630 files changed, 5812 insertions, 3205 deletions
diff --git a/.mailmap b/.mailmap
index acba1a6163f1..afaad605284a 100644
--- a/.mailmap
+++ b/.mailmap
@@ -64,6 +64,9 @@ Dengcheng Zhu <dzhu@wavecomp.com> <dengcheng.zhu@imgtec.com>
 Dengcheng Zhu <dzhu@wavecomp.com> <dczhu@mips.com>
 Dengcheng Zhu <dzhu@wavecomp.com> <dengcheng.zhu@gmail.com>
 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Dmitry Safonov <0x7f454c46@gmail.com> <dsafonov@virtuozzo.com>
+Dmitry Safonov <0x7f454c46@gmail.com> <d.safonov@partner.samsung.com>
+Dmitry Safonov <0x7f454c46@gmail.com> <dima@arista.com>
 Domen Puncer <domen@coderock.org>
 Douglas Gilbert <dougg@torque.net>
 Ed L. Cashin <ecashin@coraid.com>
@@ -160,6 +163,8 @@ Matt Ranostay <mranostay@gmail.com> Matthew Ranostay <mranostay@embeddedalley.co
 Matt Ranostay <mranostay@gmail.com> <matt.ranostay@intel.com>
 Matt Ranostay <matt.ranostay@konsulko.com> <matt@ranostay.consulting>
 Matt Redfearn <matt.redfearn@mips.com> <matt.redfearn@imgtec.com>
+Maxime Ripard <mripard@kernel.org> <maxime.ripard@bootlin.com>
+Maxime Ripard <mripard@kernel.org> <maxime.ripard@free-electrons.com>
 Mayuresh Janorkar <mayur@ti.com>
 Michael Buesch <m@bues.ch>
 Michel Dänzer <michel@tungstengraphics.com>
diff --git a/Documentation/PCI/index.rst b/Documentation/PCI/index.rst
index f4c6121868c3..6768305e4c26 100644
--- a/Documentation/PCI/index.rst
+++ b/Documentation/PCI/index.rst
@@ -9,7 +9,7 @@ Linux PCI Bus Subsystem
   :numbered:
   pci
-   picebus-howto
+   pciebus-howto
   pci-iov-howto
   msi-howto
   acpi-info
diff --git a/Documentation/PCI/picebus-howto.rst b/Documentation/PCI/pciebus-howto.rst
index f882ff62c51f..f882ff62c51f 100644
--- a/Documentation/PCI/picebus-howto.rst
+++ b/Documentation/PCI/pciebus-howto.rst
diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst
index a7d44e71019d..287b98708a40 100644
--- a/Documentation/admin-guide/sysctl/net.rst
+++ b/Documentation/admin-guide/sysctl/net.rst
@@ -39,7 +39,6 @@ Table : Subdirectories in /proc/sys/net
 802       E802 protocol         ax25       AX25
 ethernet  Ethernet protocol     rose       X.25 PLP layer
 ipv4      IP version 4          x25        X.25 protocol
- ipx       IPX                   token-ring IBM token ring
 bridge    Bridging              decnet     DEC net
 ipv6      IP version 6          tipc       TIPC
 ========= =================== = ========== ==================
@@ -401,33 +400,7 @@ interface.
 (network) that the route leads to, the router (may be directly connected), the
 route flags, and the device the route is using.
+5. TIPC
-5. IPX
------
-The IPX protocol has no tunable values in proc/sys/net.
-The IPX  protocol  does,  however,  provide  proc/net/ipx. This lists each IPX
-socket giving  the  local  and  remote  addresses  in  Novell  format (that is
-network:node:port). In  accordance  with  the  strange  Novell  tradition,
-everything but the port is in hex. Not_Connected is displayed for sockets that
-are not  tied to a specific remote address. The Tx and Rx queue sizes indicate
-the number  of  bytes  pending  for  transmission  and  reception.  The  state
-indicates the  state  the  socket  is  in and the uid is the owning uid of the
-socket.
-The /proc/net/ipx_interface  file lists all IPX interfaces. For each interface
-it gives  the network number, the node number, and indicates if the network is
-the primary  network.  It  also  indicates  which  device  it  is bound to (or
-Internal for  internal  networks)  and  the  Frame  Type if appropriate. Linux
-supports 802.3,  802.2,  802.2  SNAP  and DIX (Blue Book) ethernet framing for
-IPX.
-The /proc/net/ipx_route  table  holds  a list of IPX routes. For each route it
-gives the  destination  network, the router node (or Directly) and the network
-address of the router (or Connected) for internal networks.
-6. TIPC
 -------
 tipc_rmem
diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 6b0dfd5c17ba..5138a2f6232a 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -19,7 +19,9 @@ quiet_cmd_mk_schema = SCHEMA  $@
 DT_DOCS = $(shell \
        cd $(srctree)/$(src) && \
-        find * \( -name '*.yaml' ! -name $(DT_TMP_SCHEMA) \) \
+        find * \( -name '*.yaml' ! \
+                -name $(DT_TMP_SCHEMA) ! \
+                -name '*.example.dt.yaml' \) \
        )
 DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS))
diff --git a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
index 09fc02b99845..a5c1db95b3ec 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
@@ -1,20 +1,30 @@
 * ARC-HS Interrupt Distribution Unit
-  This optional 2nd level interrupt controller can be used in SMP configurations for
+  This optional 2nd level interrupt controller can be used in SMP configurations
-  dynamic IRQ routing, load balancing of common/external IRQs towards core intc.
+  for dynamic IRQ routing, load balancing of common/external IRQs towards core
+  intc.
 Properties:
 - compatible: "snps,archs-idu-intc"
 - interrupt-controller: This is an interrupt controller.
- #interrupt-cells: Must be <1>.
+- #interrupt-cells: Must be <1> or <2>.
-  Value of the cell specifies the "common" IRQ from peripheral to IDU. Number N
+  Value of the first cell specifies the "common" IRQ from peripheral to IDU.
-  of the particular interrupt line of IDU corresponds to the line N+24 of the
+  Number N of the particular interrupt line of IDU corresponds to the line N+24
-  core interrupt controller.
+  of the core interrupt controller.
-  intc accessed via the special ARC AUX register interface, hence "reg" property
+  The (optional) second cell specifies any of the following flags:
-  is not specified.
+    - bits[3:0] trigger type and level flags
+        1 = low-to-high edge triggered
+        2 = NOT SUPPORTED (high-to-low edge triggered)
+        4 = active high level-sensitive <<< DEFAULT
+        8 = NOT SUPPORTED (active low level-sensitive)
+  When no second cell is specified, the interrupt is assumed to be level
+  sensitive.
+  The interrupt controller is accessed via the special ARC AUX register
+  interface, hence "reg" property is not specified.
 Example:
        core_intc: core-interrupt-controller {
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index 2d41fb96ce0a..5b88fae0307d 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -7,18 +7,6 @@ Required properties:
 - phy-mode : See ethernet.txt file in the same directory
 Optional properties:
- phy-reset-gpios : Should specify the gpio for phy reset
- phy-reset-duration : Reset duration in milliseconds.  Should present
-  only if property "phy-reset-gpios" is available.  Missing the property
-  will have the duration be 1 millisecond.  Numbers greater than 1000 are
-  invalid and 1 millisecond will be used instead.
- phy-reset-active-high : If present then the reset sequence using the GPIO
-  specified in the "phy-reset-gpios" property is reversed (H=reset state,
-  L=operation state).
- phy-reset-post-delay : Post reset delay in milliseconds. If present then
-  a delay of phy-reset-post-delay milliseconds will be observed after the
-  phy-reset-gpios has been toggled. Can be omitted thus no delay is
-  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 - phy-supply : regulator that powers the Ethernet PHY.
 - phy-handle : phandle to the PHY device connected to this device.
 - fixed-link : Assume a fixed link. See fixed-link.txt in the same directory.
@@ -47,11 +35,27 @@ Optional properties:
  For imx6sx, "int0" handles all 3 queues and ENET_MII. "pps" is for the pulse
  per second interrupt associated with 1588 precision time protocol(PTP).
 Optional subnodes:
 - mdio : specifies the mdio bus in the FEC, used as a container for phy nodes
  according to phy.txt in the same directory
+Deprecated optional properties:
+        To avoid these, create a phy node according to phy.txt in the same
+        directory, and point the fec's "phy-handle" property to it. Then use
+        the phy's reset binding, again described by phy.txt.
+- phy-reset-gpios : Should specify the gpio for phy reset
+- phy-reset-duration : Reset duration in milliseconds.  Should present
+  only if property "phy-reset-gpios" is available.  Missing the property
+  will have the duration be 1 millisecond.  Numbers greater than 1000 are
+  invalid and 1 millisecond will be used instead.
+- phy-reset-active-high : If present then the reset sequence using the GPIO
+  specified in the "phy-reset-gpios" property is reversed (H=reset state,
+  L=operation state).
+- phy-reset-post-delay : Post reset delay in milliseconds. If present then
+  a delay of phy-reset-post-delay milliseconds will be observed after the
+  phy-reset-gpios has been toggled. Can be omitted thus no delay is
+  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 Example:
 ethernet@83fec000 {
diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
index 91d3e78b3395..400df2da018a 100644
--- a/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.yaml
@@ -37,7 +37,8 @@ properties:
  hwlocks: true
  st,syscfg:
-    $ref: "/schemas/types.yaml#/definitions/phandle-array"
+    allOf:
+      - $ref: "/schemas/types.yaml#/definitions/phandle-array"
    description: Should be phandle/offset/mask
    items:
      - description: Phandle to the syscon node which includes IRQ mux selection.
diff --git a/Documentation/networking/tls-offload.rst b/Documentation/networking/tls-offload.rst
index b70b70dc4524..0dd3f748239f 100644
--- a/Documentation/networking/tls-offload.rst
+++ b/Documentation/networking/tls-offload.rst
@@ -506,21 +506,3 @@ Drivers should ignore the changes to TLS the device feature flags.
 These flags will be acted upon accordingly by the core ``ktls`` code.
 TLS device feature flags only control adding of new TLS connection
 offloads, old connections will remain active after flags are cleared.
-Known bugs
-==========
-skb_orphan() leaks clear text
-----------------------------
-Currently drivers depend on the :c:member:`sk` member of
-:c:type:`struct sk_buff <sk_buff>` to identify segments requiring
-encryption. Any operation which removes or does not preserve the socket
-association such as :c:func:`skb_orphan` or :c:func:`skb_clone`
-will cause the driver to miss the packets and lead to clear text leaks.
-Redirects leak clear text
-------------------------
-In the RX direction, if segment has already been decrypted by the device
-and it gets redirected or mirrored - clear text will be transmitted out.
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt
index 949d5dcdd9a3..0104830d5075 100644
--- a/Documentation/networking/tuntap.txt
+++ b/Documentation/networking/tuntap.txt
@@ -204,8 +204,8 @@ Ethernet device, which instead of receiving packets from a physical
 media, receives them from user space program and instead of sending 
 packets via physical media sends them to the user space program. 
