if ((ino_t)(ctx->pos + 1) != (u64)(ctx->pos + 1)) {
+                        vbg_err("vboxsf: fake ino overflow, truncating dir\n");
+                        return false;
+                }
+                fake_ino = ctx->pos + 1;
+                if (sbi->nls) {
+                        char d_name[NAME_MAX];
+                        err = vboxsf_nlscpy(sbi, d_name, NAME_MAX,
+                                            info->name.string.utf8,
+                                            info->name.length);
+                        if (err) {
+                                /* skip erroneous entry and proceed */
+                                ctx->pos += 1;
+                                goto try_next_entry;
+                        }
+                        return dir_emit(ctx, d_name, strlen(d_name),
+                                        fake_ino, d_type);
+                }
+                return dir_emit(ctx, info->name.string.utf8, info->name.length,
+                                fake_ino, d_type);
+        }
+        return false;
+}
+static int vboxsf_dir_iterate(struct file *dir, struct dir_context *ctx)
+{
+        bool keep_iterating;
+        for (keep_iterating = true; keep_iterating; ctx->pos += 1)
+                keep_iterating = vboxsf_dir_emit(dir, ctx);
+        return 0;
+}
+const struct file_operations vboxsf_dir_fops = {
+        .open = vboxsf_dir_open,
+        .iterate = vboxsf_dir_iterate,
+        .release = vboxsf_dir_release,
+        .read = generic_read_dir,
+        .llseek = generic_file_llseek,
+};
+/*
+ * This is called during name resolution/lookup to check if the @dentry in
+ * the cache is still valid. the job is handled by vboxsf_inode_revalidate.
+ */
+static int vboxsf_dentry_revalidate(struct dentry *dentry, unsigned int flags)
+{
+        if (flags & LOOKUP_RCU)
+                return -ECHILD;
+        if (d_really_is_positive(dentry))
+                return vboxsf_inode_revalidate(dentry) == 0;
+        else
+                return vboxsf_stat_dentry(dentry, NULL) == -ENOENT;
+}
+const struct dentry_operations vboxsf_dentry_ops = {
+        .d_revalidate = vboxsf_dentry_revalidate
+};
+/* iops */
+static struct dentry *vboxsf_dir_lookup(struct inode *parent,
+                                        struct dentry *dentry,
+                                        unsigned int flags)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+        struct shfl_fsobjinfo fsinfo;
+        struct inode *inode;
+        int err;
+        dentry->d_time = jiffies;
+        err = vboxsf_stat_dentry(dentry, &fsinfo);
+        if (err) {
+                inode = (err == -ENOENT) ? NULL : ERR_PTR(err);
+        } else {
+                inode = vboxsf_new_inode(parent->i_sb);
+                if (!IS_ERR(inode))
+                        vboxsf_init_inode(sbi, inode, &fsinfo);
+        }
+        return d_splice_alias(inode, dentry);
+}
+static int vboxsf_dir_instantiate(struct inode *parent, struct dentry *dentry,
+                                  struct shfl_fsobjinfo *info)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+        struct vboxsf_inode *sf_i;
+        struct inode *inode;
+        inode = vboxsf_new_inode(parent->i_sb);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+        sf_i = VBOXSF_I(inode);
+        /* The host may have given us different attr then requested */
+        sf_i->force_restat = 1;
+        vboxsf_init_inode(sbi, inode, info);
+        d_instantiate(dentry, inode);
+        return 0;
+}
+static int vboxsf_dir_create(struct inode *parent, struct dentry *dentry,
+                             umode_t mode, int is_dir)
+{
+        struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent);
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+        struct shfl_createparms params = {};
+        int err;
+        params.handle = SHFL_HANDLE_NIL;
+        params.create_flags = SHFL_CF_ACT_CREATE_IF_NEW |
+                              SHFL_CF_ACT_FAIL_IF_EXISTS |
+                              SHFL_CF_ACCESS_READWRITE |
+                              (is_dir ? SHFL_CF_DIRECTORY : 0);
+        params.info.attr.mode = (mode & 0777) |
+                                (is_dir ? SHFL_TYPE_DIRECTORY : SHFL_TYPE_FILE);
+        params.info.attr.additional = SHFLFSOBJATTRADD_NOTHING;
+        err = vboxsf_create_at_dentry(dentry, &params);
+        if (err)
+                return err;
+        if (params.result != SHFL_FILE_CREATED)
+                return -EPERM;
+        vboxsf_close(sbi->root, params.handle);
+        err = vboxsf_dir_instantiate(parent, dentry, &params.info);
+        if (err)
+                return err;
+        /* parent directory access/change time changed */
+        sf_parent_i->force_restat = 1;
+        return 0;
+}
+static int vboxsf_dir_mkfile(struct inode *parent, struct dentry *dentry,
+                             umode_t mode, bool excl)
+{
+        return vboxsf_dir_create(parent, dentry, mode, 0);
+}
+static int vboxsf_dir_mkdir(struct inode *parent, struct dentry *dentry,
+                            umode_t mode)
+{
+        return vboxsf_dir_create(parent, dentry, mode, 1);
+}
+static int vboxsf_dir_unlink(struct inode *parent, struct dentry *dentry)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+        struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent);
+        struct inode *inode = d_inode(dentry);
+        struct shfl_string *path;
+        u32 flags;
+        int err;
+        if (S_ISDIR(inode->i_mode))
+                flags = SHFL_REMOVE_DIR;
+        else
+                flags = SHFL_REMOVE_FILE;
+        if (S_ISLNK(inode->i_mode))
+                flags |= SHFL_REMOVE_SYMLINK;
+        path = vboxsf_path_from_dentry(sbi, dentry);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        err = vboxsf_remove(sbi->root, path, flags);
+        __putname(path);
+        if (err)
+                return err;
+        /* parent directory access/change time changed */
+        sf_parent_i->force_restat = 1;
+        return 0;
+}
+static int vboxsf_dir_rename(struct inode *old_parent,
+                             struct dentry *old_dentry,
+                             struct inode *new_parent,
+                             struct dentry *new_dentry,
+                             unsigned int flags)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(old_parent->i_sb);
+        struct vboxsf_inode *sf_old_parent_i = VBOXSF_I(old_parent);
+        struct vboxsf_inode *sf_new_parent_i = VBOXSF_I(new_parent);
+        u32 shfl_flags = SHFL_RENAME_FILE | SHFL_RENAME_REPLACE_IF_EXISTS;
+        struct shfl_string *old_path, *new_path;
+        int err;
+        if (flags)
+                return -EINVAL;
+        old_path = vboxsf_path_from_dentry(sbi, old_dentry);
+        if (IS_ERR(old_path))
+                return PTR_ERR(old_path);
+        new_path = vboxsf_path_from_dentry(sbi, new_dentry);
+        if (IS_ERR(new_path)) {
+                err = PTR_ERR(new_path);
+                goto err_put_old_path;
+        }
+        if (d_inode(old_dentry)->i_mode & S_IFDIR)
+                shfl_flags = 0;
+        err = vboxsf_rename(sbi->root, old_path, new_path, shfl_flags);
+        if (err == 0) {
+                /* parent directories access/change time changed */
+                sf_new_parent_i->force_restat = 1;
+                sf_old_parent_i->force_restat = 1;
+        }
+        __putname(new_path);
+err_put_old_path:
+        __putname(old_path);
+        return err;
+}
+static int vboxsf_dir_symlink(struct inode *parent, struct dentry *dentry,
+                              const char *symname)
+{
+        struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent);
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+        int symname_size = strlen(symname) + 1;
+        struct shfl_string *path, *ssymname;
+        struct shfl_fsobjinfo info;
+        int err;
+        path = vboxsf_path_from_dentry(sbi, dentry);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        ssymname = kmalloc(SHFLSTRING_HEADER_SIZE + symname_size, GFP_KERNEL);
+        if (!ssymname) {
+                __putname(path);
+                return -ENOMEM;
+        }
+        ssymname->length = symname_size - 1;
+        ssymname->size = symname_size;
+        memcpy(ssymname->string.utf8, symname, symname_size);
+        err = vboxsf_symlink(sbi->root, path, ssymname, &info);
+        kfree(ssymname);
+        __putname(path);
+        if (err) {
+                /* -EROFS means symlinks are note support -> -EPERM */
+                return (err == -EROFS) ? -EPERM : err;
+        }
+        err = vboxsf_dir_instantiate(parent, dentry, &info);
+        if (err)
+                return err;
+        /* parent directory access/change time changed */
+        sf_parent_i->force_restat = 1;
+        return 0;
+}
+const struct inode_operations vboxsf_dir_iops = {
+        .lookup  = vboxsf_dir_lookup,
+        .create  = vboxsf_dir_mkfile,
+        .mkdir   = vboxsf_dir_mkdir,
+        .rmdir   = vboxsf_dir_unlink,
+        .unlink  = vboxsf_dir_unlink,
+        .rename  = vboxsf_dir_rename,
+        .symlink = vboxsf_dir_symlink,
+        .getattr = vboxsf_getattr,
+        .setattr = vboxsf_setattr,
+};
diff --git a/drivers/staging/vboxsf/file.c b/drivers/staging/vboxsf/file.c
new file mode 100644
index 000000000000..4b61ccf83fca
--- /dev/null
+++ b/drivers/staging/vboxsf/file.c
@@ -0,0 +1,370 @@
+// SPDX-License-Identifier: MIT
+/*
+ * VirtualBox Guest Shared Folders support: Regular file inode and file ops.
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#include <linux/mm.h>
+#include <linux/page-flags.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <linux/sizes.h>
+#include "vfsmod.h"
+struct vboxsf_handle {
+        u64 handle;
+        u32 root;
+        u32 access_flags;
+        struct kref refcount;
+        struct list_head head;
+};
+static int vboxsf_file_open(struct inode *inode, struct file *file)
+{
+        struct vboxsf_inode *sf_i = VBOXSF_I(inode);
+        struct shfl_createparms params = {};
+        struct vboxsf_handle *sf_handle;
+        u32 access_flags = 0;
+        int err;
+        sf_handle = kmalloc(sizeof(*sf_handle), GFP_KERNEL);
+        if (!sf_handle)
+                return -ENOMEM;
+        /*
+         * We check the value of params.handle afterwards to find out if
+         * the call succeeded or failed, as the API does not seem to cleanly
+         * distinguish error and informational messages.
+         *
+         * Furthermore, we must set params.handle to SHFL_HANDLE_NIL to
+         * make the shared folders host service use our mode parameter.
+         */
+        params.handle = SHFL_HANDLE_NIL;
+        if (file->f_flags & O_CREAT) {
+                params.create_flags |= SHFL_CF_ACT_CREATE_IF_NEW;
+                /*
+                 * We ignore O_EXCL, as the Linux kernel seems to call create
+                 * beforehand itself, so O_EXCL should always fail.
+                 */
+                if (file->f_flags & O_TRUNC)
+                        params.create_flags |= SHFL_CF_ACT_OVERWRITE_IF_EXISTS;
+                else
+                        params.create_flags |= SHFL_CF_ACT_OPEN_IF_EXISTS;
+        } else {
+                params.create_flags |= SHFL_CF_ACT_FAIL_IF_NEW;
+                if (file->f_flags & O_TRUNC)
+                        params.create_flags |= SHFL_CF_ACT_OVERWRITE_IF_EXISTS;
+        }
+        switch (file->f_flags & O_ACCMODE) {
+        case O_RDONLY:
+                access_flags |= SHFL_CF_ACCESS_READ;
+                break;
+        case O_WRONLY:
+                access_flags |= SHFL_CF_ACCESS_WRITE;
+                break;
+        case O_RDWR:
+                access_flags |= SHFL_CF_ACCESS_READWRITE;
+                break;
+        default:
+                WARN_ON(1);
+        }
+        if (file->f_flags & O_APPEND)
+                access_flags |= SHFL_CF_ACCESS_APPEND;
+        params.create_flags |= access_flags;
+        params.info.attr.mode = inode->i_mode;
+        err = vboxsf_create_at_dentry(file_dentry(file), &params);
+        if (err == 0 && params.handle == SHFL_HANDLE_NIL)
+                err = (params.result == SHFL_FILE_EXISTS) ? -EEXIST : -ENOENT;
+        if (err) {
+                kfree(sf_handle);
+                return err;
+        }
+        /* the host may have given us different attr then requested */
+        sf_i->force_restat = 1;
+        /* init our handle struct and add it to the inode's handles list */
+        sf_handle->handle = params.handle;
+        sf_handle->root = VBOXSF_SBI(inode->i_sb)->root;
+        sf_handle->access_flags = access_flags;
+        kref_init(&sf_handle->refcount);
+        mutex_lock(&sf_i->handle_list_mutex);
+        list_add(&sf_handle->head, &sf_i->handle_list);
+        mutex_unlock(&sf_i->handle_list_mutex);
+        file->private_data = sf_handle;
+        return 0;
+}
+static void vboxsf_handle_release(struct kref *refcount)
+{
+        struct vboxsf_handle *sf_handle =
+                container_of(refcount, struct vboxsf_handle, refcount);
+        vboxsf_close(sf_handle->root, sf_handle->handle);
+        kfree(sf_handle);
+}
+static int vboxsf_file_release(struct inode *inode, struct file *file)
+{
+        struct vboxsf_inode *sf_i = VBOXSF_I(inode);
+        struct vboxsf_handle *sf_handle = file->private_data;
+        /*
+         * When a file is closed on our (the guest) side, we want any subsequent
+         * accesses done on the host side to see all changes done from our side.
+         */
+        filemap_write_and_wait(inode->i_mapping);
+        mutex_lock(&sf_i->handle_list_mutex);
+        list_del(&sf_handle->head);
+        mutex_unlock(&sf_i->handle_list_mutex);
+        kref_put(&sf_handle->refcount, vboxsf_handle_release);
+        return 0;
+}
+/*
+ * Write back dirty pages now, because there may not be any suitable
+ * open files later
+ */
+static void vboxsf_vma_close(struct vm_area_struct *vma)
+{
+        filemap_write_and_wait(vma->vm_file->f_mapping);
+}
+static const struct vm_operations_struct vboxsf_file_vm_ops = {
+        .close          = vboxsf_vma_close,
+        .fault          = filemap_fault,
+        .map_pages      = filemap_map_pages,
+};
+static int vboxsf_file_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        int err;
+        err = generic_file_mmap(file, vma);
+        if (!err)
+                vma->vm_ops = &vboxsf_file_vm_ops;
+        return err;
+}
+/*
+ * Note that since we are accessing files on the host's filesystem, files
+ * may always be changed underneath us by the host!
+ *
+ * The vboxsf API between the guest and the host does not offer any functions
+ * to deal with this. There is no inode-generation to check for changes, no
+ * events / callback on changes and no way to lock files.
+ *
+ * To avoid returning stale data when a file gets *opened* on our (the guest)
+ * side, we do a "stat" on the host side, then compare the mtime with the
+ * last known mtime and invalidate the page-cache if they differ.
+ * This is done from vboxsf_inode_revalidate().
+ *
+ * When reads are done through the read_iter fop, it is possible to do
+ * further cache revalidation then, there are 3 options to deal with this:
+ *
+ * 1)  Rely solely on the revalidation done at open time
+ * 2)  Do another "stat" and compare mtime again. Unfortunately the vboxsf
+ *     host API does not allow stat on handles, so we would need to use
+ *     file->f_path.dentry and the stat will then fail if the file was unlinked
+ *     or renamed (and there is no thing like NFS' silly-rename). So we get:
+ * 2a) "stat" and compare mtime, on stat failure invalidate the cache
+ * 2b) "stat" and compare mtime, on stat failure do nothing
+ * 3)  Simply always call invalidate_inode_pages2_range on the range of the read
+ *
+ * Currently we are keeping things KISS and using option 1. this allows
+ * directly using generic_file_read_iter without wrapping it.
+ *
+ * This means that only data written on the host side before open() on
+ * the guest side is guaranteed to be seen by the guest. If necessary
+ * we may provide other read-cache strategies in the future and make this
+ * configurable through a mount option.
+ */
+const struct file_operations vboxsf_reg_fops = {
+        .llseek = generic_file_llseek,
+        .read_iter = generic_file_read_iter,
+        .write_iter = generic_file_write_iter,
+        .mmap = vboxsf_file_mmap,
+        .open = vboxsf_file_open,
+        .release = vboxsf_file_release,
+        .fsync = noop_fsync,
+        .splice_read = generic_file_splice_read,
+};
+const struct inode_operations vboxsf_reg_iops = {
+        .getattr = vboxsf_getattr,
+        .setattr = vboxsf_setattr
+};
+static int vboxsf_readpage(struct file *file, struct page *page)
+{
+        struct vboxsf_handle *sf_handle = file->private_data;
+        loff_t off = page_offset(page);
+        u32 nread = PAGE_SIZE;
+        u8 *buf;
+        int err;
+        buf = kmap(page);
+        err = vboxsf_read(sf_handle->root, sf_handle->handle, off, &nread, buf);
+        if (err == 0) {
+                memset(&buf[nread], 0, PAGE_SIZE - nread);
+                flush_dcache_page(page);
+                SetPageUptodate(page);
+        } else {
+                SetPageError(page);
+        }
+        kunmap(page);
+        unlock_page(page);
+        return err;
+}
+static struct vboxsf_handle *vboxsf_get_write_handle(struct vboxsf_inode *sf_i)
+{
+        struct vboxsf_handle *h, *sf_handle = NULL;
+        mutex_lock(&sf_i->handle_list_mutex);
+        list_for_each_entry(h, &sf_i->handle_list, head) {
+                if (h->access_flags == SHFL_CF_ACCESS_WRITE ||
+                    h->access_flags == SHFL_CF_ACCESS_READWRITE) {
+                        kref_get(&h->refcount);
+                        sf_handle = h;
+                        break;
+                }
+        }
+        mutex_unlock(&sf_i->handle_list_mutex);
+        return sf_handle;
+}
+static int vboxsf_writepage(struct page *page, struct writeback_control *wbc)
+{
+        struct inode *inode = page->mapping->host;
+        struct vboxsf_inode *sf_i = VBOXSF_I(inode);
+        struct vboxsf_handle *sf_handle;
+        loff_t off = page_offset(page);
+        loff_t size = i_size_read(inode);
+        u32 nwrite = PAGE_SIZE;
+        u8 *buf;
+        int err;
+        if (off + PAGE_SIZE > size)
+                nwrite = size & ~PAGE_MASK;
+        sf_handle = vboxsf_get_write_handle(sf_i);
+        if (!sf_handle)
+                return -EBADF;
+        buf = kmap(page);
+        err = vboxsf_write(sf_handle->root, sf_handle->handle,
+                           off, &nwrite, buf);
+        kunmap(page);
+        kref_put(&sf_handle->refcount, vboxsf_handle_release);
+        if (err == 0) {
+                ClearPageError(page);
+                /* mtime changed */
+                sf_i->force_restat = 1;
+        } else {
+                ClearPageUptodate(page);
+        }
+        unlock_page(page);
+        return err;
+}
+static int vboxsf_write_end(struct file *file, struct address_space *mapping,
+                            loff_t pos, unsigned int len, unsigned int copied,
+                            struct page *page, void *fsdata)
+{
+        struct inode *inode = mapping->host;
+        struct vboxsf_handle *sf_handle = file->private_data;
+        unsigned int from = pos & ~PAGE_MASK;
+        u32 nwritten = len;
+        u8 *buf;
+        int err;
+        buf = kmap(page);
+        err = vboxsf_write(sf_handle->root, sf_handle->handle,
+                           pos, &nwritten, buf + from);
+        kunmap(page);
+        if (err) {
+                nwritten = 0;
+                goto out;
+        }
+        /* mtime changed */
+        VBOXSF_I(inode)->force_restat = 1;
+        if (!PageUptodate(page) && nwritten == PAGE_SIZE)
+                SetPageUptodate(page);
+        pos += nwritten;
+        if (pos > inode->i_size)
+                i_size_write(inode, pos);
+out:
+        unlock_page(page);
+        put_page(page);
+        return nwritten;
+}
+const struct address_space_operations vboxsf_reg_aops = {
+        .readpage = vboxsf_readpage,
+        .writepage = vboxsf_writepage,
+        .set_page_dirty = __set_page_dirty_nobuffers,
+        .write_begin = simple_write_begin,
+        .write_end = vboxsf_write_end,
+};
+static const char *vboxsf_get_link(struct dentry *dentry, struct inode *inode,
+                                   struct delayed_call *done)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(inode->i_sb);
+        struct shfl_string *path;
+        char *link;
+        int err;
+        if (!dentry)
+                return ERR_PTR(-ECHILD);
+        path = vboxsf_path_from_dentry(sbi, dentry);
+        if (IS_ERR(path))
+                return (char *)path;
+        link = kzalloc(PATH_MAX, GFP_KERNEL);
+        if (!link) {
+                __putname(path);
+                return ERR_PTR(-ENOMEM);
+        }
+        err = vboxsf_readlink(sbi->root, path, PATH_MAX, link);
+        __putname(path);
+        if (err) {
+                kfree(link);
+                return ERR_PTR(err);
+        }
+        set_delayed_call(done, kfree_link, link);
+        return link;
+}
+const struct inode_operations vboxsf_lnk_iops = {
+        .get_link = vboxsf_get_link
+};
diff --git a/drivers/staging/vboxsf/shfl_hostintf.h b/drivers/staging/vboxsf/shfl_hostintf.h
new file mode 100644
index 000000000000..aca829062c12
--- /dev/null
+++ b/drivers/staging/vboxsf/shfl_hostintf.h
@@ -0,0 +1,901 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * VirtualBox Shared Folders: host interface definition.
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#ifndef SHFL_HOSTINTF_H
+#define SHFL_HOSTINTF_H
+#include <linux/vbox_vmmdev_types.h>
+/* The max in/out buffer size for a FN_READ or FN_WRITE call */
+#define SHFL_MAX_RW_COUNT           (16 * SZ_1M)
+/*
+ * Structures shared between guest and the service
+ * can be relocated and use offsets to point to variable
+ * length parts.
+ *
+ * Shared folders protocol works with handles.
+ * Before doing any action on a file system object,
+ * one have to obtain the object handle via a SHFL_FN_CREATE
+ * request. A handle must be closed with SHFL_FN_CLOSE.
+ */
+enum {
+        SHFL_FN_QUERY_MAPPINGS = 1,     /* Query mappings changes. */
+        SHFL_FN_QUERY_MAP_NAME = 2,     /* Query map name. */
+        SHFL_FN_CREATE = 3,             /* Open/create object. */
+        SHFL_FN_CLOSE = 4,              /* Close object handle. */
+        SHFL_FN_READ = 5,               /* Read object content. */
+        SHFL_FN_WRITE = 6,              /* Write new object content. */
+        SHFL_FN_LOCK = 7,               /* Lock/unlock a range in the object. */
+        SHFL_FN_LIST = 8,               /* List object content. */
+        SHFL_FN_INFORMATION = 9,        /* Query/set object information. */
+        /* Note function number 10 is not used! */
+        SHFL_FN_REMOVE = 11,            /* Remove object */
+        SHFL_FN_MAP_FOLDER_OLD = 12,    /* Map folder (legacy) */
+        SHFL_FN_UNMAP_FOLDER = 13,      /* Unmap folder */
+        SHFL_FN_RENAME = 14,            /* Rename object */
+        SHFL_FN_FLUSH = 15,             /* Flush file */
+        SHFL_FN_SET_UTF8 = 16,          /* Select UTF8 filename encoding */
+        SHFL_FN_MAP_FOLDER = 17,        /* Map folder */
+        SHFL_FN_READLINK = 18,          /* Read symlink dest (as of VBox 4.0) */
+        SHFL_FN_SYMLINK = 19,           /* Create symlink (as of VBox 4.0) */
+        SHFL_FN_SET_SYMLINKS = 20,      /* Ask host to show symlinks (4.0+) */
+};
+/* Root handles for a mapping are of type u32, Root handles are unique. */
+#define SHFL_ROOT_NIL           UINT_MAX
+/* Shared folders handle for an opened object are of type u64. */
+#define SHFL_HANDLE_NIL         ULLONG_MAX
+/* Hardcoded maximum length (in chars) of a shared folder name. */
+#define SHFL_MAX_LEN         (256)
+/* Hardcoded maximum number of shared folder mapping available to the guest. */
+#define SHFL_MAX_MAPPINGS    (64)
+/** Shared folder string buffer structure. */
+struct shfl_string {
+        /** Allocated size of the string member in bytes. */
+        u16 size;
+        /** Length of string without trailing nul in bytes. */
+        u16 length;
+        /** UTF-8 or UTF-16 string. Nul terminated. */
+        union {
+                u8 utf8[2];
+                u16 utf16[1];
+                u16 ucs2[1]; /* misnomer, use utf16. */
+        } string;
+};
+VMMDEV_ASSERT_SIZE(shfl_string, 6);
+/* The size of shfl_string w/o the string part. */
+#define SHFLSTRING_HEADER_SIZE  4
+/* Calculate size of the string. */
+static inline u32 shfl_string_buf_size(const struct shfl_string *string)
+{
+        return string ? SHFLSTRING_HEADER_SIZE + string->size : 0;
+}
+/* Set user id on execution (S_ISUID). */
+#define SHFL_UNIX_ISUID             0004000U
+/* Set group id on execution (S_ISGID). */
+#define SHFL_UNIX_ISGID             0002000U
+/* Sticky bit (S_ISVTX / S_ISTXT). */
+#define SHFL_UNIX_ISTXT             0001000U
+/* Owner readable (S_IRUSR). */
+#define SHFL_UNIX_IRUSR             0000400U
+/* Owner writable (S_IWUSR). */
+#define SHFL_UNIX_IWUSR             0000200U
+/* Owner executable (S_IXUSR). */
+#define SHFL_UNIX_IXUSR             0000100U
+/* Group readable (S_IRGRP). */
+#define SHFL_UNIX_IRGRP             0000040U
+/* Group writable (S_IWGRP). */
+#define SHFL_UNIX_IWGRP             0000020U
+/* Group executable (S_IXGRP). */
+#define SHFL_UNIX_IXGRP             0000010U
+/* Other readable (S_IROTH). */
+#define SHFL_UNIX_IROTH             0000004U
+/* Other writable (S_IWOTH). */
+#define SHFL_UNIX_IWOTH             0000002U
+/* Other executable (S_IXOTH). */
+#define SHFL_UNIX_IXOTH             0000001U
+/* Named pipe (fifo) (S_IFIFO). */
+#define SHFL_TYPE_FIFO              0010000U
+/* Character device (S_IFCHR). */
+#define SHFL_TYPE_DEV_CHAR          0020000U
+/* Directory (S_IFDIR). */
+#define SHFL_TYPE_DIRECTORY         0040000U
+/* Block device (S_IFBLK). */
+#define SHFL_TYPE_DEV_BLOCK         0060000U
+/* Regular file (S_IFREG). */
+#define SHFL_TYPE_FILE              0100000U
+/* Symbolic link (S_IFLNK). */
+#define SHFL_TYPE_SYMLINK           0120000U
+/* Socket (S_IFSOCK). */
+#define SHFL_TYPE_SOCKET            0140000U
+/* Whiteout (S_IFWHT). */
+#define SHFL_TYPE_WHITEOUT          0160000U
+/* Type mask (S_IFMT). */
+#define SHFL_TYPE_MASK              0170000U
+/* Checks the mode flags indicate a directory (S_ISDIR). */
+#define SHFL_IS_DIRECTORY(m)   (((m) & SHFL_TYPE_MASK) == SHFL_TYPE_DIRECTORY)
+/* Checks the mode flags indicate a symbolic link (S_ISLNK). */
+#define SHFL_IS_SYMLINK(m)     (((m) & SHFL_TYPE_MASK) == SHFL_TYPE_SYMLINK)
+/** The available additional information in a shfl_fsobjattr object. */
+enum shfl_fsobjattr_add {
+        /** No additional information is available / requested. */
+        SHFLFSOBJATTRADD_NOTHING = 1,
+        /**
+         * The additional unix attributes (shfl_fsobjattr::u::unix_attr) are
+         *  available / requested.
+         */
+        SHFLFSOBJATTRADD_UNIX,
+        /**
+         * The additional extended attribute size (shfl_fsobjattr::u::size) is
+         *  available / requested.
+         */
+        SHFLFSOBJATTRADD_EASIZE,
+        /**
+         * The last valid item (inclusive).
+         * The valid range is SHFLFSOBJATTRADD_NOTHING thru
+         * SHFLFSOBJATTRADD_LAST.
+         */
+        SHFLFSOBJATTRADD_LAST = SHFLFSOBJATTRADD_EASIZE,
+        /** The usual 32-bit hack. */
+        SHFLFSOBJATTRADD_32BIT_SIZE_HACK = 0x7fffffff
+};
+/**
+ * Additional unix Attributes, these are available when
+ * shfl_fsobjattr.additional == SHFLFSOBJATTRADD_UNIX.
+ */
+struct shfl_fsobjattr_unix {
+        /**
+         * The user owning the filesystem object (st_uid).
+         * This field is ~0U if not supported.
+         */
+        u32 uid;
+        /**
+         * The group the filesystem object is assigned (st_gid).
