350 files changed, 3831 insertions, 1901 deletions

diff --git a/.clang-format b/.clang-format
index 3a4c8220df2f..2ffd69afc1a8 100644
--- a/.clang-format
+++ b/.clang-format
@@ -78,6 +78,8 @@ ForEachMacros:
   - 'ata_qc_for_each_with_internal'
   - 'ax25_for_each'
   - 'ax25_uid_for_each'
+  - '__bio_for_each_bvec'
+  - 'bio_for_each_bvec'
   - 'bio_for_each_integrity_vec'
   - '__bio_for_each_segment'
   - 'bio_for_each_segment'
@@ -118,10 +120,12 @@ ForEachMacros:
   - 'drm_for_each_legacy_plane'
   - 'drm_for_each_plane'
   - 'drm_for_each_plane_mask'
+  - 'drm_for_each_privobj'
   - 'drm_mm_for_each_hole'
   - 'drm_mm_for_each_node'
   - 'drm_mm_for_each_node_in_range'
   - 'drm_mm_for_each_node_safe'
+  - 'flow_action_for_each'
   - 'for_each_active_drhd_unit'
   - 'for_each_active_iommu'
   - 'for_each_available_child_of_node'
@@ -158,6 +162,9 @@ ForEachMacros:
   - 'for_each_dss_dev'
   - 'for_each_efi_memory_desc'
   - 'for_each_efi_memory_desc_in_map'
+  - 'for_each_element'
+  - 'for_each_element_extid'
+  - 'for_each_element_id'
   - 'for_each_endpoint_of_node'
   - 'for_each_evictable_lru'
   - 'for_each_fib6_node_rt_rcu'
@@ -195,6 +202,7 @@ ForEachMacros:
   - 'for_each_net_rcu'
   - 'for_each_new_connector_in_state'
   - 'for_each_new_crtc_in_state'
+  - 'for_each_new_mst_mgr_in_state'
   - 'for_each_new_plane_in_state'
   - 'for_each_new_private_obj_in_state'
   - 'for_each_node'
@@ -210,8 +218,10 @@ ForEachMacros:
   - 'for_each_of_pci_range'
   - 'for_each_old_connector_in_state'
   - 'for_each_old_crtc_in_state'
+  - 'for_each_old_mst_mgr_in_state'
   - 'for_each_oldnew_connector_in_state'
   - 'for_each_oldnew_crtc_in_state'
+  - 'for_each_oldnew_mst_mgr_in_state'
   - 'for_each_oldnew_plane_in_state'
   - 'for_each_oldnew_plane_in_state_reverse'
   - 'for_each_oldnew_private_obj_in_state'
@@ -243,6 +253,9 @@ ForEachMacros:
   - 'for_each_sg_dma_page'
   - 'for_each_sg_page'
   - 'for_each_sibling_event'
+  - 'for_each_subelement'
+  - 'for_each_subelement_extid'
+  - 'for_each_subelement_id'
   - '__for_each_thread'
   - 'for_each_thread'
   - 'for_each_zone'
@@ -252,6 +265,8 @@ ForEachMacros:
   - 'fwnode_for_each_child_node'
   - 'fwnode_graph_for_each_endpoint'
   - 'gadget_for_each_ep'
+  - 'genradix_for_each'
+  - 'genradix_for_each_from'
   - 'hash_for_each'
   - 'hash_for_each_possible'
   - 'hash_for_each_possible_rcu'
@@ -293,7 +308,11 @@ ForEachMacros:
   - 'key_for_each'
   - 'key_for_each_safe'
   - 'klp_for_each_func'
+  - 'klp_for_each_func_safe'
+  - 'klp_for_each_func_static'
   - 'klp_for_each_object'
+  - 'klp_for_each_object_safe'
+  - 'klp_for_each_object_static'
   - 'kvm_for_each_memslot'
   - 'kvm_for_each_vcpu'
   - 'list_for_each'
@@ -324,6 +343,8 @@ ForEachMacros:
   - 'media_device_for_each_intf'
   - 'media_device_for_each_link'
   - 'media_device_for_each_pad'
+  - 'mp_bvec_for_each_page'
+  - 'mp_bvec_for_each_segment'
   - 'nanddev_io_for_each_page'
   - 'netdev_for_each_lower_dev'
   - 'netdev_for_each_lower_private'
@@ -375,6 +396,7 @@ ForEachMacros:
   - 'rht_for_each_rcu'
   - 'rht_for_each_rcu_from'
   - '__rq_for_each_bio'
+  - 'rq_for_each_bvec'
   - 'rq_for_each_segment'
   - 'scsi_for_each_prot_sg'
   - 'scsi_for_each_sg'
@@ -410,6 +432,8 @@ ForEachMacros:
   - 'v4l2_m2m_for_each_src_buf_safe'
   - 'virtio_device_for_each_vq'
   - 'xa_for_each'
+  - 'xa_for_each_marked'
+  - 'xa_for_each_start'
   - 'xas_for_each'
   - 'xas_for_each_conflict'
   - 'xas_for_each_marked'
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 2df5894353d6..cd7303d7fa25 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1009,16 +1009,18 @@ The kernel interface functions are as follows:
 
  (*) Check call still alive.
 
-        u32 rxrpc_kernel_check_life(struct socket *sock,
-                                    struct rxrpc_call *call);
+        bool rxrpc_kernel_check_life(struct socket *sock,
+                                     struct rxrpc_call *call,
+                                     u32 *_life);
         void rxrpc_kernel_probe_life(struct socket *sock,
                                      struct rxrpc_call *call);
 
-     The first function returns a number that is updated when ACKs are received
-     from the peer (notably including PING RESPONSE ACKs which we can elicit by
-     sending PING ACKs to see if the call still exists on the server).  The
-     caller should compare the numbers of two calls to see if the call is still
-     alive after waiting for a suitable interval.
+     The first function passes back in *_life a number that is updated when
+     ACKs are received from the peer (notably including PING RESPONSE ACKs
+     which we can elicit by sending PING ACKs to see if the call still exists
+     on the server).  The caller should compare the numbers of two calls to see
+     if the call is still alive after waiting for a suitable interval.  It also
+     returns true as long as the call hasn't yet reached the completed state.
 
      This allows the caller to work out if the server is still contactable and
      if the call is still alive on the server while waiting for the server to
diff --git a/MAINTAINERS b/MAINTAINERS
index 2b08063c8275..72dfb80e8721 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -10139,7 +10139,7 @@ F:	drivers/spi/spi-at91-usart.c
 F:      Documentation/devicetree/bindings/mfd/atmel-usart.txt
 
 MICROCHIP KSZ SERIES ETHERNET SWITCH DRIVER
-M:      Woojung Huh <Woojung.Huh@microchip.com>
+M:      Woojung Huh <woojung.huh@microchip.com>
 M:      Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -16503,7 +16503,7 @@ F:	drivers/char/virtio_console.c
 F:      include/linux/virtio_console.h
 F:      include/uapi/linux/virtio_console.h
 
-VIRTIO CORE, NET AND BLOCK DRIVERS
+VIRTIO CORE AND NET DRIVERS
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 M:      Jason Wang <jasowang@redhat.com>
 L:      virtualization@lists.linux-foundation.org
@@ -16518,6 +16518,19 @@ F:	include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
 F:      mm/balloon_compaction.c
 
+VIRTIO BLOCK AND SCSI DRIVERS
+M:      "Michael S. Tsirkin" <mst@redhat.com>
+M:      Jason Wang <jasowang@redhat.com>
+R:      Paolo Bonzini <pbonzini@redhat.com>
+R:      Stefan Hajnoczi <stefanha@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+S:      Maintained
+F:      drivers/block/virtio_blk.c
+F:      drivers/scsi/virtio_scsi.c
+F:      include/uapi/linux/virtio_blk.h
+F:      include/uapi/linux/virtio_scsi.h
+F:      drivers/vhost/scsi.c
+
 VIRTIO CRYPTO DRIVER
 M:      Gonglei <arei.gonglei@huawei.com>
 L:      virtualization@lists.linux-foundation.org
diff --git a/Makefile b/Makefile
index 079c9a90bf90..6355f82461f4 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index cccb83ad7fa8..e1d95f08f8e1 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -30,8 +30,8 @@ do {									\
 "       prfm    pstl1strm, %2\n"                                        \
 "1:     ldxr    %w1, %2\n"                                              \
         insn "\n"                                                       \
-"2:     stlxr   %w3, %w0, %2\n"                                         \
-"       cbnz    %w3, 1b\n"                                              \
+"2:     stlxr   %w0, %w3, %2\n"                                         \
+"       cbnz    %w0, 1b\n"                                              \
 "       dmb     ish\n"                                                  \
 "3:\n"                                                                  \
 "       .pushsection .fixup,\"ax\"\n"                                   \
@@ -50,30 +50,30 @@ do {									\
 static inline int
 arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
 {
-        int oldval = 0, ret, tmp;
+        int oldval, ret, tmp;
         u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
 
         pagefault_disable();
 
         switch (op) {
         case FUTEX_OP_SET:
-                __futex_atomic_op("mov  %w0, %w4",
+                __futex_atomic_op("mov  %w3, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_ADD:
-                __futex_atomic_op("add  %w0, %w1, %w4",
+                __futex_atomic_op("add  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_OR:
-                __futex_atomic_op("orr  %w0, %w1, %w4",
+                __futex_atomic_op("orr  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         case FUTEX_OP_ANDN:
-                __futex_atomic_op("and  %w0, %w1, %w4",
+                __futex_atomic_op("and  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, ~oparg);
                 break;
         case FUTEX_OP_XOR:
-                __futex_atomic_op("eor  %w0, %w1, %w4",
+                __futex_atomic_op("eor  %w3, %w1, %w4",
                                   ret, oldval, uaddr, tmp, oparg);
                 break;
         default:
diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
index 905e1bb0e7bd..cd9f4e9d04d3 100644
--- a/arch/arm64/include/asm/module.h
+++ b/arch/arm64/include/asm/module.h
@@ -73,4 +73,9 @@ static inline bool is_forbidden_offset_for_adrp(void *place)
 struct plt_entry get_plt_entry(u64 dst, void *pc);
 bool plt_entries_equal(const struct plt_entry *a, const struct plt_entry *b);
 
+static inline bool plt_entry_is_initialized(const struct plt_entry *e)
+{
+        return e->adrp || e->add || e->br;
+}
+
 #endif /* __ASM_MODULE_H */
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 8e4431a8821f..07b298120182 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -107,8 +107,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                 trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline);
                 if (!plt_entries_equal(mod->arch.ftrace_trampoline,
                                        &trampoline)) {
-                        if (!plt_entries_equal(mod->arch.ftrace_trampoline,
-                                               &(struct plt_entry){})) {
+                        if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) {
                                 pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
                                 return -EINVAL;
                         }
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 8ad119c3f665..29755989f616 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -102,10 +102,16 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
 void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
 {
         struct stackframe frame;
-        int skip;
+        int skip = 0;
 
         pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
 
+        if (regs) {
+                if (user_mode(regs))
+                        return;
+                skip = 1;
+        }
+
         if (!tsk)
                 tsk = current;
 
@@ -126,7 +132,6 @@ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
         frame.graph = 0;
 #endif
 
-        skip = !!regs;
         printk("Call trace:\n");
         do {
                 /* skip until specified stack frame */
@@ -176,15 +181,13 @@ static int __die(const char *str, int err, struct pt_regs *regs)
                 return ret;
 
         print_modules();
-        __show_regs(regs);
         pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
                  TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk),
                  end_of_stack(tsk));
+        show_regs(regs);
 
-        if (!user_mode(regs)) {
-                dump_backtrace(regs, tsk);
+        if (!user_mode(regs))
                 dump_instr(KERN_EMERG, regs);
-        }
 
         return ret;
 }
diff --git a/arch/mips/configs/generic/board-ocelot.config b/arch/mips/configs/generic/board-ocelot.config
index f607888d2483..184eb65a6ba7 100644
--- a/arch/mips/configs/generic/board-ocelot.config
+++ b/arch/mips/configs/generic/board-ocelot.config
@@ -1,6 +1,10 @@
 # require CONFIG_CPU_MIPS32_R2=y
 
 CONFIG_LEGACY_BOARD_OCELOT=y
+CONFIG_FIT_IMAGE_FDT_OCELOT=y
+
+CONFIG_BRIDGE=y
+CONFIG_GENERIC_PHY=y
 
 CONFIG_MTD=y
 CONFIG_MTD_CMDLINE_PARTS=y
@@ -19,6 +23,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 
 CONFIG_NETDEVICES=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NET_DSA=y
 CONFIG_MSCC_OCELOT_SWITCH=y
 CONFIG_MSCC_OCELOT_SWITCH_OCELOT=y
 CONFIG_MDIO_MSCC_MIIM=y
@@ -35,6 +41,8 @@ CONFIG_SPI_DESIGNWARE=y
 CONFIG_SPI_DW_MMIO=y
 CONFIG_SPI_SPIDEV=y
 
+CONFIG_PINCTRL_OCELOT=y
+
 CONFIG_GPIO_SYSFS=y
 
 CONFIG_POWER_RESET=y
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 6e574c02e4c3..ea781b29f7f1 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -33,6 +33,7 @@
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
 #include <linux/uaccess.h>
+#include <asm/irq_regs.h>
 
 static struct hard_trap_info {
         unsigned char tt;       /* Trap type code for MIPS R3xxx and R4xxx */
@@ -214,7 +215,7 @@ void kgdb_call_nmi_hook(void *ignored)
         old_fs = get_fs();
         set_fs(KERNEL_DS);
 
-        kgdb_nmicallback(raw_smp_processor_id(), NULL);
+        kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
 
         set_fs(old_fs);
 }
diff --git a/arch/mips/sgi-ip27/ip27-irq.c b/arch/mips/sgi-ip27/ip27-irq.c
index 710a59764b01..a32f843cdbe0 100644
--- a/arch/mips/sgi-ip27/ip27-irq.c
+++ b/arch/mips/sgi-ip27/ip27-irq.c
@@ -118,7 +118,6 @@ static void shutdown_bridge_irq(struct irq_data *d)
 {
         struct hub_irq_data *hd = irq_data_get_irq_chip_data(d);
         struct bridge_controller *bc;
-        int pin = hd->pin;
 
         if (!hd)
                 return;
@@ -126,7 +125,7 @@ static void shutdown_bridge_irq(struct irq_data *d)
         disable_hub_irq(d);
 
         bc = hd->bc;
-        bridge_clr(bc, b_int_enable, (1 << pin));
+        bridge_clr(bc, b_int_enable, (1 << hd->pin));
         bridge_read(bc, b_wid_tflush);
 }
 
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index 598cdcdd1355..8ddd4a91bdc1 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -352,7 +352,7 @@ static inline bool strict_kernel_rwx_enabled(void)
 #if defined(CONFIG_SPARSEMEM_VMEMMAP) && defined(CONFIG_SPARSEMEM_EXTREME) &&   \
         defined (CONFIG_PPC_64K_PAGES)
 #define MAX_PHYSMEM_BITS        51
-#elif defined(CONFIG_SPARSEMEM)
+#elif defined(CONFIG_PPC64)
 #define MAX_PHYSMEM_BITS        46
 #endif
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index a5b8fbae56a0..9481a117e242 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -656,11 +656,17 @@ EXC_COMMON_BEGIN(data_access_slb_common)
         ld      r4,PACA_EXSLB+EX_DAR(r13)
         std     r4,_DAR(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
+BEGIN_MMU_FTR_SECTION
+        /* HPT case, do SLB fault */
         bl      do_slb_fault
         cmpdi   r3,0
         bne-    1f
         b       fast_exception_return
 1:      /* Error case */
+MMU_FTR_SECTION_ELSE
+        /* Radix case, access is outside page table range */
+        li      r3,-EFAULT
+ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
         std     r3,RESULT(r1)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
@@ -705,11 +711,17 @@ EXC_COMMON_BEGIN(instruction_access_slb_common)
         EXCEPTION_PROLOG_COMMON(0x480, PACA_EXSLB)
         ld      r4,_NIP(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
+BEGIN_MMU_FTR_SECTION
+        /* HPT case, do SLB fault */
         bl      do_slb_fault
         cmpdi   r3,0
         bne-    1f
         b       fast_exception_return
 1:      /* Error case */
+MMU_FTR_SECTION_ELSE
+        /* Radix case, access is outside page table range */
+        li      r3,-EFAULT
+ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
         std     r3,RESULT(r1)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 48051c8977c5..e25b615e9f9e 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -851,10 +851,6 @@ __secondary_start:
         tophys(r4,r2)
         addi    r4,r4,THREAD    /* phys address of our thread_struct */
         mtspr   SPRN_SPRG_THREAD,r4
-#ifdef CONFIG_PPC_RTAS
-        li      r3,0
-        stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
-#endif
         lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
         ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
         mtspr   SPRN_SPRG_PGDIR, r4
@@ -941,10 +937,6 @@ start_here:
         tophys(r4,r2)
         addi    r4,r4,THREAD    /* init task's THREAD */
         mtspr   SPRN_SPRG_THREAD,r4
-#ifdef CONFIG_PPC_RTAS
-        li      r3,0
-        stw     r3, RTAS_SP(r4)         /* 0 => not in RTAS */
-#endif
         lis     r4, (swapper_pg_dir - PAGE_OFFSET)@h
         ori     r4, r4, (swapper_pg_dir - PAGE_OFFSET)@l
         mtspr   SPRN_SPRG_PGDIR, r4
diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
index 1e0bc5955a40..afd516b572f8 100644
--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
@@ -98,7 +98,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
          * can be used, r7 contains NSEC_PER_SEC.
          */
 
-        lwz     r5,WTOM_CLOCK_SEC(r9)
+        lwz     r5,(WTOM_CLOCK_SEC+LOPART)(r9)
         lwz     r6,WTOM_CLOCK_NSEC(r9)
 
         /* We now have our offset in r5,r6. We create a fake dependency
diff --git a/arch/riscv/configs/rv32_defconfig b/arch/riscv/configs/rv32_defconfig
new file mode 100644
index 000000000000..1a911ed8e772
--- /dev/null
+++ b/arch/riscv/configs/rv32_defconfig
@@ -0,0 +1,84 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_ARCH_RV32I=y
+CONFIG_SMP=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_XILINX=y
+CONFIG_DEVTMPFS=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_NETDEVICES=y
+CONFIG_VIRTIO_NET=y
+CONFIG_MACB=y
+CONFIG_E1000E=y
+CONFIG_R8169=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
+CONFIG_HVC_RISCV_SBI=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_UAS=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_SIFIVE_PLIC=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_DEV_VIRTIO=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 5fd8c922e1c2..bc7b77e34d09 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -121,6 +121,14 @@ void __init setup_bootmem(void)
                          */
                         memblock_reserve(reg->base, vmlinux_end - reg->base);
                         mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET);
+
+                        /*
+                         * Remove memblock from the end of usable area to the
+                         * end of region
+                         */
+                        if (reg->base + mem_size < end)
+                                memblock_remove(reg->base + mem_size,
+                                                end - reg->base - mem_size);
                 }
         }
         BUG_ON(mem_size == 0);
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index a8af6023c126..14b93c5564e3 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -73,6 +73,11 @@ static inline void iommu_batch_start(struct device *dev, unsigned long prot, uns
         p->npages       = 0;
 }
 
+static inline bool iommu_use_atu(struct iommu *iommu, u64 mask)
+{
+        return iommu->atu && mask > DMA_BIT_MASK(32);
+}
+
 /* Interrupts must be disabled.  */
 static long iommu_batch_flush(struct iommu_batch *p, u64 mask)
 {
@@ -92,7 +97,7 @@ static long iommu_batch_flush(struct iommu_batch *p, u64 mask)
                 prot &= (HV_PCI_MAP_ATTR_READ | HV_PCI_MAP_ATTR_WRITE);
 
         while (npages != 0) {
-                if (mask <= DMA_BIT_MASK(32) || !pbm->iommu->atu) {
+                if (!iommu_use_atu(pbm->iommu, mask)) {
                         num = pci_sun4v_iommu_map(devhandle,
                                                   HV_PCI_TSBID(0, entry),
                                                   npages,
@@ -179,7 +184,6 @@ static void *dma_4v_alloc_coherent(struct device *dev, size_t size,
         unsigned long flags, order, first_page, npages, n;
         unsigned long prot = 0;
         struct iommu *iommu;
-        struct atu *atu;
         struct iommu_map_table *tbl;
         struct page *page;
         void *ret;
@@ -205,13 +209,11 @@ static void *dma_4v_alloc_coherent(struct device *dev, size_t size,
         memset((char *)first_page, 0, PAGE_SIZE << order);
 
         iommu = dev->archdata.iommu;
-        atu = iommu->atu;
-
         mask = dev->coherent_dma_mask;
-        if (mask <= DMA_BIT_MASK(32) || !atu)
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
-                tbl = &atu->tbl;
+                tbl = &iommu->atu->tbl;
 
         entry = iommu_tbl_range_alloc(dev, tbl, npages, NULL,
                                       (unsigned long)(-1), 0);
@@ -333,7 +335,7 @@ static void dma_4v_free_coherent(struct device *dev, size_t size, void *cpu,
         atu = iommu->atu;
         devhandle = pbm->devhandle;
 
-        if (dvma <= DMA_BIT_MASK(32)) {
+        if (!iommu_use_atu(iommu, dvma)) {
                 tbl = &iommu->tbl;
                 iotsb_num = 0; /* we don't care for legacy iommu */
         } else {
@@ -374,7 +376,7 @@ static dma_addr_t dma_4v_map_page(struct device *dev, struct page *page,
         npages >>= IO_PAGE_SHIFT;
 
         mask = *dev->dma_mask;
-        if (mask <= DMA_BIT_MASK(32))
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
                 tbl = &atu->tbl;
@@ -510,7 +512,7 @@ static int dma_4v_map_sg(struct device *dev, struct scatterlist *sglist,
                                   IO_PAGE_SIZE) >> IO_PAGE_SHIFT;
 
         mask = *dev->dma_mask;
-        if (mask <= DMA_BIT_MASK(32))
+        if (!iommu_use_atu(iommu, mask))
                 tbl = &iommu->tbl;
         else
                 tbl = &atu->tbl;
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index 7d2d7c801dba..0ecfac84ba91 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -3,10 +3,14 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 #include <asm/apicdef.h>
+#include <asm/nmi.h>
 
 #include "../perf_event.h"
 
+static DEFINE_PER_CPU(unsigned int, perf_nmi_counter);
+
 static __initconst const u64 amd_hw_cache_event_ids
                                 [PERF_COUNT_HW_CACHE_MAX]
                                 [PERF_COUNT_HW_CACHE_OP_MAX]
@@ -429,6 +433,132 @@ static void amd_pmu_cpu_dead(int cpu)
         }
 }
 
+/*
+ * When a PMC counter overflows, an NMI is used to process the event and
+ * reset the counter. NMI latency can result in the counter being updated
+ * before the NMI can run, which can result in what appear to be spurious
+ * NMIs. This function is intended to wait for the NMI to run and reset
+ * the counter to avoid possible unhandled NMI messages.
+ */
+#define OVERFLOW_WAIT_COUNT     50
+
+static void amd_pmu_wait_on_overflow(int idx)
+{
+        unsigned int i;
+        u64 counter;
+
+        /*
+         * Wait for the counter to be reset if it has overflowed. This loop
+         * should exit very, very quickly, but just in case, don't wait
+         * forever...
+         */
+        for (i = 0; i < OVERFLOW_WAIT_COUNT; i++) {
+                rdmsrl(x86_pmu_event_addr(idx), counter);
+                if (counter & (1ULL << (x86_pmu.cntval_bits - 1)))
+                        break;
+
+                /* Might be in IRQ context, so can't sleep */
+                udelay(1);
+        }
+}
+
+static void amd_pmu_disable_all(void)
+{
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+        int idx;
+
+        x86_pmu_disable_all();
+
+        /*
+         * This shouldn't be called from NMI context, but add a safeguard here
+         * to return, since if we're in NMI context we can't wait for an NMI
+         * to reset an overflowed counter value.
+         */
+        if (in_nmi())
+                return;
+
+        /*
+         * Check each counter for overflow and wait for it to be reset by the
+         * NMI if it has overflowed. This relies on the fact that all active
+         * counters are always enabled when this function is caled and
+         * ARCH_PERFMON_EVENTSEL_INT is always set.
+         */
+        for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+                if (!test_bit(idx, cpuc->active_mask))
+                        continue;
+
+                amd_pmu_wait_on_overflow(idx);
+        }
+}
+
+static void amd_pmu_disable_event(struct perf_event *event)
+{
+        x86_pmu_disable_event(event);
+
+        /*
+         * This can be called from NMI context (via x86_pmu_stop). The counter
+         * may have overflowed, but either way, we'll never see it get reset
+         * by the NMI if we're already in the NMI. And the NMI latency support
+         * below will take care of any pending NMI that might have been
+         * generated by the overflow.
+         */
+        if (in_nmi())
+                return;
+
+        amd_pmu_wait_on_overflow(event->hw.idx);
+}
+
+/*
+ * Because of NMI latency, if multiple PMC counters are active or other sources
+ * of NMIs are received, the perf NMI handler can handle one or more overflowed
+ * PMC counters outside of the NMI associated with the PMC overflow. If the NMI
+ * doesn't arrive at the LAPIC in time to become a pending NMI, then the kernel
+ * back-to-back NMI support won't be active. This PMC handler needs to take into
+ * account that this can occur, otherwise this could result in unknown NMI
+ * messages being issued. Examples of this is PMC overflow while in the NMI
+ * handler when multiple PMCs are active or PMC overflow while handling some
+ * other source of an NMI.
+ *
+ * Attempt to mitigate this by using the number of active PMCs to determine
+ * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset
+ * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the
+ * number of active PMCs or 2. The value of 2 is used in case an NMI does not
+ * arrive at the LAPIC in time to be collapsed into an already pending NMI.
+ */
+static int amd_pmu_handle_irq(struct pt_regs *regs)
+{
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+        int active, handled;
+
+        /*
+         * Obtain the active count before calling x86_pmu_handle_irq() since
+         * it is possible that x86_pmu_handle_irq() may make a counter
+         * inactive (through x86_pmu_stop).
+         */
+        active = __bitmap_weight(cpuc->active_mask, X86_PMC_IDX_MAX);
+
+        /* Process any counter overflows */
+        handled = x86_pmu_handle_irq(regs);
+
+        /*
+         * If a counter was handled, record the number of possible remaining
+         * NMIs that can occur.
+         */
+        if (handled) {
+                this_cpu_write(perf_nmi_counter,
+                               min_t(unsigned int, 2, active));
+
+                return handled;
+        }
+
+        if (!this_cpu_read(perf_nmi_counter))
+                return NMI_DONE;
+
+        this_cpu_dec(perf_nmi_counter);
+
+        return NMI_HANDLED;
+}
+
 static struct event_constraint *
 amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
                           struct perf_event *event)
@@ -621,11 +751,11 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config)
 
 static __initconst const struct x86_pmu amd_pmu = {
         .name                   = "AMD",
-        .handle_irq             = x86_pmu_handle_irq,
-        .disable_all            = x86_pmu_disable_all,
+        .handle_irq             = amd_pmu_handle_irq,
+        .disable_all            = amd_pmu_disable_all,
         .enable_all             = x86_pmu_enable_all,
         .enable                 = x86_pmu_enable_event,
-        .disable                = x86_pmu_disable_event,
+        .disable                = amd_pmu_disable_event,
         .hw_config              = amd_pmu_hw_config,
         .schedule_events        = x86_schedule_events,
         .eventsel               = MSR_K7_EVNTSEL0,
@@ -732,7 +862,7 @@ void amd_pmu_enable_virt(void)
         cpuc->perf_ctr_virt_mask = 0;
 
         /* Reload all events */
-        x86_pmu_disable_all();
+        amd_pmu_disable_all();
         x86_pmu_enable_all(0);
 }
 EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
@@ -750,7 +880,7 @@ void amd_pmu_disable_virt(void)
         cpuc->perf_ctr_virt_mask = AMD64_EVENTSEL_HOSTONLY;
 
         /* Reload all events */
-        x86_pmu_disable_all();
+        amd_pmu_disable_all();
         x86_pmu_enable_all(0);
 }
 EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index e2b1447192a8..81911e11a15d 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1349,8 +1349,9 @@ void x86_pmu_stop(struct perf_event *event, int flags)
         struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
 
-        if (__test_and_clear_bit(hwc->idx, cpuc->active_mask)) {
+        if (test_bit(hwc->idx, cpuc->active_mask)) {
                 x86_pmu.disable(event);
+                __clear_bit(hwc->idx, cpuc->active_mask);
                 cpuc->events[hwc->idx] = NULL;
                 WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
                 hwc->state |= PERF_HES_STOPPED;
@@ -1447,16 +1448,8 @@ int x86_pmu_handle_irq(struct pt_regs *regs)
         apic_write(APIC_LVTPC, APIC_DM_NMI);
 
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
-                if (!test_bit(idx, cpuc->active_mask)) {
-                        /*
-                         * Though we deactivated the counter some cpus
-                         * might still deliver spurious interrupts still
-                         * in flight. Catch them:
-                         */
-                        if (__test_and_clear_bit(idx, cpuc->running))
-                                handled++;
+                if (!test_bit(idx, cpuc->active_mask))
                         continue;
-                }
 
                 event = cpuc->events[idx];
 
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 8baa441d8000..f61dcbef20ff 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3185,7 +3185,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 return ret;
 
         if (event->attr.precise_ip) {
-                if (!event->attr.freq) {
+                if (!(event->attr.freq || event->attr.wakeup_events)) {
                         event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
                         if (!(event->attr.sample_type &
                               ~intel_pmu_large_pebs_flags(event)))
@@ -3575,6 +3575,12 @@ static void intel_pmu_cpu_starting(int cpu)
 
         cpuc->lbr_sel = NULL;
 
+        if (x86_pmu.flags & PMU_FL_TFA) {
+                WARN_ON_ONCE(cpuc->tfa_shadow);
+                cpuc->tfa_shadow = ~0ULL;
+                intel_set_tfa(cpuc, false);
+        }
+
         if (x86_pmu.version > 1)
                 flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
 
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index d153d570bb04..8e790ec219a5 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -36,16 +36,17 @@
  * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1).
  */
 
-#define BITOP_ADDR(x) "+m" (*(volatile long *) (x))
+#define RLONG_ADDR(x)                    "m" (*(volatile long *) (x))
+#define WBYTE_ADDR(x)                   "+m" (*(volatile char *) (x))
 
-#define ADDR                            BITOP_ADDR(addr)
+#define ADDR                            RLONG_ADDR(addr)
 
 /*
  * We do the locked ops that don't return the old value as
  * a mask operation on a byte.
  */
 #define IS_IMMEDIATE(nr)                (__builtin_constant_p(nr))
-#define CONST_MASK_ADDR(nr, addr)       BITOP_ADDR((void *)(addr) + ((nr)>>3))
+#define CONST_MASK_ADDR(nr, addr)       WBYTE_ADDR((void *)(addr) + ((nr)>>3))
 #define CONST_MASK(nr)                  (1 << ((nr) & 7))
 
 /**
@@ -73,7 +74,7 @@ set_bit(long nr, volatile unsigned long *addr)
                         : "memory");
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0"
-                        : BITOP_ADDR(addr) : "Ir" (nr) : "memory");
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -88,7 +89,7 @@ set_bit(long nr, volatile unsigned long *addr)
  */
 static __always_inline void __set_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory");
+        asm volatile(__ASM_SIZE(bts) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 /**
@@ -110,8 +111,7 @@ clear_bit(long nr, volatile unsigned long *addr)
                         : "iq" ((u8)~CONST_MASK(nr)));
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
-                        : BITOP_ADDR(addr)
-                        : "Ir" (nr));
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -131,7 +131,7 @@ static __always_inline void clear_bit_unlock(long nr, volatile unsigned long *ad
 
 static __always_inline void __clear_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btr) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
@@ -139,7 +139,7 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
         bool negative;
         asm volatile(LOCK_PREFIX "andb %2,%1"
                 CC_SET(s)
-                : CC_OUT(s) (negative), ADDR
+                : CC_OUT(s) (negative), WBYTE_ADDR(addr)
                 : "ir" ((char) ~(1 << nr)) : "memory");
         return negative;
 }
@@ -155,13 +155,9 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
  * __clear_bit() is non-atomic and implies release semantics before the memory
  * operation. It can be used for an unlock if no other CPUs can concurrently
  * modify other bits in the word.
- *
- * No memory barrier is required here, because x86 cannot reorder stores past
- * older loads. Same principle as spin_unlock.
  */
 static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *addr)
 {
-        barrier();
         __clear_bit(nr, addr);
 }
 
@@ -176,7 +172,7 @@ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *
  */
 static __always_inline void __change_bit(long nr, volatile unsigned long *addr)
 {
-        asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr));
+        asm volatile(__ASM_SIZE(btc) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
 }
 
 /**
@@ -196,8 +192,7 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr)
                         : "iq" ((u8)CONST_MASK(nr)));
         } else {
                 asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0"
-                        : BITOP_ADDR(addr)
-                        : "Ir" (nr));
+                        : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
         }
 }
 
@@ -242,8 +237,8 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long *
 
         asm(__ASM_SIZE(bts) " %2,%1"
             CC_SET(c)
-            : CC_OUT(c) (oldbit), ADDR
-            : "Ir" (nr));
+            : CC_OUT(c) (oldbit)
+            : ADDR, "Ir" (nr) : "memory");
         return oldbit;
 }
 
@@ -282,8 +277,8 @@ static __always_inline bool __test_and_clear_bit(long nr, volatile unsigned long
 
         asm volatile(__ASM_SIZE(btr) " %2,%1"
                      CC_SET(c)
-                     : CC_OUT(c) (oldbit), ADDR
-                     : "Ir" (nr));
+                     : CC_OUT(c) (oldbit)
+                     : ADDR, "Ir" (nr) : "memory");
         return oldbit;
 }
 
@@ -294,8 +289,8 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon
 
         asm volatile(__ASM_SIZE(btc) " %2,%1"
                      CC_SET(c)
-                     : CC_OUT(c) (oldbit), ADDR
-                     : "Ir" (nr) : "memory");
+                     : CC_OUT(c) (oldbit)
+                     : ADDR, "Ir" (nr) : "memory");
 
         return oldbit;
 }
@@ -326,7 +321,7 @@ static __always_inline bool variable_test_bit(long nr, volatile const unsigned l
         asm volatile(__ASM_SIZE(bt) " %2,%1"
                      CC_SET(c)
                      : CC_OUT(c) (oldbit)
-                     : "m" (*(unsigned long *)addr), "Ir" (nr));
+                     : "m" (*(unsigned long *)addr), "Ir" (nr) : "memory");
 
         return oldbit;
 }
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 93c4bf598fb0..feab24cac610 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -226,7 +226,9 @@ struct x86_emulate_ops {
 
         unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
         void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
-        int (*pre_leave_smm)(struct x86_emulate_ctxt *ctxt, u64 smbase);
+        int (*pre_leave_smm)(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate);
+        void (*post_leave_smm)(struct x86_emulate_ctxt *ctxt);
 
 };
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 159b5988292f..a9d03af34030 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -126,7 +126,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
 }
 
 #define KVM_PERMILLE_MMU_PAGES 20
-#define KVM_MIN_ALLOC_MMU_PAGES 64
+#define KVM_MIN_ALLOC_MMU_PAGES 64UL
 #define KVM_MMU_HASH_SHIFT 12
 #define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
 #define KVM_MIN_FREE_MMU_PAGES 5
@@ -844,9 +844,9 @@ enum kvm_irqchip_mode {
 };
 
 struct kvm_arch {
-        unsigned int n_used_mmu_pages;
-        unsigned int n_requested_mmu_pages;
-        unsigned int n_max_mmu_pages;
+        unsigned long n_used_mmu_pages;
+        unsigned long n_requested_mmu_pages;
+        unsigned long n_max_mmu_pages;
         unsigned int indirect_shadow_pages;
         struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
         /*
@@ -1182,7 +1182,7 @@ struct kvm_x86_ops {
 
         int (*smi_allowed)(struct kvm_vcpu *vcpu);
         int (*pre_enter_smm)(struct kvm_vcpu *vcpu, char *smstate);
-        int (*pre_leave_smm)(struct kvm_vcpu *vcpu, u64 smbase);
+        int (*pre_leave_smm)(struct kvm_vcpu *vcpu, const char *smstate);
         int (*enable_smi_window)(struct kvm_vcpu *vcpu);
 
         int (*mem_enc_op)(struct kvm *kvm, void __user *argp);
@@ -1256,8 +1256,8 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
                                    gfn_t gfn_offset, unsigned long mask);
 void kvm_mmu_zap_all(struct kvm *kvm);
 void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
-unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm);
-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
+unsigned long kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm);
+void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long kvm_nr_mmu_pages);
 
 int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3);
 bool pdptrs_changed(struct kvm_vcpu *vcpu);
@@ -1592,4 +1592,7 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
 #define put_smstate(type, buf, offset, val)                      \
         *(type *)((buf) + (offset) - 0x7e00) = val
 
+#define GET_SMSTATE(type, buf, offset)          \
+        (*(type *)((buf) + (offset) - 0x7e00))
+
 #endif /* _ASM_X86_KVM_HOST_H */
diff --git a/arch/x86/include/uapi/asm/vmx.h b/arch/x86/include/uapi/asm/vmx.h
index f0b0c90dd398..d213ec5c3766 100644
--- a/arch/x86/include/uapi/asm/vmx.h
+++ b/arch/x86/include/uapi/asm/vmx.h
@@ -146,6 +146,7 @@
 
 #define VMX_ABORT_SAVE_GUEST_MSR_FAIL        1
 #define VMX_ABORT_LOAD_HOST_PDPTE_FAIL       2
+#define VMX_ABORT_VMCS_CORRUPTED             3
 #define VMX_ABORT_LOAD_HOST_MSR_FAIL         4
 
 #endif /* _UAPIVMX_H */
diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
index 399601eda8e4..54b9eef3eea9 100644
--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -2039,14 +2039,14 @@ out:
 enum rdt_param {
         Opt_cdp,
         Opt_cdpl2,
-        Opt_mba_mpbs,
+        Opt_mba_mbps,
         nr__rdt_params
 };
 
 static const struct fs_parameter_spec rdt_param_specs[] = {
         fsparam_flag("cdp",             Opt_cdp),
         fsparam_flag("cdpl2",           Opt_cdpl2),
-        fsparam_flag("mba_mpbs",        Opt_mba_mpbs),
+        fsparam_flag("mba_MBps",        Opt_mba_mbps),
         {}
 };
 
@@ -2072,7 +2072,7 @@ static int rdt_parse_param(struct fs_context *fc, struct fs_parameter *param)
         case Opt_cdpl2:
                 ctx->enable_cdpl2 = true;
                 return 0;
-        case Opt_mba_mpbs:
+        case Opt_mba_mbps:
                 if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
                         return -EINVAL;
                 ctx->enable_mba_mbps = true;
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c338984c850d..d0d5dd44b4f4 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2331,24 +2331,18 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt)
 
 static int emulator_has_longmode(struct x86_emulate_ctxt *ctxt)
 {
+#ifdef CONFIG_X86_64
         u32 eax, ebx, ecx, edx;
 
         eax = 0x80000001;
         ecx = 0;
         ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx, false);
         return edx & bit(X86_FEATURE_LM);
+#else
+        return false;
+#endif
 }
 
-#define GET_SMSTATE(type, smbase, offset)                                 \
-        ({                                                                \
-         type __val;                                                      \
-         int r = ctxt->ops->read_phys(ctxt, smbase + offset, &__val,      \
-                                      sizeof(__val));                     \
-         if (r != X86EMUL_CONTINUE)                                       \
-                 return X86EMUL_UNHANDLEABLE;                             \
-         __val;                                                           \
-        })
-
 static void rsm_set_desc_flags(struct desc_struct *desc, u32 flags)
 {
         desc->g    = (flags >> 23) & 1;
@@ -2361,27 +2355,30 @@ static void rsm_set_desc_flags(struct desc_struct *desc, u32 flags)
         desc->type = (flags >>  8) & 15;
 }
 
-static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, const char *smstate,
+                           int n)
 {
         struct desc_struct desc;
         int offset;
         u16 selector;
 
-        selector = GET_SMSTATE(u32, smbase, 0x7fa8 + n * 4);
+        selector = GET_SMSTATE(u32, smstate, 0x7fa8 + n * 4);
 
         if (n < 3)
                 offset = 0x7f84 + n * 12;
         else
                 offset = 0x7f2c + (n - 3) * 12;
 
-        set_desc_base(&desc,      GET_SMSTATE(u32, smbase, offset + 8));
-        set_desc_limit(&desc,     GET_SMSTATE(u32, smbase, offset + 4));
-        rsm_set_desc_flags(&desc, GET_SMSTATE(u32, smbase, offset));
+        set_desc_base(&desc,      GET_SMSTATE(u32, smstate, offset + 8));
+        set_desc_limit(&desc,     GET_SMSTATE(u32, smstate, offset + 4));
+        rsm_set_desc_flags(&desc, GET_SMSTATE(u32, smstate, offset));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, n);
         return X86EMUL_CONTINUE;
 }
 
-static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+#ifdef CONFIG_X86_64
+static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, const char *smstate,
+                           int n)
 {
         struct desc_struct desc;
         int offset;
@@ -2390,15 +2387,16 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
 
         offset = 0x7e00 + n * 16;
 
-        selector =                GET_SMSTATE(u16, smbase, offset);
-        rsm_set_desc_flags(&desc, GET_SMSTATE(u16, smbase, offset + 2) << 8);
-        set_desc_limit(&desc,     GET_SMSTATE(u32, smbase, offset + 4));
-        set_desc_base(&desc,      GET_SMSTATE(u32, smbase, offset + 8));
-        base3 =                   GET_SMSTATE(u32, smbase, offset + 12);
+        selector =                GET_SMSTATE(u16, smstate, offset);
+        rsm_set_desc_flags(&desc, GET_SMSTATE(u16, smstate, offset + 2) << 8);
+        set_desc_limit(&desc,     GET_SMSTATE(u32, smstate, offset + 4));
+        set_desc_base(&desc,      GET_SMSTATE(u32, smstate, offset + 8));
+        base3 =                   GET_SMSTATE(u32, smstate, offset + 12);
 
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, n);
         return X86EMUL_CONTINUE;
 }
+#endif
 
 static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
                                     u64 cr0, u64 cr3, u64 cr4)
@@ -2445,7 +2443,8 @@ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
         return X86EMUL_CONTINUE;
 }
 
-static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
+static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate)
 {
         struct desc_struct desc;
         struct desc_ptr dt;
@@ -2453,53 +2452,55 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
         u32 val, cr0, cr3, cr4;
         int i;
 
-        cr0 =                      GET_SMSTATE(u32, smbase, 0x7ffc);
-        cr3 =                      GET_SMSTATE(u32, smbase, 0x7ff8);
-        ctxt->eflags =             GET_SMSTATE(u32, smbase, 0x7ff4) | X86_EFLAGS_FIXED;
-        ctxt->_eip =               GET_SMSTATE(u32, smbase, 0x7ff0);
+        cr0 =                      GET_SMSTATE(u32, smstate, 0x7ffc);
+        cr3 =                      GET_SMSTATE(u32, smstate, 0x7ff8);
+        ctxt->eflags =             GET_SMSTATE(u32, smstate, 0x7ff4) | X86_EFLAGS_FIXED;
+        ctxt->_eip =               GET_SMSTATE(u32, smstate, 0x7ff0);
 
         for (i = 0; i < 8; i++)
-                *reg_write(ctxt, i) = GET_SMSTATE(u32, smbase, 0x7fd0 + i * 4);
+                *reg_write(ctxt, i) = GET_SMSTATE(u32, smstate, 0x7fd0 + i * 4);
 
-        val = GET_SMSTATE(u32, smbase, 0x7fcc);
+        val = GET_SMSTATE(u32, smstate, 0x7fcc);
         ctxt->ops->set_dr(ctxt, 6, (val & DR6_VOLATILE) | DR6_FIXED_1);
-        val = GET_SMSTATE(u32, smbase, 0x7fc8);
+        val = GET_SMSTATE(u32, smstate, 0x7fc8);
         ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 
-        selector =                 GET_SMSTATE(u32, smbase, 0x7fc4);
-        set_desc_base(&desc,       GET_SMSTATE(u32, smbase, 0x7f64));
-        set_desc_limit(&desc,      GET_SMSTATE(u32, smbase, 0x7f60));
-        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smbase, 0x7f5c));
+        selector =                 GET_SMSTATE(u32, smstate, 0x7fc4);
+        set_desc_base(&desc,       GET_SMSTATE(u32, smstate, 0x7f64));
+        set_desc_limit(&desc,      GET_SMSTATE(u32, smstate, 0x7f60));
+        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smstate, 0x7f5c));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, VCPU_SREG_TR);
 
-        selector =                 GET_SMSTATE(u32, smbase, 0x7fc0);
-        set_desc_base(&desc,       GET_SMSTATE(u32, smbase, 0x7f80));
-        set_desc_limit(&desc,      GET_SMSTATE(u32, smbase, 0x7f7c));
-        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smbase, 0x7f78));
+        selector =                 GET_SMSTATE(u32, smstate, 0x7fc0);
+        set_desc_base(&desc,       GET_SMSTATE(u32, smstate, 0x7f80));
+        set_desc_limit(&desc,      GET_SMSTATE(u32, smstate, 0x7f7c));
+        rsm_set_desc_flags(&desc,  GET_SMSTATE(u32, smstate, 0x7f78));
         ctxt->ops->set_segment(ctxt, selector, &desc, 0, VCPU_SREG_LDTR);
 
-        dt.address =               GET_SMSTATE(u32, smbase, 0x7f74);
-        dt.size =                  GET_SMSTATE(u32, smbase, 0x7f70);
+        dt.address =               GET_SMSTATE(u32, smstate, 0x7f74);
+        dt.size =                  GET_SMSTATE(u32, smstate, 0x7f70);
         ctxt->ops->set_gdt(ctxt, &dt);
 
-        dt.address =               GET_SMSTATE(u32, smbase, 0x7f58);
-        dt.size =                  GET_SMSTATE(u32, smbase, 0x7f54);
+        dt.address =               GET_SMSTATE(u32, smstate, 0x7f58);
+        dt.size =                  GET_SMSTATE(u32, smstate, 0x7f54);
         ctxt->ops->set_idt(ctxt, &dt);
 
         for (i = 0; i < 6; i++) {
-                int r = rsm_load_seg_32(ctxt, smbase, i);
+                int r = rsm_load_seg_32(ctxt, smstate, i);
                 if (r != X86EMUL_CONTINUE)
                         return r;
         }
 
-        cr4 = GET_SMSTATE(u32, smbase, 0x7f14);
+        cr4 = GET_SMSTATE(u32, smstate, 0x7f14);
 
-        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7ef8));
+        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smstate, 0x7ef8));
 
         return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
 }
 
-static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+#ifdef CONFIG_X86_64
+static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt,
+                             const char *smstate)
 {
         struct desc_struct desc;
         struct desc_ptr dt;
@@ -2509,43 +2510,43 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
         int i, r;
 
         for (i = 0; i < 16; i++)
-                *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8);
+                *reg_write(ctxt, i) = GET_SMSTATE(u64, smstate, 0x7ff8 - i * 8);
 
-        ctxt->_eip   = GET_SMSTATE(u64, smbase, 0x7f78);
-        ctxt->eflags = GET_SMSTATE(u32, smbase, 0x7f70) | X86_EFLAGS_FIXED;
+        ctxt->_eip   = GET_SMSTATE(u64, smstate, 0x7f78);
+        ctxt->eflags = GET_SMSTATE(u32, smstate, 0x7f70) | X86_EFLAGS_FIXED;
 
-        val = GET_SMSTATE(u32, smbase, 0x7f68);
+        val = GET_SMSTATE(u32, smstate, 0x7f68);
         ctxt->ops->set_dr(ctxt, 6, (val & DR6_VOLATILE) | DR6_FIXED_1);
-        val = GET_SMSTATE(u32, smbase, 0x7f60);
+        val = GET_SMSTATE(u32, smstate, 0x7f60);
         ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 
-        cr0 =                       GET_SMSTATE(u64, smbase, 0x7f58);
-        cr3 =                       GET_SMSTATE(u64, smbase, 0x7f50);
-        cr4 =                       GET_SMSTATE(u64, smbase, 0x7f48);
-        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7f00));
-        val =                       GET_SMSTATE(u64, smbase, 0x7ed0);
+        cr0 =                       GET_SMSTATE(u64, smstate, 0x7f58);
+        cr3 =                       GET_SMSTATE(u64, smstate, 0x7f50);
+        cr4 =                       GET_SMSTATE(u64, smstate, 0x7f48);
+        ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smstate, 0x7f00));
+        val =                       GET_SMSTATE(u64, smstate, 0x7ed0);
         ctxt->ops->set_msr(ctxt, MSR_EFER, val & ~EFER_LMA);
 
-        selector =                  GET_SMSTATE(u32, smbase, 0x7e90);
-        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smbase, 0x7e92) << 8);
-        set_desc_limit(&desc,       GET_SMSTATE(u32, smbase, 0x7e94));
-        set_desc_base(&desc,        GET_SMSTATE(u32, smbase, 0x7e98));
-        base3 =                     GET_SMSTATE(u32, smbase, 0x7e9c);
+        selector =                  GET_SMSTATE(u32, smstate, 0x7e90);
+        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smstate, 0x7e92) << 8);
+        set_desc_limit(&desc,       GET_SMSTATE(u32, smstate, 0x7e94));
+        set_desc_base(&desc,        GET_SMSTATE(u32, smstate, 0x7e98));
+        base3 =                     GET_SMSTATE(u32, smstate, 0x7e9c);
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, VCPU_SREG_TR);
 
-        dt.size =                   GET_SMSTATE(u32, smbase, 0x7e84);
-        dt.address =                GET_SMSTATE(u64, smbase, 0x7e88);
+        dt.size =                   GET_SMSTATE(u32, smstate, 0x7e84);
+        dt.address =                GET_SMSTATE(u64, smstate, 0x7e88);
         ctxt->ops->set_idt(ctxt, &dt);
 
-        selector =                  GET_SMSTATE(u32, smbase, 0x7e70);
-        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smbase, 0x7e72) << 8);
-        set_desc_limit(&desc,       GET_SMSTATE(u32, smbase, 0x7e74));
-        set_desc_base(&desc,        GET_SMSTATE(u32, smbase, 0x7e78));
-        base3 =                     GET_SMSTATE(u32, smbase, 0x7e7c);
+        selector =                  GET_SMSTATE(u32, smstate, 0x7e70);
+        rsm_set_desc_flags(&desc,   GET_SMSTATE(u32, smstate, 0x7e72) << 8);
+        set_desc_limit(&desc,       GET_SMSTATE(u32, smstate, 0x7e74));
+        set_desc_base(&desc,        GET_SMSTATE(u32, smstate, 0x7e78));
+        base3 =                     GET_SMSTATE(u32, smstate, 0x7e7c);
         ctxt->ops->set_segment(ctxt, selector, &desc, base3, VCPU_SREG_LDTR);
 
-        dt.size =                   GET_SMSTATE(u32, smbase, 0x7e64);
-        dt.address =                GET_SMSTATE(u64, smbase, 0x7e68);
+        dt.size =                   GET_SMSTATE(u32, smstate, 0x7e64);
+        dt.address =                GET_SMSTATE(u64, smstate, 0x7e68);
         ctxt->ops->set_gdt(ctxt, &dt);
 
         r = rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
@@ -2553,37 +2554,49 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
                 return r;
 
         for (i = 0; i < 6; i++) {
-                r = rsm_load_seg_64(ctxt, smbase, i);
+                r = rsm_load_seg_64(ctxt, smstate, i);
                 if (r != X86EMUL_CONTINUE)
                         return r;
         }
 
         return X86EMUL_CONTINUE;
 }
+#endif
 
 static int em_rsm(struct x86_emulate_ctxt *ctxt)
 {
         unsigned long cr0, cr4, efer;
+        char buf[512];
         u64 smbase;
         int ret;
 
         if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
                 return emulate_ud(ctxt);
 
+        smbase = ctxt->ops->get_smbase(ctxt);
+
+        ret = ctxt->ops->read_phys(ctxt, smbase + 0xfe00, buf, sizeof(buf));
+        if (ret != X86EMUL_CONTINUE)
+                return X86EMUL_UNHANDLEABLE;
+
+        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
+                ctxt->ops->set_nmi_mask(ctxt, false);
+
+        ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
+                ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
+
         /*
          * Get back to real mode, to prepare a safe state in which to load
          * CR0/CR3/CR4/EFER.  It's all a bit more complicated if the vCPU
          * supports long mode.
          */
-        cr4 = ctxt->ops->get_cr(ctxt, 4);
         if (emulator_has_longmode(ctxt)) {
                 struct desc_struct cs_desc;
 
                 /* Zero CR4.PCIDE before CR0.PG.  */
-                if (cr4 & X86_CR4_PCIDE) {
+                cr4 = ctxt->ops->get_cr(ctxt, 4);
+                if (cr4 & X86_CR4_PCIDE)
                         ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE);
-                        cr4 &= ~X86_CR4_PCIDE;
-                }
 
                 /* A 32-bit code segment is required to clear EFER.LMA.  */
                 memset(&cs_desc, 0, sizeof(cs_desc));
@@ -2597,39 +2610,39 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
         if (cr0 & X86_CR0_PE)
                 ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE));
 
-        /* Now clear CR4.PAE (which must be done before clearing EFER.LME).  */
-        if (cr4 & X86_CR4_PAE)
-                ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
-
-        /* And finally go back to 32-bit mode.  */
-        efer = 0;
-        ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
+        if (emulator_has_longmode(ctxt)) {
+                /* Clear CR4.PAE before clearing EFER.LME. */
+                cr4 = ctxt->ops->get_cr(ctxt, 4);
+                if (cr4 & X86_CR4_PAE)
+                        ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
 
-        smbase = ctxt->ops->get_smbase(ctxt);
+                /* And finally go back to 32-bit mode.  */
+                efer = 0;
+                ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
+        }
 
         /*
          * Give pre_leave_smm() a chance to make ISA-specific changes to the
          * vCPU state (e.g. enter guest mode) before loading state from the SMM
          * state-save area.
          */
-        if (ctxt->ops->pre_leave_smm(ctxt, smbase))
+        if (ctxt->ops->pre_leave_smm(ctxt, buf))
                 return X86EMUL_UNHANDLEABLE;
 
+#ifdef CONFIG_X86_64
         if (emulator_has_longmode(ctxt))
-                ret = rsm_load_state_64(ctxt, smbase + 0x8000);
+                ret = rsm_load_state_64(ctxt, buf);
         else
-                ret = rsm_load_state_32(ctxt, smbase + 0x8000);
+#endif
+                ret = rsm_load_state_32(ctxt, buf);
 
         if (ret != X86EMUL_CONTINUE) {
                 /* FIXME: should triple fault */
                 return X86EMUL_UNHANDLEABLE;
         }
 
-        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
-                ctxt->ops->set_nmi_mask(ctxt, false);
+        ctxt->ops->post_leave_smm(ctxt);
 
-        ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
-                ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
         return X86EMUL_CONTINUE;
 }
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 991fdf7fc17f..9bf70cf84564 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -138,6 +138,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map,
                 if (offset <= max_apic_id) {
                         u8 cluster_size = min(max_apic_id - offset + 1, 16U);
 
+                        offset = array_index_nospec(offset, map->max_apic_id + 1);
                         *cluster = &map->phys_map[offset];
                         *mask = dest_id & (0xffff >> (16 - cluster_size));
                 } else {
@@ -901,7 +902,8 @@ static inline bool kvm_apic_map_get_dest_lapic(struct kvm *kvm,
                 if (irq->dest_id > map->max_apic_id) {
                         *bitmap = 0;
                 } else {
-                        *dst = &map->phys_map[irq->dest_id];
+                        u32 dest_id = array_index_nospec(irq->dest_id, map->max_apic_id + 1);
+                        *dst = &map->phys_map[dest_id];
                         *bitmap = 1;
                 }
                 return true;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index eee455a8a612..e10962dfc203 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2007,7 +2007,7 @@ static int is_empty_shadow_page(u64 *spt)
  * aggregate version in order to make the slab shrinker
  * faster
  */
-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
+static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr)
 {
         kvm->arch.n_used_mmu_pages += nr;
         percpu_counter_add(&kvm_total_used_mmu_pages, nr);
@@ -2238,7 +2238,7 @@ static bool kvm_mmu_remote_flush_or_zap(struct kvm *kvm,
                                         struct list_head *invalid_list,
                                         bool remote_flush)
 {
-        if (!remote_flush && !list_empty(invalid_list))
+        if (!remote_flush && list_empty(invalid_list))
                 return false;
 
         if (!list_empty(invalid_list))
@@ -2763,7 +2763,7 @@ static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
  * Changing the number of mmu pages allocated to the vm
  * Note: if goal_nr_mmu_pages is too small, you will get dead lock
  */
-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
+void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long goal_nr_mmu_pages)
 {
         LIST_HEAD(invalid_list);
 
@@ -6031,10 +6031,10 @@ out:
 /*
  * Calculate mmu pages needed for kvm.
  */
-unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
+unsigned long kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
 {
-        unsigned int nr_mmu_pages;
-        unsigned int  nr_pages = 0;
+        unsigned long nr_mmu_pages;
+        unsigned long nr_pages = 0;
         struct kvm_memslots *slots;
         struct kvm_memory_slot *memslot;
         int i;
@@ -6047,8 +6047,7 @@ unsigned int kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
         }
 
         nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
-        nr_mmu_pages = max(nr_mmu_pages,
-                           (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
+        nr_mmu_pages = max(nr_mmu_pages, KVM_MIN_ALLOC_MMU_PAGES);
 
         return nr_mmu_pages;
 }
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index bbdc60f2fae8..54c2a377795b 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -64,7 +64,7 @@ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
                                 u64 fault_address, char *insn, int insn_len);
 
-static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
+static inline unsigned long kvm_mmu_available_pages(struct kvm *kvm)
 {
         if (kvm->arch.n_max_mmu_pages > kvm->arch.n_used_mmu_pages)
                 return kvm->arch.n_max_mmu_pages -
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 58ead7db71a3..e39741997893 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -281,9 +281,13 @@ static int kvm_pmu_rdpmc_vmware(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
 int kvm_pmu_rdpmc(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
 {
         bool fast_mode = idx & (1u << 31);
+        struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
         struct kvm_pmc *pmc;
         u64 ctr_val;
 
+        if (!pmu->version)
+                return 1;
+
         if (is_vmware_backdoor_pmc(idx))
                 return kvm_pmu_rdpmc_vmware(vcpu, idx, data);
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e0a791c3d4fc..406b558abfef 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -262,6 +262,7 @@ struct amd_svm_iommu_ir {
 };
 
 #define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK    (0xFF)
+#define AVIC_LOGICAL_ID_ENTRY_VALID_BIT                 31
 #define AVIC_LOGICAL_ID_ENTRY_VALID_MASK                (1 << 31)
 
 #define AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK    (0xFFULL)
@@ -2692,6 +2693,7 @@ static int npf_interception(struct vcpu_svm *svm)
 static int db_interception(struct vcpu_svm *svm)
 {
         struct kvm_run *kvm_run = svm->vcpu.run;
+        struct kvm_vcpu *vcpu = &svm->vcpu;
 
         if (!(svm->vcpu.guest_debug &
               (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
@@ -2702,6 +2704,8 @@ static int db_interception(struct vcpu_svm *svm)
 
         if (svm->nmi_singlestep) {
                 disable_nmi_singlestep(svm);
+                /* Make sure we check for pending NMIs upon entry */
+                kvm_make_request(KVM_REQ_EVENT, vcpu);
         }
 
         if (svm->vcpu.guest_debug &
@@ -4517,14 +4521,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
                 kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                 break;
         case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
+                int i;
+                struct kvm_vcpu *vcpu;
+                struct kvm *kvm = svm->vcpu.kvm;
                 struct kvm_lapic *apic = svm->vcpu.arch.apic;
 
                 /*
-                 * Update ICR high and low, then emulate sending IPI,
-                 * which is handled when writing APIC_ICR.
+                 * At this point, we expect that the AVIC HW has already
+                 * set the appropriate IRR bits on the valid target
+                 * vcpus. So, we just need to kick the appropriate vcpu.
                  */
-                kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
-                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+                kvm_for_each_vcpu(i, vcpu, kvm) {
+                        bool m = kvm_apic_match_dest(vcpu, apic,
+                                                     icrl & KVM_APIC_SHORT_MASK,
+                                                     GET_APIC_DEST_FIELD(icrh),
+                                                     icrl & KVM_APIC_DEST_MASK);
+
+                        if (m && !avic_vcpu_is_running(vcpu))
+                                kvm_vcpu_wake_up(vcpu);
+                }
                 break;
         }
         case AVIC_IPI_FAILURE_INVALID_TARGET:
@@ -4596,7 +4611,7 @@ static void avic_invalidate_logical_id_entry(struct kvm_vcpu *vcpu)
         u32 *entry = avic_get_logical_id_entry(vcpu, svm->ldr_reg, flat);
 
         if (entry)
-                WRITE_ONCE(*entry, (u32) ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK);
+                clear_bit(AVIC_LOGICAL_ID_ENTRY_VALID_BIT, (unsigned long *)entry);
 }
 
 static int avic_handle_ldr_update(struct kvm_vcpu *vcpu)
@@ -5621,6 +5636,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         svm->vmcb->save.cr2 = vcpu->arch.cr2;
 
         clgi();
+        kvm_load_guest_xcr0(vcpu);
 