-Let's say that you configured IPX on the tap0, then whenever 
+Let's say that you configured IPv6 on the tap0, then whenever
-the kernel sends an IPX packet to tap0, it is passed to the application
+the kernel sends an IPv6 packet to tap0, it is passed to the application
 (VTun for example). The application encrypts, compresses and sends it to 
 the other side over TCP or UDP. The application on the other side decompresses
 and decrypts the data received and writes the packet to the TAP device, 
diff --git a/MAINTAINERS b/MAINTAINERS
index f3a78403b47f..028bc47526c0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -183,7 +183,7 @@ M:	Realtek linux nic maintainers <nic_swsd@realtek.com>
 M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
-F:      drivers/net/ethernet/realtek/r8169.c
+F:      drivers/net/ethernet/realtek/r8169*
 8250/16?50 (AND CLONE UARTS) SERIAL DRIVER
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@@ -683,7 +683,7 @@ S:	Maintained
 F:      drivers/crypto/sunxi-ss/
 ALLWINNER VPU DRIVER
-M:      Maxime Ripard <maxime.ripard@bootlin.com>
+M:      Maxime Ripard <mripard@kernel.org>
 M:      Paul Kocialkowski <paul.kocialkowski@bootlin.com>
 L:      linux-media@vger.kernel.org
 S:      Maintained
@@ -1408,7 +1408,7 @@ S:	Maintained
 F:      drivers/clk/sunxi/
 ARM/Allwinner sunXi SoC support
-M:      Maxime Ripard <maxime.ripard@bootlin.com>
+M:      Maxime Ripard <mripard@kernel.org>
 M:      Chen-Yu Tsai <wens@csie.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -3577,7 +3577,7 @@ F:	Documentation/filesystems/caching/cachefiles.txt
 F:      fs/cachefiles/
 CADENCE MIPI-CSI2 BRIDGES
-M:      Maxime Ripard <maxime.ripard@bootlin.com>
+M:      Maxime Ripard <mripard@kernel.org>
 L:      linux-media@vger.kernel.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/media/cdns,*.txt
@@ -5295,7 +5295,7 @@ F:	include/linux/vga*
 DRM DRIVERS AND MISC GPU PATCHES
 M:      Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-M:      Maxime Ripard <maxime.ripard@bootlin.com>
+M:      Maxime Ripard <mripard@kernel.org>
 M:      Sean Paul <sean@poorly.run>
 W:      https://01.org/linuxgraphics/gfx-docs/maintainer-tools/drm-misc.html
 S:      Maintained
@@ -5308,7 +5308,7 @@ F:	include/uapi/drm/drm*
 F:      include/linux/vga*
 DRM DRIVERS FOR ALLWINNER A10
-M:      Maxime Ripard  <maxime.ripard@bootlin.com>
+M:      Maxime Ripard <mripard@kernel.org>
 L:      dri-devel@lists.freedesktop.org
 S:      Supported
 F:      drivers/gpu/drm/sun4i/
@@ -6065,7 +6065,7 @@ M:	Florian Fainelli <f.fainelli@gmail.com>
 M:      Heiner Kallweit <hkallweit1@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
-F:      Documentation/ABI/testing/sysfs-bus-mdio
+F:      Documentation/ABI/testing/sysfs-class-net-phydev
 F:      Documentation/devicetree/bindings/net/ethernet-phy.yaml
 F:      Documentation/devicetree/bindings/net/mdio*
 F:      Documentation/networking/phy.rst
@@ -6441,6 +6441,14 @@ S:	Maintained
 F:      drivers/perf/fsl_imx8_ddr_perf.c
 F:      Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt
+FREESCALE IMX I2C DRIVER
+M:      Oleksij Rempel <o.rempel@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      drivers/i2c/busses/i2c-imx.c
+F:      Documentation/devicetree/bindings/i2c/i2c-imx.txt
 FREESCALE IMX LPI2C DRIVER
 M:      Dong Aisheng <aisheng.dong@nxp.com>
 L:      linux-i2c@vger.kernel.org
@@ -7452,7 +7460,7 @@ F:	drivers/net/hyperv/
 F:      drivers/scsi/storvsc_drv.c
 F:      drivers/uio/uio_hv_generic.c
 F:      drivers/video/fbdev/hyperv_fb.c
-F:      drivers/iommu/hyperv_iommu.c
+F:      drivers/iommu/hyperv-iommu.c
 F:      net/vmw_vsock/hyperv_transport.c
 F:      include/clocksource/hyperv_timer.h
 F:      include/linux/hyperv.h
@@ -7505,7 +7513,7 @@ I2C MV64XXX MARVELL AND ALLWINNER DRIVER
 M:      Gregory CLEMENT <gregory.clement@bootlin.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
-F:      Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
+F:      Documentation/devicetree/bindings/i2c/marvell,mv64xxx-i2c.yaml
 F:      drivers/i2c/busses/i2c-mv64xxx.c
 I2C OVER PARALLEL PORT
@@ -8422,7 +8430,6 @@ L:	linux-xfs@vger.kernel.org
 L:      linux-fsdevel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
 S:      Supported
-F:      fs/iomap.c
 F:      fs/iomap/
 F:      include/linux/iomap.h
@@ -8447,11 +8454,6 @@ S:	Maintained
 F:      fs/io_uring.c
 F:      include/uapi/linux/io_uring.h
-IP MASQUERADING
-M:      Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
-S:      Maintained
-F:      net/ipv4/netfilter/ipt_MASQUERADE.c
 IPMI SUBSYSTEM
 M:      Corey Minyard <minyard@acm.org>
 L:      openipmi-developer@lists.sourceforge.net (moderated for non-subscribers)
@@ -8825,14 +8827,6 @@ F:	virt/kvm/*
 F:      tools/kvm/
 F:      tools/testing/selftests/kvm/
-KERNEL VIRTUAL MACHINE FOR AMD-V (KVM/amd)
-M:      Joerg Roedel <joro@8bytes.org>
-L:      kvm@vger.kernel.org
-W:      http://www.linux-kvm.org/
-S:      Maintained
-F:      arch/x86/include/asm/svm.h
-F:      arch/x86/kvm/svm.c
 KERNEL VIRTUAL MACHINE FOR ARM/ARM64 (KVM/arm, KVM/arm64)
 M:      Marc Zyngier <maz@kernel.org>
 R:      James Morse <james.morse@arm.com>
@@ -8875,7 +8869,7 @@ M:	Christian Borntraeger <borntraeger@de.ibm.com>
 M:      Janosch Frank <frankja@linux.ibm.com>
 R:      David Hildenbrand <david@redhat.com>
 R:      Cornelia Huck <cohuck@redhat.com>
-L:      linux-s390@vger.kernel.org
+L:      kvm@vger.kernel.org
 W:      http://www.ibm.com/developerworks/linux/linux390/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux.git
 S:      Supported
@@ -8890,6 +8884,11 @@ F:	tools/testing/selftests/kvm/*/s390x/
 KERNEL VIRTUAL MACHINE FOR X86 (KVM/x86)
 M:      Paolo Bonzini <pbonzini@redhat.com>
 M:      Radim Krčmář <rkrcmar@redhat.com>
+R:      Sean Christopherson <sean.j.christopherson@intel.com>
+R:      Vitaly Kuznetsov <vkuznets@redhat.com>
+R:      Wanpeng Li <wanpengli@tencent.com>
+R:      Jim Mattson <jmattson@google.com>
+R:      Joerg Roedel <joro@8bytes.org>
 L:      kvm@vger.kernel.org
 W:      http://www.linux-kvm.org
 T:      git git://git.kernel.org/pub/scm/virt/kvm/kvm.git
@@ -8897,8 +8896,12 @@ S:	Supported
 F:      arch/x86/kvm/
 F:      arch/x86/kvm/*/
 F:      arch/x86/include/uapi/asm/kvm*
+F:      arch/x86/include/uapi/asm/vmx.h
+F:      arch/x86/include/uapi/asm/svm.h
 F:      arch/x86/include/asm/kvm*
 F:      arch/x86/include/asm/pvclock-abi.h
+F:      arch/x86/include/asm/svm.h
+F:      arch/x86/include/asm/vmx.h
 F:      arch/x86/kernel/kvm.c
 F:      arch/x86/kernel/kvmclock.c
@@ -11078,7 +11081,7 @@ NET_FAILOVER MODULE
 M:      Sridhar Samudrala <sridhar.samudrala@intel.com>
 L:      netdev@vger.kernel.org
 S:      Supported
-F:      driver/net/net_failover.c
+F:      drivers/net/net_failover.c
 F:      include/net/net_failover.h
 F:      Documentation/networking/net_failover.rst
@@ -14470,6 +14473,7 @@ F:	drivers/net/phy/phylink.c
 F:      drivers/net/phy/sfp*
 F:      include/linux/phylink.h
 F:      include/linux/sfp.h
+K:      phylink
 SGI GRU DRIVER
 M:      Dimitri Sivanich <sivanich@sgi.com>
@@ -14875,9 +14879,9 @@ F:	include/linux/arm_sdei.h
 F:      include/uapi/linux/arm_sdei.h
 SOFTWARE RAID (Multiple Disks) SUPPORT
-M:      Shaohua Li <shli@kernel.org>
+M:      Song Liu <song@kernel.org>
 L:      linux-raid@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shli/md.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/song/md.git
 S:      Supported
 F:      drivers/md/Makefile
 F:      drivers/md/Kconfig
diff --git a/Makefile b/Makefile
index 1b23f95db176..f125625efd60 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Bobtail Squid
 # *DOCUMENTATION*
diff --git a/arch/arc/boot/dts/Makefile b/arch/arc/boot/dts/Makefile
index a83c4f5e928b..8483a86c743d 100644
--- a/arch/arc/boot/dts/Makefile
+++ b/arch/arc/boot/dts/Makefile
@@ -12,3 +12,6 @@ dtb-y := $(builtindtb-y).dtb
 # for CONFIG_OF_ALL_DTBS test
 dtstree := $(srctree)/$(src)
 dtb-    := $(patsubst $(dtstree)/%.dts,%.dtb, $(wildcard $(dtstree)/*.dts))
+# board-specific dtc flags
+DTC_FLAGS_hsdk += --pad 20
diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
index f5ae394ebe06..41b16f21beec 100644
--- a/arch/arc/include/asm/entry-arcv2.h
+++ b/arch/arc/include/asm/entry-arcv2.h
@@ -256,7 +256,7 @@
 .macro FAKE_RET_FROM_EXCPN
        lr      r9, [status32]
-        bic     r9, r9, (STATUS_U_MASK|STATUS_DE_MASK|STATUS_AE_MASK)
+        bic     r9, r9, STATUS_AE_MASK
        or      r9, r9, STATUS_IE_MASK
        kflag   r9
 .endm
diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
index a0eeb9f8f0a9..d9ee43c6b7db 100644
--- a/arch/arc/include/asm/linkage.h
+++ b/arch/arc/include/asm/linkage.h
@@ -62,15 +62,15 @@
 #else   /* !__ASSEMBLY__ */
 #ifdef CONFIG_ARC_HAS_ICCM
-#define __arcfp_code __attribute__((__section__(".text.arcfp")))
+#define __arcfp_code __section(.text.arcfp)
 #else
-#define __arcfp_code __attribute__((__section__(".text")))
+#define __arcfp_code __section(.text)
 #endif
 #ifdef CONFIG_ARC_HAS_DCCM
-#define __arcfp_data __attribute__((__section__(".data.arcfp")))
+#define __arcfp_data __section(.data.arcfp)
 #else
-#define __arcfp_data __attribute__((__section__(".data")))
+#define __arcfp_data __section(.data)
 #endif
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arc/include/asm/mach_desc.h b/arch/arc/include/asm/mach_desc.h
index 8ac0e2ac3e70..73746ed5b834 100644
--- a/arch/arc/include/asm/mach_desc.h
+++ b/arch/arc/include/asm/mach_desc.h
@@ -53,8 +53,7 @@ extern const struct machine_desc __arch_info_begin[], __arch_info_end[];
 */
 #define MACHINE_START(_type, _name)                     \
 static const struct machine_desc __mach_desc_##_type    \
-__used                                                  \
+__used __section(.arch.info.init) = {                   \
-__attribute__((__section__(".arch.info.init"))) = {     \
        .name           = _name,
 #define MACHINE_END                             \
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 18b493dfb3a8..abf9398cc333 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -202,8 +202,8 @@ static void idu_set_dest(unsigned int cmn_irq, unsigned int cpu_mask)
        __mcip_cmd_data(CMD_IDU_SET_DEST, cmn_irq, cpu_mask);
 }
-static void idu_set_mode(unsigned int cmn_irq, unsigned int lvl,
+static void idu_set_mode(unsigned int cmn_irq, bool set_lvl, unsigned int lvl,
-                           unsigned int distr)
+                         bool set_distr, unsigned int distr)
 {
        union {
                unsigned int word;
@@ -212,8 +212,11 @@ static void idu_set_mode(unsigned int cmn_irq, unsigned int lvl,
                };
        } data;
-        data.distr = distr;
+        data.word = __mcip_cmd_read(CMD_IDU_READ_MODE, cmn_irq);
-        data.lvl = lvl;
+        if (set_distr)
+                data.distr = distr;
+        if (set_lvl)
+                data.lvl = lvl;
        __mcip_cmd_data(CMD_IDU_SET_MODE, cmn_irq, data.word);
 }
@@ -240,6 +243,25 @@ static void idu_irq_unmask(struct irq_data *data)
        raw_spin_unlock_irqrestore(&mcip_lock, flags);
 }
+static void idu_irq_ack(struct irq_data *data)
+{
+        unsigned long flags;
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+        __mcip_cmd(CMD_IDU_ACK_CIRQ, data->hwirq);
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+}
+static void idu_irq_mask_ack(struct irq_data *data)
+{
+        unsigned long flags;
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+        __mcip_cmd_data(CMD_IDU_SET_MASK, data->hwirq, 1);
+        __mcip_cmd(CMD_IDU_ACK_CIRQ, data->hwirq);
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+}
 static int
 idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
                     bool force)
@@ -263,13 +285,36 @@ idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
        else
                distribution_mode = IDU_M_DISTRI_RR;
-        idu_set_mode(data->hwirq, IDU_M_TRIG_LEVEL, distribution_mode);
+        idu_set_mode(data->hwirq, false, 0, true, distribution_mode);
        raw_spin_unlock_irqrestore(&mcip_lock, flags);
        return IRQ_SET_MASK_OK;
 }
+static int idu_irq_set_type(struct irq_data *data, u32 type)
+{
+        unsigned long flags;
+        /*
+         * ARCv2 IDU HW does not support inverse polarity, so these are the
+         * only interrupt types supported.
+         */
+        if (type & ~(IRQ_TYPE_EDGE_RISING | IRQ_TYPE_LEVEL_HIGH))
+                return -EINVAL;
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+        idu_set_mode(data->hwirq, true,
+                     type & IRQ_TYPE_EDGE_RISING ? IDU_M_TRIG_EDGE :
+                                                   IDU_M_TRIG_LEVEL,
+                     false, 0);
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+        return 0;
+}
 static void idu_irq_enable(struct irq_data *data)
 {
        /*
@@ -289,7 +334,10 @@ static struct irq_chip idu_irq_chip = {
        .name                   = "MCIP IDU Intc",
        .irq_mask               = idu_irq_mask,
        .irq_unmask             = idu_irq_unmask,
+        .irq_ack                = idu_irq_ack,
+        .irq_mask_ack           = idu_irq_mask_ack,
        .irq_enable             = idu_irq_enable,
+        .irq_set_type           = idu_irq_set_type,
 #ifdef CONFIG_SMP
        .irq_set_affinity       = idu_irq_set_affinity,
 #endif
@@ -317,7 +365,7 @@ static int idu_irq_map(struct irq_domain *d, unsigned int virq, irq_hw_number_t
 }
 static const struct irq_domain_ops idu_irq_ops = {
-        .xlate  = irq_domain_xlate_onecell,
+        .xlate  = irq_domain_xlate_onetwocell,
        .map    = idu_irq_map,
 };
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index c2663fce7f6c..dc05a63516f5 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -572,6 +572,7 @@ static unsigned long read_pointer(const u8 **pLoc, const void *end,
 #else
                BUILD_BUG_ON(sizeof(u32) != sizeof(value));
 #endif
+                /* Fall through */
        case DW_EH_PE_native:
                if (end < (const void *)(ptr.pul + 1))
                        return 0;
@@ -826,7 +827,7 @@ static int processCFI(const u8 *start, const u8 *end, unsigned long targetLoc,
                        case DW_CFA_def_cfa:
                                state->cfa.reg = get_uleb128(&ptr.p8, end);
                                unw_debug("cfa_def_cfa: r%lu ", state->cfa.reg);
-                                /*nobreak*/
+                                /* fall through */
                        case DW_CFA_def_cfa_offset:
                                state->cfa.offs = get_uleb128(&ptr.p8, end);
                                unw_debug("cfa_def_cfa_offset: 0x%lx ",
@@ -834,7 +835,7 @@ static int processCFI(const u8 *start, const u8 *end, unsigned long targetLoc,
                                break;
                        case DW_CFA_def_cfa_sf:
                                state->cfa.reg = get_uleb128(&ptr.p8, end);
-                                /*nobreak */
+                                /* fall through */
                        case DW_CFA_def_cfa_offset_sf:
                                state->cfa.offs = get_sleb128(&ptr.p8, end)
                                    * state->dataAlign;
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 62c210e7ee4c..70a3fbe79fba 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -101,7 +101,7 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
        if (is_isa_arcv2() && ioc_enable && coherent)
                dev->dma_coherent = true;
-        dev_info(dev, "use %sncoherent DMA ops\n",
+        dev_info(dev, "use %scoherent DMA ops\n",
                 dev->dma_coherent ? "" : "non");
 }
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index 7dd2dd335cf6..0b961a2a10b8 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -6,11 +6,15 @@
 */
 #include <linux/init.h>
+#include <linux/of_fdt.h>
+#include <linux/libfdt.h>
 #include <linux/smp.h>
 #include <asm/arcregs.h>
 #include <asm/io.h>
 #include <asm/mach_desc.h>
+int arc_hsdk_axi_dmac_coherent __section(.data) = 0;
 #define ARC_CCM_UNUSED_ADDR     0x60000000
 static void __init hsdk_init_per_cpu(unsigned int cpu)
@@ -97,6 +101,42 @@ static void __init hsdk_enable_gpio_intc_wire(void)
        iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN);
 }
+static int __init hsdk_tweak_node_coherency(const char *path, bool coherent)
+{
+        void *fdt = initial_boot_params;
+        const void *prop;
+        int node, ret;
+        bool dt_coh_set;
+        node = fdt_path_offset(fdt, path);
+        if (node < 0)
+                goto tweak_fail;
+        prop = fdt_getprop(fdt, node, "dma-coherent", &ret);
+        if (!prop && ret != -FDT_ERR_NOTFOUND)
+                goto tweak_fail;
+        dt_coh_set = ret != -FDT_ERR_NOTFOUND;
+        ret = 0;
+        /* need to remove "dma-coherent" property */
+        if (dt_coh_set && !coherent)
+                ret = fdt_delprop(fdt, node, "dma-coherent");
+        /* need to set "dma-coherent" property */
+        if (!dt_coh_set && coherent)
+                ret = fdt_setprop(fdt, node, "dma-coherent", NULL, 0);
+        if (ret < 0)
+                goto tweak_fail;
+        return 0;
+tweak_fail:
+        pr_err("failed to tweak %s to %scoherent\n", path, coherent ? "" : "non");
+        return -EFAULT;
+}
 enum hsdk_axi_masters {
        M_HS_CORE = 0,
        M_HS_RTT,
@@ -162,6 +202,39 @@ enum hsdk_axi_masters {
 #define CREG_PAE                ((void __iomem *)(CREG_BASE + 0x180))
 #define CREG_PAE_UPDT           ((void __iomem *)(CREG_BASE + 0x194))
+static void __init hsdk_init_memory_bridge_axi_dmac(void)
+{
+        bool coherent = !!arc_hsdk_axi_dmac_coherent;
+        u32 axi_m_slv1, axi_m_oft1;
+        /*
+         * Don't tweak memory bridge configuration if we failed to tweak DTB
+         * as we will end up in a inconsistent state.