+         * This field is ~0U if not supported.
+         */
+        u32 gid;
+        /**
+         * Number of hard links to this filesystem object (st_nlink).
+         * This field is 1 if the filesystem doesn't support hardlinking or
+         * the information isn't available.
+         */
+        u32 hardlinks;
+        /**
+         * The device number of the device which this filesystem object resides
+         * on (st_dev). This field is 0 if this information is not available.
+         */
+        u32 inode_id_device;
+        /**
+         * The unique identifier (within the filesystem) of this filesystem
+         * object (st_ino). Together with inode_id_device, this field can be
+         * used as a OS wide unique id, when both their values are not 0.
+         * This field is 0 if the information is not available.
+         */
+        u64 inode_id;
+        /**
+         * User flags (st_flags).
+         * This field is 0 if this information is not available.
+         */
+        u32 flags;
+        /**
+         * The current generation number (st_gen).
+         * This field is 0 if this information is not available.
+         */
+        u32 generation_id;
+        /**
+         * The device number of a char. or block device type object (st_rdev).
+         * This field is 0 if the file isn't a char. or block device or when
+         * the OS doesn't use the major+minor device idenfication scheme.
+         */
+        u32 device;
+} __packed;
+/** Extended attribute size. */
+struct shfl_fsobjattr_easize {
+        /** Size of EAs. */
+        s64 cb;
+} __packed;
+/** Shared folder filesystem object attributes. */
+struct shfl_fsobjattr {
+        /** Mode flags (st_mode). SHFL_UNIX_*, SHFL_TYPE_*, and SHFL_DOS_*. */
+        u32 mode;
+        /** The additional attributes available. */
+        enum shfl_fsobjattr_add additional;
+        /**
+         * Additional attributes.
+         *
+         * Unless explicitly specified to an API, the API can provide additional
+         * data as it is provided by the underlying OS.
+         */
+        union {
+                struct shfl_fsobjattr_unix unix_attr;
+                struct shfl_fsobjattr_easize size;
+        } __packed u;
+} __packed;
+VMMDEV_ASSERT_SIZE(shfl_fsobjattr, 44);
+struct shfl_timespec {
+        s64 ns_relative_to_unix_epoch;
+};
+/** Filesystem object information structure. */
+struct shfl_fsobjinfo {
+        /**
+         * Logical size (st_size).
+         * For normal files this is the size of the file.
+         * For symbolic links, this is the length of the path name contained
+         * in the symbolic link.
+         * For other objects this fields needs to be specified.
+         */
+        s64 size;
+        /** Disk allocation size (st_blocks * DEV_BSIZE). */
+        s64 allocated;
+        /** Time of last access (st_atime). */
+        struct shfl_timespec access_time;
+        /** Time of last data modification (st_mtime). */
+        struct shfl_timespec modification_time;
+        /**
+         * Time of last status change (st_ctime).
+         * If not available this is set to modification_time.
+         */
+        struct shfl_timespec change_time;
+        /**
+         * Time of file birth (st_birthtime).
+         * If not available this is set to change_time.
+         */
+        struct shfl_timespec birth_time;
+        /** Attributes. */
+        struct shfl_fsobjattr attr;
+} __packed;
+VMMDEV_ASSERT_SIZE(shfl_fsobjinfo, 92);
+/**
+ * result of an open/create request.
+ * Along with handle value the result code
+ * identifies what has happened while
+ * trying to open the object.
+ */
+enum shfl_create_result {
+        SHFL_NO_RESULT,
+        /** Specified path does not exist. */
+        SHFL_PATH_NOT_FOUND,
+        /** Path to file exists, but the last component does not. */
+        SHFL_FILE_NOT_FOUND,
+        /** File already exists and either has been opened or not. */
+        SHFL_FILE_EXISTS,
+        /** New file was created. */
+        SHFL_FILE_CREATED,
+        /** Existing file was replaced or overwritten. */
+        SHFL_FILE_REPLACED
+};
+/* No flags. Initialization value. */
+#define SHFL_CF_NONE                  (0x00000000)
+/*
+ * Only lookup the object, do not return a handle. When this is set all other
+ * flags are ignored.
+ */
+#define SHFL_CF_LOOKUP                (0x00000001)
+/*
+ * Open parent directory of specified object.
+ * Useful for the corresponding Windows FSD flag
+ * and for opening paths like \\dir\\*.* to search the 'dir'.
+ */
+#define SHFL_CF_OPEN_TARGET_DIRECTORY (0x00000002)
+/* Create/open a directory. */
+#define SHFL_CF_DIRECTORY             (0x00000004)
+/*
+ *  Open/create action to do if object exists
+ *  and if the object does not exists.
+ *  REPLACE file means atomically DELETE and CREATE.
+ *  OVERWRITE file means truncating the file to 0 and
+ *  setting new size.
+ *  When opening an existing directory REPLACE and OVERWRITE
+ *  actions are considered invalid, and cause returning
+ *  FILE_EXISTS with NIL handle.
+ */
+#define SHFL_CF_ACT_MASK_IF_EXISTS      (0x000000f0)
+#define SHFL_CF_ACT_MASK_IF_NEW         (0x00000f00)
+/* What to do if object exists. */
+#define SHFL_CF_ACT_OPEN_IF_EXISTS      (0x00000000)
+#define SHFL_CF_ACT_FAIL_IF_EXISTS      (0x00000010)
+#define SHFL_CF_ACT_REPLACE_IF_EXISTS   (0x00000020)
+#define SHFL_CF_ACT_OVERWRITE_IF_EXISTS (0x00000030)
+/* What to do if object does not exist. */
+#define SHFL_CF_ACT_CREATE_IF_NEW       (0x00000000)
+#define SHFL_CF_ACT_FAIL_IF_NEW         (0x00000100)
+/* Read/write requested access for the object. */
+#define SHFL_CF_ACCESS_MASK_RW          (0x00003000)
+/* No access requested. */
+#define SHFL_CF_ACCESS_NONE             (0x00000000)
+/* Read access requested. */
+#define SHFL_CF_ACCESS_READ             (0x00001000)
+/* Write access requested. */
+#define SHFL_CF_ACCESS_WRITE            (0x00002000)
+/* Read/Write access requested. */
+#define SHFL_CF_ACCESS_READWRITE        (0x00003000)
+/* Requested share access for the object. */
+#define SHFL_CF_ACCESS_MASK_DENY        (0x0000c000)
+/* Allow any access. */
+#define SHFL_CF_ACCESS_DENYNONE         (0x00000000)
+/* Do not allow read. */
+#define SHFL_CF_ACCESS_DENYREAD         (0x00004000)
+/* Do not allow write. */
+#define SHFL_CF_ACCESS_DENYWRITE        (0x00008000)
+/* Do not allow access. */
+#define SHFL_CF_ACCESS_DENYALL          (0x0000c000)
+/* Requested access to attributes of the object. */
+#define SHFL_CF_ACCESS_MASK_ATTR        (0x00030000)
+/* No access requested. */
+#define SHFL_CF_ACCESS_ATTR_NONE        (0x00000000)
+/* Read access requested. */
+#define SHFL_CF_ACCESS_ATTR_READ        (0x00010000)
+/* Write access requested. */
+#define SHFL_CF_ACCESS_ATTR_WRITE       (0x00020000)
+/* Read/Write access requested. */
+#define SHFL_CF_ACCESS_ATTR_READWRITE   (0x00030000)
+/*
+ * The file is opened in append mode.
+ * Ignored if SHFL_CF_ACCESS_WRITE is not set.
+ */
+#define SHFL_CF_ACCESS_APPEND           (0x00040000)
+/** Create parameters buffer struct for SHFL_FN_CREATE call */
+struct shfl_createparms {
+        /** Returned handle of opened object. */
+        u64 handle;
+        /** Returned result of the operation */
+        enum shfl_create_result result;
+        /** SHFL_CF_* */
+        u32 create_flags;
+        /**
+         * Attributes of object to create and
+         * returned actual attributes of opened/created object.
+         */
+        struct shfl_fsobjinfo info;
+} __packed;
+/** Shared Folder directory information */
+struct shfl_dirinfo {
+        /** Full information about the object. */
+        struct shfl_fsobjinfo info;
+        /**
+         * The length of the short field (number of UTF16 chars).
+         * It is 16-bit for reasons of alignment.
+         */
+        u16 short_name_len;
+        /**
+         * The short name for 8.3 compatibility.
+         * Empty string if not available.
+         */
+        u16 short_name[14];
+        struct shfl_string name;
+};
+/** Shared folder filesystem properties. */
+struct shfl_fsproperties {
+        /**
+         * The maximum size of a filesystem object name.
+         * This does not include the '\\0'.
+         */
+        u32 max_component_len;
+        /**
+         * True if the filesystem is remote.
+         * False if the filesystem is local.
+         */
+        bool remote;
+        /**
+         * True if the filesystem is case sensitive.
+         * False if the filesystem is case insensitive.
+         */
+        bool case_sensitive;
+        /**
+         * True if the filesystem is mounted read only.
+         * False if the filesystem is mounted read write.
+         */
+        bool read_only;
+        /**
+         * True if the filesystem can encode unicode object names.
+         * False if it can't.
+         */
+        bool supports_unicode;
+        /**
+         * True if the filesystem is compresses.
+         * False if it isn't or we don't know.
+         */
+        bool compressed;
+        /**
+         * True if the filesystem compresses of individual files.
+         * False if it doesn't or we don't know.
+         */
+        bool file_compression;
+};
+VMMDEV_ASSERT_SIZE(shfl_fsproperties, 12);
+struct shfl_volinfo {
+        s64 total_allocation_bytes;
+        s64 available_allocation_bytes;
+        u32 bytes_per_allocation_unit;
+        u32 bytes_per_sector;
+        u32 serial;
+        struct shfl_fsproperties properties;
+};
+/** SHFL_FN_MAP_FOLDER Parameters structure. */
+struct shfl_map_folder {
+        /**
+         * pointer, in:
+         * Points to struct shfl_string buffer.
+         */
+        struct vmmdev_hgcm_function_parameter path;
+        /**
+         * pointer, out: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in: UTF16
+         * Path delimiter
+         */
+        struct vmmdev_hgcm_function_parameter delimiter;
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Case senstive flag
+         */
+        struct vmmdev_hgcm_function_parameter case_sensitive;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_MAP_FOLDER (4)
+/** SHFL_FN_UNMAP_FOLDER Parameters structure. */
+struct shfl_unmap_folder {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_UNMAP_FOLDER (1)
+/** SHFL_FN_CREATE Parameters structure. */
+struct shfl_create {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string buffer.
+         */
+        struct vmmdev_hgcm_function_parameter path;
+        /**
+         * pointer, in/out:
+         * Points to struct shfl_createparms buffer.
+         */
+        struct vmmdev_hgcm_function_parameter parms;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_CREATE (3)
+/** SHFL_FN_CLOSE Parameters structure. */
+struct shfl_close {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * value64, in:
+         * SHFLHANDLE (u64) of object to close.
+         */
+        struct vmmdev_hgcm_function_parameter handle;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_CLOSE (2)
+/** SHFL_FN_READ Parameters structure. */
+struct shfl_read {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * value64, in:
+         * SHFLHANDLE (u64) of object to read from.
+         */
+        struct vmmdev_hgcm_function_parameter handle;
+        /**
+         * value64, in:
+         * Offset to read from.
+         */
+        struct vmmdev_hgcm_function_parameter offset;
+        /**
+         * value64, in/out:
+         * Bytes to read/How many were read.
+         */
+        struct vmmdev_hgcm_function_parameter cb;
+        /**
+         * pointer, out:
+         * Buffer to place data to.
+         */
+        struct vmmdev_hgcm_function_parameter buffer;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_READ (5)
+/** SHFL_FN_WRITE Parameters structure. */
+struct shfl_write {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * value64, in:
+         * SHFLHANDLE (u64) of object to write to.
+         */
+        struct vmmdev_hgcm_function_parameter handle;
+        /**
+         * value64, in:
+         * Offset to write to.
+         */
+        struct vmmdev_hgcm_function_parameter offset;
+        /**
+         * value64, in/out:
+         * Bytes to write/How many were written.
+         */
+        struct vmmdev_hgcm_function_parameter cb;
+        /**
+         * pointer, in:
+         * Data to write.
+         */
+        struct vmmdev_hgcm_function_parameter buffer;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_WRITE (5)
+/*
+ * SHFL_FN_LIST
+ * Listing information includes variable length RTDIRENTRY[EX] structures.
+ */
+#define SHFL_LIST_NONE                  0
+#define SHFL_LIST_RETURN_ONE            1
+/** SHFL_FN_LIST Parameters structure. */
+struct shfl_list {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * value64, in:
+         * SHFLHANDLE (u64) of object to be listed.
+         */
+        struct vmmdev_hgcm_function_parameter handle;
+        /**
+         * value32, in:
+         * List flags SHFL_LIST_*.
+         */
+        struct vmmdev_hgcm_function_parameter flags;
+        /**
+         * value32, in/out:
+         * Bytes to be used for listing information/How many bytes were used.
+         */
+        struct vmmdev_hgcm_function_parameter cb;
+        /**
+         * pointer, in/optional
+         * Points to struct shfl_string buffer that specifies a search path.
+         */
+        struct vmmdev_hgcm_function_parameter path;
+        /**
+         * pointer, out:
+         * Buffer to place listing information to. (struct shfl_dirinfo)
+         */
+        struct vmmdev_hgcm_function_parameter buffer;
+        /**
+         * value32, in/out:
+         * Indicates a key where the listing must be resumed.
+         * in: 0 means start from begin of object.
+         * out: 0 means listing completed.
+         */
+        struct vmmdev_hgcm_function_parameter resume_point;
+        /**
+         * pointer, out:
+         * Number of files returned
+         */
+        struct vmmdev_hgcm_function_parameter file_count;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_LIST (8)
+/** SHFL_FN_READLINK Parameters structure. */
+struct shfl_readLink {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string buffer.
+         */
+        struct vmmdev_hgcm_function_parameter path;
+        /**
+         * pointer, out:
+         * Buffer to place data to.
+         */
+        struct vmmdev_hgcm_function_parameter buffer;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_READLINK (3)
+/* SHFL_FN_INFORMATION */
+/* Mask of Set/Get bit. */
+#define SHFL_INFO_MODE_MASK    (0x1)
+/* Get information */
+#define SHFL_INFO_GET          (0x0)
+/* Set information */
+#define SHFL_INFO_SET          (0x1)
+/* Get name of the object. */
+#define SHFL_INFO_NAME         (0x2)
+/* Set size of object (extend/trucate); only applies to file objects */
+#define SHFL_INFO_SIZE         (0x4)
+/* Get/Set file object info. */
+#define SHFL_INFO_FILE         (0x8)
+/* Get volume information. */
+#define SHFL_INFO_VOLUME       (0x10)
+/** SHFL_FN_INFORMATION Parameters structure. */
+struct shfl_information {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * value64, in:
+         * SHFLHANDLE (u64) of object to be listed.
+         */
+        struct vmmdev_hgcm_function_parameter handle;
+        /**
+         * value32, in:
+         * SHFL_INFO_*
+         */
+        struct vmmdev_hgcm_function_parameter flags;
+        /**
+         * value32, in/out:
+         * Bytes to be used for information/How many bytes were used.
+         */
+        struct vmmdev_hgcm_function_parameter cb;
+        /**
+         * pointer, in/out:
+         * Information to be set/get (shfl_fsobjinfo or shfl_string). Do not
+         * forget to set the shfl_fsobjinfo::attr::additional for a get
+         * operation as well.
+         */
+        struct vmmdev_hgcm_function_parameter info;
+};
+/* Number of parameters */
+#define SHFL_CPARMS_INFORMATION (5)
+/* SHFL_FN_REMOVE */
+#define SHFL_REMOVE_FILE        (0x1)
+#define SHFL_REMOVE_DIR         (0x2)
+#define SHFL_REMOVE_SYMLINK     (0x4)
+/** SHFL_FN_REMOVE Parameters structure. */
+struct shfl_remove {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string buffer.
+         */
+        struct vmmdev_hgcm_function_parameter path;
+        /**
+         * value32, in:
+         * remove flags (file/directory)
+         */
+        struct vmmdev_hgcm_function_parameter flags;
+};
+#define SHFL_CPARMS_REMOVE  (3)
+/* SHFL_FN_RENAME */
+#define SHFL_RENAME_FILE                (0x1)
+#define SHFL_RENAME_DIR                 (0x2)
+#define SHFL_RENAME_REPLACE_IF_EXISTS   (0x4)
+/** SHFL_FN_RENAME Parameters structure. */
+struct shfl_rename {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string src.
+         */
+        struct vmmdev_hgcm_function_parameter src;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string dest.
+         */
+        struct vmmdev_hgcm_function_parameter dest;
+        /**
+         * value32, in:
+         * rename flags (file/directory)
+         */
+        struct vmmdev_hgcm_function_parameter flags;
+};
+#define SHFL_CPARMS_RENAME  (4)
+/** SHFL_FN_SYMLINK Parameters structure. */
+struct shfl_symlink {
+        /**
+         * pointer, in: SHFLROOT (u32)
+         * Root handle of the mapping which name is queried.
+         */
+        struct vmmdev_hgcm_function_parameter root;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string of path for the new symlink.
+         */
+        struct vmmdev_hgcm_function_parameter new_path;
+        /**
+         * pointer, in:
+         * Points to struct shfl_string of destination for symlink.
+         */
+        struct vmmdev_hgcm_function_parameter old_path;
+        /**
+         * pointer, out:
+         * Information about created symlink.
+         */
+        struct vmmdev_hgcm_function_parameter info;
+};
+#define SHFL_CPARMS_SYMLINK  (4)
+#endif
diff --git a/drivers/staging/vboxsf/super.c b/drivers/staging/vboxsf/super.c
new file mode 100644
index 000000000000..0bf4d724aefd
--- /dev/null
+++ b/drivers/staging/vboxsf/super.c
@@ -0,0 +1,501 @@
+// SPDX-License-Identifier: MIT
+/*
+ * VirtualBox Guest Shared Folders support: Virtual File System.
+ *
+ * Module initialization/finalization
+ * File system registration/deregistration
+ * Superblock reading
+ * Few utility functions
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#include <linux/idr.h>
+#include <linux/fs_parser.h>
+#include <linux/magic.h>
+#include <linux/module.h>
+#include <linux/nls.h>
+#include <linux/statfs.h>
+#include <linux/vbox_utils.h>
+#include "vfsmod.h"
+#define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
+#define VBSF_MOUNT_SIGNATURE_BYTE_0 ('\000')
+#define VBSF_MOUNT_SIGNATURE_BYTE_1 ('\377')
+#define VBSF_MOUNT_SIGNATURE_BYTE_2 ('\376')
+#define VBSF_MOUNT_SIGNATURE_BYTE_3 ('\375')
+static int follow_symlinks;
+module_param(follow_symlinks, int, 0444);
+MODULE_PARM_DESC(follow_symlinks,
+                 "Let host resolve symlinks rather than showing them");
+static DEFINE_IDA(vboxsf_bdi_ida);
+static DEFINE_MUTEX(vboxsf_setup_mutex);
+static bool vboxsf_setup_done;
+static struct super_operations vboxsf_super_ops; /* forward declaration */
+static struct kmem_cache *vboxsf_inode_cachep;
+static char * const vboxsf_default_nls = CONFIG_NLS_DEFAULT;
+enum  { opt_nls, opt_uid, opt_gid, opt_ttl, opt_dmode, opt_fmode,
+        opt_dmask, opt_fmask };
+static const struct fs_parameter_spec vboxsf_param_specs[] = {
+        fsparam_string  ("nls",         opt_nls),
+        fsparam_u32     ("uid",         opt_uid),
+        fsparam_u32     ("gid",         opt_gid),
+        fsparam_u32     ("ttl",         opt_ttl),
+        fsparam_u32oct  ("dmode",       opt_dmode),
+        fsparam_u32oct  ("fmode",       opt_fmode),
+        fsparam_u32oct  ("dmask",       opt_dmask),
+        fsparam_u32oct  ("fmask",       opt_fmask),
+        {}
+};
+static const struct fs_parameter_description vboxsf_fs_parameters = {
+        .name  = "vboxsf",
+        .specs  = vboxsf_param_specs,
+};
+static int vboxsf_parse_param(struct fs_context *fc, struct fs_parameter *param)
+{
+        struct vboxsf_fs_context *ctx = fc->fs_private;
+        struct fs_parse_result result;
+        kuid_t uid;
+        kgid_t gid;
+        int opt;
+        opt = fs_parse(fc, &vboxsf_fs_parameters, param, &result);
+        if (opt < 0)
+                return opt;
+        switch (opt) {
+        case opt_nls:
+                if (fc->purpose != FS_CONTEXT_FOR_MOUNT) {
+                        vbg_err("vboxsf: Cannot reconfigure nls option\n");
+                        return -EINVAL;
+                }
+                ctx->nls_name = param->string;
+                param->string = NULL;
+                break;
+        case opt_uid:
+                uid = make_kuid(current_user_ns(), result.uint_32);
+                if (!uid_valid(uid))
+                        return -EINVAL;
+                ctx->o.uid = uid;
+                break;
+        case opt_gid:
+                gid = make_kgid(current_user_ns(), result.uint_32);
+                if (!gid_valid(gid))
+                        return -EINVAL;
+                ctx->o.gid = gid;
+                break;
+        case opt_ttl:
+                ctx->o.ttl = msecs_to_jiffies(result.uint_32);
+                break;
+        case opt_dmode:
+                if (result.uint_32 & ~0777)
+                        return -EINVAL;
+                ctx->o.dmode = result.uint_32;
+                ctx->o.dmode_set = true;
+                break;
+        case opt_fmode:
+                if (result.uint_32 & ~0777)
+                        return -EINVAL;
+                ctx->o.fmode = result.uint_32;
+                ctx->o.fmode_set = true;
+                break;
+        case opt_dmask:
+                if (result.uint_32 & ~07777)
+                        return -EINVAL;
+                ctx->o.dmask = result.uint_32;
+                break;
+        case opt_fmask:
+                if (result.uint_32 & ~07777)
+                        return -EINVAL;
+                ctx->o.fmask = result.uint_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
+static int vboxsf_fill_super(struct super_block *sb, struct fs_context *fc)
+{
+        struct vboxsf_fs_context *ctx = fc->fs_private;
+        struct shfl_string *folder_name, root_path;
+        struct vboxsf_sbi *sbi;
+        struct dentry *droot;
+        struct inode *iroot;
+        char *nls_name;
+        size_t size;
+        int err;
+        if (!fc->source)
+                return -EINVAL;
+        sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+        if (!sbi)
+                return -ENOMEM;
+        sbi->o = ctx->o;
+        idr_init(&sbi->ino_idr);
+        spin_lock_init(&sbi->ino_idr_lock);
+        sbi->next_generation = 1;
+        sbi->bdi_id = -1;
+        /* Load nls if not utf8 */
+        nls_name = ctx->nls_name ? ctx->nls_name : vboxsf_default_nls;
+        if (strcmp(nls_name, "utf8") != 0) {
+                if (nls_name == vboxsf_default_nls)
+                        sbi->nls = load_nls_default();
+                else
+                        sbi->nls = load_nls(nls_name);
+                if (!sbi->nls) {
+                        vbg_err("vboxsf: Count not load '%s' nls\n", nls_name);
+                        err = -EINVAL;
+                        goto fail_free;
+                }
+        }
+        sbi->bdi_id = ida_simple_get(&vboxsf_bdi_ida, 0, 0, GFP_KERNEL);
+        if (sbi->bdi_id < 0) {
+                err = sbi->bdi_id;
+                goto fail_free;
+        }
+        err = super_setup_bdi_name(sb, "vboxsf-%s.%d", fc->source, sbi->bdi_id);
+        if (err)
+                goto fail_free;
+        /* Turn source into a shfl_string and map the folder */
+        size = strlen(fc->source) + 1;
+        folder_name = kmalloc(SHFLSTRING_HEADER_SIZE + size, GFP_KERNEL);
+        if (!folder_name) {
+                err = -ENOMEM;
+                goto fail_free;
+        }
+        folder_name->size = size;
+        folder_name->length = size - 1;
+        strlcpy(folder_name->string.utf8, fc->source, size);
+        err = vboxsf_map_folder(folder_name, &sbi->root);
+        kfree(folder_name);
+        if (err) {
+                vbg_err("vboxsf: Host rejected mount of '%s' with error %d\n",
+                        fc->source, err);
+                goto fail_free;
+        }
+        root_path.length = 1;
+        root_path.size = 2;
+        root_path.string.utf8[0] = '/';
+        root_path.string.utf8[1] = 0;
+        err = vboxsf_stat(sbi, &root_path, &sbi->root_info);
+        if (err)
+                goto fail_unmap;
+        sb->s_magic = VBOXSF_SUPER_MAGIC;
+        sb->s_blocksize = 1024;
+        sb->s_maxbytes = MAX_LFS_FILESIZE;
+        sb->s_op = &vboxsf_super_ops;
+        sb->s_d_op = &vboxsf_dentry_ops;
+        iroot = iget_locked(sb, 0);
+        if (!iroot) {
+                err = -ENOMEM;
+                goto fail_unmap;
+        }
+        vboxsf_init_inode(sbi, iroot, &sbi->root_info);
+        unlock_new_inode(iroot);
+        droot = d_make_root(iroot);
+        if (!droot) {
+                err = -ENOMEM;
+                goto fail_unmap;
+        }
+        sb->s_root = droot;
+        sb->s_fs_info = sbi;
+        return 0;
+fail_unmap:
+        vboxsf_unmap_folder(sbi->root);
+fail_free:
+        if (sbi->bdi_id >= 0)
+                ida_simple_remove(&vboxsf_bdi_ida, sbi->bdi_id);
+        if (sbi->nls)
+                unload_nls(sbi->nls);
+        idr_destroy(&sbi->ino_idr);
+        kfree(sbi);
+        return err;
+}
+static void vboxsf_inode_init_once(void *data)
+{
+        struct vboxsf_inode *sf_i = data;
+        mutex_init(&sf_i->handle_list_mutex);
+        inode_init_once(&sf_i->vfs_inode);
+}
+static struct inode *vboxsf_alloc_inode(struct super_block *sb)
+{
+        struct vboxsf_inode *sf_i;
+        sf_i = kmem_cache_alloc(vboxsf_inode_cachep, GFP_NOFS);
+        if (!sf_i)
+                return NULL;
+        sf_i->force_restat = 0;
+        INIT_LIST_HEAD(&sf_i->handle_list);
+        return &sf_i->vfs_inode;
+}
+static void vboxsf_free_inode(struct inode *inode)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(inode->i_sb);
+        unsigned long flags;
+        spin_lock_irqsave(&sbi->ino_idr_lock, flags);
+        idr_remove(&sbi->ino_idr, inode->i_ino);
+        spin_unlock_irqrestore(&sbi->ino_idr_lock, flags);
+        kmem_cache_free(vboxsf_inode_cachep, VBOXSF_I(inode));
+}
+static void vboxsf_put_super(struct super_block *sb)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(sb);
+        vboxsf_unmap_folder(sbi->root);
+        if (sbi->bdi_id >= 0)
+                ida_simple_remove(&vboxsf_bdi_ida, sbi->bdi_id);
+        if (sbi->nls)
+                unload_nls(sbi->nls);
+        /*
+         * vboxsf_free_inode uses the idr, make sure all delayed rcu free
+         * inodes are flushed.
+         */
+        rcu_barrier();
+        idr_destroy(&sbi->ino_idr);
+        kfree(sbi);
+}
+static int vboxsf_statfs(struct dentry *dentry, struct kstatfs *stat)
+{
+        struct super_block *sb = dentry->d_sb;
+        struct shfl_volinfo shfl_volinfo;
+        struct vboxsf_sbi *sbi;
+        u32 buf_len;
+        int err;
+        sbi = VBOXSF_SBI(sb);
+        buf_len = sizeof(shfl_volinfo);
+        err = vboxsf_fsinfo(sbi->root, 0, SHFL_INFO_GET | SHFL_INFO_VOLUME,
+                            &buf_len, &shfl_volinfo);
+        if (err)
+                return err;
+        stat->f_type = VBOXSF_SUPER_MAGIC;
+        stat->f_bsize = shfl_volinfo.bytes_per_allocation_unit;
+        do_div(shfl_volinfo.total_allocation_bytes,
+               shfl_volinfo.bytes_per_allocation_unit);
+        stat->f_blocks = shfl_volinfo.total_allocation_bytes;
+        do_div(shfl_volinfo.available_allocation_bytes,
+               shfl_volinfo.bytes_per_allocation_unit);
+        stat->f_bfree  = shfl_volinfo.available_allocation_bytes;
+        stat->f_bavail = shfl_volinfo.available_allocation_bytes;
+        stat->f_files = 1000;
+        /*
+         * Don't return 0 here since the guest may then think that it is not
+         * possible to create any more files.