         /*
          * If this vCPU has touched SPEC_CTRL, restore the guest's value if
@@ -5766,6 +5782,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
                 kvm_before_interrupt(&svm->vcpu);
 
+        kvm_put_guest_xcr0(vcpu);
         stgi();
 
         /* Any pending NMI will happen here */
@@ -6215,32 +6232,24 @@ static int svm_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
         return 0;
 }
 
-static int svm_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
+static int svm_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
         struct vmcb *nested_vmcb;
         struct page *page;
-        struct {
-                u64 guest;
-                u64 vmcb;
-        } svm_state_save;
-        int ret;
+        u64 guest;
+        u64 vmcb;
 
-        ret = kvm_vcpu_read_guest(vcpu, smbase + 0xfed8, &svm_state_save,
-                                  sizeof(svm_state_save));
-        if (ret)
-                return ret;
+        guest = GET_SMSTATE(u64, smstate, 0x7ed8);
+        vmcb = GET_SMSTATE(u64, smstate, 0x7ee0);
 
-        if (svm_state_save.guest) {
-                vcpu->arch.hflags &= ~HF_SMM_MASK;
-                nested_vmcb = nested_svm_map(svm, svm_state_save.vmcb, &page);
-                if (nested_vmcb)
-                        enter_svm_guest_mode(svm, svm_state_save.vmcb, nested_vmcb, page);
-                else
-                        ret = 1;
-                vcpu->arch.hflags |= HF_SMM_MASK;
+        if (guest) {
+                nested_vmcb = nested_svm_map(svm, vmcb, &page);
+                if (!nested_vmcb)
+                        return 1;
+                enter_svm_guest_mode(svm, vmcb, nested_vmcb, page);
         }
-        return ret;
+        return 0;
 }
 
 static int enable_smi_window(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 6432d08c7de7..4d47a2631d1f 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -438,13 +438,13 @@ TRACE_EVENT(kvm_apic_ipi,
 );
 
 TRACE_EVENT(kvm_apic_accept_irq,
-            TP_PROTO(__u32 apicid, __u16 dm, __u8 tm, __u8 vec),
+            TP_PROTO(__u32 apicid, __u16 dm, __u16 tm, __u8 vec),
             TP_ARGS(apicid, dm, tm, vec),
 
         TP_STRUCT__entry(
                 __field(        __u32,          apicid          )
                 __field(        __u16,          dm              )
-                __field(        __u8,           tm              )
+                __field(        __u16,          tm              )
                 __field(        __u8,           vec             )
         ),
 
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 7ec9bb1dd723..6401eb7ef19c 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2873,20 +2873,27 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
                 /*
                  * If translation failed, VM entry will fail because
                  * prepare_vmcs02 set VIRTUAL_APIC_PAGE_ADDR to -1ull.
-                 * Failing the vm entry is _not_ what the processor
-                 * does but it's basically the only possibility we
-                 * have.  We could still enter the guest if CR8 load
-                 * exits are enabled, CR8 store exits are enabled, and
-                 * virtualize APIC access is disabled; in this case
-                 * the processor would never use the TPR shadow and we
-                 * could simply clear the bit from the execution
-                 * control.  But such a configuration is useless, so
-                 * let's keep the code simple.
                  */
                 if (!is_error_page(page)) {
                         vmx->nested.virtual_apic_page = page;
                         hpa = page_to_phys(vmx->nested.virtual_apic_page);
                         vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, hpa);
+                } else if (nested_cpu_has(vmcs12, CPU_BASED_CR8_LOAD_EXITING) &&
+                           nested_cpu_has(vmcs12, CPU_BASED_CR8_STORE_EXITING) &&
+                           !nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                        /*
+                         * The processor will never use the TPR shadow, simply
+                         * clear the bit from the execution control.  Such a
+                         * configuration is useless, but it happens in tests.
+                         * For any other configuration, failing the vm entry is
+                         * _not_ what the processor does but it's basically the
+                         * only possibility we have.
+                         */
+                        vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+                                        CPU_BASED_TPR_SHADOW);
+                } else {
+                        printk("bad virtual-APIC page address\n");
+                        dump_vmcs();
                 }
         }
 
@@ -3789,8 +3796,18 @@ static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)
         vmx_set_cr4(vcpu, vmcs_readl(CR4_READ_SHADOW));
 
         nested_ept_uninit_mmu_context(vcpu);
-        vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
-        __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+
+        /*
+         * This is only valid if EPT is in use, otherwise the vmcs01 GUEST_CR3
+         * points to shadow pages!  Fortunately we only get here after a WARN_ON
+         * if EPT is disabled, so a VMabort is perfectly fine.
+         */
+        if (enable_ept) {
+                vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
+                __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+        } else {
+                nested_vmx_abort(vcpu, VMX_ABORT_VMCS_CORRUPTED);
+        }
 
         /*
          * Use ept_save_pdptrs(vcpu) to load the MMU's cached PDPTRs
@@ -5738,6 +5755,14 @@ __init int nested_vmx_hardware_setup(int (*exit_handlers[])(struct kvm_vcpu *))
 {
         int i;
 
+        /*
+         * Without EPT it is not possible to restore L1's CR3 and PDPTR on
+         * VMfail, because they are not available in vmcs01.  Just always
+         * use hardware checks.
+         */
+        if (!enable_ept)
+                nested_early_check = 1;
+
         if (!cpu_has_vmx_shadow_vmcs())
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs) {
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index ab432a930ae8..b4e7d645275a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -5603,7 +5603,7 @@ static void vmx_dump_dtsel(char *name, uint32_t limit)
                vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
 }
 
-static void dump_vmcs(void)
+void dump_vmcs(void)
 {
         u32 vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
         u32 vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
@@ -6410,6 +6410,8 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
         if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
                 vmx_set_interrupt_shadow(vcpu, 0);
 
+        kvm_load_guest_xcr0(vcpu);
+
         if (static_cpu_has(X86_FEATURE_PKU) &&
             kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
             vcpu->arch.pkru != vmx->host_pkru)
@@ -6506,6 +6508,8 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
                         __write_pkru(vmx->host_pkru);
         }
 
+        kvm_put_guest_xcr0(vcpu);
+
         vmx->nested.nested_run_pending = 0;
         vmx->idt_vectoring_info = 0;
 
@@ -6852,6 +6856,30 @@ static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
         }
 }
 
+static bool guest_cpuid_has_pmu(struct kvm_vcpu *vcpu)
+{
+        struct kvm_cpuid_entry2 *entry;
+        union cpuid10_eax eax;
+
+        entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
+        if (!entry)
+                return false;
+
+        eax.full = entry->eax;
+        return (eax.split.version_id > 0);
+}
+
+static void nested_vmx_procbased_ctls_update(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool pmu_enabled = guest_cpuid_has_pmu(vcpu);
+
+        if (pmu_enabled)
+                vmx->nested.msrs.procbased_ctls_high |= CPU_BASED_RDPMC_EXITING;
+        else
+                vmx->nested.msrs.procbased_ctls_high &= ~CPU_BASED_RDPMC_EXITING;
+}
+
 static void update_intel_pt_cfg(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
@@ -6940,6 +6968,7 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
         if (nested_vmx_allowed(vcpu)) {
                 nested_vmx_cr_fixed1_bits_update(vcpu);
                 nested_vmx_entry_exit_ctls_update(vcpu);
+                nested_vmx_procbased_ctls_update(vcpu);
         }
 
         if (boot_cpu_has(X86_FEATURE_INTEL_PT) &&
@@ -7369,7 +7398,7 @@ static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
         return 0;
 }
 
-static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
+static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         int ret;
@@ -7380,9 +7409,7 @@ static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
         }
 
         if (vmx->nested.smm.guest_mode) {
-                vcpu->arch.hflags &= ~HF_SMM_MASK;
                 ret = nested_vmx_enter_non_root_mode(vcpu, false);
-                vcpu->arch.hflags |= HF_SMM_MASK;
                 if (ret)
                         return ret;
 
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index a1e00d0a2482..f879529906b4 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -517,4 +517,6 @@ static inline void decache_tsc_multiplier(struct vcpu_vmx *vmx)
         vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
 }
 
+void dump_vmcs(void);
+
 #endif /* __KVM_X86_VMX_H */
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 099b851dabaf..a0d1fc80ac5a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -800,7 +800,7 @@ void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
 }
 EXPORT_SYMBOL_GPL(kvm_lmsw);
 
-static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
 {
         if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE) &&
                         !vcpu->guest_xcr0_loaded) {
@@ -810,8 +810,9 @@ static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
                 vcpu->guest_xcr0_loaded = 1;
         }
 }
+EXPORT_SYMBOL_GPL(kvm_load_guest_xcr0);
 
-static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
 {
         if (vcpu->guest_xcr0_loaded) {
                 if (vcpu->arch.xcr0 != host_xcr0)
@@ -819,6 +820,7 @@ static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
                 vcpu->guest_xcr0_loaded = 0;
         }
 }
+EXPORT_SYMBOL_GPL(kvm_put_guest_xcr0);
 
 static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 {
@@ -3093,7 +3095,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
                 break;
         case KVM_CAP_NESTED_STATE:
                 r = kvm_x86_ops->get_nested_state ?
-                        kvm_x86_ops->get_nested_state(NULL, 0, 0) : 0;
+                        kvm_x86_ops->get_nested_state(NULL, NULL, 0) : 0;
                 break;
         default:
                 break;
@@ -3528,7 +3530,7 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
         memset(&events->reserved, 0, sizeof(events->reserved));
 }
 
-static void kvm_set_hflags(struct kvm_vcpu *vcpu, unsigned emul_flags);
+static void kvm_smm_changed(struct kvm_vcpu *vcpu);
 
 static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
                                               struct kvm_vcpu_events *events)
@@ -3588,12 +3590,13 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
                 vcpu->arch.apic->sipi_vector = events->sipi_vector;
 
         if (events->flags & KVM_VCPUEVENT_VALID_SMM) {
-                u32 hflags = vcpu->arch.hflags;
-                if (events->smi.smm)
-                        hflags |= HF_SMM_MASK;
-                else
-                        hflags &= ~HF_SMM_MASK;
-                kvm_set_hflags(vcpu, hflags);
+                if (!!(vcpu->arch.hflags & HF_SMM_MASK) != events->smi.smm) {
+                        if (events->smi.smm)
+                                vcpu->arch.hflags |= HF_SMM_MASK;
+                        else
+                                vcpu->arch.hflags &= ~HF_SMM_MASK;
+                        kvm_smm_changed(vcpu);
+                }
 
                 vcpu->arch.smi_pending = events->smi.pending;
 
@@ -4270,7 +4273,7 @@ static int kvm_vm_ioctl_set_identity_map_addr(struct kvm *kvm,
 }
 
 static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
-                                          u32 kvm_nr_mmu_pages)
+                                         unsigned long kvm_nr_mmu_pages)
 {
         if (kvm_nr_mmu_pages < KVM_MIN_ALLOC_MMU_PAGES)
                 return -EINVAL;
@@ -4284,7 +4287,7 @@ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
         return 0;
 }
 
-static int kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
+static unsigned long kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
 {
         return kvm->arch.n_max_mmu_pages;
 }
@@ -5958,12 +5961,18 @@ static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
 
 static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
 {
-        kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags);
+        emul_to_vcpu(ctxt)->arch.hflags = emul_flags;
+}
+
+static int emulator_pre_leave_smm(struct x86_emulate_ctxt *ctxt,
+                                  const char *smstate)
+{
+        return kvm_x86_ops->pre_leave_smm(emul_to_vcpu(ctxt), smstate);
 }
 
-static int emulator_pre_leave_smm(struct x86_emulate_ctxt *ctxt, u64 smbase)
+static void emulator_post_leave_smm(struct x86_emulate_ctxt *ctxt)
 {
-        return kvm_x86_ops->pre_leave_smm(emul_to_vcpu(ctxt), smbase);
+        kvm_smm_changed(emul_to_vcpu(ctxt));
 }
 
 static const struct x86_emulate_ops emulate_ops = {
@@ -6006,6 +6015,7 @@ static const struct x86_emulate_ops emulate_ops = {
         .get_hflags          = emulator_get_hflags,
         .set_hflags          = emulator_set_hflags,
         .pre_leave_smm       = emulator_pre_leave_smm,
+        .post_leave_smm      = emulator_post_leave_smm,
 };
 
 static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
@@ -6247,16 +6257,6 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu)
         kvm_mmu_reset_context(vcpu);
 }
 
-static void kvm_set_hflags(struct kvm_vcpu *vcpu, unsigned emul_flags)
-{
-        unsigned changed = vcpu->arch.hflags ^ emul_flags;
-
-        vcpu->arch.hflags = emul_flags;
-
-        if (changed & HF_SMM_MASK)
-                kvm_smm_changed(vcpu);
-}
-
 static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
                                 unsigned long *db)
 {
@@ -7441,9 +7441,9 @@ static void enter_smm_save_state_32(struct kvm_vcpu *vcpu, char *buf)
         put_smstate(u32, buf, 0x7ef8, vcpu->arch.smbase);
 }
 
+#ifdef CONFIG_X86_64
 static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
 {
-#ifdef CONFIG_X86_64
         struct desc_ptr dt;
         struct kvm_segment seg;
         unsigned long val;
@@ -7493,10 +7493,8 @@ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
 
         for (i = 0; i < 6; i++)
                 enter_smm_save_seg_64(vcpu, buf, i);
-#else
-        WARN_ON_ONCE(1);
-#endif
 }
+#endif
 
 static void enter_smm(struct kvm_vcpu *vcpu)
 {
@@ -7507,9 +7505,11 @@ static void enter_smm(struct kvm_vcpu *vcpu)
 
         trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
         memset(buf, 0, 512);
+#ifdef CONFIG_X86_64
         if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
                 enter_smm_save_state_64(vcpu, buf);
         else
+#endif
                 enter_smm_save_state_32(vcpu, buf);
 
         /*
@@ -7567,8 +7567,10 @@ static void enter_smm(struct kvm_vcpu *vcpu)
         kvm_set_segment(vcpu, &ds, VCPU_SREG_GS);
         kvm_set_segment(vcpu, &ds, VCPU_SREG_SS);
 
+#ifdef CONFIG_X86_64
         if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
                 kvm_x86_ops->set_efer(vcpu, 0);
+#endif
 
         kvm_update_cpuid(vcpu);
         kvm_mmu_reset_context(vcpu);
@@ -7865,8 +7867,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                 goto cancel_injection;
         }
 
-        kvm_load_guest_xcr0(vcpu);
-
         if (req_immediate_exit) {
                 kvm_make_request(KVM_REQ_EVENT, vcpu);
                 kvm_x86_ops->request_immediate_exit(vcpu);
@@ -7919,8 +7919,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
         vcpu->mode = OUTSIDE_GUEST_MODE;
         smp_wmb();
 
-        kvm_put_guest_xcr0(vcpu);
-
         kvm_before_interrupt(vcpu);
         kvm_x86_ops->handle_external_intr(vcpu);
         kvm_after_interrupt(vcpu);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 28406aa1136d..aedc5d0d4989 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -347,4 +347,6 @@ static inline void kvm_after_interrupt(struct kvm_vcpu *vcpu)
         __this_cpu_write(current_vcpu, NULL);
 }
 
+void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu);
+void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu);
 #endif
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index fac188dd78fa..dfb8cb0af13a 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2822,7 +2822,7 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
         bfq_remove_request(q, rq);
 }
 
-static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+static bool __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 {
         /*
          * If this bfqq is shared between multiple processes, check
@@ -2855,9 +2855,11 @@ static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
         /*
          * All in-service entities must have been properly deactivated
          * or requeued before executing the next function, which
-         * resets all in-service entites as no more in service.
+         * resets all in-service entities as no more in service. This
+         * may cause bfqq to be freed. If this happens, the next
+         * function returns true.
          */
-        __bfq_bfqd_reset_in_service(bfqd);
+        return __bfq_bfqd_reset_in_service(bfqd);
 }
 
 /**
@@ -3262,7 +3264,6 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
         bool slow;
         unsigned long delta = 0;
         struct bfq_entity *entity = &bfqq->entity;
-        int ref;
 
         /*
          * Check whether the process is slow (see bfq_bfqq_is_slow).
@@ -3347,10 +3348,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
          * reason.
          */
         __bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
-        ref = bfqq->ref;
-        __bfq_bfqq_expire(bfqd, bfqq);
-
-        if (ref == 1) /* bfqq is gone, no more actions on it */
+        if (__bfq_bfqq_expire(bfqd, bfqq))
+                /* bfqq is gone, no more actions on it */
                 return;
 
         bfqq->injected_service = 0;
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index 062e1c4787f4..86394e503ca9 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -995,7 +995,7 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity,
                              bool ins_into_idle_tree);
 bool next_queue_may_preempt(struct bfq_data *bfqd);
 struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd);
-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
+bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
 void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                          bool ins_into_idle_tree, bool expiration);
 void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq);
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index a11bef75483d..ae4d000ac0af 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1605,7 +1605,8 @@ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
         return bfqq;
 }
 
-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
+/* returns true if the in-service queue gets freed */
+bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
 {
         struct bfq_queue *in_serv_bfqq = bfqd->in_service_queue;
         struct bfq_entity *in_serv_entity = &in_serv_bfqq->entity;
@@ -1629,8 +1630,20 @@ void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
          * service tree either, then release the service reference to
          * the queue it represents (taken with bfq_get_entity).
          */
-        if (!in_serv_entity->on_st)
+        if (!in_serv_entity->on_st) {
+                /*
+                 * If no process is referencing in_serv_bfqq any
+                 * longer, then the service reference may be the only
+                 * reference to the queue. If this is the case, then
+                 * bfqq gets freed here.
+                 */
+                int ref = in_serv_bfqq->ref;
                 bfq_put_queue(in_serv_bfqq);
+                if (ref == 1)
+                        return true;
+        }
+
+        return false;
 }
 
 void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
diff --git a/block/bio.c b/block/bio.c
index b64cedc7f87c..716510ecd7ff 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1298,8 +1298,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                         }
                 }
 
-                if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes)
+                if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) {
+                        if (!map_data)
+                                __free_page(page);
                         break;
+                }
 
                 len -= bytes;
                 offset = 0;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a9354835cf51..9516304a38ee 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -654,6 +654,13 @@ bool blk_mq_complete_request(struct request *rq)
 }
 EXPORT_SYMBOL(blk_mq_complete_request);
 
+void blk_mq_complete_request_sync(struct request *rq)
+{
+        WRITE_ONCE(rq->state, MQ_RQ_COMPLETE);
+        rq->q->mq_ops->complete(rq);
+}
+EXPORT_SYMBOL_GPL(blk_mq_complete_request_sync);
+
 int blk_mq_request_started(struct request *rq)
 {
         return blk_mq_rq_state(rq) != MQ_RQ_IDLE;
diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c
index 8638f43cfc3d..79d86da1c892 100644
--- a/drivers/acpi/acpica/nsobject.c
+++ b/drivers/acpi/acpica/nsobject.c
@@ -186,6 +186,10 @@ void acpi_ns_detach_object(struct acpi_namespace_node *node)
                 }
         }
 
+        if (obj_desc->common.type == ACPI_TYPE_REGION) {
+                acpi_ut_remove_address_range(obj_desc->region.space_id, node);
+        }
+
         /* Clear the Node entry in all cases */
 
         node->object = NULL;
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 5a389a4f4f65..f1ed0befe303 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -567,6 +567,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 goto out;
         }
 
+        dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
+                        cmd_name, out_obj->buffer.length);
+        print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
+                        out_obj->buffer.pointer,
+                        min_t(u32, 128, out_obj->buffer.length), true);
+
         if (call_pkg) {
                 call_pkg->nd_fw_size = out_obj->buffer.length;
                 memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
@@ -585,12 +591,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                 return 0;
         }
 
-        dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
-                        cmd_name, out_obj->buffer.length);
-        print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
-                        out_obj->buffer.pointer,
-                        min_t(u32, 128, out_obj->buffer.length), true);
-
         for (i = 0, offset = 0; i < desc->out_num; i++) {
                 u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
                                 (u32 *) out_obj->buffer.pointer,
diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
index f70de71f79d6..cddd0fcf622c 100644
--- a/drivers/acpi/nfit/intel.c
+++ b/drivers/acpi/nfit/intel.c
@@ -122,9 +122,8 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
         if (!test_bit(cmd, &nfit_mem->dsm_mask))
                 return -ENOTTY;
 
-        if (old_data)
-                memcpy(nd_cmd.cmd.old_pass, old_data->data,
-                                sizeof(nd_cmd.cmd.old_pass));
+        memcpy(nd_cmd.cmd.old_pass, old_data->data,
+                        sizeof(nd_cmd.cmd.old_pass));
         memcpy(nd_cmd.cmd.new_pass, new_data->data,
                         sizeof(nd_cmd.cmd.new_pass));
         rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
@@ -336,9 +335,8 @@ static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
 
         /* flush all cache before we erase DIMM */
         nvdimm_invalidate_cache();
-        if (nkey)
-                memcpy(nd_cmd.cmd.passphrase, nkey->data,
-                                sizeof(nd_cmd.cmd.passphrase));
+        memcpy(nd_cmd.cmd.passphrase, nkey->data,
+                        sizeof(nd_cmd.cmd.passphrase));
         rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
         if (rc < 0)
                 return rc;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 4bc083b7c9b5..2a7ca4a1e6f7 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -513,6 +513,8 @@ static int init_vq(struct virtio_blk *vblk)
         if (err)
                 num_vqs = 1;
 
+        num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
+
         vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
         if (!vblk->vqs)
                 return -ENOMEM;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ded198328f21..7db48ae65cd2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2942,6 +2942,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
                 return 0;
         }
 
+        irq_set_status_flags(irq, IRQ_NOAUTOEN);
         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
                                0, "OOB Wake-on-BT", data);
         if (ret) {
@@ -2956,7 +2957,6 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
         }
 
         data->oob_wake_irq = irq;
-        disable_irq(irq);
         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
         return 0;
 }
diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
index ff0b199be472..f2411468f33f 100644
--- a/drivers/char/ipmi/ipmi_dmi.c
+++ b/drivers/char/ipmi/ipmi_dmi.c
@@ -66,7 +66,6 @@ static void __init dmi_add_platform_ipmi(unsigned long base_addr,
                 return;
         }
 
-        memset(&p, 0, sizeof(p));
         p.addr = base_addr;
         p.space = space;
         p.regspacing = offset;
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index e8ba67834746..00bf4b17edbf 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -214,6 +214,9 @@ struct ipmi_user {
 
         /* Does this interface receive IPMI events? */
         bool gets_events;
+
+        /* Free must run in process context for RCU cleanup. */
+        struct work_struct remove_work;
 };
 
 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
@@ -1157,6 +1160,15 @@ static int intf_err_seq(struct ipmi_smi *intf,
         return rv;
 }
 
+static void free_user_work(struct work_struct *work)
+{
+        struct ipmi_user *user = container_of(work, struct ipmi_user,
+                                              remove_work);
+
+        cleanup_srcu_struct(&user->release_barrier);
+        kfree(user);
+}
+
 int ipmi_create_user(unsigned int          if_num,
                      const struct ipmi_user_hndl *handler,
                      void                  *handler_data,
@@ -1200,6 +1212,8 @@ int ipmi_create_user(unsigned int          if_num,
         goto out_kfree;
 
  found:
+        INIT_WORK(&new_user->remove_work, free_user_work);
+
         rv = init_srcu_struct(&new_user->release_barrier);
         if (rv)
                 goto out_kfree;
@@ -1260,8 +1274,9 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
-        cleanup_srcu_struct(&user->release_barrier);
-        kfree(user);
+
+        /* SRCU cleanup must happen in task context. */
+        schedule_work(&user->remove_work);
 }
 
 static void _ipmi_destroy_user(struct ipmi_user *user)
diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c
index 01946cad3d13..682221eebd66 100644
--- a/drivers/char/ipmi/ipmi_si_hardcode.c
+++ b/drivers/char/ipmi/ipmi_si_hardcode.c
@@ -118,6 +118,8 @@ void __init ipmi_hardcode_init(void)
         char *str;
         char *si_type[SI_MAX_PARMS];
 
+        memset(si_type, 0, sizeof(si_type));
+
         /* Parse out the si_type string into its components. */
         str = si_type_str;
         if (*str != '\0') {
diff --git a/drivers/clk/at91/clk-programmable.c b/drivers/clk/at91/clk-programmable.c
index 89d6f3736dbf..f8edbb65eda3 100644
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -20,8 +20,7 @@
 #define PROG_ID_MAX             7
 
 #define PROG_STATUS_MASK(id)    (1 << ((id) + 8))
-#define PROG_PRES_MASK          0x7
-#define PROG_PRES(layout, pckr) ((pckr >> layout->pres_shift) & PROG_PRES_MASK)
+#define PROG_PRES(layout, pckr) ((pckr >> layout->pres_shift) & layout->pres_mask)
 #define PROG_MAX_RM9200_CSS     3
 
 struct clk_programmable {
@@ -37,20 +36,29 @@ static unsigned long clk_programmable_recalc_rate(struct clk_hw *hw,
                                                   unsigned long parent_rate)
 {
         struct clk_programmable *prog = to_clk_programmable(hw);
+        const struct clk_programmable_layout *layout = prog->layout;
         unsigned int pckr;
+        unsigned long rate;
 
         regmap_read(prog->regmap, AT91_PMC_PCKR(prog->id), &pckr);
 
-        return parent_rate >> PROG_PRES(prog->layout, pckr);
+        if (layout->is_pres_direct)
+                rate = parent_rate / (PROG_PRES(layout, pckr) + 1);
+        else
+                rate = parent_rate >> PROG_PRES(layout, pckr);
+
+        return rate;
 }
 
 static int clk_programmable_determine_rate(struct clk_hw *hw,
                                            struct clk_rate_request *req)
 {
+        struct clk_programmable *prog = to_clk_programmable(hw);
+        const struct clk_programmable_layout *layout = prog->layout;
         struct clk_hw *parent;
         long best_rate = -EINVAL;
         unsigned long parent_rate;
-        unsigned long tmp_rate;
+        unsigned long tmp_rate = 0;
         int shift;
         int i;
 
@@ -60,10 +68,18 @@ static int clk_programmable_determine_rate(struct clk_hw *hw,
                         continue;
 
                 parent_rate = clk_hw_get_rate(parent);
-                for (shift = 0; shift < PROG_PRES_MASK; shift++) {
-                        tmp_rate = parent_rate >> shift;
-                        if (tmp_rate <= req->rate)
-                                break;
+                if (layout->is_pres_direct) {
+                        for (shift = 0; shift <= layout->pres_mask; shift++) {
+                                tmp_rate = parent_rate / (shift + 1);
+                                if (tmp_rate <= req->rate)
+                                        break;
+                        }
+                } else {
+                        for (shift = 0; shift < layout->pres_mask; shift++) {
+                                tmp_rate = parent_rate >> shift;
+                                if (tmp_rate <= req->rate)
+                                        break;
+                        }
                 }
 
                 if (tmp_rate > req->rate)
@@ -137,16 +153,23 @@ static int clk_programmable_set_rate(struct clk_hw *hw, unsigned long rate,
         if (!div)
                 return -EINVAL;
 
-        shift = fls(div) - 1;
+        if (layout->is_pres_direct) {
+                shift = div - 1;
 
-        if (div != (1 << shift))
-                return -EINVAL;
+                if (shift > layout->pres_mask)
+                        return -EINVAL;
+        } else {
+                shift = fls(div) - 1;
 
-        if (shift >= PROG_PRES_MASK)
-                return -EINVAL;
+                if (div != (1 << shift))
+                        return -EINVAL;
+
+                if (shift >= layout->pres_mask)
+                        return -EINVAL;
+        }
 
         regmap_update_bits(prog->regmap, AT91_PMC_PCKR(prog->id),
-                           PROG_PRES_MASK << layout->pres_shift,
+                           layout->pres_mask << layout->pres_shift,
                            shift << layout->pres_shift);
 
         return 0;
@@ -202,19 +225,25 @@ at91_clk_register_programmable(struct regmap *regmap,
 }
 
 const struct clk_programmable_layout at91rm9200_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 2,
         .css_mask = 0x3,
         .have_slck_mck = 0,
+        .is_pres_direct = 0,
 };
 
 const struct clk_programmable_layout at91sam9g45_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 2,
         .css_mask = 0x3,
         .have_slck_mck = 1,
+        .is_pres_direct = 0,
 };
 
 const struct clk_programmable_layout at91sam9x5_programmable_layout = {
+        .pres_mask = 0x7,
         .pres_shift = 4,
         .css_mask = 0x7,
         .have_slck_mck = 0,
+        .is_pres_direct = 0,
 };
diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
index 672a79bda88c..a0e5ce9c9b9e 100644
--- a/drivers/clk/at91/pmc.h
+++ b/drivers/clk/at91/pmc.h
@@ -71,9 +71,11 @@ struct clk_pll_characteristics {
 };
 
 struct clk_programmable_layout {
+        u8 pres_mask;
         u8 pres_shift;
         u8 css_mask;
         u8 have_slck_mck;
+        u8 is_pres_direct;
 };
 
 extern const struct clk_programmable_layout at91rm9200_programmable_layout;
diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c
index 1f70cb164b06..81943fac4537 100644
--- a/drivers/clk/at91/sama5d2.c
+++ b/drivers/clk/at91/sama5d2.c
@@ -125,6 +125,14 @@ static const struct {
           .pll = true },
 };
 
+static const struct clk_programmable_layout sama5d2_programmable_layout = {
+        .pres_mask = 0xff,
+        .pres_shift = 4,
+        .css_mask = 0x7,
+        .have_slck_mck = 0,
+        .is_pres_direct = 1,
+};
+
 static void __init sama5d2_pmc_setup(struct device_node *np)
 {
         struct clk_range range = CLK_RANGE(0, 0);
@@ -249,7 +257,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np)
 
                 hw = at91_clk_register_programmable(regmap, name,
                                                     parent_names, 6, i,
-                                                    &at91sam9x5_programmable_layout);
+                                                    &sama5d2_programmable_layout);
                 if (IS_ERR(hw))
                         goto err_free;
         }
diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c
index 1acfa3e3cfb4..113d71042199 100644
--- a/drivers/clk/imx/clk-pll14xx.c
+++ b/drivers/clk/imx/clk-pll14xx.c
@@ -362,7 +362,7 @@ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
 
         switch (pll_clk->type) {
         case PLL_1416X:
-                if (!pll->rate_table)
+                if (!pll_clk->rate_table)
                         init.ops = &clk_pll1416x_min_ops;
                 else
                         init.ops = &clk_pll1416x_ops;
diff --git a/drivers/clk/mediatek/clk-gate.c b/drivers/clk/mediatek/clk-gate.c
index 9628d4e7690b..85daf826619a 100644
--- a/drivers/clk/mediatek/clk-gate.c
+++ b/drivers/clk/mediatek/clk-gate.c
@@ -169,11 +169,10 @@ struct clk *mtk_clk_register_gate(
                 return ERR_PTR(-ENOMEM);
 
         init.name = name;
-        init.flags = CLK_SET_RATE_PARENT;
+        init.flags = flags | CLK_SET_RATE_PARENT;
         init.parent_names = parent_name ? &parent_name : NULL;
         init.num_parents = parent_name ? 1 : 0;
         init.ops = ops;
-        init.flags = flags;
 
         cg->regmap = regmap;
         cg->set_ofs = set_ofs;
diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
index 41e16dd7272a..7a14ac9b2fec 100644
--- a/drivers/clk/meson/clk-pll.c
+++ b/drivers/clk/meson/clk-pll.c
@@ -120,7 +120,7 @@ static bool meson_clk_pll_is_better(unsigned long rate,
                         return true;
         } else {
                 /* Round down */
-                if (now < rate && best < now)
+                if (now <= rate && best < now)
                         return true;
         }
 
diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
index 0e1ce8c03259..f7b11e1eeebe 100644
--- a/drivers/clk/meson/g12a.c
+++ b/drivers/clk/meson/g12a.c
@@ -960,14 +960,14 @@ static struct clk_regmap g12a_sd_emmc_c_clk0 = {
 /* VPU Clock */
 
 static const char * const g12a_vpu_parent_names[] = {
-        "fclk_div4", "fclk_div3", "fclk_div5", "fclk_div7",
+        "fclk_div3", "fclk_div4", "fclk_div5", "fclk_div7",
         "mpll1", "vid_pll", "hifi_pll", "gp0_pll",
 };
 
 static struct clk_regmap g12a_vpu_0_sel = {
         .data = &(struct clk_regmap_mux_data){
                 .offset = HHI_VPU_CLK_CNTL,
-                .mask = 0x3,
+                .mask = 0x7,
                 .shift = 9,
         },
         .hw.init = &(struct clk_init_data){
@@ -1011,7 +1011,7 @@ static struct clk_regmap g12a_vpu_0 = {
 static struct clk_regmap g12a_vpu_1_sel = {
         .data = &(struct clk_regmap_mux_data){
                 .offset = HHI_VPU_CLK_CNTL,
-                .mask = 0x3,
+                .mask = 0x7,
                 .shift = 25,
         },
         .hw.init = &(struct clk_init_data){
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 04df2e208ed6..29ffb4fde714 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -2216,6 +2216,7 @@ static struct clk_regmap gxbb_vdec_1_div = {
                 .offset = HHI_VDEC_CLK_CNTL,
                 .shift = 0,
                 .width = 7,
+                .flags = CLK_DIVIDER_ROUND_CLOSEST,
         },
         .hw.init = &(struct clk_init_data){
                 .name = "vdec_1_div",
@@ -2261,6 +2262,7 @@ static struct clk_regmap gxbb_vdec_hevc_div = {
                 .offset = HHI_VDEC2_CLK_CNTL,
                 .shift = 16,
                 .width = 7,
+                .flags = CLK_DIVIDER_ROUND_CLOSEST,
         },
         .hw.init = &(struct clk_init_data){
                 .name = "vdec_hevc_div",
diff --git a/drivers/clk/meson/vid-pll-div.c b/drivers/clk/meson/vid-pll-div.c
index 08bcc01c0923..daff235bc763 100644
--- a/drivers/clk/meson/vid-pll-div.c
+++ b/drivers/clk/meson/vid-pll-div.c
@@ -82,8 +82,8 @@ static unsigned long meson_vid_pll_div_recalc_rate(struct clk_hw *hw,
         div = _get_table_val(meson_parm_read(clk->map, &pll_div->val),
                              meson_parm_read(clk->map, &pll_div->sel));
         if (!div || !div->divider) {
-                pr_info("%s: Invalid config value for vid_pll_div\n", __func__);
-                return parent_rate;
+                pr_debug("%s: Invalid config value for vid_pll_div\n", __func__);
+                return 0;
         }
 
         return DIV_ROUND_UP_ULL(parent_rate * div->multiplier, div->divider);
diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
index d977193842df..19174835693b 100644
--- a/drivers/clk/x86/clk-pmc-atom.c
+++ b/drivers/clk/x86/clk-pmc-atom.c
@@ -165,7 +165,7 @@ static const struct clk_ops plt_clk_ops = {
 };
 
 static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
-                                        void __iomem *base,
+                                        const struct pmc_clk_data *pmc_data,
                                         const char **parent_names,
                                         int num_parents)
 {
@@ -184,9 +184,17 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
         init.num_parents = num_parents;
 
         pclk->hw.init = &init;
-        pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
+        pclk->reg = pmc_data->base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
         spin_lock_init(&pclk->lock);
 
+        /*
+         * On some systems, the pmc_plt_clocks already enabled by the
+         * firmware are being marked as critical to avoid them being
+         * gated by the clock framework.
+         */
+        if (pmc_data->critical && plt_clk_is_enabled(&pclk->hw))
+                init.flags |= CLK_IS_CRITICAL;
+
         ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
         if (ret) {
                 pclk = ERR_PTR(ret);
@@ -332,7 +340,7 @@ static int plt_clk_probe(struct platform_device *pdev)
                 return PTR_ERR(parent_names);
 
         for (i = 0; i < PMC_CLK_NUM; i++) {
-                data->clks[i] = plt_clk_register(pdev, i, pmc_data->base,
+                data->clks[i] = plt_clk_register(pdev, i, pmc_data,
                                                  parent_names, data->nparents);
                 if (IS_ERR(data->clks[i])) {
                         err = PTR_ERR(data->clks[i]);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ac0d646a7b74..5d8b30fd4534 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3173,11 +3173,16 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev)
                         break;
 
                 if (fence) {
-                        r = dma_fence_wait_timeout(fence, false, tmo);
+                        tmo = dma_fence_wait_timeout(fence, false, tmo);
                         dma_fence_put(fence);
                         fence = next;
-                        if (r <= 0)
+                        if (tmo == 0) {
+                                r = -ETIMEDOUT;
                                 break;
+                        } else if (tmo < 0) {
+                                r = tmo;
+                                break;
+                        }
                 } else {
                         fence = next;
                 }
@@ -3188,8 +3193,8 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev)
                 tmo = dma_fence_wait_timeout(fence, false, tmo);
         dma_fence_put(fence);
 
-        if (r <= 0 || tmo <= 0) {
-                DRM_ERROR("recover vram bo from shadow failed\n");
+        if (r < 0 || tmo <= 0) {
+                DRM_ERROR("recover vram bo from shadow failed, r is %ld, tmo is %ld\n", r, tmo);
                 return -EIO;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 0b8ef2d27d6b..fe393a46f881 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -35,6 +35,7 @@
 #include "amdgpu_trace.h"
 
 #define AMDGPU_IB_TEST_TIMEOUT  msecs_to_jiffies(1000)
+#define AMDGPU_IB_TEST_GFX_XGMI_TIMEOUT msecs_to_jiffies(2000)
 
 /*
  * IB
@@ -344,6 +345,8 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                  * cost waiting for it coming back under RUNTIME only
                 */
                 tmo_gfx = 8 * AMDGPU_IB_TEST_TIMEOUT;
+        } else if (adev->gmc.xgmi.hive_id) {
+                tmo_gfx = AMDGPU_IB_TEST_GFX_XGMI_TIMEOUT;
         }
 
         for (i = 0; i < adev->num_rings; ++i) {
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 8be9677c0c07..cf9a49f49d3a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -320,6 +320,7 @@ static const struct kfd_deviceid supported_devices[] = {
         { 0x9876, &carrizo_device_info },       /* Carrizo */
         { 0x9877, &carrizo_device_info },       /* Carrizo */
         { 0x15DD, &raven_device_info },         /* Raven */
+        { 0x15D8, &raven_device_info },         /* Raven */
 #endif
         { 0x67A0, &hawaii_device_info },        /* Hawaii */
         { 0x67A1, &hawaii_device_info },        /* Hawaii */
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 81127f7d6ed1..3082b55b1e77 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4533,6 +4533,7 @@ static void handle_cursor_update(struct drm_plane *plane,
         amdgpu_crtc->cursor_width = plane->state->crtc_w;
         amdgpu_crtc->cursor_height = plane->state->crtc_h;
 
+        memset(&attributes, 0, sizeof(attributes));
         attributes.address.high_part = upper_32_bits(address);
         attributes.address.low_part  = lower_32_bits(address);
         attributes.width             = plane->state->crtc_w;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
index 683829466a44..0ba68d41b9c3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
@@ -1150,28 +1150,9 @@ void hubp1_cursor_set_position(
         REG_UPDATE(CURSOR_CONTROL,
                         CURSOR_ENABLE, cur_en);
 
-        //account for cases where we see negative offset relative to overlay plane
-        if (src_x_offset < 0 && src_y_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
-                        CURSOR_X_POSITION, 0,
-                        CURSOR_Y_POSITION, 0);
-                x_hotspot -= src_x_offset;
-                y_hotspot -= src_y_offset;
-        } else if (src_x_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
-                        CURSOR_X_POSITION, 0,
-                        CURSOR_Y_POSITION, pos->y);
-                x_hotspot -= src_x_offset;
-        } else if (src_y_offset < 0) {
-                REG_SET_2(CURSOR_POSITION, 0,
+        REG_SET_2(CURSOR_POSITION, 0,
                         CURSOR_X_POSITION, pos->x,
-                        CURSOR_Y_POSITION, 0);
-                y_hotspot -= src_y_offset;
-        } else {
-                REG_SET_2(CURSOR_POSITION, 0,
-                                CURSOR_X_POSITION, pos->x,
-                                CURSOR_Y_POSITION, pos->y);
-        }
+                        CURSOR_Y_POSITION, pos->y);
 
         REG_SET_2(CURSOR_HOT_SPOT, 0,
                         CURSOR_HOT_SPOT_X, x_hotspot,
diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
index a63e5f0dae56..db761329a1e3 100644
--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
@@ -1037,6 +1037,31 @@ void dw_hdmi_phy_i2c_write(struct dw_hdmi *hdmi, unsigned short data,
 }
 EXPORT_SYMBOL_GPL(dw_hdmi_phy_i2c_write);
 
+/* Filter out invalid setups to avoid configuring SCDC and scrambling */
+static bool dw_hdmi_support_scdc(struct dw_hdmi *hdmi)
+{
+        struct drm_display_info *display = &hdmi->connector.display_info;
+
+        /* Completely disable SCDC support for older controllers */
+        if (hdmi->version < 0x200a)
+                return false;
+
+        /* Disable if SCDC is not supported, or if an HF-VSDB block is absent */
+        if (!display->hdmi.scdc.supported ||
+            !display->hdmi.scdc.scrambling.supported)
+                return false;
+
+        /*
+         * Disable if display only support low TMDS rates and scrambling
+         * for low rates is not supported either
+         */
+        if (!display->hdmi.scdc.scrambling.low_rates &&
+            display->max_tmds_clock <= 340000)
+                return false;
+
+        return true;
+}
+
 /*
  * HDMI2.0 Specifies the following procedure for High TMDS Bit Rates:
  * - The Source shall suspend transmission of the TMDS clock and data
@@ -1055,7 +1080,7 @@ void dw_hdmi_set_high_tmds_clock_ratio(struct dw_hdmi *hdmi)
         unsigned long mtmdsclock = hdmi->hdmi_data.video_mode.mtmdsclock;
 
         /* Control for TMDS Bit Period/TMDS Clock-Period Ratio */
-        if (hdmi->connector.display_info.hdmi.scdc.supported) {
+        if (dw_hdmi_support_scdc(hdmi)) {
                 if (mtmdsclock > HDMI14_MAX_TMDSCLK)
                         drm_scdc_set_high_tmds_clock_ratio(hdmi->ddc, 1);
                 else
@@ -1579,8 +1604,9 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
 
         /* Set up HDMI_FC_INVIDCONF */
         inv_val = (hdmi->hdmi_data.hdcp_enable ||
-                   vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
-                   hdmi_info->scdc.scrambling.low_rates ?
+                   (dw_hdmi_support_scdc(hdmi) &&
+                    (vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
+                     hdmi_info->scdc.scrambling.low_rates)) ?
                 HDMI_FC_INVIDCONF_HDCP_KEEPOUT_ACTIVE :
                 HDMI_FC_INVIDCONF_HDCP_KEEPOUT_INACTIVE);
 
@@ -1646,7 +1672,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
         }
 
         /* Scrambling Control */
-        if (hdmi_info->scdc.supported) {
+        if (dw_hdmi_support_scdc(hdmi)) {
                 if (vmode->mtmdsclock > HDMI14_MAX_TMDSCLK ||
                     hdmi_info->scdc.scrambling.low_rates) {
                         /*
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 40ac19848034..fbb76332cc9f 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1034,7 +1034,7 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state)
                         funcs->atomic_disable(crtc, old_crtc_state);
                 else if (funcs->disable)
                         funcs->disable(crtc);
-                else
+                else if (funcs->dpms)
                         funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
 
                 if (!(dev->irq_enabled && dev->num_crtcs))
@@ -1277,10 +1277,9 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev,
                 if (new_crtc_state->enable) {
                         DRM_DEBUG_ATOMIC("enabling [CRTC:%d:%s]\n",
                                          crtc->base.id, crtc->name);
-
                         if (funcs->atomic_enable)
                                 funcs->atomic_enable(crtc, old_crtc_state);
-                        else
+                        else if (funcs->commit)
                                 funcs->commit(crtc);
                 }
         }
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 5d887f7cc0d5..69a9a1b2ea4a 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -209,7 +209,7 @@ static int vgpu_get_plane_info(struct drm_device *dev,
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct intel_vgpu_primary_plane_format p;
         struct intel_vgpu_cursor_plane_format c;
-        int ret;
+        int ret, tile_height = 1;
 
         if (plane_id == DRM_PLANE_TYPE_PRIMARY) {
                 ret = intel_vgpu_decode_primary_plane(vgpu, &p);
@@ -228,12 +228,15 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                         break;
                 case PLANE_CTL_TILED_X:
                         info->drm_format_mod = I915_FORMAT_MOD_X_TILED;
+                        tile_height = 8;
                         break;
                 case PLANE_CTL_TILED_Y:
                         info->drm_format_mod = I915_FORMAT_MOD_Y_TILED;
+                        tile_height = 32;
                         break;
                 case PLANE_CTL_TILED_YF:
                         info->drm_format_mod = I915_FORMAT_MOD_Yf_TILED;
+                        tile_height = 32;
                         break;
                 default:
                         gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
@@ -264,8 +267,8 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        info->size = (info->stride * info->height + PAGE_SIZE - 1)
-                      >> PAGE_SHIFT;
+        info->size = (info->stride * roundup(info->height, tile_height)
+                      + PAGE_SIZE - 1) >> PAGE_SHIFT;
         if (info->size == 0) {
                 gvt_vgpu_err("fb size is zero\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index cf133ef03873..9814773882ec 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -750,14 +750,20 @@ static void ppgtt_free_spt(struct intel_vgpu_ppgtt_spt *spt)
 
 static void ppgtt_free_all_spt(struct intel_vgpu *vgpu)
 {
-        struct intel_vgpu_ppgtt_spt *spt;
+        struct intel_vgpu_ppgtt_spt *spt, *spn;
         struct radix_tree_iter iter;
-        void **slot;
+        LIST_HEAD(all_spt);
+        void __rcu **slot;
 
+        rcu_read_lock();
         radix_tree_for_each_slot(slot, &vgpu->gtt.spt_tree, &iter, 0) {
                 spt = radix_tree_deref_slot(slot);
-                ppgtt_free_spt(spt);
+                list_move(&spt->post_shadow_list, &all_spt);
         }
+        rcu_read_unlock();
+
+        list_for_each_entry_safe(spt, spn, &all_spt, post_shadow_list)
+                ppgtt_free_spt(spt);
 }
 
 static int ppgtt_handle_guest_write_page_table_bytes(
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index d5fcc447d22f..a68addf95c23 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -905,7 +905,7 @@ static inline bool intel_vgpu_in_aperture(struct intel_vgpu *vgpu, u64 off)
 static int intel_vgpu_aperture_rw(struct intel_vgpu *vgpu, u64 off,
                 void *buf, unsigned long count, bool is_write)
 {
-        void *aperture_va;
+        void __iomem *aperture_va;
 
         if (!intel_vgpu_in_aperture(vgpu, off) ||
             !intel_vgpu_in_aperture(vgpu, off + count)) {
@@ -920,9 +920,9 @@ static int intel_vgpu_aperture_rw(struct intel_vgpu *vgpu, u64 off,
                 return -EIO;
 
         if (is_write)
-                memcpy(aperture_va + offset_in_page(off), buf, count);
+                memcpy_toio(aperture_va + offset_in_page(off), buf, count);
         else
-                memcpy(buf, aperture_va + offset_in_page(off), count);
+                memcpy_fromio(buf, aperture_va + offset_in_page(off), count);
 
         io_mapping_unmap(aperture_va);
 
diff --git a/drivers/gpu/drm/i915/icl_dsi.c b/drivers/gpu/drm/i915/icl_dsi.c
index 73a7bee24a66..641e0778fa9c 100644
--- a/drivers/gpu/drm/i915/icl_dsi.c
+++ b/drivers/gpu/drm/i915/icl_dsi.c
@@ -323,6 +323,21 @@ static void gen11_dsi_program_esc_clk_div(struct intel_encoder *encoder)
         }
 }
 
+static void get_dsi_io_power_domains(struct drm_i915_private *dev_priv,
+                                     struct intel_dsi *intel_dsi)
+{
+        enum port port;
+
+        for_each_dsi_port(port, intel_dsi->ports) {
+                WARN_ON(intel_dsi->io_wakeref[port]);
+                intel_dsi->io_wakeref[port] =
+                        intel_display_power_get(dev_priv,
+                                                port == PORT_A ?
+                                                POWER_DOMAIN_PORT_DDI_A_IO :
+                                                POWER_DOMAIN_PORT_DDI_B_IO);
+        }
+}
+
 static void gen11_dsi_enable_io_power(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
@@ -336,13 +351,7 @@ static void gen11_dsi_enable_io_power(struct intel_encoder *encoder)
                 I915_WRITE(ICL_DSI_IO_MODECTL(port), tmp);
         }
 
-        for_each_dsi_port(port, intel_dsi->ports) {
-                intel_dsi->io_wakeref[port] =
-                        intel_display_power_get(dev_priv,
-                                                port == PORT_A ?
-                                                POWER_DOMAIN_PORT_DDI_A_IO :
-                                                POWER_DOMAIN_PORT_DDI_B_IO);
-        }
+        get_dsi_io_power_domains(dev_priv, intel_dsi);
 }
 
 static void gen11_dsi_power_up_lanes(struct intel_encoder *encoder)
@@ -589,6 +598,12 @@ static void gen11_dsi_map_pll(struct intel_encoder *encoder,
                 val |= DPCLKA_CFGCR0_DDI_CLK_SEL(pll->info->id, port);
         }
         I915_WRITE(DPCLKA_CFGCR0_ICL, val);
+
+        for_each_dsi_port(port, intel_dsi->ports) {
+                val &= ~DPCLKA_CFGCR0_DDI_CLK_OFF(port);
+        }
+        I915_WRITE(DPCLKA_CFGCR0_ICL, val);
+
         POSTING_READ(DPCLKA_CFGCR0_ICL);
 
         mutex_unlock(&dev_priv->dpll_lock);
@@ -1117,7 +1132,7 @@ static void gen11_dsi_disable_port(struct intel_encoder *encoder)
                         DRM_ERROR("DDI port:%c buffer not idle\n",
                                   port_name(port));
         }
-        gen11_dsi_ungate_clocks(encoder);
+        gen11_dsi_gate_clocks(encoder);
 }
 
 static void gen11_dsi_disable_io_power(struct intel_encoder *encoder)
@@ -1218,20 +1233,11 @@ static int gen11_dsi_compute_config(struct intel_encoder *encoder,
         return 0;
 }
 
-static u64 gen11_dsi_get_power_domains(struct intel_encoder *encoder,
-                                       struct intel_crtc_state *crtc_state)
+static void gen11_dsi_get_power_domains(struct intel_encoder *encoder,
+                                        struct intel_crtc_state *crtc_state)
 {
-        struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
-        u64 domains = 0;
-        enum port port;
-
-        for_each_dsi_port(port, intel_dsi->ports)
-                if (port == PORT_A)
-                        domains |= BIT_ULL(POWER_DOMAIN_PORT_DDI_A_IO);
-                else
-                        domains |= BIT_ULL(POWER_DOMAIN_PORT_DDI_B_IO);
-
-        return domains;
+        get_dsi_io_power_domains(to_i915(encoder->base.dev),
+                                 enc_to_intel_dsi(&encoder->base));
 }
 
 static bool gen11_dsi_get_hw_state(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 14d580cdefd3..ab4e60dfd6a3 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2075,12 +2075,11 @@ intel_ddi_main_link_aux_domain(struct intel_digital_port *dig_port)
                                               intel_aux_power_domain(dig_port);
 }
 
-static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
-                                       struct intel_crtc_state *crtc_state)
+static void intel_ddi_get_power_domains(struct intel_encoder *encoder,
+                                        struct intel_crtc_state *crtc_state)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         struct intel_digital_port *dig_port;
-        u64 domains;
 
         /*
          * TODO: Add support for MST encoders. Atm, the following should never
@@ -2088,10 +2087,10 @@ static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
          * hook.
          */
         if (WARN_ON(intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DP_MST)))
-                return 0;
+                return;
 
         dig_port = enc_to_dig_port(&encoder->base);
-        domains = BIT_ULL(dig_port->ddi_io_power_domain);
+        intel_display_power_get(dev_priv, dig_port->ddi_io_power_domain);
 
         /*
          * AUX power is only needed for (e)DP mode, and for HDMI mode on TC
@@ -2099,15 +2098,15 @@ static u64 intel_ddi_get_power_domains(struct intel_encoder *encoder,
          */
         if (intel_crtc_has_dp_encoder(crtc_state) ||
             intel_port_is_tc(dev_priv, encoder->port))
-                domains |= BIT_ULL(intel_ddi_main_link_aux_domain(dig_port));
+                intel_display_power_get(dev_priv,
+                                        intel_ddi_main_link_aux_domain(dig_port));
 
         /*
          * VDSC power is needed when DSC is enabled
          */
         if (crtc_state->dsc_params.compression_enable)
-                domains |= BIT_ULL(intel_dsc_power_domain(crtc_state));
-
-        return domains;
+                intel_display_power_get(dev_priv,
+                                        intel_dsc_power_domain(crtc_state));
 }
 
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state)
@@ -2825,10 +2824,10 @@ void icl_sanitize_encoder_pll_mapping(struct intel_encoder *encoder)
                                 return;
                 }
                 /*
-                 * DSI ports should have their DDI clock ungated when disabled
-                 * and gated when enabled.
+                 * For DSI we keep the ddi clocks gated
+                 * except during enable/disable sequence.
                  */
-                ddi_clk_needed = !encoder->base.crtc;
+                ddi_clk_needed = false;
         }
 
         val = I915_READ(DPCLKA_CFGCR0_ICL);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ccb616351bba..421aac80a838 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15986,8 +15986,6 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
         struct intel_encoder *encoder;
 
         for_each_intel_encoder(&dev_priv->drm, encoder) {
-                u64 get_domains;
-                enum intel_display_power_domain domain;
                 struct intel_crtc_state *crtc_state;
 
                 if (!encoder->get_power_domains)
@@ -16001,9 +15999,7 @@ get_encoder_power_domains(struct drm_i915_private *dev_priv)
                         continue;
 
                 crtc_state = to_intel_crtc_state(encoder->base.crtc->state);
-                get_domains = encoder->get_power_domains(encoder, crtc_state);
-                for_each_power_domain(domain, get_domains)
-                        intel_display_power_get(dev_priv, domain);
+                encoder->get_power_domains(encoder, crtc_state);
         }
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cf709835fb9a..8891f29a8c7f 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1859,42 +1859,6 @@ intel_dp_compute_link_config_wide(struct intel_dp *intel_dp,
         return -EINVAL;
 }
 
-/* Optimize link config in order: max bpp, min lanes, min clock */
-static int
-intel_dp_compute_link_config_fast(struct intel_dp *intel_dp,
-                                  struct intel_crtc_state *pipe_config,
-                                  const struct link_config_limits *limits)
-{
-        struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
-        int bpp, clock, lane_count;
-        int mode_rate, link_clock, link_avail;
-
-        for (bpp = limits->max_bpp; bpp >= limits->min_bpp; bpp -= 2 * 3) {
-                mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
-                                                   bpp);
-
-                for (lane_count = limits->min_lane_count;
-                     lane_count <= limits->max_lane_count;
-                     lane_count <<= 1) {
-                        for (clock = limits->min_clock; clock <= limits->max_clock; clock++) {
-                                link_clock = intel_dp->common_rates[clock];
-                                link_avail = intel_dp_max_data_rate(link_clock,
-                                                                    lane_count);
-
-                                if (mode_rate <= link_avail) {
-                                        pipe_config->lane_count = lane_count;
-                                        pipe_config->pipe_bpp = bpp;
-                                        pipe_config->port_clock = link_clock;
-
-                                        return 0;
-                                }
-                        }
-                }
-        }
-
-        return -EINVAL;
-}
-
 static int intel_dp_dsc_compute_bpp(struct intel_dp *intel_dp, u8 dsc_max_bpc)
 {
         int i, num_bpc;
@@ -2031,15 +1995,13 @@ intel_dp_compute_link_config(struct intel_encoder *encoder,
         limits.min_bpp = 6 * 3;
         limits.max_bpp = intel_dp_compute_bpp(intel_dp, pipe_config);
 
-        if (intel_dp_is_edp(intel_dp) && intel_dp->edp_dpcd[0] < DP_EDP_14) {
+        if (intel_dp_is_edp(intel_dp)) {
                 /*
                  * Use the maximum clock and number of lanes the eDP panel
-                 * advertizes being capable of. The eDP 1.3 and earlier panels
-                 * are generally designed to support only a single clock and
-                 * lane configuration, and typically these values correspond to
-                 * the native resolution of the panel. With eDP 1.4 rate select
-                 * and DSC, this is decreasingly the case, and we need to be
-                 * able to select less than maximum link config.
+                 * advertizes being capable of. The panels are generally
+                 * designed to support only a single clock and lane
+                 * configuration, and typically these values correspond to the
+                 * native resolution of the panel.
                  */
                 limits.min_lane_count = limits.max_lane_count;
                 limits.min_clock = limits.max_clock;
@@ -2053,22 +2015,11 @@ intel_dp_compute_link_config(struct intel_encoder *encoder,
                       intel_dp->common_rates[limits.max_clock],
                       limits.max_bpp, adjusted_mode->crtc_clock);
 
-        if (intel_dp_is_edp(intel_dp))
-                /*
-                 * Optimize for fast and narrow. eDP 1.3 section 3.3 and eDP 1.4
-                 * section A.1: "It is recommended that the minimum number of
-                 * lanes be used, using the minimum link rate allowed for that
-                 * lane configuration."
-                 *
-                 * Note that we use the max clock and lane count for eDP 1.3 and
-                 * earlier, and fast vs. wide is irrelevant.
-                 */
-                ret = intel_dp_compute_link_config_fast(intel_dp, pipe_config,
-                                                        &limits);
-        else
-                /* Optimize for slow and wide. */
-                ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config,
-                                                        &limits);
+        /*
+         * Optimize for slow and wide. This is the place to add alternative
+         * optimization policy.
+         */
+        ret = intel_dp_compute_link_config_wide(intel_dp, pipe_config, &limits);
 
         /* enable compression if the mode doesn't fit available BW */
         DRM_DEBUG_KMS("Force DSC en = %d\n", intel_dp->force_dsc_en);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 15db41394b9e..d5660ac1b0d6 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -270,10 +270,12 @@ struct intel_encoder {
          * be set correctly before calling this function. */
         void (*get_config)(struct intel_encoder *,
                            struct intel_crtc_state *pipe_config);
-        /* Returns a mask of power domains that need to be referenced as part
-         * of the hardware state readout code. */
-        u64 (*get_power_domains)(struct intel_encoder *encoder,
-                                 struct intel_crtc_state *crtc_state);
+        /*
+         * Acquires the power domains needed for an active encoder during
+         * hardware state readout.
+         */
+        void (*get_power_domains)(struct intel_encoder *encoder,
+                                  struct intel_crtc_state *crtc_state);
         /*
          * Called during system suspend after all pending requests for the
          * encoder are flushed (for example for DP AUX transactions) and
diff --git a/drivers/gpu/drm/i915/vlv_dsi.c b/drivers/gpu/drm/i915/vlv_dsi.c
index 6403728fe778..31c93c3ccd00 100644
--- a/drivers/gpu/drm/i915/vlv_dsi.c
+++ b/drivers/gpu/drm/i915/vlv_dsi.c
@@ -256,6 +256,28 @@ static void band_gap_reset(struct drm_i915_private *dev_priv)
         mutex_unlock(&dev_priv->sb_lock);
 }
 
+static int bdw_get_pipemisc_bpp(struct intel_crtc *crtc)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        u32 tmp;
+
+        tmp = I915_READ(PIPEMISC(crtc->pipe));
+
+        switch (tmp & PIPEMISC_DITHER_BPC_MASK) {
+        case PIPEMISC_DITHER_6_BPC:
+                return 18;
+        case PIPEMISC_DITHER_8_BPC:
+                return 24;
+        case PIPEMISC_DITHER_10_BPC:
+                return 30;
+        case PIPEMISC_DITHER_12_BPC:
+                return 36;
+        default:
+                MISSING_CASE(tmp);
+                return 0;
+        }
+}
+
 static int intel_dsi_compute_config(struct intel_encoder *encoder,
                                     struct intel_crtc_state *pipe_config,
                                     struct drm_connector_state *conn_state)
@@ -1071,6 +1093,8 @@ static void bxt_dsi_get_pipe_config(struct intel_encoder *encoder,
         bpp = mipi_dsi_pixel_format_to_bpp(
                         pixel_format_from_register_bits(fmt));
 