+         */
+        if (hsdk_tweak_node_coherency("/soc/dmac@80000", coherent))
+                return;
+        if (coherent) {
+                axi_m_slv1 = 0x77999999;
+                axi_m_oft1 = 0x76DCBA98;
+        } else {
+                axi_m_slv1 = 0x77777777;
+                axi_m_oft1 = 0x76543210;
+        }
+        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_0));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_0));
+        writel(axi_m_slv1, CREG_AXI_M_SLV1(M_DMAC_0));
+        writel(axi_m_oft1, CREG_AXI_M_OFT1(M_DMAC_0));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_0));
+        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_1));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_1));
+        writel(axi_m_slv1, CREG_AXI_M_SLV1(M_DMAC_1));
+        writel(axi_m_oft1, CREG_AXI_M_OFT1(M_DMAC_1));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_1));
+}
 static void __init hsdk_init_memory_bridge(void)
 {
        u32 reg;
@@ -227,24 +300,14 @@ static void __init hsdk_init_memory_bridge(void)
        writel(0x76543210, CREG_AXI_M_OFT1(M_GPU));
        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_GPU));
-        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_0));
-        writel(0x77777777, CREG_AXI_M_SLV1(M_DMAC_0));
-        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_0));
-        writel(0x76543210, CREG_AXI_M_OFT1(M_DMAC_0));
-        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_0));
-        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_1));
-        writel(0x77777777, CREG_AXI_M_SLV1(M_DMAC_1));
-        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_1));
-        writel(0x76543210, CREG_AXI_M_OFT1(M_DMAC_1));
-        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_1));
        writel(0x00000000, CREG_AXI_M_SLV0(M_DVFS));
        writel(0x60000000, CREG_AXI_M_SLV1(M_DVFS));
        writel(0x00000000, CREG_AXI_M_OFT0(M_DVFS));
        writel(0x00000000, CREG_AXI_M_OFT1(M_DVFS));
        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DVFS));
+        hsdk_init_memory_bridge_axi_dmac();
        /*
         * PAE remapping for DMA clients does not work due to an RTL bug, so
         * CREG_PAE register must be programmed to all zeroes, otherwise it
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 33b00579beff..24360211534a 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -7,6 +7,8 @@ config ARM
        select ARCH_HAS_BINFMT_FLAT
        select ARCH_HAS_DEBUG_VIRTUAL if MMU
        select ARCH_HAS_DEVMEM_IS_ALLOWED
+        select ARCH_HAS_DMA_COHERENT_TO_PFN if SWIOTLB
+        select ARCH_HAS_DMA_MMAP_PGPROT if SWIOTLB
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_FORTIFY_SOURCE
        select ARCH_HAS_KEEPINITRD
@@ -18,6 +20,8 @@ config ARM
        select ARCH_HAS_SET_MEMORY
        select ARCH_HAS_STRICT_KERNEL_RWX if MMU && !XIP_KERNEL
        select ARCH_HAS_STRICT_MODULE_RWX if MMU
+        select ARCH_HAS_SYNC_DMA_FOR_DEVICE if SWIOTLB
+        select ARCH_HAS_SYNC_DMA_FOR_CPU if SWIOTLB
        select ARCH_HAS_TEARDOWN_DMA_OPS if MMU
        select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
        select ARCH_HAVE_CUSTOM_GPIO_H
diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
index ced1a19d5f89..46849d6ecb3e 100644
--- a/arch/arm/boot/dts/am33xx-l4.dtsi
+++ b/arch/arm/boot/dts/am33xx-l4.dtsi
@@ -185,7 +185,7 @@
                        uart0: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <72>;
                                status = "disabled";
                                dmas = <&edma 26 0>, <&edma 27 0>;
@@ -934,7 +934,7 @@
                        uart1: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <73>;
                                status = "disabled";
                                dmas = <&edma 28 0>, <&edma 29 0>;
@@ -966,7 +966,7 @@
                        uart2: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <74>;
                                status = "disabled";
                                dmas = <&edma 30 0>, <&edma 31 0>;
@@ -1614,7 +1614,7 @@
                        uart3: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <44>;
                                status = "disabled";
                        };
@@ -1644,7 +1644,7 @@
                        uart4: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <45>;
                                status = "disabled";
                        };
@@ -1674,7 +1674,7 @@
                        uart5: serial@0 {
                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                clock-frequency = <48000000>;
-                                reg = <0x0 0x2000>;
+                                reg = <0x0 0x1000>;
                                interrupts = <46>;
                                status = "disabled";
                        };
@@ -1758,6 +1758,8 @@
                target-module@cc000 {                   /* 0x481cc000, ap 60 46.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
+                        reg = <0xcc020 0x4>;
+                        reg-names = "rev";
                        ti,hwmods = "d_can0";
                        /* Domains (P, C): per_pwrdm, l4ls_clkdm */
                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN0_CLKCTRL 0>,
@@ -1780,6 +1782,8 @@
                target-module@d0000 {                   /* 0x481d0000, ap 62 42.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
+                        reg = <0xd0020 0x4>;
+                        reg-names = "rev";
                        ti,hwmods = "d_can1";
                        /* Domains (P, C): per_pwrdm, l4ls_clkdm */
                        clocks = <&l4ls_clkctrl AM3_L4LS_D_CAN1_CLKCTRL 0>,
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index e5c2f71a7c77..fb6b8aa12cc5 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -234,13 +234,33 @@
                        interrupt-names = "edma3_tcerrint";
                };
-                mmc3: mmc@47810000 {
+                target-module@47810000 {
-                        compatible = "ti,omap4-hsmmc";
+                        compatible = "ti,sysc-omap2", "ti,sysc";
                        ti,hwmods = "mmc3";
-                        ti,needs-special-reset;
+                        reg = <0x478102fc 0x4>,
-                        interrupts = <29>;
+                              <0x47810110 0x4>,
-                        reg = <0x47810000 0x1000>;
+                              <0x47810114 0x4>;
-                        status = "disabled";
+                        reg-names = "rev", "sysc", "syss";
+                        ti,sysc-mask = <(SYSC_OMAP2_CLOCKACTIVITY |
+                                         SYSC_OMAP2_ENAWAKEUP |
+                                         SYSC_OMAP2_SOFTRESET |
+                                         SYSC_OMAP2_AUTOIDLE)>;
+                        ti,sysc-sidle = <SYSC_IDLE_FORCE>,
+                                        <SYSC_IDLE_NO>,
+                                        <SYSC_IDLE_SMART>;
+                        ti,syss-mask = <1>;
+                        clocks = <&l3s_clkctrl AM3_L3S_MMC3_CLKCTRL 0>;
+                        clock-names = "fck";
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        ranges = <0x0 0x47810000 0x1000>;
+                        mmc3: mmc@0 {
+                                compatible = "ti,omap4-hsmmc";
+                                ti,needs-special-reset;
+                                interrupts = <29>;
+                                reg = <0x0 0x1000>;
+                        };
                };
                usb: usb@47400000 {
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index 55aff4db9c7c..848e2a8884e2 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -228,13 +228,33 @@
                        interrupt-names = "edma3_tcerrint";
                };
-                mmc3: mmc@47810000 {
+                target-module@47810000 {
-                        compatible = "ti,omap4-hsmmc";
+                        compatible = "ti,sysc-omap2", "ti,sysc";
-                        reg = <0x47810000 0x1000>;
                        ti,hwmods = "mmc3";
-                        ti,needs-special-reset;
+                        reg = <0x478102fc 0x4>,
-                        interrupts = <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>;
+                              <0x47810110 0x4>,
-                        status = "disabled";
+                              <0x47810114 0x4>;
+                        reg-names = "rev", "sysc", "syss";
+                        ti,sysc-mask = <(SYSC_OMAP2_CLOCKACTIVITY |
+                                         SYSC_OMAP2_ENAWAKEUP |
+                                         SYSC_OMAP2_SOFTRESET |
+                                         SYSC_OMAP2_AUTOIDLE)>;
+                        ti,sysc-sidle = <SYSC_IDLE_FORCE>,
+                                        <SYSC_IDLE_NO>,
+                                        <SYSC_IDLE_SMART>;
+                        ti,syss-mask = <1>;
+                        clocks = <&l3s_clkctrl AM4_L3S_MMC3_CLKCTRL 0>;
+                        clock-names = "fck";
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        ranges = <0x0 0x47810000 0x1000>;
+                        mmc3: mmc@0 {
+                                compatible = "ti,omap4-hsmmc";
+                                ti,needs-special-reset;
+                                interrupts = <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>;
+                                reg = <0x0 0x1000>;
+                        };
                };
                sham: sham@53100000 {
diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi
index 989cb60b9029..04bee4ff9dcb 100644
--- a/arch/arm/boot/dts/am437x-l4.dtsi
+++ b/arch/arm/boot/dts/am437x-l4.dtsi
@@ -1574,6 +1574,8 @@
                target-module@cc000 {                   /* 0x481cc000, ap 50 46.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
+                        reg = <0xcc020 0x4>;
+                        reg-names = "rev";
                        ti,hwmods = "d_can0";
                        /* Domains (P, C): per_pwrdm, l4ls_clkdm */
                        clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>;
@@ -1593,6 +1595,8 @@
                target-module@d0000 {                   /* 0x481d0000, ap 52 3a.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
+                        reg = <0xd0020 0x4>;
+                        reg-names = "rev";
                        ti,hwmods = "d_can1";
                        /* Domains (P, C): per_pwrdm, l4ls_clkdm */
                        clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>;
diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
index 1d5e99964bbf..0aaacea1d887 100644
--- a/arch/arm/boot/dts/am571x-idk.dts
+++ b/arch/arm/boot/dts/am571x-idk.dts
@@ -175,14 +175,9 @@
 };
 &mmc1 {
-        pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
+        pinctrl-names = "default", "hs";
        pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
        pinctrl-1 = <&mmc1_pins_hs>;
-        pinctrl-2 = <&mmc1_pins_sdr12>;
-        pinctrl-3 = <&mmc1_pins_sdr25>;
-        pinctrl-4 = <&mmc1_pins_sdr50>;
-        pinctrl-5 = <&mmc1_pins_ddr50_rev20 &mmc1_iodelay_ddr50_conf>;
-        pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
 };
 &mmc2 {
diff --git a/arch/arm/boot/dts/am572x-idk.dts b/arch/arm/boot/dts/am572x-idk.dts
index c65d7f6d3b5a..ea1c119feaa5 100644
--- a/arch/arm/boot/dts/am572x-idk.dts
+++ b/arch/arm/boot/dts/am572x-idk.dts
@@ -16,14 +16,9 @@
 };
 &mmc1 {
-        pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
+        pinctrl-names = "default", "hs";
        pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
        pinctrl-1 = <&mmc1_pins_hs>;
-        pinctrl-2 = <&mmc1_pins_sdr12>;
-        pinctrl-3 = <&mmc1_pins_sdr25>;
-        pinctrl-4 = <&mmc1_pins_sdr50>;
-        pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
-        pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
 };
 &mmc2 {
diff --git a/arch/arm/boot/dts/am574x-idk.dts b/arch/arm/boot/dts/am574x-idk.dts
index dc5141c35610..7935d70874ce 100644
--- a/arch/arm/boot/dts/am574x-idk.dts
+++ b/arch/arm/boot/dts/am574x-idk.dts
@@ -24,14 +24,9 @@
 };
 &mmc1 {
-        pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
+        pinctrl-names = "default", "hs";
        pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
        pinctrl-1 = <&mmc1_pins_hs>;
-        pinctrl-2 = <&mmc1_pins_default>;
-        pinctrl-3 = <&mmc1_pins_hs>;
-        pinctrl-4 = <&mmc1_pins_sdr50>;
-        pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_conf>;
-        pinctrl-6 = <&mmc1_pins_ddr50 &mmc1_iodelay_sdr104_conf>;
 };
 &mmc2 {
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
index d02f5fa61e5f..bc76f1705c0f 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
@@ -379,7 +379,7 @@
        };
 };
-&gpio7 {
+&gpio7_target {
        ti,no-reset-on-init;
        ti,no-idle-on-init;
 };
@@ -430,6 +430,7 @@
        bus-width = <4>;
        cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */
+        no-1-8-v;
 };
 &mmc2 {
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
index a374b5cd6db0..7b113b52c3fb 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
@@ -16,14 +16,9 @@
 };
 &mmc1 {
-        pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
+        pinctrl-names = "default", "hs";
        pinctrl-0 = <&mmc1_pins_default>;
        pinctrl-1 = <&mmc1_pins_hs>;
-        pinctrl-2 = <&mmc1_pins_sdr12>;
-        pinctrl-3 = <&mmc1_pins_sdr25>;
-        pinctrl-4 = <&mmc1_pins_sdr50>;
-        pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev11_conf>;
-        pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev11_conf>;
        vmmc-supply = <&vdd_3v3>;
        vqmmc-supply = <&ldo1_reg>;
 };
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
index 4badd2144db9..30c500b15b21 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
@@ -16,14 +16,9 @@
 };
 &mmc1 {
-        pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
+        pinctrl-names = "default", "hs";
        pinctrl-0 = <&mmc1_pins_default>;
        pinctrl-1 = <&mmc1_pins_hs>;
-        pinctrl-2 = <&mmc1_pins_sdr12>;
-        pinctrl-3 = <&mmc1_pins_sdr25>;
-        pinctrl-4 = <&mmc1_pins_sdr50>;
-        pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
-        pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
        vmmc-supply = <&vdd_3v3>;
        vqmmc-supply = <&ldo1_reg>;
 };
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 714e971b912a..de7f85efaa51 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -498,7 +498,7 @@
        phy-supply = <&ldousb_reg>;
 };
-&gpio7 {
+&gpio7_target {
        ti,no-reset-on-init;
        ti,no-idle-on-init;
 };
diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
index 23faedec08ab..21e5914fdd62 100644
--- a/arch/arm/boot/dts/dra7-l4.dtsi
+++ b/arch/arm/boot/dts/dra7-l4.dtsi
@@ -1261,7 +1261,7 @@
                        };