+         */
+        stat->f_ffree = 1000000;
+        stat->f_fsid.val[0] = 0;
+        stat->f_fsid.val[1] = 0;
+        stat->f_namelen = 255;
+        return 0;
+}
+static struct super_operations vboxsf_super_ops = {
+        .alloc_inode    = vboxsf_alloc_inode,
+        .free_inode     = vboxsf_free_inode,
+        .put_super      = vboxsf_put_super,
+        .statfs         = vboxsf_statfs,
+};
+static int vboxsf_setup(void)
+{
+        int err;
+        mutex_lock(&vboxsf_setup_mutex);
+        if (vboxsf_setup_done)
+                goto success;
+        vboxsf_inode_cachep =
+                kmem_cache_create("vboxsf_inode_cache",
+                                  sizeof(struct vboxsf_inode), 0,
+                                  (SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD |
+                                   SLAB_ACCOUNT),
+                                  vboxsf_inode_init_once);
+        if (!vboxsf_inode_cachep) {
+                err = -ENOMEM;
+                goto fail_nomem;
+        }
+        err = vboxsf_connect();
+        if (err) {
+                vbg_err("vboxsf: err %d connecting to guest PCI-device\n", err);
+                vbg_err("vboxsf: make sure you are inside a VirtualBox VM\n");
+                vbg_err("vboxsf: and check dmesg for vboxguest errors\n");
+                goto fail_free_cache;
+        }
+        err = vboxsf_set_utf8();
+        if (err) {
+                vbg_err("vboxsf_setutf8 error %d\n", err);
+                goto fail_disconnect;
+        }
+        if (!follow_symlinks) {
+                err = vboxsf_set_symlinks();
+                if (err)
+                        vbg_warn("vboxsf: Unable to show symlinks: %d\n", err);
+        }
+        vboxsf_setup_done = true;
+success:
+        mutex_unlock(&vboxsf_setup_mutex);
+        return 0;
+fail_disconnect:
+        vboxsf_disconnect();
+fail_free_cache:
+        kmem_cache_destroy(vboxsf_inode_cachep);
+fail_nomem:
+        mutex_unlock(&vboxsf_setup_mutex);
+        return err;
+}
+static int vboxsf_parse_monolithic(struct fs_context *fc, void *data)
+{
+        char *options = data;
+        if (options && options[0] == VBSF_MOUNT_SIGNATURE_BYTE_0 &&
+                       options[1] == VBSF_MOUNT_SIGNATURE_BYTE_1 &&
+                       options[2] == VBSF_MOUNT_SIGNATURE_BYTE_2 &&
+                       options[3] == VBSF_MOUNT_SIGNATURE_BYTE_3) {
+                vbg_err("vboxsf: Old binary mount data not supported, remove obsolete mount.vboxsf and/or update your VBoxService.\n");
+                return -EINVAL;
+        }
+        return generic_parse_monolithic(fc, data);
+}
+static int vboxsf_get_tree(struct fs_context *fc)
+{
+        int err;
+        err = vboxsf_setup();
+        if (err)
+                return err;
+        return vfs_get_super(fc, vfs_get_independent_super, vboxsf_fill_super);
+}
+static int vboxsf_reconfigure(struct fs_context *fc)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(fc->root->d_sb);
+        struct vboxsf_fs_context *ctx = fc->fs_private;
+        struct inode *iroot;
+        iroot = ilookup(fc->root->d_sb, 0);
+        if (!iroot)
+                return -ENOENT;
+        /* Apply changed options to the root inode */
+        sbi->o = ctx->o;
+        vboxsf_init_inode(sbi, iroot, &sbi->root_info);
+        return 0;
+}
+static void vboxsf_free_fc(struct fs_context *fc)
+{
+        struct vboxsf_fs_context *ctx = fc->fs_private;
+        kfree(ctx->nls_name);
+        kfree(ctx);
+}
+static const struct fs_context_operations vboxsf_context_ops = {
+        .free                   = vboxsf_free_fc,
+        .parse_param            = vboxsf_parse_param,
+        .parse_monolithic       = vboxsf_parse_monolithic,
+        .get_tree               = vboxsf_get_tree,
+        .reconfigure            = vboxsf_reconfigure,
+};
+static int vboxsf_init_fs_context(struct fs_context *fc)
+{
+        struct vboxsf_fs_context *ctx;
+        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+        if (!ctx)
+                return -ENOMEM;
+        current_uid_gid(&ctx->o.uid, &ctx->o.gid);
+        fc->fs_private = ctx;
+        fc->ops = &vboxsf_context_ops;
+        return 0;
+}
+static struct file_system_type vboxsf_fs_type = {
+        .owner                  = THIS_MODULE,
+        .name                   = "vboxsf",
+        .init_fs_context        = vboxsf_init_fs_context,
+        .parameters             = &vboxsf_fs_parameters,
+        .kill_sb                = kill_anon_super
+};
+/* Module initialization/finalization handlers */
+static int __init vboxsf_init(void)
+{
+        return register_filesystem(&vboxsf_fs_type);
+}
+static void __exit vboxsf_fini(void)
+{
+        unregister_filesystem(&vboxsf_fs_type);
+        mutex_lock(&vboxsf_setup_mutex);
+        if (vboxsf_setup_done) {
+                vboxsf_disconnect();
+                /*
+                 * Make sure all delayed rcu free inodes are flushed
+                 * before we destroy the cache.
+                 */
+                rcu_barrier();
+                kmem_cache_destroy(vboxsf_inode_cachep);
+        }
+        mutex_unlock(&vboxsf_setup_mutex);
+}
+module_init(vboxsf_init);
+module_exit(vboxsf_fini);
+MODULE_DESCRIPTION("Oracle VM VirtualBox Module for Host File System Access");
+MODULE_AUTHOR("Oracle Corporation");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_FS("vboxsf");
diff --git a/drivers/staging/vboxsf/utils.c b/drivers/staging/vboxsf/utils.c
new file mode 100644
index 000000000000..34a49e6f74fc
--- /dev/null
+++ b/drivers/staging/vboxsf/utils.c
@@ -0,0 +1,551 @@
+// SPDX-License-Identifier: MIT
+/*
+ * VirtualBox Guest Shared Folders support: Utility functions.
+ * Mainly conversion from/to VirtualBox/Linux data structures.
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#include <linux/namei.h>
+#include <linux/nls.h>
+#include <linux/sizes.h>
+#include <linux/vfs.h>
+#include "vfsmod.h"
+struct inode *vboxsf_new_inode(struct super_block *sb)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(sb);
+        struct inode *inode;
+        unsigned long flags;
+        int cursor, ret;
+        u32 gen;
+        inode = new_inode(sb);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+        idr_preload(GFP_KERNEL);
+        spin_lock_irqsave(&sbi->ino_idr_lock, flags);
+        cursor = idr_get_cursor(&sbi->ino_idr);
+        ret = idr_alloc_cyclic(&sbi->ino_idr, inode, 1, 0, GFP_ATOMIC);
+        if (ret >= 0 && ret < cursor)
+                sbi->next_generation++;
+        gen = sbi->next_generation;
+        spin_unlock_irqrestore(&sbi->ino_idr_lock, flags);
+        idr_preload_end();
+        if (ret < 0) {
+                iput(inode);
+                return ERR_PTR(ret);
+        }
+        inode->i_ino = ret;
+        inode->i_generation = gen;
+        return inode;
+}
+/* set [inode] attributes based on [info], uid/gid based on [sbi] */
+void vboxsf_init_inode(struct vboxsf_sbi *sbi, struct inode *inode,
+                       const struct shfl_fsobjinfo *info)
+{
+        const struct shfl_fsobjattr *attr;
+        s64 allocated;
+        int mode;
+        attr = &info->attr;
+#define mode_set(r) ((attr->mode & (SHFL_UNIX_##r)) ? (S_##r) : 0)
+        mode = mode_set(IRUSR);
+        mode |= mode_set(IWUSR);
+        mode |= mode_set(IXUSR);
+        mode |= mode_set(IRGRP);
+        mode |= mode_set(IWGRP);
+        mode |= mode_set(IXGRP);
+        mode |= mode_set(IROTH);
+        mode |= mode_set(IWOTH);
+        mode |= mode_set(IXOTH);
+#undef mode_set
+        /* We use the host-side values for these */
+        inode->i_flags |= S_NOATIME | S_NOCMTIME;
+        inode->i_mapping->a_ops = &vboxsf_reg_aops;
+        if (SHFL_IS_DIRECTORY(attr->mode)) {
+                inode->i_mode = sbi->o.dmode_set ? sbi->o.dmode : mode;
+                inode->i_mode &= ~sbi->o.dmask;
+                inode->i_mode |= S_IFDIR;
+                inode->i_op = &vboxsf_dir_iops;
+                inode->i_fop = &vboxsf_dir_fops;
+                /*
+                 * XXX: this probably should be set to the number of entries
+                 * in the directory plus two (. ..)
+                 */
+                set_nlink(inode, 1);
+        } else if (SHFL_IS_SYMLINK(attr->mode)) {
+                inode->i_mode = sbi->o.fmode_set ? sbi->o.fmode : mode;
+                inode->i_mode &= ~sbi->o.fmask;
+                inode->i_mode |= S_IFLNK;
+                inode->i_op = &vboxsf_lnk_iops;
+                set_nlink(inode, 1);
+        } else {
+                inode->i_mode = sbi->o.fmode_set ? sbi->o.fmode : mode;
+                inode->i_mode &= ~sbi->o.fmask;
+                inode->i_mode |= S_IFREG;
+                inode->i_op = &vboxsf_reg_iops;
+                inode->i_fop = &vboxsf_reg_fops;
+                set_nlink(inode, 1);
+        }
+        inode->i_uid = sbi->o.uid;
+        inode->i_gid = sbi->o.gid;
+        inode->i_size = info->size;
+        inode->i_blkbits = 12;
+        /* i_blocks always in units of 512 bytes! */
+        allocated = info->allocated + 511;
+        do_div(allocated, 512);
+        inode->i_blocks = allocated;
+        inode->i_atime = ns_to_timespec64(
+                                 info->access_time.ns_relative_to_unix_epoch);
+        inode->i_ctime = ns_to_timespec64(
+                                 info->change_time.ns_relative_to_unix_epoch);
+        inode->i_mtime = ns_to_timespec64(
+                           info->modification_time.ns_relative_to_unix_epoch);
+}
+int vboxsf_create_at_dentry(struct dentry *dentry,
+                            struct shfl_createparms *params)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(dentry->d_sb);
+        struct shfl_string *path;
+        int err;
+        path = vboxsf_path_from_dentry(sbi, dentry);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        err = vboxsf_create(sbi->root, path, params);
+        __putname(path);
+        return err;
+}
+int vboxsf_stat(struct vboxsf_sbi *sbi, struct shfl_string *path,
+                struct shfl_fsobjinfo *info)
+{
+        struct shfl_createparms params = {};
+        int err;
+        params.handle = SHFL_HANDLE_NIL;
+        params.create_flags = SHFL_CF_LOOKUP | SHFL_CF_ACT_FAIL_IF_NEW;
+        err = vboxsf_create(sbi->root, path, &params);
+        if (err)
+                return err;
+        if (params.result != SHFL_FILE_EXISTS)
+                return -ENOENT;
+        if (info)
+                *info = params.info;
+        return 0;
+}
+int vboxsf_stat_dentry(struct dentry *dentry, struct shfl_fsobjinfo *info)
+{
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(dentry->d_sb);
+        struct shfl_string *path;
+        int err;
+        path = vboxsf_path_from_dentry(sbi, dentry);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        err = vboxsf_stat(sbi, path, info);
+        __putname(path);
+        return err;
+}
+int vboxsf_inode_revalidate(struct dentry *dentry)
+{
+        struct vboxsf_sbi *sbi;
+        struct vboxsf_inode *sf_i;
+        struct shfl_fsobjinfo info;
+        struct timespec64 prev_mtime;
+        struct inode *inode;
+        int err;
+        if (!dentry || !d_really_is_positive(dentry))
+                return -EINVAL;
+        inode = d_inode(dentry);
+        prev_mtime = inode->i_mtime;
+        sf_i = VBOXSF_I(inode);
+        sbi = VBOXSF_SBI(dentry->d_sb);
+        if (!sf_i->force_restat) {
+                if (time_before(jiffies, dentry->d_time + sbi->o.ttl))
+                        return 0;
+        }
+        err = vboxsf_stat_dentry(dentry, &info);
+        if (err)
+                return err;
+        dentry->d_time = jiffies;
+        sf_i->force_restat = 0;
+        vboxsf_init_inode(sbi, inode, &info);
+        /*
+         * If the file was changed on the host side we need to invalidate the
+         * page-cache for it.  Note this also gets triggered by our own writes,
+         * this is unavoidable.
+         */
+        if (timespec64_compare(&inode->i_mtime, &prev_mtime) > 0)
+                invalidate_inode_pages2(inode->i_mapping);
+        return 0;
+}
+int vboxsf_getattr(const struct path *path, struct kstat *kstat,
+                   u32 request_mask, unsigned int flags)
+{
+        int err;
+        struct dentry *dentry = path->dentry;
+        struct inode *inode = d_inode(dentry);
+        struct vboxsf_inode *sf_i = VBOXSF_I(inode);
+        switch (flags & AT_STATX_SYNC_TYPE) {
+        case AT_STATX_DONT_SYNC:
+                err = 0;
+                break;
+        case AT_STATX_FORCE_SYNC:
+                sf_i->force_restat = 1;
+                /* fall-through */
+        default:
+                err = vboxsf_inode_revalidate(dentry);
+        }
+        if (err)
+                return err;
+        generic_fillattr(d_inode(dentry), kstat);
+        return 0;
+}
+int vboxsf_setattr(struct dentry *dentry, struct iattr *iattr)
+{
+        struct vboxsf_inode *sf_i = VBOXSF_I(d_inode(dentry));
+        struct vboxsf_sbi *sbi = VBOXSF_SBI(dentry->d_sb);
+        struct shfl_createparms params = {};
+        struct shfl_fsobjinfo info = {};
+        u32 buf_len;
+        int err;
+        params.handle = SHFL_HANDLE_NIL;
+        params.create_flags = SHFL_CF_ACT_OPEN_IF_EXISTS |
+                              SHFL_CF_ACT_FAIL_IF_NEW |
+                              SHFL_CF_ACCESS_ATTR_WRITE;
+        /* this is at least required for Posix hosts */
+        if (iattr->ia_valid & ATTR_SIZE)
+                params.create_flags |= SHFL_CF_ACCESS_WRITE;
+        err = vboxsf_create_at_dentry(dentry, &params);
+        if (err || params.result != SHFL_FILE_EXISTS)
+                return err ? err : -ENOENT;
+#define mode_set(r) ((iattr->ia_mode & (S_##r)) ? SHFL_UNIX_##r : 0)
+        /*
+         * Setting the file size and setting the other attributes has to
+         * be handled separately.
+         */
+        if (iattr->ia_valid & (ATTR_MODE | ATTR_ATIME | ATTR_MTIME)) {
+                if (iattr->ia_valid & ATTR_MODE) {
+                        info.attr.mode = mode_set(IRUSR);
+                        info.attr.mode |= mode_set(IWUSR);
+                        info.attr.mode |= mode_set(IXUSR);
+                        info.attr.mode |= mode_set(IRGRP);
+                        info.attr.mode |= mode_set(IWGRP);
+                        info.attr.mode |= mode_set(IXGRP);
+                        info.attr.mode |= mode_set(IROTH);
+                        info.attr.mode |= mode_set(IWOTH);
+                        info.attr.mode |= mode_set(IXOTH);
+                        if (iattr->ia_mode & S_IFDIR)
+                                info.attr.mode |= SHFL_TYPE_DIRECTORY;
+                        else
+                                info.attr.mode |= SHFL_TYPE_FILE;
+                }
+                if (iattr->ia_valid & ATTR_ATIME)
+                        info.access_time.ns_relative_to_unix_epoch =
+                                            timespec64_to_ns(&iattr->ia_atime);
+                if (iattr->ia_valid & ATTR_MTIME)
+                        info.modification_time.ns_relative_to_unix_epoch =
+                                            timespec64_to_ns(&iattr->ia_mtime);
+                /*
+                 * Ignore ctime (inode change time) as it can't be set
+                 * from userland anyway.
+                 */
+                buf_len = sizeof(info);
+                err = vboxsf_fsinfo(sbi->root, params.handle,
+                                    SHFL_INFO_SET | SHFL_INFO_FILE, &buf_len,
+                                    &info);
+                if (err) {
+                        vboxsf_close(sbi->root, params.handle);
+                        return err;
+                }
+                /* the host may have given us different attr then requested */
+                sf_i->force_restat = 1;
+        }
+#undef mode_set
+        if (iattr->ia_valid & ATTR_SIZE) {
+                memset(&info, 0, sizeof(info));
+                info.size = iattr->ia_size;
+                buf_len = sizeof(info);
+                err = vboxsf_fsinfo(sbi->root, params.handle,
+                                    SHFL_INFO_SET | SHFL_INFO_SIZE, &buf_len,
+                                    &info);
+                if (err) {
+                        vboxsf_close(sbi->root, params.handle);
+                        return err;
+                }
+                /* the host may have given us different attr then requested */
+                sf_i->force_restat = 1;
+        }
+        vboxsf_close(sbi->root, params.handle);
+        /* Update the inode with what the host has actually given us. */
+        if (sf_i->force_restat)
+                vboxsf_inode_revalidate(dentry);
+        return 0;
+}
+/*
+ * [dentry] contains string encoded in coding system that corresponds
+ * to [sbi]->nls, we must convert it to UTF8 here.
+ * Returns a shfl_string allocated through __getname (must be freed using
+ * __putname), or an ERR_PTR on error.
+ */
+struct shfl_string *vboxsf_path_from_dentry(struct vboxsf_sbi *sbi,
+                                            struct dentry *dentry)
+{
+        struct shfl_string *shfl_path;
+        int path_len, out_len, nb;
+        char *buf, *path;
+        wchar_t uni;
+        u8 *out;
+        buf = __getname();
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
+        path = dentry_path_raw(dentry, buf, PATH_MAX);
+        if (IS_ERR(path)) {
+                __putname(buf);
+                return (struct shfl_string *)path;
+        }
+        path_len = strlen(path);
+        if (sbi->nls) {
+                shfl_path = __getname();
+                if (!shfl_path) {
+                        __putname(buf);
+                        return ERR_PTR(-ENOMEM);
+                }
+                out = shfl_path->string.utf8;
+                out_len = PATH_MAX - SHFLSTRING_HEADER_SIZE - 1;
+                while (path_len) {
+                        nb = sbi->nls->char2uni(path, path_len, &uni);
+                        if (nb < 0) {
+                                __putname(shfl_path);
+                                __putname(buf);
+                                return ERR_PTR(-EINVAL);
+                        }
+                        path += nb;
+                        path_len -= nb;
+                        nb = utf32_to_utf8(uni, out, out_len);
+                        if (nb < 0) {
+                                __putname(shfl_path);
+                                __putname(buf);
+                                return ERR_PTR(-ENAMETOOLONG);
+                        }
+                        out += nb;
+                        out_len -= nb;
+                }
+                *out = 0;
+                shfl_path->length = out - shfl_path->string.utf8;
+                shfl_path->size = shfl_path->length + 1;
+                __putname(buf);
+        } else {
+                if ((SHFLSTRING_HEADER_SIZE + path_len + 1) > PATH_MAX) {
+                        __putname(buf);
+                        return ERR_PTR(-ENAMETOOLONG);
+                }
+                /*
+                 * dentry_path stores the name at the end of buf, but the
+                 * shfl_string string we return must be properly aligned.
+                 */
+                shfl_path = (struct shfl_string *)buf;
+                memmove(shfl_path->string.utf8, path, path_len);
+                shfl_path->string.utf8[path_len] = 0;
+                shfl_path->length = path_len;
+                shfl_path->size = path_len + 1;
+        }
+        return shfl_path;
+}
+int vboxsf_nlscpy(struct vboxsf_sbi *sbi, char *name, size_t name_bound_len,
+                  const unsigned char *utf8_name, size_t utf8_len)
+{
+        const char *in;
+        char *out;
+        size_t out_len;
+        size_t out_bound_len;
+        size_t in_bound_len;
+        in = utf8_name;
+        in_bound_len = utf8_len;
+        out = name;
+        out_len = 0;
+        /* Reserve space for terminating 0 */
+        out_bound_len = name_bound_len - 1;
+        while (in_bound_len) {
+                int nb;
+                unicode_t uni;
+                nb = utf8_to_utf32(in, in_bound_len, &uni);
+                if (nb < 0)
+                        return -EINVAL;
+                in += nb;
+                in_bound_len -= nb;
+                nb = sbi->nls->uni2char(uni, out, out_bound_len);
+                if (nb < 0)
+                        return nb;
+                out += nb;
+                out_bound_len -= nb;
+                out_len += nb;
+        }
+        *out = 0;
+        return 0;
+}
+static struct vboxsf_dir_buf *vboxsf_dir_buf_alloc(struct list_head *list)
+{
+        struct vboxsf_dir_buf *b;
+        b = kmalloc(sizeof(*b), GFP_KERNEL);
+        if (!b)
+                return NULL;
+        b->buf = kmalloc(DIR_BUFFER_SIZE, GFP_KERNEL);
+        if (!b->buf) {
+                kfree(b);
+                return NULL;
+        }
+        b->entries = 0;
+        b->used = 0;
+        b->free = DIR_BUFFER_SIZE;
+        list_add(&b->head, list);
+        return b;
+}
+static void vboxsf_dir_buf_free(struct vboxsf_dir_buf *b)
+{
+        list_del(&b->head);
+        kfree(b->buf);
+        kfree(b);
+}
+struct vboxsf_dir_info *vboxsf_dir_info_alloc(void)
+{
+        struct vboxsf_dir_info *p;
+        p = kmalloc(sizeof(*p), GFP_KERNEL);
+        if (!p)
+                return NULL;
+        INIT_LIST_HEAD(&p->info_list);
+        return p;
+}
+void vboxsf_dir_info_free(struct vboxsf_dir_info *p)
+{
+        struct list_head *list, *pos, *tmp;
+        list = &p->info_list;
+        list_for_each_safe(pos, tmp, list) {
+                struct vboxsf_dir_buf *b;
+                b = list_entry(pos, struct vboxsf_dir_buf, head);
+                vboxsf_dir_buf_free(b);
+        }
+        kfree(p);
+}
+int vboxsf_dir_read_all(struct vboxsf_sbi *sbi, struct vboxsf_dir_info *sf_d,
+                        u64 handle)
+{
+        struct vboxsf_dir_buf *b;
+        u32 entries, size;
+        int err = 0;
+        void *buf;
+        /* vboxsf_dirinfo returns 1 on end of dir */
+        while (err == 0) {
+                b = vboxsf_dir_buf_alloc(&sf_d->info_list);
+                if (!b) {
+                        err = -ENOMEM;
+                        break;
+                }
+                buf = b->buf;
+                size = b->free;
+                err = vboxsf_dirinfo(sbi->root, handle, NULL, 0, 0,
+                                     &size, buf, &entries);
+                if (err < 0)
+                        break;
+                b->entries += entries;
+                b->free -= size;
+                b->used += size;
+        }
+        if (b && b->used == 0)
+                vboxsf_dir_buf_free(b);
+        /* -EILSEQ means the host could not translate a filename, ignore */
+        if (err > 0 || err == -EILSEQ)
+                err = 0;
+        return err;
+}
diff --git a/drivers/staging/vboxsf/vboxsf_wrappers.c b/drivers/staging/vboxsf/vboxsf_wrappers.c
new file mode 100644
index 000000000000..bfc78a097dae
--- /dev/null
+++ b/drivers/staging/vboxsf/vboxsf_wrappers.c
@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: MIT
+/*
+ * Wrapper functions for the shfl host calls.
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vbox_err.h>
+#include <linux/vbox_utils.h>
+#include "vfsmod.h"
+#define SHFL_REQUEST \
+        (VMMDEV_REQUESTOR_KERNEL | VMMDEV_REQUESTOR_USR_DRV_OTHER | \
+         VMMDEV_REQUESTOR_CON_DONT_KNOW | VMMDEV_REQUESTOR_TRUST_NOT_GIVEN)
+static u32 vboxsf_client_id;
+int vboxsf_connect(void)
+{
+        struct vbg_dev *gdev;
+        struct vmmdev_hgcm_service_location loc;
+        int err, vbox_status;
+        loc.type = VMMDEV_HGCM_LOC_LOCALHOST_EXISTING;
+        strcpy(loc.u.localhost.service_name, "VBoxSharedFolders");
+        gdev = vbg_get_gdev();
+        if (IS_ERR(gdev))
+                return -ENODEV; /* No guest-device */
+        err = vbg_hgcm_connect(gdev, SHFL_REQUEST, &loc,
+                               &vboxsf_client_id, &vbox_status);
+        vbg_put_gdev(gdev);
+        return err ? err : vbg_status_code_to_errno(vbox_status);
+}
+void vboxsf_disconnect(void)
+{
+        struct vbg_dev *gdev;
+        int vbox_status;
+        gdev = vbg_get_gdev();
+        if (IS_ERR(gdev))
+                return;   /* guest-device is gone, already disconnected */
+        vbg_hgcm_disconnect(gdev, SHFL_REQUEST, vboxsf_client_id, &vbox_status);
+        vbg_put_gdev(gdev);
+}
+static int vboxsf_call(u32 function, void *parms, u32 parm_count, int *status)
+{
+        struct vbg_dev *gdev;
+        int err, vbox_status;
+        gdev = vbg_get_gdev();
+        if (IS_ERR(gdev))
+                return -ESHUTDOWN; /* guest-dev removed underneath us */
+        err = vbg_hgcm_call(gdev, SHFL_REQUEST, vboxsf_client_id, function,
+                            U32_MAX, parms, parm_count, &vbox_status);
+        vbg_put_gdev(gdev);
+        if (err < 0)
+                return err;
+        if (status)
+                *status = vbox_status;
+        return vbg_status_code_to_errno(vbox_status);
+}
+int vboxsf_map_folder(struct shfl_string *folder_name, u32 *root)
+{
+        struct shfl_map_folder parms;
+        int err, status;
+        parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL;
+        parms.path.u.pointer.size = shfl_string_buf_size(folder_name);
+        parms.path.u.pointer.u.linear_addr = (uintptr_t)folder_name;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = 0;
+        parms.delimiter.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.delimiter.u.value32 = '/';
+        parms.case_sensitive.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.case_sensitive.u.value32 = 1;
+        err = vboxsf_call(SHFL_FN_MAP_FOLDER, &parms, SHFL_CPARMS_MAP_FOLDER,
+                          &status);
+        if (err == -ENOSYS && status == VERR_NOT_IMPLEMENTED)
+                vbg_err("%s: Error host is too old\n", __func__);
+        *root = parms.root.u.value32;
+        return err;
+}
+int vboxsf_unmap_folder(u32 root)
+{
+        struct shfl_unmap_folder parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        return vboxsf_call(SHFL_FN_UNMAP_FOLDER, &parms,
+                           SHFL_CPARMS_UNMAP_FOLDER, NULL);
+}
+/**
+ * vboxsf_create - Create a new file or folder
+ * @root:         Root of the shared folder in which to create the file
+ * @parsed_path:  The path of the file or folder relative to the shared folder
+ * @param:        create_parms Parameters for file/folder creation.
+ *
+ * Create a new file or folder or open an existing one in a shared folder.
+ * Note this function always returns 0 / success unless an exceptional condition
+ * occurs - out of memory, invalid arguments, etc. If the file or folder could
+ * not be opened or created, create_parms->handle will be set to
+ * SHFL_HANDLE_NIL on return.  In this case the value in create_parms->result
+ * provides information as to why (e.g. SHFL_FILE_EXISTS), create_parms->result
+ * is also set on success as additional information.
+ *
+ * Returns:
+ * 0 or negative errno value.