+        pipe_config->pipe_bpp = bdw_get_pipemisc_bpp(crtc);
+
         /* Enable Frame time stamo based scanline reporting */
         adjusted_mode->private_flags |=
                         I915_MODE_FLAG_GET_SCANLINE_FROM_TIMESTAMP;
diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
index 22e68a100e7b..5d333138f913 100644
--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
@@ -662,13 +662,11 @@ static unsigned int mt8173_calculate_factor(int clock)
 static unsigned int mt2701_calculate_factor(int clock)
 {
         if (clock <= 64000)
-                return 16;
-        else if (clock <= 128000)
-                return 8;
-        else if (clock <= 256000)
                 return 4;
-        else
+        else if (clock <= 128000)
                 return 2;
+        else
+                return 1;
 }
 
 static const struct mtk_dpi_conf mt8173_conf = {
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index cf59ea9bccfd..57ce4708ef1b 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -15,6 +15,7 @@
 #include <drm/drmP.h>
 #include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
+#include <drm/drm_fb_helper.h>
 #include <drm/drm_gem.h>
 #include <drm/drm_gem_cma_helper.h>
 #include <drm/drm_of.h>
@@ -341,6 +342,8 @@ static struct drm_driver mtk_drm_driver = {
         .gem_prime_get_sg_table = mtk_gem_prime_get_sg_table,
         .gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
         .gem_prime_mmap = mtk_drm_gem_mmap_buf,
+        .gem_prime_vmap = mtk_drm_gem_prime_vmap,
+        .gem_prime_vunmap = mtk_drm_gem_prime_vunmap,
         .fops = &mtk_drm_fops,
 
         .name = DRIVER_NAME,
@@ -376,6 +379,10 @@ static int mtk_drm_bind(struct device *dev)
         if (ret < 0)
                 goto err_deinit;
 
+        ret = drm_fbdev_generic_setup(drm, 32);
+        if (ret)
+                DRM_ERROR("Failed to initialize fbdev: %d\n", ret);
+
         return 0;
 
 err_deinit:
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index 259b7b0de1d2..38483e9ee071 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -241,3 +241,49 @@ err_gem_free:
         kfree(mtk_gem);
         return ERR_PTR(ret);
 }
+
+void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj)
+{
+        struct mtk_drm_gem_obj *mtk_gem = to_mtk_gem_obj(obj);
+        struct sg_table *sgt;
+        struct sg_page_iter iter;
+        unsigned int npages;
+        unsigned int i = 0;
+
+        if (mtk_gem->kvaddr)
+                return mtk_gem->kvaddr;
+
+        sgt = mtk_gem_prime_get_sg_table(obj);
+        if (IS_ERR(sgt))
+                return NULL;
+
+        npages = obj->size >> PAGE_SHIFT;
+        mtk_gem->pages = kcalloc(npages, sizeof(*mtk_gem->pages), GFP_KERNEL);
+        if (!mtk_gem->pages)
+                goto out;
+
+        for_each_sg_page(sgt->sgl, &iter, sgt->orig_nents, 0) {
+                mtk_gem->pages[i++] = sg_page_iter_page(&iter);
+                if (i > npages)
+                        break;
+        }
+        mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP,
+                               pgprot_writecombine(PAGE_KERNEL));
+
+out:
+        kfree((void *)sgt);
+
+        return mtk_gem->kvaddr;
+}
+
+void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
+{
+        struct mtk_drm_gem_obj *mtk_gem = to_mtk_gem_obj(obj);
+
+        if (!mtk_gem->pages)
+                return;
+
+        vunmap(vaddr);
+        mtk_gem->kvaddr = 0;
+        kfree((void *)mtk_gem->pages);
+}
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.h b/drivers/gpu/drm/mediatek/mtk_drm_gem.h
index 534639b43a1c..c047a7ef294f 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.h
@@ -37,6 +37,7 @@ struct mtk_drm_gem_obj {
         dma_addr_t              dma_addr;
         unsigned long           dma_attrs;
         struct sg_table         *sg;
+        struct page             **pages;
 };
 
 #define to_mtk_gem_obj(x)       container_of(x, struct mtk_drm_gem_obj, base)
@@ -52,5 +53,7 @@ int mtk_drm_gem_mmap_buf(struct drm_gem_object *obj,
 struct sg_table *mtk_gem_prime_get_sg_table(struct drm_gem_object *obj);
 struct drm_gem_object *mtk_gem_prime_import_sg_table(struct drm_device *dev,
                         struct dma_buf_attachment *attach, struct sg_table *sg);
+void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj);
+void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 
 #endif
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 915cc84621ae..e04e6c293d39 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1480,7 +1480,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
         if (IS_ERR(regmap))
                 ret = PTR_ERR(regmap);
         if (ret) {
-                ret = PTR_ERR(regmap);
                 dev_err(dev,
                         "Failed to get system configuration registers: %d\n",
                         ret);
@@ -1516,6 +1515,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
         of_node_put(remote);
 
         hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
+        of_node_put(i2c_np);
         if (!hdmi->ddc_adpt) {
                 dev_err(dev, "Failed to get ddc i2c adapter by node\n");
                 return -EINVAL;
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
index 4ef9c57ffd44..5223498502c4 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c
@@ -15,28 +15,6 @@ static const struct phy_ops mtk_hdmi_phy_dev_ops = {
         .owner = THIS_MODULE,
 };
 
-long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
-                             unsigned long *parent_rate)
-{
-        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
-
-        hdmi_phy->pll_rate = rate;
-        if (rate <= 74250000)
-                *parent_rate = rate;
-        else
-                *parent_rate = rate / 2;
-
-        return rate;
-}
-
-unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
-                                       unsigned long parent_rate)
-{
-        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
-
-        return hdmi_phy->pll_rate;
-}
-
 void mtk_hdmi_phy_clear_bits(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
                              u32 bits)
 {
@@ -110,13 +88,11 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy)
                 return NULL;
 }
 
-static void mtk_hdmi_phy_clk_get_ops(struct mtk_hdmi_phy *hdmi_phy,
-                                     const struct clk_ops **ops)
+static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy,
+                                      struct clk_init_data *clk_init)
 {
-        if (hdmi_phy && hdmi_phy->conf && hdmi_phy->conf->hdmi_phy_clk_ops)
-                *ops = hdmi_phy->conf->hdmi_phy_clk_ops;
-        else
-                dev_err(hdmi_phy->dev, "Failed to get clk ops of phy\n");
+        clk_init->flags = hdmi_phy->conf->flags;
+        clk_init->ops = hdmi_phy->conf->hdmi_phy_clk_ops;
 }
 
 static int mtk_hdmi_phy_probe(struct platform_device *pdev)
@@ -129,7 +105,6 @@ static int mtk_hdmi_phy_probe(struct platform_device *pdev)
         struct clk_init_data clk_init = {
                 .num_parents = 1,
                 .parent_names = (const char * const *)&ref_clk_name,
-                .flags = CLK_SET_RATE_PARENT | CLK_SET_RATE_GATE,
         };
 
         struct phy *phy;
@@ -167,7 +142,7 @@ static int mtk_hdmi_phy_probe(struct platform_device *pdev)
         hdmi_phy->dev = dev;
         hdmi_phy->conf =
                 (struct mtk_hdmi_phy_conf *)of_device_get_match_data(dev);
-        mtk_hdmi_phy_clk_get_ops(hdmi_phy, &clk_init.ops);
+        mtk_hdmi_phy_clk_get_data(hdmi_phy, &clk_init);
         hdmi_phy->pll_hw.init = &clk_init;
         hdmi_phy->pll = devm_clk_register(dev, &hdmi_phy->pll_hw);
         if (IS_ERR(hdmi_phy->pll)) {
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
index f39b1fc66612..2d8b3182470d 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.h
@@ -21,6 +21,7 @@ struct mtk_hdmi_phy;
 
 struct mtk_hdmi_phy_conf {
         bool tz_disabled;
+        unsigned long flags;
         const struct clk_ops *hdmi_phy_clk_ops;
         void (*hdmi_phy_enable_tmds)(struct mtk_hdmi_phy *hdmi_phy);
         void (*hdmi_phy_disable_tmds)(struct mtk_hdmi_phy *hdmi_phy);
@@ -48,10 +49,6 @@ void mtk_hdmi_phy_set_bits(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
 void mtk_hdmi_phy_mask(struct mtk_hdmi_phy *hdmi_phy, u32 offset,
                        u32 val, u32 mask);
 struct mtk_hdmi_phy *to_mtk_hdmi_phy(struct clk_hw *hw);
-long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
-                             unsigned long *parent_rate);
-unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
-                                       unsigned long parent_rate);
 
 extern struct platform_driver mtk_hdmi_phy_driver;
 extern struct mtk_hdmi_phy_conf mtk_hdmi_phy_8173_conf;
diff --git a/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
index fcc42dc6ea7f..d3cc4022e988 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt2701_hdmi_phy.c
@@ -79,7 +79,6 @@ static int mtk_hdmi_pll_prepare(struct clk_hw *hw)
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
         usleep_range(80, 100);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
-        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
@@ -94,7 +93,6 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
         usleep_range(80, 100);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
@@ -108,6 +106,12 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         usleep_range(80, 100);
 }
 
+static long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+                                    unsigned long *parent_rate)
+{
+        return rate;
+}
+
 static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                                  unsigned long parent_rate)
 {
@@ -116,13 +120,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 
         if (rate <= 64000000)
                 pos_div = 3;
-        else if (rate <= 12800000)
-                pos_div = 1;
+        else if (rate <= 128000000)
+                pos_div = 2;
         else
                 pos_div = 1;
 
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON6, RG_HTPLL_PREDIV_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON6, RG_HTPLL_POSDIV_MASK);
+        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6, (0x1 << RG_HTPLL_IC),
                           RG_HTPLL_IC_MASK);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6, (0x1 << RG_HTPLL_IR),
@@ -154,6 +159,39 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
         return 0;
 }
 
+static unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
+                                              unsigned long parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+        unsigned long out_rate, val;
+
+        val = (readl(hdmi_phy->regs + HDMI_CON6)
+               & RG_HTPLL_PREDIV_MASK) >> RG_HTPLL_PREDIV;
+        switch (val) {
+        case 0x00:
+                out_rate = parent_rate;
+                break;
+        case 0x01:
+                out_rate = parent_rate / 2;
+                break;
+        default:
+                out_rate = parent_rate / 4;
+                break;
+        }
+
+        val = (readl(hdmi_phy->regs + HDMI_CON6)
+               & RG_HTPLL_FBKDIV_MASK) >> RG_HTPLL_FBKDIV;
+        out_rate *= (val + 1) * 2;
+        val = (readl(hdmi_phy->regs + HDMI_CON2)
+               & RG_HDMITX_TX_POSDIV_MASK);
+        out_rate >>= (val >> RG_HDMITX_TX_POSDIV);
+
+        if (readl(hdmi_phy->regs + HDMI_CON2) & RG_HDMITX_EN_TX_POSDIV)
+                out_rate /= 5;
+
+        return out_rate;
+}
+
 static const struct clk_ops mtk_hdmi_phy_pll_ops = {
         .prepare = mtk_hdmi_pll_prepare,
         .unprepare = mtk_hdmi_pll_unprepare,
@@ -174,7 +212,6 @@ static void mtk_hdmi_phy_enable_tmds(struct mtk_hdmi_phy *hdmi_phy)
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
         usleep_range(80, 100);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
-        mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
@@ -186,7 +223,6 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_DRV_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_PRED_MASK);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SER_MASK);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_EN_TX_POSDIV);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON2, RG_HDMITX_MBIAS_LPF_EN);
         usleep_range(80, 100);
         mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON0, RG_HDMITX_EN_SLDO_MASK);
@@ -202,6 +238,7 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
 
 struct mtk_hdmi_phy_conf mtk_hdmi_phy_2701_conf = {
         .tz_disabled = true,
+        .flags = CLK_SET_RATE_GATE,
         .hdmi_phy_clk_ops = &mtk_hdmi_phy_pll_ops,
         .hdmi_phy_enable_tmds = mtk_hdmi_phy_enable_tmds,
         .hdmi_phy_disable_tmds = mtk_hdmi_phy_disable_tmds,
diff --git a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
index ed5916b27658..47f8a2951682 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
@@ -199,6 +199,20 @@ static void mtk_hdmi_pll_unprepare(struct clk_hw *hw)
         usleep_range(100, 150);
 }
 
+static long mtk_hdmi_pll_round_rate(struct clk_hw *hw, unsigned long rate,
+                                    unsigned long *parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+
+        hdmi_phy->pll_rate = rate;
+        if (rate <= 74250000)
+                *parent_rate = rate;
+        else
+                *parent_rate = rate / 2;
+
+        return rate;
+}
+
 static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                                  unsigned long parent_rate)
 {
@@ -285,6 +299,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
         return 0;
 }
 
+static unsigned long mtk_hdmi_pll_recalc_rate(struct clk_hw *hw,
+                                              unsigned long parent_rate)
+{
+        struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
+
+        return hdmi_phy->pll_rate;
+}
+
 static const struct clk_ops mtk_hdmi_phy_pll_ops = {
         .prepare = mtk_hdmi_pll_prepare,
         .unprepare = mtk_hdmi_pll_unprepare,
@@ -309,6 +331,7 @@ static void mtk_hdmi_phy_disable_tmds(struct mtk_hdmi_phy *hdmi_phy)
 }
 
 struct mtk_hdmi_phy_conf mtk_hdmi_phy_8173_conf = {
+        .flags = CLK_SET_RATE_PARENT | CLK_SET_RATE_GATE,
         .hdmi_phy_clk_ops = &mtk_hdmi_phy_pll_ops,
         .hdmi_phy_enable_tmds = mtk_hdmi_phy_enable_tmds,
         .hdmi_phy_disable_tmds = mtk_hdmi_phy_disable_tmds,
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
index 340383150fb9..ebf9c96d43ee 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
@@ -175,6 +175,7 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
                 REG_FLD_MOD(core->base, HDMI_CORE_SYS_INTR_UNMASK4, 0, 3, 3);
                 hdmi_wp_clear_irqenable(core->wp, HDMI_IRQ_CORE);
                 hdmi_wp_set_irqstatus(core->wp, HDMI_IRQ_CORE);
+                REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
                 hdmi4_core_disable(core);
                 return 0;
         }
@@ -182,16 +183,24 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
         if (err)
                 return err;
 
+        /*
+         * Initialize CEC clock divider: CEC needs 2MHz clock hence
+         * set the divider to 24 to get 48/24=2MHz clock
+         */
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
+
         /* Clear TX FIFO */
         if (!hdmi_cec_clear_tx_fifo(adap)) {
                 pr_err("cec-%s: could not clear TX FIFO\n", adap->name);
-                return -EIO;
+                err = -EIO;
+                goto err_disable_clk;
         }
 
         /* Clear RX FIFO */
         if (!hdmi_cec_clear_rx_fifo(adap)) {
                 pr_err("cec-%s: could not clear RX FIFO\n", adap->name);
-                return -EIO;
+                err = -EIO;
+                goto err_disable_clk;
         }
 
         /* Clear CEC interrupts */
@@ -236,6 +245,12 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
                 hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, temp);
         }
         return 0;
+
+err_disable_clk:
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+        hdmi4_core_disable(core);
+
+        return err;
 }
 
 static int hdmi_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr)
@@ -333,11 +348,8 @@ int hdmi4_cec_init(struct platform_device *pdev, struct hdmi_core_data *core,
                 return ret;
         core->wp = wp;
 
-        /*
-         * Initialize CEC clock divider: CEC needs 2MHz clock hence
-         * set the devider to 24 to get 48/24=2MHz clock
-         */
-        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
+        /* Disable clock initially, hdmi_cec_adap_enable() manages it */
+        REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
 
         ret = cec_register_adapter(core->adap, &pdev->dev);
         if (ret < 0) {
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
index 813ba42f2753..e384b95ad857 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c
@@ -708,7 +708,7 @@ int hdmi4_audio_config(struct hdmi_core_data *core, struct hdmi_wp_data *wp,
         else
                 acore.i2s_cfg.justification = HDMI_AUDIO_JUSTIFY_RIGHT;
         /*
-         * The I2S input word length is twice the lenght given in the IEC-60958
+         * The I2S input word length is twice the length given in the IEC-60958
          * status word. If the word size is greater than
          * 20 bits, increment by one.
          */
diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
index dc47720c99ba..39d8509d96a0 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
@@ -48,8 +48,13 @@ static enum drm_mode_status
 sun8i_dw_hdmi_mode_valid_h6(struct drm_connector *connector,
                             const struct drm_display_mode *mode)
 {
-        /* This is max for HDMI 2.0b (4K@60Hz) */
-        if (mode->clock > 594000)
+        /*
+         * Controller support maximum of 594 MHz, which correlates to
+         * 4K@60Hz 4:4:4 or RGB. However, for frequencies greater than
+         * 340 MHz scrambling has to be enabled. Because scrambling is
+         * not yet implemented, just limit to 340 MHz for now.
+         */
+        if (mode->clock > 340000)
                 return MODE_CLOCK_HIGH;
 
         return MODE_OK;
diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
index fc36e0c10a37..b1e7c76e9c17 100644
--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
@@ -227,7 +227,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
 
 err_unregister_gates:
         for (i = 0; i < CLK_NUM; i++)
-                if (clk_data->hws[i])
+                if (!IS_ERR_OR_NULL(clk_data->hws[i]))
                         clk_hw_unregister_gate(clk_data->hws[i]);
         clk_disable_unprepare(tcon_top->bus);
 err_assert_reset:
@@ -245,7 +245,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
 
         of_clk_del_provider(dev->of_node);
         for (i = 0; i < CLK_NUM; i++)
-                clk_hw_unregister_gate(clk_data->hws[i]);
+                if (clk_data->hws[i])
+                        clk_hw_unregister_gate(clk_data->hws[i]);
 
         clk_disable_unprepare(tcon_top->bus);
         reset_control_assert(tcon_top->rst);
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 22cd2d13e272..ff47f890e6ad 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -52,6 +52,7 @@ static struct drm_driver driver = {
         .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
         .load = udl_driver_load,
         .unload = udl_driver_unload,
+        .release = udl_driver_release,
 
         /* gem hooks */
         .gem_free_object_unlocked = udl_gem_free_object,
diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
index e9e9b1ff678e..4ae67d882eae 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
@@ -104,6 +104,7 @@ void udl_urb_completion(struct urb *urb);
 
 int udl_driver_load(struct drm_device *dev, unsigned long flags);
 void udl_driver_unload(struct drm_device *dev);
+void udl_driver_release(struct drm_device *dev);
 
 int udl_fbdev_init(struct drm_device *dev);
 void udl_fbdev_cleanup(struct drm_device *dev);
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 9086d0d1b880..1f8ef34ade24 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -379,6 +379,12 @@ void udl_driver_unload(struct drm_device *dev)
                 udl_free_urb_list(dev);
 
         udl_fbdev_cleanup(dev);
-        udl_modeset_cleanup(dev);
         kfree(udl);
 }
+
+void udl_driver_release(struct drm_device *dev)
+{
+        udl_modeset_cleanup(dev);
+        drm_dev_fini(dev);
+        kfree(dev);
+}
diff --git a/drivers/gpu/host1x/hw/channel_hw.c b/drivers/gpu/host1x/hw/channel_hw.c
index 27101c04a827..4030d64916f0 100644
--- a/drivers/gpu/host1x/hw/channel_hw.c
+++ b/drivers/gpu/host1x/hw/channel_hw.c
@@ -114,7 +114,7 @@ static inline void synchronize_syncpt_base(struct host1x_job *job)
 
 static void host1x_channel_set_streamid(struct host1x_channel *channel)
 {
-#if HOST1X_HW >= 6
+#if IS_ENABLED(CONFIG_IOMMU_API) &&  HOST1X_HW >= 6
         struct iommu_fwspec *spec = dev_iommu_fwspec_get(channel->dev->parent);
         u32 sid = spec ? spec->ids[0] & 0xffff : 0x7f;
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 612f04190ed8..9784c6c0d2ec 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -13232,7 +13232,7 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
         int total_contexts;
         int ret;
         unsigned ngroups;
-        int qos_rmt_count;
+        int rmt_count;
         int user_rmt_reduced;
         u32 n_usr_ctxts;
         u32 send_contexts = chip_send_contexts(dd);
@@ -13294,10 +13294,20 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
                 n_usr_ctxts = rcv_contexts - total_contexts;
         }
 
-        /* each user context requires an entry in the RMT */
-        qos_rmt_count = qos_rmt_entries(dd, NULL, NULL);
-        if (qos_rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
-                user_rmt_reduced = NUM_MAP_ENTRIES - qos_rmt_count;
+        /*
+         * The RMT entries are currently allocated as shown below:
+         * 1. QOS (0 to 128 entries);
+         * 2. FECN for PSM (num_user_contexts + num_vnic_contexts);
+         * 3. VNIC (num_vnic_contexts).
+         * It should be noted that PSM FECN oversubscribe num_vnic_contexts
+         * entries of RMT because both VNIC and PSM could allocate any receive
+         * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
+         * and PSM FECN must reserve an RMT entry for each possible PSM receive
+         * context.
+         */
+        rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_vnic_contexts * 2);
+        if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
+                user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
                 dd_dev_err(dd,
                            "RMT size is reducing the number of user receive contexts from %u to %d\n",
                            n_usr_ctxts,
@@ -14285,9 +14295,11 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
         u64 reg;
         int i, idx, regoff, regidx;
         u8 offset;
+        u32 total_cnt;
 
         /* there needs to be enough room in the map table */
-        if (rmt->used + dd->num_user_contexts >= NUM_MAP_ENTRIES) {
+        total_cnt = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
+        if (rmt->used + total_cnt >= NUM_MAP_ENTRIES) {
                 dd_dev_err(dd, "User FECN handling disabled - too many user contexts allocated\n");
                 return;
         }
@@ -14341,7 +14353,7 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
         /* add rule 1 */
         add_rsm_rule(dd, RSM_INS_FECN, &rrd);
 
-        rmt->used += dd->num_user_contexts;
+        rmt->used += total_cnt;
 }
 
 /* Initialize RSM for VNIC */
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index 9b643c2409cf..eba300330a02 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -898,7 +898,9 @@ void notify_error_qp(struct rvt_qp *qp)
                 if (!list_empty(&priv->s_iowait.list) &&
                     !(qp->s_flags & RVT_S_BUSY) &&
                     !(priv->s_flags & RVT_S_BUSY)) {
-                        qp->s_flags &= ~RVT_S_ANY_WAIT_IO;
+                        qp->s_flags &= ~HFI1_S_ANY_WAIT_IO;
+                        iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_IB);
+                        iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_TID);
                         list_del_init(&priv->s_iowait.list);
                         priv->s_iowait.lock = NULL;
                         rvt_put_qp(qp);
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index e6726c1ab866..5991211d72bd 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -3088,7 +3088,7 @@ send_last:
                         update_ack_queue(qp, next);
                 }
                 e = &qp->s_ack_queue[qp->r_head_ack_queue];
-                if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
+                if (e->rdma_sge.mr) {
                         rvt_put_mr(e->rdma_sge.mr);
                         e->rdma_sge.mr = NULL;
                 }
@@ -3166,7 +3166,7 @@ send_last:
                         update_ack_queue(qp, next);
                 }
                 e = &qp->s_ack_queue[qp->r_head_ack_queue];
-                if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
+                if (e->rdma_sge.mr) {
                         rvt_put_mr(e->rdma_sge.mr);
                         e->rdma_sge.mr = NULL;
                 }
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
index fdda33aca77f..43cbce7a19ea 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -5017,24 +5017,14 @@ int hfi1_make_tid_rdma_pkt(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
             make_tid_rdma_ack(qp, ohdr, ps))
                 return 1;
 
-        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) {
-                if (!(ib_rvt_state_ops[qp->state] & RVT_FLUSH_SEND))
-                        goto bail;
-                /* We are in the error state, flush the work request. */
-                if (qp->s_last == READ_ONCE(qp->s_head))
-                        goto bail;
-                /* If DMAs are in progress, we can't flush immediately. */
-                if (iowait_sdma_pending(&priv->s_iowait)) {
-                        qp->s_flags |= RVT_S_WAIT_DMA;
-                        goto bail;
-                }
-                clear_ahg(qp);
-                wqe = rvt_get_swqe_ptr(qp, qp->s_last);
-                hfi1_trdma_send_complete(qp, wqe, qp->s_last != qp->s_acked ?
-                                         IB_WC_SUCCESS : IB_WC_WR_FLUSH_ERR);
-                /* will get called again */
-                goto done_free_tx;
-        }
+        /*
+         * Bail out if we can't send data.
+         * Be reminded that this check must been done after the call to
+         * make_tid_rdma_ack() because the responding QP could be in
+         * RTR state where it can send TID RDMA ACK, not TID RDMA WRITE DATA.
+         */
+        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK))
+                goto bail;
 
         if (priv->s_flags & RVT_S_WAIT_ACK)
                 goto bail;
@@ -5144,11 +5134,6 @@ int hfi1_make_tid_rdma_pkt(struct rvt_qp *qp, struct hfi1_pkt_state *ps)
         hfi1_make_ruc_header(qp, ohdr, (opcode << 24), bth1, bth2,
                              middle, ps);
         return 1;
-done_free_tx:
-        hfi1_put_txreq(ps->s_txreq);
-        ps->s_txreq = NULL;
-        return 1;
-
 bail:
         hfi1_put_txreq(ps->s_txreq);
 bail_no_tx:
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index f1fec56f3ff4..8e29dbb5b5fb 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -792,6 +792,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
                 idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk;
                 dma_offset = offset = idx_offset * table->obj_size;
         } else {
+                u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */
+
                 hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop);
                 /* mtt mhop */
                 i = mhop.l0_idx;
@@ -803,8 +805,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
                         hem_idx = i;
 
                 hem = table->hem[hem_idx];
-                dma_offset = offset = (obj & (table->num_obj - 1)) *
-                                       table->obj_size % mhop.bt_chunk_size;
+                dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size %
+                                       mhop.bt_chunk_size;
                 if (mhop.hop_num == 2)
                         dma_offset = offset = 0;
         }
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index b09f1cde2ff5..08be0e4eabcd 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -746,7 +746,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
         struct hns_roce_hem_table *table;
         dma_addr_t dma_handle;
         __le64 *mtts;
-        u32 s = start_index * sizeof(u64);
         u32 bt_page_size;
         u32 i;
 
@@ -780,7 +779,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
                 return -EINVAL;
 
         mtts = hns_roce_table_find(hr_dev, table,
-                                mtt->first_seg + s / hr_dev->caps.mtt_entry_sz,
+                                mtt->first_seg +
+                                start_index / HNS_ROCE_MTT_ENTRY_PER_SEG,
                                 &dma_handle);
         if (!mtts)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 57c76eafef2f..66cdf625534f 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -274,9 +274,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
         wait_for_completion(&hr_qp->free);
 
         if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) {
-                if (hr_dev->caps.sccc_entry_sz)
-                        hns_roce_table_put(hr_dev, &qp_table->sccc_table,
-                                           hr_qp->qpn);
                 if (hr_dev->caps.trrl_entry_sz)
                         hns_roce_table_put(hr_dev, &qp_table->trrl_table,
                                            hr_qp->qpn);
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index c20bfc41ecf1..0aa10ebda5d9 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -585,7 +585,7 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
         struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem);
         bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
         bool prefetch = flags & MLX5_PF_FLAGS_PREFETCH;
-        u64 access_mask = ODP_READ_ALLOWED_BIT;
+        u64 access_mask;
         u64 start_idx, page_mask;
         struct ib_umem_odp *odp;
         size_t size;
@@ -607,6 +607,7 @@ next_mr:
         page_shift = mr->umem->page_shift;
         page_mask = ~(BIT(page_shift) - 1);
         start_idx = (io_virt - (mr->mmkey.iova & page_mask)) >> page_shift;
+        access_mask = ODP_READ_ALLOWED_BIT;
 
         if (prefetch && !downgrade && !mr->umem->writable) {
                 /* prefetch with write-access must
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 6d8b3e0de57a..ec41400fec0c 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -1131,6 +1131,8 @@ static void pvrdma_pci_remove(struct pci_dev *pdev)
         pvrdma_page_dir_cleanup(dev, &dev->cq_pdir);
         pvrdma_page_dir_cleanup(dev, &dev->async_pdir);
         pvrdma_free_slots(dev);
+        dma_free_coherent(&pdev->dev, sizeof(*dev->dsr), dev->dsr,
+                          dev->dsrbase);
 
         iounmap(dev->regs);
         kfree(dev->sgid_tbl);
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 1b1378619fc9..ff40ba758cf3 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -359,7 +359,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val)
 static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 {
         u64 start = iommu->exclusion_start & PAGE_MASK;
-        u64 limit = (start + iommu->exclusion_length) & PAGE_MASK;
+        u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK;
         u64 entry;
 
         if (!iommu->exclusion_start)
diff --git a/drivers/irqchip/irq-ls1x.c b/drivers/irqchip/irq-ls1x.c
index 86b72fbd3b45..353111a10413 100644
--- a/drivers/irqchip/irq-ls1x.c
+++ b/drivers/irqchip/irq-ls1x.c
@@ -130,6 +130,7 @@ static int __init ls1x_intc_of_init(struct device_node *node,
                                              NULL);
         if (!priv->domain) {
                 pr_err("ls1x-irq: cannot add IRQ domain\n");
+                err = -ENOMEM;
                 goto out_iounmap;
         }
 
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 4ab8b1b6608f..a14e35d40538 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -710,10 +710,10 @@ base_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         struct sock *sk = sock->sk;
         int err = 0;
 
-        if (!maddr || maddr->family != AF_ISDN)
+        if (addr_len < sizeof(struct sockaddr_mISDN))
                 return -EINVAL;
 
-        if (addr_len < sizeof(struct sockaddr_mISDN))
+        if (!maddr || maddr->family != AF_ISDN)
                 return -EINVAL;
 
         lock_sock(sk);
diff --git a/drivers/lightnvm/pblk-read.c b/drivers/lightnvm/pblk-read.c
index 3789185144da..0b7d5fb4548d 100644
--- a/drivers/lightnvm/pblk-read.c
+++ b/drivers/lightnvm/pblk-read.c
@@ -231,14 +231,14 @@ static void pblk_end_partial_read(struct nvm_rq *rqd)
         struct pblk_sec_meta *meta;
         struct bio *new_bio = rqd->bio;
         struct bio *bio = pr_ctx->orig_bio;
-        struct bio_vec src_bv, dst_bv;
         void *meta_list = rqd->meta_list;
-        int bio_init_idx = pr_ctx->bio_init_idx;
         unsigned long *read_bitmap = pr_ctx->bitmap;
+        struct bvec_iter orig_iter = BVEC_ITER_ALL_INIT;
+        struct bvec_iter new_iter = BVEC_ITER_ALL_INIT;
         int nr_secs = pr_ctx->orig_nr_secs;
         int nr_holes = nr_secs - bitmap_weight(read_bitmap, nr_secs);
         void *src_p, *dst_p;
-        int hole, i;
+        int bit, i;
 
         if (unlikely(nr_holes == 1)) {
                 struct ppa_addr ppa;
@@ -257,33 +257,39 @@ static void pblk_end_partial_read(struct nvm_rq *rqd)
 
         /* Fill the holes in the original bio */
         i = 0;
-        hole = find_first_zero_bit(read_bitmap, nr_secs);
-        do {
-                struct pblk_line *line;
+        for (bit = 0; bit < nr_secs; bit++) {
+                if (!test_bit(bit, read_bitmap)) {
+                        struct bio_vec dst_bv, src_bv;
+                        struct pblk_line *line;
 
-                line = pblk_ppa_to_line(pblk, rqd->ppa_list[i]);
-                kref_put(&line->ref, pblk_line_put);
+                        line = pblk_ppa_to_line(pblk, rqd->ppa_list[i]);
+                        kref_put(&line->ref, pblk_line_put);
 
-                meta = pblk_get_meta(pblk, meta_list, hole);
-                meta->lba = cpu_to_le64(pr_ctx->lba_list_media[i]);
+                        meta = pblk_get_meta(pblk, meta_list, bit);
+                        meta->lba = cpu_to_le64(pr_ctx->lba_list_media[i]);
 
-                src_bv = new_bio->bi_io_vec[i++];
-                dst_bv = bio->bi_io_vec[bio_init_idx + hole];
+                        dst_bv = bio_iter_iovec(bio, orig_iter);
+                        src_bv = bio_iter_iovec(new_bio, new_iter);
 
-                src_p = kmap_atomic(src_bv.bv_page);
-                dst_p = kmap_atomic(dst_bv.bv_page);
+                        src_p = kmap_atomic(src_bv.bv_page);
+                        dst_p = kmap_atomic(dst_bv.bv_page);
 
-                memcpy(dst_p + dst_bv.bv_offset,
-                        src_p + src_bv.bv_offset,
-                        PBLK_EXPOSED_PAGE_SIZE);
+                        memcpy(dst_p + dst_bv.bv_offset,
+                                src_p + src_bv.bv_offset,
+                                PBLK_EXPOSED_PAGE_SIZE);
 
-                kunmap_atomic(src_p);
-                kunmap_atomic(dst_p);
+                        kunmap_atomic(src_p);
+                        kunmap_atomic(dst_p);
 
-                mempool_free(src_bv.bv_page, &pblk->page_bio_pool);
+                        flush_dcache_page(dst_bv.bv_page);
+                        mempool_free(src_bv.bv_page, &pblk->page_bio_pool);
 
-                hole = find_next_zero_bit(read_bitmap, nr_secs, hole + 1);
-        } while (hole < nr_secs);
+                        bio_advance_iter(new_bio, &new_iter,
+                                        PBLK_EXPOSED_PAGE_SIZE);
+                        i++;
+                }
+                bio_advance_iter(bio, &orig_iter, PBLK_EXPOSED_PAGE_SIZE);
+        }
 
         bio_put(new_bio);
         kfree(pr_ctx);
diff --git a/drivers/mmc/host/alcor.c b/drivers/mmc/host/alcor.c
index 82a97866e0cf..7c8f203f9a24 100644
--- a/drivers/mmc/host/alcor.c
+++ b/drivers/mmc/host/alcor.c
@@ -48,7 +48,6 @@ struct alcor_sdmmc_host {
         struct mmc_command *cmd;
         struct mmc_data *data;
         unsigned int dma_on:1;
-        unsigned int early_data:1;
 
         struct mutex cmd_mutex;
 
@@ -144,8 +143,7 @@ static void alcor_data_set_dma(struct alcor_sdmmc_host *host)
         host->sg_count--;
 }
 
-static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host,
-                                        bool early)
+static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host)
 {
         struct alcor_pci_priv *priv = host->alcor_pci;
         struct mmc_data *data = host->data;
@@ -155,13 +153,6 @@ static void alcor_trigger_data_transfer(struct alcor_sdmmc_host *host,
                 ctrl |= AU6601_DATA_WRITE;
 
         if (data->host_cookie == COOKIE_MAPPED) {
-                if (host->early_data) {
-                        host->early_data = false;
-                        return;
-                }
-
-                host->early_data = early;
-
                 alcor_data_set_dma(host);
                 ctrl |= AU6601_DATA_DMA_MODE;
                 host->dma_on = 1;
@@ -231,6 +222,7 @@ static void alcor_prepare_sg_miter(struct alcor_sdmmc_host *host)
 static void alcor_prepare_data(struct alcor_sdmmc_host *host,
                                struct mmc_command *cmd)
 {
+        struct alcor_pci_priv *priv = host->alcor_pci;
         struct mmc_data *data = cmd->data;
 
         if (!data)
@@ -248,7 +240,7 @@ static void alcor_prepare_data(struct alcor_sdmmc_host *host,
         if (data->host_cookie != COOKIE_MAPPED)
                 alcor_prepare_sg_miter(host);
 
-        alcor_trigger_data_transfer(host, true);
+        alcor_write8(priv, 0, AU6601_DATA_XFER_CTRL);
 }
 
 static void alcor_send_cmd(struct alcor_sdmmc_host *host,
@@ -435,7 +427,7 @@ static int alcor_cmd_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
         if (!host->data)
                 return false;
 
-        alcor_trigger_data_transfer(host, false);
+        alcor_trigger_data_transfer(host);
         host->cmd = NULL;
         return true;
 }
@@ -456,7 +448,7 @@ static void alcor_cmd_irq_thread(struct alcor_sdmmc_host *host, u32 intmask)
         if (!host->data)
                 alcor_request_complete(host, 1);
         else
-                alcor_trigger_data_transfer(host, false);
+                alcor_trigger_data_transfer(host);
         host->cmd = NULL;
 }
 
@@ -487,15 +479,9 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
                 break;
         case AU6601_INT_READ_BUF_RDY:
                 alcor_trf_block_pio(host, true);
-                if (!host->blocks)
-                        break;
-                alcor_trigger_data_transfer(host, false);
                 return 1;
         case AU6601_INT_WRITE_BUF_RDY:
                 alcor_trf_block_pio(host, false);
-                if (!host->blocks)
-                        break;
-                alcor_trigger_data_transfer(host, false);
                 return 1;
         case AU6601_INT_DMA_END:
                 if (!host->sg_count)
@@ -508,8 +494,14 @@ static int alcor_data_irq_done(struct alcor_sdmmc_host *host, u32 intmask)
                 break;
         }
 
-        if (intmask & AU6601_INT_DATA_END)
-                return 0;
+        if (intmask & AU6601_INT_DATA_END) {
+                if (!host->dma_on && host->blocks) {
+                        alcor_trigger_data_transfer(host);
+                        return 1;
+                } else {
+                        return 0;
+                }
+        }
 
         return 1;
 }
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 5bbed477c9b1..9f20fff9781b 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -797,6 +797,43 @@ void sdhci_omap_reset(struct sdhci_host *host, u8 mask)
         sdhci_reset(host, mask);
 }
 
+#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\
+                      SDHCI_INT_TIMEOUT)
+#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE)
+
+static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask)
+{
+        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
+
+        if (omap_host->is_tuning && host->cmd && !host->data_early &&
+            (intmask & CMD_ERR_MASK)) {
+
+                /*
+                 * Since we are not resetting data lines during tuning
+                 * operation, data error or data complete interrupts
+                 * might still arrive. Mark this request as a failure
+                 * but still wait for the data interrupt
+                 */
+                if (intmask & SDHCI_INT_TIMEOUT)
+                        host->cmd->error = -ETIMEDOUT;
+                else
+                        host->cmd->error = -EILSEQ;
+
+                host->cmd = NULL;
+
+                /*
+                 * Sometimes command error interrupts and command complete
+                 * interrupt will arrive together. Clear all command related
+                 * interrupts here.
+                 */
+                sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS);
+                intmask &= ~CMD_MASK;
+        }
+
+        return intmask;
+}
+
 static struct sdhci_ops sdhci_omap_ops = {
         .set_clock = sdhci_omap_set_clock,
         .set_power = sdhci_omap_set_power,
@@ -807,6 +844,7 @@ static struct sdhci_ops sdhci_omap_ops = {
         .platform_send_init_74_clocks = sdhci_omap_init_74_clocks,
         .reset = sdhci_omap_reset,
         .set_uhs_signaling = sdhci_omap_set_uhs_signaling,
+        .irq = sdhci_omap_irq,
 };
 
 static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 8ddbada9e281..062fa7e3af4c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3213,8 +3213,12 @@ static int bond_netdev_event(struct notifier_block *this,
                 return NOTIFY_DONE;
 
         if (event_dev->flags & IFF_MASTER) {
+                int ret;
+
                 netdev_dbg(event_dev, "IFF_MASTER\n");
-                return bond_master_netdev_event(event, event_dev);
+                ret = bond_master_netdev_event(event, event_dev);
+                if (ret != NOTIFY_DONE)
+                        return ret;
         }
 
         if (event_dev->flags & IFF_SLAVE) {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index a9bdc21873d3..10ff37d6dc78 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -957,7 +957,7 @@ int bnx2x_vfpf_update_vlan(struct bnx2x *bp, u16 vid, u8 vf_qid, bool add)
         bnx2x_sample_bulletin(bp);
 
         if (bp->shadow_bulletin.content.valid_bitmap & 1 << VLAN_VALID) {
-                BNX2X_ERR("Hypervisor will dicline the request, avoiding\n");
+                BNX2X_ERR("Hypervisor will decline the request, avoiding\n");
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 28eac9056211..c032bef1b776 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -32,6 +32,13 @@
 #define DRV_NAME        "nicvf"
 #define DRV_VERSION     "1.0"
 
+/* NOTE: Packets bigger than 1530 are split across multiple pages and XDP needs
+ * the buffer to be contiguous. Allow XDP to be set up only if we don't exceed
+ * this value, keeping headroom for the 14 byte Ethernet header and two
+ * VLAN tags (for QinQ)
+ */
+#define MAX_XDP_MTU     (1530 - ETH_HLEN - VLAN_HLEN * 2)
+
 /* Supported devices */
 static const struct pci_device_id nicvf_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM,
@@ -1582,6 +1589,15 @@ static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
         struct nicvf *nic = netdev_priv(netdev);
         int orig_mtu = netdev->mtu;
 
+        /* For now just support only the usual MTU sized frames,
+         * plus some headroom for VLAN, QinQ.
+         */
+        if (nic->xdp_prog && new_mtu > MAX_XDP_MTU) {
+                netdev_warn(netdev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
+                            netdev->mtu);
+                return -EINVAL;
+        }
+
         netdev->mtu = new_mtu;
 
         if (!netif_running(netdev))
@@ -1830,8 +1846,10 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
         bool bpf_attached = false;
         int ret = 0;
 
-        /* For now just support only the usual MTU sized frames */
-        if (prog && (dev->mtu > 1500)) {
+        /* For now just support only the usual MTU sized frames,
+         * plus some headroom for VLAN, QinQ.
+         */
+        if (prog && dev->mtu > MAX_XDP_MTU) {
                 netdev_warn(dev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
                             dev->mtu);
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 697c2427f2b7..a96ad20ee484 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1840,13 +1840,9 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
         int ret;
 
         if (enable) {
-                ret = clk_prepare_enable(fep->clk_ahb);
-                if (ret)
-                        return ret;
-
                 ret = clk_prepare_enable(fep->clk_enet_out);
                 if (ret)
-                        goto failed_clk_enet_out;
+                        return ret;
 
                 if (fep->clk_ptp) {
                         mutex_lock(&fep->ptp_clk_mutex);
@@ -1866,7 +1862,6 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
 
                 phy_reset_after_clk_enable(ndev->phydev);
         } else {
-                clk_disable_unprepare(fep->clk_ahb);
                 clk_disable_unprepare(fep->clk_enet_out);
                 if (fep->clk_ptp) {
                         mutex_lock(&fep->ptp_clk_mutex);
@@ -1885,8 +1880,6 @@ failed_clk_ref:
 failed_clk_ptp:
         if (fep->clk_enet_out)
                 clk_disable_unprepare(fep->clk_enet_out);
-failed_clk_enet_out:
-                clk_disable_unprepare(fep->clk_ahb);
 
         return ret;
 }
@@ -3470,6 +3463,9 @@ fec_probe(struct platform_device *pdev)
         ret = clk_prepare_enable(fep->clk_ipg);
         if (ret)
                 goto failed_clk_ipg;
+        ret = clk_prepare_enable(fep->clk_ahb);
+        if (ret)
+                goto failed_clk_ahb;
 
         fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
         if (!IS_ERR(fep->reg_phy)) {
@@ -3563,6 +3559,9 @@ failed_reset:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 failed_regulator:
+        clk_disable_unprepare(fep->clk_ahb);
+failed_clk_ahb:
+        clk_disable_unprepare(fep->clk_ipg);
 failed_clk_ipg:
         fec_enet_clk_enable(ndev, false);
 failed_clk:
@@ -3686,6 +3685,7 @@ static int __maybe_unused fec_runtime_suspend(struct device *dev)
         struct net_device *ndev = dev_get_drvdata(dev);
         struct fec_enet_private *fep = netdev_priv(ndev);
 
+        clk_disable_unprepare(fep->clk_ahb);
         clk_disable_unprepare(fep->clk_ipg);
 
         return 0;
@@ -3695,8 +3695,20 @@ static int __maybe_unused fec_runtime_resume(struct device *dev)
 {
         struct net_device *ndev = dev_get_drvdata(dev);
         struct fec_enet_private *fep = netdev_priv(ndev);
+        int ret;
 
-        return clk_prepare_enable(fep->clk_ipg);
+        ret = clk_prepare_enable(fep->clk_ahb);
+        if (ret)
+                return ret;
+        ret = clk_prepare_enable(fep->clk_ipg);
+        if (ret)
+                goto failed_clk_ipg;
+
+        return 0;
+
+failed_clk_ipg:
+        clk_disable_unprepare(fep->clk_ahb);
+        return ret;
 }
 
 static const struct dev_pm_ops fec_pm_ops = {
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 1de691e76b86..5e3cdb0b46d5 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -3758,6 +3758,7 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
 {
         struct device *dev = &adapter->vdev->dev;
         struct ibmvnic_query_ip_offload_buffer *buf = &adapter->ip_offload_buf;
+        netdev_features_t old_hw_features = 0;
         union ibmvnic_crq crq;
         int i;
 
@@ -3833,24 +3834,41 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
         adapter->ip_offload_ctrl.large_rx_ipv4 = 0;
         adapter->ip_offload_ctrl.large_rx_ipv6 = 0;
 
-        adapter->netdev->features = NETIF_F_SG | NETIF_F_GSO;
+        if (adapter->state != VNIC_PROBING) {
+                old_hw_features = adapter->netdev->hw_features;
+                adapter->netdev->hw_features = 0;
+        }
+
+        adapter->netdev->hw_features = NETIF_F_SG | NETIF_F_GSO | NETIF_F_GRO;
 
         if (buf->tcp_ipv4_chksum || buf->udp_ipv4_chksum)
-                adapter->netdev->features |= NETIF_F_IP_CSUM;
+                adapter->netdev->hw_features |= NETIF_F_IP_CSUM;
 
         if (buf->tcp_ipv6_chksum || buf->udp_ipv6_chksum)
-                adapter->netdev->features |= NETIF_F_IPV6_CSUM;
+                adapter->netdev->hw_features |= NETIF_F_IPV6_CSUM;
 
         if ((adapter->netdev->features &
             (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM)))
-                adapter->netdev->features |= NETIF_F_RXCSUM;
+                adapter->netdev->hw_features |= NETIF_F_RXCSUM;
 
         if (buf->large_tx_ipv4)
-                adapter->netdev->features |= NETIF_F_TSO;
+                adapter->netdev->hw_features |= NETIF_F_TSO;
         if (buf->large_tx_ipv6)
-                adapter->netdev->features |= NETIF_F_TSO6;
+                adapter->netdev->hw_features |= NETIF_F_TSO6;
 
-        adapter->netdev->hw_features |= adapter->netdev->features;
+        if (adapter->state == VNIC_PROBING) {
+                adapter->netdev->features |= adapter->netdev->hw_features;
+        } else if (old_hw_features != adapter->netdev->hw_features) {
+                netdev_features_t tmp = 0;
+
+                /* disable features no longer supported */
+                adapter->netdev->features &= adapter->netdev->hw_features;
+                /* turn on features now supported if previously enabled */
+                tmp = (old_hw_features ^ adapter->netdev->hw_features) &
+                        adapter->netdev->hw_features;
+                adapter->netdev->features |=
+                                tmp & adapter->netdev->wanted_features;
+        }
 
         memset(&crq, 0, sizeof(crq));
         crq.control_ip_offload.first = IBMVNIC_CRQ_CMD;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index bd855ab8dfe2..51e109fdeec1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -856,6 +856,7 @@ void mlx5e_close_channels(struct mlx5e_channels *chs);
  * switching channels
  */
 typedef int (*mlx5e_fp_hw_modify)(struct mlx5e_priv *priv);
+int mlx5e_safe_reopen_channels(struct mlx5e_priv *priv);
 int mlx5e_safe_switch_channels(struct mlx5e_priv *priv,
                                struct mlx5e_channels *new_chs,
                                mlx5e_fp_hw_modify hw_modify);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
index 9d38e62cdf24..476dd97f7f2f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -186,12 +186,17 @@ static int mlx5e_tx_reporter_recover_from_ctx(struct mlx5e_tx_err_ctx *err_ctx)
 
 static int mlx5e_tx_reporter_recover_all(struct mlx5e_priv *priv)
 {
-        int err;
+        int err = 0;
 
         rtnl_lock();
         mutex_lock(&priv->state_lock);
-        mlx5e_close_locked(priv->netdev);
-        err = mlx5e_open_locked(priv->netdev);
+
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
+                goto out;
+
+        err = mlx5e_safe_reopen_channels(priv);
+
+out:
         mutex_unlock(&priv->state_lock);
         rtnl_unlock();
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index b9d5830e8344..fe5d4d7f15ed 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -39,6 +39,10 @@ static int get_route_and_out_devs(struct mlx5e_priv *priv,
                         return -EOPNOTSUPP;
         }
 
+        if (!(mlx5e_eswitch_rep(*out_dev) &&
+              mlx5e_is_uplink_rep(netdev_priv(*out_dev))))
+                return -EOPNOTSUPP;
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 5efce4a3ff79..76a3d01a489e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1768,7 +1768,8 @@ static int set_pflag_rx_no_csum_complete(struct net_device *netdev, bool enable)
         struct mlx5e_channel *c;
         int i;
 
-        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state) ||
+            priv->channels.params.xdp_prog)
                 return 0;
 
         for (i = 0; i < channels->num; i++) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index ba705392b46b..5c127fccad60 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -952,7 +952,11 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (params->rx_dim_enabled)
                 __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
+        /* We disable csum_complete when XDP is enabled since
+         * XDP programs might manipulate packets which will render
+         * skb->checksum incorrect.
+         */
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE) || c->xdp)
                 __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
 
         return 0;
@@ -2956,6 +2960,14 @@ int mlx5e_safe_switch_channels(struct mlx5e_priv *priv,
         return 0;
 }
 
+int mlx5e_safe_reopen_channels(struct mlx5e_priv *priv)
+{
+        struct mlx5e_channels new_channels = {};
+
+        new_channels.params = priv->channels.params;
+        return mlx5e_safe_switch_channels(priv, &new_channels, NULL);
+}
+
 void mlx5e_timestamp_init(struct mlx5e_priv *priv)
 {
         priv->tstamp.tx_type   = HWTSTAMP_TX_OFF;
@@ -4186,11 +4198,10 @@ static void mlx5e_tx_timeout_work(struct work_struct *work)
         if (!report_failed)
                 goto unlock;
 
-        mlx5e_close_locked(priv->netdev);
-        err = mlx5e_open_locked(priv->netdev);
+        err = mlx5e_safe_reopen_channels(priv);
         if (err)
                 netdev_err(priv->netdev,
-                           "mlx5e_open_locked failed recovering from a tx_timeout, err(%d).\n",
+                           "mlx5e_safe_reopen_channels failed recovering from a tx_timeout, err(%d).\n",
                            err);
 
 unlock:
@@ -4578,7 +4589,7 @@ void mlx5e_build_rss_params(struct mlx5e_rss_params *rss_params,
 {
         enum mlx5e_traffic_types tt;
 
-        rss_params->hfunc = ETH_RSS_HASH_XOR;
+        rss_params->hfunc = ETH_RSS_HASH_TOP;
         netdev_rss_key_fill(rss_params->toeplitz_hash_key,
                             sizeof(rss_params->toeplitz_hash_key));
         mlx5e_build_default_indir_rqt(rss_params->indirection_rqt,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 3dde5c7e0739..c3b3002ff62f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -692,7 +692,14 @@ static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth,
 {
         *proto = ((struct ethhdr *)skb->data)->h_proto;
         *proto = __vlan_get_protocol(skb, *proto, network_depth);
-        return (*proto == htons(ETH_P_IP) || *proto == htons(ETH_P_IPV6));
+
+        if (*proto == htons(ETH_P_IP))
+                return pskb_may_pull(skb, *network_depth + sizeof(struct iphdr));
+
+        if (*proto == htons(ETH_P_IPV6))
+                return pskb_may_pull(skb, *network_depth + sizeof(struct ipv6hdr));
+
+        return false;
 }
 
 static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
@@ -712,17 +719,6 @@ static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
         rq->stats->ecn_mark += !!rc;
 }
 
-static u32 mlx5e_get_fcs(const struct sk_buff *skb)
-{
-        const void *fcs_bytes;
-        u32 _fcs_bytes;
-
-        fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
-                                       ETH_FCS_LEN, &_fcs_bytes);
-
-        return __get_unaligned_cpu32(fcs_bytes);
-}
-
 static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
 {
         void *ip_p = skb->data + network_depth;
@@ -733,6 +729,68 @@ static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
 
 #define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
 
+#define MAX_PADDING 8
+
+static void
+tail_padding_csum_slow(struct sk_buff *skb, int offset, int len,
+                       struct mlx5e_rq_stats *stats)
+{
+        stats->csum_complete_tail_slow++;
+        skb->csum = csum_block_add(skb->csum,
+                                   skb_checksum(skb, offset, len, 0),
+                                   offset);
+}
+
+static void
+tail_padding_csum(struct sk_buff *skb, int offset,
+                  struct mlx5e_rq_stats *stats)
+{
+        u8 tail_padding[MAX_PADDING];
+        int len = skb->len - offset;
+        void *tail;
+
+        if (unlikely(len > MAX_PADDING)) {
+                tail_padding_csum_slow(skb, offset, len, stats);
+                return;
+        }
+
+        tail = skb_header_pointer(skb, offset, len, tail_padding);
+        if (unlikely(!tail)) {
+                tail_padding_csum_slow(skb, offset, len, stats);
+                return;
+        }
+
+        stats->csum_complete_tail++;
+        skb->csum = csum_block_add(skb->csum, csum_partial(tail, len, 0), offset);
+}
+
+static void
+mlx5e_skb_padding_csum(struct sk_buff *skb, int network_depth, __be16 proto,
+                       struct mlx5e_rq_stats *stats)
+{
+        struct ipv6hdr *ip6;
+        struct iphdr   *ip4;
+        int pkt_len;
+
+        switch (proto) {
+        case htons(ETH_P_IP):
+                ip4 = (struct iphdr *)(skb->data + network_depth);
+                pkt_len = network_depth + ntohs(ip4->tot_len);
+                break;
+        case htons(ETH_P_IPV6):
+                ip6 = (struct ipv6hdr *)(skb->data + network_depth);
+                pkt_len = network_depth + sizeof(*ip6) + ntohs(ip6->payload_len);
+                break;
+        default:
+                return;
+        }
+
+        if (likely(pkt_len >= skb->len))
+                return;
+
+        tail_padding_csum(skb, pkt_len, stats);
+}
+
 static inline void mlx5e_handle_csum(struct net_device *netdev,
                                      struct mlx5_cqe64 *cqe,
                                      struct mlx5e_rq *rq,
@@ -752,7 +810,8 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                 return;
         }
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)))
+        /* True when explicitly set via priv flag, or XDP prog is loaded */
+        if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state))
                 goto csum_unnecessary;
 
         /* CQE csum doesn't cover padding octets in short ethernet
@@ -780,18 +839,15 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum = csum_partial(skb->data + ETH_HLEN,
                                                  network_depth - ETH_HLEN,
                                                  skb->csum);
-                if (unlikely(netdev->features & NETIF_F_RXFCS))
-                        skb->csum = csum_block_add(skb->csum,
-                                                   (__force __wsum)mlx5e_get_fcs(skb),
-                                                   skb->len - ETH_FCS_LEN);
+
+                mlx5e_skb_padding_csum(skb, network_depth, proto, stats);
                 stats->csum_complete++;
                 return;
         }
 
 csum_unnecessary:
         if (likely((cqe->hds_ip_ext & CQE_L3_OK) &&
-                   ((cqe->hds_ip_ext & CQE_L4_OK) ||
-                    (get_cqe_l4_hdr_type(cqe) == CQE_L4_HDR_TYPE_NONE)))) {
+                   (cqe->hds_ip_ext & CQE_L4_OK))) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                 if (cqe_is_tunneled(cqe)) {
                         skb->csum_level = 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 1a78e05cbba8..b75aa8b8bf04 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -59,6 +59,8 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail_slow) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_redirect) },
@@ -151,6 +153,8 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                 s->rx_removed_vlan_packets += rq_stats->removed_vlan_packets;
                 s->rx_csum_none += rq_stats->csum_none;
                 s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_complete_tail += rq_stats->csum_complete_tail;
+                s->rx_csum_complete_tail_slow += rq_stats->csum_complete_tail_slow;
                 s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                 s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_xdp_drop     += rq_stats->xdp_drop;
@@ -1190,6 +1194,8 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail_slow) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 4640d4f986f8..16c3b785f282 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -71,6 +71,8 @@ struct mlx5e_sw_stats {
         u64 rx_csum_unnecessary;
         u64 rx_csum_none;
         u64 rx_csum_complete;
+        u64 rx_csum_complete_tail;
+        u64 rx_csum_complete_tail_slow;
         u64 rx_csum_unnecessary_inner;
         u64 rx_xdp_drop;
         u64 rx_xdp_redirect;
@@ -181,6 +183,8 @@ struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
         u64 csum_complete;
+        u64 csum_complete_tail;
+        u64 csum_complete_tail_slow;
         u64 csum_unnecessary;
         u64 csum_unnecessary_inner;
         u64 csum_none;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
index 8de64e88c670..22a2ef111514 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
@@ -148,14 +148,16 @@ static int mlx5_fpga_tls_alloc_swid(struct idr *idr, spinlock_t *idr_spinlock,
         return ret;
 }
 
-static void mlx5_fpga_tls_release_swid(struct idr *idr,
-                                       spinlock_t *idr_spinlock, u32 swid)
+static void *mlx5_fpga_tls_release_swid(struct idr *idr,
+                                        spinlock_t *idr_spinlock, u32 swid)
 {
         unsigned long flags;
+        void *ptr;
 
         spin_lock_irqsave(idr_spinlock, flags);
-        idr_remove(idr, swid);
+        ptr = idr_remove(idr, swid);
         spin_unlock_irqrestore(idr_spinlock, flags);
+        return ptr;
 }
 
 static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
@@ -165,20 +167,12 @@ static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
         kfree(buf);
 }
 
-struct mlx5_teardown_stream_context {
-        struct mlx5_fpga_tls_command_context cmd;
-        u32 swid;
-};
-
 static void
 mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
                                   struct mlx5_fpga_device *fdev,
                                   struct mlx5_fpga_tls_command_context *cmd,
                                   struct mlx5_fpga_dma_buf *resp)
 {
-        struct mlx5_teardown_stream_context *ctx =
-                    container_of(cmd, struct mlx5_teardown_stream_context, cmd);
-
         if (resp) {
                 u32 syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
 
@@ -186,14 +180,6 @@ mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
                         mlx5_fpga_err(fdev,
                                       "Teardown stream failed with syndrome = %d",
                                       syndrome);
-                else if (MLX5_GET(tls_cmd, cmd->buf.sg[0].data, direction_sx))
-                        mlx5_fpga_tls_release_swid(&fdev->tls->tx_idr,
-                                                   &fdev->tls->tx_idr_spinlock,
-                                                   ctx->swid);
-                else
-                        mlx5_fpga_tls_release_swid(&fdev->tls->rx_idr,
-                                                   &fdev->tls->rx_idr_spinlock,
-                                                   ctx->swid);
         }
         mlx5_fpga_tls_put_command_ctx(cmd);
 }
@@ -217,22 +203,22 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
         void *cmd;
         int ret;
 
-        rcu_read_lock();
-        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
-        rcu_read_unlock();
-
-        if (!flow) {
-                WARN_ONCE(1, "Received NULL pointer for handle\n");
-                return -EINVAL;
-        }
-
         buf = kzalloc(size, GFP_ATOMIC);
         if (!buf)
                 return -ENOMEM;
 
         cmd = (buf + 1);
 
+        rcu_read_lock();
+        flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+        if (unlikely(!flow)) {
+                rcu_read_unlock();
+                WARN_ONCE(1, "Received NULL pointer for handle\n");
+                kfree(buf);
+                return -EINVAL;
+        }
         mlx5_fpga_tls_flow_to_cmd(flow, cmd);
+        rcu_read_unlock();
 
         MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
         MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn));
@@ -253,7 +239,7 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
 static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
                                             void *flow, u32 swid, gfp_t flags)
 {
-        struct mlx5_teardown_stream_context *ctx;
+        struct mlx5_fpga_tls_command_context *ctx;
         struct mlx5_fpga_dma_buf *buf;
         void *cmd;
 