                };
-                target-module@51000 {                   /* 0x48051000, ap 45 2e.0 */
+                gpio7_target: target-module@51000 {             /* 0x48051000, ap 45 2e.0 */
                        compatible = "ti,sysc-omap2", "ti,sysc";
                        ti,hwmods = "gpio7";
                        reg = <0x51000 0x4>,
@@ -3025,7 +3025,7 @@
                target-module@80000 {                   /* 0x48480000, ap 31 16.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
-                        reg = <0x80000 0x4>;
+                        reg = <0x80020 0x4>;
                        reg-names = "rev";
                        clocks = <&l4per2_clkctrl DRA7_L4PER2_DCAN2_CLKCTRL 0>;
                        clock-names = "fck";
@@ -4577,7 +4577,7 @@
                target-module@c000 {                    /* 0x4ae3c000, ap 30 04.0 */
                        compatible = "ti,sysc-omap4", "ti,sysc";
-                        reg = <0xc000 0x4>;
+                        reg = <0xc020 0x4>;
                        reg-names = "rev";
                        clocks = <&wkupaon_clkctrl DRA7_WKUPAON_DCAN1_CLKCTRL 0>;
                        clock-names = "fck";
diff --git a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
index 28ebb4eb884a..214b9e6de2c3 100644
--- a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
+++ b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
@@ -32,7 +32,7 @@
 *
 * Datamanual Revisions:
 *
- * AM572x Silicon Revision 2.0: SPRS953B, Revised November 2016
+ * AM572x Silicon Revision 2.0: SPRS953F, Revised May 2019
 * AM572x Silicon Revision 1.1: SPRS915R, Revised November 2016
 *
 */
@@ -229,45 +229,45 @@
        mmc3_pins_default: mmc3_pins_default {
                pinctrl-single,pins = <
-                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
-                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
-                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
-                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
-                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
-                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
                >;
        };
        mmc3_pins_hs: mmc3_pins_hs {
                pinctrl-single,pins = <
-                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
-                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
-                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
-                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
-                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
-                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
                >;
        };
        mmc3_pins_sdr12: mmc3_pins_sdr12 {
                pinctrl-single,pins = <
-                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
-                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
-                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
-                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
-                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
-                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
                >;
        };
        mmc3_pins_sdr25: mmc3_pins_sdr25 {
                pinctrl-single,pins = <
-                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
-                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
-                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
-                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
-                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
-                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
                >;
        };
diff --git a/arch/arm/boot/dts/vf610-bk4.dts b/arch/arm/boot/dts/vf610-bk4.dts
index 3fa0cbe456db..0f3870d3b099 100644
--- a/arch/arm/boot/dts/vf610-bk4.dts
+++ b/arch/arm/boot/dts/vf610-bk4.dts
@@ -246,13 +246,13 @@
                reg = <0>;
        };
-        n25q128a13_2: flash@1 {
+        n25q128a13_2: flash@2 {
                compatible = "n25q128a13", "jedec,spi-nor";
                #address-cells = <1>;
                #size-cells = <1>;
                spi-max-frequency = <66000000>;
                spi-rx-bus-width = <2>;
-                reg = <1>;
+                reg = <2>;
        };
 };
diff --git a/arch/arm/lib/backtrace.S b/arch/arm/lib/backtrace.S
index 1d5210eb4776..582925238d65 100644
--- a/arch/arm/lib/backtrace.S
+++ b/arch/arm/lib/backtrace.S
@@ -66,7 +66,7 @@ for_each_frame:	tst	frame, mask		@ Check for address exceptions
 1003:           ldr     r2, [sv_pc, #-4]        @ if stmfd sp!, {args} exists,
                ldr     r3, .Ldsi+4             @ adjust saved 'pc' back one
-                teq     r3, r2, lsr #10         @ instruction
+                teq     r3, r2, lsr #11         @ instruction
                subne   r0, sv_pc, #4           @ allow for mov
                subeq   r0, sv_pc, #8           @ allow for mov + stmia
diff --git a/arch/arm/mach-omap1/ams-delta-fiq-handler.S b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
index 81159af44862..14a6c3eb3298 100644
--- a/arch/arm/mach-omap1/ams-delta-fiq-handler.S
+++ b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
@@ -126,6 +126,8 @@ restart:
        orr r11, r11, r13                       @ mask all requested interrupts
        str r11, [r12, #OMAP1510_GPIO_INT_MASK]
+        str r13, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack all requested interrupts
        ands r10, r13, #KEYBRD_CLK_MASK         @ extract keyboard status - set?
        beq hksw                                @ no - try next source
@@ -133,7 +135,6 @@ restart:
        @@@@@@@@@@@@@@@@@@@@@@
        @ Keyboard clock FIQ mode interrupt handler
        @ r10 now contains KEYBRD_CLK_MASK, use it
-        str r10, [r12, #OMAP1510_GPIO_INT_STATUS]       @ ack the interrupt
        bic r11, r11, r10                               @ unmask it
        str r11, [r12, #OMAP1510_GPIO_INT_MASK]
diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c
index 43899fa56674..0254eb9cf8c6 100644
--- a/arch/arm/mach-omap1/ams-delta-fiq.c
+++ b/arch/arm/mach-omap1/ams-delta-fiq.c
@@ -70,9 +70,7 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id)
                         * interrupts default to since commit 80ac93c27441
                         * requires interrupt already acked and unmasked.
                         */
-                        if (irq_chip->irq_ack)
+                        if (!WARN_ON_ONCE(!irq_chip->irq_unmask))
-                                irq_chip->irq_ack(d);
-                        if (irq_chip->irq_unmask)
                                irq_chip->irq_unmask(d);
                }
                for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++)
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index f9c02f9f1c92..5c3845730dbf 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -127,6 +127,9 @@ static int __init omap4_sram_init(void)
        struct device_node *np;
        struct gen_pool *sram_pool;
+        if (!soc_is_omap44xx() && !soc_is_omap54xx())
+                return 0;
        np = of_find_compatible_node(NULL, NULL, "ti,omap4-mpu");
        if (!np)
                pr_warn("%s:Unable to allocate sram needed to handle errata I688\n",
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index 4a5b4aee6615..1ec21e9ba1e9 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -379,7 +379,8 @@ static struct omap_hwmod dra7xx_dcan2_hwmod = {
 static struct omap_hwmod_class_sysconfig dra7xx_epwmss_sysc = {
        .rev_offs       = 0x0,
        .sysc_offs      = 0x4,
-        .sysc_flags     = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET,
+        .sysc_flags     = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
+                          SYSC_HAS_RESET_STATUS,
        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
        .sysc_fields    = &omap_hwmod_sysc_type2,
 };
diff --git a/arch/arm/mach-rpc/riscpc.c b/arch/arm/mach-rpc/riscpc.c
index 0ce56ad754ce..ea2c84214bac 100644
--- a/arch/arm/mach-rpc/riscpc.c
+++ b/arch/arm/mach-rpc/riscpc.c
@@ -46,6 +46,7 @@ static int __init parse_tag_acorn(const struct tag *tag)
        switch (tag->u.acorn.vram_pages) {
        case 512:
                vram_size += PAGE_SIZE * 256;
+                /* Fall through - ??? */
        case 256:
                vram_size += PAGE_SIZE * 256;
        default:
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index c54cd7ed90ba..c1222c0e9fd3 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -664,10 +664,6 @@ config ARM_LPAE
                !CPU_32v4 && !CPU_32v3
        select PHYS_ADDR_T_64BIT
        select SWIOTLB
-        select ARCH_HAS_DMA_COHERENT_TO_PFN
-        select ARCH_HAS_DMA_MMAP_PGPROT
-        select ARCH_HAS_SYNC_DMA_FOR_DEVICE
-        select ARCH_HAS_SYNC_DMA_FOR_CPU
        help
          Say Y if you have an ARMv7 processor supporting the LPAE page
          table format and you would like to access memory beyond the
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 6774b03aa405..d42557ee69c2 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2405,9 +2405,7 @@ long arch_dma_coherent_to_pfn(struct device *dev, void *cpu_addr,
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                unsigned long attrs)
 {
-        if (!dev_is_dma_coherent(dev))
+        return __get_dma_pgprot(attrs, prot);
-                return __get_dma_pgprot(attrs, prot);
-        return prot;
 }
 void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 16d373d587c4..b4be3baa83d4 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -175,6 +175,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
 #ifdef CONFIG_HAVE_ARCH_PFN_VALID
 int pfn_valid(unsigned long pfn)
 {
+        phys_addr_t addr = __pfn_to_phys(pfn);
+        if (__phys_to_pfn(addr) != pfn)
+                return 0;
        return memblock_is_map_memory(__pfn_to_phys(pfn));
 }
 EXPORT_SYMBOL(pfn_valid);
@@ -628,7 +633,8 @@ static void update_sections_early(struct section_perm perms[], int n)
                if (t->flags & PF_KTHREAD)
                        continue;
                for_each_thread(t, s)
-                        set_section_perms(perms, n, true, s->mm);
+                        if (s->mm)
+                                set_section_perms(perms, n, true, s->mm);
        }
        set_section_perms(perms, n, true, current->active_mm);
        set_section_perms(perms, n, true, &init_mm);
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
index c7a87368850b..12aa7eaeaf68 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
@@ -339,6 +339,12 @@
        pinctrl-names = "default";
 };
+&ir {
+        status = "okay";
+        pinctrl-0 = <&remote_input_ao_pins>;
+        pinctrl-names = "default";
+};
 &pwm_ef {
        status = "okay";
        pinctrl-0 = <&pwm_e_pins>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
index f8d43e3dcf20..1785552d450c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
@@ -2386,6 +2386,7 @@
                                clocks = <&clkc CLKID_USB1_DDR_BRIDGE>;
                                clock-names = "ddr";
                                phys = <&usb2_phy1>;
+                                phy-names = "usb2-phy";
                                dr_mode = "peripheral";
                                g-rx-fifo-size = <192>;
                                g-np-tx-fifo-size = <128>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
index 81780ffcc7f0..4e916e1f71f7 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
@@ -53,6 +53,7 @@
                gpio = <&gpio_ao GPIOAO_8 GPIO_ACTIVE_HIGH>;
                enable-active-high;
+                regulator-always-on;
        };
        tf_io: gpio-regulator-tf_io {
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index d19d14ba9ae4..b1fdc486aed8 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -184,9 +184,17 @@ static const struct arm64_ftr_bits ftr_id_aa64zfr0[] = {
 };
 static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
-        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+        /*
-        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+         * We already refuse to boot CPUs that don't support our configured
-        ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
+         * page size, so we can only detect mismatches for a page size other
+         * than the one we're currently using. Unfortunately, SoCs like this
+         * exist in the wild so, even though we don't like it, we'll have to go
+         * along with it and treat them as non-strict.
+         */
+        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+        S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+        ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
        ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0),
        /* Linux shouldn't care about secure memory */
        ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0),
diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
index 1285c7b2947f..171773257974 100644
--- a/arch/arm64/kernel/ftrace.c
+++ b/arch/arm64/kernel/ftrace.c
@@ -73,7 +73,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
        if (offset < -SZ_128M || offset >= SZ_128M) {
 #ifdef CONFIG_ARM64_MODULE_PLTS
-                struct plt_entry trampoline;
+                struct plt_entry trampoline, *dst;
                struct module *mod;
                /*
@@ -106,23 +106,27 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                 * to check if the actual opcodes are in fact identical,
                 * regardless of the offset in memory so use memcmp() instead.
                 */
-                trampoline = get_plt_entry(addr, mod->arch.ftrace_trampoline);
+                dst = mod->arch.ftrace_trampoline;
-                if (memcmp(mod->arch.ftrace_trampoline, &trampoline,
+                trampoline = get_plt_entry(addr, dst);
-                           sizeof(trampoline))) {
+                if (memcmp(dst, &trampoline, sizeof(trampoline))) {
-                        if (plt_entry_is_initialized(mod->arch.ftrace_trampoline)) {
+                        if (plt_entry_is_initialized(dst)) {
                                pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
                                return -EINVAL;
                        }
                        /* point the trampoline to our ftrace entry point */
                        module_disable_ro(mod);
-                        *mod->arch.ftrace_trampoline = trampoline;
+                        *dst = trampoline;
                        module_enable_ro(mod, true);
-                        /* update trampoline before patching in the branch */
+                        /*
-                        smp_wmb();
+                         * Ensure updated trampoline is visible to instruction
+                         * fetch before we patch in the branch.