+ */
+int vboxsf_create(u32 root, struct shfl_string *parsed_path,
+                  struct shfl_createparms *create_parms)
+{
+        struct shfl_create parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL;
+        parms.path.u.pointer.size = shfl_string_buf_size(parsed_path);
+        parms.path.u.pointer.u.linear_addr = (uintptr_t)parsed_path;
+        parms.parms.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL;
+        parms.parms.u.pointer.size = sizeof(struct shfl_createparms);
+        parms.parms.u.pointer.u.linear_addr = (uintptr_t)create_parms;
+        return vboxsf_call(SHFL_FN_CREATE, &parms, SHFL_CPARMS_CREATE, NULL);
+}
+int vboxsf_close(u32 root, u64 handle)
+{
+        struct shfl_close parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.handle.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.handle.u.value64 = handle;
+        return vboxsf_call(SHFL_FN_CLOSE, &parms, SHFL_CPARMS_CLOSE, NULL);
+}
+int vboxsf_remove(u32 root, struct shfl_string *parsed_path, u32 flags)
+{
+        struct shfl_remove parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.path.u.pointer.size = shfl_string_buf_size(parsed_path);
+        parms.path.u.pointer.u.linear_addr = (uintptr_t)parsed_path;
+        parms.flags.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.flags.u.value32 = flags;
+        return vboxsf_call(SHFL_FN_REMOVE, &parms, SHFL_CPARMS_REMOVE, NULL);
+}
+int vboxsf_rename(u32 root, struct shfl_string *src_path,
+                  struct shfl_string *dest_path, u32 flags)
+{
+        struct shfl_rename parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.src.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.src.u.pointer.size = shfl_string_buf_size(src_path);
+        parms.src.u.pointer.u.linear_addr = (uintptr_t)src_path;
+        parms.dest.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.dest.u.pointer.size = shfl_string_buf_size(dest_path);
+        parms.dest.u.pointer.u.linear_addr = (uintptr_t)dest_path;
+        parms.flags.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.flags.u.value32 = flags;
+        return vboxsf_call(SHFL_FN_RENAME, &parms, SHFL_CPARMS_RENAME, NULL);
+}
+int vboxsf_read(u32 root, u64 handle, u64 offset, u32 *buf_len, u8 *buf)
+{
+        struct shfl_read parms;
+        int err;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.handle.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.handle.u.value64 = handle;
+        parms.offset.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.offset.u.value64 = offset;
+        parms.cb.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.cb.u.value32 = *buf_len;
+        parms.buffer.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT;
+        parms.buffer.u.pointer.size = *buf_len;
+        parms.buffer.u.pointer.u.linear_addr = (uintptr_t)buf;
+        err = vboxsf_call(SHFL_FN_READ, &parms, SHFL_CPARMS_READ, NULL);
+        *buf_len = parms.cb.u.value32;
+        return err;
+}
+int vboxsf_write(u32 root, u64 handle, u64 offset, u32 *buf_len, u8 *buf)
+{
+        struct shfl_write parms;
+        int err;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.handle.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.handle.u.value64 = handle;
+        parms.offset.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.offset.u.value64 = offset;
+        parms.cb.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.cb.u.value32 = *buf_len;
+        parms.buffer.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.buffer.u.pointer.size = *buf_len;
+        parms.buffer.u.pointer.u.linear_addr = (uintptr_t)buf;
+        err = vboxsf_call(SHFL_FN_WRITE, &parms, SHFL_CPARMS_WRITE, NULL);
+        *buf_len = parms.cb.u.value32;
+        return err;
+}
+/* Returns 0 on success, 1 on end-of-dir, negative errno otherwise */
+int vboxsf_dirinfo(u32 root, u64 handle,
+                   struct shfl_string *parsed_path, u32 flags, u32 index,
+                   u32 *buf_len, struct shfl_dirinfo *buf, u32 *file_count)
+{
+        struct shfl_list parms;
+        int err, status;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.handle.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.handle.u.value64 = handle;
+        parms.flags.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.flags.u.value32 = flags;
+        parms.cb.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.cb.u.value32 = *buf_len;
+        if (parsed_path) {
+                parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+                parms.path.u.pointer.size = shfl_string_buf_size(parsed_path);
+                parms.path.u.pointer.u.linear_addr = (uintptr_t)parsed_path;
+        } else {
+                parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_IN;
+                parms.path.u.pointer.size = 0;
+                parms.path.u.pointer.u.linear_addr = 0;
+        }
+        parms.buffer.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT;
+        parms.buffer.u.pointer.size = *buf_len;
+        parms.buffer.u.pointer.u.linear_addr = (uintptr_t)buf;
+        parms.resume_point.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.resume_point.u.value32 = index;
+        parms.file_count.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.file_count.u.value32 = 0; /* out parameter only */
+        err = vboxsf_call(SHFL_FN_LIST, &parms, SHFL_CPARMS_LIST, &status);
+        if (err == -ENODATA && status == VERR_NO_MORE_FILES)
+                err = 1;
+        *buf_len = parms.cb.u.value32;
+        *file_count = parms.file_count.u.value32;
+        return err;
+}
+int vboxsf_fsinfo(u32 root, u64 handle, u32 flags,
+                  u32 *buf_len, void *buf)
+{
+        struct shfl_information parms;
+        int err;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.handle.type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+        parms.handle.u.value64 = handle;
+        parms.flags.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.flags.u.value32 = flags;
+        parms.cb.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.cb.u.value32 = *buf_len;
+        parms.info.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL;
+        parms.info.u.pointer.size = *buf_len;
+        parms.info.u.pointer.u.linear_addr = (uintptr_t)buf;
+        err = vboxsf_call(SHFL_FN_INFORMATION, &parms, SHFL_CPARMS_INFORMATION,
+                          NULL);
+        *buf_len = parms.cb.u.value32;
+        return err;
+}
+int vboxsf_readlink(u32 root, struct shfl_string *parsed_path,
+                    u32 buf_len, u8 *buf)
+{
+        struct shfl_readLink parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.path.u.pointer.size = shfl_string_buf_size(parsed_path);
+        parms.path.u.pointer.u.linear_addr = (uintptr_t)parsed_path;
+        parms.buffer.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT;
+        parms.buffer.u.pointer.size = buf_len;
+        parms.buffer.u.pointer.u.linear_addr = (uintptr_t)buf;
+        return vboxsf_call(SHFL_FN_READLINK, &parms, SHFL_CPARMS_READLINK,
+                           NULL);
+}
+int vboxsf_symlink(u32 root, struct shfl_string *new_path,
+                   struct shfl_string *old_path, struct shfl_fsobjinfo *buf)
+{
+        struct shfl_symlink parms;
+        parms.root.type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+        parms.root.u.value32 = root;
+        parms.new_path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.new_path.u.pointer.size = shfl_string_buf_size(new_path);
+        parms.new_path.u.pointer.u.linear_addr = (uintptr_t)new_path;
+        parms.old_path.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN;
+        parms.old_path.u.pointer.size = shfl_string_buf_size(old_path);
+        parms.old_path.u.pointer.u.linear_addr = (uintptr_t)old_path;
+        parms.info.type = VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT;
+        parms.info.u.pointer.size = sizeof(struct shfl_fsobjinfo);
+        parms.info.u.pointer.u.linear_addr = (uintptr_t)buf;
+        return vboxsf_call(SHFL_FN_SYMLINK, &parms, SHFL_CPARMS_SYMLINK, NULL);
+}
+int vboxsf_set_utf8(void)
+{
+        return vboxsf_call(SHFL_FN_SET_UTF8, NULL, 0, NULL);
+}
+int vboxsf_set_symlinks(void)
+{
+        return vboxsf_call(SHFL_FN_SET_SYMLINKS, NULL, 0, NULL);
+}
diff --git a/drivers/staging/vboxsf/vfsmod.h b/drivers/staging/vboxsf/vfsmod.h
new file mode 100644
index 000000000000..18f95b00fc33
--- /dev/null
+++ b/drivers/staging/vboxsf/vfsmod.h
@@ -0,0 +1,137 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * VirtualBox Guest Shared Folders support: module header.
+ *
+ * Copyright (C) 2006-2018 Oracle Corporation
+ */
+#ifndef VFSMOD_H
+#define VFSMOD_H
+#include <linux/backing-dev.h>
+#include <linux/idr.h>
+#include "shfl_hostintf.h"
+#define DIR_BUFFER_SIZE SZ_16K
+/* The cast is to prevent assignment of void * to pointers of arbitrary type */
+#define VBOXSF_SBI(sb)  ((struct vboxsf_sbi *)(sb)->s_fs_info)
+#define VBOXSF_I(i)     container_of(i, struct vboxsf_inode, vfs_inode)
+struct vboxsf_options {
+        unsigned long ttl;
+        kuid_t uid;
+        kgid_t gid;
+        bool dmode_set;
+        bool fmode_set;
+        umode_t dmode;
+        umode_t fmode;
+        umode_t dmask;
+        umode_t fmask;
+};
+struct vboxsf_fs_context {
+        struct vboxsf_options o;
+        char *nls_name;
+};
+/* per-shared folder information */
+struct vboxsf_sbi {
+        struct vboxsf_options o;
+        struct shfl_fsobjinfo root_info;
+        struct idr ino_idr;
+        spinlock_t ino_idr_lock; /* This protects ino_idr */
+        struct nls_table *nls;
+        u32 next_generation;
+        u32 root;
+        int bdi_id;
+};
+/* per-inode information */
+struct vboxsf_inode {
+        /* some information was changed, update data on next revalidate */
+        int force_restat;
+        /* list of open handles for this inode + lock protecting it */
+        struct list_head handle_list;
+        /* This mutex protects handle_list accesses */
+        struct mutex handle_list_mutex;
+        /* The VFS inode struct */
+        struct inode vfs_inode;
+};
+struct vboxsf_dir_info {
+        struct list_head info_list;
+};
+struct vboxsf_dir_buf {
+        size_t entries;
+        size_t free;
+        size_t used;
+        void *buf;
+        struct list_head head;
+};
+/* globals */
+extern const struct inode_operations vboxsf_dir_iops;
+extern const struct inode_operations vboxsf_lnk_iops;
+extern const struct inode_operations vboxsf_reg_iops;
+extern const struct file_operations vboxsf_dir_fops;
+extern const struct file_operations vboxsf_reg_fops;
+extern const struct address_space_operations vboxsf_reg_aops;
+extern const struct dentry_operations vboxsf_dentry_ops;
+/* from utils.c */
+struct inode *vboxsf_new_inode(struct super_block *sb);
+void vboxsf_init_inode(struct vboxsf_sbi *sbi, struct inode *inode,
+                       const struct shfl_fsobjinfo *info);
+int vboxsf_create_at_dentry(struct dentry *dentry,
+                            struct shfl_createparms *params);
+int vboxsf_stat(struct vboxsf_sbi *sbi, struct shfl_string *path,
+                struct shfl_fsobjinfo *info);
+int vboxsf_stat_dentry(struct dentry *dentry, struct shfl_fsobjinfo *info);
+int vboxsf_inode_revalidate(struct dentry *dentry);
+int vboxsf_getattr(const struct path *path, struct kstat *kstat,
+                   u32 request_mask, unsigned int query_flags);
+int vboxsf_setattr(struct dentry *dentry, struct iattr *iattr);
+struct shfl_string *vboxsf_path_from_dentry(struct vboxsf_sbi *sbi,
+                                            struct dentry *dentry);
+int vboxsf_nlscpy(struct vboxsf_sbi *sbi, char *name, size_t name_bound_len,
+                  const unsigned char *utf8_name, size_t utf8_len);
+struct vboxsf_dir_info *vboxsf_dir_info_alloc(void);
+void vboxsf_dir_info_free(struct vboxsf_dir_info *p);
+int vboxsf_dir_read_all(struct vboxsf_sbi *sbi, struct vboxsf_dir_info *sf_d,
+                        u64 handle);
+/* from vboxsf_wrappers.c */
+int vboxsf_connect(void);
+void vboxsf_disconnect(void);
+int vboxsf_create(u32 root, struct shfl_string *parsed_path,
+                  struct shfl_createparms *create_parms);
+int vboxsf_close(u32 root, u64 handle);
+int vboxsf_remove(u32 root, struct shfl_string *parsed_path, u32 flags);
+int vboxsf_rename(u32 root, struct shfl_string *src_path,
+                  struct shfl_string *dest_path, u32 flags);
+int vboxsf_read(u32 root, u64 handle, u64 offset, u32 *buf_len, u8 *buf);
+int vboxsf_write(u32 root, u64 handle, u64 offset, u32 *buf_len, u8 *buf);
+int vboxsf_dirinfo(u32 root, u64 handle,
+                   struct shfl_string *parsed_path, u32 flags, u32 index,
+                   u32 *buf_len, struct shfl_dirinfo *buf, u32 *file_count);
+int vboxsf_fsinfo(u32 root, u64 handle, u32 flags,
+                  u32 *buf_len, void *buf);
+int vboxsf_map_folder(struct shfl_string *folder_name, u32 *root);
+int vboxsf_unmap_folder(u32 root);
+int vboxsf_readlink(u32 root, struct shfl_string *parsed_path,
+                    u32 buf_len, u8 *buf);
+int vboxsf_symlink(u32 root, struct shfl_string *new_path,
+                   struct shfl_string *old_path, struct shfl_fsobjinfo *buf);
+int vboxsf_set_utf8(void);
+int vboxsf_set_symlinks(void);
+#endif
diff --git a/drivers/thunderbolt/nhi_ops.c b/drivers/thunderbolt/nhi_ops.c
index 61cd09cef943..6795851aac95 100644
--- a/drivers/thunderbolt/nhi_ops.c
+++ b/drivers/thunderbolt/nhi_ops.c
@@ -80,7 +80,6 @@ static void icl_nhi_lc_mailbox_cmd(struct tb_nhi *nhi, enum icl_lc_mailbox_cmd c
 {
        u32 data;
-        pci_read_config_dword(nhi->pdev, VS_CAP_19, &data);
        data = (cmd << VS_CAP_19_CMD_SHIFT) & VS_CAP_19_CMD_MASK;
        pci_write_config_dword(nhi->pdev, VS_CAP_19, data | VS_CAP_19_VALID);
 }
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 410bf1bceeee..5ea8db667e83 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -896,12 +896,13 @@ int tb_dp_port_set_hops(struct tb_port *port, unsigned int video,
 */
 bool tb_dp_port_is_enabled(struct tb_port *port)
 {
-        u32 data;
+        u32 data[2];
-        if (tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1))
+        if (tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
+                         ARRAY_SIZE(data)))
                return false;
-        return !!(data & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
+        return !!(data[0] & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
 }
 /**
@@ -914,19 +915,21 @@ bool tb_dp_port_is_enabled(struct tb_port *port)
 */
 int tb_dp_port_enable(struct tb_port *port, bool enable)
 {
-        u32 data;
+        u32 data[2];
        int ret;
-        ret = tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1);
+        ret = tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
+                           ARRAY_SIZE(data));
        if (ret)
                return ret;
        if (enable)
-                data |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
+                data[0] |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
        else
-                data &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
+                data[0] &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
-        return tb_port_write(port, &data, TB_CFG_PORT, port->cap_adap, 1);
+        return tb_port_write(port, data, TB_CFG_PORT, port->cap_adap,
+                             ARRAY_SIZE(data));
 }
 /* switch utility functions */
@@ -1031,13 +1034,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
        if (sw->authorized)
                goto unlock;
-        /*
-         * Make sure there is no PCIe rescan ongoing when a new PCIe
-         * tunnel is created. Otherwise the PCIe rescan code might find
-         * the new tunnel too early.
-         */
-        pci_lock_rescan_remove();
        switch (val) {
        /* Approve switch */
        case 1:
@@ -1057,8 +1053,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
                break;
        }
-        pci_unlock_rescan_remove();
        if (!ret) {
                sw->authorized = val;
                /* Notify status change to the userspace */
diff --git a/drivers/video/fbdev/c2p_core.h b/drivers/video/fbdev/c2p_core.h
index e1035a865fb9..45a6d895a7d7 100644
--- a/drivers/video/fbdev/c2p_core.h
+++ b/drivers/video/fbdev/c2p_core.h
@@ -29,7 +29,7 @@ static inline void _transp(u32 d[], unsigned int i1, unsigned int i2,
 extern void c2p_unsupported(void);
-static inline u32 get_mask(unsigned int n)
+static __always_inline u32 get_mask(unsigned int n)
 {
        switch (n) {
        case 1:
@@ -57,7 +57,7 @@ static inline u32 get_mask(unsigned int n)
     *  Transpose operations on 8 32-bit words
     */
-static inline void transp8(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp8(u32 d[], unsigned int n, unsigned int m)
 {
        u32 mask = get_mask(n);
@@ -99,7 +99,7 @@ static inline void transp8(u32 d[], unsigned int n, unsigned int m)
     *  Transpose operations on 4 32-bit words
     */
-static inline void transp4(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp4(u32 d[], unsigned int n, unsigned int m)
 {
        u32 mask = get_mask(n);
@@ -126,7 +126,7 @@ static inline void transp4(u32 d[], unsigned int n, unsigned int m)
     *  Transpose operations on 4 32-bit words (reverse order)
     */
-static inline void transp4x(u32 d[], unsigned int n, unsigned int m)
+static __always_inline void transp4x(u32 d[], unsigned int n, unsigned int m)
 {
        u32 mask = get_mask(n);
diff --git a/drivers/watchdog/bd70528_wdt.c b/drivers/watchdog/bd70528_wdt.c
index b0152fef4fc7..bc60e036627a 100644
--- a/drivers/watchdog/bd70528_wdt.c
+++ b/drivers/watchdog/bd70528_wdt.c
@@ -288,3 +288,4 @@ module_platform_driver(bd70528_wdt);
 MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
 MODULE_DESCRIPTION("BD70528 watchdog driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:bd70528-wdt");
diff --git a/drivers/watchdog/cpwd.c b/drivers/watchdog/cpwd.c
index 9393be584e72..808eeb4779e4 100644
--- a/drivers/watchdog/cpwd.c
+++ b/drivers/watchdog/cpwd.c
@@ -26,6 +26,7 @@
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/timer.h>
+#include <linux/compat.h>
 #include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/io.h>
@@ -473,6 +474,11 @@ static long cpwd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        return 0;
 }
+static long cpwd_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return cpwd_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+}
 static ssize_t cpwd_write(struct file *file, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
@@ -497,7 +503,7 @@ static ssize_t cpwd_read(struct file *file, char __user *buffer,
 static const struct file_operations cpwd_fops = {
        .owner =                THIS_MODULE,
        .unlocked_ioctl =       cpwd_ioctl,
-        .compat_ioctl =         compat_ptr_ioctl,
+        .compat_ioctl =         cpwd_compat_ioctl,
        .open =                 cpwd_open,
        .write =                cpwd_write,
        .read =                 cpwd_read,
diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c
index 7ea5cf54e94a..8ed89f032ebf 100644
--- a/drivers/watchdog/imx_sc_wdt.c
+++ b/drivers/watchdog/imx_sc_wdt.c
@@ -99,8 +99,14 @@ static int imx_sc_wdt_set_pretimeout(struct watchdog_device *wdog,
 {
        struct arm_smccc_res res;
+        /*
+         * SCU firmware calculates pretimeout based on current time
+         * stamp instead of watchdog timeout stamp, need to convert
+         * the pretimeout to SCU firmware's timeout value.
+         */
        arm_smccc_smc(IMX_SIP_TIMER, IMX_SIP_TIMER_SET_PRETIME_WDOG,
-                      pretimeout * 1000, 0, 0, 0, 0, 0, &res);
+                      (wdog->timeout - pretimeout) * 1000, 0, 0, 0,
+                      0, 0, &res);
        if (res.a0)
                return -EACCES;
diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
index d17c1a6ed723..5a9ca10fbcfa 100644
--- a/drivers/watchdog/meson_gxbb_wdt.c
+++ b/drivers/watchdog/meson_gxbb_wdt.c
@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
        reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
-        return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+        return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
-                (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
+                (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
 }
 static const struct watchdog_ops meson_gxbb_wdt_ops = {
diff --git a/drivers/watchdog/pm8916_wdt.c b/drivers/watchdog/pm8916_wdt.c
index 2d3652004e39..1213179f863c 100644
--- a/drivers/watchdog/pm8916_wdt.c
+++ b/drivers/watchdog/pm8916_wdt.c
@@ -163,9 +163,17 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        if (irq > 0) {
-                if (devm_request_irq(dev, irq, pm8916_wdt_isr, 0, "pm8916_wdt",
+                err = devm_request_irq(dev, irq, pm8916_wdt_isr, 0,
-                                     wdt))
+                                       "pm8916_wdt", wdt);
-                        irq = 0;
+                if (err)
+                        return err;
+                wdt->wdev.info = &pm8916_wdt_pt_ident;
+        } else {
+                if (irq == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                wdt->wdev.info = &pm8916_wdt_ident;
        }
        /* Configure watchdog to hard-reset mode */
@@ -177,7 +185,6 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
                return err;
        }
-        wdt->wdev.info = (irq > 0) ? &pm8916_wdt_pt_ident : &pm8916_wdt_ident,
        wdt->wdev.ops = &pm8916_wdt_ops,
        wdt->wdev.parent = dev;
        wdt->wdev.min_timeout = PM8916_WDT_MIN_TIMEOUT;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c3f386b7cc0b..c6dc4dd16cf7 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -474,6 +474,7 @@ static noinline int compress_file_range(struct async_chunk *async_chunk)
        u64 start = async_chunk->start;
        u64 end = async_chunk->end;
        u64 actual_end;
+        u64 i_size;
        int ret = 0;
        struct page **pages = NULL;
        unsigned long nr_pages;
@@ -488,7 +489,19 @@ static noinline int compress_file_range(struct async_chunk *async_chunk)
        inode_should_defrag(BTRFS_I(inode), start, end, end - start + 1,
                        SZ_16K);
-        actual_end = min_t(u64, i_size_read(inode), end + 1);
+        /*
+         * We need to save i_size before now because it could change in between
+         * us evaluating the size and assigning it.  This is because we lock and
+         * unlock the page in truncate and fallocate, and then modify the i_size
+         * later on.
+         *
+         * The barriers are to emulate READ_ONCE, remove that once i_size_read
+         * does that for us.
+         */
+        barrier();
+        i_size = i_size_read(inode);
+        barrier();
+        actual_end = min_t(u64, i_size, end + 1);
 again:
        will_compress = 0;
        nr_pages = (end >> PAGE_SHIFT) - (start >> PAGE_SHIFT) + 1;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7c145a41decd..23272d9154f3 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4195,9 +4195,6 @@ static noinline long btrfs_ioctl_start_sync(struct btrfs_root *root,
        u64 transid;
        int ret;
-        btrfs_warn(root->fs_info,
-        "START_SYNC ioctl is deprecated and will be removed in kernel 5.7");
        trans = btrfs_attach_transaction_barrier(root);
        if (IS_ERR(trans)) {
                if (PTR_ERR(trans) != -ENOENT)
@@ -4225,9 +4222,6 @@ static noinline long btrfs_ioctl_wait_sync(struct btrfs_fs_info *fs_info,
 {
        u64 transid;
-        btrfs_warn(fs_info,
-                "WAIT_SYNC ioctl is deprecated and will be removed in kernel 5.7");
        if (argp) {
                if (copy_from_user(&transid, argp, sizeof(transid)))
                        return -EFAULT;
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 98dc092a905e..e8a4b0ebe97f 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -893,6 +893,15 @@ static void wait_reserve_ticket(struct btrfs_fs_info *fs_info,
        while (ticket->bytes > 0 && ticket->error == 0) {
                ret = prepare_to_wait_event(&ticket->wait, &wait, TASK_KILLABLE);
                if (ret) {
+                        /*
+                         * Delete us from the list. After we unlock the space
+                         * info, we don't want the async reclaim job to reserve
+                         * space for this ticket. If that would happen, then the
+                         * ticket's task would not known that space was reserved
+                         * despite getting an error, resulting in a space leak
+                         * (bytes_may_use counter of our space_info).
+                         */
+                        list_del_init(&ticket->list);
                        ticket->error = -EINTR;
                        break;
                }
@@ -945,12 +954,24 @@ static int handle_reserve_ticket(struct btrfs_fs_info *fs_info,
        spin_lock(&space_info->lock);
        ret = ticket->error;
        if (ticket->bytes || ticket->error) {
+                /*
+                 * Need to delete here for priority tickets. For regular tickets
+                 * either the async reclaim job deletes the ticket from the list
+                 * or we delete it ourselves at wait_reserve_ticket().
+                 */
                list_del_init(&ticket->list);
                if (!ret)
                        ret = -ENOSPC;
        }
        spin_unlock(&space_info->lock);
        ASSERT(list_empty(&ticket->list));
+        /*
+         * Check that we can't have an error set if the reservation succeeded,
+         * as that would confuse tasks and lead them to error out without
+         * releasing reserved space (if an error happens the expectation is that
+         * space wasn't reserved at all).
+         */
+        ASSERT(!(ticket->bytes == 0 && ticket->error));
        return ret;
 }
diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index 43e488f5d063..076d5b8014fb 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -686,9 +686,7 @@ static void dev_item_err(const struct extent_buffer *eb, int slot,
 static int check_dev_item(struct extent_buffer *leaf,
                          struct btrfs_key *key, int slot)
 {
-        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_dev_item *ditem;
-        u64 max_devid = max(BTRFS_MAX_DEVS(fs_info), BTRFS_MAX_DEVS_SYS_CHUNK);
        if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) {
                dev_item_err(leaf, slot,
@@ -696,12 +694,6 @@ static int check_dev_item(struct extent_buffer *leaf,
                             key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
                return -EUCLEAN;
        }
-        if (key->offset > max_devid) {
-                dev_item_err(leaf, slot,
-                             "invalid devid: has=%llu expect=[0, %llu]",
-                             key->offset, max_devid);
-                return -EUCLEAN;
-        }
        ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
        if (btrfs_device_id(leaf, ditem) != key->offset) {
                dev_item_err(leaf, slot,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index bdfe4493e43a..e04409f85063 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4967,6 +4967,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
        } else if (type & BTRFS_BLOCK_GROUP_SYSTEM) {
                max_stripe_size = SZ_32M;
                max_chunk_size = 2 * max_stripe_size;
+                devs_max = min_t(int, devs_max, BTRFS_MAX_DEVS_SYS_CHUNK);
        } else {
                btrfs_err(info, "invalid chunk type 0x%llx requested",
                       type);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index d3b9c9d5c1bd..f5a38910a82b 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1058,6 +1058,11 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
        dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+        /* remove from inode's cap rbtree, and clear auth cap */
+        rb_erase(&cap->ci_node, &ci->i_caps);
+        if (ci->i_auth_cap == cap)
+                ci->i_auth_cap = NULL;
        /* remove from session list */
        spin_lock(&session->s_cap_lock);
        if (session->s_cap_iterator == cap) {
@@ -1091,11 +1096,6 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
        spin_unlock(&session->s_cap_lock);
-        /* remove from inode list */
-        rb_erase(&cap->ci_node, &ci->i_caps);
-        if (ci->i_auth_cap == cap)
-                ci->i_auth_cap = NULL;
        if (removed)
                ceph_put_cap(mdsc, cap);
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 4ca0b8ff9a72..d17a789fd856 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1553,36 +1553,37 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
        int valid = 0;
        struct dentry *parent;
-        struct inode *dir;
+        struct inode *dir, *inode;
        if (flags & LOOKUP_RCU) {
                parent = READ_ONCE(dentry->d_parent);
                dir = d_inode_rcu(parent);
                if (!dir)
                        return -ECHILD;
+                inode = d_inode_rcu(dentry);
        } else {
                parent = dget_parent(dentry);
                dir = d_inode(parent);
+                inode = d_inode(dentry);
        }
        dout("d_revalidate %p '%pd' inode %p offset %lld\n", dentry,
-             dentry, d_inode(dentry), ceph_dentry(dentry)->offset);
+             dentry, inode, ceph_dentry(dentry)->offset);
        /* always trust cached snapped dentries, snapdir dentry */
        if (ceph_snap(dir) != CEPH_NOSNAP) {
                dout("d_revalidate %p '%pd' inode %p is SNAPPED\n", dentry,
-                     dentry, d_inode(dentry));
+                     dentry, inode);
                valid = 1;
-        } else if (d_really_is_positive(dentry) &&
+        } else if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
-                   ceph_snap(d_inode(dentry)) == CEPH_SNAPDIR) {
                valid = 1;
        } else {
                valid = dentry_lease_is_valid(dentry, flags);
                if (valid == -ECHILD)
                        return valid;
                if (valid || dir_lease_is_valid(dir, dentry)) {
-                        if (d_really_is_positive(dentry))
+                        if (inode)
-                                valid = ceph_is_any_caps(d_inode(dentry));
+                                valid = ceph_is_any_caps(inode);
                        else
                                valid = 1;
                }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index d277f71abe0b..bd77adb64bfd 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -462,6 +462,9 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
                err = ceph_security_init_secctx(dentry, mode, &as_ctx);
                if (err < 0)
                        goto out_ctx;
+        } else if (!d_in_lookup(dentry)) {
+                /* If it's not being looked up, it's negative */
+                return -ENOENT;
        }
        /* do the open */
@@ -1956,10 +1959,18 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
        if (ceph_test_mount_opt(src_fsc, NOCOPYFROM))
                return -EOPNOTSUPP;
+        /*
+         * Striped file layouts require that we copy partial objects, but the
+         * OSD copy-from operation only supports full-object copies.  Limit
+         * this to non-striped file layouts for now.