@@ -261,7 +247,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
         if (!ctx)
                 return;
 
-        buf = &ctx->cmd.buf;
+        buf = &ctx->buf;
         cmd = (ctx + 1);
         MLX5_SET(tls_cmd, cmd, command_type, CMD_TEARDOWN_STREAM);
         MLX5_SET(tls_cmd, cmd, swid, swid);
@@ -272,8 +258,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
         buf->sg[0].data = cmd;
         buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
 
-        ctx->swid = swid;
-        mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
+        mlx5_fpga_tls_cmd_send(mdev->fpga, ctx,
                                mlx5_fpga_tls_teardown_completion);
 }
 
@@ -283,13 +268,14 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
         struct mlx5_fpga_tls *tls = mdev->fpga->tls;
         void *flow;
 
-        rcu_read_lock();
         if (direction_sx)
-                flow = idr_find(&tls->tx_idr, swid);
+                flow = mlx5_fpga_tls_release_swid(&tls->tx_idr,
+                                                  &tls->tx_idr_spinlock,
+                                                  swid);
         else
-                flow = idr_find(&tls->rx_idr, swid);
-
-        rcu_read_unlock();
+                flow = mlx5_fpga_tls_release_swid(&tls->rx_idr,
+                                                  &tls->rx_idr_spinlock,
+                                                  swid);
 
         if (!flow) {
                 mlx5_fpga_err(mdev->fpga, "No flow information for swid %u\n",
@@ -297,6 +283,7 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
                 return;
         }
 
+        synchronize_rcu(); /* before kfree(flow) */
         mlx5_fpga_tls_send_teardown_cmd(mdev, flow, swid, flags);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index c2fba5c7c9ee..9e8e3e92f369 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -568,7 +568,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
         if (!(mlxsw_core->bus->features & MLXSW_BUS_F_TXRX))
                 return 0;
 
-        emad_wq = alloc_workqueue("mlxsw_core_emad", WQ_MEM_RECLAIM, 0);
+        emad_wq = alloc_workqueue("mlxsw_core_emad", 0, 0);
         if (!emad_wq)
                 return -ENOMEM;
         mlxsw_core->emad_wq = emad_wq;
@@ -2004,10 +2004,10 @@ static int __init mlxsw_core_module_init(void)
 {
         int err;
 
-        mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, WQ_MEM_RECLAIM, 0);
+        mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, 0, 0);
         if (!mlxsw_wq)
                 return -ENOMEM;
-        mlxsw_owq = alloc_ordered_workqueue("%s_ordered", WQ_MEM_RECLAIM,
+        mlxsw_owq = alloc_ordered_workqueue("%s_ordered", 0,
                                             mlxsw_core_driver_name);
         if (!mlxsw_owq) {
                 err = -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 9a79b5e11597..d633bef5f105 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -70,6 +70,7 @@ static const struct mlxsw_sp_sb_pool_des mlxsw_sp2_sb_pool_dess[] = {
         {MLXSW_REG_SBXX_DIR_EGRESS, 1},
         {MLXSW_REG_SBXX_DIR_EGRESS, 2},
         {MLXSW_REG_SBXX_DIR_EGRESS, 3},
+        {MLXSW_REG_SBXX_DIR_EGRESS, 15},
 };
 
 #define MLXSW_SP_SB_ING_TC_COUNT 8
@@ -428,6 +429,7 @@ static const struct mlxsw_sp_sb_pr mlxsw_sp2_sb_prs[] = {
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
         MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, 0),
+        MLXSW_SP_SB_PR(MLXSW_REG_SBPR_MODE_STATIC, MLXSW_SP_SB_INFI),
 };
 
 static int mlxsw_sp_sb_prs_init(struct mlxsw_sp *mlxsw_sp,
@@ -517,14 +519,14 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp2_sb_cms_egress[] = {
         MLXSW_SP_SB_CM(0, 7, 4),
         MLXSW_SP_SB_CM(0, 7, 4),
         MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
-        MLXSW_SP_SB_CM(0, 7, 4),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
+        MLXSW_SP_SB_CM(0, MLXSW_SP_SB_INFI, 8),
         MLXSW_SP_SB_CM(1, 0xff, 4),
 };
 
@@ -671,6 +673,7 @@ static const struct mlxsw_sp_sb_pm mlxsw_sp2_sb_pms[] = {
         MLXSW_SP_SB_PM(0, 0),
         MLXSW_SP_SB_PM(0, 0),
         MLXSW_SP_SB_PM(0, 0),
+        MLXSW_SP_SB_PM(10000, 90000),
 };
 
 static int mlxsw_sp_port_sb_pms_init(struct mlxsw_sp_port *mlxsw_sp_port)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 31656a2a6252..64498c9f55ab 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -6804,7 +6804,7 @@ static int mlxsw_sp_router_port_check_rif_addr(struct mlxsw_sp *mlxsw_sp,
         /* A RIF is not created for macvlan netdevs. Their MAC is used to
          * populate the FDB
          */
-        if (netif_is_macvlan(dev))
+        if (netif_is_macvlan(dev) || netif_is_l3_master(dev))
                 return 0;
 
         for (i = 0; i < MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS); i++) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index f6ce386c3036..50111f228d77 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1630,7 +1630,7 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
         u16 fid_index;
         int err = 0;
 
-        if (switchdev_trans_ph_prepare(trans))
+        if (switchdev_trans_ph_commit(trans))
                 return 0;
 
         bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index a1d0d6e42533..d715ef4fc92f 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -613,7 +613,7 @@ static int ocelot_mact_mc_add(struct ocelot_port *port,
                               struct netdev_hw_addr *hw_addr)
 {
         struct ocelot *ocelot = port->ocelot;
-        struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_KERNEL);
+        struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_ATOMIC);
 
         if (!ha)
                 return -ENOMEM;
@@ -959,10 +959,8 @@ static void ocelot_get_strings(struct net_device *netdev, u32 sset, u8 *data)
                        ETH_GSTRING_LEN);
 }
 
-static void ocelot_check_stats(struct work_struct *work)
+static void ocelot_update_stats(struct ocelot *ocelot)
 {
-        struct delayed_work *del_work = to_delayed_work(work);
-        struct ocelot *ocelot = container_of(del_work, struct ocelot, stats_work);
         int i, j;
 
         mutex_lock(&ocelot->stats_lock);
@@ -986,11 +984,19 @@ static void ocelot_check_stats(struct work_struct *work)
                 }
         }
 
-        cancel_delayed_work(&ocelot->stats_work);
+        mutex_unlock(&ocelot->stats_lock);
+}
+
+static void ocelot_check_stats_work(struct work_struct *work)
+{
+        struct delayed_work *del_work = to_delayed_work(work);
+        struct ocelot *ocelot = container_of(del_work, struct ocelot,
+                                             stats_work);
+
+        ocelot_update_stats(ocelot);
+
         queue_delayed_work(ocelot->stats_queue, &ocelot->stats_work,
                            OCELOT_STATS_CHECK_DELAY);
-
-        mutex_unlock(&ocelot->stats_lock);
 }
 
 static void ocelot_get_ethtool_stats(struct net_device *dev,
@@ -1001,7 +1007,7 @@ static void ocelot_get_ethtool_stats(struct net_device *dev,
         int i;
 
         /* check and update now */
-        ocelot_check_stats(&ocelot->stats_work.work);
+        ocelot_update_stats(ocelot);
 
         /* Copy all counters */
         for (i = 0; i < ocelot->num_stats; i++)
@@ -1809,7 +1815,7 @@ int ocelot_init(struct ocelot *ocelot)
                                  ANA_CPUQ_8021_CFG_CPUQ_BPDU_VAL(6),
                                  ANA_CPUQ_8021_CFG, i);
 
-        INIT_DELAYED_WORK(&ocelot->stats_work, ocelot_check_stats);
+        INIT_DELAYED_WORK(&ocelot->stats_work, ocelot_check_stats_work);
         queue_delayed_work(ocelot->stats_queue, &ocelot->stats_work,
                            OCELOT_STATS_CHECK_DELAY);
         return 0;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
index 7cde387e5ec6..51cd57ab3d95 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
@@ -2366,6 +2366,7 @@ static void *__vxge_hw_blockpool_malloc(struct __vxge_hw_device *devh, u32 size,
                                 dma_object->addr))) {
                         vxge_os_dma_free(devh->pdev, memblock,
                                 &dma_object->acc_handle);
+                        memblock = NULL;
                         goto exit;
                 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 512186adab00..c5e96ce20f59 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -431,12 +431,16 @@ struct qed_qm_info {
         u8 num_pf_rls;
 };
 
+#define QED_OVERFLOW_BIT        1
+
 struct qed_db_recovery_info {
         struct list_head list;
 
         /* Lock to protect the doorbell recovery mechanism list */
         spinlock_t lock;
+        bool dorq_attn;
         u32 db_recovery_counter;
+        unsigned long overflow;
 };
 
 struct storm_stats {
@@ -923,8 +927,7 @@ u16 qed_get_cm_pq_idx_llt_mtc(struct qed_hwfn *p_hwfn, u8 tc);
 
 /* doorbell recovery mechanism */
 void qed_db_recovery_dp(struct qed_hwfn *p_hwfn);
-void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
-                             enum qed_db_rec_exec db_exec);
+void qed_db_recovery_execute(struct qed_hwfn *p_hwfn);
 bool qed_edpm_enabled(struct qed_hwfn *p_hwfn);
 
 /* Other Linux specific common definitions */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 195573793352..fccdb06fc5c5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -102,11 +102,15 @@ static void qed_db_recovery_dp_entry(struct qed_hwfn *p_hwfn,
 
 /* Doorbell address sanity (address within doorbell bar range) */
 static bool qed_db_rec_sanity(struct qed_dev *cdev,
-                              void __iomem *db_addr, void *db_data)
+                              void __iomem *db_addr,
+                              enum qed_db_rec_width db_width,
+                              void *db_data)
 {
+        u32 width = (db_width == DB_REC_WIDTH_32B) ? 32 : 64;
+
         /* Make sure doorbell address is within the doorbell bar */
         if (db_addr < cdev->doorbells ||
-            (u8 __iomem *)db_addr >
+            (u8 __iomem *)db_addr + width >
             (u8 __iomem *)cdev->doorbells + cdev->db_size) {
                 WARN(true,
                      "Illegal doorbell address: %p. Legal range for doorbell addresses is [%p..%p]\n",
@@ -159,7 +163,7 @@ int qed_db_recovery_add(struct qed_dev *cdev,
         }
 
         /* Sanitize doorbell address */
-        if (!qed_db_rec_sanity(cdev, db_addr, db_data))
+        if (!qed_db_rec_sanity(cdev, db_addr, db_width, db_data))
                 return -EINVAL;
 
         /* Obtain hwfn from doorbell address */
@@ -205,10 +209,6 @@ int qed_db_recovery_del(struct qed_dev *cdev,
                 return 0;
         }
 
-        /* Sanitize doorbell address */
-        if (!qed_db_rec_sanity(cdev, db_addr, db_data))
-                return -EINVAL;
-
         /* Obtain hwfn from doorbell address */
         p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr);
 
@@ -300,31 +300,24 @@ void qed_db_recovery_dp(struct qed_hwfn *p_hwfn)
 
 /* Ring the doorbell of a single doorbell recovery entry */
 static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
-                                 struct qed_db_recovery_entry *db_entry,
-                                 enum qed_db_rec_exec db_exec)
-{
-        if (db_exec != DB_REC_ONCE) {
-                /* Print according to width */
-                if (db_entry->db_width == DB_REC_WIDTH_32B) {
-                        DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
-                                   "%s doorbell address %p data %x\n",
-                                   db_exec == DB_REC_DRY_RUN ?
-                                   "would have rung" : "ringing",
-                                   db_entry->db_addr,
-                                   *(u32 *)db_entry->db_data);
-                } else {
-                        DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
-                                   "%s doorbell address %p data %llx\n",
-                                   db_exec == DB_REC_DRY_RUN ?
-                                   "would have rung" : "ringing",
-                                   db_entry->db_addr,
-                                   *(u64 *)(db_entry->db_data));
-                }
+                                 struct qed_db_recovery_entry *db_entry)
+{
+        /* Print according to width */
+        if (db_entry->db_width == DB_REC_WIDTH_32B) {
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "ringing doorbell address %p data %x\n",
+                           db_entry->db_addr,
+                           *(u32 *)db_entry->db_data);
+        } else {
+                DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+                           "ringing doorbell address %p data %llx\n",
+                           db_entry->db_addr,
+                           *(u64 *)(db_entry->db_data));
         }
 
         /* Sanity */
         if (!qed_db_rec_sanity(p_hwfn->cdev, db_entry->db_addr,
-                               db_entry->db_data))
+                               db_entry->db_width, db_entry->db_data))
                 return;
 
         /* Flush the write combined buffer. Since there are multiple doorbelling
@@ -334,14 +327,12 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
         wmb();
 
         /* Ring the doorbell */
-        if (db_exec == DB_REC_REAL_DEAL || db_exec == DB_REC_ONCE) {
-                if (db_entry->db_width == DB_REC_WIDTH_32B)
-                        DIRECT_REG_WR(db_entry->db_addr,
-                                      *(u32 *)(db_entry->db_data));
-                else
-                        DIRECT_REG_WR64(db_entry->db_addr,
-                                        *(u64 *)(db_entry->db_data));
-        }
+        if (db_entry->db_width == DB_REC_WIDTH_32B)
+                DIRECT_REG_WR(db_entry->db_addr,
+                              *(u32 *)(db_entry->db_data));
+        else
+                DIRECT_REG_WR64(db_entry->db_addr,
+                                *(u64 *)(db_entry->db_data));
 
         /* Flush the write combined buffer. Next doorbell may come from a
          * different entity to the same address...
@@ -350,29 +341,21 @@ static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
 }
 
 /* Traverse the doorbell recovery entry list and ring all the doorbells */
-void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
-                             enum qed_db_rec_exec db_exec)
+void qed_db_recovery_execute(struct qed_hwfn *p_hwfn)
 {
         struct qed_db_recovery_entry *db_entry = NULL;
 
-        if (db_exec != DB_REC_ONCE) {
-                DP_NOTICE(p_hwfn,
-                          "Executing doorbell recovery. Counter was %d\n",
-                          p_hwfn->db_recovery_info.db_recovery_counter);
+        DP_NOTICE(p_hwfn, "Executing doorbell recovery. Counter was %d\n",
+                  p_hwfn->db_recovery_info.db_recovery_counter);
 
-                /* Track amount of times recovery was executed */
-                p_hwfn->db_recovery_info.db_recovery_counter++;
-        }
+        /* Track amount of times recovery was executed */
+        p_hwfn->db_recovery_info.db_recovery_counter++;
 
         /* Protect the list */
         spin_lock_bh(&p_hwfn->db_recovery_info.lock);
         list_for_each_entry(db_entry,
-                            &p_hwfn->db_recovery_info.list, list_entry) {
-                qed_db_recovery_ring(p_hwfn, db_entry, db_exec);
-                if (db_exec == DB_REC_ONCE)
-                        break;
-        }
-
+                            &p_hwfn->db_recovery_info.list, list_entry)
+                qed_db_recovery_ring(p_hwfn, db_entry);
         spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
index e23980e301b6..8848d5bed6e5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
@@ -378,6 +378,9 @@ static int qed_db_rec_flush_queue(struct qed_hwfn *p_hwfn,
         u32 count = QED_DB_REC_COUNT;
         u32 usage = 1;
 
+        /* Flush any pending (e)dpms as they may never arrive */
+        qed_wr(p_hwfn, p_ptt, DORQ_REG_DPM_FORCE_ABORT, 0x1);
+
         /* wait for usage to zero or count to run out. This is necessary since
          * EDPM doorbell transactions can take multiple 64b cycles, and as such
          * can "split" over the pci. Possibly, the doorbell drop can happen with
@@ -406,51 +409,74 @@ static int qed_db_rec_flush_queue(struct qed_hwfn *p_hwfn,
 
 int qed_db_rec_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 overflow;
+        u32 attn_ovfl, cur_ovfl;
         int rc;
 
-        overflow = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
-        DP_NOTICE(p_hwfn, "PF Overflow sticky 0x%x\n", overflow);
-        if (!overflow) {
-                qed_db_recovery_execute(p_hwfn, DB_REC_ONCE);
+        attn_ovfl = test_and_clear_bit(QED_OVERFLOW_BIT,
+                                       &p_hwfn->db_recovery_info.overflow);
+        cur_ovfl = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
+        if (!cur_ovfl && !attn_ovfl)
                 return 0;
-        }
 
-        if (qed_edpm_enabled(p_hwfn)) {
+        DP_NOTICE(p_hwfn, "PF Overflow sticky: attn %u current %u\n",
+                  attn_ovfl, cur_ovfl);
+
+        if (cur_ovfl && !p_hwfn->db_bar_no_edpm) {
                 rc = qed_db_rec_flush_queue(p_hwfn, p_ptt);
                 if (rc)
                         return rc;
         }
 
-        /* Flush any pending (e)dpm as they may never arrive */
-        qed_wr(p_hwfn, p_ptt, DORQ_REG_DPM_FORCE_ABORT, 0x1);
-
         /* Release overflow sticky indication (stop silently dropping everything) */
         qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY, 0x0);
 
         /* Repeat all last doorbells (doorbell drop recovery) */
-        qed_db_recovery_execute(p_hwfn, DB_REC_REAL_DEAL);
+        qed_db_recovery_execute(p_hwfn);
 
         return 0;
 }
 
-static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
+static void qed_dorq_attn_overflow(struct qed_hwfn *p_hwfn)
 {
-        u32 int_sts, first_drop_reason, details, address, all_drops_reason;
         struct qed_ptt *p_ptt = p_hwfn->p_dpc_ptt;
+        u32 overflow;
         int rc;
 
-        int_sts = qed_rd(p_hwfn, p_ptt, DORQ_REG_INT_STS);
-        DP_NOTICE(p_hwfn->cdev, "DORQ attention. int_sts was %x\n", int_sts);
+        overflow = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
+        if (!overflow)
+                goto out;
+
+        /* Run PF doorbell recovery in next periodic handler */
+        set_bit(QED_OVERFLOW_BIT, &p_hwfn->db_recovery_info.overflow);
+
+        if (!p_hwfn->db_bar_no_edpm) {
+                rc = qed_db_rec_flush_queue(p_hwfn, p_ptt);
+                if (rc)
+                        goto out;
+        }
+
+        qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY, 0x0);
+out:
+        /* Schedule the handler even if overflow was not detected */
+        qed_periodic_db_rec_start(p_hwfn);
+}
+
+static int qed_dorq_attn_int_sts(struct qed_hwfn *p_hwfn)
+{
+        u32 int_sts, first_drop_reason, details, address, all_drops_reason;
+        struct qed_ptt *p_ptt = p_hwfn->p_dpc_ptt;
 
         /* int_sts may be zero since all PFs were interrupted for doorbell
          * overflow but another one already handled it. Can abort here. If
          * This PF also requires overflow recovery we will be interrupted again.
          * The masked almost full indication may also be set. Ignoring.
          */
+        int_sts = qed_rd(p_hwfn, p_ptt, DORQ_REG_INT_STS);
         if (!(int_sts & ~DORQ_REG_INT_STS_DORQ_FIFO_AFULL))
                 return 0;
 
+        DP_NOTICE(p_hwfn->cdev, "DORQ attention. int_sts was %x\n", int_sts);
+
         /* check if db_drop or overflow happened */
         if (int_sts & (DORQ_REG_INT_STS_DB_DROP |
                        DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR)) {
@@ -477,11 +503,6 @@ static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
                           GET_FIELD(details, QED_DORQ_ATTENTION_SIZE) * 4,
                           first_drop_reason, all_drops_reason);
 
-                rc = qed_db_rec_handler(p_hwfn, p_ptt);
-                qed_periodic_db_rec_start(p_hwfn);
-                if (rc)
-                        return rc;
-
                 /* Clear the doorbell drop details and prepare for next drop */
                 qed_wr(p_hwfn, p_ptt, DORQ_REG_DB_DROP_DETAILS_REL, 0);
 
@@ -507,6 +528,25 @@ static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
         return -EINVAL;
 }
 
+static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
+{
+        p_hwfn->db_recovery_info.dorq_attn = true;
+        qed_dorq_attn_overflow(p_hwfn);
+
+        return qed_dorq_attn_int_sts(p_hwfn);
+}
+
+static void qed_dorq_attn_handler(struct qed_hwfn *p_hwfn)
+{
+        if (p_hwfn->db_recovery_info.dorq_attn)
+                goto out;
+
+        /* Call DORQ callback if the attention was missed */
+        qed_dorq_attn_cb(p_hwfn);
+out:
+        p_hwfn->db_recovery_info.dorq_attn = false;
+}
+
 /* Instead of major changes to the data-structure, we have a some 'special'
  * identifiers for sources that changed meaning between adapters.
  */
@@ -1080,6 +1120,9 @@ static int qed_int_deassertion(struct qed_hwfn  *p_hwfn,
                 }
         }
 
+        /* Handle missed DORQ attention */
+        qed_dorq_attn_handler(p_hwfn);
+
         /* Clear IGU indication for the deasserted bits */
         DIRECT_REG_WR((u8 __iomem *)p_hwfn->regview +
                                     GTT_BAR0_MAP_REG_IGU_CMD +
diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
index 1f356ed4f761..d473b522afc5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
@@ -192,8 +192,8 @@ void qed_int_disable_post_isr_release(struct qed_dev *cdev);
 
 /**
  * @brief - Doorbell Recovery handler.
- *          Run DB_REAL_DEAL doorbell recovery in case of PF overflow
- *          (and flush DORQ if needed), otherwise run DB_REC_ONCE.
+ *          Run doorbell recovery in case of PF overflow (and flush DORQ if
+ *          needed).
  *
  * @param p_hwfn
  * @param p_ptt
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index f164d4acebcb..6de23b56b294 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -970,7 +970,7 @@ static void qed_update_pf_params(struct qed_dev *cdev,
         }
 }
 
-#define QED_PERIODIC_DB_REC_COUNT               100
+#define QED_PERIODIC_DB_REC_COUNT               10
 #define QED_PERIODIC_DB_REC_INTERVAL_MS         100
 #define QED_PERIODIC_DB_REC_INTERVAL \
         msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index 9faaa6df78ed..2f318aaf2b05 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1591,7 +1591,7 @@ static void qed_iov_vf_mbx_acquire(struct qed_hwfn *p_hwfn,
                         p_vfdev->eth_fp_hsi_minor = ETH_HSI_VER_NO_PKT_LEN_TUNN;
                 } else {
                         DP_INFO(p_hwfn,
-                                "VF[%d] needs fastpath HSI %02x.%02x, which is incompatible with loaded FW's faspath HSI %02x.%02x\n",
+                                "VF[%d] needs fastpath HSI %02x.%02x, which is incompatible with loaded FW's fastpath HSI %02x.%02x\n",
                                 vf->abs_vf_id,
                                 req->vfdev_info.eth_fp_hsi_major,
                                 req->vfdev_info.eth_fp_hsi_minor,
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
index 5f3f42a25361..bddb2b5982dc 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
@@ -490,18 +490,17 @@ int qede_ptp_enable(struct qede_dev *edev, bool init_tc)
 
         ptp->clock = ptp_clock_register(&ptp->clock_info, &edev->pdev->dev);
         if (IS_ERR(ptp->clock)) {
-                rc = -EINVAL;
                 DP_ERR(edev, "PTP clock registration failed\n");
+                qede_ptp_disable(edev);
+                rc = -EINVAL;
                 goto err2;
         }
 
         return 0;
 
-err2:
-        qede_ptp_disable(edev);
-        ptp->clock = NULL;
 err1:
         kfree(ptp);
+err2:
         edev->ptp = NULL;
 
         return rc;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a622ec33453a..699a8870e928 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1244,6 +1244,23 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
                 goto err_option_port_add;
         }
 
+        /* set promiscuity level to new slave */
+        if (dev->flags & IFF_PROMISC) {
+                err = dev_set_promiscuity(port_dev, 1);
+                if (err)
+                        goto err_set_slave_promisc;
+        }
+
+        /* set allmulti level to new slave */
+        if (dev->flags & IFF_ALLMULTI) {
+                err = dev_set_allmulti(port_dev, 1);
+                if (err) {
+                        if (dev->flags & IFF_PROMISC)
+                                dev_set_promiscuity(port_dev, -1);
+                        goto err_set_slave_promisc;
+                }
+        }
+
         netif_addr_lock_bh(dev);
         dev_uc_sync_multiple(port_dev, dev);
         dev_mc_sync_multiple(port_dev, dev);
@@ -1260,6 +1277,9 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 
         return 0;
 
+err_set_slave_promisc:
+        __team_option_inst_del_port(team, port);
+
 err_option_port_add:
         team_upper_dev_unlink(team, port);
 
@@ -1305,6 +1325,12 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
 
         team_port_disable(team, port);
         list_del_rcu(&port->list);
+
+        if (dev->flags & IFF_PROMISC)
+                dev_set_promiscuity(port_dev, -1);
+        if (dev->flags & IFF_ALLMULTI)
+                dev_set_allmulti(port_dev, -1);
+
         team_upper_dev_unlink(team, port);
         netdev_rx_handler_unregister(port_dev);
         team_port_disable_netpoll(port);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a20ea270d519..1acc622d2183 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2728,7 +2728,7 @@ static void ath10k_htt_rx_tx_fetch_ind(struct ath10k *ar, struct sk_buff *skb)
                         num_msdus++;
                         num_bytes += ret;
                 }
-                ieee80211_return_txq(hw, txq);
+                ieee80211_return_txq(hw, txq, false);
                 ieee80211_txq_schedule_end(hw, txq->ac);
 
                 record->num_msdus = cpu_to_le16(num_msdus);
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index b73c23d4ce86..41e89db244d2 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4089,7 +4089,7 @@ static int ath10k_mac_schedule_txq(struct ieee80211_hw *hw, u32 ac)
                         if (ret < 0)
                                 break;
                 }
-                ieee80211_return_txq(hw, txq);
+                ieee80211_return_txq(hw, txq, false);
                 ath10k_htt_tx_txq_update(hw, txq);
                 if (ret == -EBUSY)
                         break;
@@ -4374,7 +4374,7 @@ static void ath10k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
                 if (ret < 0)
                         break;
         }
-        ieee80211_return_txq(hw, txq);
+        ieee80211_return_txq(hw, txq, false);
         ath10k_htt_tx_txq_update(hw, txq);
 out:
         ieee80211_txq_schedule_end(hw, ac);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 773d428ff1b0..b17e1ca40995 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1938,12 +1938,15 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                 goto out;
 
         while ((queue = ieee80211_next_txq(hw, txq->mac80211_qnum))) {
+                bool force;
+
                 tid = (struct ath_atx_tid *)queue->drv_priv;
 
                 ret = ath_tx_sched_aggr(sc, txq, tid);
                 ath_dbg(common, QUEUE, "ath_tx_sched_aggr returned %d\n", ret);
 
-                ieee80211_return_txq(hw, queue);
+                force = !skb_queue_empty(&tid->retry_q);
+                ieee80211_return_txq(hw, queue, force);
         }
 
 out:
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
index fdc56f821b5a..eb6defb6d0cd 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -82,6 +82,7 @@
 #define IWL_22000_HR_A0_FW_PRE          "iwlwifi-QuQnj-a0-hr-a0-"
 #define IWL_22000_SU_Z0_FW_PRE          "iwlwifi-su-z0-"
 #define IWL_QU_B_JF_B_FW_PRE            "iwlwifi-Qu-b0-jf-b0-"
+#define IWL_QUZ_A_HR_B_FW_PRE           "iwlwifi-QuZ-a0-hr-b0-"
 #define IWL_QNJ_B_JF_B_FW_PRE           "iwlwifi-QuQnj-b0-jf-b0-"
 #define IWL_CC_A_FW_PRE                 "iwlwifi-cc-a0-"
 #define IWL_22000_SO_A_JF_B_FW_PRE      "iwlwifi-so-a0-jf-b0-"
@@ -105,8 +106,8 @@
         IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
 #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
         IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
-#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
-        IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_QUZ_A_HR_B_MODULE_FIRMWARE(api) \
+        IWL_QUZ_A_HR_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
         IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
 #define IWL_QNJ_B_JF_B_MODULE_FIRMWARE(api)             \
@@ -235,8 +236,20 @@ const struct iwl_cfg iwl_ax101_cfg_qu_hr = {
         .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
 };
 
-const struct iwl_cfg iwl22260_2ax_cfg = {
-        .name = "Intel(R) Wireless-AX 22260",
+const struct iwl_cfg iwl_ax101_cfg_quz_hr = {
+        .name = "Intel(R) Wi-Fi 6 AX101",
+        .fw_name_pre = IWL_QUZ_A_HR_B_FW_PRE,
+        IWL_DEVICE_22500,
+        /*
+         * This device doesn't support receiving BlockAck with a large bitmap
+         * so we need to restrict the size of transmitted aggregation to the
+         * HT size; mac80211 would otherwise pick the HE max (256) by default.
+         */
+        .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl_ax200_cfg_cc = {
+        .name = "Intel(R) Wi-Fi 6 AX200 160MHz",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -249,7 +262,7 @@ const struct iwl_cfg iwl22260_2ax_cfg = {
 };
 
 const struct iwl_cfg killer1650x_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (200NGW)",
+        .name = "Killer(R) Wi-Fi 6 AX1650x 160MHz Wireless Network Adapter (200NGW)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -262,7 +275,7 @@ const struct iwl_cfg killer1650x_2ax_cfg = {
 };
 
 const struct iwl_cfg killer1650w_2ax_cfg = {
-        .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (200D2W)",
+        .name = "Killer(R) Wi-Fi 6 AX1650w 160MHz Wireless Network Adapter (200D2W)",
         .fw_name_pre = IWL_CC_A_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -328,7 +341,7 @@ const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
 };
 
 const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0 = {
-        .name = "Killer(R) Wireless-AX 1650i Wireless Network Adapter (22560NGW)",
+        .name = "Killer(R) Wi-Fi 6 AX1650i 160MHz Wireless Network Adapter (201NGW)",
         .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -340,7 +353,7 @@ const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0 = {
 };
 
 const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0 = {
-        .name = "Killer(R) Wireless-AX 1650s Wireless Network Adapter (22560D2W)",
+        .name = "Killer(R) Wi-Fi 6 AX1650s 160MHz Wireless Network Adapter (201D2W)",
         .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
         IWL_DEVICE_22500,
         /*
@@ -444,6 +457,7 @@ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_QUZ_A_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_QNJ_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL_22000_SO_A_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index f119c49cd39c..d7380016f1c0 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -1614,6 +1614,7 @@ iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
         if (!range) {
                 IWL_ERR(fwrt, "Failed to fill region header: id=%d, type=%d\n",
                         le32_to_cpu(reg->region_id), type);
+                memset(*data, 0, le32_to_cpu((*data)->len));
                 return;
         }
 
@@ -1623,6 +1624,7 @@ iwl_dump_ini_mem(struct iwl_fw_runtime *fwrt,
                 if (range_size < 0) {
                         IWL_ERR(fwrt, "Failed to dump region: id=%d, type=%d\n",
                                 le32_to_cpu(reg->region_id), type);
+                        memset(*data, 0, le32_to_cpu((*data)->len));
                         return;
                 }
                 range = range + range_size;
@@ -1807,12 +1809,12 @@ _iwl_fw_error_ini_dump(struct iwl_fw_runtime *fwrt,
 
         trigger = fwrt->dump.active_trigs[id].trig;
 
-        size = sizeof(*dump_file);
-        size += iwl_fw_ini_get_trigger_len(fwrt, trigger);
-
+        size = iwl_fw_ini_get_trigger_len(fwrt, trigger);
         if (!size)
                 return NULL;
 
+        size += sizeof(*dump_file);
+
         dump_file = vzalloc(size);
         if (!dump_file)
                 return NULL;
@@ -1942,14 +1944,10 @@ int iwl_fw_dbg_error_collect(struct iwl_fw_runtime *fwrt,
         iwl_dump_error_desc->len = 0;
 
         ret = iwl_fw_dbg_collect_desc(fwrt, iwl_dump_error_desc, false, 0);
-        if (ret) {
+        if (ret)
                 kfree(iwl_dump_error_desc);
-        } else {
-                set_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
-
-                /* trigger nmi to halt the fw */
-                iwl_force_nmi(fwrt->trans);
-        }
+        else
+                iwl_trans_sync_nmi(fwrt->trans);
 
         return ret;
 }
@@ -2489,22 +2487,6 @@ IWL_EXPORT_SYMBOL(iwl_fw_dbg_apply_point);
 
 void iwl_fwrt_stop_device(struct iwl_fw_runtime *fwrt)
 {
-        /* if the wait event timeout elapses instead of wake up then
-         * the driver did not receive NMI interrupt and can not assume the FW
-         * is halted
-         */
-        int ret = wait_event_timeout(fwrt->trans->fw_halt_waitq,
-                                     !test_bit(STATUS_FW_WAIT_DUMP,
-                                               &fwrt->trans->status),
-                                     msecs_to_jiffies(2000));
-        if (!ret) {
-                /* failed to receive NMI interrupt, assuming the FW is stuck */
-                set_bit(STATUS_FW_ERROR, &fwrt->trans->status);
-
-                clear_bit(STATUS_FW_WAIT_DUMP, &fwrt->trans->status);
-        }
-
-        /* Assuming the op mode mutex is held at this point */
         iwl_fw_dbg_collect_sync(fwrt);
 
         iwl_trans_stop_device(fwrt->trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index 7adf4e4e841a..12310e3d2fc5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -76,7 +76,6 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
         fwrt->ops_ctx = ops_ctx;
         INIT_DELAYED_WORK(&fwrt->dump.wk, iwl_fw_error_dump_wk);
         iwl_fwrt_dbgfs_register(fwrt, dbgfs_dir);
-        init_waitqueue_head(&fwrt->trans->fw_halt_waitq);
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index f5f87773667b..93070848280a 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -549,8 +549,9 @@ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
 extern const struct iwl_cfg iwl_ax101_cfg_qu_hr;
+extern const struct iwl_cfg iwl_ax101_cfg_quz_hr;
 extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
-extern const struct iwl_cfg iwl22260_2ax_cfg;
+extern const struct iwl_cfg iwl_ax200_cfg_cc;
 extern const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0;
 extern const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0;
 extern const struct iwl_cfg killer1650x_2ax_cfg;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index aea6d03e545a..e539bc94eff7 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -327,6 +327,7 @@ enum {
 #define CSR_HW_REV_TYPE_NONE            (0x00001F0)
 #define CSR_HW_REV_TYPE_QNJ             (0x0000360)
 #define CSR_HW_REV_TYPE_QNJ_B0          (0x0000364)
+#define CSR_HW_REV_TYPE_QUZ             (0x0000354)
 #define CSR_HW_REV_TYPE_HR_CDB          (0x0000340)
 #define CSR_HW_REV_TYPE_SO              (0x0000370)
 #define CSR_HW_REV_TYPE_TY              (0x0000420)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index bbebbf3efd57..d8690acee40c 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -338,7 +338,6 @@ enum iwl_d3_status {
  *      are sent
  * @STATUS_TRANS_IDLE: the trans is idle - general commands are not to be sent
  * @STATUS_TRANS_DEAD: trans is dead - avoid any read/write operation
- * @STATUS_FW_WAIT_DUMP: if set, wait until cleared before collecting dump
  */
 enum iwl_trans_status {
         STATUS_SYNC_HCMD_ACTIVE,
@@ -351,7 +350,6 @@ enum iwl_trans_status {
         STATUS_TRANS_GOING_IDLE,
         STATUS_TRANS_IDLE,
         STATUS_TRANS_DEAD,
-        STATUS_FW_WAIT_DUMP,
 };
 
 static inline int
@@ -618,6 +616,7 @@ struct iwl_trans_ops {
         struct iwl_trans_dump_data *(*dump_data)(struct iwl_trans *trans,
                                                  u32 dump_mask);
         void (*debugfs_cleanup)(struct iwl_trans *trans);
+        void (*sync_nmi)(struct iwl_trans *trans);
 };
 
 /**
@@ -831,7 +830,6 @@ struct iwl_trans {
         u32 lmac_error_event_table[2];
         u32 umac_error_event_table;
         unsigned int error_event_table_tlv_status;
-        wait_queue_head_t fw_halt_waitq;
 
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
@@ -1239,10 +1237,12 @@ static inline void iwl_trans_fw_error(struct iwl_trans *trans)
         /* prevent double restarts due to the same erroneous FW */
         if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
                 iwl_op_mode_nic_error(trans->op_mode);
+}
 
-        if (test_and_clear_bit(STATUS_FW_WAIT_DUMP, &trans->status))
-                wake_up(&trans->fw_halt_waitq);
-
+static inline void iwl_trans_sync_nmi(struct iwl_trans *trans)
+{
+        if (trans->ops->sync_nmi)
+                trans->ops->sync_nmi(trans);
 }
 
 /*****************************************************
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 3a92c09d4692..6a3b11dd2edf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2714,9 +2714,6 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
 
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
-        kfree(mvmvif->ap_wep_key);
-        mvmvif->ap_wep_key = NULL;
-
         mutex_unlock(&mvm->mutex);
 }
 
@@ -3183,24 +3180,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = iwl_mvm_update_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
-                /* if wep is used, need to set the key for the station now */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
-                        mvm_sta->wep_key =
-                                kmemdup(mvmvif->ap_wep_key,
-                                        sizeof(*mvmvif->ap_wep_key) +
-                                        mvmvif->ap_wep_key->keylen,
-                                        GFP_KERNEL);
-                        if (!mvm_sta->wep_key) {
-                                ret = -ENOMEM;
-                                goto out_unlock;
-                        }
-
-                        ret = iwl_mvm_set_sta_key(mvm, vif, sta,
-                                                  mvm_sta->wep_key,
-                                                  STA_KEY_IDX_INVALID);
-                } else {
-                        ret = 0;
-                }
+                ret = 0;
 
                 /* we don't support TDLS during DCM */
                 if (iwl_mvm_phy_ctx_count(mvm) > 1)
@@ -3242,17 +3222,6 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                                    NL80211_TDLS_DISABLE_LINK);
                 }
 
-                /* Remove STA key if this is an AP using WEP */
-                if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key) {
-                        int rm_ret = iwl_mvm_remove_sta_key(mvm, vif, sta,
-                                                            mvm_sta->wep_key);
-
-                        if (!ret)
-                                ret = rm_ret;
-                        kfree(mvm_sta->wep_key);
-                        mvm_sta->wep_key = NULL;
-                }
-
                 if (unlikely(ret &&
                              test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
                                       &mvm->status)))
@@ -3289,6 +3258,13 @@ static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
                                   struct ieee80211_sta *sta, u32 changed)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (changed & (IEEE80211_RC_BW_CHANGED |
+                       IEEE80211_RC_SUPP_RATES_CHANGED |
+                       IEEE80211_RC_NSS_CHANGED))
+                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+                                     true);
 
         if (vif->type == NL80211_IFTYPE_STATION &&
             changed & IEEE80211_RC_NSS_CHANGED)
@@ -3439,20 +3415,12 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                 break;
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
-                if (vif->type == NL80211_IFTYPE_AP) {
-                        struct iwl_mvm_vif *mvmvif =
-                                iwl_mvm_vif_from_mac80211(vif);
-
-                        mvmvif->ap_wep_key = kmemdup(key,
-                                                     sizeof(*key) + key->keylen,
-                                                     GFP_KERNEL);
-                        if (!mvmvif->ap_wep_key)
-                                return -ENOMEM;
-                }
-
-                if (vif->type != NL80211_IFTYPE_STATION)
-                        return 0;
-                break;
+                if (vif->type == NL80211_IFTYPE_STATION)
+                        break;
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        return -EOPNOTSUPP;
+                /* support HW crypto on TX */
+                return 0;
         default:
                 /* currently FW supports only one optional cipher scheme */
                 if (hw->n_cipher_schemes &&
@@ -3540,12 +3508,17 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                 ret = iwl_mvm_set_sta_key(mvm, vif, sta, key, key_offset);
                 if (ret) {
                         IWL_WARN(mvm, "set key failed\n");
+                        key->hw_key_idx = STA_KEY_IDX_INVALID;
                         /*
                          * can't add key for RX, but we don't need it
-                         * in the device for TX so still return 0
+                         * in the device for TX so still return 0,
+                         * unless we have new TX API where we cannot
+                         * put key material into the TX_CMD
                          */
-                        key->hw_key_idx = STA_KEY_IDX_INVALID;
-                        ret = 0;
+                        if (iwl_mvm_has_new_tx_api(mvm))
+                                ret = -EOPNOTSUPP;
+                        else
+                                ret = 0;
                 }
 
                 break;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index bca6f6b536d9..a50dc53df086 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -498,7 +498,6 @@ struct iwl_mvm_vif {
         netdev_features_t features;
 
         struct iwl_probe_resp_data __rcu *probe_resp_data;
-        struct ieee80211_key_conf *ap_wep_key;
 };
 
 static inline struct iwl_mvm_vif *
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 498c315291cf..98d123dd7177 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1399,7 +1399,9 @@ void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk)
 
                 iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, tid);
                 list_del_init(&mvmtxq->list);
+                local_bh_disable();
                 iwl_mvm_mac_itxq_xmit(mvm->hw, txq);
+                local_bh_enable();
         }
 
         mutex_unlock(&mvm->mutex);
@@ -2333,21 +2335,6 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 iwl_mvm_enable_txq(mvm, NULL, mvmvif->cab_queue, 0, &cfg,
                                    timeout);
 
-        if (mvmvif->ap_wep_key) {
-                u8 key_offset = iwl_mvm_set_fw_key_idx(mvm);
-
-                __set_bit(key_offset, mvm->fw_key_table);
-
-                if (key_offset == STA_KEY_IDX_INVALID)
-                        return -ENOSPC;
-
-                ret = iwl_mvm_send_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                           mvmvif->ap_wep_key, true, 0, NULL, 0,
-                                           key_offset, 0);
-                if (ret)
-                        return ret;
-        }
-
         return 0;
 }
 
@@ -2419,28 +2406,6 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
 
-        if (mvmvif->ap_wep_key) {
-                int i;
-
-                if (!__test_and_clear_bit(mvmvif->ap_wep_key->hw_key_idx,
-                                          mvm->fw_key_table)) {
-                        IWL_ERR(mvm, "offset %d not used in fw key table.\n",
-                                mvmvif->ap_wep_key->hw_key_idx);
-                        return -ENOENT;
-                }
-
-                /* track which key was deleted last */
-                for (i = 0; i < STA_KEY_MAX_NUM; i++) {
-                        if (mvm->fw_key_deleted[i] < U8_MAX)
-                                mvm->fw_key_deleted[i]++;
-                }
-                mvm->fw_key_deleted[mvmvif->ap_wep_key->hw_key_idx] = 0;
-                ret = __iwl_mvm_remove_sta_key(mvm, mvmvif->mcast_sta.sta_id,
-                                               mvmvif->ap_wep_key, true);
-                if (ret)
-                        return ret;
-        }
-
         ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
         if (ret)
                 IWL_WARN(mvm, "Failed sending remove station\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 79700c7310a1..b4d4071b865d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -8,7 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -31,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -394,7 +394,6 @@ struct iwl_mvm_rxq_dup_data {
  *      the BA window. To be used for UAPSD only.
  * @ptk_pn: per-queue PTK PN data structures
  * @dup_data: per queue duplicate packet detection data
- * @wep_key: used in AP mode. Is a duplicate of the WEP key.
  * @deferred_traffic_tid_map: indication bitmap of deferred traffic per-TID
  * @tx_ant: the index of the antenna to use for data tx to this station. Only
  *      used during connection establishment (e.g. for the 4 way handshake
@@ -426,8 +425,6 @@ struct iwl_mvm_sta {
         struct iwl_mvm_key_pn __rcu *ptk_pn[4];
         struct iwl_mvm_rxq_dup_data *dup_data;
 
-        struct ieee80211_key_conf *wep_key;
-
         u8 reserved_queue;
 
         /* Temporary, until the new TLC will control the Tx protection */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 2b94e4cef56c..9f1af8da9dc1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -953,14 +953,15 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0)},
         {IWL_PCI_DEVICE(0xA0F0, 0x4070, iwl_ax101_cfg_qu_hr)},
 
-        {IWL_PCI_DEVICE(0x2723, 0x0080, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x0084, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x0088, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x008C, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x0080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x0084, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x0088, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x008C, iwl_ax200_cfg_cc)},
         {IWL_PCI_DEVICE(0x2723, 0x1653, killer1650w_2ax_cfg)},
         {IWL_PCI_DEVICE(0x2723, 0x1654, killer1650x_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x4080, iwl22260_2ax_cfg)},
-        {IWL_PCI_DEVICE(0x2723, 0x4088, iwl22260_2ax_cfg)},
+        {IWL_PCI_DEVICE(0x2723, 0x2080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x4080, iwl_ax200_cfg_cc)},
+        {IWL_PCI_DEVICE(0x2723, 0x4088, iwl_ax200_cfg_cc)},
 
         {IWL_PCI_DEVICE(0x1a56, 0x1653, killer1650w_2ax_cfg)},
         {IWL_PCI_DEVICE(0x1a56, 0x1654, killer1650x_2ax_cfg)},
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index bf8b61a476c5..59213164f35e 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -1043,7 +1043,7 @@ static inline bool iwl_pcie_dbg_on(struct iwl_trans *trans)
 
 void iwl_trans_pcie_rf_kill(struct iwl_trans *trans, bool state);
 void iwl_trans_pcie_dump_regs(struct iwl_trans *trans);
-void iwl_trans_sync_nmi(struct iwl_trans *trans);
+void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index fe8269d023de..79c1dc05f948 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3318,7 +3318,8 @@ static void iwl_trans_pcie_resume(struct iwl_trans *trans)
         .unref = iwl_trans_pcie_unref,                                  \
         .dump_data = iwl_trans_pcie_dump_data,                          \
         .d3_suspend = iwl_trans_pcie_d3_suspend,                        \
-        .d3_resume = iwl_trans_pcie_d3_resume
+        .d3_resume = iwl_trans_pcie_d3_resume,                          \
+        .sync_nmi = iwl_trans_pcie_sync_nmi
 
 #ifdef CONFIG_PM_SLEEP
 #define IWL_TRANS_PM_OPS                                                \
@@ -3542,6 +3543,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         } else if (cfg == &iwl_ax101_cfg_qu_hr) {
                 if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
+                    trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
+                        trans->cfg = &iwl22000_2ax_cfg_qnj_hr_b0;
+                } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                     CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
                         trans->cfg = &iwl_ax101_cfg_qu_hr;
                 } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
@@ -3560,7 +3565,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                    CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
-                   (trans->cfg != &iwl22260_2ax_cfg ||
+                   (trans->cfg != &iwl_ax200_cfg_cc ||
                     trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
                 u32 hw_status;
 
@@ -3637,7 +3642,7 @@ out_no_pci:
         return ERR_PTR(ret);
 }
 
-void iwl_trans_sync_nmi(struct iwl_trans *trans)
+void iwl_trans_pcie_sync_nmi(struct iwl_trans *trans)
 {
         unsigned long timeout = jiffies + IWL_TRANS_NMI_TIMEOUT;
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 88530d9f4a54..38d110338987 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -965,7 +965,7 @@ static int iwl_pcie_gen2_send_hcmd_sync(struct iwl_trans *trans,
                                cmd_str);
                 ret = -ETIMEDOUT;
 
-                iwl_trans_sync_nmi(trans);
+                iwl_trans_pcie_sync_nmi(trans);
                 goto cancel;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 9fbd37d23e85..7be73e2c4681 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -1960,7 +1960,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                iwl_get_cmd_string(trans, cmd->id));
                 ret = -ETIMEDOUT;
 
-                iwl_trans_sync_nmi(trans);
+                iwl_trans_pcie_sync_nmi(trans);
                 goto cancel;
         }
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4cc7b222859c..7437faae7cf2 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2644,7 +2644,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
         enum nl80211_band band;
         const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
         struct net *net;
-        int idx;
+        int idx, i;
         int n_limits = 0;
 
         if (WARN_ON(param->channels > 1 && !param->use_chanctx))
@@ -2768,12 +2768,23 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                 goto failed_hw;
         }
 
+        data->if_combination.max_interfaces = 0;
+        for (i = 0; i < n_limits; i++)
+                data->if_combination.max_interfaces +=
+                        data->if_limits[i].max;
+
         data->if_combination.n_limits = n_limits;
-        data->if_combination.max_interfaces = 2048;
         data->if_combination.limits = data->if_limits;
 
-        hw->wiphy->iface_combinations = &data->if_combination;
-        hw->wiphy->n_iface_combinations = 1;
+        /*
+         * If we actually were asked to support combinations,
+         * advertise them - if there's only a single thing like
+         * only IBSS then don't advertise it as combinations.
+         */
+        if (data->if_combination.max_interfaces > 1) {
+                hw->wiphy->iface_combinations = &data->if_combination;
+                hw->wiphy->n_iface_combinations = 1;
+        }
 
         if (param->ciphers) {
                 memcpy(data->ciphers, param->ciphers,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/init.c b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
index d54dda67d036..3af45949e868 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/init.c
@@ -510,6 +510,8 @@ int mt7603_register_device(struct mt7603_dev *dev)
         bus_ops->rmw = mt7603_rmw;
         dev->mt76.bus = bus_ops;
 
+        spin_lock_init(&dev->ps_lock);
+
         INIT_DELAYED_WORK(&dev->mac_work, mt7603_mac_work);
         tasklet_init(&dev->pre_tbtt_tasklet, mt7603_pre_tbtt_tasklet,
                      (unsigned long)dev);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index 5e31d7da96fc..5abc02b57818 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -343,7 +343,7 @@ void mt7603_mac_rx_ba_reset(struct mt7603_dev *dev, void *addr, u8 tid)
                  MT_BA_CONTROL_1_RESET));
 }
 
-void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
+void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid,
                             int ba_size)
 {
         u32 addr = mt7603_wtbl2_addr(wcid);
@@ -358,43 +358,6 @@ void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
                 mt76_clear(dev, addr + (15 * 4), tid_mask);
                 return;
         }
-        mt76_poll(dev, MT_WTBL_UPDATE, MT_WTBL_UPDATE_BUSY, 0, 5000);
-
-        mt7603_mac_stop(dev);
-        switch (tid) {
-        case 0:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID0_SN, ssn);
-                break;
-        case 1:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID1_SN, ssn);
-                break;
-        case 2:
-                mt76_rmw_field(dev, addr + (2 * 4), MT_WTBL2_W2_TID2_SN_LO,
-                               ssn);
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID2_SN_HI,
-                               ssn >> 8);
-                break;
-        case 3:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID3_SN, ssn);
-                break;
-        case 4:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID4_SN, ssn);
-                break;
-        case 5:
-                mt76_rmw_field(dev, addr + (3 * 4), MT_WTBL2_W3_TID5_SN_LO,
-                               ssn);
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID5_SN_HI,
-                               ssn >> 4);
-                break;
-        case 6:
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID6_SN, ssn);
-                break;
-        case 7:
-                mt76_rmw_field(dev, addr + (4 * 4), MT_WTBL2_W4_TID7_SN, ssn);
-                break;
-        }
-        mt7603_wtbl_update(dev, wcid, MT_WTBL_UPDATE_WTBL2);
-        mt7603_mac_start(dev);
 
         for (i = 7; i > 0; i--) {
                 if (ba_size >= MT_AGG_SIZE_LIMIT(i))
@@ -827,6 +790,7 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *rate = &info->control.rates[0];
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
         struct ieee80211_vif *vif = info->control.vif;
         struct mt7603_vif *mvif;
         int wlan_idx;
@@ -834,6 +798,7 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
         int tx_count = 8;
         u8 frame_type, frame_subtype;
         u16 fc = le16_to_cpu(hdr->frame_control);
+        u16 seqno = 0;
         u8 vif_idx = 0;
         u32 val;
         u8 bw;
@@ -919,7 +884,17 @@ mt7603_mac_write_txwi(struct mt7603_dev *dev, __le32 *txwi,
                 tx_count = 0x1f;
 
         val = FIELD_PREP(MT_TXD3_REM_TX_COUNT, tx_count) |
-              FIELD_PREP(MT_TXD3_SEQ, le16_to_cpu(hdr->seq_ctrl));
+                  MT_TXD3_SN_VALID;
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                seqno = le16_to_cpu(hdr->seq_ctrl);
+        else if (ieee80211_is_back_req(hdr->frame_control))
+                seqno = le16_to_cpu(bar->start_seq_num);
+        else
+                val &= ~MT_TXD3_SN_VALID;
+
+        val |= FIELD_PREP(MT_TXD3_SEQ, seqno >> 4);
+
         txwi[3] = cpu_to_le32(val);
 
         if (key) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
index cc0fe0933b2d..a3c4ef198bfe 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c
@@ -372,7 +372,7 @@ mt7603_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps)
         struct mt7603_sta *msta = (struct mt7603_sta *)sta->drv_priv;
         struct sk_buff_head list;
 
-        mt76_stop_tx_queues(&dev->mt76, sta, false);
+        mt76_stop_tx_queues(&dev->mt76, sta, true);
         mt7603_wtbl_set_ps(dev, msta, ps);
         if (ps)
                 return;
@@ -584,13 +584,13 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 mtxq->aggr = true;
                 mtxq->send_bar = false;
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, ba_size);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, ba_size);
                 break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 mtxq->aggr = false;
                 ieee80211_send_bar(vif, sta->addr, tid, mtxq->agg_ssn);
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, -1);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, -1);
                 break;
         case IEEE80211_AMPDU_TX_START:
                 mtxq->agg_ssn = *ssn << 4;
@@ -598,7 +598,7 @@ mt7603_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 break;
         case IEEE80211_AMPDU_TX_STOP_CONT:
                 mtxq->aggr = false;
-                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, *ssn, -1);
+                mt7603_mac_tx_ba_reset(dev, msta->wcid.idx, tid, -1);
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         }
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
index 79f332429432..6049f3b7c8fe 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mt7603.h
@@ -200,7 +200,7 @@ void mt7603_beacon_set_timer(struct mt7603_dev *dev, int idx, int intval);
 int mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb);
 void mt7603_mac_add_txs(struct mt7603_dev *dev, void *data);
 void mt7603_mac_rx_ba_reset(struct mt7603_dev *dev, void *addr, u8 tid);
-void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid, int ssn,
+void mt7603_mac_tx_ba_reset(struct mt7603_dev *dev, int wcid, int tid,
                             int ba_size);
 
 void mt7603_pse_client_reset(struct mt7603_dev *dev);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 9ed231abe916..4fe5a83ca5a4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -466,7 +466,6 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                 return;
 
         rcu_read_lock();
-        mt76_tx_status_lock(mdev, &list);
 
         if (stat->wcid < ARRAY_SIZE(dev->mt76.wcid))
                 wcid = rcu_dereference(dev->mt76.wcid[stat->wcid]);
@@ -479,6 +478,8 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                                           drv_priv);
         }
 
+        mt76_tx_status_lock(mdev, &list);
+
         if (wcid) {
                 if (stat->pktid >= MT_PACKET_ID_FIRST)
                         status.skb = mt76_tx_status_skb_get(mdev, wcid,
@@ -498,7 +499,9 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
                 if (*update == 0 && stat_val == stat_cache &&
                     stat->wcid == msta->status.wcid && msta->n_frames < 32) {
                         msta->n_frames++;
-                        goto out;
+                        mt76_tx_status_unlock(mdev, &list);
+                        rcu_read_unlock();
+                        return;
                 }
 
                 mt76x02_mac_fill_tx_status(dev, status.info, &msta->status,
@@ -514,11 +517,10 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
 
         if (status.skb)
                 mt76_tx_status_skb_done(mdev, status.skb, &list);
-        else
-                ieee80211_tx_status_ext(mt76_hw(dev), &status);
-
-out:
         mt76_tx_status_unlock(mdev, &list);
+
+        if (!status.skb)
+                ieee80211_tx_status_ext(mt76_hw(dev), &status);
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
index 4b1744e9fb78..50b92ca92bd7 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
@@ -673,7 +673,6 @@ enum rt2x00_state_flags {
         CONFIG_CHANNEL_HT40,
         CONFIG_POWERSAVING,
         CONFIG_HT_DISABLED,
-        CONFIG_QOS_DISABLED,
         CONFIG_MONITORING,
 
         /*
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
index 2825560e2424..e8462f25d252 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
@@ -642,19 +642,9 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                         rt2x00dev->intf_associated--;
 
                 rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
-
-                clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
         }
 
         /*
-         * Check for access point which do not support 802.11e . We have to
-         * generate data frames sequence number in S/W for such AP, because
-         * of H/W bug.
-         */
-        if (changes & BSS_CHANGED_QOS && !bss_conf->qos)
-                set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
-
-        /*
          * When the erp information has changed, we should perform
          * additional configuration steps. For all other changes we are done.
          */
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
index 92ddc19e7bf7..4834b4eb0206 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
@@ -201,15 +201,18 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
         if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
                 /*
                  * rt2800 has a H/W (or F/W) bug, device incorrectly increase
-                 * seqno on retransmited data (non-QOS) frames. To workaround
-                 * the problem let's generate seqno in software if QOS is
-                 * disabled.
+                 * seqno on retransmitted data (non-QOS) and management frames.
+                 * To workaround the problem let's generate seqno in software.
+                 * Except for beacons which are transmitted periodically by H/W
+                 * hence hardware has to assign seqno for them.
                  */
-                if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags))
-                        __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
-                else
+                if (ieee80211_is_beacon(hdr->frame_control)) {
+                        __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
                         /* H/W will generate sequence number */
                         return;
+                }
+
+                __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
         }
 
         /*
diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
index b72a303176c7..9486acc08402 100644
--- a/drivers/nvdimm/btt_devs.c
+++ b/drivers/nvdimm/btt_devs.c
@@ -198,14 +198,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
                 return NULL;
 
         nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL);
-        if (nd_btt->id < 0) {
-                kfree(nd_btt);
-                return NULL;
-        }
+        if (nd_btt->id < 0)
+                goto out_nd_btt;
 
         nd_btt->lbasize = lbasize;
-        if (uuid)
+        if (uuid) {
                 uuid = kmemdup(uuid, 16, GFP_KERNEL);
+                if (!uuid)
+                        goto out_put_id;
+        }
         nd_btt->uuid = uuid;
         dev = &nd_btt->dev;
         dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id);
@@ -220,6 +221,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
                 return NULL;
         }
         return dev;
+
+out_put_id:
+        ida_simple_remove(&nd_region->btt_ida, nd_btt->id);
+
+out_nd_btt:
+        kfree(nd_btt);
+        return NULL;
 }
 
 struct device *nd_btt_create(struct nd_region *nd_region)
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 7849bf1812c4..f293556cbbf6 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -2249,9 +2249,12 @@ static struct device *create_namespace_blk(struct nd_region *nd_region,
         if (!nsblk->uuid)
                 goto blk_err;
         memcpy(name, nd_label->name, NSLABEL_NAME_LEN);
-        if (name[0])
+        if (name[0]) {
                 nsblk->alt_name = kmemdup(name, NSLABEL_NAME_LEN,
                                 GFP_KERNEL);
+                if (!nsblk->alt_name)
+                        goto blk_err;
+        }
         res = nsblk_add_resource(nd_region, ndd, nsblk,
                         __le64_to_cpu(nd_label->dpa));
         if (!res)
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index bc2f700feef8..0279eb1da3ef 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -113,13 +113,13 @@ static void write_pmem(void *pmem_addr, struct page *page,
 
         while (len) {
                 mem = kmap_atomic(page);
-                chunk = min_t(unsigned int, len, PAGE_SIZE);
+                chunk = min_t(unsigned int, len, PAGE_SIZE - off);
                 memcpy_flushcache(pmem_addr, mem + off, chunk);
                 kunmap_atomic(mem);
                 len -= chunk;
                 off = 0;
                 page++;
-                pmem_addr += PAGE_SIZE;
+                pmem_addr += chunk;
         }
 }
 
@@ -132,7 +132,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
 
         while (len) {
                 mem = kmap_atomic(page);
-                chunk = min_t(unsigned int, len, PAGE_SIZE);
+                chunk = min_t(unsigned int, len, PAGE_SIZE - off);
                 rem = memcpy_mcsafe(mem + off, pmem_addr, chunk);
                 kunmap_atomic(mem);
                 if (rem)
@@ -140,7 +140,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
                 len -= chunk;
                 off = 0;
                 page++;
-                pmem_addr += PAGE_SIZE;
+                pmem_addr += chunk;
         }
         return BLK_STS_OK;
 }
diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
index f8bb746a549f..a570f2263a42 100644
--- a/drivers/nvdimm/security.c
+++ b/drivers/nvdimm/security.c
@@ -22,6 +22,8 @@ static bool key_revalidate = true;
 module_param(key_revalidate, bool, 0444);
 MODULE_PARM_DESC(key_revalidate, "Require key validation at init.");
 