+                         */
+                        __flush_icache_range((unsigned long)&dst[0],
+                                             (unsigned long)&dst[1]);
                }
-                addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
+                addr = (unsigned long)dst;
 #else /* CONFIG_ARM64_MODULE_PLTS */
                return -EINVAL;
 #endif /* CONFIG_ARM64_MODULE_PLTS */
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 1d3f0b5a9940..bd2b039f43a6 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -14,9 +14,7 @@
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                unsigned long attrs)
 {
-        if (!dev_is_dma_coherent(dev) || (attrs & DMA_ATTR_WRITE_COMBINE))
+        return pgprot_writecombine(prot);
-                return pgprot_writecombine(prot);
-        return prot;
 }
 void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr,
diff --git a/arch/mips/include/asm/octeon/cvmx-sli-defs.h b/arch/mips/include/asm/octeon/cvmx-sli-defs.h
index 52cf96ea43e5..cbc7cdae1c6a 100644
--- a/arch/mips/include/asm/octeon/cvmx-sli-defs.h
+++ b/arch/mips/include/asm/octeon/cvmx-sli-defs.h
@@ -46,6 +46,7 @@ static inline uint64_t CVMX_SLI_PCIE_MSI_RCV_FUNC(void)
        case OCTEON_CN78XX & OCTEON_FAMILY_MASK:
                if (OCTEON_IS_MODEL(OCTEON_CN78XX_PASS1_X))
                        return 0x0000000000003CB0ull;
+                /* Else, fall through */
        default:
                return 0x0000000000023CB0ull;
        }
diff --git a/arch/nds32/kernel/signal.c b/arch/nds32/kernel/signal.c
index fe61513982b4..330b19fcd990 100644
--- a/arch/nds32/kernel/signal.c
+++ b/arch/nds32/kernel/signal.c
@@ -316,6 +316,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                                regs->uregs[0] = -EINTR;
                                break;
                        }
+                        /* Else, fall through */
                case -ERESTARTNOINTR:
                        regs->uregs[0] = regs->orig_r0;
                        regs->ipc -= 4;
@@ -360,6 +361,7 @@ static void do_signal(struct pt_regs *regs)
                switch (regs->uregs[0]) {
                case -ERESTART_RESTARTBLOCK:
                        regs->uregs[15] = __NR_restart_syscall;
+                        /* Fall through */
                case -ERESTARTNOHAND:
                case -ERESTARTSYS:
                case -ERESTARTNOINTR:
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index a39b079e73f2..6d58c1739b42 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -2,6 +2,7 @@
 #ifndef _PARISC_PGTABLE_H
 #define _PARISC_PGTABLE_H
+#include <asm/page.h>
 #include <asm-generic/4level-fixup.h>
 #include <asm/fixmap.h>
@@ -98,8 +99,6 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 #endif /* !__ASSEMBLY__ */
-#include <asm/page.h>
 #define pte_ERROR(e) \
        printk("%s:%d: bad pte %08lx.\n", __FILE__, __LINE__, pte_val(e))
 #define pmd_ERROR(e) \
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 77f6ebf97113..d8dcd8820369 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -121,7 +121,6 @@ config PPC
        select ARCH_32BIT_OFF_T if PPC32
        select ARCH_HAS_DEBUG_VIRTUAL
        select ARCH_HAS_DEVMEM_IS_ALLOWED
-        select ARCH_HAS_DMA_MMAP_PGPROT
        select ARCH_HAS_ELF_RANDOMIZE
        select ARCH_HAS_FORTIFY_SOURCE
        select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index ea0c69236789..56dfa7a2a6f2 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -49,8 +49,7 @@ obj-y				:= cputable.o ptrace.o syscalls.o \
                                   signal.o sysfs.o cacheinfo.o time.o \
                                   prom.o traps.o setup-common.o \
                                   udbg.o misc.o io.o misc_$(BITS).o \
-                                   of_platform.o prom_parse.o \
+                                   of_platform.o prom_parse.o
-                                   dma-common.o
 obj-$(CONFIG_PPC64)             += setup_64.o sys_ppc32.o \
                                   signal_64.o ptrace32.o \
                                   paca.o nvram_64.o firmware.o
diff --git a/arch/powerpc/kernel/dma-common.c b/arch/powerpc/kernel/dma-common.c
deleted file mode 100644
index dc7ef6b17b69..000000000000
--- a/arch/powerpc/kernel/dma-common.c
+++ /dev/null
@@ -1,17 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Contains common dma routines for all powerpc platforms.
- *
- * Copyright (C) 2019 Shawn Anastasio.
- */
-#include <linux/mm.h>
-#include <linux/dma-noncoherent.h>
-pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
-                unsigned long attrs)
-{
-        if (!dev_is_dma_coherent(dev))
-                return pgprot_noncached(prot);
-        return prot;
-}
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index e99a14798ab0..c4b606fe73eb 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -660,8 +660,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
                }
                tce = be64_to_cpu(tce);
-                if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua))
+                if (kvmppc_tce_to_ua(vcpu->kvm, tce, &ua)) {
-                        return H_PARAMETER;
+                        ret = H_PARAMETER;
+                        goto unlock_exit;
+                }
                list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
                        ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index f50bbeedfc66..b4f20f13b860 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -556,8 +556,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
                unsigned long tce = be64_to_cpu(((u64 *)tces)[i]);
                ua = 0;
-                if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL))
+                if (kvmppc_rm_tce_to_ua(vcpu->kvm, tce, &ua, NULL)) {
-                        return H_PARAMETER;
+                        ret = H_PARAMETER;
+                        goto unlock_exit;
+                }
                list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
                        ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index 93205c0bf71d..3efff552a261 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -54,6 +54,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
 CONFIG_HVC_RISCV_SBI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
 CONFIG_SPI=y
 CONFIG_SPI_SIFIVE=y
 # CONFIG_PTP_1588_CLOCK is not set
diff --git a/arch/riscv/configs/rv32_defconfig b/arch/riscv/configs/rv32_defconfig
index d5449ef805a3..7da93e494445 100644
--- a/arch/riscv/configs/rv32_defconfig
+++ b/arch/riscv/configs/rv32_defconfig
@@ -34,6 +34,7 @@ CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCIE_XILINX=y
 CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
@@ -53,6 +54,8 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_EARLYCON_RISCV_SBI=y
 CONFIG_HVC_RISCV_SBI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_VIRTIO=y
 # CONFIG_PTP_1588_CLOCK is not set
 CONFIG_DRM=y
 CONFIG_DRM_RADEON=y
diff --git a/arch/riscv/include/asm/fixmap.h b/arch/riscv/include/asm/fixmap.h
index 9c66033c3a54..161f28d04a07 100644
--- a/arch/riscv/include/asm/fixmap.h
+++ b/arch/riscv/include/asm/fixmap.h
@@ -30,10 +30,6 @@ enum fixed_addresses {
        __end_of_fixed_addresses
 };
-#define FIXADDR_SIZE            (__end_of_fixed_addresses * PAGE_SIZE)
-#define FIXADDR_TOP             (VMALLOC_START)
-#define FIXADDR_START           (FIXADDR_TOP - FIXADDR_SIZE)
 #define FIXMAP_PAGE_IO          PAGE_KERNEL
 #define __early_set_fixmap      __set_fixmap
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index a364aba23d55..c24a083b3e12 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -420,14 +420,22 @@ static inline void pgtable_cache_init(void)
 #define VMALLOC_END      (PAGE_OFFSET - 1)
 #define VMALLOC_START    (PAGE_OFFSET - VMALLOC_SIZE)
+#define FIXADDR_TOP      VMALLOC_START
+#ifdef CONFIG_64BIT
+#define FIXADDR_SIZE     PMD_SIZE
+#else
+#define FIXADDR_SIZE     PGDIR_SIZE
+#endif
+#define FIXADDR_START    (FIXADDR_TOP - FIXADDR_SIZE)
 /*
- * Task size is 0x4000000000 for RV64 or 0xb800000 for RV32.
+ * Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32.
 * Note that PGDIR_SIZE must evenly divide TASK_SIZE.
 */
 #ifdef CONFIG_64BIT
 #define TASK_SIZE (PGDIR_SIZE * PTRS_PER_PGD / 2)
 #else
-#define TASK_SIZE VMALLOC_START
+#define TASK_SIZE FIXADDR_START
 #endif
 #include <asm-generic/pgtable.h>
diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
index 853b65ef656d..f0227bdce0f0 100644
--- a/arch/riscv/include/asm/switch_to.h
+++ b/arch/riscv/include/asm/switch_to.h
@@ -16,7 +16,13 @@ extern void __fstate_restore(struct task_struct *restore_from);
 static inline void __fstate_clean(struct pt_regs *regs)
 {
-        regs->sstatus |= (regs->sstatus & ~(SR_FS)) | SR_FS_CLEAN;
+        regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN;
+}
+static inline void fstate_off(struct task_struct *task,
+                              struct pt_regs *regs)
+{
+        regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_OFF;
 }
 static inline void fstate_save(struct task_struct *task,
diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h
index 687dd19735a7..4d9bbe8438bf 100644
--- a/arch/riscv/include/asm/tlbflush.h
+++ b/arch/riscv/include/asm/tlbflush.h
@@ -53,10 +53,17 @@ static inline void remote_sfence_vma(struct cpumask *cmask, unsigned long start,
 }
 #define flush_tlb_all() sbi_remote_sfence_vma(NULL, 0, -1)
-#define flush_tlb_page(vma, addr) flush_tlb_range(vma, addr, 0)
 #define flush_tlb_range(vma, start, end) \
        remote_sfence_vma(mm_cpumask((vma)->vm_mm), start, (end) - (start))
-#define flush_tlb_mm(mm) \
+static inline void flush_tlb_page(struct vm_area_struct *vma,
+                                  unsigned long addr)
+{
+        flush_tlb_range(vma, addr, addr + PAGE_SIZE);
+}
+#define flush_tlb_mm(mm)                                \
        remote_sfence_vma(mm_cpumask(mm), 0, -1)
 #endif /* CONFIG_SMP */
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index f23794bd1e90..fb3a082362eb 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -64,8 +64,14 @@ void start_thread(struct pt_regs *regs, unsigned long pc,
        unsigned long sp)
 {
        regs->sstatus = SR_SPIE;
-        if (has_fpu)
+        if (has_fpu) {
                regs->sstatus |= SR_FS_INITIAL;
+                /*
+                 * Restore the initial value to the FP register
+                 * before starting the user program.
+                 */
+                fstate_restore(current, regs);
+        }
        regs->sepc = pc;
        regs->sp = sp;
        set_fs(USER_DS);
@@ -75,10 +81,11 @@ void flush_thread(void)
 {
 #ifdef CONFIG_FPU
        /*
-         * Reset FPU context
+         * Reset FPU state and context
         *      frm: round to nearest, ties to even (IEEE default)
         *      fflags: accrued exceptions cleared
         */
+        fstate_off(current, task_pt_regs(current));
        memset(&current->thread.fstate, 0, sizeof(current->thread.fstate));
 #endif
 }
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index e636728ab452..955eb355c2fd 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -863,7 +863,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
                break;
        case BPF_ALU64 | BPF_NEG: /* dst = -dst */
                /* lcgr %dst,%dst */
-                EMIT4(0xb9130000, dst_reg, dst_reg);
+                EMIT4(0xb9030000, dst_reg, dst_reg);
                break;
        /*
         * BPF_FROM_BE/LE
@@ -1049,8 +1049,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
                /* llgf %w1,map.max_entries(%b2) */
                EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,
                              offsetof(struct bpf_array, map.max_entries));
-                /* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */
+                /* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */
-                EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3,
+                EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,
                                  REG_W1, 0, 0xa);
                /*
@@ -1076,8 +1076,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
                 *         goto out;
                 */
-                /* sllg %r1,%b3,3: %r1 = index * 8 */
+                /* llgfr %r1,%b3: %r1 = (u32) index */
-                EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3);
+                EMIT4(0xb9160000, REG_1, BPF_REG_3);
+                /* sllg %r1,%r1,3: %r1 *= 8 */
+                EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);
                /* lg %r1,prog(%b2,%r1) */
                EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2,
                              REG_1, offsetof(struct bpf_array, ptrs));
diff --git a/arch/sh/kernel/disassemble.c b/arch/sh/kernel/disassemble.c
index defebf1a9c8a..845543780cc5 100644
--- a/arch/sh/kernel/disassemble.c
+++ b/arch/sh/kernel/disassemble.c
@@ -475,8 +475,6 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                printk("dbr");
                                break;
                        case FD_REG_N:
-                                if (0)
-                                        goto d_reg_n;
                        case F_REG_N:
                                printk("fr%d", rn);
                                break;
@@ -488,7 +486,7 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                        printk("xd%d", rn & ~1);
                                        break;
                                }
-                        d_reg_n:
+                                /* else, fall through */
                        case D_REG_N:
                                printk("dr%d", rn);
                                break;
@@ -497,6 +495,7 @@ static void print_sh_insn(u32 memaddr, u16 insn)
                                        printk("xd%d", rm & ~1);
                                        break;
                                }
+                                /* else, fall through */
                        case D_REG_M:
                                printk("dr%d", rm);
                                break;
diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c
index 3bd010b4c55f..f10d64311127 100644
--- a/arch/sh/kernel/hw_breakpoint.c
+++ b/arch/sh/kernel/hw_breakpoint.c
@@ -157,6 +157,7 @@ int arch_bp_generic_fields(int sh_len, int sh_type,
        switch (sh_type) {
        case SH_BREAKPOINT_READ:
                *gen_type = HW_BREAKPOINT_R;
+                break;
        case SH_BREAKPOINT_WRITE:
                *gen_type = HW_BREAKPOINT_W;
                break;
diff --git a/arch/um/include/shared/timer-internal.h b/arch/um/include/shared/timer-internal.h
index 8574338bf23b..9991ec2371e4 100644
--- a/arch/um/include/shared/timer-internal.h
+++ b/arch/um/include/shared/timer-internal.h
@@ -34,10 +34,13 @@ static inline void time_travel_set_time(unsigned long long ns)
        time_travel_time = ns;
 }
-static inline void time_travel_set_timer(enum time_travel_timer_mode mode,
+static inline void time_travel_set_timer_mode(enum time_travel_timer_mode mode)
-                                         unsigned long long expiry)
 {
        time_travel_timer_mode = mode;
+}
+static inline void time_travel_set_timer_expiry(unsigned long long expiry)
+{
        time_travel_timer_expiry = expiry;
 }
 #else
@@ -50,8 +53,11 @@ static inline void time_travel_set_time(unsigned long long ns)
 {
 }
-static inline void time_travel_set_timer(enum time_travel_timer_mode mode,
+static inline void time_travel_set_timer_mode(enum time_travel_timer_mode mode)
-                                         unsigned long long expiry)
+{
+}
+static inline void time_travel_set_timer_expiry(unsigned long long expiry)
 {
 }
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index 67c0d1a860e9..6bede7888fc2 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -213,7 +213,7 @@ static void time_travel_sleep(unsigned long long duration)
        if (time_travel_timer_mode != TT_TMR_DISABLED ||
            time_travel_timer_expiry < next) {
                if (time_travel_timer_mode == TT_TMR_ONESHOT)
-                        time_travel_set_timer(TT_TMR_DISABLED, 0);
+                        time_travel_set_timer_mode(TT_TMR_DISABLED);
                /*
                 * time_travel_time will be adjusted in the timer
                 * IRQ handler so it works even when the signal
diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
index 6a051b078359..234757233355 100644
--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@@ -50,7 +50,7 @@ void timer_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
 static int itimer_shutdown(struct clock_event_device *evt)
 {
        if (time_travel_mode != TT_MODE_OFF)
-                time_travel_set_timer(TT_TMR_DISABLED, 0);
+                time_travel_set_timer_mode(TT_TMR_DISABLED);
        if (time_travel_mode != TT_MODE_INFCPU)
                os_timer_disable();
@@ -62,9 +62,10 @@ static int itimer_set_periodic(struct clock_event_device *evt)
 {
        unsigned long long interval = NSEC_PER_SEC / HZ;
-        if (time_travel_mode != TT_MODE_OFF)
+        if (time_travel_mode != TT_MODE_OFF) {
-                time_travel_set_timer(TT_TMR_PERIODIC,
+                time_travel_set_timer_mode(TT_TMR_PERIODIC);
-                                      time_travel_time + interval);
+                time_travel_set_timer_expiry(time_travel_time + interval);
+        }
        if (time_travel_mode != TT_MODE_INFCPU)
                os_timer_set_interval(interval);
@@ -77,9 +78,10 @@ static int itimer_next_event(unsigned long delta,
 {
        delta += 1;
-        if (time_travel_mode != TT_MODE_OFF)
+        if (time_travel_mode != TT_MODE_OFF) {
-                time_travel_set_timer(TT_TMR_ONESHOT,
+                time_travel_set_timer_mode(TT_TMR_ONESHOT);
-                                      time_travel_time + delta);
+                time_travel_set_timer_expiry(time_travel_time + delta);
+        }
        if (time_travel_mode != TT_MODE_INFCPU)
                return os_timer_one_shot(delta);
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 62f317c9113a..5b35b7ea5d72 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -661,10 +661,17 @@ fail:
        throttle = perf_event_overflow(event, &data, &regs);
 out:
-        if (throttle)
+        if (throttle) {
                perf_ibs_stop(event, 0);
-        else
+        } else {
-                perf_ibs_enable_event(perf_ibs, hwc, period >> 4);
+                period >>= 4;
+                if ((ibs_caps & IBS_CAPS_RDWROPCNT) &&
+                    (*config & IBS_OP_CNT_CTL))
+                        period |= *config & IBS_OP_CUR_CNT_RAND;
+                perf_ibs_enable_event(perf_ibs, hwc, period);
+        }
        perf_event_update_userpage(event);
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 81b005e4c7d9..325959d19d9a 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1236,7 +1236,7 @@ void x86_pmu_enable_event(struct perf_event *event)
 * Add a single event to the PMU.