+         */
        if ((src_ci->i_layout.stripe_unit != dst_ci->i_layout.stripe_unit) ||
-            (src_ci->i_layout.stripe_count != dst_ci->i_layout.stripe_count) ||
+            (src_ci->i_layout.stripe_count != 1) ||
-            (src_ci->i_layout.object_size != dst_ci->i_layout.object_size))
+            (dst_ci->i_layout.stripe_count != 1) ||
+            (src_ci->i_layout.object_size != dst_ci->i_layout.object_size)) {
+                dout("Invalid src/dst files layout\n");
                return -EOPNOTSUPP;
+        }
        if (len < src_ci->i_layout.object_size)
                return -EOPNOTSUPP; /* no remote copy will be done */
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 9f135624ae47..c07407586ce8 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1434,6 +1434,7 @@ retry_lookup:
                dout(" final dn %p\n", dn);
        } else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
                    req->r_op == CEPH_MDS_OP_MKSNAP) &&
+                   test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) &&
                   !test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {
                struct inode *dir = req->r_parent;
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index edfd643a8205..b47f43fc2d68 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -268,6 +268,7 @@ static int parse_fsopt_token(char *c, void *private)
                }
                break;
        case Opt_fscache_uniq:
+#ifdef CONFIG_CEPH_FSCACHE
                kfree(fsopt->fscache_uniq);
                fsopt->fscache_uniq = kstrndup(argstr[0].from,
                                               argstr[0].to-argstr[0].from,
@@ -276,7 +277,10 @@ static int parse_fsopt_token(char *c, void *private)
                        return -ENOMEM;
                fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
                break;
-                /* misc */
+#else
+                pr_err("fscache support is disabled\n");
+                return -EINVAL;
+#endif
        case Opt_wsize:
                if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
                        return -EINVAL;
@@ -353,10 +357,15 @@ static int parse_fsopt_token(char *c, void *private)
                fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
                break;
        case Opt_fscache:
+#ifdef CONFIG_CEPH_FSCACHE
                fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
                kfree(fsopt->fscache_uniq);
                fsopt->fscache_uniq = NULL;
                break;
+#else
+                pr_err("fscache support is disabled\n");
+                return -EINVAL;
+#endif
        case Opt_nofscache:
                fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
                kfree(fsopt->fscache_uniq);
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index ea735d59c36e..0abfde6d0b05 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -838,6 +838,7 @@ struct create_durable_handle_reconnect_v2 {
        struct create_context ccontext;
        __u8   Name[8];
        struct durable_reconnect_context_v2 dcontext;
+        __u8   Pad[4];
 } __packed;
 /* See MS-SMB2 2.2.13.2.5 */
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index dc5dbf6a81d7..cb61467478ca 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -101,7 +101,7 @@ static int create_link(struct config_item *parent_item,
        }
        target_sd->s_links++;
        spin_unlock(&configfs_dirent_lock);
-        ret = configfs_get_target_path(item, item, body);
+        ret = configfs_get_target_path(parent_item, item, body);
        if (!ret)
                ret = configfs_create_link(target_sd, parent_item->ci_dentry,
                                           dentry, body);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 8461a6322039..335607b8c5c0 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -576,10 +576,13 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc,
        spin_unlock(&inode->i_lock);
        /*
-         * A dying wb indicates that the memcg-blkcg mapping has changed
+         * A dying wb indicates that either the blkcg associated with the
-         * and a new wb is already serving the memcg.  Switch immediately.
+         * memcg changed or the associated memcg is dying.  In the first
+         * case, a replacement wb should already be available and we should
+         * refresh the wb immediately.  In the second case, trying to
+         * refresh will keep failing.
         */
-        if (unlikely(wb_dying(wbc->wb)))
+        if (unlikely(wb_dying(wbc->wb) && !css_is_dying(wbc->wb->memcg_css)))
                inode_switch_wbs(inode, wbc->wb_id);
 }
 EXPORT_SYMBOL_GPL(wbc_attach_and_unlock_inode);
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 53939bf9d7d2..9876db52913a 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2098,53 +2098,89 @@ static int ocfs2_is_io_unaligned(struct inode *inode, size_t count, loff_t pos)
        return 0;
 }
-static int ocfs2_prepare_inode_for_refcount(struct inode *inode,
+static int ocfs2_inode_lock_for_extent_tree(struct inode *inode,
-                                            struct file *file,
+                                            struct buffer_head **di_bh,
-                                            loff_t pos, size_t count,
+                                            int meta_level,
-                                            int *meta_level)
+                                            int overwrite_io,
+                                            int write_sem,
+                                            int wait)
 {
-        int ret;
+        int ret = 0;
-        struct buffer_head *di_bh = NULL;
-        u32 cpos = pos >> OCFS2_SB(inode->i_sb)->s_clustersize_bits;
-        u32 clusters =
-                ocfs2_clusters_for_bytes(inode->i_sb, pos + count) - cpos;
-        ret = ocfs2_inode_lock(inode, &di_bh, 1);
+        if (wait)
-        if (ret) {
+                ret = ocfs2_inode_lock(inode, NULL, meta_level);
-                mlog_errno(ret);
+        else
+                ret = ocfs2_try_inode_lock(inode,
+                        overwrite_io ? NULL : di_bh, meta_level);
+        if (ret < 0)
                goto out;
+        if (wait) {
+                if (write_sem)
+                        down_write(&OCFS2_I(inode)->ip_alloc_sem);
+                else
+                        down_read(&OCFS2_I(inode)->ip_alloc_sem);
+        } else {
+                if (write_sem)
+                        ret = down_write_trylock(&OCFS2_I(inode)->ip_alloc_sem);
+                else
+                        ret = down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem);
+                if (!ret) {
+                        ret = -EAGAIN;
+                        goto out_unlock;
+                }
        }
-        *meta_level = 1;
+        return ret;
-        ret = ocfs2_refcount_cow(inode, di_bh, cpos, clusters, UINT_MAX);
+out_unlock:
-        if (ret)
+        brelse(*di_bh);
-                mlog_errno(ret);
+        ocfs2_inode_unlock(inode, meta_level);
 out:
-        brelse(di_bh);
        return ret;
 }
+static void ocfs2_inode_unlock_for_extent_tree(struct inode *inode,
+                                               struct buffer_head **di_bh,
+                                               int meta_level,
+                                               int write_sem)
+{
+        if (write_sem)
+                up_write(&OCFS2_I(inode)->ip_alloc_sem);
+        else
+                up_read(&OCFS2_I(inode)->ip_alloc_sem);
+        brelse(*di_bh);
+        *di_bh = NULL;
+        if (meta_level >= 0)
+                ocfs2_inode_unlock(inode, meta_level);
+}
 static int ocfs2_prepare_inode_for_write(struct file *file,
                                         loff_t pos, size_t count, int wait)
 {
        int ret = 0, meta_level = 0, overwrite_io = 0;
+        int write_sem = 0;
        struct dentry *dentry = file->f_path.dentry;
        struct inode *inode = d_inode(dentry);
        struct buffer_head *di_bh = NULL;
+        u32 cpos;
+        u32 clusters;
        /*
         * We start with a read level meta lock and only jump to an ex
         * if we need to make modifications here.
         */
        for(;;) {
-                if (wait)
+                ret = ocfs2_inode_lock_for_extent_tree(inode,
-                        ret = ocfs2_inode_lock(inode, NULL, meta_level);
+                                                       &di_bh,
-                else
+                                                       meta_level,
-                        ret = ocfs2_try_inode_lock(inode,
+                                                       overwrite_io,
-                                overwrite_io ? NULL : &di_bh, meta_level);
+                                                       write_sem,
+                                                       wait);
                if (ret < 0) {
-                        meta_level = -1;
                        if (ret != -EAGAIN)
                                mlog_errno(ret);
                        goto out;
@@ -2156,15 +2192,8 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
                 */
                if (!wait && !overwrite_io) {
                        overwrite_io = 1;
-                        if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) {
-                                ret = -EAGAIN;
-                                goto out_unlock;
-                        }
                        ret = ocfs2_overwrite_io(inode, di_bh, pos, count);
-                        brelse(di_bh);
-                        di_bh = NULL;
-                        up_read(&OCFS2_I(inode)->ip_alloc_sem);
                        if (ret < 0) {
                                if (ret != -EAGAIN)
                                        mlog_errno(ret);
@@ -2183,7 +2212,10 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
                 * set inode->i_size at the end of a write. */
                if (should_remove_suid(dentry)) {
                        if (meta_level == 0) {
-                                ocfs2_inode_unlock(inode, meta_level);
+                                ocfs2_inode_unlock_for_extent_tree(inode,
+                                                                   &di_bh,
+                                                                   meta_level,
+                                                                   write_sem);
                                meta_level = 1;
                                continue;
                        }
@@ -2197,18 +2229,32 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
                ret = ocfs2_check_range_for_refcount(inode, pos, count);
                if (ret == 1) {
-                        ocfs2_inode_unlock(inode, meta_level);
+                        ocfs2_inode_unlock_for_extent_tree(inode,
-                        meta_level = -1;
+                                                           &di_bh,
+                                                           meta_level,
-                        ret = ocfs2_prepare_inode_for_refcount(inode,
+                                                           write_sem);
-                                                               file,
+                        ret = ocfs2_inode_lock_for_extent_tree(inode,
-                                                               pos,
+                                                               &di_bh,
-                                                               count,
+                                                               meta_level,
-                                                               &meta_level);
+                                                               overwrite_io,
+                                                               1,
+                                                               wait);
+                        write_sem = 1;
+                        if (ret < 0) {
+                                if (ret != -EAGAIN)
+                                        mlog_errno(ret);
+                                goto out;
+                        }
+                        cpos = pos >> OCFS2_SB(inode->i_sb)->s_clustersize_bits;
+                        clusters =
+                                ocfs2_clusters_for_bytes(inode->i_sb, pos + count) - cpos;
+                        ret = ocfs2_refcount_cow(inode, di_bh, cpos, clusters, UINT_MAX);
                }
                if (ret < 0) {
-                        mlog_errno(ret);
+                        if (ret != -EAGAIN)
+                                mlog_errno(ret);
                        goto out_unlock;
                }
@@ -2219,10 +2265,10 @@ out_unlock:
        trace_ocfs2_prepare_inode_for_write(OCFS2_I(inode)->ip_blkno,
                                            pos, count, wait);
-        brelse(di_bh);
+        ocfs2_inode_unlock_for_extent_tree(inode,
+                                           &di_bh,
-        if (meta_level >= 0)
+                                           meta_level,
-                ocfs2_inode_unlock(inode, meta_level);
+                                           write_sem);
 out:
        return ret;
diff --git a/include/asm-generic/vdso/vsyscall.h b/include/asm-generic/vdso/vsyscall.h
index e94b19782c92..ce4103208619 100644
--- a/include/asm-generic/vdso/vsyscall.h
+++ b/include/asm-generic/vdso/vsyscall.h
@@ -25,13 +25,6 @@ static __always_inline int __arch_get_clock_mode(struct timekeeper *tk)
 }
 #endif /* __arch_get_clock_mode */
-#ifndef __arch_use_vsyscall
-static __always_inline int __arch_use_vsyscall(struct vdso_data *vdata)
-{
-        return 1;
-}
-#endif /* __arch_use_vsyscall */
 #ifndef __arch_update_vsyscall
 static __always_inline void __arch_update_vsyscall(struct vdso_data *vdata,
                                                   struct timekeeper *tk)
diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h
index 01f514521687..7865e6b5d36c 100644
--- a/include/drm/drm_gem_shmem_helper.h
+++ b/include/drm/drm_gem_shmem_helper.h
@@ -44,7 +44,20 @@ struct drm_gem_shmem_object {
         */
        unsigned int pages_use_count;
+        /**
+         * @madv: State for madvise
+         *
+         * 0 is active/inuse.
+         * A negative value is the object is purged.
+         * Positive values are driver specific and not used by the helpers.
+         */
        int madv;
+        /**
+         * @madv_list: List entry for madvise tracking
+         *
+         * Typically used by drivers to track purgeable objects
+         */
        struct list_head madv_list;
        /**
diff --git a/include/drm/drm_self_refresh_helper.h b/include/drm/drm_self_refresh_helper.h
index 5b79d253fb46..520235c20708 100644
--- a/include/drm/drm_self_refresh_helper.h
+++ b/include/drm/drm_self_refresh_helper.h
@@ -13,7 +13,8 @@ struct drm_crtc;
 void drm_self_refresh_helper_alter_state(struct drm_atomic_state *state);
 void drm_self_refresh_helper_update_avg_times(struct drm_atomic_state *state,
-                                              unsigned int commit_time_ms);
+                                        unsigned int commit_time_ms,
+                                        unsigned int new_self_refresh_mask);
 int drm_self_refresh_helper_init(struct drm_crtc *crtc);
 void drm_self_refresh_helper_cleanup(struct drm_crtc *crtc);
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 5b9d22338606..3bf3835d0e86 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -656,11 +656,11 @@ void bpf_map_put_with_uref(struct bpf_map *map);
 void bpf_map_put(struct bpf_map *map);
 int bpf_map_charge_memlock(struct bpf_map *map, u32 pages);
 void bpf_map_uncharge_memlock(struct bpf_map *map, u32 pages);
-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size);
+int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size);
 void bpf_map_charge_finish(struct bpf_map_memory *mem);
 void bpf_map_charge_move(struct bpf_map_memory *dst,
                         struct bpf_map_memory *src);
-void *bpf_map_area_alloc(size_t size, int numa_node);
+void *bpf_map_area_alloc(u64 size, int numa_node);
 void bpf_map_area_free(void *base);
 void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
diff --git a/include/linux/idr.h b/include/linux/idr.h
index 4ec8986e5dfb..ac6e946b6767 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
 * is convenient for a "not found" value.
 */
 #define idr_for_each_entry(idr, entry, id)                      \
-        for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
+        for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
 /**
 * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
diff --git a/include/linux/mm.h b/include/linux/mm.h
index cc292273e6ba..a2adf95b3f9c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -695,11 +695,6 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
 extern void kvfree(const void *addr);
-static inline atomic_t *compound_mapcount_ptr(struct page *page)
-{
-        return &page[1].compound_mapcount;
-}
 static inline int compound_mapcount(struct page *page)
 {
        VM_BUG_ON_PAGE(!PageCompound(page), page);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 2222fa795284..270aa8fd2800 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -221,6 +221,11 @@ struct page {
 #endif
 } _struct_page_alignment;
+static inline atomic_t *compound_mapcount_ptr(struct page *page)
+{
+        return &page[1].compound_mapcount;
+}
 /*
 * Used for sizing the vmemmap region on some architectures
 */
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index f91cb8898ff0..1bf83c8fcaa7 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -622,12 +622,28 @@ static inline int PageTransCompound(struct page *page)
 *
 * Unlike PageTransCompound, this is safe to be called only while
 * split_huge_pmd() cannot run from under us, like if protected by the
- * MMU notifier, otherwise it may result in page->_mapcount < 0 false
+ * MMU notifier, otherwise it may result in page->_mapcount check false
 * positives.
+ *
+ * We have to treat page cache THP differently since every subpage of it
+ * would get _mapcount inc'ed once it is PMD mapped.  But, it may be PTE
+ * mapped in the current process so comparing subpage's _mapcount to
+ * compound_mapcount to filter out PTE mapped case.
 */
 static inline int PageTransCompoundMap(struct page *page)
 {
-        return PageTransCompound(page) && atomic_read(&page->_mapcount) < 0;
+        struct page *head;
+        if (!PageTransCompound(page))
+                return 0;
+        if (PageAnon(page))
+                return atomic_read(&page->_mapcount) < 0;
+        head = compound_head(page);
+        /* File THP is PMD mapped and not PTE mapped */
+        return atomic_read(&page->_mapcount) ==
+               atomic_read(compound_mapcount_ptr(head));
 }
 /*
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index b5116013f27e..63e62372443a 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -316,24 +316,6 @@ radix_tree_iter_lookup(const struct radix_tree_root *root,
 }
 /**
- * radix_tree_iter_find - find a present entry
- * @root: radix tree root
- * @iter: iterator state
- * @index: start location
- *
- * This function returns the slot containing the entry with the lowest index
- * which is at least @index.  If @index is larger than any present entry, this
- * function returns NULL.  The @iter is updated to describe the entry found.
- */
-static inline void __rcu **
-radix_tree_iter_find(const struct radix_tree_root *root,
-                        struct radix_tree_iter *iter, unsigned long index)
-{
-        radix_tree_iter_init(iter, index);
-        return radix_tree_next_chunk(root, iter, 0);
-}
-/**
 * radix_tree_iter_retry - retry this chunk of the iteration
 * @iter:       iterator state
 *
diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
index 9326d671b6e6..eaae6b4e9f24 100644
--- a/include/linux/reset-controller.h
+++ b/include/linux/reset-controller.h
@@ -7,7 +7,7 @@
 struct reset_controller_dev;
 /**
- * struct reset_control_ops
+ * struct reset_control_ops - reset controller driver callbacks
 *
 * @reset: for self-deasserting resets, does all necessary
 *         things to reset the device
@@ -33,7 +33,7 @@ struct of_phandle_args;
 * @provider: name of the reset controller device controlling this reset line
 * @index: ID of the reset controller in the reset controller device
 * @dev_id: name of the device associated with this reset line
- * @con_id name of the reset line (can be NULL)
+ * @con_id: name of the reset line (can be NULL)
 */
 struct reset_control_lookup {
        struct list_head list;
diff --git a/include/linux/reset.h b/include/linux/reset.h
index e7793fc0fa93..eb597e8aa430 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -143,7 +143,7 @@ static inline int device_reset_optional(struct device *dev)
 * If this function is called more than once for the same reset_control it will
 * return -EBUSY.
 *
- * See reset_control_get_shared for details on shared references to
+ * See reset_control_get_shared() for details on shared references to
 * reset-controls.
 *
 * Use of id names is optional.
diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index e4b3fb4bb77c..ce7055259877 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -139,6 +139,11 @@ static inline void sk_msg_apply_bytes(struct sk_psock *psock, u32 bytes)
        }
 }
+static inline u32 sk_msg_iter_dist(u32 start, u32 end)
+{
+        return end >= start ? end - start : end + (MAX_MSG_FRAGS - start);
+}
 #define sk_msg_iter_var_prev(var)                       \
        do {                                            \
                if (var == 0)                           \
@@ -198,9 +203,7 @@ static inline u32 sk_msg_elem_used(const struct sk_msg *msg)
        if (sk_msg_full(msg))
                return MAX_MSG_FRAGS;
-        return msg->sg.end >= msg->sg.start ?
+        return sk_msg_iter_dist(msg->sg.start, msg->sg.end);
-                msg->sg.end - msg->sg.start :
-                msg->sg.end + (MAX_MSG_FRAGS - msg->sg.start);
 }
 static inline struct scatterlist *sk_msg_elem(struct sk_msg *msg, int which)
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 1afc125014da..3d56b026bb9e 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -159,7 +159,6 @@ struct slave {
        unsigned long target_last_arp_rx[BOND_MAX_ARP_TARGETS];
        s8     link;            /* one of BOND_LINK_XXXX */
        s8     link_new_state;  /* one of BOND_LINK_XXXX */
-        s8     new_link;
        u8     backup:1,   /* indicates backup slave. Value corresponds with
                              BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
               inactive:1, /* indicates inactive slave */
@@ -549,7 +548,7 @@ static inline void bond_propose_link_state(struct slave *slave, int state)
 static inline void bond_commit_link_state(struct slave *slave, bool notify)
 {
-        if (slave->link == slave->link_new_state)
+        if (slave->link_new_state == BOND_LINK_NOCHANGE)
                return;
        slave->link = slave->link_new_state;
diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
index 107c0d700ed6..38a9a3d1222b 100644
--- a/include/net/fq_impl.h
+++ b/include/net/fq_impl.h
@@ -313,7 +313,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
        fq->limit = 8192;
        fq->memory_limit = 16 << 20; /* 16 MBytes */
-        fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+        fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
        if (!fq->flows)
                return -ENOMEM;
@@ -331,7 +331,7 @@ static void fq_reset(struct fq *fq,
        for (i = 0; i < fq->flows_cnt; i++)
                fq_flow_reset(fq, &fq->flows[i], free_func);
-        kfree(fq->flows);
+        kvfree(fq->flows);
        fq->flows = NULL;
 }
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 50a67bd6a434..b8452cc0e059 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -439,8 +439,8 @@ static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
        unsigned long now = jiffies;
        
-        if (neigh->used != now)
+        if (READ_ONCE(neigh->used) != now)
-                neigh->used = now;
+                WRITE_ONCE(neigh->used, now);
        if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE)))
                return __neigh_event_send(neigh, skb);
        return 0;
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 001d294edf57..2d0275f13bbf 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -820,7 +820,8 @@ struct nft_expr_ops {
 */
 struct nft_expr {
        const struct nft_expr_ops       *ops;
-        unsigned char                   data[];
+        unsigned char                   data[]
+                __attribute__((aligned(__alignof__(u64))));
 };
 static inline void *nft_expr_priv(const struct nft_expr *expr)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 637548d54b3e..d80acda231ae 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -15,6 +15,7 @@
 #include <linux/mutex.h>
 #include <linux/rwsem.h>
 #include <linux/atomic.h>
+#include <linux/hashtable.h>
 #include <net/gen_stats.h>
 #include <net/rtnetlink.h>
 #include <net/flow_offload.h>
@@ -362,6 +363,7 @@ struct tcf_proto {
        bool                    deleting;
        refcount_t              refcnt;
        struct rcu_head         rcu;
+        struct hlist_node       destroy_ht_node;
 };
 struct qdisc_skb_cb {
@@ -414,6 +416,8 @@ struct tcf_block {
                struct list_head filter_chain_list;
        } chain0;
        struct rcu_head rcu;
+        DECLARE_HASHTABLE(proto_destroy_ht, 7);
+        struct mutex proto_destroy_lock; /* Lock for proto_destroy hashtable. */
 };
 #ifdef CONFIG_PROVE_LOCKING
diff --git a/include/net/sock.h b/include/net/sock.h
index 8f9adcfac41b..718e62fbe869 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2342,7 +2342,7 @@ static inline ktime_t sock_read_timestamp(struct sock *sk)
        return kt;
 #else
-        return sk->sk_stamp;
+        return READ_ONCE(sk->sk_stamp);
 #endif
 }
@@ -2353,7 +2353,7 @@ static inline void sock_write_timestamp(struct sock *sk, ktime_t kt)
        sk->sk_stamp = kt;
        write_sequnlock(&sk->sk_stamp_seq);
 #else
-        sk->sk_stamp = kt;
+        WRITE_ONCE(sk->sk_stamp, kt);
 #endif
 }
diff --git a/include/net/tls.h b/include/net/tls.h
index c664e6dba0d1..794e297483ea 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -40,6 +40,7 @@
 #include <linux/socket.h>
 #include <linux/tcp.h>
 #include <linux/skmsg.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
@@ -269,6 +270,10 @@ struct tls_context {
        bool in_tcp_sendpages;
        bool pending_open_record_frags;
+        struct mutex tx_lock; /* protects partially_sent_* fields and
+                               * per-type TX fields
+                               */
        unsigned long flags;
        /* cache cold stuff */
diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
index 1e988fdeba34..6a6d2c7655ff 100644
--- a/include/uapi/linux/can.h
+++ b/include/uapi/linux/can.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
 * linux/can.h
 *
diff --git a/include/uapi/linux/can/bcm.h b/include/uapi/linux/can/bcm.h
index 0fb328d93148..dd2b925b09ac 100644
--- a/include/uapi/linux/can/bcm.h
+++ b/include/uapi/linux/can/bcm.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
 * linux/can/bcm.h
 *
diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h
index bfc4b5d22a5e..34633283de64 100644
--- a/include/uapi/linux/can/error.h
+++ b/include/uapi/linux/can/error.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
 * linux/can/error.h
 *
diff --git a/include/uapi/linux/can/gw.h b/include/uapi/linux/can/gw.h
index 3aea5388c8e4..c2190bbe21d8 100644
--- a/include/uapi/linux/can/gw.h
+++ b/include/uapi/linux/can/gw.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
 * linux/can/gw.h
 *
diff --git a/include/uapi/linux/can/j1939.h b/include/uapi/linux/can/j1939.h
index c32325342d30..df6e821075c1 100644
--- a/include/uapi/linux/can/j1939.h
+++ b/include/uapi/linux/can/j1939.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
 /*
 * j1939.h
 *
diff --git a/include/uapi/linux/can/netlink.h b/include/uapi/linux/can/netlink.h
index 1bc70d3a4d39..6f598b73839e 100644
--- a/include/uapi/linux/can/netlink.h
+++ b/include/uapi/linux/can/netlink.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
 /*
 * linux/can/netlink.h
 *
diff --git a/include/uapi/linux/can/raw.h b/include/uapi/linux/can/raw.h
index be3b36e7ff61..6a11d308eb5c 100644
--- a/include/uapi/linux/can/raw.h
+++ b/include/uapi/linux/can/raw.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+/* SPDX-License-Identifier: ((GPL-2.0-only WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
 * linux/can/raw.h
 *
diff --git a/include/uapi/linux/can/vxcan.h b/include/uapi/linux/can/vxcan.h
index 066812d118a2..4fa9d8777a07 100644
--- a/include/uapi/linux/can/vxcan.h
+++ b/include/uapi/linux/can/vxcan.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
 #ifndef _UAPI_CAN_VXCAN_H
 #define _UAPI_CAN_VXCAN_H
diff --git a/include/uapi/linux/nvme_ioctl.h b/include/uapi/linux/nvme_ioctl.h
index e168dc59e9a0..d99b5a772698 100644
--- a/include/uapi/linux/nvme_ioctl.h
+++ b/include/uapi/linux/nvme_ioctl.h
@@ -63,6 +63,7 @@ struct nvme_passthru_cmd64 {
        __u32   cdw14;
        __u32   cdw15;
        __u32   timeout_ms;
+        __u32   rsvd2;
        __u64   result;
 };
diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
index 99335e1f4a27..25b4fa00bad1 100644
--- a/include/uapi/linux/sched.h
+++ b/include/uapi/linux/sched.h
@@ -51,6 +51,10 @@
 *               sent when the child exits.
 * @stack:       Specify the location of the stack for the
 *               child process.
+ *               Note, @stack is expected to point to the
+ *               lowest address. The stack direction will be
+ *               determined by the kernel and set up
+ *               appropriately based on @stack_size.
 * @stack_size:  The size of the stack for the child process.
 * @tls:         If CLONE_SETTLS is set, the tls descriptor
 *               is set to tls.
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index ddd8addcdb5c..a3eaf08e7dd3 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1311,12 +1311,12 @@ static bool sysctl_is_valid_access(int off, int size, enum bpf_access_type type,
                return false;
        switch (off) {
-        case offsetof(struct bpf_sysctl, write):
+        case bpf_ctx_range(struct bpf_sysctl, write):
                if (type != BPF_READ)
                        return false;
                bpf_ctx_record_field_size(info, size_default);
                return bpf_ctx_narrow_access_ok(off, size, size_default);
-        case offsetof(struct bpf_sysctl, file_pos):
+        case bpf_ctx_range(struct bpf_sysctl, file_pos):
                if (type == BPF_READ) {
                        bpf_ctx_record_field_size(info, size_default);
                        return bpf_ctx_narrow_access_ok(off, size, size_default);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0937719b87e2..ace1cfaa24b6 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -126,7 +126,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
        return map;
 }
-void *bpf_map_area_alloc(size_t size, int numa_node)
+void *bpf_map_area_alloc(u64 size, int numa_node)
 {
        /* We really just want to fail instead of triggering OOM killer
         * under memory pressure, therefore we set __GFP_NORETRY to kmalloc,
@@ -141,6 +141,9 @@ void *bpf_map_area_alloc(size_t size, int numa_node)
        const gfp_t flags = __GFP_NOWARN | __GFP_ZERO;
        void *area;
+        if (size >= SIZE_MAX)
+                return NULL;
        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
                area = kmalloc_node(size, GFP_USER | __GFP_NORETRY | flags,
                                    numa_node);
@@ -197,7 +200,7 @@ static void bpf_uncharge_memlock(struct user_struct *user, u32 pages)
                atomic_long_sub(pages, &user->locked_vm);
 }
-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size)
+int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size)
 {
        u32 pages = round_up(size, PAGE_SIZE) >> PAGE_SHIFT;
        struct user_struct *user;
diff --git a/kernel/fork.c b/kernel/fork.c
index bcdf53125210..55af6931c6ec 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2561,7 +2561,35 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
        return 0;
 }
-static bool clone3_args_valid(const struct kernel_clone_args *kargs)
+/**
+ * clone3_stack_valid - check and prepare stack
+ * @kargs: kernel clone args
+ *
+ * Verify that the stack arguments userspace gave us are sane.
+ * In addition, set the stack direction for userspace since it's easy for us to
+ * determine.
+ */
+static inline bool clone3_stack_valid(struct kernel_clone_args *kargs)
+{
+        if (kargs->stack == 0) {
+                if (kargs->stack_size > 0)
+                        return false;
+        } else {
+                if (kargs->stack_size == 0)
+                        return false;
+                if (!access_ok((void __user *)kargs->stack, kargs->stack_size))
+                        return false;
+#if !defined(CONFIG_STACK_GROWSUP) && !defined(CONFIG_IA64)
+                kargs->stack += kargs->stack_size;
+#endif
+        }
+        return true;
+}
+static bool clone3_args_valid(struct kernel_clone_args *kargs)
 {
        /*
         * All lower bits of the flag word are taken.
@@ -2581,6 +2609,9 @@ static bool clone3_args_valid(const struct kernel_clone_args *kargs)
            kargs->exit_signal)
                return false;
+        if (!clone3_stack_valid(kargs))
+                return false;
        return true;
 }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 132672b74e4b..dd822fd8a7d5 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -51,7 +51,7 @@ EXPORT_SYMBOL_GPL(irqchip_fwnode_ops);
 * @type:       Type of irqchip_fwnode. See linux/irqdomain.h
 * @name:       Optional user provided domain name
 * @id:         Optional user provided id if name != NULL
- * @data:       Optional user-provided data
+ * @pa:         Optional user-provided physical address
 *
 * Allocate a struct irqchip_fwid, and return a poiner to the embedded
 * fwnode_handle (or NULL on failure).