+static const char zero_key[NVDIMM_PASSPHRASE_LEN];
+
 static void *key_data(struct key *key)
 {
         struct encrypted_key_payload *epayload = dereference_key_locked(key);
@@ -75,6 +77,16 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
         return key;
 }
 
+static const void *nvdimm_get_key_payload(struct nvdimm *nvdimm,
+                struct key **key)
+{
+        *key = nvdimm_request_key(nvdimm);
+        if (!*key)
+                return zero_key;
+
+        return key_data(*key);
+}
+
 static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
                 key_serial_t id, int subclass)
 {
@@ -105,36 +117,57 @@ static struct key *nvdimm_lookup_user_key(struct nvdimm *nvdimm,
         return key;
 }
 
-static struct key *nvdimm_key_revalidate(struct nvdimm *nvdimm)
+static const void *nvdimm_get_user_key_payload(struct nvdimm *nvdimm,
+                key_serial_t id, int subclass, struct key **key)
+{
+        *key = NULL;
+        if (id == 0) {
+                if (subclass == NVDIMM_BASE_KEY)
+                        return zero_key;
+                else
+                        return NULL;
+        }
+
+        *key = nvdimm_lookup_user_key(nvdimm, id, subclass);
+        if (!*key)
+                return NULL;
+
+        return key_data(*key);
+}
+
+
+static int nvdimm_key_revalidate(struct nvdimm *nvdimm)
 {
         struct key *key;
         int rc;
+        const void *data;
 
         if (!nvdimm->sec.ops->change_key)
-                return NULL;
+                return -EOPNOTSUPP;
 
-        key = nvdimm_request_key(nvdimm);
-        if (!key)
-                return NULL;
+        data = nvdimm_get_key_payload(nvdimm, &key);
 
         /*
          * Send the same key to the hardware as new and old key to
          * verify that the key is good.
          */
-        rc = nvdimm->sec.ops->change_key(nvdimm, key_data(key),
-                        key_data(key), NVDIMM_USER);
+        rc = nvdimm->sec.ops->change_key(nvdimm, data, data, NVDIMM_USER);
         if (rc < 0) {
                 nvdimm_put_key(key);
-                key = NULL;
+                return rc;
         }
-        return key;
+
+        nvdimm_put_key(key);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
+        return 0;
 }
 
 static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key = NULL;
+        struct key *key;
+        const void *data;
         int rc;
 
         /* The bus lock should be held at the top level of the call stack */
@@ -160,16 +193,11 @@ static int __nvdimm_security_unlock(struct nvdimm *nvdimm)
                 if (!key_revalidate)
                         return 0;
 
-                key = nvdimm_key_revalidate(nvdimm);
-                if (!key)
-                        return nvdimm_security_freeze(nvdimm);
+                return nvdimm_key_revalidate(nvdimm);
         } else
-                key = nvdimm_request_key(nvdimm);
+                data = nvdimm_get_key_payload(nvdimm, &key);
 
-        if (!key)
-                return -ENOKEY;
-
-        rc = nvdimm->sec.ops->unlock(nvdimm, key_data(key));
+        rc = nvdimm->sec.ops->unlock(nvdimm, data);
         dev_dbg(dev, "key: %d unlock: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
@@ -195,6 +223,7 @@ int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
         struct key *key;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -214,11 +243,12 @@ int nvdimm_security_disable(struct nvdimm *nvdimm, unsigned int keyid)
                 return -EBUSY;
         }
 
-        key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-        if (!key)
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
                 return -ENOKEY;
 
-        rc = nvdimm->sec.ops->disable(nvdimm, key_data(key));
+        rc = nvdimm->sec.ops->disable(nvdimm, data);
         dev_dbg(dev, "key: %d disable: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
@@ -235,6 +265,7 @@ int nvdimm_security_update(struct nvdimm *nvdimm, unsigned int keyid,
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
         struct key *key, *newkey;
         int rc;
+        const void *data, *newdata;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -249,22 +280,19 @@ int nvdimm_security_update(struct nvdimm *nvdimm, unsigned int keyid,
                 return -EIO;
         }
 
-        if (keyid == 0)
-                key = NULL;
-        else {
-                key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-                if (!key)
-                        return -ENOKEY;
-        }
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
+                return -ENOKEY;
 
-        newkey = nvdimm_lookup_user_key(nvdimm, new_keyid, NVDIMM_NEW_KEY);
-        if (!newkey) {
+        newdata = nvdimm_get_user_key_payload(nvdimm, new_keyid,
+                        NVDIMM_NEW_KEY, &newkey);
+        if (!newdata) {
                 nvdimm_put_key(key);
                 return -ENOKEY;
         }
 
-        rc = nvdimm->sec.ops->change_key(nvdimm, key ? key_data(key) : NULL,
-                        key_data(newkey), pass_type);
+        rc = nvdimm->sec.ops->change_key(nvdimm, data, newdata, pass_type);
         dev_dbg(dev, "key: %d %d update%s: %s\n",
                         key_serial(key), key_serial(newkey),
                         pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
@@ -286,8 +314,9 @@ int nvdimm_security_erase(struct nvdimm *nvdimm, unsigned int keyid,
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key;
+        struct key *key = NULL;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -319,11 +348,12 @@ int nvdimm_security_erase(struct nvdimm *nvdimm, unsigned int keyid,
                 return -EOPNOTSUPP;
         }
 
-        key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-        if (!key)
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
                 return -ENOKEY;
 
-        rc = nvdimm->sec.ops->erase(nvdimm, key_data(key), pass_type);
+        rc = nvdimm->sec.ops->erase(nvdimm, data, pass_type);
         dev_dbg(dev, "key: %d erase%s: %s\n", key_serial(key),
                         pass_type == NVDIMM_MASTER ? "(master)" : "(user)",
                         rc == 0 ? "success" : "fail");
@@ -337,8 +367,9 @@ int nvdimm_security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
 {
         struct device *dev = &nvdimm->dev;
         struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(dev);
-        struct key *key;
+        struct key *key = NULL;
         int rc;
+        const void *data;
 
         /* The bus lock should be held at the top level of the call stack */
         lockdep_assert_held(&nvdimm_bus->reconfig_mutex);
@@ -368,15 +399,12 @@ int nvdimm_security_overwrite(struct nvdimm *nvdimm, unsigned int keyid)
                 return -EBUSY;
         }
 
-        if (keyid == 0)
-                key = NULL;
-        else {
-                key = nvdimm_lookup_user_key(nvdimm, keyid, NVDIMM_BASE_KEY);
-                if (!key)
-                        return -ENOKEY;
-        }
+        data = nvdimm_get_user_key_payload(nvdimm, keyid,
+                        NVDIMM_BASE_KEY, &key);
+        if (!data)
+                return -ENOKEY;
 
-        rc = nvdimm->sec.ops->overwrite(nvdimm, key ? key_data(key) : NULL);
+        rc = nvdimm->sec.ops->overwrite(nvdimm, data);
         dev_dbg(dev, "key: %d overwrite submission: %s\n", key_serial(key),
                         rc == 0 ? "success" : "fail");
 
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 470601980794..2c43e12b70af 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -288,7 +288,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
                                 "Cancelling I/O %d", req->tag);
 
         nvme_req(req)->status = NVME_SC_ABORT_REQ;
-        blk_mq_complete_request(req);
+        blk_mq_complete_request_sync(req);
         return true;
 }
 EXPORT_SYMBOL_GPL(nvme_cancel_request);
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index f3b9d91ba0df..6d8451356eac 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1845,7 +1845,7 @@ nvme_fc_init_queue(struct nvme_fc_ctrl *ctrl, int idx)
         memset(queue, 0, sizeof(*queue));
         queue->ctrl = ctrl;
         queue->qnum = idx;
-        atomic_set(&queue->csn, 1);
+        atomic_set(&queue->csn, 0);
         queue->dev = ctrl->dev;
 
         if (idx > 0)
@@ -1887,7 +1887,7 @@ nvme_fc_free_queue(struct nvme_fc_queue *queue)
          */
 
         queue->connection_id = 0;
-        atomic_set(&queue->csn, 1);
+        atomic_set(&queue->csn, 0);
 }
 
 static void
@@ -2183,7 +2183,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
 {
         struct nvme_fc_cmd_iu *cmdiu = &op->cmd_iu;
         struct nvme_command *sqe = &cmdiu->sqe;
-        u32 csn;
         int ret, opstate;
 
         /*
@@ -2198,8 +2197,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
 
         /* format the FC-NVME CMD IU and fcp_req */
         cmdiu->connection_id = cpu_to_be64(queue->connection_id);
-        csn = atomic_inc_return(&queue->csn);
-        cmdiu->csn = cpu_to_be32(csn);
         cmdiu->data_len = cpu_to_be32(data_len);
         switch (io_dir) {
         case NVMEFC_FCP_WRITE:
@@ -2257,11 +2254,24 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
         if (!(op->flags & FCOP_FLAGS_AEN))
                 blk_mq_start_request(op->rq);
 
+        cmdiu->csn = cpu_to_be32(atomic_inc_return(&queue->csn));
         ret = ctrl->lport->ops->fcp_io(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
                                         queue->lldd_handle, &op->fcp_req);
 
         if (ret) {
+                /*
+                 * If the lld fails to send the command is there an issue with
+                 * the csn value?  If the command that fails is the Connect,
+                 * no - as the connection won't be live.  If it is a command
+                 * post-connect, it's possible a gap in csn may be created.
+                 * Does this matter?  As Linux initiators don't send fused
+                 * commands, no.  The gap would exist, but as there's nothing
+                 * that depends on csn order to be delivered on the target
+                 * side, it shouldn't hurt.  It would be difficult for a
+                 * target to even detect the csn gap as it has no idea when the
+                 * cmd with the csn was supposed to arrive.
+                 */
                 opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
                 __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
 
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 76250181fee0..9f72d515fc4b 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -24,6 +24,11 @@ u32 nvmet_get_log_page_len(struct nvme_command *cmd)
         return len;
 }
 
+u64 nvmet_get_log_page_offset(struct nvme_command *cmd)
+{
+        return le64_to_cpu(cmd->get_log_page.lpo);
+}
+
 static void nvmet_execute_get_log_page_noop(struct nvmet_req *req)
 {
         nvmet_req_complete(req, nvmet_zero_sgl(req, 0, req->data_len));
diff --git a/drivers/nvme/target/discovery.c b/drivers/nvme/target/discovery.c
index c872b47a88f3..33ed95e72d6b 100644
--- a/drivers/nvme/target/discovery.c
+++ b/drivers/nvme/target/discovery.c
@@ -131,54 +131,76 @@ static void nvmet_set_disc_traddr(struct nvmet_req *req, struct nvmet_port *port
                 memcpy(traddr, port->disc_addr.traddr, NVMF_TRADDR_SIZE);
 }
 
+static size_t discovery_log_entries(struct nvmet_req *req)
+{
+        struct nvmet_ctrl *ctrl = req->sq->ctrl;
+        struct nvmet_subsys_link *p;
+        struct nvmet_port *r;
+        size_t entries = 0;
+
+        list_for_each_entry(p, &req->port->subsystems, entry) {
+                if (!nvmet_host_allowed(p->subsys, ctrl->hostnqn))
+                        continue;
+                entries++;
+        }
+        list_for_each_entry(r, &req->port->referrals, entry)
+                entries++;
+        return entries;
+}
+
 static void nvmet_execute_get_disc_log_page(struct nvmet_req *req)
 {
         const int entry_size = sizeof(struct nvmf_disc_rsp_page_entry);
         struct nvmet_ctrl *ctrl = req->sq->ctrl;
         struct nvmf_disc_rsp_page_hdr *hdr;
+        u64 offset = nvmet_get_log_page_offset(req->cmd);
         size_t data_len = nvmet_get_log_page_len(req->cmd);
-        size_t alloc_len = max(data_len, sizeof(*hdr));
-        int residual_len = data_len - sizeof(*hdr);
+        size_t alloc_len;
         struct nvmet_subsys_link *p;
         struct nvmet_port *r;
         u32 numrec = 0;
         u16 status = 0;
+        void *buffer;
+
+        /* Spec requires dword aligned offsets */
+        if (offset & 0x3) {
+                status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
+                goto out;
+        }
 
         /*
          * Make sure we're passing at least a buffer of response header size.
          * If host provided data len is less than the header size, only the
          * number of bytes requested by host will be sent to host.
          */
-        hdr = kzalloc(alloc_len, GFP_KERNEL);
-        if (!hdr) {
+        down_read(&nvmet_config_sem);
+        alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);
+        buffer = kzalloc(alloc_len, GFP_KERNEL);
+        if (!buffer) {
+                up_read(&nvmet_config_sem);
                 status = NVME_SC_INTERNAL;
                 goto out;
         }
 
-        down_read(&nvmet_config_sem);
+        hdr = buffer;
         list_for_each_entry(p, &req->port->subsystems, entry) {
+                char traddr[NVMF_TRADDR_SIZE];
+
                 if (!nvmet_host_allowed(p->subsys, ctrl->hostnqn))
                         continue;
-                if (residual_len >= entry_size) {
-                        char traddr[NVMF_TRADDR_SIZE];
-
-                        nvmet_set_disc_traddr(req, req->port, traddr);
-                        nvmet_format_discovery_entry(hdr, req->port,
-                                        p->subsys->subsysnqn, traddr,
-                                        NVME_NQN_NVME, numrec);
-                        residual_len -= entry_size;
-                }
+
+                nvmet_set_disc_traddr(req, req->port, traddr);
+                nvmet_format_discovery_entry(hdr, req->port,
+                                p->subsys->subsysnqn, traddr,
+                                NVME_NQN_NVME, numrec);
                 numrec++;
         }
 
         list_for_each_entry(r, &req->port->referrals, entry) {
-                if (residual_len >= entry_size) {
-                        nvmet_format_discovery_entry(hdr, r,
-                                        NVME_DISC_SUBSYS_NAME,
-                                        r->disc_addr.traddr,
-                                        NVME_NQN_DISC, numrec);
-                        residual_len -= entry_size;
-                }
+                nvmet_format_discovery_entry(hdr, r,
+                                NVME_DISC_SUBSYS_NAME,
+                                r->disc_addr.traddr,
+                                NVME_NQN_DISC, numrec);
                 numrec++;
         }
 
@@ -190,8 +212,8 @@ static void nvmet_execute_get_disc_log_page(struct nvmet_req *req)
 
         up_read(&nvmet_config_sem);
 
-        status = nvmet_copy_to_sgl(req, 0, hdr, data_len);
-        kfree(hdr);
+        status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);
+        kfree(buffer);
 out:
         nvmet_req_complete(req, status);
 }
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 51e49efd7849..1653d19b187f 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -428,6 +428,7 @@ u16 nvmet_copy_from_sgl(struct nvmet_req *req, off_t off, void *buf,
 u16 nvmet_zero_sgl(struct nvmet_req *req, off_t off, size_t len);
 
 u32 nvmet_get_log_page_len(struct nvme_command *cmd);
+u64 nvmet_get_log_page_offset(struct nvme_command *cmd);
 
 extern struct list_head *nvmet_ports;
 void nvmet_port_disc_changed(struct nvmet_port *port,
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 3f3df4c29f6e..905282a8ddaa 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -115,6 +115,10 @@ static void remove_board(struct controller *ctrl, bool safe_removal)
                  * removed from the slot/adapter.
                  */
                 msleep(1000);
+
+                /* Ignore link or presence changes caused by power off */
+                atomic_and(~(PCI_EXP_SLTSTA_DLLSC | PCI_EXP_SLTSTA_PDC),
+                           &ctrl->pending_events);
         }
 
         /* turn off Green LED */
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index a59ad09ce911..a077f67fe1da 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3877,6 +3877,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
                          quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170,
+                         quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172,
                          quirk_dma_func1_alias);
diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
index 8f018b3f3cd4..c7039f52ad51 100644
--- a/drivers/platform/x86/pmc_atom.c
+++ b/drivers/platform/x86/pmc_atom.c
@@ -17,6 +17,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/platform_data/x86/clk-pmc-atom.h>
@@ -391,11 +392,27 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
 }
 #endif /* CONFIG_DEBUG_FS */
 
+/*
+ * Some systems need one or more of their pmc_plt_clks to be
+ * marked as critical.
+ */
+static const struct dmi_system_id critclk_systems[] = {
+        {
+                .ident = "MPL CEC1x",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MPL AG"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CEC10 Family"),
+                },
+        },
+        { /*sentinel*/ }
+};
+
 static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
                           const struct pmc_data *pmc_data)
 {
         struct platform_device *clkdev;
         struct pmc_clk_data *clk_data;
+        const struct dmi_system_id *d = dmi_first_match(critclk_systems);
 
         clk_data = kzalloc(sizeof(*clk_data), GFP_KERNEL);
         if (!clk_data)
@@ -403,6 +420,10 @@ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
 
         clk_data->base = pmc_regmap; /* offset is added by client */
         clk_data->clks = pmc_data->clks;
+        if (d) {
+                clk_data->critical = true;
+                pr_info("%s critclks quirk enabled\n", d->ident);
+        }
 
         clkdev = platform_device_register_data(&pdev->dev, "clk-pmc-atom",
                                                PLATFORM_DEVID_NONE,
diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c
index 462560b2855e..469d0bc9f5fe 100644
--- a/drivers/scsi/csiostor/csio_scsi.c
+++ b/drivers/scsi/csiostor/csio_scsi.c
@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req)
         }
 
 out:
-        if (req->nsge > 0)
+        if (req->nsge > 0) {
                 scsi_dma_unmap(cmnd);
+                if (req->dcopy && (host_status == DID_OK))
+                        host_status = csio_scsi_copy_to_sgl(hw, req);
+        }
 
         cmnd->result = (((host_status) << 16) | scsi_status);
         cmnd->scsi_done(cmnd);
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 8af01777d09c..f8cb7c23305b 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -793,6 +793,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 
         /* We need to know how many queues before we allocate. */
         num_queues = virtscsi_config_get(vdev, num_queues) ? : 1;
+        num_queues = min_t(unsigned int, nr_cpu_ids, num_queues);
 
         num_targets = virtscsi_config_get(vdev, max_target) + 1;
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 5ace833de746..351af88231ad 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -911,8 +911,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem,
                                 u64 start, u64 size, u64 end,
                                 u64 userspace_addr, int perm)
 {
-        struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
+        struct vhost_umem_node *tmp, *node;
 
+        if (!size)
+                return -EFAULT;
+
+        node = kmalloc(sizeof(*node), GFP_ATOMIC);
         if (!node)
                 return -ENOMEM;
 
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index d0584c040c60..7a0398bb84f7 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
         for (i = 0; i < vp_dev->msix_used_vectors; ++i)
                 free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
 
-        for (i = 0; i < vp_dev->msix_vectors; i++)
-                if (vp_dev->msix_affinity_masks[i])
-                        free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+        if (vp_dev->msix_affinity_masks) {
+                for (i = 0; i < vp_dev->msix_vectors; i++)
+                        if (vp_dev->msix_affinity_masks[i])
+                                free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+        }
 
         if (vp_dev->msix_enabled) {
                 /* Disable the vector used for configuration */
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 18846afb39da..5df92c308286 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -882,6 +882,8 @@ static struct virtqueue *vring_create_virtqueue_split(
                                           GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO);
                 if (queue)
                         break;
+                if (!may_reduce_num)
+                        return NULL;
         }
 
         if (!num)
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 2c588f9bbbda..c14001b42d20 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -610,6 +610,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
         bool stalled = false;
         u64 rtt;
         u32 life, last_life;
+        bool rxrpc_complete = false;
 
         DECLARE_WAITQUEUE(myself, current);
 
@@ -621,7 +622,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
                 rtt2 = 2;
 
         timeout = rtt2;
-        last_life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
+        rxrpc_kernel_check_life(call->net->socket, call->rxcall, &last_life);
 
         add_wait_queue(&call->waitq, &myself);
         for (;;) {
@@ -639,7 +640,12 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
                 if (afs_check_call_state(call, AFS_CALL_COMPLETE))
                         break;
 
-                life = rxrpc_kernel_check_life(call->net->socket, call->rxcall);
+                if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall, &life)) {
+                        /* rxrpc terminated the call. */
+                        rxrpc_complete = true;
+                        break;
+                }
+
                 if (timeout == 0 &&
                     life == last_life && signal_pending(current)) {
                         if (stalled)
@@ -663,12 +669,16 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
         remove_wait_queue(&call->waitq, &myself);
         __set_current_state(TASK_RUNNING);
 
-        /* Kill off the call if it's still live. */
         if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) {
-                _debug("call interrupted");
-                if (rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
-                                            RX_USER_ABORT, -EINTR, "KWI"))
-                        afs_set_call_complete(call, -EINTR, 0);
+                if (rxrpc_complete) {
+                        afs_set_call_complete(call, call->error, call->abort_code);
+                } else {
+                        /* Kill off the call if it's still live. */
+                        _debug("call interrupted");
+                        if (rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                                    RX_USER_ABORT, -EINTR, "KWI"))
+                                afs_set_call_complete(call, -EINTR, 0);
+                }
         }
 
         spin_lock_bh(&call->state_lock);
diff --git a/fs/aio.c b/fs/aio.c
index a4cc2a1cccb7..3490d1fa0e16 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1034,7 +1034,7 @@ static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
                 return NULL;
 
         if (unlikely(!get_reqs_available(ctx))) {
-                kfree(req);
+                kmem_cache_free(kiocb_cachep, req);
                 return NULL;
         }
 
@@ -1794,7 +1794,7 @@ static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb,
                  */
                 eventfd = eventfd_ctx_fdget(iocb->aio_resfd);
                 if (IS_ERR(eventfd))
-                        return PTR_ERR(req->ki_eventfd);
+                        return PTR_ERR(eventfd);
 
                 req->ki_eventfd = eventfd;
         }
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 78d3257435c0..24615c76c1d0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -307,10 +307,10 @@ static void blkdev_bio_end_io(struct bio *bio)
         struct blkdev_dio *dio = bio->bi_private;
         bool should_dirty = dio->should_dirty;
 
-        if (dio->multi_bio && !atomic_dec_and_test(&dio->ref)) {
-                if (bio->bi_status && !dio->bio.bi_status)
-                        dio->bio.bi_status = bio->bi_status;
-        } else {
+        if (bio->bi_status && !dio->bio.bi_status)
+                dio->bio.bi_status = bio->bi_status;
+
+        if (!dio->multi_bio || atomic_dec_and_test(&dio->ref)) {
                 if (!dio->is_sync) {
                         struct kiocb *iocb = dio->iocb;
                         ssize_t ret;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index ec2d8919e7fb..cd4e693406a0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -501,6 +501,16 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        /*
+         * If the fs is mounted with nologreplay, which requires it to be
+         * mounted in RO mode as well, we can not allow discard on free space
+         * inside block groups, because log trees refer to extents that are not
+         * pinned in a block group's free space cache (pinning the extents is
+         * precisely the first phase of replaying a log tree).
+         */
+        if (btrfs_test_opt(fs_info, NOLOGREPLAY))
+                return -EROFS;
+
         rcu_read_lock();
         list_for_each_entry_rcu(device, &fs_info->fs_devices->devices,
                                 dev_list) {
diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
index dc6140013ae8..61d22a56c0ba 100644
--- a/fs/btrfs/props.c
+++ b/fs/btrfs/props.c
@@ -366,11 +366,11 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
 
 static int prop_compression_validate(const char *value, size_t len)
 {
-        if (!strncmp("lzo", value, len))
+        if (!strncmp("lzo", value, 3))
                 return 0;
-        else if (!strncmp("zlib", value, len))
+        else if (!strncmp("zlib", value, 4))
                 return 0;
-        else if (!strncmp("zstd", value, len))
+        else if (!strncmp("zstd", value, 4))
                 return 0;
 
         return -EINVAL;
@@ -396,7 +396,7 @@ static int prop_compression_apply(struct inode *inode,
                 btrfs_set_fs_incompat(fs_info, COMPRESS_LZO);
         } else if (!strncmp("zlib", value, 4)) {
                 type = BTRFS_COMPRESS_ZLIB;
-        } else if (!strncmp("zstd", value, len)) {
+        } else if (!strncmp("zstd", value, 4)) {
                 type = BTRFS_COMPRESS_ZSTD;
                 btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD);
         } else {
diff --git a/fs/dax.c b/fs/dax.c
index ca0671d55aa6..e5e54da1715f 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -33,6 +33,7 @@
 #include <linux/sizes.h>
 #include <linux/mmu_notifier.h>
 #include <linux/iomap.h>
+#include <asm/pgalloc.h>
 #include "internal.h"
 
 #define CREATE_TRACE_POINTS
@@ -1407,7 +1408,9 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
 {
         struct address_space *mapping = vmf->vma->vm_file->f_mapping;
         unsigned long pmd_addr = vmf->address & PMD_MASK;
+        struct vm_area_struct *vma = vmf->vma;
         struct inode *inode = mapping->host;
+        pgtable_t pgtable = NULL;
         struct page *zero_page;
         spinlock_t *ptl;
         pmd_t pmd_entry;
@@ -1422,12 +1425,22 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
         *entry = dax_insert_entry(xas, mapping, vmf, *entry, pfn,
                         DAX_PMD | DAX_ZERO_PAGE, false);
 
+        if (arch_needs_pgtable_deposit()) {
+                pgtable = pte_alloc_one(vma->vm_mm);
+                if (!pgtable)
+                        return VM_FAULT_OOM;
+        }
+
         ptl = pmd_lock(vmf->vma->vm_mm, vmf->pmd);
         if (!pmd_none(*(vmf->pmd))) {
                 spin_unlock(ptl);
                 goto fallback;
         }
 
+        if (pgtable) {
+                pgtable_trans_huge_deposit(vma->vm_mm, vmf->pmd, pgtable);
+                mm_inc_nr_ptes(vma->vm_mm);
+        }
         pmd_entry = mk_pmd(zero_page, vmf->vma->vm_page_prot);
         pmd_entry = pmd_mkhuge(pmd_entry);
         set_pmd_at(vmf->vma->vm_mm, pmd_addr, vmf->pmd, pmd_entry);
@@ -1436,6 +1449,8 @@ static vm_fault_t dax_pmd_load_hole(struct xa_state *xas, struct vm_fault *vmf,
         return VM_FAULT_NOPAGE;
 
 fallback:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
         trace_dax_pmd_load_hole_fallback(inode, vmf, zero_page, *entry);
         return VM_FAULT_FALLBACK;
 }
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 8a63e52785e9..9971a35cf1ef 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -2056,10 +2056,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
                 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
 
         ret = -EINVAL;
-        if (rem < len) {
-                pipe_unlock(pipe);
-                goto out;
-        }
+        if (rem < len)
+                goto out_free;
 
         rem = len;
         while (rem) {
@@ -2077,7 +2075,9 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
                         pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
                         pipe->nrbufs--;
                 } else {
-                        pipe_buf_get(pipe, ibuf);
+                        if (!pipe_buf_get(pipe, ibuf))
+                                goto out_free;
+
                         *obuf = *ibuf;
                         obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
                         obuf->len = rem;
@@ -2100,11 +2100,11 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
         ret = fuse_dev_do_write(fud, &cs, len);
 
         pipe_lock(pipe);
+out_free:
         for (idx = 0; idx < nbuf; idx++)
                 pipe_buf_release(pipe, &bufs[idx]);
         pipe_unlock(pipe);
 
-out:
         kvfree(bufs);
         return ret;
 }
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 07d6ef195d05..89aa8412b5f5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2245,6 +2245,10 @@ static int io_sq_offload_start(struct io_ring_ctx *ctx,
                 goto err;
 
         if (ctx->flags & IORING_SETUP_SQPOLL) {
+                ret = -EPERM;
+                if (!capable(CAP_SYS_ADMIN))
+                        goto err;
+
                 if (p->flags & IORING_SETUP_SQ_AFF) {
                         int cpu;
 
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index ff6f85fb676b..5196bfa7894d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -329,9 +329,6 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src,
         };
         ssize_t err, err2;
 
-        if (!nfs_server_capable(file_inode(dst), NFS_CAP_COPY))
-                return -EOPNOTSUPP;
-
         src_lock = nfs_get_lock_context(nfs_file_open_context(src));
         if (IS_ERR(src_lock))
                 return PTR_ERR(src_lock);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 45b2322e092d..00d17198ee12 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -133,8 +133,10 @@ static ssize_t nfs4_copy_file_range(struct file *file_in, loff_t pos_in,
                                     struct file *file_out, loff_t pos_out,
                                     size_t count, unsigned int flags)
 {
+        if (!nfs_server_capable(file_inode(file_out), NFS_CAP_COPY))
+                return -EOPNOTSUPP;
         if (file_inode(file_in) == file_inode(file_out))
-                return -EINVAL;
+                return -EOPNOTSUPP;
         return nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index cfcabc33e24d..602446158bfb 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2589,7 +2589,7 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
                         ARRAY_SIZE(nfs4_acl_bitmap), &hdr);
 
         rpc_prepare_reply_pages(req, args->acl_pages, 0,
-                                args->acl_len, replen);
+                                args->acl_len, replen + 1);
         encode_nops(&hdr);
 }
 
@@ -2811,7 +2811,7 @@ static void nfs4_xdr_enc_fs_locations(struct rpc_rqst *req,
         }
 
         rpc_prepare_reply_pages(req, (struct page **)&args->page, 0,
-                                PAGE_SIZE, replen);
+                                PAGE_SIZE, replen + 1);
         encode_nops(&hdr);
 }
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 23790c7b2289..c27ac96a95bd 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2041,7 +2041,8 @@ static int nfs23_validate_mount_data(void *options,
                 memcpy(sap, &data->addr, sizeof(data->addr));
                 args->nfs_server.addrlen = sizeof(data->addr);
                 args->nfs_server.port = ntohs(data->addr.sin_port);
-                if (!nfs_verify_server_address(sap))
+                if (sap->sa_family != AF_INET ||
+                    !nfs_verify_server_address(sap))
                         goto out_no_address;
 
                 if (!(data->flags & NFS_MOUNT_TCP))
diff --git a/fs/pipe.c b/fs/pipe.c
index 070aad543382..41065901106b 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -188,9 +188,9 @@ EXPORT_SYMBOL(generic_pipe_buf_steal);
  *      in the tee() system call, when we duplicate the buffers in one
  *      pipe into another.
  */
-void generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
+bool generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
 {
-        get_page(buf->page);
+        return try_get_page(buf->page);
 }
 EXPORT_SYMBOL(generic_pipe_buf_get);
 
diff --git a/fs/splice.c b/fs/splice.c
index 3ee7e82df48f..98943d9b219c 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1593,7 +1593,11 @@ retry:
                          * Get a reference to this pipe buffer,
                          * so we can copy the contents over.
                          */
-                        pipe_buf_get(ipipe, ibuf);
+                        if (!pipe_buf_get(ipipe, ibuf)) {
+                                if (ret == 0)
+                                        ret = -EFAULT;
+                                break;
+                        }
                         *obuf = *ibuf;
 
                         /*
@@ -1667,7 +1671,11 @@ static int link_pipe(struct pipe_inode_info *ipipe,
                  * Get a reference to this pipe buffer,
                  * so we can copy the contents over.
                  */
-                pipe_buf_get(ipipe, ibuf);
+                if (!pipe_buf_get(ipipe, ibuf)) {
+                        if (ret == 0)
+                                ret = -EFAULT;
+                        break;
+                }
 
                 obuf = opipe->bufs + nbuf;
                 *obuf = *ibuf;
diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h
index cfb7be40bed7..ce4de6b1e444 100644
--- a/include/drm/drm_modeset_helper_vtables.h
+++ b/include/drm/drm_modeset_helper_vtables.h
@@ -418,6 +418,8 @@ struct drm_crtc_helper_funcs {
          * Drivers can use the @old_crtc_state input parameter if the operations
          * needed to enable the CRTC don't depend solely on the new state but
          * also on the transition between the old state and the new state.
+         *
+         * This function is optional.
          */
         void (*atomic_enable)(struct drm_crtc *crtc,
                               struct drm_crtc_state *old_crtc_state);
@@ -441,6 +443,8 @@ struct drm_crtc_helper_funcs {
          * parameter @old_crtc_state which could be used to access the old
          * state. Atomic drivers should consider to use this one instead
          * of @disable.
+         *
+         * This function is optional.
          */
         void (*atomic_disable)(struct drm_crtc *crtc,
                                struct drm_crtc_state *old_crtc_state);
diff --git a/include/dt-bindings/clock/sifive-fu540-prci.h b/include/dt-bindings/clock/sifive-fu540-prci.h
new file mode 100644
index 000000000000..6a0b70a37d78
--- /dev/null
+++ b/include/dt-bindings/clock/sifive-fu540-prci.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2018-2019 SiFive, Inc.
+ * Wesley Terpstra
+ * Paul Walmsley
+ */
+
+#ifndef __DT_BINDINGS_CLOCK_SIFIVE_FU540_PRCI_H
+#define __DT_BINDINGS_CLOCK_SIFIVE_FU540_PRCI_H
+
+/* Clock indexes for use by Device Tree data and the PRCI driver */
+
+#define PRCI_CLK_COREPLL               0
+#define PRCI_CLK_DDRPLL                1
+#define PRCI_CLK_GEMGXLPLL             2
+#define PRCI_CLK_TLCLK                 3
+
+#endif
diff --git a/include/linux/bio.h b/include/linux/bio.h
index bb6090aa165d..e584673c1881 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -120,19 +120,23 @@ static inline bool bio_full(struct bio *bio)
         return bio->bi_vcnt >= bio->bi_max_vecs;
 }
 
-#define mp_bvec_for_each_segment(bv, bvl, i, iter_all)                  \
-        for (bv = bvec_init_iter_all(&iter_all);                        \
-                (iter_all.done < (bvl)->bv_len) &&                      \
-                (mp_bvec_next_segment((bvl), &iter_all), 1);            \
-                iter_all.done += bv->bv_len, i += 1)
+static inline bool bio_next_segment(const struct bio *bio,
+                                    struct bvec_iter_all *iter)
+{
+        if (iter->idx >= bio->bi_vcnt)
+                return false;
+
+        bvec_advance(&bio->bi_io_vec[iter->idx], iter);
+        return true;
+}
 
 /*
  * drivers should _never_ use the all version - the bio may have been split
  * before it got to the driver and the driver won't own all of it
  */
-#define bio_for_each_segment_all(bvl, bio, i, iter_all)         \
-        for (i = 0, iter_all.idx = 0; iter_all.idx < (bio)->bi_vcnt; iter_all.idx++)    \
-                mp_bvec_for_each_segment(bvl, &((bio)->bi_io_vec[iter_all.idx]), i, iter_all)
+#define bio_for_each_segment_all(bvl, bio, i, iter)                     \
+        for (i = 0, bvl = bvec_init_iter_all(&iter);                    \
+             bio_next_segment((bio), &iter); i++)
 
 static inline void bio_advance_iter(struct bio *bio, struct bvec_iter *iter,
                                     unsigned bytes)
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index cb2aa7ecafff..db29928de467 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -302,6 +302,7 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
 bool blk_mq_complete_request(struct request *rq);
+void blk_mq_complete_request_sync(struct request *rq);
 bool blk_mq_bio_list_merge(struct request_queue *q, struct list_head *list,
                            struct bio *bio);
 bool blk_mq_queue_stopped(struct request_queue *q);
diff --git a/include/linux/bvec.h b/include/linux/bvec.h
index f6275c4da13a..3bc91879e1e2 100644
--- a/include/linux/bvec.h
+++ b/include/linux/bvec.h
@@ -145,18 +145,18 @@ static inline bool bvec_iter_advance(const struct bio_vec *bv,
 
 static inline struct bio_vec *bvec_init_iter_all(struct bvec_iter_all *iter_all)
 {
-        iter_all->bv.bv_page = NULL;
         iter_all->done = 0;
+        iter_all->idx = 0;
 
         return &iter_all->bv;
 }
 
-static inline void mp_bvec_next_segment(const struct bio_vec *bvec,
-                                        struct bvec_iter_all *iter_all)
+static inline void bvec_advance(const struct bio_vec *bvec,
+                                struct bvec_iter_all *iter_all)
 {
         struct bio_vec *bv = &iter_all->bv;
 
-        if (bv->bv_page) {
+        if (iter_all->done) {
                 bv->bv_page = nth_page(bv->bv_page, 1);
                 bv->bv_offset = 0;
         } else {
@@ -165,6 +165,12 @@ static inline void mp_bvec_next_segment(const struct bio_vec *bvec,
         }
         bv->bv_len = min_t(unsigned int, PAGE_SIZE - bv->bv_offset,
                            bvec->bv_len - iter_all->done);
+        iter_all->done += bv->bv_len;
+
+        if (iter_all->done == bvec->bv_len) {
+                iter_all->idx++;
+                iter_all->done = 0;
+        }
 }
 
 /*
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 34a5036debd3..2d14e21c16c0 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -47,8 +47,8 @@
 
 #define u64_to_user_ptr(x) (            \
 {                                       \
-        typecheck(u64, x);              \
-        (void __user *)(uintptr_t)x;    \
+        typecheck(u64, (x));            \
+        (void __user *)(uintptr_t)(x);  \
 }                                       \
 )
 
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 9d55c63db09b..640a03642766 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -28,6 +28,7 @@
 #include <linux/irqbypass.h>
 #include <linux/swait.h>
 #include <linux/refcount.h>
+#include <linux/nospec.h>
 #include <asm/signal.h>
 
 #include <linux/kvm.h>
@@ -513,10 +514,10 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)
 
 static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
 {
-        /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu, in case
-         * the caller has read kvm->online_vcpus before (as is the case
-         * for kvm_for_each_vcpu, for example).
-         */
+        int num_vcpus = atomic_read(&kvm->online_vcpus);
+        i = array_index_nospec(i, num_vcpus);
+
+        /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu.  */
         smp_rmb();
         return kvm->vcpus[i];
 }
@@ -600,6 +601,7 @@ void kvm_put_kvm(struct kvm *kvm);
 
 static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id)
 {
+        as_id = array_index_nospec(as_id, KVM_ADDRESS_SPACE_NUM);
         return srcu_dereference_check(kvm->memslots[as_id], &kvm->srcu,
                         lockdep_is_held(&kvm->slots_lock) ||
                         !refcount_read(&kvm->users_count));
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 76769749b5a5..6b10c21630f5 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -966,6 +966,10 @@ static inline bool is_pci_p2pdma_page(const struct page *page)
 }
 #endif /* CONFIG_DEV_PAGEMAP_OPS */
 
+/* 127: arbitrary random number, small enough to assemble well */
+#define page_ref_zero_or_close_to_overflow(page) \
+        ((unsigned int) page_ref_count(page) + 127u <= 127u)
+
 static inline void get_page(struct page *page)
 {
         page = compound_head(page);
@@ -973,8 +977,17 @@ static inline void get_page(struct page *page)
          * Getting a normal page or the head of a compound page
          * requires to already have an elevated page->_refcount.
          */
-        VM_BUG_ON_PAGE(page_ref_count(page) <= 0, page);
+        VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page);
+        page_ref_inc(page);
+}
+
+static inline __must_check bool try_get_page(struct page *page)
+{
+        page = compound_head(page);
+        if (WARN_ON_ONCE(page_ref_count(page) <= 0))
+                return false;
         page_ref_inc(page);
+        return true;
 }
 
 static inline void put_page(struct page *page)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 521eb869555e..c46d218a0456 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1498,6 +1498,7 @@ struct net_device_ops {
  * @IFF_FAILOVER: device is a failover master device
  * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
  * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
+ * @IFF_LIVE_RENAME_OK: rename is allowed while device is up and running
  */
 enum netdev_priv_flags {
         IFF_802_1Q_VLAN                 = 1<<0,
@@ -1530,6 +1531,7 @@ enum netdev_priv_flags {
         IFF_FAILOVER                    = 1<<27,
         IFF_FAILOVER_SLAVE              = 1<<28,
         IFF_L3MDEV_RX_HANDLER           = 1<<29,
+        IFF_LIVE_RENAME_OK              = 1<<30,
 };
 
 #define IFF_802_1Q_VLAN                 IFF_802_1Q_VLAN
@@ -1561,6 +1563,7 @@ enum netdev_priv_flags {
 #define IFF_FAILOVER                    IFF_FAILOVER
 #define IFF_FAILOVER_SLAVE              IFF_FAILOVER_SLAVE
 #define IFF_L3MDEV_RX_HANDLER           IFF_L3MDEV_RX_HANDLER
+#define IFF_LIVE_RENAME_OK              IFF_LIVE_RENAME_OK
 
 /**
  *      struct net_device - The DEVICE structure.
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index baa49e6a23cc..c40720cb59ac 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -967,8 +967,13 @@ struct nvme_get_log_page_command {
         __le16                  numdl;
         __le16                  numdu;
         __u16                   rsvd11;
-        __le32                  lpol;
-        __le32                  lpou;
+        union {
+                struct {
+                        __le32 lpol;
+                        __le32 lpou;
+                };
+                __le64 lpo;
+        };
         __u32                   rsvd14[2];
 };
 
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 787d224ff43e..abb2dac3da9b 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -101,18 +101,20 @@ struct pipe_buf_operations {
         /*
          * Get a reference to the pipe buffer.
          */
-        void (*get)(struct pipe_inode_info *, struct pipe_buffer *);
+        bool (*get)(struct pipe_inode_info *, struct pipe_buffer *);
 };
 
 /**
  * pipe_buf_get - get a reference to a pipe_buffer
  * @pipe:       the pipe that the buffer belongs to
  * @buf:        the buffer to get a reference to
+ *
+ * Return: %true if the reference was successfully obtained.
  */
-static inline void pipe_buf_get(struct pipe_inode_info *pipe,
+static inline __must_check bool pipe_buf_get(struct pipe_inode_info *pipe,
                                 struct pipe_buffer *buf)
 {
-        buf->ops->get(pipe, buf);
+        return buf->ops->get(pipe, buf);
 }
 
 /**
@@ -171,7 +173,7 @@ struct pipe_inode_info *alloc_pipe_info(void);
 void free_pipe_info(struct pipe_inode_info *);
 
 /* Generic pipe buffer ops functions */
-void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+bool generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
 int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
 int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
 void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
diff --git a/include/linux/platform_data/x86/clk-pmc-atom.h b/include/linux/platform_data/x86/clk-pmc-atom.h
index 3ab892208343..7a37ac27d0fb 100644
--- a/include/linux/platform_data/x86/clk-pmc-atom.h
+++ b/include/linux/platform_data/x86/clk-pmc-atom.h
@@ -35,10 +35,13 @@ struct pmc_clk {
  *
  * @base:       PMC clock register base offset
  * @clks:       pointer to set of registered clocks, typically 0..5
+ * @critical:   flag to indicate if firmware enabled pmc_plt_clks
+ *              should be marked as critial or not
  */
 struct pmc_clk_data {
         void __iomem *base;
         const struct pmc_clk *clks;
+        bool critical;
 };
 
 #endif /* __PLATFORM_DATA_X86_CLK_PMC_ATOM_H */
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index ec861cd0cfe8..52d41d0c1ae1 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -304,12 +304,4 @@ rpc_clnt_swap_deactivate(struct rpc_clnt *clnt)
 }
 #endif /* CONFIG_SUNRPC_SWAP */
 
-static inline bool
-rpc_task_need_resched(const struct rpc_task *task)
-{
-        if (RPC_IS_QUEUED(task) || task->tk_callback)
-                return true;
-        return false;
-}
-
 #endif /* _LINUX_SUNRPC_SCHED_H_ */
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index fab02133a919..3dc70adfe5f5 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -63,7 +63,7 @@ struct virtqueue;
 /*
  * Creates a virtqueue and allocates the descriptor ring.  If
  * may_reduce_num is set, then this may allocate a smaller ring than
- * expected.  The caller should query virtqueue_get_ring_size to learn
+ * expected.  The caller should query virtqueue_get_vring_size to learn
  * the actual size of the ring.
  */
 struct virtqueue *vring_create_virtqueue(unsigned int index,
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 2bfb87eb98ce..78c856cba4f5 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -61,10 +61,12 @@ int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t,
                                rxrpc_user_attach_call_t, unsigned long, gfp_t,
                                unsigned int);
 void rxrpc_kernel_set_tx_length(struct socket *, struct rxrpc_call *, s64);
-u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+bool rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *,
+                             u32 *);
 void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
 bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
                                  ktime_t *);
+bool rxrpc_kernel_call_is_complete(struct rxrpc_call *);
 
 #endif /* _NET_RXRPC_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bb307a11ee63..13bfeb712d36 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -7183,6 +7183,11 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev,
 #define wiphy_info(wiphy, format, args...)                      \
         dev_info(&(wiphy)->dev, format, ##args)
 
+#define wiphy_err_ratelimited(wiphy, format, args...)           \
+        dev_err_ratelimited(&(wiphy)->dev, format, ##args)
+#define wiphy_warn_ratelimited(wiphy, format, args...)          \
+        dev_warn_ratelimited(&(wiphy)->dev, format, ##args)
+
 #define wiphy_debug(wiphy, format, args...)                     \
         wiphy_printk(KERN_DEBUG, wiphy, format, ##args)
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ac2ed8ec662b..112dc18c658f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -6231,8 +6231,6 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @ac: AC number to return packets from.
  *
- * Should only be called between calls to ieee80211_txq_schedule_start()
- * and ieee80211_txq_schedule_end().
  * Returns the next txq if successful, %NULL if no queue is eligible. If a txq
  * is returned, it should be returned with ieee80211_return_txq() after the
  * driver has finished scheduling it.
@@ -6240,51 +6238,58 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac);
 
 /**
- * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
- *
- * @hw: pointer as obtained from ieee80211_alloc_hw()
- * @txq: pointer obtained from station or virtual interface
- *
- * Should only be called between calls to ieee80211_txq_schedule_start()
- * and ieee80211_txq_schedule_end().
- */
-void ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq);
-
-/**
- * ieee80211_txq_schedule_start - acquire locks for safe scheduling of an AC
+ * ieee80211_txq_schedule_start - start new scheduling round for TXQs
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @ac: AC number to acquire locks for
  *
- * Acquire locks needed to schedule TXQs from the given AC. Should be called
- * before ieee80211_next_txq() or ieee80211_return_txq().
+ * Should be called before ieee80211_next_txq() or ieee80211_return_txq().
+ * The driver must not call multiple TXQ scheduling rounds concurrently.
  */
-void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
-        __acquires(txq_lock);
+void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac);
+
+/* (deprecated) */
+static inline void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
+{
+}
+
+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+                              struct ieee80211_txq *txq, bool force);
 
 /**
- * ieee80211_txq_schedule_end - release locks for safe scheduling of an AC
+ * ieee80211_schedule_txq - schedule a TXQ for transmission
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
- * @ac: AC number to acquire locks for
+ * @txq: pointer obtained from station or virtual interface
  *
- * Release locks previously acquired by ieee80211_txq_schedule_end().
+ * Schedules a TXQ for transmission if it is not already scheduled,
+ * even if mac80211 does not have any packets buffered.
+ *
+ * The driver may call this function if it has buffered packets for
+ * this TXQ internally.
  */
-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
-        __releases(txq_lock);
+static inline void
+ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
+{
+        __ieee80211_schedule_txq(hw, txq, true);
+}
 
 /**
- * ieee80211_schedule_txq - schedule a TXQ for transmission
+ * ieee80211_return_txq - return a TXQ previously acquired by ieee80211_next_txq()
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @txq: pointer obtained from station or virtual interface
+ * @force: schedule txq even if mac80211 does not have any buffered packets.
  *
- * Schedules a TXQ for transmission if it is not already scheduled. Takes a
- * lock, which means it must *not* be called between
- * ieee80211_txq_schedule_start() and ieee80211_txq_schedule_end()
+ * The driver may set force=true if it has buffered packets for this TXQ
+ * internally.
  */
-void ieee80211_schedule_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
-        __acquires(txq_lock) __releases(txq_lock);
+static inline void
+ieee80211_return_txq(struct ieee80211_hw *hw, struct ieee80211_txq *txq,
+                     bool force)
+{
+        __ieee80211_schedule_txq(hw, txq, force);
+}
 
 /**
  * ieee80211_txq_may_transmit - check whether TXQ is allowed to transmit
diff --git a/include/net/netrom.h b/include/net/netrom.h
index 5a0714ff500f..80f15b1c1a48 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -266,7 +266,7 @@ void nr_stop_idletimer(struct sock *);
 int nr_t1timer_running(struct sock *);
 
 /* sysctl_net_netrom.c */
-void nr_register_sysctl(void);
+int nr_register_sysctl(void);
 void nr_unregister_sysctl(void);
 
 #endif
diff --git a/include/net/sock.h b/include/net/sock.h
index 7fa223278522..bdd77bbce7d8 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2091,12 +2091,6 @@ static inline bool skwq_has_sleeper(struct socket_wq *wq)
  * @p:              poll_table
  *
  * See the comments in the wq_has_sleeper function.
- *
- * Do not derive sock from filp->private_data here. An SMC socket establishes
- * an internal TCP socket that is used in the fallback case. All socket
- * operations on the SMC socket are then forwarded to the TCP socket. In case of
- * poll, the filp->private_data pointer references the SMC socket because the
- * TCP socket has no file assigned.
  */
 static inline void sock_poll_wait(struct file *filp, struct socket *sock,
                                   poll_table *p)
diff --git a/include/net/tls.h b/include/net/tls.h
index 3ce71d78414c..d9d0ac66f040 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -318,6 +318,7 @@ int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size);
 int tls_device_sendpage(struct sock *sk, struct page *page,
                         int offset, size_t size, int flags);
 void tls_device_sk_destruct(struct sock *sk);
+void tls_device_free_resources_tx(struct sock *sk);
 void tls_device_init(void);
 void tls_device_cleanup(void);
 int tls_tx_records(struct sock *sk, int flags);
@@ -341,6 +342,7 @@ int tls_push_sg(struct sock *sk, struct tls_context *ctx,
                 int flags);
 int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
                             int flags);
+bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx);
 
 static inline struct tls_msg *tls_msg(struct sk_buff *skb)
 {
@@ -390,7 +392,7 @@ tls_validate_xmit_skb(struct sock *sk, struct net_device *dev,
 static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
 {
 #ifdef CONFIG_SOCK_VALIDATE_XMIT
-        return sk_fullsock(sk) &
+        return sk_fullsock(sk) &&
                (smp_load_acquire(&sk->sk_validate_xmit_skb) ==
                &tls_validate_xmit_skb);
 #else
diff --git a/include/sound/soc.h b/include/sound/soc.h
index eb7db605955b..482b4ea87c3c 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -802,8 +802,13 @@ struct snd_soc_component_driver {
         int probe_order;
         int remove_order;
 
-        /* signal if the module handling the component cannot be removed */
-        unsigned int ignore_module_refcount:1;
+        /*
+         * signal if the module handling the component should not be removed
+         * if a pcm is open. Setting this would prevent the module
+         * refcount being incremented in probe() but allow it be incremented
+         * when a pcm is opened and decremented when it is closed.
+         */
+        unsigned int module_get_upon_open:1;
 
         /* bits */
         unsigned int idle_bias_on:1;
@@ -1083,6 +1088,8 @@ struct snd_soc_card {
         struct mutex mutex;
         struct mutex dapm_mutex;
 
+        spinlock_t dpcm_lock;
+
         bool instantiated;
         bool topology_shortname_created;
 
diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h
index 404d4b9ffe76..df1153cea0b7 100644
--- a/include/uapi/sound/asound.h
+++ b/include/uapi/sound/asound.h
@@ -32,6 +32,7 @@
 
 #ifndef __KERNEL__
 #include <stdlib.h>
+#include <time.h>
 #endif
 
 /*
diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index 45d51e8e26f6..a218e43cc382 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -706,7 +706,7 @@ static struct dma_debug_entry *dma_entry_alloc(void)
 #ifdef CONFIG_STACKTRACE
         entry->stacktrace.max_entries = DMA_DEBUG_STACKTRACE_ENTRIES;
         entry->stacktrace.entries = entry->st_entries;
-        entry->stacktrace.skip = 2;
+        entry->stacktrace.skip = 1;
         save_stack_trace(&entry->stacktrace);
 #endif
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 72d06e302e99..534e01e7bc36 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2009,8 +2009,8 @@ event_sched_out(struct perf_event *event,
         event->pmu->del(event, 0);
         event->oncpu = -1;
 
-        if (event->pending_disable) {
-                event->pending_disable = 0;
+        if (READ_ONCE(event->pending_disable) >= 0) {
+                WRITE_ONCE(event->pending_disable, -1);
                 state = PERF_EVENT_STATE_OFF;
         }
         perf_event_set_state(event, state);
@@ -2198,7 +2198,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable);
 
 void perf_event_disable_inatomic(struct perf_event *event)
 {
-        event->pending_disable = 1;
+        WRITE_ONCE(event->pending_disable, smp_processor_id());
+        /* can fail, see perf_pending_event_disable() */
         irq_work_queue(&event->pending);
 }
 
@@ -5810,10 +5811,45 @@ void perf_event_wakeup(struct perf_event *event)
         }
 }
 
+static void perf_pending_event_disable(struct perf_event *event)
+{
+        int cpu = READ_ONCE(event->pending_disable);
+
+        if (cpu < 0)
+                return;
+
+        if (cpu == smp_processor_id()) {
+                WRITE_ONCE(event->pending_disable, -1);
+                perf_event_disable_local(event);
+                return;
+        }
+
+        /*
+         *  CPU-A                       CPU-B
+         *
+         *  perf_event_disable_inatomic()
+         *    @pending_disable = CPU-A;
+         *    irq_work_queue();
+         *
+         *  sched-out
+         *    @pending_disable = -1;
+         *
+         *                              sched-in
+         *                              perf_event_disable_inatomic()
+         *                                @pending_disable = CPU-B;
+         *                                irq_work_queue(); // FAILS
+         *
+         *  irq_work_run()
+         *    perf_pending_event()
+         *
+         * But the event runs on CPU-B and wants disabling there.
+         */
+        irq_work_queue_on(&event->pending, cpu);
+}
+
 static void perf_pending_event(struct irq_work *entry)
 {
-        struct perf_event *event = container_of(entry,
-                        struct perf_event, pending);
+        struct perf_event *event = container_of(entry, struct perf_event, pending);
         int rctx;
 
         rctx = perf_swevent_get_recursion_context();
@@ -5822,10 +5858,7 @@ static void perf_pending_event(struct irq_work *entry)
          * and we won't recurse 'further'.
          */
 
-        if (event->pending_disable) {
-                event->pending_disable = 0;
-                perf_event_disable_local(event);
-        }
+        perf_pending_event_disable(event);
 
         if (event->pending_wakeup) {
                 event->pending_wakeup = 0;
@@ -10236,6 +10269,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 
 
         init_waitqueue_head(&event->waitq);
+        event->pending_disable = -1;
         init_irq_work(&event->pending, perf_pending_event);
 
         mutex_init(&event->mmap_mutex);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index a4047321d7d8..2545ac08cc77 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -392,7 +392,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
                  * store that will be enabled on successful return
                  */
                 if (!handle->size) { /* A, matches D */
-                        event->pending_disable = 1;
+                        event->pending_disable = smp_processor_id();
                         perf_output_wakeup(handle);
                         local_set(&rb->aux_nest, 0);
                         goto err_put;
@@ -480,7 +480,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
 
         if (wakeup) {
                 if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
-                        handle->event->pending_disable = 1;
+                        handle->event->pending_disable = smp_processor_id();
                 perf_output_wakeup(handle);
         }
 
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 3faef4a77f71..51128bea3846 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1449,6 +1449,10 @@ int irq_chip_set_vcpu_affinity_parent(struct irq_data *data, void *vcpu_info)
 int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on)
 {
         data = data->parent_data;
+
+        if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE)
+                return 0;
+
         if (data->chip->irq_set_wake)
                 return data->chip->irq_set_wake(data, on);
 
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 13539e12cd80..9f8a709337cf 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -558,6 +558,7 @@ int __init early_irq_init(void)
                 alloc_masks(&desc[i], node);
                 raw_spin_lock_init(&desc[i].lock);
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
+                mutex_init(&desc[i].request_mutex);
                 desc_set_defaults(i, &desc[i], node, NULL, NULL);
         }
         return arch_early_irq_init();
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 34cdcbedda49..e16766ff184b 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -4689,8 +4689,8 @@ static void free_zapped_rcu(struct rcu_head *ch)
                 return;
 
         raw_local_irq_save(flags);
-        if (!graph_lock())
-                goto out_irq;
+        arch_spin_lock(&lockdep_lock);
+        current->lockdep_recursion = 1;
 
         /* closed head */
         pf = delayed_free.pf + (delayed_free.index ^ 1);
@@ -4702,8 +4702,8 @@ static void free_zapped_rcu(struct rcu_head *ch)
          */
         call_rcu_zapped(delayed_free.pf + delayed_free.index);
 
-        graph_unlock();
-out_irq:
+        current->lockdep_recursion = 0;
+        arch_spin_unlock(&lockdep_lock);
         raw_local_irq_restore(flags);
 }
 
@@ -4744,21 +4744,17 @@ static void lockdep_free_key_range_reg(void *start, unsigned long size)
 {
         struct pending_free *pf;
         unsigned long flags;
-        int locked;
 
         init_data_structures_once();
 
         raw_local_irq_save(flags);
-        locked = graph_lock();
-        if (!locked)
-                goto out_irq;
-
+        arch_spin_lock(&lockdep_lock);
+        current->lockdep_recursion = 1;
         pf = get_pending_free();
         __lockdep_free_key_range(pf, start, size);
         call_rcu_zapped(pf);
-
-        graph_unlock();
-out_irq:
+        current->lockdep_recursion = 0;
+        arch_spin_unlock(&lockdep_lock);
         raw_local_irq_restore(flags);
 
         /*
@@ -4911,9 +4907,8 @@ void lockdep_unregister_key(struct lock_class_key *key)
                 return;
 
         raw_local_irq_save(flags);
-        if (!graph_lock())
-                goto out_irq;
-
+        arch_spin_lock(&lockdep_lock);
+        current->lockdep_recursion = 1;
         pf = get_pending_free();
         hlist_for_each_entry_rcu(k, hash_head, hash_entry) {
                 if (k == key) {
@@ -4925,8 +4920,8 @@ void lockdep_unregister_key(struct lock_class_key *key)
         WARN_ON_ONCE(!found);
         __lockdep_free_key_range(pf, key, 1);
         call_rcu_zapped(pf);
-        graph_unlock();
-out_irq:
+        current->lockdep_recursion = 0;
+        arch_spin_unlock(&lockdep_lock);
         raw_local_irq_restore(flags);
 
         /* Wait until is_dynamic_key() has finished accessing k->hash_entry. */
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index fdab7eb6f351..40bd1e27b1b7 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7784,10 +7784,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
         if (cfs_rq->last_h_load_update == now)
                 return;
 
-        cfs_rq->h_load_next = NULL;
+        WRITE_ONCE(cfs_rq->h_load_next, NULL);
         for_each_sched_entity(se) {
                 cfs_rq = cfs_rq_of(se);
-                cfs_rq->h_load_next = se;
+                WRITE_ONCE(cfs_rq->h_load_next, se);
                 if (cfs_rq->last_h_load_update == now)
                         break;
         }
@@ -7797,7 +7797,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
                 cfs_rq->last_h_load_update = now;
         }
 
-        while ((se = cfs_rq->h_load_next) != NULL) {
+        while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) {
                 load = cfs_rq->h_load;
                 load = div64_ul(load * se->avg.load_avg,
                         cfs_rq_load_avg(cfs_rq) + 1);
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 2c97e8c2d29f..0519a8805aab 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -594,7 +594,7 @@ static ktime_t alarm_timer_remaining(struct k_itimer *timr, ktime_t now)
 {
         struct alarm *alarm = &timr->it.alarm.alarmtimer;
 
-        return ktime_sub(now, alarm->node.expires);
+        return ktime_sub(alarm->node.expires, now);
 }
 
 /**
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 21153e64bf1c..6c24755655c7 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7041,12 +7041,16 @@ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
         buf->private = 0;
 }
 
-static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
+static bool buffer_pipe_buf_get(struct pipe_inode_info *pipe,
                                 struct pipe_buffer *buf)
 {
         struct buffer_ref *ref = (struct buffer_ref *)buf->private;
 
+        if (ref->ref > INT_MAX/2)
+                return false;
+
         ref->ref++;
+        return true;
 }
 
 /* Pipe buffer operations for a buffer. */
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ea36dc355da1..b396d328a764 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1528,6 +1528,7 @@ EXPORT_SYMBOL(csum_and_copy_to_iter);
 size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
                 struct iov_iter *i)
 {
+#ifdef CONFIG_CRYPTO
         struct ahash_request *hash = hashp;
         struct scatterlist sg;
         size_t copied;
@@ -1537,6 +1538,9 @@ size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
         ahash_request_set_crypt(hash, &sg, NULL, copied);
         crypto_ahash_update(hash);
         return copied;
+#else
+        return 0;
+#endif
 }
 EXPORT_SYMBOL(hash_and_copy_to_iter);
 
diff --git a/mm/gup.c b/mm/gup.c
index f84e22685aaa..91819b8ad9cc 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -160,8 +160,12 @@ retry:
                 goto retry;
         }
 