 *
 * The event is added to the group of enabled events
- * but only if it can be scehduled with existing events.
+ * but only if it can be scheduled with existing events.
 */
 static int x86_pmu_add(struct perf_event *event, int flags)
 {
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 648260b5f367..e4c2cb65ea50 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3572,6 +3572,11 @@ static u64 bdw_limit_period(struct perf_event *event, u64 left)
        return left;
 }
+static u64 nhm_limit_period(struct perf_event *event, u64 left)
+{
+        return max(left, 32ULL);
+}
 PMU_FORMAT_ATTR(event,  "config:0-7"    );
 PMU_FORMAT_ATTR(umask,  "config:8-15"   );
 PMU_FORMAT_ATTR(edge,   "config:18"     );
@@ -4606,6 +4611,7 @@ __init int intel_pmu_init(void)
                x86_pmu.pebs_constraints = intel_nehalem_pebs_event_constraints;
                x86_pmu.enable_all = intel_pmu_nhm_enable_all;
                x86_pmu.extra_regs = intel_nehalem_extra_regs;
+                x86_pmu.limit_period = nhm_limit_period;
                mem_attr = nhm_mem_events_attrs;
diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
index 287f1f7b2e52..c38a66661576 100644
--- a/arch/x86/include/asm/ftrace.h
+++ b/arch/x86/include/asm/ftrace.h
@@ -16,7 +16,6 @@
 #define HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
 #ifndef __ASSEMBLY__
-extern void mcount(void);
 extern atomic_t modifying_ftrace_code;
 extern void __fentry__(void);
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 1392d5e6e8d6..ee26e9215f18 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -252,16 +252,20 @@ struct pebs_lbr {
 #define IBSCTL_LVT_OFFSET_VALID         (1ULL<<8)
 #define IBSCTL_LVT_OFFSET_MASK          0x0F
-/* ibs fetch bits/masks */
+/* IBS fetch bits/masks */
 #define IBS_FETCH_RAND_EN       (1ULL<<57)
 #define IBS_FETCH_VAL           (1ULL<<49)
 #define IBS_FETCH_ENABLE        (1ULL<<48)
 #define IBS_FETCH_CNT           0xFFFF0000ULL
 #define IBS_FETCH_MAX_CNT       0x0000FFFFULL
-/* ibs op bits/masks */
+/*
-/* lower 4 bits of the current count are ignored: */
+ * IBS op bits/masks
-#define IBS_OP_CUR_CNT          (0xFFFF0ULL<<32)
+ * The lower 7 bits of the current count are random bits
+ * preloaded by hardware and ignored in software
+ */
+#define IBS_OP_CUR_CNT          (0xFFF80ULL<<32)
+#define IBS_OP_CUR_CNT_RAND     (0x0007FULL<<32)
 #define IBS_OP_CNT_CTL          (1ULL<<19)
 #define IBS_OP_VAL              (1ULL<<18)
 #define IBS_OP_ENABLE           (1ULL<<17)
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index c10a8b10b203..fff790a3f4ee 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1781,7 +1781,7 @@ int kvm_vm_ioctl_hv_eventfd(struct kvm *kvm, struct kvm_hyperv_eventfd *args)
 int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                                struct kvm_cpuid_entry2 __user *entries)
 {
-        uint16_t evmcs_ver = kvm_x86_ops->nested_get_evmcs_version(vcpu);
+        uint16_t evmcs_ver = 0;
        struct kvm_cpuid_entry2 cpuid_entries[] = {
                { .function = HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS },
                { .function = HYPERV_CPUID_INTERFACE },
@@ -1793,6 +1793,9 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
        };
        int i, nent = ARRAY_SIZE(cpuid_entries);
+        if (kvm_x86_ops->nested_get_evmcs_version)
+                evmcs_ver = kvm_x86_ops->nested_get_evmcs_version(vcpu);
        /* Skip NESTED_FEATURES if eVMCS is not supported */
        if (!evmcs_ver)
                --nent;
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 685d17c11461..e904ff06a83d 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -216,6 +216,9 @@ static void recalculate_apic_map(struct kvm *kvm)
                if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id])
                        new->phys_map[xapic_id] = apic;
+                if (!kvm_apic_sw_enabled(apic))
+                        continue;
                ldr = kvm_lapic_get_reg(apic, APIC_LDR);
                if (apic_x2apic_mode(apic)) {
@@ -258,6 +261,8 @@ static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val)
                        static_key_slow_dec_deferred(&apic_sw_disabled);
                else
                        static_key_slow_inc(&apic_sw_disabled.key);
+                recalculate_apic_map(apic->vcpu->kvm);
        }
 }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 24843cf49579..218b277bfda3 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5653,38 +5653,7 @@ static void kvm_mmu_invalidate_zap_pages_in_memslot(struct kvm *kvm,
                        struct kvm_memory_slot *slot,
                        struct kvm_page_track_notifier_node *node)
 {
-        struct kvm_mmu_page *sp;
+        kvm_mmu_zap_all(kvm);
-        LIST_HEAD(invalid_list);
-        unsigned long i;
-        bool flush;
-        gfn_t gfn;
-        spin_lock(&kvm->mmu_lock);
-        if (list_empty(&kvm->arch.active_mmu_pages))
-                goto out_unlock;
-        flush = slot_handle_all_level(kvm, slot, kvm_zap_rmapp, false);
-        for (i = 0; i < slot->npages; i++) {
-                gfn = slot->base_gfn + i;
-                for_each_valid_sp(kvm, sp, gfn) {
-                        if (sp->gfn != gfn)
-                                continue;
-                        kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
-                }
-                if (need_resched() || spin_needbreak(&kvm->mmu_lock)) {
-                        kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
-                        flush = false;
-                        cond_resched_lock(&kvm->mmu_lock);
-                }
-        }
-        kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, flush);
-out_unlock:
-        spin_unlock(&kvm->mmu_lock);
 }
 void kvm_mmu_init_vm(struct kvm *kvm)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d685491fce4d..e0368076a1ef 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1714,7 +1714,6 @@ static int avic_init_backing_page(struct kvm_vcpu *vcpu)
        if (!entry)
                return -EINVAL;
-        new_entry = READ_ONCE(*entry);
        new_entry = __sme_set((page_to_phys(svm->avic_backing_page) &
                              AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK) |
                              AVIC_PHYSICAL_ID_ENTRY_VALID_MASK);
@@ -7129,12 +7128,6 @@ failed:
        return ret;
 }
-static uint16_t nested_get_evmcs_version(struct kvm_vcpu *vcpu)
-{
-        /* Not supported */
-        return 0;
-}
 static int nested_enable_evmcs(struct kvm_vcpu *vcpu,
                                   uint16_t *vmcs_version)
 {
@@ -7333,7 +7326,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
        .mem_enc_unreg_region = svm_unregister_enc_region,
        .nested_enable_evmcs = nested_enable_evmcs,
-        .nested_get_evmcs_version = nested_get_evmcs_version,
+        .nested_get_evmcs_version = NULL,
        .need_emulation_on_page_fault = svm_need_emulation_on_page_fault,
 };
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 42ed3faa6af8..c030c96fc81a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7797,6 +7797,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
        .set_nested_state = NULL,
        .get_vmcs12_pages = NULL,
        .nested_enable_evmcs = NULL,
+        .nested_get_evmcs_version = NULL,
        .need_emulation_on_page_fault = vmx_need_emulation_on_page_fault,
 };
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 93b0bd45ac73..290c3c3efb87 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6594,12 +6594,13 @@ restart:
                unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
                toggle_interruptibility(vcpu, ctxt->interruptibility);
                vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
-                kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE && ctxt->tf)
-                        kvm_vcpu_do_singlestep(vcpu, &r);
                if (!ctxt->have_exception ||
-                    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
+                    exception_type(ctxt->exception.vector) == EXCPT_TRAP) {
+                        kvm_rip_write(vcpu, ctxt->eip);
+                        if (r == EMULATE_DONE && ctxt->tf)
+                                kvm_vcpu_do_singlestep(vcpu, &r);
                        __kvm_set_rflags(vcpu, ctxt->eflags);
+                }
                /*
                 * For STI, interrupts are shadowed; so KVM_REQ_EVENT will
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index eaaed5bfc4a4..991549a1c5f3 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -390,8 +390,9 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
        emit_prologue(&prog, bpf_prog->aux->stack_depth,
                      bpf_prog_was_classic(bpf_prog));
+        addrs[0] = prog - temp;
-        for (i = 0; i < insn_cnt; i++, insn++) {
+        for (i = 1; i <= insn_cnt; i++, insn++) {
                const s32 imm32 = insn->imm;
                u32 dst_reg = insn->dst_reg;
                u32 src_reg = insn->src_reg;
@@ -1105,7 +1106,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
                extra_pass = true;
                goto skip_init_addrs;
        }
-        addrs = kmalloc_array(prog->len, sizeof(*addrs), GFP_KERNEL);
+        addrs = kmalloc_array(prog->len + 1, sizeof(*addrs), GFP_KERNEL);
        if (!addrs) {
                prog = orig_prog;
                goto out_addrs;
@@ -1115,7 +1116,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
         * Before first pass, make a rough estimation of addrs[]
         * each BPF instruction is translated to less than 64 bytes
         */
-        for (proglen = 0, i = 0; i < prog->len; i++) {
+        for (proglen = 0, i = 0; i <= prog->len; i++) {
                proglen += 64;
                addrs[i] = proglen;
        }
@@ -1180,7 +1181,7 @@ out_image:
        if (!image || !prog->is_func || extra_pass) {
                if (image)
-                        bpf_prog_fill_jited_linfo(prog, addrs);
+                        bpf_prog_fill_jited_linfo(prog, addrs + 1);
 out_addrs:
                kfree(addrs);
                kfree(jit_data);
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 5cb8a62e091c..7c3106093c75 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -511,6 +511,7 @@ void cpu_reset(void)
                                      "add      %2, %2, %7\n\t"
                                      "addi     %0, %0, -1\n\t"
                                      "bnez     %0, 1b\n\t"
+                                      "isync\n\t"
                                      /* Jump to identity mapping */
                                      "jx       %3\n"
                                      "2:\n\t"
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f78d3287dd82..0835f4d8d42e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1958,13 +1958,9 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
        rq = blk_mq_get_request(q, bio, &data);
        if (unlikely(!rq)) {
                rq_qos_cleanup(q, bio);
+                if (bio->bi_opf & REQ_NOWAIT)
-                cookie = BLK_QC_T_NONE;
-                if (bio->bi_opf & REQ_NOWAIT_INLINE)
-                        cookie = BLK_QC_T_EAGAIN;
-                else if (bio->bi_opf & REQ_NOWAIT)
                        bio_wouldblock_error(bio);
-                return cookie;
+                return BLK_QC_T_NONE;
        }
        trace_block_getrq(q, bio, bio->bi_opf);
@@ -2666,8 +2662,6 @@ void blk_mq_release(struct request_queue *q)
        struct blk_mq_hw_ctx *hctx, *next;
        int i;
-        cancel_delayed_work_sync(&q->requeue_work);
        queue_for_each_hw_ctx(q, hctx, i)
                WARN_ON_ONCE(hctx && list_empty(&hctx->hctx_list));
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 977c659dcd18..9bfa3ea4ed63 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -892,6 +892,9 @@ static void __blk_release_queue(struct work_struct *work)
        blk_free_queue_stats(q->stats);
+        if (queue_is_mq(q))
+                cancel_delayed_work_sync(&q->requeue_work);
        blk_exit_queue(q);
        blk_queue_free_zone_bitmaps(q);
diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig
index 2e2efa577437..8c37294f1d1e 100644
--- a/drivers/atm/Kconfig
+++ b/drivers/atm/Kconfig
@@ -200,7 +200,7 @@ config ATM_NICSTAR_USE_SUNI
          make the card work).
 config ATM_NICSTAR_USE_IDT77105
-        bool "Use IDT77015 PHY driver (25Mbps)"
+        bool "Use IDT77105 PHY driver (25Mbps)"
        depends on ATM_NICSTAR
        help
          Support for the PHYsical layer chip in ForeRunner LE25 cards. In
diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
index dd61fdd400f0..68489d1f00bb 100644
--- a/drivers/auxdisplay/Kconfig
+++ b/drivers/auxdisplay/Kconfig
@@ -448,6 +448,11 @@ config PANEL_BOOT_MESSAGE
 choice
        prompt "Backlight initial state"
        default CHARLCD_BL_FLASH
+        ---help---
+          Select the initial backlight state on boot or module load.