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index dd05a378631a..0f2eb3629070 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1073,6 +1073,7 @@ uclamp_update_active(struct task_struct *p, enum uclamp_id clamp_id)
        task_rq_unlock(rq, p, &rf);
 }
+#ifdef CONFIG_UCLAMP_TASK_GROUP
 static inline void
 uclamp_update_active_tasks(struct cgroup_subsys_state *css,
                           unsigned int clamps)
@@ -1091,7 +1092,6 @@ uclamp_update_active_tasks(struct cgroup_subsys_state *css,
        css_task_iter_end(&it);
 }
-#ifdef CONFIG_UCLAMP_TASK_GROUP
 static void cpu_util_update_eff(struct cgroup_subsys_state *css);
 static void uclamp_update_root_tg(void)
 {
@@ -3929,13 +3929,22 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
        }
 restart:
+#ifdef CONFIG_SMP
        /*
-         * Ensure that we put DL/RT tasks before the pick loop, such that they
+         * We must do the balancing pass before put_next_task(), such
-         * can PULL higher prio tasks when we lower the RQ 'priority'.
+         * that when we release the rq->lock the task is in the same
+         * state as before we took rq->lock.
+         *
+         * We can terminate the balance pass as soon as we know there is
+         * a runnable task of @class priority or higher.
         */
-        prev->sched_class->put_prev_task(rq, prev, rf);
+        for_class_range(class, prev->sched_class, &idle_sched_class) {
-        if (!rq->nr_running)
+                if (class->balance(rq, prev, rf))
-                newidle_balance(rq, rf);
+                        break;
+        }
+#endif
+        put_prev_task(rq, prev);
        for_each_class(class) {
                p = class->pick_next_task(rq, NULL, NULL);
@@ -6201,7 +6210,7 @@ static struct task_struct *__pick_migrate_task(struct rq *rq)
        for_each_class(class) {
                next = class->pick_next_task(rq, NULL, NULL);
                if (next) {
-                        next->sched_class->put_prev_task(rq, next, NULL);
+                        next->sched_class->put_prev_task(rq, next);
                        return next;
                }
        }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 2dc48720f189..a8a08030a8f7 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1691,6 +1691,22 @@ static void check_preempt_equal_dl(struct rq *rq, struct task_struct *p)
        resched_curr(rq);
 }
+static int balance_dl(struct rq *rq, struct task_struct *p, struct rq_flags *rf)
+{
+        if (!on_dl_rq(&p->dl) && need_pull_dl_task(rq, p)) {
+                /*
+                 * This is OK, because current is on_cpu, which avoids it being
+                 * picked for load-balance and preemption/IRQs are still
+                 * disabled avoiding further scheduler activity on it and we've
+                 * not yet started the picking loop.
+                 */
+                rq_unpin_lock(rq, rf);
+                pull_dl_task(rq);
+                rq_repin_lock(rq, rf);
+        }
+        return sched_stop_runnable(rq) || sched_dl_runnable(rq);
+}
 #endif /* CONFIG_SMP */
 /*
@@ -1758,45 +1774,28 @@ static struct task_struct *
 pick_next_task_dl(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
 {
        struct sched_dl_entity *dl_se;
+        struct dl_rq *dl_rq = &rq->dl;
        struct task_struct *p;
-        struct dl_rq *dl_rq;
        WARN_ON_ONCE(prev || rf);
-        dl_rq = &rq->dl;
+        if (!sched_dl_runnable(rq))
-        if (unlikely(!dl_rq->dl_nr_running))
                return NULL;
        dl_se = pick_next_dl_entity(rq, dl_rq);
        BUG_ON(!dl_se);
        p = dl_task_of(dl_se);
        set_next_task_dl(rq, p);
        return p;
 }
-static void put_prev_task_dl(struct rq *rq, struct task_struct *p, struct rq_flags *rf)
+static void put_prev_task_dl(struct rq *rq, struct task_struct *p)
 {
        update_curr_dl(rq);
        update_dl_rq_load_avg(rq_clock_pelt(rq), rq, 1);
        if (on_dl_rq(&p->dl) && p->nr_cpus_allowed > 1)
                enqueue_pushable_dl_task(rq, p);
-        if (rf && !on_dl_rq(&p->dl) && need_pull_dl_task(rq, p)) {
-                /*
-                 * This is OK, because current is on_cpu, which avoids it being
-                 * picked for load-balance and preemption/IRQs are still
-                 * disabled avoiding further scheduler activity on it and we've
-                 * not yet started the picking loop.
-                 */
-                rq_unpin_lock(rq, rf);
-                pull_dl_task(rq);
-                rq_repin_lock(rq, rf);
-        }
 }
 /*
@@ -2442,6 +2441,7 @@ const struct sched_class dl_sched_class = {
        .set_next_task          = set_next_task_dl,
 #ifdef CONFIG_SMP
+        .balance                = balance_dl,
        .select_task_rq         = select_task_rq_dl,
        .migrate_task_rq        = migrate_task_rq_dl,
        .set_cpus_allowed       = set_cpus_allowed_dl,
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 682a754ea3e1..22a2fed29054 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6570,6 +6570,15 @@ static void task_dead_fair(struct task_struct *p)
 {
        remove_entity_load_avg(&p->se);
 }
+static int
+balance_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+{
+        if (rq->nr_running)
+                return 1;
+        return newidle_balance(rq, rf) != 0;
+}
 #endif /* CONFIG_SMP */
 static unsigned long wakeup_gran(struct sched_entity *se)
@@ -6746,7 +6755,7 @@ pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf
        int new_tasks;
 again:
-        if (!cfs_rq->nr_running)
+        if (!sched_fair_runnable(rq))
                goto idle;
 #ifdef CONFIG_FAIR_GROUP_SCHED
@@ -6884,7 +6893,7 @@ idle:
 /*
 * Account for a descheduled task:
 */
-static void put_prev_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+static void put_prev_task_fair(struct rq *rq, struct task_struct *prev)
 {
        struct sched_entity *se = &prev->se;
        struct cfs_rq *cfs_rq;
@@ -10414,11 +10423,11 @@ const struct sched_class fair_sched_class = {
        .check_preempt_curr     = check_preempt_wakeup,
        .pick_next_task         = pick_next_task_fair,
        .put_prev_task          = put_prev_task_fair,
        .set_next_task          = set_next_task_fair,
 #ifdef CONFIG_SMP
+        .balance                = balance_fair,
        .select_task_rq         = select_task_rq_fair,
        .migrate_task_rq        = migrate_task_rq_fair,
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 8dad5aa600ea..f65ef1e2f204 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -365,6 +365,12 @@ select_task_rq_idle(struct task_struct *p, int cpu, int sd_flag, int flags)
 {
        return task_cpu(p); /* IDLE tasks as never migrated */
 }
+static int
+balance_idle(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+{
+        return WARN_ON_ONCE(1);
+}
 #endif
 /*
@@ -375,7 +381,7 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl
        resched_curr(rq);
 }
-static void put_prev_task_idle(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+static void put_prev_task_idle(struct rq *rq, struct task_struct *prev)
 {
 }
@@ -460,6 +466,7 @@ const struct sched_class idle_sched_class = {
        .set_next_task          = set_next_task_idle,
 #ifdef CONFIG_SMP
+        .balance                = balance_idle,
        .select_task_rq         = select_task_rq_idle,
        .set_cpus_allowed       = set_cpus_allowed_common,
 #endif
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index ebaa4e619684..9b8adc01be3d 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1469,6 +1469,22 @@ static void check_preempt_equal_prio(struct rq *rq, struct task_struct *p)
        resched_curr(rq);
 }
+static int balance_rt(struct rq *rq, struct task_struct *p, struct rq_flags *rf)
+{
+        if (!on_rt_rq(&p->rt) && need_pull_rt_task(rq, p)) {
+                /*
+                 * This is OK, because current is on_cpu, which avoids it being
+                 * picked for load-balance and preemption/IRQs are still
+                 * disabled avoiding further scheduler activity on it and we've
+                 * not yet started the picking loop.
+                 */
+                rq_unpin_lock(rq, rf);
+                pull_rt_task(rq);
+                rq_repin_lock(rq, rf);
+        }
+        return sched_stop_runnable(rq) || sched_dl_runnable(rq) || sched_rt_runnable(rq);
+}
 #endif /* CONFIG_SMP */
 /*
@@ -1552,21 +1568,18 @@ static struct task_struct *
 pick_next_task_rt(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
 {
        struct task_struct *p;
-        struct rt_rq *rt_rq = &rq->rt;
        WARN_ON_ONCE(prev || rf);
-        if (!rt_rq->rt_queued)
+        if (!sched_rt_runnable(rq))
                return NULL;
        p = _pick_next_task_rt(rq);
        set_next_task_rt(rq, p);
        return p;
 }
-static void put_prev_task_rt(struct rq *rq, struct task_struct *p, struct rq_flags *rf)
+static void put_prev_task_rt(struct rq *rq, struct task_struct *p)
 {
        update_curr_rt(rq);
@@ -1578,18 +1591,6 @@ static void put_prev_task_rt(struct rq *rq, struct task_struct *p, struct rq_fla
         */
        if (on_rt_rq(&p->rt) && p->nr_cpus_allowed > 1)
                enqueue_pushable_task(rq, p);
-        if (rf && !on_rt_rq(&p->rt) && need_pull_rt_task(rq, p)) {
-                /*
-                 * This is OK, because current is on_cpu, which avoids it being
-                 * picked for load-balance and preemption/IRQs are still
-                 * disabled avoiding further scheduler activity on it and we've
-                 * not yet started the picking loop.
-                 */
-                rq_unpin_lock(rq, rf);
-                pull_rt_task(rq);
-                rq_repin_lock(rq, rf);
-        }
 }
 #ifdef CONFIG_SMP
@@ -2366,8 +2367,8 @@ const struct sched_class rt_sched_class = {
        .set_next_task          = set_next_task_rt,
 #ifdef CONFIG_SMP
+        .balance                = balance_rt,
        .select_task_rq         = select_task_rq_rt,
        .set_cpus_allowed       = set_cpus_allowed_common,
        .rq_online              = rq_online_rt,
        .rq_offline             = rq_offline_rt,
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 0db2c1b3361e..c8870c5bd7df 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1727,10 +1727,11 @@ struct sched_class {
        struct task_struct * (*pick_next_task)(struct rq *rq,
                                               struct task_struct *prev,
                                               struct rq_flags *rf);
-        void (*put_prev_task)(struct rq *rq, struct task_struct *p, struct rq_flags *rf);
+        void (*put_prev_task)(struct rq *rq, struct task_struct *p);
        void (*set_next_task)(struct rq *rq, struct task_struct *p);
 #ifdef CONFIG_SMP
+        int (*balance)(struct rq *rq, struct task_struct *prev, struct rq_flags *rf);
        int  (*select_task_rq)(struct task_struct *p, int task_cpu, int sd_flag, int flags);
        void (*migrate_task_rq)(struct task_struct *p, int new_cpu);
@@ -1773,7 +1774,7 @@ struct sched_class {
 static inline void put_prev_task(struct rq *rq, struct task_struct *prev)
 {
        WARN_ON_ONCE(rq->curr != prev);
-        prev->sched_class->put_prev_task(rq, prev, NULL);
+        prev->sched_class->put_prev_task(rq, prev);
 }
 static inline void set_next_task(struct rq *rq, struct task_struct *next)
@@ -1787,8 +1788,12 @@ static inline void set_next_task(struct rq *rq, struct task_struct *next)
 #else
 #define sched_class_highest (&dl_sched_class)
 #endif
+#define for_class_range(class, _from, _to) \
+        for (class = (_from); class != (_to); class = class->next)
 #define for_each_class(class) \
-   for (class = sched_class_highest; class; class = class->next)
+        for_class_range(class, sched_class_highest, NULL)
 extern const struct sched_class stop_sched_class;
 extern const struct sched_class dl_sched_class;
@@ -1796,6 +1801,25 @@ extern const struct sched_class rt_sched_class;
 extern const struct sched_class fair_sched_class;
 extern const struct sched_class idle_sched_class;
+static inline bool sched_stop_runnable(struct rq *rq)
+{
+        return rq->stop && task_on_rq_queued(rq->stop);
+}
+static inline bool sched_dl_runnable(struct rq *rq)
+{
+        return rq->dl.dl_nr_running > 0;
+}
+static inline bool sched_rt_runnable(struct rq *rq)
+{
+        return rq->rt.rt_queued > 0;
+}
+static inline bool sched_fair_runnable(struct rq *rq)
+{
+        return rq->cfs.nr_running > 0;
+}
 #ifdef CONFIG_SMP
diff --git a/kernel/sched/stop_task.c b/kernel/sched/stop_task.c
index 7e1cee4e65b2..c0640739e05e 100644
--- a/kernel/sched/stop_task.c
+++ b/kernel/sched/stop_task.c
@@ -15,6 +15,12 @@ select_task_rq_stop(struct task_struct *p, int cpu, int sd_flag, int flags)
 {
        return task_cpu(p); /* stop tasks as never migrate */
 }
+static int
+balance_stop(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+{
+        return sched_stop_runnable(rq);
+}
 #endif /* CONFIG_SMP */
 static void
@@ -31,16 +37,13 @@ static void set_next_task_stop(struct rq *rq, struct task_struct *stop)
 static struct task_struct *
 pick_next_task_stop(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
 {
-        struct task_struct *stop = rq->stop;
        WARN_ON_ONCE(prev || rf);
-        if (!stop || !task_on_rq_queued(stop))
+        if (!sched_stop_runnable(rq))
                return NULL;
-        set_next_task_stop(rq, stop);
+        set_next_task_stop(rq, rq->stop);
+        return rq->stop;
-        return stop;
 }
 static void
@@ -60,7 +63,7 @@ static void yield_task_stop(struct rq *rq)
        BUG(); /* the stop task should never yield, its pointless. */
 }
-static void put_prev_task_stop(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
+static void put_prev_task_stop(struct rq *rq, struct task_struct *prev)
 {
        struct task_struct *curr = rq->curr;
        u64 delta_exec;
@@ -129,6 +132,7 @@ const struct sched_class stop_sched_class = {
        .set_next_task          = set_next_task_stop,
 #ifdef CONFIG_SMP
+        .balance                = balance_stop,
        .select_task_rq         = select_task_rq_stop,
        .set_cpus_allowed       = set_cpus_allowed_common,
 #endif
diff --git a/kernel/signal.c b/kernel/signal.c
index c4da1ef56fdf..bcd46f547db3 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2205,8 +2205,8 @@ static void ptrace_stop(int exit_code, int why, int clear_code, kernel_siginfo_t
                 */
                preempt_disable();
                read_unlock(&tasklist_lock);
-                preempt_enable_no_resched();
                cgroup_enter_frozen();
+                preempt_enable_no_resched();
                freezable_schedule();
                cgroup_leave_frozen(true);
        } else {
diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
index 6d1f68b7e528..c9ea7eb2cb1a 100644
--- a/kernel/stacktrace.c
+++ b/kernel/stacktrace.c
@@ -141,7 +141,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *tsk, unsigned long *store,
        struct stacktrace_cookie c = {
                .store  = store,
                .size   = size,
-                .skip   = skipnr + 1,
+                /* skip this function if they are tracing us */
+                .skip   = skipnr + !!(current == tsk),
        };
        if (!try_get_task_stack(tsk))
@@ -298,7 +299,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *task,
        struct stack_trace trace = {
                .entries        = store,
                .max_entries    = size,
-                .skip           = skipnr + 1,
+                /* skip this function if they are tracing us */
+                .skip   = skipnr + !!(current == task),
        };
        save_stack_trace_tsk(task, &trace);
diff --git a/kernel/time/vsyscall.c b/kernel/time/vsyscall.c
index 4bc37ac3bb05..5ee0f7709410 100644
--- a/kernel/time/vsyscall.c
+++ b/kernel/time/vsyscall.c
@@ -110,8 +110,7 @@ void update_vsyscall(struct timekeeper *tk)
        nsec            = nsec + tk->wall_to_monotonic.tv_nsec;
        vdso_ts->sec    += __iter_div_u64_rem(nsec, NSEC_PER_SEC, &vdso_ts->nsec);
-        if (__arch_use_vsyscall(vdata))
+        update_vdso_data(vdata, tk);
-                update_vdso_data(vdata, tk);
        __arch_update_vsyscall(vdata, tk);
@@ -124,10 +123,8 @@ void update_vsyscall_tz(void)
 {
        struct vdso_data *vdata = __arch_get_k_vdso_data();
-        if (__arch_use_vsyscall(vdata)) {
+        vdata[CS_HRES_COARSE].tz_minuteswest = sys_tz.tz_minuteswest;
-                vdata[CS_HRES_COARSE].tz_minuteswest = sys_tz.tz_minuteswest;
+        vdata[CS_HRES_COARSE].tz_dsttime = sys_tz.tz_dsttime;
-                vdata[CS_HRES_COARSE].tz_dsttime = sys_tz.tz_dsttime;
-        }
        __arch_sync_vdso_data(vdata);
 }
diff --git a/lib/Kconfig b/lib/Kconfig
index 183f92a297ca..3321d04dfa5a 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -447,7 +447,6 @@ config ASSOCIATIVE_ARRAY
 config HAS_IOMEM
        bool
        depends on !NO_IOMEM
-        select GENERIC_IO
        default y
 config HAS_IOPORT_MAP
diff --git a/lib/dump_stack.c b/lib/dump_stack.c
index 5cff72f18c4a..33ffbf308853 100644
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -106,7 +106,12 @@ retry:
                was_locked = 1;
        } else {
                local_irq_restore(flags);
-                cpu_relax();
+                /*
+                 * Wait for the lock to release before jumping to
+                 * atomic_cmpxchg() in order to mitigate the thundering herd
+                 * problem.
+                 */
+                do { cpu_relax(); } while (atomic_read(&dump_lock) != -1);
                goto retry;
        }
diff --git a/lib/idr.c b/lib/idr.c
index 66a374892482..c2cf2c52bbde 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -215,7 +215,7 @@ int idr_for_each(const struct idr *idr,
 EXPORT_SYMBOL(idr_for_each);
 /**
- * idr_get_next() - Find next populated entry.
+ * idr_get_next_ul() - Find next populated entry.
 * @idr: IDR handle.
 * @nextid: Pointer to an ID.
 *
@@ -224,7 +224,7 @@ EXPORT_SYMBOL(idr_for_each);
 * to the ID of the found value.  To use in a loop, the value pointed to by
 * nextid must be incremented by the user.
 */
-void *idr_get_next(struct idr *idr, int *nextid)
+void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
 {
        struct radix_tree_iter iter;
        void __rcu **slot;
@@ -245,18 +245,14 @@ void *idr_get_next(struct idr *idr, int *nextid)
        }
        if (!slot)
                return NULL;
-        id = iter.index + base;
-        if (WARN_ON_ONCE(id > INT_MAX))
-                return NULL;
-        *nextid = id;
+        *nextid = iter.index + base;
        return entry;
 }
-EXPORT_SYMBOL(idr_get_next);
+EXPORT_SYMBOL(idr_get_next_ul);
 /**
- * idr_get_next_ul() - Find next populated entry.
+ * idr_get_next() - Find next populated entry.
 * @idr: IDR handle.
 * @nextid: Pointer to an ID.
 *
@@ -265,22 +261,17 @@ EXPORT_SYMBOL(idr_get_next);
 * to the ID of the found value.  To use in a loop, the value pointed to by
 * nextid must be incremented by the user.
 */
-void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
+void *idr_get_next(struct idr *idr, int *nextid)
 {
-        struct radix_tree_iter iter;
-        void __rcu **slot;
-        unsigned long base = idr->idr_base;
        unsigned long id = *nextid;
+        void *entry = idr_get_next_ul(idr, &id);
-        id = (id < base) ? 0 : id - base;
+        if (WARN_ON_ONCE(id > INT_MAX))
-        slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
-        if (!slot)
                return NULL;
+        *nextid = id;
-        *nextid = iter.index + base;
+        return entry;
-        return rcu_dereference_raw(*slot);
 }
-EXPORT_SYMBOL(idr_get_next_ul);
+EXPORT_SYMBOL(idr_get_next);
 /**
 * idr_replace() - replace pointer for given ID.
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 18c1dfbb1765..c8fa1d274530 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -1529,7 +1529,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
                        offset = radix_tree_find_next_bit(node, IDR_FREE,
                                                        offset + 1);
                        start = next_index(start, node, offset);
-                        if (start > max)
+                        if (start > max || start == 0)
                                return ERR_PTR(-ENOSPC);
                        while (offset == RADIX_TREE_MAP_SIZE) {
                                offset = node->offset + 1;
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 9d631a7b6a70..7df4f7f395bf 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -1110,6 +1110,28 @@ static noinline void check_find_entry(struct xarray *xa)
        XA_BUG_ON(xa, !xa_empty(xa));
 }
+static noinline void check_move_tiny(struct xarray *xa)
+{
+        XA_STATE(xas, xa, 0);
+        XA_BUG_ON(xa, !xa_empty(xa));
+        rcu_read_lock();
+        XA_BUG_ON(xa, xas_next(&xas) != NULL);
+        XA_BUG_ON(xa, xas_next(&xas) != NULL);
+        rcu_read_unlock();
+        xa_store_index(xa, 0, GFP_KERNEL);
+        rcu_read_lock();
+        xas_set(&xas, 0);
+        XA_BUG_ON(xa, xas_next(&xas) != xa_mk_index(0));
+        XA_BUG_ON(xa, xas_next(&xas) != NULL);
+        xas_set(&xas, 0);
+        XA_BUG_ON(xa, xas_prev(&xas) != xa_mk_index(0));
+        XA_BUG_ON(xa, xas_prev(&xas) != NULL);
+        rcu_read_unlock();
+        xa_erase_index(xa, 0);
+        XA_BUG_ON(xa, !xa_empty(xa));
+}
 static noinline void check_move_small(struct xarray *xa, unsigned long idx)
 {
        XA_STATE(xas, xa, 0);
@@ -1217,6 +1239,8 @@ static noinline void check_move(struct xarray *xa)
        xa_destroy(xa);
+        check_move_tiny(xa);
        for (i = 0; i < 16; i++)
                check_move_small(xa, 1UL << i);
diff --git a/lib/xarray.c b/lib/xarray.c
index 446b956c9188..1237c213f52b 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -994,6 +994,8 @@ void *__xas_prev(struct xa_state *xas)
        if (!xas_frozen(xas->xa_node))
                xas->xa_index--;
+        if (!xas->xa_node)
+                return set_bounds(xas);
        if (xas_not_node(xas->xa_node))
                return xas_load(xas);
@@ -1031,6 +1033,8 @@ void *__xas_next(struct xa_state *xas)
        if (!xas_frozen(xas->xa_node))
                xas->xa_index++;
+        if (!xas->xa_node)
+                return set_bounds(xas);
        if (xas_not_node(xas->xa_node))
                return xas_load(xas);
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 0a1b4b484ac5..f05d27b7183d 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1028,12 +1028,13 @@ static void collapse_huge_page(struct mm_struct *mm,
        anon_vma_lock_write(vma->anon_vma);
-        pte = pte_offset_map(pmd, address);
-        pte_ptl = pte_lockptr(mm, pmd);
        mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm,
                                address, address + HPAGE_PMD_SIZE);
        mmu_notifier_invalidate_range_start(&range);
+        pte = pte_offset_map(pmd, address);
+        pte_ptl = pte_lockptr(mm, pmd);
        pmd_ptl = pmd_lock(mm, pmd); /* probably unnecessary */
        /*
         * After this gup_fast can't run anymore. This also removes
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 363106578876..37592dd7ae32 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -484,7 +484,7 @@ ino_t page_cgroup_ino(struct page *page)
        unsigned long ino = 0;
        rcu_read_lock();
-        if (PageHead(page) && PageSlab(page))
+        if (PageSlab(page) && !PageTail(page))
                memcg = memcg_from_slab_page(page);
        else
                memcg = READ_ONCE(page->mem_cgroup);
@@ -2535,6 +2535,15 @@ retry:
        }
        /*
+         * Memcg doesn't have a dedicated reserve for atomic
+         * allocations. But like the global atomic pool, we need to
+         * put the burden of reclaim on regular allocation requests
+         * and let these go through as privileged allocations.
+         */
+        if (gfp_mask & __GFP_ATOMIC)
+                goto force;
+        /*
         * Unlike in global OOM situations, memcg is not in a physical
         * memory shortage.  Allow dying and OOM-killed tasks to
         * bypass the last charges so that they can exit quickly and
@@ -5014,12 +5023,6 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
        int node;
-        /*
-         * Flush percpu vmstats and vmevents to guarantee the value correctness
-         * on parent's and all ancestor levels.
-         */
-        memcg_flush_percpu_vmstats(memcg, false);
-        memcg_flush_percpu_vmevents(memcg);
        for_each_node(node)
                free_mem_cgroup_per_node_info(memcg, node);
        free_percpu(memcg->vmstats_percpu);
@@ -5030,6 +5033,12 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 static void mem_cgroup_free(struct mem_cgroup *memcg)
 {
        memcg_wb_domain_exit(memcg);
+        /*
+         * Flush percpu vmstats and vmevents to guarantee the value correctness
+         * on parent's and all ancestor levels.
+         */
+        memcg_flush_percpu_vmstats(memcg, false);
+        memcg_flush_percpu_vmevents(memcg);
        __mem_cgroup_free(memcg);
 }
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index df570e5c71cc..07e5c67f48a8 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -447,6 +447,14 @@ static void update_pgdat_span(struct pglist_data *pgdat)
                                             zone->spanned_pages;
                /* No need to lock the zones, they can't change. */
+                if (!zone->spanned_pages)
+                        continue;
+                if (!node_end_pfn) {
+                        node_start_pfn = zone->zone_start_pfn;
+                        node_end_pfn = zone_end_pfn;
+                        continue;
+                }
                if (zone_end_pfn > node_end_pfn)
                        node_end_pfn = zone_end_pfn;
                if (zone->zone_start_pfn < node_start_pfn)
diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
index 7fde88695f35..9a889e456168 100644
--- a/mm/mmu_notifier.c
+++ b/mm/mmu_notifier.c
@@ -180,7 +180,7 @@ int __mmu_notifier_invalidate_range_start(struct mmu_notifier_range *range)
                                        mn->ops->invalidate_range_start, _ret,
                                        !mmu_notifier_range_blockable(range) ? "non-" : "");
                                WARN_ON(mmu_notifier_range_blockable(range) ||
-                                        ret != -EAGAIN);
+                                        _ret != -EAGAIN);
                                ret = _ret;
                        }
                }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ecc3dbad606b..f391c0c4ed1d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1948,6 +1948,14 @@ void __init page_alloc_init_late(void)
        wait_for_completion(&pgdat_init_all_done_comp);
        /*
+         * The number of managed pages has changed due to the initialisation
+         * so the pcpu batch and high limits needs to be updated or the limits
+         * will be artificially small.
+         */
+        for_each_populated_zone(zone)
+                zone_pcp_update(zone);
+        /*
         * We initialized the rest of the deferred pages.  Permanently disable
         * on-demand struct page initialization.
         */
@@ -3720,10 +3728,6 @@ try_this_zone:
 static void warn_alloc_show_mem(gfp_t gfp_mask, nodemask_t *nodemask)
 {
        unsigned int filter = SHOW_MEM_FILTER_NODES;
-        static DEFINE_RATELIMIT_STATE(show_mem_rs, HZ, 1);
-        if (!__ratelimit(&show_mem_rs))
-                return;
        /*
         * This documents exceptions given to allocations in certain
@@ -3744,8 +3748,7 @@ void warn_alloc(gfp_t gfp_mask, nodemask_t *nodemask, const char *fmt, ...)
 {
        struct va_format vaf;
        va_list args;
-        static DEFINE_RATELIMIT_STATE(nopage_rs, DEFAULT_RATELIMIT_INTERVAL,
+        static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1);
-                                      DEFAULT_RATELIMIT_BURST);
        if ((gfp_mask & __GFP_NOWARN) || !__ratelimit(&nopage_rs))
                return;
@@ -8514,7 +8517,6 @@ void free_contig_range(unsigned long pfn, unsigned int nr_pages)
        WARN(count != 0, "%d pages are still in use!\n", count);
 }
-#ifdef CONFIG_MEMORY_HOTPLUG
 /*
 * The zone indicated has a new number of managed_pages; batch sizes and percpu
 * page high values need to be recalulated.
@@ -8528,7 +8530,6 @@ void __meminit zone_pcp_update(struct zone *zone)
                                per_cpu_ptr(zone->pageset, cpu));
        mutex_unlock(&pcp_batch_high_lock);
 }
-#endif
 void zone_pcp_reset(struct zone *zone)
 {
diff --git a/mm/slab.h b/mm/slab.h
index 68e455f2b698..b2b01694dc43 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -323,8 +323,8 @@ static inline struct kmem_cache *memcg_root_cache(struct kmem_cache *s)
 * Expects a pointer to a slab page. Please note, that PageSlab() check
 * isn't sufficient, as it returns true also for tail compound slab pages,
 * which do not have slab_cache pointer set.