-        if (flags & FOLL_GET)
-                get_page(page);
+        if (flags & FOLL_GET) {
+                if (unlikely(!try_get_page(page))) {
+                        page = ERR_PTR(-ENOMEM);
+                        goto out;
+                }
+        }
         if (flags & FOLL_TOUCH) {
                 if ((flags & FOLL_WRITE) &&
                     !pte_dirty(pte) && !PageDirty(page))
@@ -298,7 +302,10 @@ retry_locked:
                         if (pmd_trans_unstable(pmd))
                                 ret = -EBUSY;
                 } else {
-                        get_page(page);
+                        if (unlikely(!try_get_page(page))) {
+                                spin_unlock(ptl);
+                                return ERR_PTR(-ENOMEM);
+                        }
                         spin_unlock(ptl);
                         lock_page(page);
                         ret = split_huge_page(page);
@@ -500,7 +507,10 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
                 if (is_device_public_page(*page))
                         goto unmap;
         }
-        get_page(*page);
+        if (unlikely(!try_get_page(*page))) {
+                ret = -ENOMEM;
+                goto unmap;
+        }
 out:
         ret = 0;
 unmap:
@@ -1545,6 +1555,20 @@ static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
         }
 }
 
+/*
+ * Return the compund head page with ref appropriately incremented,
+ * or NULL if that failed.
+ */
+static inline struct page *try_get_compound_head(struct page *page, int refs)
+{
+        struct page *head = compound_head(page);
+        if (WARN_ON_ONCE(page_ref_count(head) < 0))
+                return NULL;
+        if (unlikely(!page_cache_add_speculative(head, refs)))
+                return NULL;
+        return head;
+}
+
 #ifdef CONFIG_ARCH_HAS_PTE_SPECIAL
 static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
                          int write, struct page **pages, int *nr)
@@ -1579,9 +1603,9 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
 
                 VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
                 page = pte_page(pte);
-                head = compound_head(page);
 
-                if (!page_cache_get_speculative(head))
+                head = try_get_compound_head(page, 1);
+                if (!head)
                         goto pte_unmap;
 
                 if (unlikely(pte_val(pte) != pte_val(*ptep))) {
@@ -1720,8 +1744,8 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pmd_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pmd_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
@@ -1758,8 +1782,8 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pud_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pud_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
@@ -1795,8 +1819,8 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
                 refs++;
         } while (addr += PAGE_SIZE, addr != end);
 
-        head = compound_head(pgd_page(orig));
-        if (!page_cache_add_speculative(head, refs)) {
+        head = try_get_compound_head(pgd_page(orig), refs);
+        if (!head) {
                 *nr -= refs;
                 return 0;
         }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 97b1e0290c66..6cdc7b2d9100 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4299,6 +4299,19 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
 
                 pfn_offset = (vaddr & ~huge_page_mask(h)) >> PAGE_SHIFT;
                 page = pte_page(huge_ptep_get(pte));
+
+                /*
+                 * Instead of doing 'try_get_page()' below in the same_page
+                 * loop, just check the count once here.
+                 */
+                if (unlikely(page_count(page) <= 0)) {
+                        if (pages) {
+                                spin_unlock(ptl);
+                                remainder = 0;
+                                err = -ENOMEM;
+                                break;
+                        }
+                }
 same_page:
                 if (pages) {
                         pages[i] = mem_map_offset(page, pfn_offset);
diff --git a/net/atm/lec.c b/net/atm/lec.c
index d7f5cf5b7594..ad4f829193f0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -710,7 +710,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
 static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
 {
-        if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
+        if (arg < 0 || arg >= MAX_LEC_ITF)
+                return -EINVAL;
+        arg = array_index_nospec(arg, MAX_LEC_ITF);
+        if (!dev_lec[arg])
                 return -EINVAL;
         vcc->proto_data = dev_lec[arg];
         return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
@@ -728,6 +731,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                 i = arg;
         if (arg >= MAX_LEC_ITF)
                 return -EINVAL;
+        i = array_index_nospec(arg, MAX_LEC_ITF);
         if (!dev_lec[i]) {
                 int size;
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 9a580999ca57..d892b7c3cc42 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -523,12 +523,12 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
         struct sock *sk = sock->sk;
         int err = 0;
 
-        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
-
         if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
             addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
+        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
+
         lock_sock(sk);
 
         if (sk->sk_state != BT_OPEN) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 86dc46f6a68f..014af7efef25 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -196,13 +196,10 @@ static void __br_handle_local_finish(struct sk_buff *skb)
 /* note: already called with rcu_read_lock */
 static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-
         __br_handle_local_finish(skb);
 
-        BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
-        br_pass_frame_up(skb);
-        return 0;
+        /* return 1 to signal the okfn() was called so it's ok to use the skb */
+        return 1;
 }
 
 static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)
@@ -333,10 +330,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                                 goto forward;
                 }
 
-                /* Deliver packet to local host only */
-                NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev),
-                        NULL, skb, skb->dev, NULL, br_handle_local_finish);
-                return RX_HANDLER_CONSUMED;
+                /* The else clause should be hit when nf_hook():
+                 *   - returns < 0 (drop/error)
+                 *   - returns = 0 (stolen/nf_queue)
+                 * Thus return 1 from the okfn() to signal the skb is ok to pass
+                 */
+                if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
+                            dev_net(skb->dev), NULL, skb, skb->dev, NULL,
+                            br_handle_local_finish) == 1) {
+                        return RX_HANDLER_PASS;
+                } else {
+                        return RX_HANDLER_CONSUMED;
+                }
         }
 
 forward:
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 812560d7f7a2..c2a30f79a9d0 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2013,7 +2013,8 @@ static void br_multicast_start_querier(struct net_bridge *br,
 
         __br_multicast_open(br, query);
 
-        list_for_each_entry(port, &br->port_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(port, &br->port_list, list) {
                 if (port->state == BR_STATE_DISABLED ||
                     port->state == BR_STATE_BLOCKING)
                         continue;
@@ -2025,6 +2026,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
                         br_multicast_enable(&port->ip6_own_query);
 #endif
         }
+        rcu_read_unlock();
 }
 
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 4f9f59eba8b4..8dfcc2d285d8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1441,7 +1441,7 @@ static int br_fill_info(struct sk_buff *skb, const struct net_device *brdev)
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_ENABLED,
                        br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) ||
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_PER_PORT,
-                       br_opt_get(br, IFLA_BR_VLAN_STATS_PER_PORT)))
+                       br_opt_get(br, BROPT_VLAN_STATS_PER_PORT)))
                 return -EMSGSIZE;
 #endif
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/net/core/dev.c b/net/core/dev.c
index b430f851f377..22f2640f559a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1184,7 +1184,21 @@ int dev_change_name(struct net_device *dev, const char *newname)
         BUG_ON(!dev_net(dev));
 
         net = dev_net(dev);
-        if (dev->flags & IFF_UP)
+
+        /* Some auto-enslaved devices e.g. failover slaves are
+         * special, as userspace might rename the device after
+         * the interface had been brought up and running since
+         * the point kernel initiated auto-enslavement. Allow
+         * live name change even when these slave devices are
+         * up and running.
+         *
+         * Typically, users of these auto-enslaving devices
+         * don't actually care about slave name change, as
+         * they are supposed to operate on master interface
+         * directly.
+         */
+        if (dev->flags & IFF_UP &&
+            likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
                 return -EBUSY;
 
         write_seqcount_begin(&devnet_rename_seq);
diff --git a/net/core/failover.c b/net/core/failover.c
index 4a92a98ccce9..b5cd3c727285 100644
--- a/net/core/failover.c
+++ b/net/core/failover.c
@@ -80,14 +80,14 @@ static int failover_slave_register(struct net_device *slave_dev)
                 goto err_upper_link;
         }
 
-        slave_dev->priv_flags |= IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags |= (IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_register &&
             !fops->slave_register(slave_dev, failover_dev))
                 return NOTIFY_OK;
 
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 err_upper_link:
         netdev_rx_handler_unregister(slave_dev);
 done:
@@ -121,7 +121,7 @@ int failover_slave_unregister(struct net_device *slave_dev)
 
         netdev_rx_handler_unregister(slave_dev);
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_unregister &&
             !fops->slave_unregister(slave_dev, failover_dev))
diff --git a/net/core/filter.c b/net/core/filter.c
index 95a27fdf9a40..07687e2a2e66 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4462,6 +4462,8 @@ BPF_CALL_3(bpf_bind, struct bpf_sock_addr_kern *, ctx, struct sockaddr *, addr,
          * Only binding to IP is supported.
          */
         err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return err;
         if (addr->sa_family == AF_INET) {
                 if (addr_len < sizeof(struct sockaddr_in))
                         return err;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c14f0dc0157c..e4fd68389d6f 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1747,20 +1747,16 @@ int netdev_register_kobject(struct net_device *ndev)
 
         error = device_add(dev);
         if (error)
-                goto error_put_device;
+                return error;
 
         error = register_queue_kobjects(ndev);
-        if (error)
-                goto error_device_del;
+        if (error) {
+                device_del(dev);
+                return error;
+        }
 
         pm_runtime_set_memalloc_noio(dev, true);
 
-        return 0;
-
-error_device_del:
-        device_del(dev);
-error_put_device:
-        put_device(dev);
         return error;
 }
 
diff --git a/net/core/ptp_classifier.c b/net/core/ptp_classifier.c
index 703cf76aa7c2..7109c168b5e0 100644
--- a/net/core/ptp_classifier.c
+++ b/net/core/ptp_classifier.c
@@ -185,9 +185,10 @@ void __init ptp_classifier_init(void)
                 { 0x16,  0,  0, 0x00000000 },
                 { 0x06,  0,  0, 0x00000000 },
         };
-        struct sock_fprog_kern ptp_prog = {
-                .len = ARRAY_SIZE(ptp_filter), .filter = ptp_filter,
-        };
+        struct sock_fprog_kern ptp_prog;
+
+        ptp_prog.len = ARRAY_SIZE(ptp_filter);
+        ptp_prog.filter = ptp_filter;
 
         BUG_ON(bpf_prog_create(&ptp_insns, &ptp_prog));
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f9b964fd4e4d..5fa5bf3e9945 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4951,7 +4951,7 @@ static int rtnl_valid_stats_req(const struct nlmsghdr *nlh, bool strict_check,
 {
         struct if_stats_msg *ifsm;
 
-        if (nlh->nlmsg_len < sizeof(*ifsm)) {
+        if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifsm))) {
                 NL_SET_ERR_MSG(extack, "Invalid header for stats dump");
                 return -EINVAL;
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9901f5322852..a083e188374f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5082,7 +5082,8 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
-        int mac_len;
+        int mac_len, meta_len;
+        void *meta;
 
         if (skb_cow(skb, skb_headroom(skb)) < 0) {
                 kfree_skb(skb);
@@ -5094,6 +5095,13 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
                 memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
                         mac_len - VLAN_HLEN - ETH_TLEN);
         }
+
+        meta_len = skb_metadata_len(skb);
+        if (meta_len) {
+                meta = skb_metadata_end(skb) - meta_len;
+                memmove(meta + VLAN_HLEN, meta, meta_len);
+        }
+
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 782343bb925b..067878a1e4c5 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -348,7 +348,7 @@ static int sock_get_timeout(long timeo, void *optval, bool old_timeval)
                 tv.tv_usec = ((timeo % HZ) * USEC_PER_SEC) / HZ;
         }
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32 = { tv.tv_sec, tv.tv_usec };
                 *(struct old_timeval32 *)optval = tv32;
                 return sizeof(tv32);
@@ -372,7 +372,7 @@ static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen, bool
 {
         struct __kernel_sock_timeval tv;
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32;
 
                 if (optlen < sizeof(tv32))
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index b038f563baa4..1ca1586a7e46 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -121,6 +121,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         struct guehdr *guehdr;
         void *data;
         u16 doffset = 0;
+        u8 proto_ctype;
 
         if (!fou)
                 return 1;
@@ -210,13 +211,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         if (unlikely(guehdr->control))
                 return gue_control_message(skb, guehdr);
 
+        proto_ctype = guehdr->proto_ctype;
         __skb_pull(skb, sizeof(struct udphdr) + hdrlen);
         skb_reset_transport_header(skb);
 
         if (iptunnel_pull_offloads(skb))
                 goto drop;
 
-        return -guehdr->proto_ctype;
+        return -proto_ctype;
 
 drop:
         kfree_skb(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index efa6a36cbfff..d9b5aa2290d6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1200,9 +1200,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 
 static void ipv4_link_failure(struct sk_buff *skb)
 {
+        struct ip_options opt;
         struct rtable *rt;
+        int res;
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+        /* Recompile ip options since IPCB may not be valid anymore.
+         */
+        memset(&opt, 0, sizeof(opt));
+        opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
+
+        rcu_read_lock();
+        res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+        rcu_read_unlock();
+
+        if (res)
+                return;
+
+        __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
 
         rt = skb_rtable(skb);
         if (rt)
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 359da68d7c06..477cb4aa456c 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -49,9 +49,8 @@
 #define DCTCP_MAX_ALPHA 1024U
 
 struct dctcp {
-        u32 acked_bytes_ecn;
-        u32 acked_bytes_total;
-        u32 prior_snd_una;
+        u32 old_delivered;
+        u32 old_delivered_ce;
         u32 prior_rcv_nxt;
         u32 dctcp_alpha;
         u32 next_seq;
@@ -73,8 +72,8 @@ static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
 {
         ca->next_seq = tp->snd_nxt;
 
-        ca->acked_bytes_ecn = 0;
-        ca->acked_bytes_total = 0;
+        ca->old_delivered = tp->delivered;
+        ca->old_delivered_ce = tp->delivered_ce;
 }
 
 static void dctcp_init(struct sock *sk)
@@ -86,7 +85,6 @@ static void dctcp_init(struct sock *sk)
              sk->sk_state == TCP_CLOSE)) {
                 struct dctcp *ca = inet_csk_ca(sk);
 
-                ca->prior_snd_una = tp->snd_una;
                 ca->prior_rcv_nxt = tp->rcv_nxt;
 
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
@@ -118,37 +116,25 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct dctcp *ca = inet_csk_ca(sk);
-        u32 acked_bytes = tp->snd_una - ca->prior_snd_una;
-
-        /* If ack did not advance snd_una, count dupack as MSS size.
-         * If ack did update window, do not count it at all.
-         */
-        if (acked_bytes == 0 && !(flags & CA_ACK_WIN_UPDATE))
-                acked_bytes = inet_csk(sk)->icsk_ack.rcv_mss;
-        if (acked_bytes) {
-                ca->acked_bytes_total += acked_bytes;
-                ca->prior_snd_una = tp->snd_una;
-
-                if (flags & CA_ACK_ECE)
-                        ca->acked_bytes_ecn += acked_bytes;
-        }
 
         /* Expired RTT */
         if (!before(tp->snd_una, ca->next_seq)) {
-                u64 bytes_ecn = ca->acked_bytes_ecn;
+                u32 delivered_ce = tp->delivered_ce - ca->old_delivered_ce;
                 u32 alpha = ca->dctcp_alpha;
 
                 /* alpha = (1 - g) * alpha + g * F */
 
                 alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
-                if (bytes_ecn) {
+                if (delivered_ce) {
+                        u32 delivered = tp->delivered - ca->old_delivered;
+
                         /* If dctcp_shift_g == 1, a 32bit value would overflow
-                         * after 8 Mbytes.
+                         * after 8 M packets.
                          */
-                        bytes_ecn <<= (10 - dctcp_shift_g);
-                        do_div(bytes_ecn, max(1U, ca->acked_bytes_total));
+                        delivered_ce <<= (10 - dctcp_shift_g);
+                        delivered_ce /= max(1U, delivered);
 
-                        alpha = min(alpha + (u32)bytes_ecn, DCTCP_MAX_ALPHA);
+                        alpha = min(alpha + delivered_ce, DCTCP_MAX_ALPHA);
                 }
                 /* dctcp_alpha can be read from dctcp_get_info() without
                  * synchro, so we ask compiler to not use dctcp_alpha
@@ -200,6 +186,7 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                              union tcp_cc_info *info)
 {
         const struct dctcp *ca = inet_csk_ca(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Fill it also in case of VEGASINFO due to req struct limits.
          * We can still correctly retrieve it later.
@@ -211,8 +198,10 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                         info->dctcp.dctcp_enabled = 1;
                         info->dctcp.dctcp_ce_state = (u16) ca->ce_state;
                         info->dctcp.dctcp_alpha = ca->dctcp_alpha;
-                        info->dctcp.dctcp_ab_ecn = ca->acked_bytes_ecn;
-                        info->dctcp.dctcp_ab_tot = ca->acked_bytes_total;
+                        info->dctcp.dctcp_ab_ecn = tp->mss_cache *
+                                                   (tp->delivered_ce - ca->old_delivered_ce);
+                        info->dctcp.dctcp_ab_tot = tp->mss_cache *
+                                                   (tp->delivered - ca->old_delivered);
                 }
 
                 *attr = INET_DIAG_DCTCPINFO;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6660ce2a7333..97671bff597a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -402,11 +402,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
 static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        int room;
+
+        room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
 
         /* Check #1 */
-        if (tp->rcv_ssthresh < tp->window_clamp &&
-            (int)tp->rcv_ssthresh < tcp_space(sk) &&
-            !tcp_under_memory_pressure(sk)) {
+        if (room > 0 && !tcp_under_memory_pressure(sk)) {
                 int incr;
 
                 /* Check #2. Increase window, if skb with such overhead
@@ -419,8 +420,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 
                 if (incr) {
                         incr = max_t(int, incr, 2 * skb->len);
-                        tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
-                                               tp->window_clamp);
+                        tp->rcv_ssthresh += min(room, incr);
                         inet_csk(sk)->icsk_ack.quick |= 1;
                 }
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a77c004d67fb..9ece8067a59b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2331,6 +2331,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
                 rcu_read_lock();
                 from = rcu_dereference(rt6->from);
+                if (!from) {
+                        rcu_read_unlock();
+                        return;
+                }
                 nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
                 if (nrt6) {
                         rt6_do_update_pmtu(nrt6, mtu);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d538fafaf4a9..2464fba569b4 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1045,6 +1045,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
                              int addr_len)
 {
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         /* The following checks are replicated from __ip6_datagram_connect()
          * and intended to prevent BPF program called below from accessing
          * bytes that are out of the bound specified by user in addr_len.
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b99e73a7e7e0..2017b7d780f5 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -320,14 +320,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         struct llc_sap *sap;
         int rc = -EINVAL;
 
-        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
-
         lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
         if (unlikely(addr->sllc_family != AF_LLC))
                 goto out;
+        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
         rc = -ENODEV;
         rcu_read_lock();
         if (sk->sk_bound_dev_if) {
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 28d022a3eee3..ae4f0be3b393 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1195,6 +1195,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
 
+        if (local->in_reconfig)
+                return;
+
         if (!check_sdata_in_driver(sdata))
                 return;
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4700718e010f..37e372896230 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -167,8 +167,10 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                  * The driver doesn't know anything about VLAN interfaces.
                  * Hence, don't send GTKs for VLAN interfaces to the driver.
                  */
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                        ret = 1;
                         goto out_unsupported;
+                }
         }
 
         ret = drv_set_key(key->local, SET_KEY, sdata,
@@ -213,11 +215,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 /* all of these we can do in software - if driver can */
                 if (ret == 1)
                         return 0;
-                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL)) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                return 0;
+                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL))
                         return -EINVAL;
-                }
                 return 0;
         default:
                 return -EINVAL;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 95eb5064fa91..b76a2aefa9ec 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
 static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
 {
         /* Use last four bytes of hw addr as hash index */
-        return jhash_1word(*(u32 *)(addr+2), seed);
+        return jhash_1word(__get_unaligned_cpu32((u8 *)addr + 2), seed);
 }
 
 static const struct rhashtable_params mesh_rht_params = {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7f8d93401ce0..bf0b187f994e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1568,7 +1568,15 @@ static void sta_ps_start(struct sta_info *sta)
                 return;
 
         for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
-                if (txq_has_queue(sta->sta.txq[tid]))
+                struct ieee80211_txq *txq = sta->sta.txq[tid];
+                struct txq_info *txqi = to_txq_info(txq);
+
+                spin_lock(&local->active_txq_lock[txq->ac]);
+                if (!list_empty(&txqi->schedule_order))
+                        list_del_init(&txqi->schedule_order);
+                spin_unlock(&local->active_txq_lock[txq->ac]);
+
+                if (txq_has_queue(txq))
                         set_bit(tid, &sta->txq_buffered_tids);
                 else
                         clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/net/mac80211/trace_msg.h b/net/mac80211/trace_msg.h
index 366b9e6f043e..40141df09f25 100644
--- a/net/mac80211/trace_msg.h
+++ b/net/mac80211/trace_msg.h
@@ -1,4 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Portions of this file
+ * Copyright (C) 2019 Intel Corporation
+ */
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 
 #if !defined(__MAC80211_MSG_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
@@ -11,7 +16,7 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
 
-#define MAX_MSG_LEN     100
+#define MAX_MSG_LEN     120
 
 DECLARE_EVENT_CLASS(mac80211_msg_event,
         TP_PROTO(struct va_format *vaf),
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8a49a74c0a37..2e816dd67be7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3221,6 +3221,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         u8 max_subframes = sta->sta.max_amsdu_subframes;
         int max_frags = local->hw.max_tx_fragments;
         int max_amsdu_len = sta->sta.max_amsdu_len;
+        int orig_truesize;
         __be16 len;
         void *data;
         bool ret = false;
@@ -3261,6 +3262,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (!head || skb_is_gso(head))
                 goto out;
 
+        orig_truesize = head->truesize;
         orig_len = head->len;
 
         if (skb->len + head->len > max_amsdu_len)
@@ -3318,6 +3320,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         *frag_tail = skb;
 
 out_recalc:
+        fq->memory_usage += head->truesize - orig_truesize;
         if (head->len != orig_len) {
                 flow->backlog += head->len - orig_len;
                 tin->backlog_bytes += head->len - orig_len;
@@ -3646,16 +3649,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_txq *ret = NULL;
         struct txq_info *txqi = NULL;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
  begin:
         txqi = list_first_entry_or_null(&local->active_txqs[ac],
                                         struct txq_info,
                                         schedule_order);
         if (!txqi)
-                return NULL;
+                goto out;
 
         if (txqi->txq.sta) {
                 struct sta_info *sta = container_of(txqi->txq.sta,
@@ -3672,24 +3676,30 @@ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 
 
         if (txqi->schedule_round == local->schedule_round[ac])
-                return NULL;
+                goto out;
 
         list_del_init(&txqi->schedule_order);
         txqi->schedule_round = local->schedule_round[ac];
-        return &txqi->txq;
+        ret = &txqi->txq;
+
+out:
+        spin_unlock_bh(&local->active_txq_lock[ac]);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_next_txq);
 
-void ieee80211_return_txq(struct ieee80211_hw *hw,
-                          struct ieee80211_txq *txq)
+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+                              struct ieee80211_txq *txq,
+                              bool force)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct txq_info *txqi = to_txq_info(txq);
 
-        lockdep_assert_held(&local->active_txq_lock[txq->ac]);
+        spin_lock_bh(&local->active_txq_lock[txq->ac]);
 
         if (list_empty(&txqi->schedule_order) &&
-            (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
+            (force || !skb_queue_empty(&txqi->frags) ||
+             txqi->tin.backlog_packets)) {
                 /* If airtime accounting is active, always enqueue STAs at the
                  * head of the list to ensure that they only get moved to the
                  * back by the airtime DRR scheduler once they have a negative
@@ -3706,20 +3716,10 @@ void ieee80211_return_txq(struct ieee80211_hw *hw,
                         list_add_tail(&txqi->schedule_order,
                                       &local->active_txqs[txq->ac]);
         }
-}
-EXPORT_SYMBOL(ieee80211_return_txq);
 
-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
-                            struct ieee80211_txq *txq)
-        __acquires(txq_lock) __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
-        spin_lock_bh(&local->active_txq_lock[txq->ac]);
-        ieee80211_return_txq(hw, txq);
         spin_unlock_bh(&local->active_txq_lock[txq->ac]);
 }
-EXPORT_SYMBOL(ieee80211_schedule_txq);
+EXPORT_SYMBOL(__ieee80211_schedule_txq);
 
 bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
                                 struct ieee80211_txq *txq)
@@ -3729,7 +3729,7 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
         struct sta_info *sta;
         u8 ac = txq->ac;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
         if (!txqi->txq.sta)
                 goto out;
@@ -3759,34 +3759,27 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
 
         sta->airtime[ac].deficit += sta->airtime_weight;
         list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return false;
 out:
         if (!list_empty(&txqi->schedule_order))
                 list_del_init(&txqi->schedule_order);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return true;
 }
 EXPORT_SYMBOL(ieee80211_txq_may_transmit);
 
 void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
-        __acquires(txq_lock)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
         spin_lock_bh(&local->active_txq_lock[ac]);
         local->schedule_round[ac]++;
-}
-EXPORT_SYMBOL(ieee80211_txq_schedule_start);
-
-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
-        __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
         spin_unlock_bh(&local->active_txq_lock[ac]);
 }
-EXPORT_SYMBOL(ieee80211_txq_schedule_end);
+EXPORT_SYMBOL(ieee80211_txq_schedule_start);
 
 void __ieee80211_subif_start_xmit(struct sk_buff *skb,
                                   struct net_device *dev,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f28e937320a3..216ab915dd54 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -988,7 +988,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
         struct netlink_sock *nlk = nlk_sk(sk);
         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
         int err = 0;
-        unsigned long groups = nladdr->nl_groups;
+        unsigned long groups;
         bool bound;
 
         if (addr_len < sizeof(struct sockaddr_nl))
@@ -996,6 +996,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 
         if (nladdr->nl_family != AF_NETLINK)
                 return -EINVAL;
+        groups = nladdr->nl_groups;
 
         /* Only superuser is allowed to listen multicasts */
         if (groups) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 1d3144d19903..71ffd1a6dc7c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1392,18 +1392,22 @@ static int __init nr_proto_init(void)
         int i;
         int rc = proto_register(&nr_proto, 0);
 
-        if (rc != 0)
-                goto out;
+        if (rc)
+                return rc;
 
         if (nr_ndevs > 0x7fffffff/sizeof(struct net_device *)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - nr_ndevs parameter to large\n");
-                return -1;
+                pr_err("NET/ROM: %s - nr_ndevs parameter too large\n",
+                       __func__);
+                rc = -EINVAL;
+                goto unregister_proto;
         }
 
         dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
-        if (dev_nr == NULL) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
-                return -1;
+        if (!dev_nr) {
+                pr_err("NET/ROM: %s - unable to allocate device array\n",
+                       __func__);
+                rc = -ENOMEM;
+                goto unregister_proto;
         }
 
         for (i = 0; i < nr_ndevs; i++) {
@@ -1413,13 +1417,13 @@ static int __init nr_proto_init(void)
                 sprintf(name, "nr%d", i);
                 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, nr_setup);
                 if (!dev) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
+                        rc = -ENOMEM;
                         goto fail;
                 }
 
                 dev->base_addr = i;
-                if (register_netdev(dev)) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register network device\n");
+                rc = register_netdev(dev);
+                if (rc) {
                         free_netdev(dev);
                         goto fail;
                 }
@@ -1427,36 +1431,64 @@ static int __init nr_proto_init(void)
                 dev_nr[i] = dev;
         }
 
-        if (sock_register(&nr_family_ops)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register socket family\n");
+        rc = sock_register(&nr_family_ops);
+        if (rc)
                 goto fail;
-        }
 
-        register_netdevice_notifier(&nr_dev_notifier);
+        rc = register_netdevice_notifier(&nr_dev_notifier);
+        if (rc)
+                goto out_sock;
 
         ax25_register_pid(&nr_pid);
         ax25_linkfail_register(&nr_linkfail_notifier);
 
 #ifdef CONFIG_SYSCTL
-        nr_register_sysctl();
+        rc = nr_register_sysctl();
+        if (rc)
+                goto out_sysctl;
 #endif
 
         nr_loopback_init();
 
-        proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops);
-        proc_create_seq("nr_neigh", 0444, init_net.proc_net, &nr_neigh_seqops);
-        proc_create_seq("nr_nodes", 0444, init_net.proc_net, &nr_node_seqops);
-out:
-        return rc;
+        rc = -ENOMEM;
+        if (!proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops))
+                goto proc_remove1;
+        if (!proc_create_seq("nr_neigh", 0444, init_net.proc_net,
+                             &nr_neigh_seqops))
+                goto proc_remove2;
+        if (!proc_create_seq("nr_nodes", 0444, init_net.proc_net,
+                             &nr_node_seqops))
+                goto proc_remove3;
+
+        return 0;
+
+proc_remove3:
+        remove_proc_entry("nr_neigh", init_net.proc_net);
+proc_remove2:
+        remove_proc_entry("nr", init_net.proc_net);
+proc_remove1:
+
+        nr_loopback_clear();
+        nr_rt_free();
+
+#ifdef CONFIG_SYSCTL
+        nr_unregister_sysctl();
+out_sysctl:
+#endif
+        ax25_linkfail_release(&nr_linkfail_notifier);
+        ax25_protocol_release(AX25_P_NETROM);
+        unregister_netdevice_notifier(&nr_dev_notifier);
+out_sock:
+        sock_unregister(PF_NETROM);
 fail:
         while (--i >= 0) {
                 unregister_netdev(dev_nr[i]);
                 free_netdev(dev_nr[i]);
         }
         kfree(dev_nr);
+unregister_proto:
         proto_unregister(&nr_proto);
-        rc = -1;
-        goto out;
+        return rc;
 }
 
 module_init(nr_proto_init);
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index 215ad22a9647..93d13f019981 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -70,7 +70,7 @@ static void nr_loopback_timer(struct timer_list *unused)
         }
 }
 
-void __exit nr_loopback_clear(void)
+void nr_loopback_clear(void)
 {
         del_timer_sync(&loopback_timer);
         skb_queue_purge(&loopback_queue);
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 6485f593e2f0..b76aa668a94b 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -953,7 +953,7 @@ const struct seq_operations nr_neigh_seqops = {
 /*
  *      Free all memory associated with the nodes and routes lists.
  */
-void __exit nr_rt_free(void)
+void nr_rt_free(void)
 {
         struct nr_neigh *s = NULL;
         struct nr_node  *t = NULL;
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index ba1c368b3f18..771011b84270 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -146,9 +146,12 @@ static struct ctl_table nr_table[] = {
         { }
 };
 
-void __init nr_register_sysctl(void)
+int __init nr_register_sysctl(void)
 {
         nr_table_header = register_net_sysctl(&init_net, "net/netrom", nr_table);
+        if (!nr_table_header)
+                return -ENOMEM;
+        return 0;
 }
 
 void nr_unregister_sysctl(void)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index d6cc97fbbbb0..2b969f99ef13 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -543,6 +543,9 @@ static int rds_connect(struct socket *sock, struct sockaddr *uaddr,
         struct rds_sock *rs = rds_sk_to_rs(sk);
         int ret = 0;
 
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
+
         lock_sock(sk);
 
         switch (uaddr->sa_family) {
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 17c9d9f0c848..0f4398e7f2a7 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -173,6 +173,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         /* We allow an RDS socket to be bound to either IPv4 or IPv6
          * address.
          */
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         if (uaddr->sa_family == AF_INET) {
                 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 96f2952bbdfd..ae8c5d7f3bf1 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -135,7 +135,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr;
         struct rxrpc_local *local;
         struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-        u16 service_id = srx->srx_service;
+        u16 service_id;
         int ret;
 
         _enter("%p,%p,%d", rx, saddr, len);
@@ -143,6 +143,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         ret = rxrpc_validate_address(rx, srx, len);
         if (ret < 0)
                 goto error;
+        service_id = srx->srx_service;
 
         lock_sock(&rx->sk);
 
@@ -370,18 +371,22 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * rxrpc_kernel_check_life - Check to see whether a call is still alive
  * @sock: The socket the call is on
  * @call: The call to check
+ * @_life: Where to store the life value
  *
  * Allow a kernel service to find out whether a call is still alive - ie. we're
- * getting ACKs from the server.  Returns a number representing the life state
- * which can be compared to that returned by a previous call.
+ * getting ACKs from the server.  Passes back in *_life a number representing
+ * the life state which can be compared to that returned by a previous call and
+ * return true if the call is still alive.
  *
  * If the life state stalls, rxrpc_kernel_probe_life() should be called and
  * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(const struct socket *sock,
-                            const struct rxrpc_call *call)
+bool rxrpc_kernel_check_life(const struct socket *sock,
+                             const struct rxrpc_call *call,
+                             u32 *_life)
 {
-        return call->acks_latest;
+        *_life = call->acks_latest;
+        return call->state != RXRPC_CALL_COMPLETE;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 4b1a534d290a..062ca9dc29b8 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -654,6 +654,7 @@ struct rxrpc_call {
         u8                      ackr_reason;    /* reason to ACK */
         u16                     ackr_skew;      /* skew on packet being ACK'd */
         rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
+        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
         rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
         rxrpc_seq_t             ackr_consumed;  /* Highest packet shown consumed */
         rxrpc_seq_t             ackr_seen;      /* Highest packet shown seen */
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index b6fca8ebb117..8d31fb4c51e1 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -153,7 +153,8 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
  * pass a connection-level abort onto all calls on that connection
  */
 static void rxrpc_abort_calls(struct rxrpc_connection *conn,
-                              enum rxrpc_call_completion compl)
+                              enum rxrpc_call_completion compl,
+                              rxrpc_serial_t serial)
 {
         struct rxrpc_call *call;
         int i;
@@ -173,6 +174,9 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn,
                                                   call->call_id, 0,
                                                   conn->abort_code,
                                                   conn->error);
+                        else
+                                trace_rxrpc_rx_abort(call, serial,
+                                                     conn->abort_code);
                         if (rxrpc_set_call_completion(call, compl,
                                                       conn->abort_code,
                                                       conn->error))
@@ -213,8 +217,6 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         conn->state = RXRPC_CONN_LOCALLY_ABORTED;
         spin_unlock_bh(&conn->state_lock);
 
-        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED);
-
         msg.msg_name    = &conn->params.peer->srx.transport;
         msg.msg_namelen = conn->params.peer->srx.transport_len;
         msg.msg_control = NULL;
@@ -242,6 +244,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         len = iov[0].iov_len + iov[1].iov_len;
 
         serial = atomic_inc_return(&conn->serial);
+        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED, serial);
         whdr.serial = htonl(serial);
         _proto("Tx CONN ABORT %%%u { %d }", serial, conn->abort_code);
 
@@ -321,7 +324,7 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 conn->error = -ECONNABORTED;
                 conn->abort_code = abort_code;
                 conn->state = RXRPC_CONN_REMOTELY_ABORTED;
-                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED);
+                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED, sp->hdr.serial);
                 return -ECONNABORTED;
 
         case RXRPC_PACKET_TYPE_CHALLENGE:
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 9128aa0e40aa..4c6f9d0a00e7 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                 u8 acks[RXRPC_MAXACKS];
         } buf;
         rxrpc_serial_t acked_serial;
-        rxrpc_seq_t first_soft_ack, hard_ack;
+        rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
         int nr_acks, offset, ioffset;
 
         _enter("");
@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         acked_serial = ntohl(buf.ack.serial);
         first_soft_ack = ntohl(buf.ack.firstPacket);
+        prev_pkt = ntohl(buf.ack.previousPacket);
         hard_ack = first_soft_ack - 1;
         nr_acks = buf.ack.nAcks;
         summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
                               buf.ack.reason : RXRPC_ACK__INVALID);
 
         trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
-                           first_soft_ack, ntohl(buf.ack.previousPacket),
+                           first_soft_ack, prev_pkt,
                            summary.ack_reason, nr_acks);
 
         if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                                   rxrpc_propose_ack_respond_to_ack);
         }
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (outside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 return;
 
         buf.info.rxMTU = 0;
@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         spin_lock(&call->input_lock);
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (inside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 goto out;
         call->acks_latest_ts = skb->tstamp;
         call->acks_latest = sp->hdr.serial;
 
+        call->ackr_first_seq = first_soft_ack;
+        call->ackr_prev_seq = prev_pkt;
+
         /* Parse rwind and mtu sizes if provided. */
         if (buf.info.rxMTU)
                 rxrpc_input_ackinfo(call, skb, &buf.info);
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index bc05af89fc38..6e84d878053c 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -157,6 +157,11 @@ void rxrpc_error_report(struct sock *sk)
 
         _enter("%p{%d}", sk, local->debug_id);
 
+        /* Clear the outstanding error value on the socket so that it doesn't
+         * cause kernel_sendmsg() to return it later.
+         */
+        sock_error(sk);
+
         skb = sock_dequeue_err_skb(sk);
         if (!skb) {
                 _leave("UDP socket errqueue empty");
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 46c9312085b1..bec64deb7b0a 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -152,12 +152,13 @@ static void rxrpc_notify_end_tx(struct rxrpc_sock *rx, struct rxrpc_call *call,
 }
 
 /*
- * Queue a DATA packet for transmission, set the resend timeout and send the
- * packet immediately
+ * Queue a DATA packet for transmission, set the resend timeout and send
+ * the packet immediately.  Returns the error from rxrpc_send_data_packet()
+ * in case the caller wants to do something with it.
  */
-static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
-                               struct sk_buff *skb, bool last,
-                               rxrpc_notify_end_tx_t notify_end_tx)
+static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+                              struct sk_buff *skb, bool last,
+                              rxrpc_notify_end_tx_t notify_end_tx)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned long now;
@@ -250,7 +251,8 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
 
 out:
         rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
-        _leave("");
+        _leave(" = %d", ret);
+        return ret;
 }
 
 /*
@@ -423,9 +425,10 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                         if (ret < 0)
                                 goto out;
 
-                        rxrpc_queue_packet(rx, call, skb,
-                                           !msg_data_left(msg) && !more,
-                                           notify_end_tx);
+                        ret = rxrpc_queue_packet(rx, call, skb,
+                                                 !msg_data_left(msg) && !more,
+                                                 notify_end_tx);
+                        /* Should check for failure here */
                         skb = NULL;
                 }
         } while (msg_data_left(msg) > 0);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f66dca3b1055..e4e892cc5644 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4850,7 +4850,8 @@ static int sctp_connect(struct sock *sk, struct sockaddr *addr,
         }
 
         /* Validate addr_len before calling common connect/connectx routine. */
-        af = sctp_get_af_specific(addr->sa_family);
+        af = addr_len < offsetofend(struct sockaddr, sa_family) ? NULL :
+                sctp_get_af_specific(addr->sa_family);
         if (!af || addr_len < af->sockaddr_len) {
                 err = -EINVAL;
         } else {
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index e066899de72d..086d9913975d 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -165,10 +165,9 @@ static int smc_release(struct socket *sock)
 
         if (sk->sk_state == SMC_CLOSED) {
                 if (smc->clcsock) {
-                        mutex_lock(&smc->clcsock_release_lock);
-                        sock_release(smc->clcsock);
-                        smc->clcsock = NULL;
-                        mutex_unlock(&smc->clcsock_release_lock);
+                        release_sock(sk);
+                        smc_clcsock_release(smc);
+                        lock_sock(sk);
                 }
                 if (!smc->use_fallback)
                         smc_conn_free(&smc->conn);
@@ -444,10 +443,19 @@ static void smc_link_save_peer_info(struct smc_link *link,
         link->peer_mtu = clc->qp_mtu;
 }
 
+static void smc_switch_to_fallback(struct smc_sock *smc)
+{
+        smc->use_fallback = true;
+        if (smc->sk.sk_socket && smc->sk.sk_socket->file) {
+                smc->clcsock->file = smc->sk.sk_socket->file;
+                smc->clcsock->file->private_data = smc->clcsock;
+        }
+}
+
 /* fall back during connect */
 static int smc_connect_fallback(struct smc_sock *smc, int reason_code)
 {
-        smc->use_fallback = true;
+        smc_switch_to_fallback(smc);
         smc->fallback_rsn = reason_code;
         smc_copy_sock_settings_to_clc(smc);
         smc->connect_nonblock = 0;
@@ -780,10 +788,14 @@ static void smc_connect_work(struct work_struct *work)
                 smc->sk.sk_err = -rc;
 
 out:
-        if (smc->sk.sk_err)
-                smc->sk.sk_state_change(&smc->sk);
-        else
-                smc->sk.sk_write_space(&smc->sk);
+        if (!sock_flag(&smc->sk, SOCK_DEAD)) {
+                if (smc->sk.sk_err) {
+                        smc->sk.sk_state_change(&smc->sk);
+                } else { /* allow polling before and after fallback decision */
+                        smc->clcsock->sk->sk_write_space(smc->clcsock->sk);
+                        smc->sk.sk_write_space(&smc->sk);
+                }
+        }
         release_sock(&smc->sk);
 }
 
@@ -867,11 +879,11 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
         if  (rc < 0)
                 lsk->sk_err = -rc;
         if (rc < 0 || lsk->sk_state == SMC_CLOSED) {
+                new_sk->sk_prot->unhash(new_sk);
                 if (new_clcsock)
                         sock_release(new_clcsock);
                 new_sk->sk_state = SMC_CLOSED;
                 sock_set_flag(new_sk, SOCK_DEAD);
-                new_sk->sk_prot->unhash(new_sk);
                 sock_put(new_sk); /* final */
                 *new_smc = NULL;
                 goto out;
@@ -922,16 +934,21 @@ struct sock *smc_accept_dequeue(struct sock *parent,
 
                 smc_accept_unlink(new_sk);
                 if (new_sk->sk_state == SMC_CLOSED) {
+                        new_sk->sk_prot->unhash(new_sk);
                         if (isk->clcsock) {
                                 sock_release(isk->clcsock);
                                 isk->clcsock = NULL;
                         }
-                        new_sk->sk_prot->unhash(new_sk);
                         sock_put(new_sk); /* final */
                         continue;
                 }
-                if (new_sock)
+                if (new_sock) {
                         sock_graft(new_sk, new_sock);
+                        if (isk->use_fallback) {
+                                smc_sk(new_sk)->clcsock->file = new_sock->file;
+                                isk->clcsock->file->private_data = isk->clcsock;
+                        }
+                }
                 return new_sk;
         }
         return NULL;
@@ -951,6 +968,7 @@ void smc_close_non_accepted(struct sock *sk)
                 sock_set_flag(sk, SOCK_DEAD);
                 sk->sk_shutdown |= SHUTDOWN_MASK;
         }
+        sk->sk_prot->unhash(sk);
         if (smc->clcsock) {
                 struct socket *tcp;
 
@@ -966,7 +984,6 @@ void smc_close_non_accepted(struct sock *sk)
                         smc_conn_free(&smc->conn);
         }
         release_sock(sk);
-        sk->sk_prot->unhash(sk);
         sock_put(sk); /* final sock_put */
 }
 
@@ -1032,13 +1049,13 @@ static void smc_listen_out(struct smc_sock *new_smc)
         struct smc_sock *lsmc = new_smc->listen_smc;
         struct sock *newsmcsk = &new_smc->sk;
 
-        lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
         if (lsmc->sk.sk_state == SMC_LISTEN) {
+                lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
                 smc_accept_enqueue(&lsmc->sk, newsmcsk);
+                release_sock(&lsmc->sk);
         } else { /* no longer listening */
                 smc_close_non_accepted(newsmcsk);
         }
-        release_sock(&lsmc->sk);
 
         /* Wake up accept */
         lsmc->sk.sk_data_ready(&lsmc->sk);
@@ -1082,7 +1099,7 @@ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
                 return;
         }
         smc_conn_free(&new_smc->conn);
-        new_smc->use_fallback = true;
+        smc_switch_to_fallback(new_smc);
         new_smc->fallback_rsn = reason_code;
         if (reason_code && reason_code != SMC_CLC_DECL_PEERDECL) {
                 if (smc_clc_send_decline(new_smc, reason_code) < 0) {
@@ -1220,6 +1237,9 @@ static void smc_listen_work(struct work_struct *work)
         u8 buf[SMC_CLC_MAX_LEN];
         int rc = 0;
 
+        if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
+                return smc_listen_out_err(new_smc);
+
         if (new_smc->use_fallback) {
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1227,7 +1247,7 @@ static void smc_listen_work(struct work_struct *work)
 
         /* check if peer is smc capable */
         if (!tcp_sk(newclcsock->sk)->syn_smc) {
-                new_smc->use_fallback = true;
+                smc_switch_to_fallback(new_smc);
                 new_smc->fallback_rsn = SMC_CLC_DECL_PEERNOSMC;
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1507,7 +1527,7 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (msg->msg_flags & MSG_FASTOPEN) {
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         rc = -EINVAL;
@@ -1712,7 +1732,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
         case TCP_FASTOPEN_NO_COOKIE:
                 /* option not supported by SMC */
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         if (!smc->use_fallback)
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 2ad37e998509..fc06720b53c1 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -21,6 +21,22 @@
 
 #define SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME      (5 * HZ)
 
+/* release the clcsock that is assigned to the smc_sock */
+void smc_clcsock_release(struct smc_sock *smc)
+{
+        struct socket *tcp;
+
+        if (smc->listen_smc && current_work() != &smc->smc_listen_work)
+                cancel_work_sync(&smc->smc_listen_work);
+        mutex_lock(&smc->clcsock_release_lock);
+        if (smc->clcsock) {
+                tcp = smc->clcsock;
+                smc->clcsock = NULL;
+                sock_release(tcp);
+        }
+        mutex_unlock(&smc->clcsock_release_lock);
+}
+
 static void smc_close_cleanup_listen(struct sock *parent)
 {
         struct sock *sk;
@@ -321,6 +337,7 @@ static void smc_close_passive_work(struct work_struct *work)
                                                    close_work);
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
         struct smc_cdc_conn_state_flags *rxflags;
+        bool release_clcsock = false;
         struct sock *sk = &smc->sk;
         int old_state;
 
@@ -400,13 +417,13 @@ wakeup:
                 if ((sk->sk_state == SMC_CLOSED) &&
                     (sock_flag(sk, SOCK_DEAD) || !sk->sk_socket)) {
                         smc_conn_free(conn);
-                        if (smc->clcsock) {
-                                sock_release(smc->clcsock);
-                                smc->clcsock = NULL;
-                        }
+                        if (smc->clcsock)
+                                release_clcsock = true;
                 }
         }
         release_sock(sk);
+        if (release_clcsock)
+                smc_clcsock_release(smc);
         sock_put(sk); /* sock_hold done by schedulers of close_work */
 }
 
diff --git a/net/smc/smc_close.h b/net/smc/smc_close.h
index 19eb6a211c23..e0e3b5df25d2 100644
--- a/net/smc/smc_close.h
+++ b/net/smc/smc_close.h
@@ -23,5 +23,6 @@ void smc_close_wake_tx_prepared(struct smc_sock *smc);
 int smc_close_active(struct smc_sock *smc);
 int smc_close_shutdown_write(struct smc_sock *smc);
 void smc_close_init(struct smc_sock *smc);
+void smc_clcsock_release(struct smc_sock *smc);
 
 #endif /* SMC_CLOSE_H */
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index 2fff79db1a59..e89e918b88e0 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -289,6 +289,11 @@ struct smcd_dev *smcd_alloc_dev(struct device *parent, const char *name,
         INIT_LIST_HEAD(&smcd->vlan);
         smcd->event_wq = alloc_ordered_workqueue("ism_evt_wq-%s)",
                                                  WQ_MEM_RECLAIM, name);
+        if (!smcd->event_wq) {
+                kfree(smcd->conn);
+                kfree(smcd);
+                return NULL;
+        }
         return smcd;
 }
 EXPORT_SYMBOL_GPL(smcd_alloc_dev);
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 2b246b94a3af..9f5d8f36f2d7 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -604,7 +604,8 @@ static int smc_pnet_flush(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = genl_info_net(info);
 
-        return smc_pnet_remove_by_pnetid(net, NULL);
+        smc_pnet_remove_by_pnetid(net, NULL);
+        return 0;
 }
 
 /* SMC_PNETID generic netlink operation definition */
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 68a0885b9319..0ba363624339 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -140,13 +140,11 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                         /* We are going to append to the frags_list of head.
                          * Need to unshare the frag_list.
                          */
-                        if (skb_has_frag_list(head)) {
-                                err = skb_unclone(head, GFP_ATOMIC);
-                                if (err) {
-                                        STRP_STATS_INCR(strp->stats.mem_fail);
-                                        desc->error = err;
-                                        return 0;
-                                }
+                        err = skb_unclone(head, GFP_ATOMIC);
+                        if (err) {
+                                STRP_STATS_INCR(strp->stats.mem_fail);
+                                desc->error = err;
+                                return 0;
                         }
 
                         if (unlikely(skb_shinfo(head)->frag_list)) {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 187d10443a15..1d0395ef62c9 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1540,7 +1540,6 @@ call_start(struct rpc_task *task)
         clnt->cl_stats->rpccnt++;
         task->tk_action = call_reserve;
         rpc_task_set_transport(task, clnt);
-        call_reserve(task);
 }
 
 /*
@@ -1554,9 +1553,6 @@ call_reserve(struct rpc_task *task)
         task->tk_status  = 0;
         task->tk_action  = call_reserveresult;
         xprt_reserve(task);
-        if (rpc_task_need_resched(task))
-                return;
-         call_reserveresult(task);
 }
 
 static void call_retry_reserve(struct rpc_task *task);
@@ -1579,7 +1575,6 @@ call_reserveresult(struct rpc_task *task)
         if (status >= 0) {
                 if (task->tk_rqstp) {
                         task->tk_action = call_refresh;
-                        call_refresh(task);
                         return;
                 }
 
@@ -1605,7 +1600,6 @@ call_reserveresult(struct rpc_task *task)
                 /* fall through */
         case -EAGAIN:   /* woken up; retry */
                 task->tk_action = call_retry_reserve;
-                call_retry_reserve(task);
                 return;
         case -EIO:      /* probably a shutdown */
                 break;
@@ -1628,9 +1622,6 @@ call_retry_reserve(struct rpc_task *task)
         task->tk_status  = 0;
         task->tk_action  = call_reserveresult;
         xprt_retry_reserve(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_reserveresult(task);
 }
 
 /*
@@ -1645,9 +1636,6 @@ call_refresh(struct rpc_task *task)
         task->tk_status = 0;
         task->tk_client->cl_stats->rpcauthrefresh++;
         rpcauth_refreshcred(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_refreshresult(task);
 }
 
 /*
@@ -1666,7 +1654,6 @@ call_refreshresult(struct rpc_task *task)
         case 0:
                 if (rpcauth_uptodatecred(task)) {
                         task->tk_action = call_allocate;
-                        call_allocate(task);
                         return;
                 }
                 /* Use rate-limiting and a max number of retries if refresh
@@ -1685,7 +1672,6 @@ call_refreshresult(struct rpc_task *task)
                 task->tk_cred_retry--;
                 dprintk("RPC: %5u %s: retry refresh creds\n",
                                 task->tk_pid, __func__);
-                call_refresh(task);
                 return;
         }
         dprintk("RPC: %5u %s: refresh creds failed with error %d\n",
@@ -1711,10 +1697,8 @@ call_allocate(struct rpc_task *task)
         task->tk_status = 0;
         task->tk_action = call_encode;
 
-        if (req->rq_buffer) {
-                call_encode(task);
+        if (req->rq_buffer)
                 return;
-        }
 
         if (proc->p_proc != 0) {
                 BUG_ON(proc->p_arglen == 0);
@@ -1740,12 +1724,8 @@ call_allocate(struct rpc_task *task)
 
         status = xprt->ops->buf_alloc(task);
         xprt_inject_disconnect(xprt);
-        if (status == 0) {
-                if (rpc_task_need_resched(task))
-                        return;
-                call_encode(task);
+        if (status == 0)
                 return;
-        }
         if (status != -ENOMEM) {
                 rpc_exit(task, status);
                 return;
@@ -1828,8 +1808,12 @@ call_encode(struct rpc_task *task)
                 xprt_request_enqueue_receive(task);
         xprt_request_enqueue_transmit(task);
 out:
-        task->tk_action = call_bind;
-        call_bind(task);
+        task->tk_action = call_transmit;
+        /* Check that the connection is OK */
+        if (!xprt_bound(task->tk_xprt))
+                task->tk_action = call_bind;
+        else if (!xprt_connected(task->tk_xprt))
+                task->tk_action = call_connect;
 }
 
 /*
@@ -1847,7 +1831,6 @@ rpc_task_handle_transmitted(struct rpc_task *task)
 {
         xprt_end_transmit(task);
         task->tk_action = call_transmit_status;
-        call_transmit_status(task);
 }
 
 /*
@@ -1865,7 +1848,6 @@ call_bind(struct rpc_task *task)
 
         if (xprt_bound(xprt)) {
                 task->tk_action = call_connect;
-                call_connect(task);
                 return;
         }
 
@@ -1896,7 +1878,6 @@ call_bind_status(struct rpc_task *task)
                 dprint_status(task);
                 task->tk_status = 0;
                 task->tk_action = call_connect;
-                call_connect(task);
                 return;
         }
 
@@ -1981,7 +1962,6 @@ call_connect(struct rpc_task *task)
 
         if (xprt_connected(xprt)) {
                 task->tk_action = call_transmit;
-                call_transmit(task);
                 return;
         }
 
@@ -2051,7 +2031,6 @@ call_connect_status(struct rpc_task *task)
         case 0:
                 clnt->cl_stats->netreconn++;
                 task->tk_action = call_transmit;
-                call_transmit(task);
                 return;
         }
         rpc_exit(task, status);
@@ -2087,9 +2066,6 @@ call_transmit(struct rpc_task *task)
                 xprt_transmit(task);
         }
         xprt_end_transmit(task);
-        if (rpc_task_need_resched(task))
-                return;
-        call_transmit_status(task);
 }
 
 /*
@@ -2107,9 +2083,6 @@ call_transmit_status(struct rpc_task *task)
         if (rpc_task_transmitted(task)) {
                 if (task->tk_status == 0)
                         xprt_request_wait_receive(task);
-                if (rpc_task_need_resched(task))
-                        return;
-                call_status(task);
                 return;
         }
 
@@ -2170,7 +2143,6 @@ call_bc_encode(struct rpc_task *task)
 {
         xprt_request_enqueue_transmit(task);
         task->tk_action = call_bc_transmit;
-        call_bc_transmit(task);
 }
 
 /*
@@ -2261,7 +2233,6 @@ call_status(struct rpc_task *task)
         status = task->tk_status;
         if (status >= 0) {
                 task->tk_action = call_decode;
-                call_decode(task);
                 return;
         }
 
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 89a63391d4d4..30cfc0efe699 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -90,7 +90,7 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
         /* Flush Receives, then wait for deferred Reply work
          * to complete.
          */
-        ib_drain_qp(ia->ri_id->qp);
+        ib_drain_rq(ia->ri_id->qp);
         drain_workqueue(buf->rb_completion_wq);
 
         /* Deferred Reply processing might have scheduled
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 3cb9f326ee6f..6053489c8063 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -876,6 +876,8 @@ void tipc_link_reset(struct tipc_link *l)
         __skb_queue_head_init(&list);
 
         l->in_session = false;
+        /* Force re-synch of peer session number before establishing */
+        l->peer_session--;
         l->session++;
         l->mtu = l->advertised_mtu;
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index bff241f03525..89993afe0fbd 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -909,7 +909,8 @@ static int tipc_nl_service_list(struct net *net, struct tipc_nl_msg *msg,
         for (; i < TIPC_NAMETBL_SIZE; i++) {
                 head = &tn->nametbl->services[i];
 
-                if (*last_type) {
+                if (*last_type ||
+                    (!i && *last_key && (*last_lower == *last_key))) {
                         service = tipc_service_find(net, *last_type);
                         if (!service)
                                 return -EPIPE;
diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 3481e4906bd6..9df82a573aa7 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -38,6 +38,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -46,14 +48,16 @@ static struct ctl_table tipc_table[] = {
                 .data           = &sysctl_tipc_rmem,
                 .maxlen         = sizeof(sysctl_tipc_rmem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
         {
                 .procname       = "named_timeout",
                 .data           = &sysctl_tipc_named_timeout,
                 .maxlen         = sizeof(sysctl_tipc_named_timeout),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "sk_filter",
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 135a7ee9db03..9f3bdbc1e593 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -52,8 +52,11 @@ static DEFINE_SPINLOCK(tls_device_lock);
 
 static void tls_device_free_ctx(struct tls_context *ctx)
 {
-        if (ctx->tx_conf == TLS_HW)
+        if (ctx->tx_conf == TLS_HW) {
                 kfree(tls_offload_ctx_tx(ctx));
+                kfree(ctx->tx.rec_seq);
+                kfree(ctx->tx.iv);
+        }
 
         if (ctx->rx_conf == TLS_HW)
                 kfree(tls_offload_ctx_rx(ctx));
@@ -216,6 +219,13 @@ void tls_device_sk_destruct(struct sock *sk)
 }
 EXPORT_SYMBOL(tls_device_sk_destruct);
 
+void tls_device_free_resources_tx(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+
+        tls_free_partial_record(sk, tls_ctx);
+}
+
 static void tls_append_frag(struct tls_record_info *record,
                             struct page_frag *pfrag,
                             int size)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 0e24edab2535..7e546b8ec000 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -208,6 +208,26 @@ int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
         return tls_push_sg(sk, ctx, sg, offset, flags);
 }
 
+bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx)
+{
+        struct scatterlist *sg;
+
+        sg = ctx->partially_sent_record;
+        if (!sg)
+                return false;
+
+        while (1) {
+                put_page(sg_page(sg));
+                sk_mem_uncharge(sk, sg->length);
+
+                if (sg_is_last(sg))
+                        break;
+                sg++;
+        }
+        ctx->partially_sent_record = NULL;
+        return true;
+}
+
 static void tls_write_space(struct sock *sk)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
@@ -267,6 +287,10 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                 kfree(ctx->tx.rec_seq);
                 kfree(ctx->tx.iv);
                 tls_sw_free_resources_tx(sk);
+#ifdef CONFIG_TLS_DEVICE
+        } else if (ctx->tx_conf == TLS_HW) {
+                tls_device_free_resources_tx(sk);
+#endif
         }
 
         if (ctx->rx_conf == TLS_SW) {
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 4741edf4bb1e..f780b473827b 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2065,20 +2065,7 @@ void tls_sw_free_resources_tx(struct sock *sk)
         /* Free up un-sent records in tx_list. First, free
          * the partially sent record if any at head of tx_list.
          */
-        if (tls_ctx->partially_sent_record) {
-                struct scatterlist *sg = tls_ctx->partially_sent_record;
-
-                while (1) {
-                        put_page(sg_page(sg));
-                        sk_mem_uncharge(sk, sg->length);
-
-                        if (sg_is_last(sg))
-                                break;
-                        sg++;
-                }
-
-                tls_ctx->partially_sent_record = NULL;
-
+        if (tls_free_partial_record(sk, tls_ctx)) {
                 rec = list_first_entry(&ctx->tx_list,
                                        struct tls_rec, list);
                 list_del(&rec->list);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 33408ba1d7ee..e7ee18ab6cb7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13614,7 +13614,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_associate,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEAUTHENTICATE,
@@ -13659,14 +13660,16 @@ static const struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_connect,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
                 .doit = nl80211_update_connect_params,
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DISCONNECT,
@@ -13691,7 +13694,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_setdel_pmksa,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMKSA,
@@ -13999,7 +14003,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .dumpit = nl80211_vendor_cmd_dump,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_SET_QOS_MAP,
@@ -14047,7 +14052,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_SET_PMK,
                 .doit = nl80211_set_pmk,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMK,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2f1bf91eb226..0ba778f371cb 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1309,6 +1309,16 @@ reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
         return dfs_region1;
 }
 
+static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
+                                    const struct ieee80211_wmm_ac *wmm_ac2,
+                                    struct ieee80211_wmm_ac *intersect)
+{
+        intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
+        intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
+        intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
+        intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
+}
+
 /*
  * Helper for regdom_intersect(), this does the real
  * mathematical intersection fun
@@ -1323,6 +1333,8 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         struct ieee80211_freq_range *freq_range;
         const struct ieee80211_power_rule *power_rule1, *power_rule2;
         struct ieee80211_power_rule *power_rule;
+        const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
+        struct ieee80211_wmm_rule *wmm_rule;
         u32 freq_diff, max_bandwidth1, max_bandwidth2;
 
         freq_range1 = &rule1->freq_range;
@@ -1333,6 +1345,10 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         power_rule2 = &rule2->power_rule;
         power_rule = &intersected_rule->power_rule;
 