+          Previously, there was no option for this: the backlight flashed
+          briefly on init. Now you can also turn it off/on.
        config CHARLCD_BL_OFF
                bool "Off"
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index 92745efefb54..bef6b85778b6 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -20,7 +20,7 @@
 #include <generated/utsrelease.h>
-#include <misc/charlcd.h>
+#include "charlcd.h"
 #define LCD_MINOR               156
diff --git a/include/misc/charlcd.h b/drivers/auxdisplay/charlcd.h
index 8cf6c18b0adb..00911ad0f3de 100644
--- a/include/misc/charlcd.h
+++ b/drivers/auxdisplay/charlcd.h
@@ -6,6 +6,9 @@
 * Copyright (C) 2016-2017 Glider bvba
 */
+#ifndef _CHARLCD_H
+#define _CHARLCD_H
 struct charlcd {
        const struct charlcd_ops *ops;
        const unsigned char *char_conv; /* Optional */
@@ -37,3 +40,5 @@ int charlcd_register(struct charlcd *lcd);
 int charlcd_unregister(struct charlcd *lcd);
 void charlcd_poke(struct charlcd *lcd);
+#endif /* CHARLCD_H */
diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c
index ab15b64707ad..bcbe13092327 100644
--- a/drivers/auxdisplay/hd44780.c
+++ b/drivers/auxdisplay/hd44780.c
@@ -14,8 +14,7 @@
 #include <linux/property.h>
 #include <linux/slab.h>
-#include <misc/charlcd.h>
+#include "charlcd.h"
 enum hd44780_pin {
        /* Order does matter due to writing to GPIO array subsets! */
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index 9c0bb771751d..a2fcde582e2a 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -74,7 +74,7 @@ struct ht16k33_priv {
        struct ht16k33_fbdev fbdev;
 };
-static struct fb_fix_screeninfo ht16k33_fb_fix = {
+static const struct fb_fix_screeninfo ht16k33_fb_fix = {
        .id             = DRIVER_NAME,
        .type           = FB_TYPE_PACKED_PIXELS,
        .visual         = FB_VISUAL_MONO10,
@@ -85,7 +85,7 @@ static struct fb_fix_screeninfo ht16k33_fb_fix = {
        .accel          = FB_ACCEL_NONE,
 };
-static struct fb_var_screeninfo ht16k33_fb_var = {
+static const struct fb_var_screeninfo ht16k33_fb_var = {
        .xres = HT16K33_MATRIX_LED_MAX_ROWS,
        .yres = HT16K33_MATRIX_LED_MAX_COLS,
        .xres_virtual = HT16K33_MATRIX_LED_MAX_ROWS,
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index e06de63497cf..85965953683e 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -55,7 +55,7 @@
 #include <linux/io.h>
 #include <linux/uaccess.h>
-#include <misc/charlcd.h>
+#include "charlcd.h"
 #define KEYPAD_MINOR            185
@@ -1617,6 +1617,8 @@ static void panel_attach(struct parport *port)
        return;
 err_lcd_unreg:
+        if (scan_timer.function)
+                del_timer_sync(&scan_timer);
        if (lcd.enabled)
                charlcd_unregister(lcd.charlcd);
 err_unreg_device:
diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
index a4984136c19d..0fd6f97ee523 100644
--- a/drivers/base/regmap/Kconfig
+++ b/drivers/base/regmap/Kconfig
@@ -44,7 +44,7 @@ config REGMAP_IRQ
 config REGMAP_SOUNDWIRE
        tristate
-        depends on SOUNDWIRE_BUS
+        depends on SOUNDWIRE
 config REGMAP_SCCB
        tristate
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 9bd4ddd12b25..5b248763a672 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -322,6 +322,8 @@ static int drbd_thread_setup(void *arg)
                 thi->name[0],
                 resource->name);
+        allow_kernel_signal(DRBD_SIGKILL);
+        allow_kernel_signal(SIGXCPU);
 restart:
        retval = thi->function(thi);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3327192bb71f..c8fb886aebd4 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3038,6 +3038,17 @@ again:
                }
                return true;
        case RBD_OBJ_READ_PARENT:
+                /*
+                 * The parent image is read only up to the overlap -- zero-fill
+                 * from the overlap to the end of the request.
+                 */
+                if (!*result) {
+                        u32 obj_overlap = rbd_obj_img_extents_bytes(obj_req);
+                        if (obj_overlap < obj_req->ex.oe_len)
+                                rbd_obj_zero_range(obj_req, obj_overlap,
+                                            obj_req->ex.oe_len - obj_overlap);
+                }
                return true;
        default:
                BUG();
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 3ac6a5d18071..b90dbcd99c03 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -965,6 +965,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
                }
        }
+        err = -ENOMEM;
        for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
                req = kzalloc(sizeof(*req), GFP_KERNEL);
                if (!req)
@@ -987,7 +988,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
        err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
        if (err) {
                xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
-                return err;
+                goto fail;
        }
        return 0;
@@ -1007,8 +1008,7 @@ fail:
                }
                kfree(req);
        }
-        return -ENOMEM;
+        return err;
 }
 static int connect_ring(struct backend_info *be)
diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 8b33128dccee..0875470a7806 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -99,6 +99,27 @@ static int qca_send_reset(struct hci_dev *hdev)
        return 0;
 }
+int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
+{
+        struct sk_buff *skb;
+        int err;
+        bt_dev_dbg(hdev, "QCA pre shutdown cmd");
+        skb = __hci_cmd_sync(hdev, QCA_PRE_SHUTDOWN_CMD, 0,
+                                NULL, HCI_INIT_TIMEOUT);
+        if (IS_ERR(skb)) {
+                err = PTR_ERR(skb);
+                bt_dev_err(hdev, "QCA preshutdown_cmd failed (%d)", err);
+                return err;
+        }
+        kfree_skb(skb);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);
 static void qca_tlv_check_data(struct rome_config *config,
                                const struct firmware *fw)
 {
@@ -119,6 +140,7 @@ static void qca_tlv_check_data(struct rome_config *config,
        BT_DBG("Length\t\t : %d bytes", length);
        config->dnld_mode = ROME_SKIP_EVT_NONE;
+        config->dnld_type = ROME_SKIP_EVT_NONE;
        switch (config->type) {
        case TLV_TYPE_PATCH:
@@ -268,7 +290,7 @@ static int qca_inject_cmd_complete_event(struct hci_dev *hdev)
        evt = skb_put(skb, sizeof(*evt));
        evt->ncmd = 1;
-        evt->opcode = QCA_HCI_CC_OPCODE;
+        evt->opcode = cpu_to_le16(QCA_HCI_CC_OPCODE);
        skb_put_u8(skb, QCA_HCI_CC_SUCCESS);
@@ -323,7 +345,7 @@ static int qca_download_firmware(struct hci_dev *hdev,
         */
        if (config->dnld_type == ROME_SKIP_EVT_VSE_CC ||
            config->dnld_type == ROME_SKIP_EVT_VSE)
-                return qca_inject_cmd_complete_event(hdev);
+                ret = qca_inject_cmd_complete_event(hdev);
 out:
        release_firmware(fw);
@@ -388,6 +410,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
                return err;
        }
+        /* Give the controller some time to get ready to receive the NVM */
+        msleep(10);
        /* Download NVM configuration */
        config.type = TLV_TYPE_NVM;
        if (firmware_name)
diff --git a/drivers/bluetooth/btqca.h b/drivers/bluetooth/btqca.h
index 6a291a7a5d96..69c5315a65fd 100644
--- a/drivers/bluetooth/btqca.h
+++ b/drivers/bluetooth/btqca.h
@@ -13,6 +13,7 @@
 #define EDL_PATCH_TLV_REQ_CMD           (0x1E)
 #define EDL_NVM_ACCESS_SET_REQ_CMD      (0x01)
 #define MAX_SIZE_PER_TLV_SEGMENT        (243)
+#define QCA_PRE_SHUTDOWN_CMD            (0xFC08)
 #define EDL_CMD_REQ_RES_EVT             (0x00)
 #define EDL_PATCH_VER_RES_EVT           (0x19)
@@ -135,6 +136,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
                   const char *firmware_name);
 int qca_read_soc_version(struct hci_dev *hdev, u32 *soc_version);
 int qca_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr);
+int qca_send_pre_shutdown_cmd(struct hci_dev *hdev);
 static inline bool qca_is_wcn399x(enum qca_btsoc_type soc_type)
 {
        return soc_type == QCA_WCN3990 || soc_type == QCA_WCN3998;
@@ -167,4 +169,9 @@ static inline bool qca_is_wcn399x(enum qca_btsoc_type soc_type)
 {
        return false;
 }
+static inline int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
+{
+        return -EOPNOTSUPP;
+}
 #endif
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3876fee6ad13..5cf0734eb31b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2762,8 +2762,10 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
        fw_size = fw->size;
        /* The size of patch header is 30 bytes, should be skip */
-        if (fw_size < 30)
+        if (fw_size < 30) {
+                err = -EINVAL;
                goto err_release_fw;
+        }
        fw_size -= 30;
        fw_ptr += 30;
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 82a0a3691a63..9a970fd1975a 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -705,7 +705,7 @@ static void device_want_to_sleep(struct hci_uart *hu)
        unsigned long flags;
        struct qca_data *qca = hu->priv;
-        BT_DBG("hu %p want to sleep", hu);
+        BT_DBG("hu %p want to sleep in %d state", hu, qca->rx_ibs_state);
        spin_lock_irqsave(&qca->hci_ibs_lock, flags);
@@ -720,7 +720,7 @@ static void device_want_to_sleep(struct hci_uart *hu)
                break;
        case HCI_IBS_RX_ASLEEP:
-                /* Fall through */
+                break;
        default:
                /* Any other state is illegal */
@@ -912,7 +912,7 @@ static int qca_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
                if (hdr->evt == HCI_EV_VENDOR)
                        complete(&qca->drop_ev_comp);
-                kfree(skb);
+                kfree_skb(skb);
                return 0;
        }
@@ -1386,6 +1386,9 @@ static int qca_power_off(struct hci_dev *hdev)
 {
        struct hci_uart *hu = hci_get_drvdata(hdev);
+        /* Perform pre shutdown command */
+        qca_send_pre_shutdown_cmd(hdev);
        qca_power_shutdown(hu);
        return 0;
 }
diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
index 19d7b6ff2f17..20c957185af2 100644
--- a/drivers/bus/hisi_lpc.c
+++ b/drivers/bus/hisi_lpc.c
@@ -456,6 +456,17 @@ struct hisi_lpc_acpi_cell {
        size_t pdata_size;
 };
+static void hisi_lpc_acpi_remove(struct device *hostdev)
+{
+        struct acpi_device *adev = ACPI_COMPANION(hostdev);
+        struct acpi_device *child;
+        device_for_each_child(hostdev, NULL, hisi_lpc_acpi_remove_subdev);
+        list_for_each_entry(child, &adev->children, node)
+                acpi_device_clear_enumerated(child);
+}
 /*
 * hisi_lpc_acpi_probe - probe children for ACPI FW
 * @hostdev: LPC host device pointer
@@ -555,8 +566,7 @@ static int hisi_lpc_acpi_probe(struct device *hostdev)
        return 0;
 fail:
-        device_for_each_child(hostdev, NULL,
+        hisi_lpc_acpi_remove(hostdev);
-                              hisi_lpc_acpi_remove_subdev);
        return ret;
 }
@@ -569,6 +579,10 @@ static int hisi_lpc_acpi_probe(struct device *dev)
 {
        return -ENODEV;
 }
+static void hisi_lpc_acpi_remove(struct device *hostdev)
+{
+}
 #endif // CONFIG_ACPI
 /*
@@ -606,24 +620,27 @@ static int hisi_lpc_probe(struct platform_device *pdev)
        range->fwnode = dev->fwnode;
        range->flags = LOGIC_PIO_INDIRECT;
        range->size = PIO_INDIRECT_SIZE;
+        range->hostdata = lpcdev;
+        range->ops = &hisi_lpc_ops;
+        lpcdev->io_host = range;
        ret = logic_pio_register_range(range);
        if (ret) {
                dev_err(dev, "register IO range failed (%d)!\n", ret);
                return ret;
        }
-        lpcdev->io_host = range;
        /* register the LPC host PIO resources */
        if (acpi_device)
                ret = hisi_lpc_acpi_probe(dev);
        else
                ret = of_platform_populate(dev->of_node, NULL, NULL, dev);
-        if (ret)
+        if (ret) {
+                logic_pio_unregister_range(range);
                return ret;
+        }
-        lpcdev->io_host->hostdata = lpcdev;
+        dev_set_drvdata(dev, lpcdev);
-        lpcdev->io_host->ops = &hisi_lpc_ops;
        io_end = lpcdev->io_host->io_start + lpcdev->io_host->size;
        dev_info(dev, "registered range [%pa - %pa]\n",
@@ -632,6 +649,23 @@ static int hisi_lpc_probe(struct platform_device *pdev)
        return ret;
 }
+static int hisi_lpc_remove(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct acpi_device *acpi_device = ACPI_COMPANION(dev);
+        struct hisi_lpc_dev *lpcdev = dev_get_drvdata(dev);
+        struct logic_pio_hwaddr *range = lpcdev->io_host;
+        if (acpi_device)
+                hisi_lpc_acpi_remove(dev);