- * So this function assumes that the page can pass PageHead() and PageSlab()
+ * So this function assumes that the page can pass PageSlab() && !PageTail()
- * checks.
+ * check.
 *
 * The kmem_cache can be reparented asynchronously. The caller must ensure
 * the memcg lifetime, e.g. by taking rcu_read_lock() or cgroup_mutex.
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 6afc892a148a..a8222041bd44 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1383,12 +1383,29 @@ static void pagetypeinfo_showfree_print(struct seq_file *m,
                        unsigned long freecount = 0;
                        struct free_area *area;
                        struct list_head *curr;
+                        bool overflow = false;
                        area = &(zone->free_area[order]);
-                        list_for_each(curr, &area->free_list[mtype])
+                        list_for_each(curr, &area->free_list[mtype]) {
-                                freecount++;
+                                /*
-                        seq_printf(m, "%6lu ", freecount);
+                                 * Cap the free_list iteration because it might
+                                 * be really large and we are under a spinlock
+                                 * so a long time spent here could trigger a
+                                 * hard lockup detector. Anyway this is a
+                                 * debugging tool so knowing there is a handful
+                                 * of pages of this order should be more than
+                                 * sufficient.
+                                 */
+                                if (++freecount >= 100000) {
+                                        overflow = true;
+                                        break;
+                                }
+                        }
+                        seq_printf(m, "%s%6lu ", overflow ? ">" : "", freecount);
+                        spin_unlock_irq(&zone->lock);
+                        cond_resched();
+                        spin_lock_irq(&zone->lock);
                }
                seq_putc(m, '\n');
        }
@@ -1972,7 +1989,7 @@ void __init init_mm_internals(void)
 #endif
 #ifdef CONFIG_PROC_FS
        proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
-        proc_create_seq("pagetypeinfo", 0444, NULL, &pagetypeinfo_op);
+        proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
        proc_create_seq("vmstat", 0444, NULL, &vmstat_op);
        proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
 #endif
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index ed91ea31978a..12a4f4d93681 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -20,7 +20,6 @@ static unsigned int
 ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
        const struct ebt_nat_info *info = par->targinfo;
-        struct net_device *dev;
        if (skb_ensure_writable(skb, ETH_ALEN))
                return EBT_DROP;
@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
                else
                        skb->pkt_type = PACKET_MULTICAST;
        } else {
-                if (xt_hooknum(par) != NF_BR_BROUTING)
+                const struct net_device *dev;
-                        dev = br_port_get_rcu(xt_in(par))->br->dev;
-                else
+                switch (xt_hooknum(par)) {
+                case NF_BR_BROUTING:
                        dev = xt_in(par);
+                        break;
+                case NF_BR_PRE_ROUTING:
+                        dev = br_port_get_rcu(xt_in(par))->br->dev;
+                        break;
+                default:
+                        dev = NULL;
+                        break;
+                }
+                if (!dev) /* NF_BR_LOCAL_OUT */
+                        return info->target;
                if (ether_addr_equal(info->mac, dev->dev_addr))
                        skb->pkt_type = PACKET_HOST;
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 37c1040bcb9c..4d8ba701e15d 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -580,6 +580,7 @@ static int j1939_sk_release(struct socket *sock)
                j1939_netdev_stop(priv);
        }
+        kfree(jsk->filters);
        sock_orphan(sk);
        sock->sk = NULL;
@@ -909,8 +910,10 @@ void j1939_sk_errqueue(struct j1939_session *session,
        memset(serr, 0, sizeof(*serr));
        switch (type) {
        case J1939_ERRQUEUE_ACK:
-                if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK))
+                if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_ACK)) {
+                        kfree_skb(skb);
                        return;
+                }
                serr->ee.ee_errno = ENOMSG;
                serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
@@ -918,8 +921,10 @@ void j1939_sk_errqueue(struct j1939_session *session,
                state = "ACK";
                break;
        case J1939_ERRQUEUE_SCHED:
-                if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED))
+                if (!(sk->sk_tsflags & SOF_TIMESTAMPING_TX_SCHED)) {
+                        kfree_skb(skb);
                        return;
+                }
                serr->ee.ee_errno = ENOMSG;
                serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index fe000ea757ea..e5f1a56994c6 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1273,9 +1273,27 @@ j1939_xtp_rx_abort(struct j1939_priv *priv, struct sk_buff *skb,
 static void
 j1939_xtp_rx_eoma_one(struct j1939_session *session, struct sk_buff *skb)
 {
+        struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+        const u8 *dat;
+        int len;
        if (j1939_xtp_rx_cmd_bad_pgn(session, skb))
                return;
+        dat = skb->data;
+        if (skcb->addr.type == J1939_ETP)
+                len = j1939_etp_ctl_to_size(dat);
+        else
+                len = j1939_tp_ctl_to_size(dat);
+        if (session->total_message_size != len) {
+                netdev_warn_once(session->priv->ndev,
+                                 "%s: 0x%p: Incorrect size. Expected: %i; got: %i.\n",
+                                 __func__, session, session->total_message_size,
+                                 len);
+        }
        netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session);
        session->pkt.tx_acked = session->pkt.total;
@@ -1432,7 +1450,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv,
        skcb = j1939_skb_to_cb(skb);
        memcpy(skcb, rel_skcb, sizeof(*skcb));
-        session = j1939_session_new(priv, skb, skb->len);
+        session = j1939_session_new(priv, skb, size);
        if (!session) {
                kfree_skb(skb);
                return NULL;
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index cf390e0aa73d..ad31e4e53d0a 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -270,18 +270,28 @@ void sk_msg_trim(struct sock *sk, struct sk_msg *msg, int len)
        msg->sg.data[i].length -= trim;
        sk_mem_uncharge(sk, trim);
+        /* Adjust copybreak if it falls into the trimmed part of last buf */
+        if (msg->sg.curr == i && msg->sg.copybreak > msg->sg.data[i].length)
+                msg->sg.copybreak = msg->sg.data[i].length;
 out:
-        /* If we trim data before curr pointer update copybreak and current
+        sk_msg_iter_var_next(i);
-         * so that any future copy operations start at new copy location.
+        msg->sg.end = i;
+        /* If we trim data a full sg elem before curr pointer update
+         * copybreak and current so that any future copy operations
+         * start at new copy location.
         * However trimed data that has not yet been used in a copy op
         * does not require an update.
         */
-        if (msg->sg.curr >= i) {
+        if (!msg->sg.size) {
+                msg->sg.curr = msg->sg.start;
+                msg->sg.copybreak = 0;
+        } else if (sk_msg_iter_dist(msg->sg.start, msg->sg.curr) >=
+                   sk_msg_iter_dist(msg->sg.start, msg->sg.end)) {
+                sk_msg_iter_var_prev(i);
                msg->sg.curr = i;
                msg->sg.copybreak = msg->sg.data[i].length;
        }
-        sk_msg_iter_var_next(i);
-        msg->sg.end = i;
 }
 EXPORT_SYMBOL_GPL(sk_msg_trim);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 0d8f782c25cc..d19557c6d04b 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -416,7 +416,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
        RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt));
        newinet->mc_index  = inet_iif(skb);
        newinet->mc_ttl    = ip_hdr(skb)->ttl;
-        newinet->inet_id   = jiffies;
+        newinet->inet_id   = prandom_u32();
        if (dst == NULL && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL)
                goto put_and_exit;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 0913a090b2bf..f1888c683426 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1814,8 +1814,8 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
        int ret = 0;
        unsigned int hash = fib_laddr_hashfn(local);
        struct hlist_head *head = &fib_info_laddrhash[hash];
+        int tb_id = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
        struct net *net = dev_net(dev);
-        int tb_id = l3mdev_fib_table(dev);
        struct fib_info *fi;
        if (!fib_info_laddrhash || local == 0)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a63ff85fe141..e60bf8e7dd1a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -621,6 +621,7 @@ static void rt6_probe(struct fib6_nh *fib6_nh)
 {
        struct __rt6_probe_work *work = NULL;
        const struct in6_addr *nh_gw;
+        unsigned long last_probe;
        struct neighbour *neigh;
        struct net_device *dev;
        struct inet6_dev *idev;
@@ -639,6 +640,7 @@ static void rt6_probe(struct fib6_nh *fib6_nh)
        nh_gw = &fib6_nh->fib_nh_gw6;
        dev = fib6_nh->fib_nh_dev;
        rcu_read_lock_bh();
+        last_probe = READ_ONCE(fib6_nh->last_probe);
        idev = __in6_dev_get(dev);
        neigh = __ipv6_neigh_lookup_noref(dev, nh_gw);
        if (neigh) {
@@ -654,13 +656,15 @@ static void rt6_probe(struct fib6_nh *fib6_nh)
                                __neigh_set_probe_once(neigh);
                }
                write_unlock(&neigh->lock);
-        } else if (time_after(jiffies, fib6_nh->last_probe +
+        } else if (time_after(jiffies, last_probe +
                                       idev->cnf.rtr_probe_interval)) {
                work = kmalloc(sizeof(*work), GFP_ATOMIC);
        }
-        if (work) {
+        if (!work || cmpxchg(&fib6_nh->last_probe,
-                fib6_nh->last_probe = jiffies;
+                             last_probe, jiffies) != last_probe) {
+                kfree(work);
+        } else {
                INIT_WORK(&work->work, rt6_probe_deferred);
                work->target = *nh_gw;
                dev_hold(dev);
@@ -3383,6 +3387,9 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
        int err;
        fib6_nh->fib_nh_family = AF_INET6;
+#ifdef CONFIG_IPV6_ROUTER_PREF
+        fib6_nh->last_probe = jiffies;
+#endif
        err = -ENODEV;
        if (cfg->fc_ifindex) {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index aba094b4ccfc..2d05c4cfaf6d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1292,8 +1292,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        ieee80211_remove_interfaces(local);
 fail_rate:
        rtnl_unlock();
-        ieee80211_led_exit(local);
 fail_flows:
+        ieee80211_led_exit(local);
        destroy_workqueue(local->workqueue);
 fail_workqueue:
        wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index bd11fef2139f..8d3a2389b055 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2457,7 +2457,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
 {
        struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
-        if (time_after(stats->last_rx, sta->status_stats.last_ack))
+        if (!sta->status_stats.last_ack ||
+            time_after(stats->last_rx, sta->status_stats.last_ack))
                return stats->last_rx;
        return sta->status_stats.last_ack;
 }
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e64d5f9a89dd..d73d1828216a 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
        if (unlikely(!flag_nested(nla)))
                return -IPSET_ERR_PROTOCOL;
-        if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
+        if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
+                             ipaddr_policy, NULL))
                return -IPSET_ERR_PROTOCOL;
        if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
                return -IPSET_ERR_PROTOCOL;
@@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
        if (unlikely(!flag_nested(nla)))
                return -IPSET_ERR_PROTOCOL;
-        if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
+        if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
+                             ipaddr_policy, NULL))
                return -IPSET_ERR_PROTOCOL;
        if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
                return -IPSET_ERR_PROTOCOL;
@@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
        /* Without holding any locks, create private part. */
        if (attr[IPSET_ATTR_DATA] &&
-            nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) {
+            nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
+                             set->type->create_policy, NULL)) {
                ret = -IPSET_ERR_PROTOCOL;
                goto put_out;
        }
@@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh)
        }
 }
+static const struct nla_policy
+ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {
+        [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
+        [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
+                                    .len = IPSET_MAXNAMELEN - 1 },
+        [IPSET_ATTR_FLAGS]      = { .type = NLA_U32 },
+};
 static int
 dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
 {
@@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
        ip_set_id_t index;
        int ret;
-        ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,
+        ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,
-                                   nlh->nlmsg_len - min_len,
+                        nlh->nlmsg_len - min_len,
-                                   ip_set_setname_policy, NULL);
+                        ip_set_dump_policy, NULL);
        if (ret)
                return ret;
@@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
                memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
                cmdattr = (void *)&errmsg->msg + min_len;
-                ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,
+                ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
-                                           nlh->nlmsg_len - min_len,
+                                nlh->nlmsg_len - min_len, ip_set_adt_policy,
-                                           ip_set_adt_policy, NULL);
+                                NULL);
                if (ret) {
                        nlmsg_free(skb2);
@@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
        use_lineno = !!attr[IPSET_ATTR_LINENO];
        if (attr[IPSET_ATTR_DATA]) {
-                if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
+                if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
+                                     attr[IPSET_ATTR_DATA],
+                                     set->type->adt_policy, NULL))
                        return -IPSET_ERR_PROTOCOL;
                ret = call_ad(ctnl, skb, set, tb, adt, flags,
                              use_lineno);
@@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
                nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
                        if (nla_type(nla) != IPSET_ATTR_DATA ||
                            !flag_nested(nla) ||
-                            nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL))
+                            nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
+                                             set->type->adt_policy, NULL))
                                return -IPSET_ERR_PROTOCOL;
                        ret = call_ad(ctnl, skb, set, tb, adt,
                                      flags, use_lineno);
@@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
        if (!set)
                return -ENOENT;
-        if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
+        if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
+                             set->type->adt_policy, NULL))
                return -IPSET_ERR_PROTOCOL;
        rcu_read_lock_bh();
@@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
        [IPSET_CMD_LIST]        = {
                .call           = ip_set_dump,
                .attr_count     = IPSET_ATTR_CMD_MAX,
-                .policy         = ip_set_setname_policy,
+                .policy         = ip_set_dump_policy,
        },
        [IPSET_CMD_SAVE]        = {
                .call           = ip_set_dump,
@@ -2069,8 +2084,9 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
                }
                req_version->version = IPSET_PROTOCOL;
-                ret = copy_to_user(user, req_version,
+                if (copy_to_user(user, req_version,
-                                   sizeof(struct ip_set_req_version));
+                                 sizeof(struct ip_set_req_version)))
+                        ret = -EFAULT;
                goto done;
        }
        case IP_SET_OP_GET_BYNAME: {
@@ -2129,7 +2145,8 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
        }       /* end of switch(op) */
 copy:
-        ret = copy_to_user(user, data, copylen);
+        if (copy_to_user(user, data, copylen))
+                ret = -EFAULT;
 done:
        vfree(data);
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index 24d8f4df4230..4ce563eb927d 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -209,7 +209,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
            (skb_mac_header(skb) + ETH_HLEN) > skb->data)
                return -EINVAL;
-        if (opt->flags & IPSET_DIM_ONE_SRC)
+        if (opt->flags & IPSET_DIM_TWO_SRC)
                ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
        else
                ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index c259cbc3ef45..3d932de0ad29 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = {
                [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
                [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
+                [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
                [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
                [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index a3ae69bfee66..4398322fad59 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = {
                [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
                [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
                [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
+                [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
                [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
                [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
                [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d481f9baca2f..712a428509ad 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1922,6 +1922,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
                if (nlh->nlmsg_flags & NLM_F_REPLACE)
                        return -EOPNOTSUPP;
+                flags |= chain->flags & NFT_BASE_CHAIN;
                return nf_tables_updchain(&ctx, genmask, policy, flags);
        }
@@ -5143,9 +5144,6 @@ static int nf_tables_updobj(const struct nft_ctx *ctx,
        struct nft_trans *trans;
        int err;
-        if (!obj->ops->update)
-                return -EOPNOTSUPP;
        trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
                                sizeof(struct nft_trans_obj));
        if (!trans)
@@ -6499,7 +6497,8 @@ static void nft_obj_commit_update(struct nft_trans *trans)
        obj = nft_trans_obj(trans);
        newobj = nft_trans_obj_newobj(trans);
-        obj->ops->update(obj, newobj);
+        if (obj->ops->update)
+                obj->ops->update(obj, newobj);
        kfree(newobj);
 }
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index ad783f4840ef..e25dab8128db 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -334,7 +334,8 @@ int nft_flow_rule_offload_commit(struct net *net)
                switch (trans->msg_type) {
                case NFT_MSG_NEWCHAIN:
-                        if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
+                        if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
+                            nft_trans_chain_update(trans))
                                continue;
                        policy = nft_trans_chain_policy(trans);
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 974300178fa9..02afa752dd2e 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -134,12 +134,13 @@ static int nft_bitwise_offload(struct nft_offload_ctx *ctx,
                               const struct nft_expr *expr)
 {
        const struct nft_bitwise *priv = nft_expr_priv(expr);
+        struct nft_offload_reg *reg = &ctx->regs[priv->dreg];
        if (memcmp(&priv->xor, &zero, sizeof(priv->xor)) ||
-            priv->sreg != priv->dreg)
+            priv->sreg != priv->dreg || priv->len != reg->len)
                return -EOPNOTSUPP;
-        memcpy(&ctx->regs[priv->dreg].mask, &priv->mask, sizeof(priv->mask));
+        memcpy(&reg->mask, &priv->mask, sizeof(priv->mask));
        return 0;
 }
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index bd173b1824c6..0744b2bb46da 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -116,7 +116,7 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
        u8 *mask = (u8 *)&flow->match.mask;
        u8 *key = (u8 *)&flow->match.key;
-        if (priv->op != NFT_CMP_EQ)
+        if (priv->op != NFT_CMP_EQ || reg->len != priv->len)
                return -EOPNOTSUPP;
        memcpy(key + reg->offset, &priv->data, priv->len);
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 17e6ca62f1be..afde0d763039 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1099,7 +1099,6 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
        local = nfc_llcp_find_local(dev);
        if (!local) {
-                nfc_put_device(dev);
                rc = -ENODEV;
                goto exit;
        }
@@ -1159,7 +1158,6 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
        local = nfc_llcp_find_local(dev);
        if (!local) {
-                nfc_put_device(dev);
                rc = -ENODEV;
                goto exit;
        }
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8717c0b26c90..20d60b8fcb70 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/idr.h>
 #include <linux/rhashtable.h>
+#include <linux/jhash.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/netlink.h>
@@ -47,6 +48,62 @@ static LIST_HEAD(tcf_proto_base);
 /* Protects list of registered TC modules. It is pure SMP lock. */
 static DEFINE_RWLOCK(cls_mod_lock);
+static u32 destroy_obj_hashfn(const struct tcf_proto *tp)
+{
+        return jhash_3words(tp->chain->index, tp->prio,
+                            (__force __u32)tp->protocol, 0);
+}
+static void tcf_proto_signal_destroying(struct tcf_chain *chain,
+                                        struct tcf_proto *tp)
+{
+        struct tcf_block *block = chain->block;
+        mutex_lock(&block->proto_destroy_lock);
+        hash_add_rcu(block->proto_destroy_ht, &tp->destroy_ht_node,
+                     destroy_obj_hashfn(tp));
+        mutex_unlock(&block->proto_destroy_lock);
+}
+static bool tcf_proto_cmp(const struct tcf_proto *tp1,
+                          const struct tcf_proto *tp2)
+{
+        return tp1->chain->index == tp2->chain->index &&
+               tp1->prio == tp2->prio &&
+               tp1->protocol == tp2->protocol;
+}
+static bool tcf_proto_exists_destroying(struct tcf_chain *chain,
+                                        struct tcf_proto *tp)
+{
+        u32 hash = destroy_obj_hashfn(tp);
+        struct tcf_proto *iter;
+        bool found = false;
+        rcu_read_lock();
+        hash_for_each_possible_rcu(chain->block->proto_destroy_ht, iter,
+                                   destroy_ht_node, hash) {
+                if (tcf_proto_cmp(tp, iter)) {
+                        found = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        return found;
+}
+static void
+tcf_proto_signal_destroyed(struct tcf_chain *chain, struct tcf_proto *tp)
+{
+        struct tcf_block *block = chain->block;
+        mutex_lock(&block->proto_destroy_lock);
+        if (hash_hashed(&tp->destroy_ht_node))
+                hash_del_rcu(&tp->destroy_ht_node);
+        mutex_unlock(&block->proto_destroy_lock);
+}
 /* Find classifier type by string name */
 static const struct tcf_proto_ops *__tcf_proto_lookup_ops(const char *kind)
@@ -234,9 +291,11 @@ static void tcf_proto_get(struct tcf_proto *tp)
 static void tcf_chain_put(struct tcf_chain *chain);
 static void tcf_proto_destroy(struct tcf_proto *tp, bool rtnl_held,
-                              struct netlink_ext_ack *extack)
+                              bool sig_destroy, struct netlink_ext_ack *extack)
 {
        tp->ops->destroy(tp, rtnl_held, extack);
+        if (sig_destroy)
+                tcf_proto_signal_destroyed(tp->chain, tp);
        tcf_chain_put(tp->chain);
        module_put(tp->ops->owner);
        kfree_rcu(tp, rcu);
@@ -246,7 +305,7 @@ static void tcf_proto_put(struct tcf_proto *tp, bool rtnl_held,
                          struct netlink_ext_ack *extack)
 {
        if (refcount_dec_and_test(&tp->refcnt))
-                tcf_proto_destroy(tp, rtnl_held, extack);
+                tcf_proto_destroy(tp, rtnl_held, true, extack);
 }
 static int walker_check_empty(struct tcf_proto *tp, void *fh,
@@ -370,6 +429,7 @@ static bool tcf_chain_detach(struct tcf_chain *chain)
 static void tcf_block_destroy(struct tcf_block *block)
 {
        mutex_destroy(&block->lock);
+        mutex_destroy(&block->proto_destroy_lock);
        kfree_rcu(block, rcu);
 }
@@ -545,6 +605,12 @@ static void tcf_chain_flush(struct tcf_chain *chain, bool rtnl_held)
        mutex_lock(&chain->filter_chain_lock);
        tp = tcf_chain_dereference(chain->filter_chain, chain);
+        while (tp) {
+                tp_next = rcu_dereference_protected(tp->next, 1);
+                tcf_proto_signal_destroying(chain, tp);
+                tp = tp_next;
+        }
+        tp = tcf_chain_dereference(chain->filter_chain, chain);
        RCU_INIT_POINTER(chain->filter_chain, NULL);
        tcf_chain0_head_change(chain, NULL);
        chain->flushing = true;
@@ -844,6 +910,7 @@ static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
                return ERR_PTR(-ENOMEM);
        }
        mutex_init(&block->lock);
+        mutex_init(&block->proto_destroy_lock);
        init_rwsem(&block->cb_lock);
        flow_block_init(&block->flow_block);
        INIT_LIST_HEAD(&block->chain_list);
@@ -1621,6 +1688,12 @@ static struct tcf_proto *tcf_chain_tp_insert_unique(struct tcf_chain *chain,
        mutex_lock(&chain->filter_chain_lock);
+        if (tcf_proto_exists_destroying(chain, tp_new)) {
+                mutex_unlock(&chain->filter_chain_lock);
+                tcf_proto_destroy(tp_new, rtnl_held, false, NULL);
+                return ERR_PTR(-EAGAIN);
+        }
        tp = tcf_chain_tp_find(chain, &chain_info,
                               protocol, prio, false);
        if (!tp)
@@ -1628,10 +1701,10 @@ static struct tcf_proto *tcf_chain_tp_insert_unique(struct tcf_chain *chain,
        mutex_unlock(&chain->filter_chain_lock);
        if (tp) {
-                tcf_proto_destroy(tp_new, rtnl_held, NULL);
+                tcf_proto_destroy(tp_new, rtnl_held, false, NULL);
                tp_new = tp;
        } else if (err) {
-                tcf_proto_destroy(tp_new, rtnl_held, NULL);
+                tcf_proto_destroy(tp_new, rtnl_held, false, NULL);
                tp_new = ERR_PTR(err);
        }
@@ -1669,6 +1742,7 @@ static void tcf_chain_tp_delete_empty(struct tcf_chain *chain,
                return;
        }
+        tcf_proto_signal_destroying(chain, tp);
        next = tcf_chain_dereference(chain_info.next, chain);
        if (tp == chain->filter_chain)
                tcf_chain0_head_change(chain, next);
@@ -2188,6 +2262,7 @@ static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
                err = -EINVAL;
                goto errout_locked;
        } else if (t->tcm_handle == 0) {
+                tcf_proto_signal_destroying(chain, tp);
                tcf_chain_tp_remove(chain, &chain_info, tp);
                mutex_unlock(&chain->filter_chain_lock);
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 2121187229cd..7cd68628c637 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1224,8 +1224,6 @@ static int taprio_enable_offload(struct net_device *dev,
                goto done;
        }
-        taprio_offload_config_changed(q);
 done:
        taprio_offload_free(offload);
@@ -1505,6 +1503,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
                        call_rcu(&admin->rcu, taprio_free_sched_cb);
                spin_unlock_irqrestore(&q->current_entry_lock, flags);
+                if (FULL_OFFLOAD_IS_ENABLED(taprio_flags))
+                        taprio_offload_config_changed(q);
        }
        new_admin = NULL;
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 2920b006f65c..571e6d84da3b 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -376,8 +376,6 @@ static int smc_pnet_fill_entry(struct net *net,
        return 0;
 error:
-        if (pnetelem->ndev)
-                dev_put(pnetelem->ndev);
        return rc;
 }
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index f959487c5cd1..683d00837693 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -523,8 +523,10 @@ last_record:
 int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
        unsigned char record_type = TLS_RECORD_TYPE_DATA;
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
        int rc;
+        mutex_lock(&tls_ctx->tx_lock);
        lock_sock(sk);
        if (unlikely(msg->msg_controllen)) {
@@ -538,12 +540,14 @@ int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 out:
        release_sock(sk);
+        mutex_unlock(&tls_ctx->tx_lock);
        return rc;
 }
 int tls_device_sendpage(struct sock *sk, struct page *page,
                        int offset, size_t size, int flags)
 {
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct iov_iter msg_iter;
        char *kaddr = kmap(page);
        struct kvec iov;
@@ -552,6 +556,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page,
        if (flags & MSG_SENDPAGE_NOTLAST)
                flags |= MSG_MORE;
+        mutex_lock(&tls_ctx->tx_lock);
        lock_sock(sk);
        if (flags & MSG_OOB) {
@@ -568,6 +573,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page,
 out:
        release_sock(sk);
+        mutex_unlock(&tls_ctx->tx_lock);
        return rc;
 }
@@ -623,9 +629,11 @@ static int tls_device_push_pending_record(struct sock *sk, int flags)
 void tls_device_write_space(struct sock *sk, struct tls_context *ctx)
 {
-        if (!sk->sk_write_pending && tls_is_partially_sent_record(ctx)) {
+        if (tls_is_partially_sent_record(ctx)) {
                gfp_t sk_allocation = sk->sk_allocation;
+                WARN_ON_ONCE(sk->sk_write_pending);
                sk->sk_allocation = GFP_ATOMIC;
                tls_push_partial_record(sk, ctx,
                                        MSG_DONTWAIT | MSG_NOSIGNAL |
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index ac88877dcade..0775ae40fcfb 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -267,6 +267,7 @@ void tls_ctx_free(struct sock *sk, struct tls_context *ctx)
        memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send));
        memzero_explicit(&ctx->crypto_recv, sizeof(ctx->crypto_recv));
+        mutex_destroy(&ctx->tx_lock);
        if (sk)
                kfree_rcu(ctx, rcu);
@@ -612,6 +613,7 @@ static struct tls_context *create_ctx(struct sock *sk)
        if (!ctx)
                return NULL;
+        mutex_init(&ctx->tx_lock);
        rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
        ctx->sk_proto = sk->sk_prot;
        return ctx;
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index c2b5e0d2ba1a..446f23c1f3ce 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -897,15 +897,9 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
        if (msg->msg_flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL))
                return -ENOTSUPP;
+        mutex_lock(&tls_ctx->tx_lock);
        lock_sock(sk);
-        /* Wait till there is any pending write on socket */
-        if (unlikely(sk->sk_write_pending)) {
-                ret = wait_on_pending_writer(sk, &timeo);
-                if (unlikely(ret))
-                        goto send_end;
-        }
        if (unlikely(msg->msg_controllen)) {
                ret = tls_proccess_cmsg(sk, msg, &record_type);
                if (ret) {
@@ -1091,6 +1085,7 @@ send_end:
        ret = sk_stream_error(sk, msg->msg_flags, ret);
        release_sock(sk);
+        mutex_unlock(&tls_ctx->tx_lock);
        return copied ? copied : ret;
 }
@@ -1114,13 +1109,6 @@ static int tls_sw_do_sendpage(struct sock *sk, struct page *page,
        eor = !(flags & (MSG_MORE | MSG_SENDPAGE_NOTLAST));
        sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
-        /* Wait till there is any pending write on socket */
-        if (unlikely(sk->sk_write_pending)) {
-                ret = wait_on_pending_writer(sk, &timeo);
-                if (unlikely(ret))
-                        goto sendpage_end;
-        }
        /* Call the sk_stream functions to manage the sndbuf mem. */
        while (size > 0) {
                size_t copy, required_size;
@@ -1219,15 +1207,18 @@ sendpage_end:
 int tls_sw_sendpage(struct sock *sk, struct page *page,
                    int offset, size_t size, int flags)
 {
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
        int ret;
        if (flags & ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL |
                      MSG_SENDPAGE_NOTLAST | MSG_SENDPAGE_NOPOLICY))
                return -ENOTSUPP;
+        mutex_lock(&tls_ctx->tx_lock);
        lock_sock(sk);
        ret = tls_sw_do_sendpage(sk, page, offset, size, flags);
        release_sock(sk);
+        mutex_unlock(&tls_ctx->tx_lock);
        return ret;
 }
@@ -2170,9 +2161,11 @@ static void tx_work_handler(struct work_struct *work)
        if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
                return;
+        mutex_lock(&tls_ctx->tx_lock);
        lock_sock(sk);
        tls_tx_records(sk, -1);
        release_sock(sk);
+        mutex_unlock(&tls_ctx->tx_lock);
 }
 void tls_sw_write_space(struct sock *sk, struct tls_context *ctx)
@@ -2180,12 +2173,9 @@ void tls_sw_write_space(struct sock *sk, struct tls_context *ctx)
        struct tls_sw_context_tx *tx_ctx = tls_sw_ctx_tx(ctx);
        /* Schedule the transmission if tx list is ready */
-        if (is_tx_ready(tx_ctx) && !sk->sk_write_pending) {
+        if (is_tx_ready(tx_ctx) &&
-                /* Schedule the transmission */
+            !test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
-                if (!test_and_set_bit(BIT_TX_SCHEDULED,
+                schedule_delayed_work(&tx_ctx->tx_work.work, 0);
-                                      &tx_ctx->tx_bitmask))
-                        schedule_delayed_work(&tx_ctx->tx_work.work, 0);
-        }
 }
 void tls_sw_strparser_arm(struct sock *sk, struct tls_context *tls_ctx)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 481f7f8a1655..fb2060dffb0a 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -947,9 +947,11 @@ virtio_transport_recv_connected(struct sock *sk,
                if (le32_to_cpu(pkt->hdr.flags) & VIRTIO_VSOCK_SHUTDOWN_SEND)
                        vsk->peer_shutdown |= SEND_SHUTDOWN;
                if (vsk->peer_shutdown == SHUTDOWN_MASK &&
-                    vsock_stream_has_data(vsk) <= 0) {
+                    vsock_stream_has_data(vsk) <= 0 &&
-                        sock_set_flag(sk, SOCK_DONE);
+                    !sock_flag(sk, SOCK_DONE)) {
-                        sk->sk_state = TCP_CLOSING;
+                        (void)virtio_transport_reset(vsk, NULL);
+                        virtio_transport_do_close(vsk, true);
                }
                if (le32_to_cpu(pkt->hdr.flags))
                        sk->sk_state_change(sk);
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 1d9be26b4edd..42b571cde177 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -176,6 +176,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/bpf/
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
 KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
+KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
 HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
index 7b7c2fafbc68..be984aa29b75 100644
--- a/scripts/gdb/linux/symbols.py
+++ b/scripts/gdb/linux/symbols.py
@@ -99,7 +99,8 @@ lx-symbols command."""
            attrs[n]['name'].string(): attrs[n]['address']
            for n in range(int(sect_attrs['nsections']))}
        args = []
-        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
+        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
+                             ".text", ".text.hot", ".text.unlikely"]:
            address = section_name_to_address.get(section_name)
            if address:
                args.append(" -s {name} {addr}".format(
diff --git a/scripts/nsdeps b/scripts/nsdeps
index dda6fbac016e..04cea0921673 100644
--- a/scripts/nsdeps
+++ b/scripts/nsdeps
@@ -31,12 +31,12 @@ generate_deps() {
        local mod_file=`echo $@ | sed -e 's/\.ko/\.mod/'`
        local ns_deps_file=`echo $@ | sed -e 's/\.ko/\.ns_deps/'`
        if [ ! -f "$ns_deps_file" ]; then return; fi
-        local mod_source_files=`cat $mod_file | sed -n 1p                      \
+        local mod_source_files="`cat $mod_file | sed -n 1p                      \
                                              | sed -e 's/\.o/\.c/g'           \
-                                              | sed "s|[^ ]* *|${srctree}/&|g"`
+                                              | sed "s|[^ ]* *|${srctree}/&|g"`"
        for ns in `cat $ns_deps_file`; do
                echo "Adding namespace $ns to module $mod_name (if needed)."