+        wmm_rule1 = &rule1->wmm_rule;
+        wmm_rule2 = &rule2->wmm_rule;
+        wmm_rule = &intersected_rule->wmm_rule;
+
         freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
                                          freq_range2->start_freq_khz);
         freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
@@ -1376,6 +1392,29 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
                                            rule2->dfs_cac_ms);
 
+        if (rule1->has_wmm && rule2->has_wmm) {
+                u8 ac;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        reg_wmm_rules_intersect(&wmm_rule1->client[ac],
+                                                &wmm_rule2->client[ac],
+                                                &wmm_rule->client[ac]);
+                        reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
+                                                &wmm_rule2->ap[ac],
+                                                &wmm_rule->ap[ac]);
+                }
+
+                intersected_rule->has_wmm = true;
+        } else if (rule1->has_wmm) {
+                *wmm_rule = *wmm_rule1;
+                intersected_rule->has_wmm = true;
+        } else if (rule2->has_wmm) {
+                *wmm_rule = *wmm_rule2;
+                intersected_rule->has_wmm = true;
+        } else {
+                intersected_rule->has_wmm = false;
+        }
+
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 287518c6caa4..04d888628f29 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -190,10 +190,9 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
         /* copy subelement as we need to change its content to
          * mark an ie after it is processed.
          */
-        sub_copy = kmalloc(subie_len, gfp);
+        sub_copy = kmemdup(subelement, subie_len, gfp);
         if (!sub_copy)
                 return 0;
-        memcpy(sub_copy, subelement, subie_len);
 
         pos = &new_ie[0];
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e4b8db5e81ec..75899b62bdc9 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1220,9 +1220,11 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
         else if (rate->bw == RATE_INFO_BW_HE_RU &&
                  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
                 result = rates_26[rate->he_gi];
-        else if (WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
-                      rate->bw, rate->he_ru_alloc))
+        else {
+                WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
+                     rate->bw, rate->he_ru_alloc);
                 return 0;
+        }
 
         /* now scale to the appropriate MCS */
         tmp = result;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 49d664ddff44..87500bde5a92 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1336,9 +1336,16 @@ module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
 bool aa_g_paranoid_load = true;
 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
 
+static int param_get_aaintbool(char *buffer, const struct kernel_param *kp);
+static int param_set_aaintbool(const char *val, const struct kernel_param *kp);
+#define param_check_aaintbool param_check_int
+static const struct kernel_param_ops param_ops_aaintbool = {
+        .set = param_set_aaintbool,
+        .get = param_get_aaintbool
+};
 /* Boot time disable flag */
 static int apparmor_enabled __lsm_ro_after_init = 1;
-module_param_named(enabled, apparmor_enabled, int, 0444);
+module_param_named(enabled, apparmor_enabled, aaintbool, 0444);
 
 static int __init apparmor_enabled_setup(char *str)
 {
@@ -1413,6 +1420,46 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp)
         return param_get_uint(buffer, kp);
 }
 
+/* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */
+static int param_set_aaintbool(const char *val, const struct kernel_param *kp)
+{
+        struct kernel_param kp_local;
+        bool value;
+        int error;
+
+        if (apparmor_initialized)
+                return -EPERM;
+
+        /* Create local copy, with arg pointing to bool type. */
+        value = !!*((int *)kp->arg);
+        memcpy(&kp_local, kp, sizeof(kp_local));
+        kp_local.arg = &value;
+
+        error = param_set_bool(val, &kp_local);
+        if (!error)
+                *((int *)kp->arg) = *((bool *)kp_local.arg);
+        return error;
+}
+
+/*
+ * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to
+ * 1/0, this converts the "int that is actually bool" back to bool for
+ * display in the /sys filesystem, while keeping it "int" for the LSM
+ * infrastructure.
+ */
+static int param_get_aaintbool(char *buffer, const struct kernel_param *kp)
+{
+        struct kernel_param kp_local;
+        bool value;
+
+        /* Create local copy, with arg pointing to bool type. */
+        value = !!*((int *)kp->arg);
+        memcpy(&kp_local, kp, sizeof(kp_local));
+        kp_local.arg = &value;
+
+        return param_get_bool(buffer, &kp_local);
+}
+
 static int param_get_audit(char *buffer, const struct kernel_param *kp)
 {
         if (!apparmor_enabled)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 7d4640d1fe9f..38e7deab6384 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,
 
         /* fill the info fields */
         if (client_info->name[0])
-                strlcpy(client->name, client_info->name, sizeof(client->name));
+                strscpy(client->name, client_info->name, sizeof(client->name));
 
         client->filter = client_info->filter;
         client->event_lost = client_info->event_lost;
@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
         /* set queue name */
         if (!info->name[0])
                 snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
-        strlcpy(q->name, info->name, sizeof(q->name));
+        strscpy(q->name, info->name, sizeof(q->name));
         snd_use_lock_free(&q->use_lock);
 
         return 0;
@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client,
                 queuefree(q);
                 return -EPERM;
         }
-        strlcpy(q->name, info->name, sizeof(q->name));
+        strscpy(q->name, info->name, sizeof(q->name));
         queuefree(q);
 
         return 0;
diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c
index 9c37d9af3023..ec7715c6b0c0 100644
--- a/sound/hda/ext/hdac_ext_bus.c
+++ b/sound/hda/ext/hdac_ext_bus.c
@@ -107,7 +107,6 @@ int snd_hdac_ext_bus_init(struct hdac_bus *bus, struct device *dev,
         INIT_LIST_HEAD(&bus->hlink_list);
         bus->idx = idx++;
 
-        mutex_init(&bus->lock);
         bus->cmd_dma_state = true;
 
         return 0;
diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
index 012305177f68..ad8eee08013f 100644
--- a/sound/hda/hdac_bus.c
+++ b/sound/hda/hdac_bus.c
@@ -38,6 +38,7 @@ int snd_hdac_bus_init(struct hdac_bus *bus, struct device *dev,
         INIT_WORK(&bus->unsol_work, snd_hdac_bus_process_unsol_events);
         spin_lock_init(&bus->reg_lock);
         mutex_init(&bus->cmd_mutex);
+        mutex_init(&bus->lock);
         bus->irq = -1;
         return 0;
 }
diff --git a/sound/hda/hdac_component.c b/sound/hda/hdac_component.c
index 5c95933e739a..1ea51e3b942a 100644
--- a/sound/hda/hdac_component.c
+++ b/sound/hda/hdac_component.c
@@ -69,13 +69,15 @@ void snd_hdac_display_power(struct hdac_bus *bus, unsigned int idx, bool enable)
 
         dev_dbg(bus->dev, "display power %s\n",
                 enable ? "enable" : "disable");
+
+        mutex_lock(&bus->lock);
         if (enable)
                 set_bit(idx, &bus->display_power_status);
         else
                 clear_bit(idx, &bus->display_power_status);
 
         if (!acomp || !acomp->ops)
-                return;
+                goto unlock;
 
         if (bus->display_power_status) {
                 if (!bus->display_power_active) {
@@ -92,6 +94,8 @@ void snd_hdac_display_power(struct hdac_bus *bus, unsigned int idx, bool enable)
                         bus->display_power_active = false;
                 }
         }
+ unlock:
+        mutex_unlock(&bus->lock);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_display_power);
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index ece256a3b48f..2ec91085fa3e 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2142,6 +2142,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
         /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
         SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+        /* https://bugs.launchpad.net/bugs/1821663 */
+        SND_PCI_QUIRK(0x8086, 0x2064, "Intel SDP 8086:2064", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
         SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0),
         /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
@@ -2150,6 +2152,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
         SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),
         /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
         SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
+        /* https://bugs.launchpad.net/bugs/1821663 */
+        SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0),
         {}
 };
 #endif /* CONFIG_PM */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a3fb3d4c5730..810479766090 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1864,8 +1864,8 @@ enum {
         ALC887_FIXUP_BASS_CHMAP,
         ALC1220_FIXUP_GB_DUAL_CODECS,
         ALC1220_FIXUP_CLEVO_P950,
-        ALC1220_FIXUP_SYSTEM76_ORYP5,
-        ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
+        ALC1220_FIXUP_CLEVO_PB51ED,
+        ALC1220_FIXUP_CLEVO_PB51ED_PINS,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2070,7 +2070,7 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
 static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action);
 
-static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
+static void alc1220_fixup_clevo_pb51ed(struct hda_codec *codec,
                                      const struct hda_fixup *fix,
                                      int action)
 {
@@ -2322,18 +2322,18 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc1220_fixup_clevo_p950,
         },
-        [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
+        [ALC1220_FIXUP_CLEVO_PB51ED] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc1220_fixup_system76_oryp5,
+                .v.func = alc1220_fixup_clevo_pb51ed,
         },
-        [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
+        [ALC1220_FIXUP_CLEVO_PB51ED_PINS] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
                         { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
                         {}
                 },
                 .chained = true,
-                .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
+                .chain_id = ALC1220_FIXUP_CLEVO_PB51ED,
         },
 };
 
@@ -2411,8 +2411,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
-        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
-        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
@@ -5491,7 +5492,7 @@ static void alc_headset_btn_callback(struct hda_codec *codec,
         jack->jack->button_state = report;
 }
 
-static void alc295_fixup_chromebook(struct hda_codec *codec,
+static void alc_fixup_headset_jack(struct hda_codec *codec,
                                     const struct hda_fixup *fix, int action)
 {
 
@@ -5501,16 +5502,6 @@ static void alc295_fixup_chromebook(struct hda_codec *codec,
                                                     alc_headset_btn_callback);
                 snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false,
                                       SND_JACK_HEADSET, alc_headset_btn_keymap);
-                switch (codec->core.vendor_id) {
-                case 0x10ec0295:
-                        alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
-                        alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
-                        break;
-                case 0x10ec0236:
-                        alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
-                        alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
-                        break;
-                }
                 break;
         case HDA_FIXUP_ACT_INIT:
                 switch (codec->core.vendor_id) {
@@ -5531,6 +5522,25 @@ static void alc295_fixup_chromebook(struct hda_codec *codec,
         }
 }
 
+static void alc295_fixup_chromebook(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        switch (action) {
+        case HDA_FIXUP_ACT_INIT:
+                switch (codec->core.vendor_id) {
+                case 0x10ec0295:
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15);
+                        break;
+                case 0x10ec0236:
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
+                        alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);
+                        break;
+                }
+                break;
+        }
+}
+
 static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
                                   const struct hda_fixup *fix, int action)
 {
@@ -5663,6 +5673,7 @@ enum {
         ALC233_FIXUP_ASUS_MIC_NO_PRESENCE,
         ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
         ALC233_FIXUP_LENOVO_MULTI_CODECS,
+        ALC233_FIXUP_ACER_HEADSET_MIC,
         ALC294_FIXUP_LENOVO_MIC_LOCATION,
         ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
         ALC700_FIXUP_INTEL_REFERENCE,
@@ -5684,6 +5695,7 @@ enum {
         ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
         ALC255_FIXUP_ACER_HEADSET_MIC,
         ALC295_FIXUP_CHROME_BOOK,
+        ALC225_FIXUP_HEADSET_JACK,
         ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE,
         ALC225_FIXUP_WYSE_AUTO_MUTE,
         ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
@@ -6490,6 +6502,16 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
         },
+        [ALC233_FIXUP_ACER_HEADSET_MIC] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC233_FIXUP_ASUS_MIC_NO_PRESENCE
+        },
         [ALC294_FIXUP_LENOVO_MIC_LOCATION] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6635,6 +6657,12 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC295_FIXUP_CHROME_BOOK] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc295_fixup_chromebook,
+                .chained = true,
+                .chain_id = ALC225_FIXUP_HEADSET_JACK
+        },
+        [ALC225_FIXUP_HEADSET_JACK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_headset_jack,
         },
         [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
                 .type = HDA_FIXUP_PINS,
@@ -6737,6 +6765,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
@@ -7132,7 +7161,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"},
         {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
         {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
-        {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"},
+        {.id = ALC225_FIXUP_HEADSET_JACK, .name = "alc-headset-jack"},
+        {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-chrome-book"},
         {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
         {}
 };
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 419114edfd57..667fc1d59e18 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -1151,6 +1151,7 @@ config SND_SOC_WCD9335
         tristate "WCD9335 Codec"
         depends on SLIMBUS
         select REGMAP_SLIMBUS
+        select REGMAP_IRQ
         help
           The WCD9335 is a standalone Hi-Fi audio CODEC IC, supports
           Qualcomm Technologies, Inc. (QTI) multimedia solutions,
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index 03bbbcd3b6c1..87616b126018 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -2129,6 +2129,7 @@ static int ab8500_codec_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
                 dev_err(dai->component->dev,
                         "%s: ERROR: The device is either a master or a slave.\n",
                         __func__);
+                /* fall through */
         default:
                 dev_err(dai->component->dev,
                         "%s: ERROR: Unsupporter master mask 0x%x\n",
diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
index 9f4a59871cee..c71696146c5e 100644
--- a/sound/soc/codecs/cs35l35.c
+++ b/sound/soc/codecs/cs35l35.c
@@ -1635,6 +1635,16 @@ err:
         return ret;
 }
 
+static int cs35l35_i2c_remove(struct i2c_client *i2c_client)
+{
+        struct cs35l35_private *cs35l35 = i2c_get_clientdata(i2c_client);
+
+        regulator_bulk_disable(cs35l35->num_supplies, cs35l35->supplies);
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
+
+        return 0;
+}
+
 static const struct of_device_id cs35l35_of_match[] = {
         {.compatible = "cirrus,cs35l35"},
         {},
@@ -1655,6 +1665,7 @@ static struct i2c_driver cs35l35_i2c_driver = {
         },
         .id_table = cs35l35_id,
         .probe = cs35l35_i2c_probe,
+        .remove = cs35l35_i2c_remove,
 };
 
 module_i2c_driver(cs35l35_i2c_driver);
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 33d74f163bd7..793a14d58667 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
         .reg_defaults =         cs4270_reg_defaults,
         .num_reg_defaults =     ARRAY_SIZE(cs4270_reg_defaults),
         .cache_type =           REGCACHE_RBTREE,
+        .write_flag_mask =      CS4270_I2C_INCR,
 
         .readable_reg =         cs4270_reg_is_readable,
         .volatile_reg =         cs4270_reg_is_volatile,
diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
index ffecdaaa8cf2..f889d94c8e3c 100644
--- a/sound/soc/codecs/hdac_hda.c
+++ b/sound/soc/codecs/hdac_hda.c
@@ -38,6 +38,9 @@ static void hdac_hda_dai_close(struct snd_pcm_substream *substream,
                                struct snd_soc_dai *dai);
 static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai);
+static int hdac_hda_dai_hw_params(struct snd_pcm_substream *substream,
+                                  struct snd_pcm_hw_params *params,
+                                  struct snd_soc_dai *dai);
 static int hdac_hda_dai_hw_free(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai);
 static int hdac_hda_dai_set_tdm_slot(struct snd_soc_dai *dai,
@@ -50,6 +53,7 @@ static const struct snd_soc_dai_ops hdac_hda_dai_ops = {
         .startup = hdac_hda_dai_open,
         .shutdown = hdac_hda_dai_close,
         .prepare = hdac_hda_dai_prepare,
+        .hw_params = hdac_hda_dai_hw_params,
         .hw_free = hdac_hda_dai_hw_free,
         .set_tdm_slot = hdac_hda_dai_set_tdm_slot,
 };
@@ -139,6 +143,39 @@ static int hdac_hda_dai_set_tdm_slot(struct snd_soc_dai *dai,
         return 0;
 }
 
+static int hdac_hda_dai_hw_params(struct snd_pcm_substream *substream,
+                                  struct snd_pcm_hw_params *params,
+                                  struct snd_soc_dai *dai)
+{
+        struct snd_soc_component *component = dai->component;
+        struct hdac_hda_priv *hda_pvt;
+        unsigned int format_val;
+        unsigned int maxbps;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                maxbps = dai->driver->playback.sig_bits;
+        else
+                maxbps = dai->driver->capture.sig_bits;
+
+        hda_pvt = snd_soc_component_get_drvdata(component);
+        format_val = snd_hdac_calc_stream_format(params_rate(params),
+                                                 params_channels(params),
+                                                 params_format(params),
+                                                 maxbps,
+                                                 0);
+        if (!format_val) {
+                dev_err(dai->dev,
+                        "invalid format_val, rate=%d, ch=%d, format=%d, maxbps=%d\n",
+                        params_rate(params), params_channels(params),
+                        params_format(params), maxbps);
+
+                return -EINVAL;
+        }
+
+        hda_pvt->pcm[dai->id].format_val[substream->stream] = format_val;
+        return 0;
+}
+
 static int hdac_hda_dai_hw_free(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai)
 {
@@ -162,10 +199,9 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
                                 struct snd_soc_dai *dai)
 {
         struct snd_soc_component *component = dai->component;
+        struct hda_pcm_stream *hda_stream;
         struct hdac_hda_priv *hda_pvt;
-        struct snd_pcm_runtime *runtime = substream->runtime;
         struct hdac_device *hdev;
-        struct hda_pcm_stream *hda_stream;
         unsigned int format_val;
         struct hda_pcm *pcm;
         unsigned int stream;
@@ -179,19 +215,8 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,
 
         hda_stream = &pcm->stream[substream->stream];
 
-        format_val = snd_hdac_calc_stream_format(runtime->rate,
-                                                 runtime->channels,
-                                                 runtime->format,
-                                                 hda_stream->maxbps,
-                                                 0);
-        if (!format_val) {
-                dev_err(&hdev->dev,
-                        "invalid format_val, rate=%d, ch=%d, format=%d\n",
-                        runtime->rate, runtime->channels, runtime->format);
-                return -EINVAL;
-        }
-
         stream = hda_pvt->pcm[dai->id].stream_tag[substream->stream];
+        format_val = hda_pvt->pcm[dai->id].format_val[substream->stream];
 
         ret = snd_hda_codec_prepare(&hda_pvt->codec, hda_stream,
                                     stream, format_val, substream);
diff --git a/sound/soc/codecs/hdac_hda.h b/sound/soc/codecs/hdac_hda.h
index e444ef593360..6b1bd4f428e7 100644
--- a/sound/soc/codecs/hdac_hda.h
+++ b/sound/soc/codecs/hdac_hda.h
@@ -8,6 +8,7 @@
 
 struct hdac_hda_pcm {
         int stream_tag[2];
+        unsigned int format_val[2];
 };
 
 struct hdac_hda_priv {
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index e5b6769b9797..35df73e42cbc 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -484,9 +484,6 @@ static int hdmi_codec_hw_params(struct snd_pcm_substream *substream,
                 params_width(params), params_rate(params),
                 params_channels(params));
 
-        if (params_width(params) > 24)
-                params->msbits = 24;
-
         ret = snd_pcm_create_iec958_consumer_hw_params(params, hp.iec.status,
                                                        sizeof(hp.iec.status));
         if (ret < 0) {
@@ -529,73 +526,71 @@ static int hdmi_codec_set_fmt(struct snd_soc_dai *dai,
 {
         struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
         struct hdmi_codec_daifmt cf = { 0 };
-        int ret = 0;
 
         dev_dbg(dai->dev, "%s()\n", __func__);
 
-        if (dai->id == DAI_ID_SPDIF) {
-                cf.fmt = HDMI_SPDIF;
-        } else {
-                switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-                case SND_SOC_DAIFMT_CBM_CFM:
-                        cf.bit_clk_master = 1;
-                        cf.frame_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBS_CFM:
-                        cf.frame_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBM_CFS:
-                        cf.bit_clk_master = 1;
-                        break;
-                case SND_SOC_DAIFMT_CBS_CFS:
-                        break;
-                default:
-                        return -EINVAL;
-                }
+        if (dai->id == DAI_ID_SPDIF)
+                return 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                cf.bit_clk_master = 1;
+                cf.frame_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFM:
+                cf.frame_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBM_CFS:
+                cf.bit_clk_master = 1;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
 
-                switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-                case SND_SOC_DAIFMT_NB_NF:
-                        break;
-                case SND_SOC_DAIFMT_NB_IF:
-                        cf.frame_clk_inv = 1;
-                        break;
-                case SND_SOC_DAIFMT_IB_NF:
-                        cf.bit_clk_inv = 1;
-                        break;
-                case SND_SOC_DAIFMT_IB_IF:
-                        cf.frame_clk_inv = 1;
-                        cf.bit_clk_inv = 1;
-                        break;
-                }
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                cf.frame_clk_inv = 1;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                cf.bit_clk_inv = 1;
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                cf.frame_clk_inv = 1;
+                cf.bit_clk_inv = 1;
+                break;
+        }
 
-                switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
-                case SND_SOC_DAIFMT_I2S:
-                        cf.fmt = HDMI_I2S;
-                        break;
-                case SND_SOC_DAIFMT_DSP_A:
-                        cf.fmt = HDMI_DSP_A;
-                        break;
-                case SND_SOC_DAIFMT_DSP_B:
-                        cf.fmt = HDMI_DSP_B;
-                        break;
-                case SND_SOC_DAIFMT_RIGHT_J:
-                        cf.fmt = HDMI_RIGHT_J;
-                        break;
-                case SND_SOC_DAIFMT_LEFT_J:
-                        cf.fmt = HDMI_LEFT_J;
-                        break;
-                case SND_SOC_DAIFMT_AC97:
-                        cf.fmt = HDMI_AC97;
-                        break;
-                default:
-                        dev_err(dai->dev, "Invalid DAI interface format\n");
-                        return -EINVAL;
-                }
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                cf.fmt = HDMI_I2S;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                cf.fmt = HDMI_DSP_A;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                cf.fmt = HDMI_DSP_B;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                cf.fmt = HDMI_RIGHT_J;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                cf.fmt = HDMI_LEFT_J;
+                break;
+        case SND_SOC_DAIFMT_AC97:
+                cf.fmt = HDMI_AC97;
+                break;
+        default:
+                dev_err(dai->dev, "Invalid DAI interface format\n");
+                return -EINVAL;
         }
 
         hcp->daifmt[dai->id] = cf;
 
-        return ret;
+        return 0;
 }
 
 static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
@@ -792,8 +787,10 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                 i++;
         }
 
-        if (hcd->spdif)
+        if (hcd->spdif) {
                 hcp->daidrv[i] = hdmi_spdif_dai;
+                hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
+        }
 
         dev_set_drvdata(dev, hcp);
 
diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
index bfd74b86c9d2..645aa0794123 100644
--- a/sound/soc/codecs/nau8810.c
+++ b/sound/soc/codecs/nau8810.c
@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
         SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
                 NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
                 ARRAY_SIZE(nau8810_mono_mixer_controls)),
-        SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
+        SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
                 NAU8810_DAC_EN_SFT, 0),
-        SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
+        SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
                 NAU8810_ADC_EN_SFT, 0),
         SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
                 NAU8810_NSPK_EN_SFT, 0, NULL, 0),
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
index 87ed3dc496dc..5ab05e75edea 100644
--- a/sound/soc/codecs/nau8824.c
+++ b/sound/soc/codecs/nau8824.c
@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
         SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
                 NAU8824_ADCR_EN_SFT, 0),
 
-        SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
-        SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
 
         SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
                 NAU8824_DACL_EN_SFT, 0),
@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
         }
 }
 
+static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        const char *prefix = dapm->component->name_prefix;
+        char prefixed_pin[80];
+
+        if (prefix) {
+                snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
+                         prefix, pin);
+                snd_soc_dapm_disable_pin(dapm, prefixed_pin);
+        } else {
+                snd_soc_dapm_disable_pin(dapm, pin);
+        }
+}
+
+static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        const char *prefix = dapm->component->name_prefix;
+        char prefixed_pin[80];
+
+        if (prefix) {
+                snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
+                         prefix, pin);
+                snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
+        } else {
+                snd_soc_dapm_force_enable_pin(dapm, pin);
+        }
+}
+
 static void nau8824_eject_jack(struct nau8824 *nau8824)
 {
         struct snd_soc_dapm_context *dapm = nau8824->dapm;
@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
         /* Clear all interruption status */
         nau8824_int_status_clear_all(regmap);
 
-        snd_soc_dapm_disable_pin(dapm, "SAR");
-        snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+        nau8824_dapm_disable_pin(nau8824, "SAR");
+        nau8824_dapm_disable_pin(nau8824, "MICBIAS");
         snd_soc_dapm_sync(dapm);
 
         /* Enable the insertion interruption, disable the ejection
@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
         struct regmap *regmap = nau8824->regmap;
         int adc_value, event = 0, event_mask = 0;
 
-        snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
-        snd_soc_dapm_force_enable_pin(dapm, "SAR");
+        nau8824_dapm_enable_pin(nau8824, "MICBIAS");
+        nau8824_dapm_enable_pin(nau8824, "SAR");
         snd_soc_dapm_sync(dapm);
 
         msleep(100);
@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
         if (adc_value < HEADSET_SARADC_THD) {
                 event |= SND_JACK_HEADPHONE;
 
-                snd_soc_dapm_disable_pin(dapm, "SAR");
-                snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+                nau8824_dapm_disable_pin(nau8824, "SAR");
+                nau8824_dapm_disable_pin(nau8824, "MICBIAS");
                 snd_soc_dapm_sync(dapm);
         } else {
                 event |= SND_JACK_HEADSET;
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 9d5acd2d04ab..86a7fa31c294 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -910,13 +910,21 @@ static int rt5682_headset_detect(struct snd_soc_component *component,
                 int jack_insert)
 {
         struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
-        struct snd_soc_dapm_context *dapm =
-                snd_soc_component_get_dapm(component);
         unsigned int val, count;
 
         if (jack_insert) {
-                snd_soc_dapm_force_enable_pin(dapm, "CBJ Power");
-                snd_soc_dapm_sync(dapm);
+
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_1,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB);
+                snd_soc_component_update_bits(component,
+                                RT5682_PWR_ANLG_1, RT5682_PWR_FV2, 0);
+                usleep_range(15000, 20000);
+                snd_soc_component_update_bits(component,
+                                RT5682_PWR_ANLG_1, RT5682_PWR_FV2, RT5682_PWR_FV2);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3,
+                        RT5682_PWR_CBJ, RT5682_PWR_CBJ);
+
                 snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
                         RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_HIGH);
 
@@ -944,8 +952,10 @@ static int rt5682_headset_detect(struct snd_soc_component *component,
                 rt5682_enable_push_button_irq(component, false);
                 snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1,
                         RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_LOW);
-                snd_soc_dapm_disable_pin(dapm, "CBJ Power");
-                snd_soc_dapm_sync(dapm);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_1,
+                        RT5682_PWR_VREF2 | RT5682_PWR_MB, 0);
+                snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3,
+                        RT5682_PWR_CBJ, 0);
 
                 rt5682->jack_type = 0;
         }
@@ -1198,7 +1208,7 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
         struct snd_soc_component *component =
                 snd_soc_dapm_to_component(w->dapm);
         struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
-        int ref, val, reg, sft, mask, idx = -EINVAL;
+        int ref, val, reg, idx = -EINVAL;
         static const int div_f[] = {1, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48};
         static const int div_o[] = {1, 2, 4, 6, 8, 12, 16, 24, 32, 48};
 
@@ -1212,15 +1222,10 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
 
         idx = rt5682_div_sel(rt5682, ref, div_f, ARRAY_SIZE(div_f));
 
-        if (w->shift == RT5682_PWR_ADC_S1F_BIT) {
+        if (w->shift == RT5682_PWR_ADC_S1F_BIT)
                 reg = RT5682_PLL_TRACK_3;
-                sft = RT5682_ADC_OSR_SFT;
-                mask = RT5682_ADC_OSR_MASK;
-        } else {
+        else
                 reg = RT5682_PLL_TRACK_2;
-                sft = RT5682_DAC_OSR_SFT;
-                mask = RT5682_DAC_OSR_MASK;
-        }
 
         snd_soc_component_update_bits(component, reg,
                 RT5682_FILTER_CLK_DIV_MASK, idx << RT5682_FILTER_CLK_DIV_SFT);
@@ -1232,7 +1237,8 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
         }
 
         snd_soc_component_update_bits(component, RT5682_ADDA_CLK_1,
-                mask, idx << sft);
+                RT5682_ADC_OSR_MASK | RT5682_DAC_OSR_MASK,
+                (idx << RT5682_ADC_OSR_SFT) | (idx << RT5682_DAC_OSR_SFT));
 
         return 0;
 }
@@ -1591,8 +1597,6 @@ static const struct snd_soc_dapm_widget rt5682_dapm_widgets[] = {
                 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("Vref1", RT5682_PWR_ANLG_1, RT5682_PWR_VREF1_BIT, 0,
                 rt5655_set_verf, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU),
-        SND_SOC_DAPM_SUPPLY("Vref2", RT5682_PWR_ANLG_1, RT5682_PWR_VREF2_BIT, 0,
-                rt5655_set_verf, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU),
 
         /* ASRC */
         SND_SOC_DAPM_SUPPLY_S("DAC STO1 ASRC", 1, RT5682_PLL_TRACK_1,
@@ -1627,9 +1631,6 @@ static const struct snd_soc_dapm_widget rt5682_dapm_widgets[] = {
         SND_SOC_DAPM_PGA("BST1 CBJ", SND_SOC_NOPM,
                 0, 0, NULL, 0),
 
-        SND_SOC_DAPM_SUPPLY("CBJ Power", RT5682_PWR_ANLG_3,
-                RT5682_PWR_CBJ_BIT, 0, NULL, 0),
-
         /* REC Mixer */
         SND_SOC_DAPM_MIXER("RECMIX1L", SND_SOC_NOPM, 0, 0, rt5682_rec1_l_mix,
                 ARRAY_SIZE(rt5682_rec1_l_mix)),
@@ -1792,17 +1793,13 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
 
         /*Vref*/
         {"MICBIAS1", NULL, "Vref1"},
-        {"MICBIAS1", NULL, "Vref2"},
         {"MICBIAS2", NULL, "Vref1"},
-        {"MICBIAS2", NULL, "Vref2"},
 
         {"CLKDET SYS", NULL, "CLKDET"},
 
         {"IN1P", NULL, "LDO2"},
 
         {"BST1 CBJ", NULL, "IN1P"},
-        {"BST1 CBJ", NULL, "CBJ Power"},
-        {"CBJ Power", NULL, "Vref2"},
 
         {"RECMIX1L", "CBJ Switch", "BST1 CBJ"},
         {"RECMIX1L", NULL, "RECMIX1L Power"},
@@ -1912,9 +1909,7 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
         {"HP Amp", NULL, "Capless"},
         {"HP Amp", NULL, "Charge Pump"},
         {"HP Amp", NULL, "CLKDET SYS"},
-        {"HP Amp", NULL, "CBJ Power"},
         {"HP Amp", NULL, "Vref1"},
-        {"HP Amp", NULL, "Vref2"},
         {"HPOL Playback", "Switch", "HP Amp"},
         {"HPOR Playback", "Switch", "HP Amp"},
         {"HPOL", NULL, "HPOL Playback"},
@@ -2303,16 +2298,13 @@ static int rt5682_set_bias_level(struct snd_soc_component *component,
         switch (level) {
         case SND_SOC_BIAS_PREPARE:
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB | RT5682_PWR_BG,
-                        RT5682_PWR_MB | RT5682_PWR_BG);
+                        RT5682_PWR_BG, RT5682_PWR_BG);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO);
                 break;
 
         case SND_SOC_BIAS_STANDBY:
-                regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB, RT5682_PWR_MB);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL, RT5682_DIG_GATE_CTRL);
                 break;
@@ -2320,7 +2312,7 @@ static int rt5682_set_bias_level(struct snd_soc_component *component,
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_DIG_1,
                         RT5682_DIG_GATE_CTRL | RT5682_PWR_LDO, 0);
                 regmap_update_bits(rt5682->regmap, RT5682_PWR_ANLG_1,
-                        RT5682_PWR_MB | RT5682_PWR_BG, 0);
+                        RT5682_PWR_BG, 0);
                 break;
 
         default:
@@ -2363,6 +2355,8 @@ static int rt5682_resume(struct snd_soc_component *component)
         regcache_cache_only(rt5682->regmap, false);
         regcache_sync(rt5682->regmap);
 
+        rt5682_irq(0, rt5682);
+
         return 0;
 }
 #else
diff --git a/sound/soc/codecs/tlv320aic32x4-i2c.c b/sound/soc/codecs/tlv320aic32x4-i2c.c
index 385fa2e9525a..22c3a6bc0b6c 100644
--- a/sound/soc/codecs/tlv320aic32x4-i2c.c
+++ b/sound/soc/codecs/tlv320aic32x4-i2c.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -72,5 +72,5 @@ static struct i2c_driver aic32x4_i2c_driver = {
 module_i2c_driver(aic32x4_i2c_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver I2C");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/tlv320aic32x4-spi.c b/sound/soc/codecs/tlv320aic32x4-spi.c
index 07d78ae51e05..aa5b7ba0254b 100644
--- a/sound/soc/codecs/tlv320aic32x4-spi.c
+++ b/sound/soc/codecs/tlv320aic32x4-spi.c
@@ -3,7 +3,7 @@
  *
  * Copyright 2011 NW Digital Radio
  *
- * Author: Jeremy McDermond <nh6z@nh6z.net>
+ * Author: Annaliese McDermond <nh6z@nh6z.net>
  *
  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  *
@@ -74,5 +74,5 @@ static struct spi_driver aic32x4_spi_driver = {
 module_spi_driver(aic32x4_spi_driver);
 
 MODULE_DESCRIPTION("ASoC TLV320AIC32x4 codec driver SPI");
-MODULE_AUTHOR("Jeremy McDermond <nh6z@nh6z.net>");
+MODULE_AUTHOR("Annaliese McDermond <nh6z@nh6z.net>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 96f1526cb258..5520044929f4 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -490,6 +490,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
         SND_SOC_DAPM_INPUT("IN2_R"),
         SND_SOC_DAPM_INPUT("IN3_L"),
         SND_SOC_DAPM_INPUT("IN3_R"),
+        SND_SOC_DAPM_INPUT("CM_L"),
+        SND_SOC_DAPM_INPUT("CM_R"),
 };
 
 static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 283583d1db60..516d17cb2182 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1609,7 +1609,6 @@ static int aic3x_probe(struct snd_soc_component *component)
         struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
         int ret, i;
 
-        INIT_LIST_HEAD(&aic3x->list);
         aic3x->component = component;
 
         for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) {
@@ -1873,6 +1872,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c,
         if (ret != 0)
                 goto err_gpio;
 
+        INIT_LIST_HEAD(&aic3x->list);
         list_add(&aic3x->list, &reset_list);
 
         return 0;
@@ -1889,6 +1889,8 @@ static int aic3x_i2c_remove(struct i2c_client *client)
 {
         struct aic3x_priv *aic3x = i2c_get_clientdata(client);
 
+        list_del(&aic3x->list);
+
         if (gpio_is_valid(aic3x->gpio_reset) &&
             !aic3x_is_shared_reset(aic3x)) {
                 gpio_set_value(aic3x->gpio_reset, 0);
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index b93fdc8d2d6f..b0b48eb9c7c9 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -2905,6 +2905,8 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
                         wm_adsp_buffer_free(dsp);
 
+                dsp->fatal_error = false;
+
                 mutex_unlock(&dsp->pwr_lock);
 
                 adsp_dbg(dsp, "Execution stopped\n");
@@ -3000,6 +3002,9 @@ static int wm_adsp_compr_attach(struct wm_adsp_compr *compr)
 {
         struct wm_adsp_compr_buf *buf = NULL, *tmp;
 
+        if (compr->dsp->fatal_error)
+                return -EINVAL;
+
         list_for_each_entry(tmp, &compr->dsp->buffer_list, list) {
                 if (!tmp->name || !strcmp(compr->name, tmp->name)) {
                         buf = tmp;
@@ -3535,11 +3540,11 @@ static int wm_adsp_buffer_get_error(struct wm_adsp_compr_buf *buf)
 
         ret = wm_adsp_buffer_read(buf, HOST_BUFFER_FIELD(error), &buf->error);
         if (ret < 0) {
-                adsp_err(buf->dsp, "Failed to check buffer error: %d\n", ret);
+                compr_err(buf, "Failed to check buffer error: %d\n", ret);
                 return ret;
         }
         if (buf->error != 0) {
-                adsp_err(buf->dsp, "Buffer error occurred: %d\n", buf->error);
+                compr_err(buf, "Buffer error occurred: %d\n", buf->error);
                 return -EIO;
         }
 
@@ -3571,8 +3576,6 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
                 if (ret < 0)
                         break;
 
-                wm_adsp_buffer_clear(compr->buf);
-
                 /* Trigger the IRQ at one fragment of data */
                 ret = wm_adsp_buffer_write(compr->buf,
                                            HOST_BUFFER_FIELD(high_water_mark),
@@ -3584,6 +3587,8 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
                 }
                 break;
         case SNDRV_PCM_TRIGGER_STOP:
+                if (wm_adsp_compr_attached(compr))
+                        wm_adsp_buffer_clear(compr->buf);
                 break;
         default:
                 ret = -EINVAL;
@@ -3917,22 +3922,40 @@ int wm_adsp2_lock(struct wm_adsp *dsp, unsigned int lock_regions)
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_lock);
 
+static void wm_adsp_fatal_error(struct wm_adsp *dsp)
+{
+        struct wm_adsp_compr *compr;
+
+        dsp->fatal_error = true;
+
+        list_for_each_entry(compr, &dsp->compr_list, list) {
+                if (compr->stream) {
+                        snd_compr_stop_error(compr->stream,
+                                             SNDRV_PCM_STATE_XRUN);
+                        snd_compr_fragment_elapsed(compr->stream);
+                }
+        }
+}
+
 irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
 {
         unsigned int val;
         struct regmap *regmap = dsp->regmap;
         int ret = 0;
 
+        mutex_lock(&dsp->pwr_lock);
+
         ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
         if (ret) {
                 adsp_err(dsp,
                         "Failed to read Region Lock Ctrl register: %d\n", ret);
-                return IRQ_HANDLED;
+                goto error;
         }
 
         if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
                 adsp_err(dsp, "watchdog timeout error\n");
                 wm_adsp_stop_watchdog(dsp);
+                wm_adsp_fatal_error(dsp);
         }
 
         if (val & (ADSP2_SLAVE_ERR_MASK | ADSP2_REGION_LOCK_ERR_MASK)) {
@@ -3946,7 +3969,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
                         adsp_err(dsp,
                                  "Failed to read Bus Err Addr register: %d\n",
                                  ret);
-                        return IRQ_HANDLED;
+                        goto error;
                 }
 
                 adsp_err(dsp, "bus error address = 0x%x\n",
@@ -3959,7 +3982,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
                         adsp_err(dsp,
                                  "Failed to read Pmem Xmem Err Addr register: %d\n",
                                  ret);
-                        return IRQ_HANDLED;
+                        goto error;
                 }
 
                 adsp_err(dsp, "xmem error address = 0x%x\n",
@@ -3972,6 +3995,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
         regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
                            ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
 
+error:
+        mutex_unlock(&dsp->pwr_lock);
+
         return IRQ_HANDLED;
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
diff --git a/sound/soc/codecs/wm_adsp.h b/sound/soc/codecs/wm_adsp.h
index 59e07ad16329..8f09b4419a91 100644
--- a/sound/soc/codecs/wm_adsp.h
+++ b/sound/soc/codecs/wm_adsp.h
@@ -85,6 +85,7 @@ struct wm_adsp {
         bool preloaded;
         bool booted;
         bool running;
+        bool fatal_error;
 
         struct list_head ctl_list;
 
diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
index 528e8b108422..0b937924d2e4 100644
--- a/sound/soc/fsl/fsl_asrc.c
+++ b/sound/soc/fsl/fsl_asrc.c
@@ -445,6 +445,19 @@ struct dma_chan *fsl_asrc_get_dma_channel(struct fsl_asrc_pair *pair, bool dir)
 }
 EXPORT_SYMBOL_GPL(fsl_asrc_get_dma_channel);
 
+static int fsl_asrc_dai_startup(struct snd_pcm_substream *substream,
+                                struct snd_soc_dai *dai)
+{
+        struct fsl_asrc *asrc_priv = snd_soc_dai_get_drvdata(dai);
+
+        /* Odd channel number is not valid for older ASRC (channel_bits==3) */
+        if (asrc_priv->channel_bits == 3)
+                snd_pcm_hw_constraint_step(substream->runtime, 0,
+                                           SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+
+        return 0;
+}
+
 static int fsl_asrc_dai_hw_params(struct snd_pcm_substream *substream,
                                   struct snd_pcm_hw_params *params,
                                   struct snd_soc_dai *dai)
@@ -539,6 +552,7 @@ static int fsl_asrc_dai_trigger(struct snd_pcm_substream *substream, int cmd,
 }
 
 static const struct snd_soc_dai_ops fsl_asrc_dai_ops = {
+        .startup      = fsl_asrc_dai_startup,
         .hw_params    = fsl_asrc_dai_hw_params,
         .hw_free      = fsl_asrc_dai_hw_free,
         .trigger      = fsl_asrc_dai_trigger,
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index afe67c865330..3623aa9a6f2e 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -54,6 +54,8 @@ struct fsl_esai {
         u32 fifo_depth;
         u32 slot_width;
         u32 slots;
+        u32 tx_mask;
+        u32 rx_mask;
         u32 hck_rate[2];
         u32 sck_rate[2];
         bool hck_dir[2];
@@ -361,21 +363,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
         regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
-                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
-
         regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
                            ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
-                           ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
-        regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
-                           ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
-
         esai_priv->slot_width = slot_width;
         esai_priv->slots = slots;
+        esai_priv->tx_mask = tx_mask;
+        esai_priv->rx_mask = rx_mask;
 
         return 0;
 }
@@ -596,6 +590,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
         bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
         u8 i, channels = substream->runtime->channels;
         u32 pins = DIV_ROUND_UP(channels, esai_priv->slots);
+        u32 mask;
 
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
@@ -608,15 +603,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
                 for (i = 0; tx && i < channels; i++)
                         regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0);
 
+                /*
+                 * When set the TE/RE in the end of enablement flow, there
+                 * will be channel swap issue for multi data line case.
+                 * In order to workaround this issue, we switch the bit
+                 * enablement sequence to below sequence
+                 * 1) clear the xSMB & xSMA: which is done in probe and
+                 *                           stop state.
+                 * 2) set TE/RE
+                 * 3) set xSMB
+                 * 4) set xSMA:  xSMA is the last one in this flow, which
+                 *               will trigger esai to start.
+                 */
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                    tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK,
                                    tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins));
+                mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask;
+
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                   ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask));
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                   ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask));
+
                 break;
         case SNDRV_PCM_TRIGGER_SUSPEND:
         case SNDRV_PCM_TRIGGER_STOP:
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                    tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0);
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                   ESAI_xSMA_xS_MASK, 0);
+                regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                   ESAI_xSMB_xS_MASK, 0);
 
                 /* Disable and reset FIFO */
                 regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx),
@@ -906,6 +924,15 @@ static int fsl_esai_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        esai_priv->tx_mask = 0xFFFFFFFF;
+        esai_priv->rx_mask = 0xFFFFFFFF;
+
+        /* Clear the TSMA, TSMB, RSMA, RSMB */
+        regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0);
+        regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0);
+
         ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
                                               &fsl_esai_dai, 1);
         if (ret) {
diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
index bb12351330e8..69bc4848d787 100644
--- a/sound/soc/generic/audio-graph-card.c
+++ b/sound/soc/generic/audio-graph-card.c
@@ -20,6 +20,8 @@
 #include <linux/string.h>
 #include <sound/simple_card_utils.h>
 
+#define DPCM_SELECTABLE 1
+
 struct graph_priv {
         struct snd_soc_card snd_card;
         struct graph_dai_props {
@@ -440,6 +442,7 @@ static int graph_for_each_link(struct graph_priv *priv,
         struct device_node *codec_port;
         struct device_node *codec_port_old = NULL;
         struct asoc_simple_card_data adata;
+        uintptr_t dpcm_selectable = (uintptr_t)of_device_get_match_data(dev);
         int rc, ret;
 
         /* loop for all listed CPU port */
@@ -470,8 +473,9 @@ static int graph_for_each_link(struct graph_priv *priv,
                          * if Codec port has many endpoints,
                          * or has convert-xxx property
                          */
-                        if ((of_get_child_count(codec_port) > 1) ||
-                            adata.convert_rate || adata.convert_channels)
+                        if (dpcm_selectable &&
+                            ((of_get_child_count(codec_port) > 1) ||
+                             adata.convert_rate || adata.convert_channels))
                                 ret = func_dpcm(priv, cpu_ep, codec_ep, li,
                                                 (codec_port_old == codec_port));
                         /* else normal sound */
@@ -732,7 +736,8 @@ static int graph_remove(struct platform_device *pdev)
 
 static const struct of_device_id graph_of_match[] = {
         { .compatible = "audio-graph-card", },
-        { .compatible = "audio-graph-scu-card", },
+        { .compatible = "audio-graph-scu-card",
+          .data = (void *)DPCM_SELECTABLE },
         {},
 };
 MODULE_DEVICE_TABLE(of, graph_of_match);
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 7147bba45a2a..34de32efc4c4 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -9,12 +9,15 @@
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/string.h>
 #include <sound/simple_card.h>
 #include <sound/soc-dai.h>
 #include <sound/soc.h>
 
+#define DPCM_SELECTABLE 1
+
 struct simple_priv {
         struct snd_soc_card snd_card;
         struct simple_dai_props {
@@ -441,6 +444,7 @@ static int simple_for_each_link(struct simple_priv *priv,
         struct device *dev = simple_priv_to_dev(priv);
         struct device_node *top = dev->of_node;
         struct device_node *node;
+        uintptr_t dpcm_selectable = (uintptr_t)of_device_get_match_data(dev);
         bool is_top = 0;
         int ret = 0;
 
@@ -480,8 +484,9 @@ static int simple_for_each_link(struct simple_priv *priv,
                          * if it has many CPUs,
                          * or has convert-xxx property
                          */
-                        if (num > 2 ||
-                            adata.convert_rate || adata.convert_channels)
+                        if (dpcm_selectable &&
+                            (num > 2 ||
+                             adata.convert_rate || adata.convert_channels))
                                 ret = func_dpcm(priv, np, codec, li, is_top);
                         /* else normal sound */
                         else
@@ -822,7 +827,8 @@ static int simple_remove(struct platform_device *pdev)
 
 static const struct of_device_id simple_of_match[] = {
         { .compatible = "simple-audio-card", },
-        { .compatible = "simple-scu-audio-card", },
+        { .compatible = "simple-scu-audio-card",
+          .data = (void *)DPCM_SELECTABLE },
         {},
 };
 MODULE_DEVICE_TABLE(of, simple_of_match);
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 08cea5b5cda9..0e8b1c5eec88 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -706,9 +706,17 @@ static int sst_soc_probe(struct snd_soc_component *component)
         return sst_dsp_init_v2_dpcm(component);
 }
 
+static void sst_soc_remove(struct snd_soc_component *component)
+{
+        struct sst_data *drv = dev_get_drvdata(component->dev);
+
+        drv->soc_card = NULL;
+}
+
 static const struct snd_soc_component_driver sst_soc_platform_drv  = {
         .name           = DRV_NAME,
         .probe          = sst_soc_probe,
+        .remove         = sst_soc_remove,
         .ops            = &sst_platform_ops,
         .compr_ops      = &sst_platform_compr_ops,
         .pcm_new        = sst_pcm_new,
diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
index 3263b0495853..c0e0844f75b9 100644
--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
@@ -43,6 +43,7 @@ struct cht_mc_private {
         struct clk *mclk;
         struct snd_soc_jack jack;
         bool ts3a227e_present;
+        int quirks;
 };
 
 static int platform_clock_control(struct snd_soc_dapm_widget *w,
@@ -54,6 +55,10 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
         struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
         int ret;
 
+        /* See the comment in snd_cht_mc_probe() */
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                return 0;
+
         codec_dai = snd_soc_card_get_codec_dai(card, CHT_CODEC_DAI);
         if (!codec_dai) {
                 dev_err(card->dev, "Codec dai not found; Unable to set platform clock\n");
@@ -223,6 +228,10 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
                         "jack detection gpios not added, error %d\n", ret);
         }
 
+        /* See the comment in snd_cht_mc_probe() */
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                return 0;
+
         /*
          * The firmware might enable the clock at
          * boot (this information may or may not
@@ -423,16 +432,15 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         const char *mclk_name;
         struct snd_soc_acpi_mach *mach;
         const char *platform_name;
-        int quirks = 0;
-
-        dmi_id = dmi_first_match(cht_max98090_quirk_table);
-        if (dmi_id)
-                quirks = (unsigned long)dmi_id->driver_data;
 
         drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
         if (!drv)
                 return -ENOMEM;
 
+        dmi_id = dmi_first_match(cht_max98090_quirk_table);
+        if (dmi_id)
+                drv->quirks = (unsigned long)dmi_id->driver_data;
+
         drv->ts3a227e_present = acpi_dev_found("104C227E");
         if (!drv->ts3a227e_present) {
                 /* no need probe TI jack detection chip */
@@ -458,7 +466,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         snd_soc_card_cht.dev = &pdev->dev;
         snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
 
-        if (quirks & QUIRK_PMC_PLT_CLK_0)
+        if (drv->quirks & QUIRK_PMC_PLT_CLK_0)
                 mclk_name = "pmc_plt_clk_0";
         else
                 mclk_name = "pmc_plt_clk_3";
@@ -471,6 +479,21 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
                 return PTR_ERR(drv->mclk);
         }
 
+        /*
+         * Boards which have the MAX98090's clk connected to clk_0 do not seem
+         * to like it if we muck with the clock. If we disable the clock when
+         * it is unused we get "max98090 i2c-193C9890:00: PLL unlocked" errors
+         * and the PLL never seems to lock again.
+         * So for these boards we enable it here once and leave it at that.
+         */
+        if (drv->quirks & QUIRK_PMC_PLT_CLK_0) {
+                ret_val = clk_prepare_enable(drv->mclk);
+                if (ret_val < 0) {
+                        dev_err(&pdev->dev, "MCLK enable error: %d\n", ret_val);
+                        return ret_val;
+                }
+        }
+
         ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
         if (ret_val) {
                 dev_err(&pdev->dev,
@@ -481,11 +504,23 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
         return ret_val;
 }
 
+static int snd_cht_mc_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
+
+        if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
+                clk_disable_unprepare(ctx->mclk);
+
+        return 0;
+}
+
 static struct platform_driver snd_cht_mc_driver = {
         .driver = {
                 .name = "cht-bsw-max98090",
         },
         .probe = snd_cht_mc_probe,
+        .remove = snd_cht_mc_remove,
 };
 
 module_platform_driver(snd_cht_mc_driver)
diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
index 7044d8c2b187..879f14257a3e 100644
--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -405,7 +405,7 @@ static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
 };
 
 static const unsigned int dmic_2ch[] = {
-        4,
+        2,
 };
 
 static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index 28c4806b196a..4bf70b4429f0 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -483,6 +483,7 @@ static void skl_set_base_module_format(struct skl_sst *ctx,
         base_cfg->audio_fmt.bit_depth = format->bit_depth;
         base_cfg->audio_fmt.valid_bit_depth = format->valid_bit_depth;
         base_cfg->audio_fmt.ch_cfg = format->ch_cfg;
+        base_cfg->audio_fmt.sample_type = format->sample_type;
 
         dev_dbg(ctx->dev, "bit_depth=%x valid_bd=%x ch_config=%x\n",
                         format->bit_depth, format->valid_bit_depth,
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 1ae83f4ccc36..9735e2412251 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -181,6 +181,7 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
         struct hdac_stream *hstream;
         struct hdac_ext_stream *stream;
         struct hdac_ext_link *link;
+        unsigned char stream_tag;
 
         hstream = snd_hdac_get_stream(bus, params->stream,
                                         params->link_dma_id + 1);
@@ -199,10 +200,13 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
 
         snd_hdac_ext_link_stream_setup(stream, format_val);
 
-        list_for_each_entry(link, &bus->hlink_list, list) {
-                if (link->index == params->link_index)
-                        snd_hdac_ext_link_set_stream_id(link,
-                                        hstream->stream_tag);
+        stream_tag = hstream->stream_tag;
+        if (stream->hstream.direction == SNDRV_PCM_STREAM_PLAYBACK) {
+                list_for_each_entry(link, &bus->hlink_list, list) {
+                        if (link->index == params->link_index)
+                                snd_hdac_ext_link_set_stream_id(link,
+                                                                stream_tag);
+                }
         }
 
         stream->link_prepared = 1;
@@ -645,6 +649,7 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
         struct hdac_ext_stream *link_dev =
                                 snd_soc_dai_get_dma_data(dai, substream);
         struct hdac_ext_link *link;
+        unsigned char stream_tag;
 
         dev_dbg(dai->dev, "%s: %s\n", __func__, dai->name);
 
@@ -654,7 +659,11 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
         if (!link)
                 return -EINVAL;
 
-        snd_hdac_ext_link_clear_stream_id(link, hdac_stream(link_dev)->stream_tag);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                stream_tag = hdac_stream(link_dev)->stream_tag;
+                snd_hdac_ext_link_clear_stream_id(link, stream_tag);
+        }
+
         snd_hdac_ext_stream_release(link_dev, HDAC_EXT_STREAM_TYPE_LINK);
         return 0;
 }
@@ -1453,13 +1462,20 @@ static int skl_platform_soc_probe(struct snd_soc_component *component)
         return 0;
 }
 
+static void skl_pcm_remove(struct snd_soc_component *component)
+{
+        /* remove topology */
+        snd_soc_tplg_component_remove(component, SND_SOC_TPLG_INDEX_ALL);
+}
+
 static const struct snd_soc_component_driver skl_component  = {
         .name           = "pcm",
         .probe          = skl_platform_soc_probe,
+        .remove         = skl_pcm_remove,
         .ops            = &skl_platform_ops,
         .pcm_new        = skl_pcm_new,
         .pcm_free       = skl_pcm_free,
-        .ignore_module_refcount = 1, /* do not increase the refcount in core */
+        .module_get_upon_open = 1, /* increment refcount when a pcm is opened */
 };
 
 int skl_platform_register(struct device *dev)
diff --git a/sound/soc/mediatek/common/mtk-btcvsd.c b/sound/soc/mediatek/common/mtk-btcvsd.c
index 1b8bcdaf02d1..9a163d7064d1 100644
--- a/sound/soc/mediatek/common/mtk-btcvsd.c
+++ b/sound/soc/mediatek/common/mtk-btcvsd.c
@@ -49,6 +49,7 @@ enum bt_sco_state {
         BT_SCO_STATE_IDLE,
         BT_SCO_STATE_RUNNING,
         BT_SCO_STATE_ENDING,
+        BT_SCO_STATE_LOOPBACK,
 };
 
 enum bt_sco_direct {
@@ -486,7 +487,8 @@ static irqreturn_t mtk_btcvsd_snd_irq_handler(int irq_id, void *dev)
         if (bt->rx->state != BT_SCO_STATE_RUNNING &&
             bt->rx->state != BT_SCO_STATE_ENDING &&
             bt->tx->state != BT_SCO_STATE_RUNNING &&
-            bt->tx->state != BT_SCO_STATE_ENDING) {
+            bt->tx->state != BT_SCO_STATE_ENDING &&
+            bt->tx->state != BT_SCO_STATE_LOOPBACK) {
                 dev_warn(bt->dev, "%s(), in idle state: rx->state: %d, tx->state: %d\n",
                          __func__, bt->rx->state, bt->tx->state);
                 goto irq_handler_exit;
@@ -512,6 +514,42 @@ static irqreturn_t mtk_btcvsd_snd_irq_handler(int irq_id, void *dev)
         buf_cnt_tx = btsco_packet_info[packet_type][2];
         buf_cnt_rx = btsco_packet_info[packet_type][3];
 
+        if (bt->tx->state == BT_SCO_STATE_LOOPBACK) {
+                u8 *src, *dst;
+                unsigned long connsys_addr_rx, ap_addr_rx;
+                unsigned long connsys_addr_tx, ap_addr_tx;
+
+                connsys_addr_rx = *bt->bt_reg_pkt_r;
+                ap_addr_rx = (unsigned long)bt->bt_sram_bank2_base +
+                             (connsys_addr_rx & 0xFFFF);
+
+                connsys_addr_tx = *bt->bt_reg_pkt_w;
+                ap_addr_tx = (unsigned long)bt->bt_sram_bank2_base +
+                             (connsys_addr_tx & 0xFFFF);
+
+                if (connsys_addr_tx == 0xdeadfeed ||
+                    connsys_addr_rx == 0xdeadfeed) {
+                        /* bt return 0xdeadfeed if read reg during bt sleep */
+                        dev_warn(bt->dev, "%s(), connsys_addr_tx == 0xdeadfeed\n",
+                                 __func__);
+                        goto irq_handler_exit;
+                }
+
+                src = (u8 *)ap_addr_rx;
+                dst = (u8 *)ap_addr_tx;
+
+                mtk_btcvsd_snd_data_transfer(BT_SCO_DIRECT_BT2ARM, src,
+                                             bt->tx->temp_packet_buf,
+                                             packet_length,
+                                             packet_num);
+                mtk_btcvsd_snd_data_transfer(BT_SCO_DIRECT_ARM2BT,
+                                             bt->tx->temp_packet_buf, dst,
+                                             packet_length,
+                                             packet_num);
+                bt->rx->rw_cnt++;
+                bt->tx->rw_cnt++;
+        }
+
         if (bt->rx->state == BT_SCO_STATE_RUNNING ||
             bt->rx->state == BT_SCO_STATE_ENDING) {
                 if (bt->rx->xrun) {
@@ -1067,6 +1105,33 @@ static int btcvsd_band_set(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+static int btcvsd_loopback_get(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_component *cmpnt = snd_soc_kcontrol_component(kcontrol);
+        struct mtk_btcvsd_snd *bt = snd_soc_component_get_drvdata(cmpnt);
+        bool lpbk_en = bt->tx->state == BT_SCO_STATE_LOOPBACK;
+
+        ucontrol->value.integer.value[0] = lpbk_en;
+        return 0;
+}
+
+static int btcvsd_loopback_set(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_component *cmpnt = snd_soc_kcontrol_component(kcontrol);
+        struct mtk_btcvsd_snd *bt = snd_soc_component_get_drvdata(cmpnt);
+
+        if (ucontrol->value.integer.value[0]) {
+                mtk_btcvsd_snd_set_state(bt, bt->tx, BT_SCO_STATE_LOOPBACK);
+                mtk_btcvsd_snd_set_state(bt, bt->rx, BT_SCO_STATE_LOOPBACK);
+        } else {
+                mtk_btcvsd_snd_set_state(bt, bt->tx, BT_SCO_STATE_RUNNING);
+                mtk_btcvsd_snd_set_state(bt, bt->rx, BT_SCO_STATE_RUNNING);
+        }
+        return 0;
+}
+
 static int btcvsd_tx_mute_get(struct snd_kcontrol *kcontrol,
                               struct snd_ctl_elem_value *ucontrol)
 {
@@ -1202,6 +1267,8 @@ static int btcvsd_tx_timestamp_get(struct snd_kcontrol *kcontrol,
 static const struct snd_kcontrol_new mtk_btcvsd_snd_controls[] = {
         SOC_ENUM_EXT("BTCVSD Band", btcvsd_enum[0],
                      btcvsd_band_get, btcvsd_band_set),
+        SOC_SINGLE_BOOL_EXT("BTCVSD Loopback Switch", 0,
+                            btcvsd_loopback_get, btcvsd_loopback_set),
         SOC_SINGLE_BOOL_EXT("BTCVSD Tx Mute Switch", 0,
                             btcvsd_tx_mute_get, btcvsd_tx_mute_set),
         SOC_SINGLE_BOOL_EXT("BTCVSD Tx Irq Received Switch", 0,
diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-clk.c b/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
index f523ad103acc..48e81c5d52fc 100644
--- a/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
+++ b/sound/soc/mediatek/mt8183/mt8183-afe-clk.c
@@ -605,6 +605,10 @@ void mt8183_mck_disable(struct mtk_base_afe *afe, int mck_id)
         int m_sel_id = mck_div[mck_id].m_sel_id;
         int div_clk_id = mck_div[mck_id].div_clk_id;
 
+        /* i2s5 mck not support */
+        if (mck_id == MT8183_I2S5_MCK)
+                return;
+
         clk_disable_unprepare(afe_priv->clk[div_clk_id]);
         if (m_sel_id >= 0)
                 clk_disable_unprepare(afe_priv->clk[m_sel_id]);
diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
index 400e29edb1c9..d0b403a0e27b 100644
--- a/sound/soc/rockchip/rockchip_pdm.c
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -24,7 +24,7 @@
 
 #include "rockchip_pdm.h"
 
-#define PDM_DMA_BURST_SIZE      (16) /* size * width: 16*4 = 64 bytes */
+#define PDM_DMA_BURST_SIZE      (8) /* size * width: 8*4 = 32 bytes */
 
 struct rk_pdm_dev {
         struct device *dev;
@@ -208,7 +208,9 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
                 return -EINVAL;
         }
 
+        pm_runtime_get_sync(cpu_dai->dev);
         regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
+        pm_runtime_put(cpu_dai->dev);
 
         return 0;
 }
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index 4231001226f4..ab471d550d17 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -1130,11 +1130,11 @@ static const struct snd_soc_dapm_widget samsung_i2s_widgets[] = {
 };
 
 static const struct snd_soc_dapm_route samsung_i2s_dapm_routes[] = {
-        { "Playback Mixer", NULL, "Primary" },
-        { "Playback Mixer", NULL, "Secondary" },
+        { "Playback Mixer", NULL, "Primary Playback" },
+        { "Playback Mixer", NULL, "Secondary Playback" },
 
         { "Mixer DAI TX", NULL, "Playback Mixer" },
-        { "Playback Mixer", NULL, "Mixer DAI RX" },
+        { "Primary Capture", NULL, "Mixer DAI RX" },
 };
 
 static const struct snd_soc_component_driver samsung_i2s_component = {
@@ -1155,7 +1155,8 @@ static int i2s_alloc_dais(struct samsung_i2s_priv *priv,
                           int num_dais)
 {
         static const char *dai_names[] = { "samsung-i2s", "samsung-i2s-sec" };
-        static const char *stream_names[] = { "Primary", "Secondary" };
+        static const char *stream_names[] = { "Primary Playback",
+                                              "Secondary Playback" };
         struct snd_soc_dai_driver *dai_drv;
         struct i2s_dai *dai;
         int i;
@@ -1201,6 +1202,7 @@ static int i2s_alloc_dais(struct samsung_i2s_priv *priv,
         dai_drv->capture.channels_max = 2;
         dai_drv->capture.rates = i2s_dai_data->pcm_rates;
         dai_drv->capture.formats = SAMSUNG_I2S_FMTS;
+        dai_drv->capture.stream_name = "Primary Capture";
 
         return 0;
 }
diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
index 694512f980fd..1dc54c4206f0 100644
--- a/sound/soc/samsung/odroid.c
+++ b/sound/soc/samsung/odroid.c
@@ -91,11 +91,11 @@ static int odroid_card_be_hw_params(struct snd_pcm_substream *substream,
                 return ret;
 
         /*
-         *  We add 1 to the rclk_freq value in order to avoid too low clock
+         *  We add 2 to the rclk_freq value in order to avoid too low clock
          *  frequency values due to the EPLL output frequency not being exact
          *  multiple of the audio sampling rate.
          */
-        rclk_freq = params_rate(params) * rfs + 1;
+        rclk_freq = params_rate(params) * rfs + 2;
 
         ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
         if (ret < 0)
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 022996d2db13..4fe83e611c01 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -110,6 +110,8 @@ static const struct of_device_id rsnd_of_match[] = {
         { .compatible = "renesas,rcar_sound-gen1", .data = (void *)RSND_GEN1 },
         { .compatible = "renesas,rcar_sound-gen2", .data = (void *)RSND_GEN2 },
         { .compatible = "renesas,rcar_sound-gen3", .data = (void *)RSND_GEN3 },
+        /* Special Handling */
+        { .compatible = "renesas,rcar_sound-r8a77990", .data = (void *)(RSND_GEN3 | RSND_SOC_E) },
         {},
 };
 MODULE_DEVICE_TABLE(of, rsnd_of_match);
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 90625c57847b..0e6ef4e18400 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -607,6 +607,8 @@ struct rsnd_priv {
 #define RSND_GEN1       (1 << 0)
 #define RSND_GEN2       (2 << 0)
 #define RSND_GEN3       (3 << 0)
+#define RSND_SOC_MASK   (0xFF << 4)
+#define RSND_SOC_E      (1 << 4) /* E1/E2/E3 */
 
         /*
          * below value will be filled on rsnd_gen_probe()
@@ -679,6 +681,9 @@ struct rsnd_priv {
 #define rsnd_is_gen1(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN1)
 #define rsnd_is_gen2(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN2)
 #define rsnd_is_gen3(priv)      (((priv)->flags & RSND_GEN_MASK) == RSND_GEN3)
+#define rsnd_is_e3(priv)        (((priv)->flags & \
+                                        (RSND_GEN_MASK | RSND_SOC_MASK)) == \
+                                        (RSND_GEN3 | RSND_SOC_E))
 
 #define rsnd_flags_has(p, f) ((p)->flags & (f))
 #define rsnd_flags_set(p, f) ((p)->flags |= (f))
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index db81e066b92e..585ffba0244b 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -14,7 +14,6 @@
  */
 
 #include "rsnd.h"
-#include <linux/sys_soc.h>
 
 #define SRC_NAME "src"
 
@@ -135,7 +134,7 @@ unsigned int rsnd_src_get_rate(struct rsnd_priv *priv,
         return rate;
 }
 
-const static u32 bsdsr_table_pattern1[] = {
+static const u32 bsdsr_table_pattern1[] = {
         0x01800000, /* 6 - 1/6 */
         0x01000000, /* 6 - 1/4 */
         0x00c00000, /* 6 - 1/3 */
@@ -144,7 +143,7 @@ const static u32 bsdsr_table_pattern1[] = {
         0x00400000, /* 6 - 1   */
 };
 
-const static u32 bsdsr_table_pattern2[] = {
+static const u32 bsdsr_table_pattern2[] = {
         0x02400000, /* 6 - 1/6 */
         0x01800000, /* 6 - 1/4 */
         0x01200000, /* 6 - 1/3 */
@@ -153,7 +152,7 @@ const static u32 bsdsr_table_pattern2[] = {
         0x00600000, /* 6 - 1   */
 };
 
-const static u32 bsisr_table[] = {
+static const u32 bsisr_table[] = {
         0x00100060, /* 6 - 1/6 */
         0x00100040, /* 6 - 1/4 */
         0x00100030, /* 6 - 1/3 */
@@ -162,7 +161,7 @@ const static u32 bsisr_table[] = {
         0x00100020, /* 6 - 1   */
 };
 
-const static u32 chan288888[] = {
+static const u32 chan288888[] = {
         0x00000006, /* 1 to 2 */
         0x000001fe, /* 1 to 8 */
         0x000001fe, /* 1 to 8 */
@@ -171,7 +170,7 @@ const static u32 chan288888[] = {
         0x000001fe, /* 1 to 8 */
 };
 
-const static u32 chan244888[] = {
+static const u32 chan244888[] = {
         0x00000006, /* 1 to 2 */
         0x0000001e, /* 1 to 4 */
         0x0000001e, /* 1 to 4 */
@@ -180,7 +179,7 @@ const static u32 chan244888[] = {
         0x000001fe, /* 1 to 8 */
 };
 
-const static u32 chan222222[] = {
+static const u32 chan222222[] = {
         0x00000006, /* 1 to 2 */
         0x00000006, /* 1 to 2 */
         0x00000006, /* 1 to 2 */
@@ -189,18 +188,12 @@ const static u32 chan222222[] = {
         0x00000006, /* 1 to 2 */
 };
 
-static const struct soc_device_attribute ov_soc[] = {
-        { .soc_id = "r8a77990" }, /* E3 */
-        { /* sentinel */ }
-};
-
 static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
                                       struct rsnd_mod *mod)
 {
         struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
         struct device *dev = rsnd_priv_to_dev(priv);
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
-        const struct soc_device_attribute *soc = soc_device_match(ov_soc);
         int is_play = rsnd_io_is_play(io);
         int use_src = 0;
         u32 fin, fout;
@@ -307,7 +300,7 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         /*
          * E3 need to overwrite
          */
-        if (soc)
+        if (rsnd_is_e3(priv))
                 switch (rsnd_mod_id(mod)) {
                 case 0:
                 case 4:
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 93d316d5bf8e..46e3ab0fced4 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -947,7 +947,7 @@ static void soc_cleanup_component(struct snd_soc_component *component)
         snd_soc_dapm_free(snd_soc_component_get_dapm(component));
         soc_cleanup_component_debugfs(component);
         component->card = NULL;
-        if (!component->driver->ignore_module_refcount)
+        if (!component->driver->module_get_upon_open)
                 module_put(component->dev->driver->owner);
 }
 
@@ -1381,7 +1381,7 @@ static int soc_probe_component(struct snd_soc_card *card,
                 return 0;
         }
 
-        if (!component->driver->ignore_module_refcount &&
+        if (!component->driver->module_get_upon_open &&
             !try_module_get(component->dev->driver->owner))
                 return -ENODEV;
 
@@ -2797,6 +2797,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
 
                 ret = soc_init_dai_link(card, link);
                 if (ret) {
+                        soc_cleanup_platform(card);
                         dev_err(card->dev, "ASoC: failed to init link %s\n",
                                 link->name);
                         mutex_unlock(&client_mutex);
@@ -2819,6 +2820,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
         card->instantiated = 0;
         mutex_init(&card->mutex);
         mutex_init(&card->dapm_mutex);
+        spin_lock_init(&card->dpcm_lock);
 
         return snd_soc_bind_card(card);
 }
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1ec06ef6d161..0382a47b30bd 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3650,6 +3650,13 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
         case snd_soc_dapm_dac:
         case snd_soc_dapm_aif_in:
         case snd_soc_dapm_pga:
+        case snd_soc_dapm_buffer:
+        case snd_soc_dapm_scheduler:
+        case snd_soc_dapm_effect:
+        case snd_soc_dapm_src:
+        case snd_soc_dapm_asrc:
+        case snd_soc_dapm_encoder:
+        case snd_soc_dapm_decoder:
         case snd_soc_dapm_out_drv:
         case snd_soc_dapm_micbias:
         case snd_soc_dapm_line:
@@ -3957,6 +3964,10 @@ snd_soc_dapm_free_kcontrol(struct snd_soc_card *card,
         int count;
 
         devm_kfree(card->dev, (void *)*private_value);
+
+        if (!w_param_text)
+                return;
+
         for (count = 0 ; count < num_params; count++)
                 devm_kfree(card->dev, (void *)w_param_text[count]);
         devm_kfree(card->dev, w_param_text);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 0d5ec68a1e50..be80a12fba27 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -15,6 +15,7 @@
 #include <linux/delay.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/pm_runtime.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/export.h>
@@ -463,6 +464,9 @@ static int soc_pcm_components_close(struct snd_pcm_substream *substream,
                         continue;
 
                 component->driver->ops->close(substream);
+
+                if (component->driver->module_get_upon_open)
+                        module_put(component->dev->driver->owner);
         }
 
         return 0;
@@ -513,6 +517,12 @@ static int soc_pcm_open(struct snd_pcm_substream *substream)
                     !component->driver->ops->open)
                         continue;
 
+                if (component->driver->module_get_upon_open &&
+                    !try_module_get(component->dev->driver->owner)) {
+                        ret = -ENODEV;
+                        goto module_err;
+                }
+
                 ret = component->driver->ops->open(substream);
                 if (ret < 0) {
                         dev_err(component->dev,
@@ -628,7 +638,7 @@ codec_dai_err:
 
 component_err:
         soc_pcm_components_close(substream, component);
-
+module_err:
         if (cpu_dai->driver->ops->shutdown)
                 cpu_dai->driver->ops->shutdown(substream, cpu_dai);
 out:
@@ -954,10 +964,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
                 codec_params = *params;
 
                 /* fixup params based on TDM slot masks */
-                if (codec_dai->tx_mask)
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+                    codec_dai->tx_mask)
                         soc_pcm_codec_params_fixup(&codec_params,
                                                    codec_dai->tx_mask);
-                if (codec_dai->rx_mask)
+
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
+                    codec_dai->rx_mask)
                         soc_pcm_codec_params_fixup(&codec_params,
                                                    codec_dai->rx_mask);
 
@@ -1213,6 +1226,7 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
                 struct snd_soc_pcm_runtime *be, int stream)
 {
         struct snd_soc_dpcm *dpcm;
+        unsigned long flags;
 
         /* only add new dpcms */
         for_each_dpcm_be(fe, stream, dpcm) {
@@ -1228,8 +1242,10 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
         dpcm->fe = fe;
         be->dpcm[stream].runtime = fe->dpcm[stream].runtime;
         dpcm->state = SND_SOC_DPCM_LINK_STATE_NEW;
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         list_add(&dpcm->list_be, &fe->dpcm[stream].be_clients);
         list_add(&dpcm->list_fe, &be->dpcm[stream].fe_clients);
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         dev_dbg(fe->dev, "connected new DPCM %s path %s %s %s\n",
                         stream ? "capture" : "playback",  fe->dai_link->name,
@@ -1275,6 +1291,7 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
 void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
 {
         struct snd_soc_dpcm *dpcm, *d;
+        unsigned long flags;
 
         for_each_dpcm_be_safe(fe, stream, dpcm, d) {
                 dev_dbg(fe->dev, "ASoC: BE %s disconnect check for %s\n",
@@ -1294,8 +1311,10 @@ void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
 #ifdef CONFIG_DEBUG_FS
                 debugfs_remove(dpcm->debugfs_state);
 #endif
+                spin_lock_irqsave(&fe->card->dpcm_lock, flags);
                 list_del(&dpcm->list_be);
                 list_del(&dpcm->list_fe);
+                spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
                 kfree(dpcm);
         }
 }
@@ -1547,10 +1566,13 @@ int dpcm_process_paths(struct snd_soc_pcm_runtime *fe,
 void dpcm_clear_pending_state(struct snd_soc_pcm_runtime *fe, int stream)
 {
         struct snd_soc_dpcm *dpcm;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm)
                 dpcm->be->dpcm[stream].runtime_update =
                                                 SND_SOC_DPCM_UPDATE_NO;
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 }
 
 static void dpcm_be_dai_startup_unwind(struct snd_soc_pcm_runtime *fe,
@@ -1899,10 +1921,15 @@ static int dpcm_apply_symmetry(struct snd_pcm_substream *fe_substream,
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 struct snd_pcm_substream *be_substream =
                         snd_soc_dpcm_get_substream(be, stream);
-                struct snd_soc_pcm_runtime *rtd = be_substream->private_data;
+                struct snd_soc_pcm_runtime *rtd;
                 struct snd_soc_dai *codec_dai;
                 int i;
 
+                /* A backend may not have the requested substream */
+                if (!be_substream)
+                        continue;
+
+                rtd = be_substream->private_data;
                 if (rtd->dai_link->be_hw_params_fixup)
                         continue;
 
@@ -2571,6 +2598,7 @@ static int dpcm_run_update_startup(struct snd_soc_pcm_runtime *fe, int stream)
         struct snd_soc_dpcm *dpcm;
         enum snd_soc_dpcm_trigger trigger = fe->dai_link->trigger[stream];
         int ret;
+        unsigned long flags;
 
         dev_dbg(fe->dev, "ASoC: runtime %s open on FE %s\n",
                         stream ? "capture" : "playback", fe->dai_link->name);
@@ -2640,11 +2668,13 @@ close:
         dpcm_be_dai_shutdown(fe, stream);
 disconnect:
         /* disconnect any non started BEs */
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm) {
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
                                 dpcm->state = SND_SOC_DPCM_LINK_STATE_FREE;
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         return ret;
 }
@@ -3221,7 +3251,10 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
 {
         struct snd_soc_dpcm *dpcm;
         int state;
+        int ret = 1;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_fe(be, stream, dpcm) {
 
                 if (dpcm->fe == fe)
@@ -3230,12 +3263,15 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
                 state = dpcm->fe->dpcm[stream].state;
                 if (state == SND_SOC_DPCM_STATE_START ||
                         state == SND_SOC_DPCM_STATE_PAUSED ||
-                        state == SND_SOC_DPCM_STATE_SUSPEND)
-                        return 0;
+                        state == SND_SOC_DPCM_STATE_SUSPEND) {
+                        ret = 0;
+                        break;
+                }
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         /* it's safe to free/stop this BE DAI */
-        return 1;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_free_stop);
 
@@ -3248,7 +3284,10 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
 {
         struct snd_soc_dpcm *dpcm;
         int state;
+        int ret = 1;
+        unsigned long flags;
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_fe(be, stream, dpcm) {
 
                 if (dpcm->fe == fe)
@@ -3258,12 +3297,15 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
                 if (state == SND_SOC_DPCM_STATE_START ||
                         state == SND_SOC_DPCM_STATE_PAUSED ||
                         state == SND_SOC_DPCM_STATE_SUSPEND ||
-                        state == SND_SOC_DPCM_STATE_PREPARE)
-                        return 0;
+                        state == SND_SOC_DPCM_STATE_PREPARE) {
+                        ret = 0;
+                        break;
+                }
         }
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 
         /* it's safe to change hw_params */
-        return 1;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_params);
 
@@ -3302,6 +3344,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
         struct snd_pcm_hw_params *params = &fe->dpcm[stream].hw_params;
         struct snd_soc_dpcm *dpcm;
         ssize_t offset = 0;
+        unsigned long flags;
 
         /* FE state */
         offset += snprintf(buf + offset, size - offset,
@@ -3329,6 +3372,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                 goto out;
         }
 
+        spin_lock_irqsave(&fe->card->dpcm_lock, flags);
         for_each_dpcm_be(fe, stream, dpcm) {
                 struct snd_soc_pcm_runtime *be = dpcm->be;
                 params = &dpcm->hw_params;
@@ -3349,7 +3393,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                                 params_channels(params),
                                 params_rate(params));
         }
-
+        spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
 out:
         return offset;
 }
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 25fca7055464..96852d250619 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -482,10 +482,11 @@ static void remove_widget(struct snd_soc_component *comp,
 
                         snd_ctl_remove(card, kcontrol);
 
-                        kfree(dobj->control.dvalues);
+                        /* free enum kcontrol's dvalues and dtexts */
+                        kfree(se->dobj.control.dvalues);
                         for (j = 0; j < se->items; j++)
-                                kfree(dobj->control.dtexts[j]);
-                        kfree(dobj->control.dtexts);
+                                kfree(se->dobj.control.dtexts[j]);
+                        kfree(se->dobj.control.dtexts);
 
                         kfree(se);
                         kfree(w->kcontrol_news[i].name);
diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c
index 47901983a6ff..78bed9734713 100644
--- a/sound/soc/stm/stm32_adfsdm.c
+++ b/sound/soc/stm/stm32_adfsdm.c
@@ -9,6 +9,7 @@
 
 #include <linux/clk.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
@@ -37,6 +38,8 @@ struct stm32_adfsdm_priv {
         /* PCM buffer */
         unsigned char *pcm_buff;
         unsigned int pos;
+
+        struct mutex lock; /* protect against race condition on iio state */
 };
 
 static const struct snd_pcm_hardware stm32_adfsdm_pcm_hw = {
@@ -62,10 +65,12 @@ static void stm32_adfsdm_shutdown(struct snd_pcm_substream *substream,
 {
         struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
 
+        mutex_lock(&priv->lock);
         if (priv->iio_active) {
                 iio_channel_stop_all_cb(priv->iio_cb);
                 priv->iio_active = false;
         }
+        mutex_unlock(&priv->lock);
 }
 
 static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
@@ -74,13 +79,19 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
         struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
         int ret;
 
+        mutex_lock(&priv->lock);
+        if (priv->iio_active) {
+                iio_channel_stop_all_cb(priv->iio_cb);
+                priv->iio_active = false;
+        }
+
         ret = iio_write_channel_attribute(priv->iio_ch,
                                           substream->runtime->rate, 0,
                                           IIO_CHAN_INFO_SAMP_FREQ);
         if (ret < 0) {
                 dev_err(dai->dev, "%s: Failed to set %d sampling rate\n",
                         __func__, substream->runtime->rate);
-                return ret;
+                goto out;
         }
 
         if (!priv->iio_active) {
@@ -92,6 +103,9 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
                                 __func__, ret);
         }
 
+out:
+        mutex_unlock(&priv->lock);
+
         return ret;
 }
 
@@ -291,6 +305,7 @@ MODULE_DEVICE_TABLE(of, stm32_adfsdm_of_match);
 static int stm32_adfsdm_probe(struct platform_device *pdev)
 {
         struct stm32_adfsdm_priv *priv;
+        struct snd_soc_component *component;
         int ret;
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
@@ -299,6 +314,7 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
 
         priv->dev = &pdev->dev;
         priv->dai_drv = stm32_adfsdm_dai;
+        mutex_init(&priv->lock);
 
         dev_set_drvdata(&pdev->dev, priv);
 
@@ -317,9 +333,15 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
         if (IS_ERR(priv->iio_cb))
                 return PTR_ERR(priv->iio_cb);
 
-        ret = devm_snd_soc_register_component(&pdev->dev,
-                                              &stm32_adfsdm_soc_platform,
-                                              NULL, 0);
+        component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL);
+        if (!component)
+                return -ENOMEM;
+#ifdef CONFIG_DEBUG_FS
+        component->debugfs_prefix = "pcm";
+#endif
+
+        ret = snd_soc_add_component(&pdev->dev, component,
+                                    &stm32_adfsdm_soc_platform, NULL, 0);
         if (ret < 0)
                 dev_err(&pdev->dev, "%s: Failed to register PCM platform\n",
                         __func__);
@@ -327,12 +349,20 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
         return ret;
 }
 
+static int stm32_adfsdm_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_component(&pdev->dev);
+
+        return 0;
+}
+
 static struct platform_driver stm32_adfsdm_driver = {
         .driver = {
                    .name = STM32_ADFSDM_DRV_NAME,
                    .of_match_table = stm32_adfsdm_of_match,
                    },
         .probe = stm32_adfsdm_probe,
+        .remove = stm32_adfsdm_remove,
 };
 
 module_platform_driver(stm32_adfsdm_driver);
diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c
index 47c334de6b09..8968458eec62 100644
--- a/sound/soc/stm/stm32_i2s.c
+++ b/sound/soc/stm/stm32_i2s.c
@@ -281,7 +281,6 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
         case STM32_I2S_CFG2_REG:
         case STM32_I2S_IER_REG:
         case STM32_I2S_SR_REG:
-        case STM32_I2S_TXDR_REG:
         case STM32_I2S_RXDR_REG:
         case STM32_I2S_CGFR_REG:
                 return true;
@@ -293,7 +292,7 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
 static bool stm32_i2s_volatile_reg(struct device *dev, unsigned int reg)
 {
         switch (reg) {
-        case STM32_I2S_TXDR_REG:
+        case STM32_I2S_SR_REG:
         case STM32_I2S_RXDR_REG:
                 return true;
         default:
diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
index 14c9591aae42..d68d62f12df5 100644
--- a/sound/soc/stm/stm32_sai.c
+++ b/sound/soc/stm/stm32_sai.c
@@ -105,6 +105,7 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
         if (!pdev) {
                 dev_err(&sai_client->pdev->dev,
                         "Device not found for node %pOFn\n", np_provider);
+                of_node_put(np_provider);
                 return -ENODEV;
         }
 
@@ -113,19 +114,20 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
                 dev_err(&sai_client->pdev->dev,
                         "SAI sync provider data not found\n");
                 ret = -EINVAL;
-                goto out_put_dev;
+                goto error;
         }
 
         /* Configure sync client */
         ret = stm32_sai_sync_conf_client(sai_client, synci);
         if (ret < 0)
-                goto out_put_dev;
+                goto error;
 
         /* Configure sync provider */
         ret = stm32_sai_sync_conf_provider(sai_provider, synco);
 
-out_put_dev:
+error:
         put_device(&pdev->dev);
+        of_node_put(np_provider);
         return ret;
 }
 
diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
index f9297228c41c..d7045aa520de 100644
--- a/sound/soc/stm/stm32_sai_sub.c
+++ b/sound/soc/stm/stm32_sai_sub.c
@@ -70,6 +70,7 @@
 #define SAI_IEC60958_STATUS_BYTES       24
 
 #define SAI_MCLK_NAME_LEN               32
+#define SAI_RATE_11K                    11025
 
 /**
  * struct stm32_sai_sub_data - private data of SAI sub block (block A or B)
@@ -100,8 +101,9 @@
  * @slot_mask: rx or tx active slots mask. set at init or at runtime
  * @data_size: PCM data width. corresponds to PCM substream width.
  * @spdif_frm_cnt: S/PDIF playback frame counter
- * @snd_aes_iec958: iec958 data
+ * @iec958: iec958 data
  * @ctrl_lock: control lock
+ * @irq_lock: prevent race condition with IRQ
  */
 struct stm32_sai_sub_data {
         struct platform_device *pdev;
@@ -133,6 +135,7 @@ struct stm32_sai_sub_data {
         unsigned int spdif_frm_cnt;
         struct snd_aes_iec958 iec958;
         struct mutex ctrl_lock; /* protect resources accessed by controls */
+        spinlock_t irq_lock; /* used to prevent race condition with IRQ */
 };
 
 enum stm32_sai_fifo_th {
@@ -307,6 +310,25 @@ static int stm32_sai_set_clk_div(struct stm32_sai_sub_data *sai,
         return ret;
 }
 
+static int stm32_sai_set_parent_clock(struct stm32_sai_sub_data *sai,
+                                      unsigned int rate)
+{
+        struct platform_device *pdev = sai->pdev;
+        struct clk *parent_clk = sai->pdata->clk_x8k;
+        int ret;
+
+        if (!(rate % SAI_RATE_11K))
+                parent_clk = sai->pdata->clk_x11k;
+
+        ret = clk_set_parent(sai->sai_ck, parent_clk);
+        if (ret)
+                dev_err(&pdev->dev, " Error %d setting sai_ck parent clock. %s",
+                        ret, ret == -EBUSY ?
+                        "Active stream rates conflict\n" : "\n");
+
+        return ret;
+}
+
 static long stm32_sai_mclk_round_rate(struct clk_hw *hw, unsigned long rate,
                                       unsigned long *prate)
 {
@@ -474,8 +496,10 @@ static irqreturn_t stm32_sai_isr(int irq, void *devid)
                 status = SNDRV_PCM_STATE_XRUN;
         }
 
-        if (status != SNDRV_PCM_STATE_RUNNING)
+        spin_lock(&sai->irq_lock);
+        if (status != SNDRV_PCM_STATE_RUNNING && sai->substream)
                 snd_pcm_stop_xrun(sai->substream);
+        spin_unlock(&sai->irq_lock);
 
         return IRQ_HANDLED;
 }
@@ -486,25 +510,29 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int ret;
 
-        if (dir == SND_SOC_CLOCK_OUT) {
+        if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) {
                 ret = regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX,
                                          SAI_XCR1_NODIV,
                                          (unsigned int)~SAI_XCR1_NODIV);
                 if (ret < 0)
                         return ret;
 
-                dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
-                sai->mclk_rate = freq;
+                /* If master clock is used, set parent clock now */
+                ret = stm32_sai_set_parent_clock(sai, freq);
+                if (ret)
+                        return ret;
 
-                if (sai->sai_mclk) {
-                        ret = clk_set_rate_exclusive(sai->sai_mclk,
-                                                     sai->mclk_rate);
-                        if (ret) {
-                                dev_err(cpu_dai->dev,
-                                        "Could not set mclk rate\n");
-                                return ret;
-                        }
+                ret = clk_set_rate_exclusive(sai->sai_mclk, freq);
+                if (ret) {
+                        dev_err(cpu_dai->dev,
+                                ret == -EBUSY ?
+                                "Active streams have incompatible rates" :
+                                "Could not set mclk rate\n");
+                        return ret;
                 }
+
+                dev_dbg(cpu_dai->dev, "SAI MCLK frequency is %uHz\n", freq);
+                sai->mclk_rate = freq;
         }
 
         return 0;
@@ -679,8 +707,19 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream,
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
         int imr, cr2, ret;
+        unsigned long flags;
 
+        spin_lock_irqsave(&sai->irq_lock, flags);
         sai->substream = substream;
+        spin_unlock_irqrestore(&sai->irq_lock, flags);
+
+        if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
+                snd_pcm_hw_constraint_mask64(substream->runtime,
+                                             SNDRV_PCM_HW_PARAM_FORMAT,
+                                             SNDRV_PCM_FMTBIT_S32_LE);
+                snd_pcm_hw_constraint_single(substream->runtime,
+                                             SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+        }
 
         ret = clk_prepare_enable(sai->sai_ck);
         if (ret < 0) {
@@ -898,14 +937,16 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
                                      struct snd_pcm_hw_params *params)
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
-        int div = 0;
+        int div = 0, cr1 = 0;
         int sai_clk_rate, mclk_ratio, den;
         unsigned int rate = params_rate(params);
+        int ret;
 
-        if (!(rate % 11025))
-                clk_set_parent(sai->sai_ck, sai->pdata->clk_x11k);
-        else
-                clk_set_parent(sai->sai_ck, sai->pdata->clk_x8k);
+        if (!sai->sai_mclk) {
+                ret = stm32_sai_set_parent_clock(sai, rate);
+                if (ret)
+                        return ret;
+        }
         sai_clk_rate = clk_get_rate(sai->sai_ck);
 
         if (STM_SAI_IS_F4(sai->pdata)) {
@@ -943,13 +984,19 @@ static int stm32_sai_configure_clock(struct snd_soc_dai *cpu_dai,
                 } else {
                         if (sai->mclk_rate) {
                                 mclk_ratio = sai->mclk_rate / rate;
-                                if ((mclk_ratio != 512) &&
-                                    (mclk_ratio != 256)) {
+                                if (mclk_ratio == 512) {
+                                        cr1 = SAI_XCR1_OSR;
+                                } else if (mclk_ratio != 256) {
                                         dev_err(cpu_dai->dev,
                                                 "Wrong mclk ratio %d\n",
                                                 mclk_ratio);
                                         return -EINVAL;
                                 }
+
+                                regmap_update_bits(sai->regmap,
+                                                   STM_SAI_CR1_REGX,
+                                                   SAI_XCR1_OSR, cr1);
+
                                 div = stm32_sai_get_clk_div(sai, sai_clk_rate,
                                                             sai->mclk_rate);
                                 if (div < 0)
@@ -1051,28 +1098,36 @@ static void stm32_sai_shutdown(struct snd_pcm_substream *substream,
                                struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+        unsigned long flags;
 
         regmap_update_bits(sai->regmap, STM_SAI_IMR_REGX, SAI_XIMR_MASK, 0);
 
         regmap_update_bits(sai->regmap, STM_SAI_CR1_REGX, SAI_XCR1_NODIV,
                            SAI_XCR1_NODIV);
 
-        clk_disable_unprepare(sai->sai_ck);
+        /* Release mclk rate only if rate was actually set */
+        if (sai->mclk_rate) {
+                clk_rate_exclusive_put(sai->sai_mclk);
+                sai->mclk_rate = 0;
+        }
 
-        clk_rate_exclusive_put(sai->sai_mclk);
+        clk_disable_unprepare(sai->sai_ck);
 
+        spin_lock_irqsave(&sai->irq_lock, flags);
         sai->substream = NULL;
+        spin_unlock_irqrestore(&sai->irq_lock, flags);
 }
 
 static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
                              struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
+        struct snd_kcontrol_new knew = iec958_ctls;
 
         if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
                 dev_dbg(&sai->pdev->dev, "%s: register iec controls", __func__);
-                return snd_ctl_add(rtd->pcm->card,
-                                   snd_ctl_new1(&iec958_ctls, sai));
+                knew.device = rtd->pcm->device;
+                return snd_ctl_add(rtd->pcm->card, snd_ctl_new1(&knew, sai));
         }
 
         return 0;
@@ -1081,7 +1136,7 @@ static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
 static int stm32_sai_dai_probe(struct snd_soc_dai *cpu_dai)
 {
         struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
-        int cr1 = 0, cr1_mask;
+        int cr1 = 0, cr1_mask, ret;
 
         sai->cpu_dai = cpu_dai;
 
@@ -1111,8 +1166,10 @@ static int stm32_sai_dai_probe(struct snd_soc_dai *cpu_dai)
         /* Configure synchronization */
         if (sai->sync == SAI_SYNC_EXTERNAL) {
                 /* Configure synchro client and provider */
-                sai->pdata->set_sync(sai->pdata, sai->np_sync_provider,
-                                     sai->synco, sai->synci);
+                ret = sai->pdata->set_sync(sai->pdata, sai->np_sync_provider,
+                                           sai->synco, sai->synci);
+                if (ret)
+                        return ret;
         }
 
         cr1_mask |= SAI_XCR1_SYNCEN_MASK;
@@ -1392,7 +1449,6 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
         if (!sai->cpu_dai_drv)
                 return -ENOMEM;
 
-        sai->cpu_dai_drv->name = dev_name(&pdev->dev);
         if (STM_SAI_IS_PLAYBACK(sai)) {
                 memcpy(sai->cpu_dai_drv, &stm32_sai_playback_dai,
                        sizeof(stm32_sai_playback_dai));
@@ -1402,6 +1458,7 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
                        sizeof(stm32_sai_capture_dai));
                 sai->cpu_dai_drv->capture.stream_name = sai->cpu_dai_drv->name;
         }
+        sai->cpu_dai_drv->name = dev_name(&pdev->dev);
 
         return 0;
 }
@@ -1424,6 +1481,7 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
 
         sai->pdev = pdev;
         mutex_init(&sai->ctrl_lock);
+        spin_lock_init(&sai->irq_lock);
         platform_set_drvdata(pdev, sai);
 
         sai->pdata = dev_get_drvdata(pdev->dev.parent);
diff --git a/sound/xen/xen_snd_front_alsa.c b/sound/xen/xen_snd_front_alsa.c
index a7f413cb704d..b14ab512c2ce 100644
--- a/sound/xen/xen_snd_front_alsa.c
+++ b/sound/xen/xen_snd_front_alsa.c
@@ -441,7 +441,7 @@ static int shbuf_setup_backstore(struct xen_snd_front_pcm_stream_info *stream,
 {
         int i;
 
-        stream->buffer = alloc_pages_exact(stream->buffer_sz, GFP_KERNEL);
+        stream->buffer = alloc_pages_exact(buffer_sz, GFP_KERNEL);
         if (!stream->buffer)
                 return -ENOMEM;
 
diff --git a/tools/io_uring/io_uring-bench.c b/tools/io_uring/io_uring-bench.c
index 512306a37531..0f257139b003 100644
--- a/tools/io_uring/io_uring-bench.c
+++ b/tools/io_uring/io_uring-bench.c
@@ -32,10 +32,6 @@
 #include "liburing.h"
 #include "barrier.h"
 
-#ifndef IOCQE_FLAG_CACHEHIT
-#define IOCQE_FLAG_CACHEHIT     (1U << 0)
-#endif
-
 #define min(a, b)               ((a < b) ? (a) : (b))
 
 struct io_sq_ring {
@@ -85,7 +81,6 @@ struct submitter {
         unsigned long reaps;
         unsigned long done;
         unsigned long calls;
-        unsigned long cachehit, cachemiss;
         volatile int finish;
 
         __s32 *fds;
@@ -270,10 +265,6 @@ static int reap_events(struct submitter *s)
                                 return -1;
                         }
                 }
-                if (cqe->flags & IOCQE_FLAG_CACHEHIT)
-                        s->cachehit++;
-                else
-                        s->cachemiss++;
                 reaped++;
                 head++;
         } while (1);
@@ -489,7 +480,7 @@ static void file_depths(char *buf)
 int main(int argc, char *argv[])
 {
         struct submitter *s = &submitters[0];
-        unsigned long done, calls, reap, cache_hit, cache_miss;
+        unsigned long done, calls, reap;
         int err, i, flags, fd;
         char *fdepths;
         void *ret;
@@ -569,44 +560,29 @@ int main(int argc, char *argv[])
         pthread_create(&s->thread, NULL, submitter_fn, s);
 
         fdepths = malloc(8 * s->nr_files);
-        cache_hit = cache_miss = reap = calls = done = 0;
+        reap = calls = done = 0;
         do {
                 unsigned long this_done = 0;
                 unsigned long this_reap = 0;
                 unsigned long this_call = 0;
-                unsigned long this_cache_hit = 0;
-                unsigned long this_cache_miss = 0;
                 unsigned long rpc = 0, ipc = 0;
-                double hit = 0.0;
 
                 sleep(1);
                 this_done += s->done;
                 this_call += s->calls;
                 this_reap += s->reaps;
-                this_cache_hit += s->cachehit;
-                this_cache_miss += s->cachemiss;
-                if (this_cache_hit && this_cache_miss) {
-                        unsigned long hits, total;
-
-                        hits = this_cache_hit - cache_hit;
-                        total = hits + this_cache_miss - cache_miss;
-                        hit = (double) hits / (double) total;
-                        hit *= 100.0;
-                }
                 if (this_call - calls) {
                         rpc = (this_done - done) / (this_call - calls);
                         ipc = (this_reap - reap) / (this_call - calls);
                 } else
                         rpc = ipc = -1;
                 file_depths(fdepths);
-                printf("IOPS=%lu, IOS/call=%ld/%ld, inflight=%u (%s), Cachehit=%0.2f%%\n",
+                printf("IOPS=%lu, IOS/call=%ld/%ld, inflight=%u (%s)\n",
                                 this_done - done, rpc, ipc, s->inflight,
-                                fdepths, hit);
+                                fdepths);
                 done = this_done;
                 calls = this_call;
                 reap = this_reap;
-                cache_hit = s->cachehit;
-                cache_miss = s->cachemiss;
         } while (!finish);
 
         pthread_join(s->thread, &ret);
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 5dde107083c6..479196aeb409 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -165,6 +165,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                 "fortify_panic",
                 "usercopy_abort",
                 "machine_real_restart",
+                "rewind_stack_do_exit",
         };
 
         if (func->bind == STB_WEAK)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index b579f962451d..85ffdcfa596b 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -146,6 +146,7 @@ static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
 struct nfit_test_sec {
         u8 state;
         u8 ext_state;
+        u8 old_state;
         u8 passphrase[32];
         u8 master_passphrase[32];
         u64 overwrite_end_time;
@@ -225,6 +226,8 @@ static struct workqueue_struct *nfit_wq;
 
 static struct gen_pool *nfit_pool;
 
+static const char zero_key[NVDIMM_PASSPHRASE_LEN];
+
 static struct nfit_test *to_nfit_test(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -1059,8 +1062,7 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
         struct device *dev = &t->pdev.dev;
         struct nfit_test_sec *sec = &dimm_sec_info[dimm];
 
-        if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED) ||
-                        (sec->state & ND_INTEL_SEC_STATE_FROZEN)) {
+        if (sec->state & ND_INTEL_SEC_STATE_FROZEN) {
                 nd_cmd->status = ND_INTEL_STATUS_INVALID_STATE;
                 dev_dbg(dev, "secure erase: wrong security state\n");
         } else if (memcmp(nd_cmd->passphrase, sec->passphrase,
@@ -1068,6 +1070,12 @@ static int nd_intel_test_cmd_secure_erase(struct nfit_test *t,
                 nd_cmd->status = ND_INTEL_STATUS_INVALID_PASS;
                 dev_dbg(dev, "secure erase: wrong passphrase\n");
         } else {
+                if (!(sec->state & ND_INTEL_SEC_STATE_ENABLED)
+                                && (memcmp(nd_cmd->passphrase, zero_key,
+                                        ND_INTEL_PASSPHRASE_SIZE) != 0)) {
+                        dev_dbg(dev, "invalid zero key\n");
+                        return 0;
+                }
                 memset(sec->passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
                 memset(sec->master_passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
                 sec->state = 0;
@@ -1093,7 +1101,7 @@ static int nd_intel_test_cmd_overwrite(struct nfit_test *t,
                 return 0;
         }
 
-        memset(sec->passphrase, 0, ND_INTEL_PASSPHRASE_SIZE);
+        sec->old_state = sec->state;
         sec->state = ND_INTEL_SEC_STATE_OVERWRITE;
         dev_dbg(dev, "overwrite progressing.\n");
         sec->overwrite_end_time = get_jiffies_64() + 5 * HZ;
@@ -1115,7 +1123,8 @@ static int nd_intel_test_cmd_query_overwrite(struct nfit_test *t,
 
         if (time_is_before_jiffies64(sec->overwrite_end_time)) {
                 sec->overwrite_end_time = 0;
-                sec->state = 0;
+                sec->state = sec->old_state;
+                sec->old_state = 0;
                 sec->ext_state = ND_INTEL_SEC_ESTATE_ENABLED;
                 dev_dbg(dev, "overwrite is complete\n");
         } else
diff --git a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
index 017d839fcefa..1c30f302a1e7 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
@@ -11,6 +11,7 @@ lib_dir=$(dirname $0)/../../../net/forwarding
 
 ALL_TESTS="
         rif_set_addr_test
+        rif_vrf_set_addr_test
         rif_inherit_bridge_addr_test
         rif_non_inherit_bridge_addr_test
         vlan_interface_deletion_test
@@ -99,6 +100,25 @@ rif_set_addr_test()
         ip link set dev $swp1 addr $swp1_mac
 }
 
+rif_vrf_set_addr_test()
+{
+        # Test that it is possible to set an IP address on a VRF upper despite
+        # its random MAC address.
+        RET=0
+
+        ip link add name vrf-test type vrf table 10
+        ip link set dev $swp1 master vrf-test
+
+        ip -4 address add 192.0.2.1/24 dev vrf-test
+        check_err $? "failed to set IPv4 address on VRF"
+        ip -6 address add 2001:db8:1::1/64 dev vrf-test
+        check_err $? "failed to set IPv6 address on VRF"
+
+        log_test "RIF - setting IP address on VRF"
+
+        ip link del dev vrf-test
+}
+
 rif_inherit_bridge_addr_test()
 {
         RET=0
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index 7514fcea91a7..f8588cca2bef 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -1,3 +1,5 @@
+include ../../../../scripts/Kbuild.include
+
 all:
 
 top_srcdir = ../../../..
@@ -17,6 +19,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/state_test
 TEST_GEN_PROGS_x86_64 += x86_64/evmcs_test
 TEST_GEN_PROGS_x86_64 += x86_64/hyperv_cpuid
 TEST_GEN_PROGS_x86_64 += x86_64/vmx_close_while_nested_test
+TEST_GEN_PROGS_x86_64 += x86_64/smm_test
 TEST_GEN_PROGS_x86_64 += dirty_log_test
 TEST_GEN_PROGS_x86_64 += clear_dirty_log_test
 
@@ -30,7 +33,11 @@ INSTALL_HDR_PATH = $(top_srcdir)/usr
 LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/
 LINUX_TOOL_INCLUDE = $(top_srcdir)/tools/include
 CFLAGS += -O2 -g -std=gnu99 -fno-stack-protector -fno-PIE -I$(LINUX_TOOL_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
-LDFLAGS += -pthread -no-pie
+
+no-pie-option := $(call try-run, echo 'int main() { return 0; }' | \
+        $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -no-pie -x c - -o "$$TMP", -no-pie)
+
+LDFLAGS += -pthread $(no-pie-option)
 
 # After inclusion, $(OUTPUT) is defined and
 # $(TEST_GEN_PROGS) starts with $(OUTPUT)/
diff --git a/tools/testing/selftests/kvm/include/x86_64/processor.h b/tools/testing/selftests/kvm/include/x86_64/processor.h
index e2884c2b81ff..6063d5b2f356 100644
--- a/tools/testing/selftests/kvm/include/x86_64/processor.h
+++ b/tools/testing/selftests/kvm/include/x86_64/processor.h
@@ -778,6 +778,33 @@ void vcpu_set_msr(struct kvm_vm *vm, uint32_t vcpuid, uint64_t msr_index,
 #define MSR_IA32_APICBASE_ENABLE        (1<<11)
 #define MSR_IA32_APICBASE_BASE          (0xfffff<<12)
 
+#define APIC_BASE_MSR   0x800
+#define X2APIC_ENABLE   (1UL << 10)
+#define APIC_ICR        0x300
+#define         APIC_DEST_SELF          0x40000
+#define         APIC_DEST_ALLINC        0x80000
+#define         APIC_DEST_ALLBUT        0xC0000
+#define         APIC_ICR_RR_MASK        0x30000
+#define         APIC_ICR_RR_INVALID     0x00000
+#define         APIC_ICR_RR_INPROG      0x10000
+#define         APIC_ICR_RR_VALID       0x20000
+#define         APIC_INT_LEVELTRIG      0x08000
+#define         APIC_INT_ASSERT         0x04000
+#define         APIC_ICR_BUSY           0x01000
+#define         APIC_DEST_LOGICAL       0x00800
+#define         APIC_DEST_PHYSICAL      0x00000
+#define         APIC_DM_FIXED           0x00000
+#define         APIC_DM_FIXED_MASK      0x00700
+#define         APIC_DM_LOWEST          0x00100
+#define         APIC_DM_SMI             0x00200
+#define         APIC_DM_REMRD           0x00300
+#define         APIC_DM_NMI             0x00400
+#define         APIC_DM_INIT            0x00500
+#define         APIC_DM_STARTUP         0x00600
+#define         APIC_DM_EXTINT          0x00700
+#define         APIC_VECTOR_MASK        0x000FF
+#define APIC_ICR2       0x310
+
 #define MSR_IA32_TSCDEADLINE            0x000006e0
 
 #define MSR_IA32_UCODE_WRITE            0x00000079
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index efa0aad8b3c6..4ca96b228e46 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -91,6 +91,11 @@ static void vm_open(struct kvm_vm *vm, int perm, unsigned long type)
         if (vm->kvm_fd < 0)
                 exit(KSFT_SKIP);
 
+        if (!kvm_check_cap(KVM_CAP_IMMEDIATE_EXIT)) {
+                fprintf(stderr, "immediate_exit not available, skipping test\n");
+                exit(KSFT_SKIP);
+        }
+
         vm->fd = ioctl(vm->kvm_fd, KVM_CREATE_VM, type);
         TEST_ASSERT(vm->fd >= 0, "KVM_CREATE_VM ioctl failed, "
                 "rc: %i errno: %i", vm->fd, errno);
diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c
index f28127f4a3af..dc7fae9fa424 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/processor.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c
@@ -1030,6 +1030,14 @@ struct kvm_x86_state *vcpu_save_state(struct kvm_vm *vm, uint32_t vcpuid)
                             nested_size, sizeof(state->nested_));
         }
 
+        /*
+         * When KVM exits to userspace with KVM_EXIT_IO, KVM guarantees
+         * guest state is consistent only after userspace re-enters the
+         * kernel with KVM_RUN.  Complete IO prior to migrating state
+         * to a new VM.
+         */
+        vcpu_run_complete_io(vm, vcpuid);
+
         nmsrs = kvm_get_num_msrs(vm);
         list = malloc(sizeof(*list) + nmsrs * sizeof(list->indices[0]));
         list->nmsrs = nmsrs;
@@ -1093,12 +1101,6 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
         struct vcpu *vcpu = vcpu_find(vm, vcpuid);
         int r;
 
-        if (state->nested.size) {
-                r = ioctl(vcpu->fd, KVM_SET_NESTED_STATE, &state->nested);
-                TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_NESTED_STATE, r: %i",
-                        r);
-        }
-
         r = ioctl(vcpu->fd, KVM_SET_XSAVE, &state->xsave);
         TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XSAVE, r: %i",
                 r);
@@ -1130,4 +1132,10 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
         r = ioctl(vcpu->fd, KVM_SET_REGS, &state->regs);
         TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_REGS, r: %i",
                 r);
+
+        if (state->nested.size) {
+                r = ioctl(vcpu->fd, KVM_SET_NESTED_STATE, &state->nested);
+                TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_NESTED_STATE, r: %i",
+                        r);
+        }
 }
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index c49c2a28b0eb..36669684eca5 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -123,8 +123,6 @@ int main(int argc, char *argv[])
                             stage, run->exit_reason,
                             exit_reason_str(run->exit_reason));
 
-                memset(&regs1, 0, sizeof(regs1));
-                vcpu_regs_get(vm, VCPU_ID, &regs1);
                 switch (get_ucall(vm, VCPU_ID, &uc)) {
                 case UCALL_ABORT:
                         TEST_ASSERT(false, "%s at %s:%d", (const char *)uc.args[0],
@@ -144,6 +142,9 @@ int main(int argc, char *argv[])
                             stage, (ulong)uc.args[1]);
 
                 state = vcpu_save_state(vm, VCPU_ID);
+                memset(&regs1, 0, sizeof(regs1));
+                vcpu_regs_get(vm, VCPU_ID, &regs1);
+
                 kvm_vm_release(vm);
 
                 /* Restore state in a new VM.  */
diff --git a/tools/testing/selftests/kvm/x86_64/smm_test.c b/tools/testing/selftests/kvm/x86_64/smm_test.c
new file mode 100644
index 000000000000..fb8086964d83
--- /dev/null
+++ b/tools/testing/selftests/kvm/x86_64/smm_test.c
@@ -0,0 +1,157 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2018, Red Hat, Inc.
+ *
+ * Tests for SMM.
+ */
+#define _GNU_SOURCE /* for program_invocation_short_name */
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+
+#include "kvm_util.h"
+
+#include "vmx.h"
+
+#define VCPU_ID       1
+
+#define PAGE_SIZE  4096
+
+#define SMRAM_SIZE 65536
+#define SMRAM_MEMSLOT ((1 << 16) | 1)
+#define SMRAM_PAGES (SMRAM_SIZE / PAGE_SIZE)
+#define SMRAM_GPA 0x1000000
+#define SMRAM_STAGE 0xfe
+
+#define STR(x) #x
+#define XSTR(s) STR(s)
+
+#define SYNC_PORT 0xe
+#define DONE 0xff
+
+/*
+ * This is compiled as normal 64-bit code, however, SMI handler is executed
+ * in real-address mode. To stay simple we're limiting ourselves to a mode
+ * independent subset of asm here.
+ * SMI handler always report back fixed stage SMRAM_STAGE.
+ */
+uint8_t smi_handler[] = {
+        0xb0, SMRAM_STAGE,    /* mov $SMRAM_STAGE, %al */
+        0xe4, SYNC_PORT,      /* in $SYNC_PORT, %al */
+        0x0f, 0xaa,           /* rsm */
+};
+
+void sync_with_host(uint64_t phase)
+{
+        asm volatile("in $" XSTR(SYNC_PORT)", %%al \n"
+                     : : "a" (phase));
+}
+
+void self_smi(void)
+{
+        wrmsr(APIC_BASE_MSR + (APIC_ICR >> 4),
+              APIC_DEST_SELF | APIC_INT_ASSERT | APIC_DM_SMI);
+}
+
+void guest_code(struct vmx_pages *vmx_pages)
+{
+        uint64_t apicbase = rdmsr(MSR_IA32_APICBASE);
+
+        sync_with_host(1);
+
+        wrmsr(MSR_IA32_APICBASE, apicbase | X2APIC_ENABLE);
+
+        sync_with_host(2);
+
+        self_smi();
+
+        sync_with_host(4);
+
+        if (vmx_pages) {
+                GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
+
+                sync_with_host(5);
+
+                self_smi();
+
+                sync_with_host(7);
+        }
+
+        sync_with_host(DONE);
+}
+
+int main(int argc, char *argv[])
+{
+        struct vmx_pages *vmx_pages = NULL;
+        vm_vaddr_t vmx_pages_gva = 0;
+
+        struct kvm_regs regs;
+        struct kvm_vm *vm;
+        struct kvm_run *run;
+        struct kvm_x86_state *state;
+        int stage, stage_reported;
+
+        /* Create VM */
+        vm = vm_create_default(VCPU_ID, 0, guest_code);
+
+        vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+
+        run = vcpu_state(vm, VCPU_ID);
+
+        vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, SMRAM_GPA,
+                                    SMRAM_MEMSLOT, SMRAM_PAGES, 0);
+        TEST_ASSERT(vm_phy_pages_alloc(vm, SMRAM_PAGES, SMRAM_GPA, SMRAM_MEMSLOT)
+                    == SMRAM_GPA, "could not allocate guest physical addresses?");
+
+        memset(addr_gpa2hva(vm, SMRAM_GPA), 0x0, SMRAM_SIZE);
+        memcpy(addr_gpa2hva(vm, SMRAM_GPA) + 0x8000, smi_handler,
+               sizeof(smi_handler));
+
+        vcpu_set_msr(vm, VCPU_ID, MSR_IA32_SMBASE, SMRAM_GPA);
+
+        if (kvm_check_cap(KVM_CAP_NESTED_STATE)) {
+                vmx_pages = vcpu_alloc_vmx(vm, &vmx_pages_gva);
+                vcpu_args_set(vm, VCPU_ID, 1, vmx_pages_gva);
+        } else {
+                printf("will skip SMM test with VMX enabled\n");
+                vcpu_args_set(vm, VCPU_ID, 1, 0);
+        }
+
+        for (stage = 1;; stage++) {
+                _vcpu_run(vm, VCPU_ID);
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Stage %d: unexpected exit reason: %u (%s),\n",
+                            stage, run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+
+                memset(&regs, 0, sizeof(regs));
+                vcpu_regs_get(vm, VCPU_ID, &regs);
+
+                stage_reported = regs.rax & 0xff;
+
+                if (stage_reported == DONE)
+                        goto done;
+
+                TEST_ASSERT(stage_reported == stage ||
+                            stage_reported == SMRAM_STAGE,
+                            "Unexpected stage: #%x, got %x",
+                            stage, stage_reported);
+
+                state = vcpu_save_state(vm, VCPU_ID);
+                kvm_vm_release(vm);
+                kvm_vm_restart(vm, O_RDWR);
+                vm_vcpu_add(vm, VCPU_ID, 0, 0);
+                vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+                vcpu_load_state(vm, VCPU_ID, state);
+                run = vcpu_state(vm, VCPU_ID);
+                free(state);
+        }
+
+done:
+        kvm_vm_free(vm);
+}
diff --git a/tools/testing/selftests/kvm/x86_64/state_test.c b/tools/testing/selftests/kvm/x86_64/state_test.c
index 30f75856cf39..e0a3c0204b7c 100644
--- a/tools/testing/selftests/kvm/x86_64/state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/state_test.c
@@ -134,11 +134,6 @@ int main(int argc, char *argv[])
 
         struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
 
-        if (!kvm_check_cap(KVM_CAP_IMMEDIATE_EXIT)) {
-                fprintf(stderr, "immediate_exit not available, skipping test\n");
-                exit(KSFT_SKIP);
-        }
-
         /* Create VM */
         vm = vm_create_default(VCPU_ID, 0, guest_code);
         vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
@@ -179,18 +174,10 @@ int main(int argc, char *argv[])
                             uc.args[1] == stage, "Unexpected register values vmexit #%lx, got %lx",
                             stage, (ulong)uc.args[1]);
 
-                /*
-                 * When KVM exits to userspace with KVM_EXIT_IO, KVM guarantees
-                 * guest state is consistent only after userspace re-enters the
-                 * kernel with KVM_RUN.  Complete IO prior to migrating state
-                 * to a new VM.
-                 */
-                vcpu_run_complete_io(vm, VCPU_ID);
-
+                state = vcpu_save_state(vm, VCPU_ID);
                 memset(&regs1, 0, sizeof(regs1));
                 vcpu_regs_get(vm, VCPU_ID, &regs1);
 
-                state = vcpu_save_state(vm, VCPU_ID);
                 kvm_vm_release(vm);
 
                 /* Restore state in a new VM.  */
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index e941024869ff..9457aaeae092 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -607,6 +607,39 @@ run_cmd()
         return $rc
 }
 
+check_expected()
+{
+        local out="$1"
+        local expected="$2"
+        local rc=0
+
+        [ "${out}" = "${expected}" ] && return 0
+
+        if [ -z "${out}" ]; then
+                if [ "$VERBOSE" = "1" ]; then
+                        printf "\nNo route entry found\n"
+                        printf "Expected:\n"
+                        printf "    ${expected}\n"
+                fi
+                return 1
+        fi
+
+        # tricky way to convert output to 1-line without ip's
+        # messy '\'; this drops all extra white space
+        out=$(echo ${out})
+        if [ "${out}" != "${expected}" ]; then
+                rc=1
+                if [ "${VERBOSE}" = "1" ]; then
+                        printf "    Unexpected route entry. Have:\n"
+                        printf "        ${out}\n"
+                        printf "    Expected:\n"
+                        printf "        ${expected}\n\n"
+                fi
+        fi
+
+        return $rc
+}
+
 # add route for a prefix, flushing any existing routes first
 # expected to be the first step of a test
 add_route6()
@@ -654,31 +687,7 @@ check_route6()
         pfx=$1
 
         out=$($IP -6 ro ls match ${pfx} | sed -e 's/ pref medium//')
-        [ "${out}" = "${expected}" ] && return 0
-
-        if [ -z "${out}" ]; then
-                if [ "$VERBOSE" = "1" ]; then
-                        printf "\nNo route entry found\n"
-                        printf "Expected:\n"
-                        printf "    ${expected}\n"
-                fi
-                return 1
-        fi
-
-        # tricky way to convert output to 1-line without ip's
-        # messy '\'; this drops all extra white space
-        out=$(echo ${out})
-        if [ "${out}" != "${expected}" ]; then
-                rc=1
-                if [ "${VERBOSE}" = "1" ]; then
-                        printf "    Unexpected route entry. Have:\n"
-                        printf "        ${out}\n"
-                        printf "    Expected:\n"
-                        printf "        ${expected}\n\n"
-                fi
-        fi
-
-        return $rc
+        check_expected "${out}" "${expected}"
 }
 
 route_cleanup()
@@ -728,7 +737,7 @@ route_setup()
         ip -netns ns2 addr add 172.16.103.2/24 dev veth4
         ip -netns ns2 addr add 172.16.104.1/24 dev dummy1
 
-        set +ex
+        set +e
 }
 
 # assumption is that basic add of a single path route works
@@ -963,7 +972,8 @@ ipv6_addr_metric_test()
         run_cmd "$IP li set dev dummy2 down"
         rc=$?
         if [ $rc -eq 0 ]; then
-                check_route6 ""
+                out=$($IP -6 ro ls match 2001:db8:104::/64)
+                check_expected "${out}" ""
                 rc=$?
         fi
         log_test $rc 0 "Prefix route removed on link down"
@@ -1094,38 +1104,13 @@ check_route()
         local pfx
         local expected="$1"
         local out
-        local rc=0
 
         set -- $expected
         pfx=$1
         [ "${pfx}" = "unreachable" ] && pfx=$2
 
         out=$($IP ro ls match ${pfx})
-        [ "${out}" = "${expected}" ] && return 0
-
-        if [ -z "${out}" ]; then
-                if [ "$VERBOSE" = "1" ]; then
-                        printf "\nNo route entry found\n"
-                        printf "Expected:\n"
-                        printf "    ${expected}\n"
-                fi
-                return 1
-        fi
-
-        # tricky way to convert output to 1-line without ip's
-        # messy '\'; this drops all extra white space
-        out=$(echo ${out})
-        if [ "${out}" != "${expected}" ]; then
-                rc=1
-                if [ "${VERBOSE}" = "1" ]; then
-                        printf "    Unexpected route entry. Have:\n"
-                        printf "        ${out}\n"
-                        printf "    Expected:\n"
-                        printf "        ${expected}\n\n"
-                fi
-        fi
-
-        return $rc
+        check_expected "${out}" "${expected}"
 }
 
 # assumption is that basic add of a single path route works
@@ -1390,7 +1375,8 @@ ipv4_addr_metric_test()
         run_cmd "$IP li set dev dummy2 down"
         rc=$?
         if [ $rc -eq 0 ]; then
-                check_route ""
+                out=$($IP ro ls match 172.16.104.0/24)
+                check_expected "${out}" ""
                 rc=$?
         fi
         log_test $rc 0 "Prefix route removed on link down"
diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
index 3547b0d8c91e..79e59e4fa3dc 100644
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -144,18 +144,19 @@ static int setup_routing_entry(struct kvm *kvm,
 {
         struct kvm_kernel_irq_routing_entry *ei;
         int r;
+        u32 gsi = array_index_nospec(ue->gsi, KVM_MAX_IRQ_ROUTES);
 
         /*
          * Do not allow GSI to be mapped to the same irqchip more than once.
          * Allow only one to one mapping between GSI and non-irqchip routing.
          */
-        hlist_for_each_entry(ei, &rt->map[ue->gsi], link)
+        hlist_for_each_entry(ei, &rt->map[gsi], link)
                 if (ei->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->type != KVM_IRQ_ROUTING_IRQCHIP ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)
                         return -EINVAL;
 
-        e->gsi = ue->gsi;
+        e->gsi = gsi;
         e->type = ue->type;
         r = kvm_set_routing_entry(kvm, e, ue);
         if (r)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 55fe8e20d8fd..dc8edc97ba85 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2977,12 +2977,14 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         struct kvm_device_ops *ops = NULL;
         struct kvm_device *dev;
         bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
+        int type;
         int ret;
 
         if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
                 return -ENODEV;
 
-        ops = kvm_device_ops_table[cd->type];
+        type = array_index_nospec(cd->type, ARRAY_SIZE(kvm_device_ops_table));
+        ops = kvm_device_ops_table[type];
         if (ops == NULL)
                 return -ENODEV;
 
@@ -2997,7 +2999,7 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         dev->kvm = kvm;
 
         mutex_lock(&kvm->lock);
-        ret = ops->create(dev, cd->type);
+        ret = ops->create(dev, type);
         if (ret < 0) {
                 mutex_unlock(&kvm->lock);
                 kfree(dev);