-                generate_deps_for_ns $ns $mod_source_files
+                generate_deps_for_ns $ns "$mod_source_files"
                # sort the imports
                for source_file in $mod_source_files; do
                        sed '/MODULE_IMPORT_NS/Q' $source_file > ${source_file}.tmp
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 41905afada63..f34ce564d92c 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
        /* first let's check the buffer parameter's */
        if (params->buffer.fragment_size == 0 ||
-            params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+            params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
            params->buffer.fragments == 0)
                return -EINVAL;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 6b724d2ee2de..59ae21b0bb93 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -284,11 +284,11 @@ int snd_timer_open(struct snd_timer_instance **ti,
                goto unlock;
        }
        if (!list_empty(&timer->open_list_head)) {
-                timeri = list_entry(timer->open_list_head.next,
+                struct snd_timer_instance *t =
+                        list_entry(timer->open_list_head.next,
                                    struct snd_timer_instance, open_list);
-                if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+                if (t->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
                        err = -EBUSY;
-                        timeri = NULL;
                        goto unlock;
                }
        }
diff --git a/sound/firewire/bebob/bebob_focusrite.c b/sound/firewire/bebob/bebob_focusrite.c
index 32b864bee25f..06d6a37cd853 100644
--- a/sound/firewire/bebob/bebob_focusrite.c
+++ b/sound/firewire/bebob/bebob_focusrite.c
@@ -27,6 +27,8 @@
 #define SAFFIRE_CLOCK_SOURCE_SPDIF              1
 /* clock sources as returned from register of Saffire Pro 10 and 26 */
+#define SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK     0x000000ff
+#define SAFFIREPRO_CLOCK_SOURCE_DETECT_MASK     0x0000ff00
 #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL        0
 #define SAFFIREPRO_CLOCK_SOURCE_SKIP            1 /* never used on hardware */
 #define SAFFIREPRO_CLOCK_SOURCE_SPDIF           2
@@ -189,6 +191,7 @@ saffirepro_both_clk_src_get(struct snd_bebob *bebob, unsigned int *id)
                map = saffirepro_clk_maps[1];
        /* In a case that this driver cannot handle the value of register. */
+        value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK;
        if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) {
                err = -EIO;
                goto end;
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 6d1fb7c11f17..b7a1abb3e231 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -7604,7 +7604,7 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
        /* Delay enabling the HP amp, to let the mic-detection
         * state machine run.
         */
-        cancel_delayed_work_sync(&spec->unsol_hp_work);
+        cancel_delayed_work(&spec->unsol_hp_work);
        schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
        tbl = snd_hda_jack_tbl_get(codec, cb->nid);
        if (tbl)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b72553710ffb..3c720703ebb8 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2851,6 +2851,18 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec)
        return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
 }
+static int patch_i915_tgl_hdmi(struct hda_codec *codec)
+{
+        /*
+         * pin to port mapping table where the value indicate the pin number and
+         * the index indicate the port number with 1 base.
+         */
+        static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
+        return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
+}
 /* Intel Baytrail and Braswell; with eld notifier */
 static int patch_i915_byt_hdmi(struct hda_codec *codec)
 {
@@ -4153,6 +4165,7 @@ HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",	patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI",     patch_i915_icl_hdmi),
+HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI",   patch_i915_tgl_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",  patch_generic_hdmi),
 HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi),
 HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI",    patch_i915_byt_hdmi),
diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index 91242b6f8ea7..4570f662fb48 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -410,8 +410,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
                return;
        }
-        snd_hdac_ext_bus_link_put(hdev->bus, hlink);
        pm_runtime_disable(&hdev->dev);
+        snd_hdac_ext_bus_link_put(hdev->bus, hlink);
 }
 static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index b5fd8f08726e..f8b5b960e597 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -274,7 +274,7 @@ struct hdmi_codec_priv {
        uint8_t eld[MAX_ELD_BYTES];
        struct snd_pcm_chmap *chmap_info;
        unsigned int chmap_idx;
-        struct mutex lock;
+        unsigned long busy;
        struct snd_soc_jack *jack;
        unsigned int jack_status;
 };
@@ -390,8 +390,8 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream,
        struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
        int ret = 0;
-        ret = mutex_trylock(&hcp->lock);
+        ret = test_and_set_bit(0, &hcp->busy);
-        if (!ret) {
+        if (ret) {
                dev_err(dai->dev, "Only one simultaneous stream supported!\n");
                return -EINVAL;
        }
@@ -419,7 +419,7 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream,
 err:
        /* Release the exclusive lock on error */
-        mutex_unlock(&hcp->lock);
+        clear_bit(0, &hcp->busy);
        return ret;
 }
@@ -431,7 +431,7 @@ static void hdmi_codec_shutdown(struct snd_pcm_substream *substream,
        hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN;
        hcp->hcd.ops->audio_shutdown(dai->dev->parent, hcp->hcd.data);
-        mutex_unlock(&hcp->lock);
+        clear_bit(0, &hcp->busy);
 }
 static int hdmi_codec_hw_params(struct snd_pcm_substream *substream,
@@ -811,8 +811,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                return -ENOMEM;
        hcp->hcd = *hcd;
-        mutex_init(&hcp->lock);
        daidrv = devm_kcalloc(dev, dai_count, sizeof(*daidrv), GFP_KERNEL);
        if (!daidrv)
                return -ENOMEM;
diff --git a/sound/soc/codecs/max98373.c b/sound/soc/codecs/max98373.c
index eb709d528259..cae1def8902d 100644
--- a/sound/soc/codecs/max98373.c
+++ b/sound/soc/codecs/max98373.c
@@ -960,11 +960,11 @@ static int max98373_i2c_probe(struct i2c_client *i2c,
        /* Power on device */
        if (gpio_is_valid(max98373->reset_gpio)) {
-                ret = gpio_request(max98373->reset_gpio, "MAX98373_RESET");
+                ret = devm_gpio_request(&i2c->dev, max98373->reset_gpio,
+                                        "MAX98373_RESET");
                if (ret) {
                        dev_err(&i2c->dev, "%s: Failed to request gpio %d\n",
                                __func__, max98373->reset_gpio);
-                        gpio_free(max98373->reset_gpio);
                        return -EINVAL;
                }
                gpio_direction_output(max98373->reset_gpio, 0);
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index 667e9f73aba3..e3d311fb510e 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -306,7 +306,7 @@ struct pm8916_wcd_analog_priv {
 };
 static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
+static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
 static const char *const hph_text[] = { "ZERO", "Switch", };
 static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
@@ -321,7 +321,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
 /* RDAC2 MUX */
 static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
-                        CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
+                        CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
 static const struct snd_kcontrol_new spkr_switch[] = {
        SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index 61226fefe1c4..2a4ffe945177 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -555,10 +555,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                return PTR_ERR(priv->clk);
        }
-        err = clk_prepare_enable(priv->clk);
-        if (err < 0)
-                return err;
        priv->extclk = devm_clk_get(&pdev->dev, "extclk");
        if (IS_ERR(priv->extclk)) {
                if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
@@ -574,6 +570,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                }
        }
+        err = clk_prepare_enable(priv->clk);
+        if (err < 0)
+                return err;
        /* Some sensible defaults - this reflects the powerup values */
        priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
        priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
@@ -587,7 +587,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
        }
-        err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+        err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
                                         soc_dai, 2);
        if (err) {
                dev_err(&pdev->dev, "snd_soc_register_component failed\n");
@@ -610,6 +610,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
 {
        struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
+        snd_soc_unregister_component(&pdev->dev);
        if (!IS_ERR(priv->extclk))
                clk_disable_unprepare(priv->extclk);
        clk_disable_unprepare(priv->clk);
diff --git a/sound/soc/rockchip/rockchip_max98090.c b/sound/soc/rockchip/rockchip_max98090.c
index 0097df1fae66..e80b09143b63 100644
--- a/sound/soc/rockchip/rockchip_max98090.c
+++ b/sound/soc/rockchip/rockchip_max98090.c
@@ -66,10 +66,13 @@ static int rk_jack_event(struct notifier_block *nb, unsigned long event,
        struct snd_soc_jack *jack = (struct snd_soc_jack *)data;
        struct snd_soc_dapm_context *dapm = &jack->card->dapm;
-        if (event & SND_JACK_MICROPHONE)
+        if (event & SND_JACK_MICROPHONE) {
                snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
-        else
+                snd_soc_dapm_force_enable_pin(dapm, "SHDN");
+        } else {
                snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+                snd_soc_dapm_disable_pin(dapm, "SHDN");
+        }
        snd_soc_dapm_sync(dapm);
diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c
index 0324a5c39619..28f65eba2bb4 100644
--- a/sound/soc/sh/rcar/dma.c
+++ b/sound/soc/sh/rcar/dma.c
@@ -508,10 +508,10 @@ static struct rsnd_mod_ops rsnd_dmapp_ops = {
 #define RDMA_SSI_I_N(addr, i)   (addr ##_reg - 0x00300000 + (0x40 * i) + 0x8)
 #define RDMA_SSI_O_N(addr, i)   (addr ##_reg - 0x00300000 + (0x40 * i) + 0xc)
-#define RDMA_SSIU_I_N(addr, i, j) (addr ##_reg - 0x00441000 + (0x1000 * (i)) + (((j) / 4) * 0xA000) + (((j) % 4) * 0x400))
+#define RDMA_SSIU_I_N(addr, i, j) (addr ##_reg - 0x00441000 + (0x1000 * (i)) + (((j) / 4) * 0xA000) + (((j) % 4) * 0x400) - (0x4000 * ((i) / 9) * ((j) / 4)))
 #define RDMA_SSIU_O_N(addr, i, j) RDMA_SSIU_I_N(addr, i, j)
-#define RDMA_SSIU_I_P(addr, i, j) (addr ##_reg - 0x00141000 + (0x1000 * (i)) + (((j) / 4) * 0xA000) + (((j) % 4) * 0x400))
+#define RDMA_SSIU_I_P(addr, i, j) (addr ##_reg - 0x00141000 + (0x1000 * (i)) + (((j) / 4) * 0xA000) + (((j) % 4) * 0x400) - (0x4000 * ((i) / 9) * ((j) / 4)))
 #define RDMA_SSIU_O_P(addr, i, j) RDMA_SSIU_I_P(addr, i, j)
 #define RDMA_SRC_I_N(addr, i)   (addr ##_reg - 0x00500000 + (0x400 * i))
diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
index 54cd431faab7..5529e8eeca46 100644
--- a/sound/soc/sof/debug.c
+++ b/sound/soc/sof/debug.c
@@ -152,8 +152,10 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer,
         */
        dentry = file->f_path.dentry;
        if (strcmp(dentry->d_name.name, "ipc_flood_count") &&
-            strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
+            strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
+        }
        if (!strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
                flood_duration_test = true;
diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
index 2c7447188402..0c11fceb28a7 100644
--- a/sound/soc/sof/intel/hda-stream.c
+++ b/sound/soc/sof/intel/hda-stream.c
@@ -190,7 +190,7 @@ hda_dsp_stream_get(struct snd_sof_dev *sdev, int direction)
         * Workaround to address a known issue with host DMA that results
         * in xruns during pause/release in capture scenarios.
         */
-        if (!IS_ENABLED(SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1))
+        if (!IS_ENABLED(CONFIG_SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1))
                if (stream && direction == SNDRV_PCM_STREAM_CAPTURE)
                        snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR,
                                                HDA_VS_INTEL_EM2,
@@ -228,7 +228,7 @@ int hda_dsp_stream_put(struct snd_sof_dev *sdev, int direction, int stream_tag)
        spin_unlock_irq(&bus->reg_lock);
        /* Enable DMI L1 entry if there are no capture streams open */
-        if (!IS_ENABLED(SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1))
+        if (!IS_ENABLED(CONFIG_SND_SOC_SOF_HDA_ALWAYS_ENABLE_DMI_L1))
                if (!active_capture_stream)
                        snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR,
                                                HDA_VS_INTEL_EM2,
diff --git a/sound/soc/sof/ipc.c b/sound/soc/sof/ipc.c
index b2f359d2f7e5..086eeeab8679 100644
--- a/sound/soc/sof/ipc.c
+++ b/sound/soc/sof/ipc.c
@@ -572,8 +572,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev,
        else
                err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata,
                                               sparams);
-        if (err < 0)
+        if (err < 0) {
+                kfree(partdata);
                return err;
+        }
        msg_bytes = sparams->msg_bytes;
        pl_size = sparams->pl_size;
diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
index 0aabb3190ddc..4452594c2e17 100644
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -543,15 +543,16 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp,
        struct soc_bytes_ext *sbe = (struct soc_bytes_ext *)kc->private_value;
        int max_size = sbe->max;
-        if (le32_to_cpu(control->priv.size) > max_size) {
+        /* init the get/put bytes data */
+        scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
+                le32_to_cpu(control->priv.size);
+        if (scontrol->size > max_size) {
                dev_err(sdev->dev, "err: bytes data size %d exceeds max %d.\n",
-                        control->priv.size, max_size);
+                        scontrol->size, max_size);
                return -EINVAL;
        }
-        /* init the get/put bytes data */
-        scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
-                le32_to_cpu(control->priv.size);
        scontrol->control_data = kzalloc(max_size, GFP_KERNEL);
        cdata = scontrol->control_data;
        if (!scontrol->control_data)
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index a4060813bc74..48e629ac2d88 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -1218,6 +1218,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
        return 0;
 }
+/* No support of mmap in S/PDIF mode */
+static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
+        .info = SNDRV_PCM_INFO_INTERLEAVED,
+        .buffer_bytes_max = 8 * PAGE_SIZE,
+        .period_bytes_min = 1024,
+        .period_bytes_max = PAGE_SIZE,
+        .periods_min = 2,
+        .periods_max = 8,
+};
 static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
        .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
        .buffer_bytes_max = 8 * PAGE_SIZE,
@@ -1270,7 +1280,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
 };
 static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
-        .pcm_hardware = &stm32_sai_pcm_hw,
+        .pcm_hardware = &stm32_sai_pcm_hw_spdif,
        .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
        .process = stm32_sai_pcm_process_spdif,
 };
diff --git a/sound/soc/ti/sdma-pcm.c b/sound/soc/ti/sdma-pcm.c
index a236350beb10..2b0bc234e1b6 100644
--- a/sound/soc/ti/sdma-pcm.c
+++ b/sound/soc/ti/sdma-pcm.c
@@ -62,7 +62,7 @@ int sdma_pcm_platform_register(struct device *dev,
        config->chan_names[0] = txdmachan;
        config->chan_names[1] = rxdmachan;
-        return devm_snd_dmaengine_pcm_register(dev, config, 0);
+        return devm_snd_dmaengine_pcm_register(dev, config, flags);
 }
 EXPORT_SYMBOL_GPL(sdma_pcm_platform_register);
diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
index 6ecdd1067826..1178d302757e 100644
--- a/tools/gpio/Makefile
+++ b/tools/gpio/Makefile
@@ -3,7 +3,11 @@ include ../scripts/Makefile.include
 bindir ?= /usr/bin
-ifeq ($(srctree),)
+# This will work when gpio is built in tools env. where srctree
+# isn't set and when invoked from selftests build, where srctree
+# is set to ".". building_out_of_srctree is undefined for in srctree
+# builds
+ifndef building_out_of_srctree
 srctree := $(patsubst %/,%,$(dir $(CURDIR)))
 srctree := $(patsubst %/,%,$(dir $(srctree)))
 endif
diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
index 63e4349a772a..15e458e150bd 100644
--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -15,7 +15,9 @@ void test_attr__init(void);
 void test_attr__open(struct perf_event_attr *attr, pid_t pid, int cpu,
                     int fd, int group_fd, unsigned long flags);
-#define HAVE_ATTR_TEST
+#ifndef HAVE_ATTR_TEST
+#define HAVE_ATTR_TEST 1
+#endif
 static inline int
 sys_perf_event_open(struct perf_event_attr *attr,
@@ -27,7 +29,7 @@ sys_perf_event_open(struct perf_event_attr *attr,
        fd = syscall(__NR_perf_event_open, attr, pid, cpu,
                     group_fd, flags);
-#ifdef HAVE_ATTR_TEST
+#if HAVE_ATTR_TEST
        if (unlikely(test_attr__enabled))
                test_attr__open(attr, pid, cpu, fd, group_fd, flags);
 #endif
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 679a1d75090c..7b6eaf5e0bda 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1625,7 +1625,7 @@ int hists__collapse_resort(struct hists *hists, struct ui_progress *prog)
        return 0;
 }
-static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
+static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
 {
        struct hists *hists = a->hists;
        struct perf_hpp_fmt *fmt;
diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index 15961854ba67..741f040648b5 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -539,10 +539,11 @@ static int perl_stop_script(void)
 static int perl_generate_script(struct tep_handle *pevent, const char *outfile)
 {
+        int i, not_first, count, nr_events;
+        struct tep_event **all_events;
        struct tep_event *event = NULL;
        struct tep_format_field *f;
        char fname[PATH_MAX];
-        int not_first, count;
        FILE *ofp;
        sprintf(fname, "%s.pl", outfile);
@@ -603,8 +604,11 @@ sub print_backtrace\n\
 }\n\n\
 ");
+        nr_events = tep_get_events_count(pevent);
+        all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
-        while ((event = trace_find_next_event(pevent, event))) {
+        for (i = 0; all_events && i < nr_events; i++) {
+                event = all_events[i];
                fprintf(ofp, "sub %s::%s\n{\n", event->system, event->name);
                fprintf(ofp, "\tmy (");
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 5d341efc3237..93c03b39cd9c 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1687,10 +1687,11 @@ static int python_stop_script(void)
 static int python_generate_script(struct tep_handle *pevent, const char *outfile)
 {
+        int i, not_first, count, nr_events;
+        struct tep_event **all_events;
        struct tep_event *event = NULL;
        struct tep_format_field *f;
        char fname[PATH_MAX];
-        int not_first, count;
        FILE *ofp;
        sprintf(fname, "%s.py", outfile);
@@ -1735,7 +1736,11 @@ static int python_generate_script(struct tep_handle *pevent, const char *outfile
        fprintf(ofp, "def trace_end():\n");
        fprintf(ofp, "\tprint(\"in trace_end\")\n\n");
-        while ((event = trace_find_next_event(pevent, event))) {
+        nr_events = tep_get_events_count(pevent);
+        all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
+        for (i = 0; all_events && i < nr_events; i++) {
+                event = all_events[i];
                fprintf(ofp, "def %s__%s(", event->system, event->name);
                fprintf(ofp, "event_name, ");
                fprintf(ofp, "context, ");
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 5d6bfc70b210..9634f0ae57be 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -173,37 +173,6 @@ int parse_event_file(struct tep_handle *pevent,
        return tep_parse_event(pevent, buf, size, sys);
 }
-struct tep_event *trace_find_next_event(struct tep_handle *pevent,
-                                        struct tep_event *event)
-{
-        static int idx;
-        int events_count;
-        struct tep_event *all_events;
-        all_events = tep_get_first_event(pevent);
-        events_count = tep_get_events_count(pevent);
-        if (!pevent || !all_events || events_count < 1)
-                return NULL;
-        if (!event) {
-                idx = 0;
-                return all_events;
-        }
-        if (idx < events_count && event == (all_events + idx)) {
-                idx++;
-                if (idx == events_count)
-                        return NULL;
-                return (all_events + idx);
-        }
-        for (idx = 1; idx < events_count; idx++) {
-                if (event == (all_events + (idx - 1)))
-                        return (all_events + idx);
-        }
-        return NULL;
-}
 struct flag {
        const char *name;
        unsigned long long value;
diff --git a/tools/perf/util/trace-event.h b/tools/perf/util/trace-event.h
index 2e158387b3d7..72fdf2a3577c 100644
--- a/tools/perf/util/trace-event.h
+++ b/tools/perf/util/trace-event.h
@@ -47,8 +47,6 @@ void parse_saved_cmdline(struct tep_handle *pevent, char *file, unsigned int siz
 ssize_t trace_report(int fd, struct trace_event *tevent, bool repipe);
-struct tep_event *trace_find_next_event(struct tep_handle *pevent,
-                                        struct tep_event *event);
 unsigned long long read_size(struct tep_event *event, void *ptr, int size);
 unsigned long long eval_flag(const char *flag);
diff --git a/tools/testing/selftests/bpf/test_sysctl.c b/tools/testing/selftests/bpf/test_sysctl.c
index a320e3844b17..7c6e5b173f33 100644
--- a/tools/testing/selftests/bpf/test_sysctl.c
+++ b/tools/testing/selftests/bpf/test_sysctl.c
@@ -161,9 +161,14 @@ static struct sysctl_test tests[] = {
                .descr = "ctx:file_pos sysctl:read read ok narrow",
                .insns = {
                        /* If (file_pos == X) */
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
                                    offsetof(struct bpf_sysctl, file_pos)),
-                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2),
+#else
+                        BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
+                                    offsetof(struct bpf_sysctl, file_pos) + 3),
+#endif
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 4, 2),
                        /* return ALLOW; */
                        BPF_MOV64_IMM(BPF_REG_0, 1),
@@ -176,6 +181,7 @@ static struct sysctl_test tests[] = {
                .attach_type = BPF_CGROUP_SYSCTL,
                .sysctl = "kernel/ostype",
                .open_flags = O_RDONLY,
+                .seek = 4,
                .result = SUCCESS,
        },
        {
diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
index 4c285b6e1db8..1c8f194d6556 100644
--- a/tools/testing/selftests/net/tls.c
+++ b/tools/testing/selftests/net/tls.c
@@ -898,6 +898,114 @@ TEST_F(tls, nonblocking)
        }
 }
+static void
+test_mutliproc(struct __test_metadata *_metadata, struct _test_data_tls *self,
+               bool sendpg, unsigned int n_readers, unsigned int n_writers)
+{
+        const unsigned int n_children = n_readers + n_writers;
+        const size_t data = 6 * 1000 * 1000;
+        const size_t file_sz = data / 100;
+        size_t read_bias, write_bias;
+        int i, fd, child_id;
+        char buf[file_sz];
+        pid_t pid;
+        /* Only allow multiples for simplicity */
+        ASSERT_EQ(!(n_readers % n_writers) || !(n_writers % n_readers), true);
+        read_bias = n_writers / n_readers ?: 1;
+        write_bias = n_readers / n_writers ?: 1;
+        /* prep a file to send */
+        fd = open("/tmp/", O_TMPFILE | O_RDWR, 0600);
+        ASSERT_GE(fd, 0);
+        memset(buf, 0xac, file_sz);
+        ASSERT_EQ(write(fd, buf, file_sz), file_sz);
+        /* spawn children */
+        for (child_id = 0; child_id < n_children; child_id++) {
+                pid = fork();
+                ASSERT_NE(pid, -1);
+                if (!pid)
+                        break;
+        }
+        /* parent waits for all children */
+        if (pid) {
+                for (i = 0; i < n_children; i++) {
+                        int status;
+                        wait(&status);
+                        EXPECT_EQ(status, 0);
+                }
+                return;
+        }
+        /* Split threads for reading and writing */
+        if (child_id < n_readers) {
+                size_t left = data * read_bias;
+                char rb[8001];
+                while (left) {
+                        int res;
+                        res = recv(self->cfd, rb,
+                                   left > sizeof(rb) ? sizeof(rb) : left, 0);
+                        EXPECT_GE(res, 0);
+                        left -= res;
+                }
+        } else {
+                size_t left = data * write_bias;
+                while (left) {
+                        int res;
+                        ASSERT_EQ(lseek(fd, 0, SEEK_SET), 0);
+                        if (sendpg)
+                                res = sendfile(self->fd, fd, NULL,
+                                               left > file_sz ? file_sz : left);
+                        else
+                                res = send(self->fd, buf,
+                                           left > file_sz ? file_sz : left, 0);
+                        EXPECT_GE(res, 0);
+                        left -= res;
+                }
+        }
+}
+TEST_F(tls, mutliproc_even)
+{
+        test_mutliproc(_metadata, self, false, 6, 6);
+}
+TEST_F(tls, mutliproc_readers)
+{
+        test_mutliproc(_metadata, self, false, 4, 12);
+}
+TEST_F(tls, mutliproc_writers)
+{
+        test_mutliproc(_metadata, self, false, 10, 2);
+}
+TEST_F(tls, mutliproc_sendpage_even)
+{
+        test_mutliproc(_metadata, self, true, 6, 6);
+}
+TEST_F(tls, mutliproc_sendpage_readers)
+{
+        test_mutliproc(_metadata, self, true, 4, 12);
+}
+TEST_F(tls, mutliproc_sendpage_writers)
+{
+        test_mutliproc(_metadata, self, true, 10, 2);
+}
 TEST_F(tls, control_msg)
 {
        if (self->notls)
diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index cb3fc09645c4..485cf06ef013 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -71,7 +71,7 @@ int main(int argc, char **argv)
                        flags |= MAP_SHARED;
                        break;
                case 'H':
-                        flags |= MAP_HUGETLB;
+                        flags |= (MAP_HUGETLB | MAP_ANONYMOUS);
                        break;
                default:
                        return -1;