+        else
+                of_platform_depopulate(dev);
+        logic_pio_unregister_range(range);
+        return 0;
+}
 static const struct of_device_id hisi_lpc_of_match[] = {
        { .compatible = "hisilicon,hip06-lpc", },
        { .compatible = "hisilicon,hip07-lpc", },
@@ -645,5 +679,6 @@ static struct platform_driver hisi_lpc_driver = {
                .acpi_match_table = ACPI_PTR(hisi_lpc_acpi_match),
        },
        .probe = hisi_lpc_probe,
+        .remove = hisi_lpc_remove,
 };
 builtin_platform_driver(hisi_lpc_driver);
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index e6deabd8305d..2db474ab4c6b 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -949,7 +949,7 @@ static int sysc_best_idle_mode(u32 idlemodes, u32 *best_mode)
                *best_mode = SYSC_IDLE_SMART_WKUP;
        else if (idlemodes & BIT(SYSC_IDLE_SMART))
                *best_mode = SYSC_IDLE_SMART;
-        else if (idlemodes & SYSC_IDLE_FORCE)
+        else if (idlemodes & BIT(SYSC_IDLE_FORCE))
                *best_mode = SYSC_IDLE_FORCE;
        else
                return -EINVAL;
@@ -1267,7 +1267,8 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
        SYSC_QUIRK("control", 0, 0, 0x10, -1, 0x40000900, 0xffffffff, 0),
        SYSC_QUIRK("cpgmac", 0, 0x1200, 0x1208, 0x1204, 0x4edb1902,
                   0xffff00f0, 0),
-        SYSC_QUIRK("dcan", 0, 0, -1, -1, 0xffffffff, 0xffffffff, 0),
+        SYSC_QUIRK("dcan", 0, 0x20, -1, -1, 0xa3170504, 0xffffffff, 0),
+        SYSC_QUIRK("dcan", 0, 0x20, -1, -1, 0x4edb1902, 0xffffffff, 0),
        SYSC_QUIRK("dmic", 0, 0, 0x10, -1, 0x50010000, 0xffffffff, 0),
        SYSC_QUIRK("dwc3", 0, 0, 0x10, -1, 0x500a0200, 0xffffffff, 0),
        SYSC_QUIRK("epwmss", 0, 0, 0x4, -1, 0x47400001, 0xffffffff, 0),
@@ -1692,10 +1693,7 @@ static int sysc_init_sysc_mask(struct sysc *ddata)
        if (error)
                return 0;
-        if (val)
+        ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
-                ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
-        else
-                ddata->cfg.sysc_val = ddata->cap->sysc_mask;
        return 0;
 }
@@ -2385,27 +2383,27 @@ static int sysc_probe(struct platform_device *pdev)
        error = sysc_init_dts_quirks(ddata);
        if (error)
-                goto unprepare;
+                return error;
        error = sysc_map_and_check_registers(ddata);
        if (error)
-                goto unprepare;
+                return error;
        error = sysc_init_sysc_mask(ddata);
        if (error)
-                goto unprepare;
+                return error;
        error = sysc_init_idlemodes(ddata);
        if (error)
-                goto unprepare;
+                return error;
        error = sysc_init_syss_mask(ddata);
        if (error)
-                goto unprepare;
+                return error;
        error = sysc_init_pdata(ddata);
        if (error)
-                goto unprepare;
+                return error;
        sysc_init_early_quirks(ddata);
@@ -2415,7 +2413,7 @@ static int sysc_probe(struct platform_device *pdev)
        error = sysc_init_resets(ddata);
        if (error)
-                return error;
+                goto unprepare;
        error = sysc_init_module(ddata);
        if (error)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index c0990703ce54..1c46babeb093 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -324,6 +324,25 @@ static struct clk_core *clk_core_lookup(const char *name)
        return NULL;
 }
+#ifdef CONFIG_OF
+static int of_parse_clkspec(const struct device_node *np, int index,
+                            const char *name, struct of_phandle_args *out_args);
+static struct clk_hw *
+of_clk_get_hw_from_clkspec(struct of_phandle_args *clkspec);
+#else
+static inline int of_parse_clkspec(const struct device_node *np, int index,
+                                   const char *name,
+                                   struct of_phandle_args *out_args)
+{
+        return -ENOENT;
+}
+static inline struct clk_hw *
+of_clk_get_hw_from_clkspec(struct of_phandle_args *clkspec)
+{
+        return ERR_PTR(-ENOENT);
+}
+#endif
 /**
 * clk_core_get - Find the clk_core parent of a clk
 * @core: clk to find parent of
@@ -355,8 +374,9 @@ static struct clk_core *clk_core_lookup(const char *name)
 *      };
 *
 * Returns: -ENOENT when the provider can't be found or the clk doesn't
- * exist in the provider. -EINVAL when the name can't be found. NULL when the
+ * exist in the provider or the name can't be found in the DT node or
- * provider knows about the clk but it isn't provided on this system.
+ * in a clkdev lookup. NULL when the provider knows about the clk but it
+ * isn't provided on this system.
 * A valid clk_core pointer when the clk can be found in the provider.
 */
 static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index)
@@ -367,17 +387,19 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index)
        struct device *dev = core->dev;
        const char *dev_id = dev ? dev_name(dev) : NULL;
        struct device_node *np = core->of_node;
+        struct of_phandle_args clkspec;
-        if (np && (name || index >= 0))
+        if (np && (name || index >= 0) &&
-                hw = of_clk_get_hw(np, index, name);
+            !of_parse_clkspec(np, index, name, &clkspec)) {
+                hw = of_clk_get_hw_from_clkspec(&clkspec);
-        /*
+                of_node_put(clkspec.np);
-         * If the DT search above couldn't find the provider or the provider
+        } else if (name) {
-         * didn't know about this clk, fallback to looking up via clkdev based
+                /*
-         * clk_lookups
+                 * If the DT search above couldn't find the provider fallback to
-         */
+                 * looking up via clkdev based clk_lookups.
-        if (PTR_ERR(hw) == -ENOENT && name)
+                 */
                hw = clk_find_hw(dev_id, name);
+        }
        if (IS_ERR(hw))
                return ERR_CAST(hw);
@@ -401,7 +423,7 @@ static void clk_core_fill_parent_index(struct clk_core *core, u8 index)
                        parent = ERR_PTR(-EPROBE_DEFER);
        } else {
                parent = clk_core_get(core, index);
-                if (IS_ERR(parent) && PTR_ERR(parent) == -ENOENT)
+                if (IS_ERR(parent) && PTR_ERR(parent) == -ENOENT && entry->name)
                        parent = clk_core_lookup(entry->name);
        }
@@ -1632,7 +1654,8 @@ static int clk_fetch_parent_index(struct clk_core *core,
                        break;
                /* Fallback to comparing globally unique names */
-                if (!strcmp(parent->name, core->parents[i].name))
+                if (core->parents[i].name &&
+                    !strcmp(parent->name, core->parents[i].name))
                        break;
        }
diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c
index 91db7894125d..65c82d922b05 100644
--- a/drivers/clk/samsung/clk-exynos5-subcmu.c
+++ b/drivers/clk/samsung/clk-exynos5-subcmu.c
@@ -14,7 +14,7 @@
 #include "clk-exynos5-subcmu.h"
 static struct samsung_clk_provider *ctx;
-static const struct exynos5_subcmu_info *cmu;
+static const struct exynos5_subcmu_info **cmu;
 static int nr_cmus;
 static void exynos5_subcmu_clk_save(void __iomem *base,
@@ -56,17 +56,17 @@ static void exynos5_subcmu_defer_gate(struct samsung_clk_provider *ctx,
 * when OF-core populates all device-tree nodes.
 */
 void exynos5_subcmus_init(struct samsung_clk_provider *_ctx, int _nr_cmus,
-                          const struct exynos5_subcmu_info *_cmu)
+                          const struct exynos5_subcmu_info **_cmu)
 {
        ctx = _ctx;
        cmu = _cmu;
        nr_cmus = _nr_cmus;
        for (; _nr_cmus--; _cmu++) {
-                exynos5_subcmu_defer_gate(ctx, _cmu->gate_clks,
+                exynos5_subcmu_defer_gate(ctx, (*_cmu)->gate_clks,
-                                          _cmu->nr_gate_clks);
+                                          (*_cmu)->nr_gate_clks);
-                exynos5_subcmu_clk_save(ctx->reg_base, _cmu->suspend_regs,
+                exynos5_subcmu_clk_save(ctx->reg_base, (*_cmu)->suspend_regs,
-                                        _cmu->nr_suspend_regs);
+                                        (*_cmu)->nr_suspend_regs);
        }
 }
@@ -163,9 +163,9 @@ static int __init exynos5_clk_probe(struct platform_device *pdev)
                if (of_property_read_string(np, "label", &name) < 0)
                        continue;
                for (i = 0; i < nr_cmus; i++)
-                        if (strcmp(cmu[i].pd_name, name) == 0)
+                        if (strcmp(cmu[i]->pd_name, name) == 0)
                                exynos5_clk_register_subcmu(&pdev->dev,
-                                                            &cmu[i], np);
+                                                            cmu[i], np);
        }
        return 0;
 }
diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.h b/drivers/clk/samsung/clk-exynos5-subcmu.h
index 755ee8aaa3de..9ae5356f25aa 100644
--- a/drivers/clk/samsung/clk-exynos5-subcmu.h
+++ b/drivers/clk/samsung/clk-exynos5-subcmu.h
@@ -21,6 +21,6 @@ struct exynos5_subcmu_info {
 };
 void exynos5_subcmus_init(struct samsung_clk_provider *ctx, int nr_cmus,
-                          const struct exynos5_subcmu_info *cmu);
+                          const struct exynos5_subcmu_info **cmu);
 #endif
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index f2b896881768..931c70a4da19 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -681,6 +681,10 @@ static const struct exynos5_subcmu_info exynos5250_disp_subcmu = {
        .pd_name        = "DISP1",
 };
+static const struct exynos5_subcmu_info *exynos5250_subcmus[] = {
+        &exynos5250_disp_subcmu,
+};
 static const struct samsung_pll_rate_table vpll_24mhz_tbl[] __initconst = {
        /* sorted in descending order */
        /* PLL_36XX_RATE(rate, m, p, s, k) */
@@ -843,7 +847,8 @@ static void __init exynos5250_clk_init(struct device_node *np)
        samsung_clk_sleep_init(reg_base, exynos5250_clk_regs,
                               ARRAY_SIZE(exynos5250_clk_regs));
-        exynos5_subcmus_init(ctx, 1, &exynos5250_disp_subcmu);
+        exynos5_subcmus_init(ctx, ARRAY_SIZE(exynos5250_subcmus),
+                             exynos5250_subcmus);
        samsung_clk_of_add_provider(np, ctx);
diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
index 01bca5a498b2..7670cc596c74 100644
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -534,8 +534,6 @@ static const struct samsung_gate_clock exynos5800_gate_clks[] __initconst = {
                                GATE_BUS_TOP, 24, 0, 0),
        GATE(CLK_ACLK432_SCALER, "aclk432_scaler", "mout_user_aclk432_scaler",
                                GATE_BUS_TOP, 27, CLK_IS_CRITICAL, 0),
-        GATE(CLK_MAU_EPLL, "mau_epll", "mout_user_mau_epll",
-                        SRC_MASK_TOP7, 20, CLK_SET_RATE_PARENT, 0),
 };
 static const struct samsung_mux_clock exynos5420_mux_clks[] __initconst = {
@@ -577,8 +575,13 @@ static const struct samsung_div_clock exynos5420_div_clks[] __initconst = {
 static const struct samsung_gate_clock exynos5420_gate_clks[] __initconst = {
        GATE(CLK_SECKEY, "seckey", "aclk66_psgen", GATE_BUS_PERIS1, 1, 0, 0),
+        /* Maudio Block */
        GATE(CLK_MAU_EPLL, "mau_epll", "mout_mau_epll_clk",
                        SRC_MASK_TOP7, 20, CLK_SET_RATE_PARENT, 0),
+        GATE(CLK_SCLK_MAUDIO0, "sclk_maudio0", "dout_maudio0",
+                GATE_TOP_SCLK_MAU, 0, CLK_SET_RATE_PARENT, 0),
+        GATE(CLK_SCLK_MAUPCM0, "sclk_maupcm0", "dout_maupcm0",
+                GATE_TOP_SCLK_MAU, 1, CLK_SET_RATE_PARENT, 0),
 };
 static const struct samsung_mux_clock exynos5x_mux_clks[] __initconst = {
@@ -890,9 +893,6 @@ static const struct samsung_div_clock exynos5x_div_clks[] __initconst = {
        /* GSCL Block */
        DIV(0, "dout_gscl_blk_333", "aclk333_432_gscl", DIV2_RATIO0, 6, 2),
-        /* MSCL Block */
-        DIV(0, "dout_mscl_blk", "aclk400_mscl", DIV2_RATIO0, 28, 2),
        /* PSGEN */
        DIV(0, "dout_gen_blk", "mout_user_aclk266", DIV2_RATIO0, 8, 1),
        DIV(0, "dout_jpg_blk", "aclk166", DIV2_RATIO0, 20, 1),
@@ -1017,12 +1017,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
        GATE(CLK_SCLK_DP1, "sclk_dp1", "dout_dp1",
                        GATE_TOP_SCLK_DISP1, 20, CLK_SET_RATE_PARENT, 0),
-        /* Maudio Block */
-        GATE(CLK_SCLK_MAUDIO0, "sclk_maudio0", "dout_maudio0",
-                GATE_TOP_SCLK_MAU, 0, CLK_SET_RATE_PARENT, 0),
-        GATE(CLK_SCLK_MAUPCM0, "sclk_maupcm0", "dout_maupcm0",
-                GATE_TOP_SCLK_MAU, 1, CLK_SET_RATE_PARENT, 0),
        /* FSYS Block */
        GATE(CLK_TSI, "tsi", "aclk200_fsys", GATE_BUS_FSYS0, 0, 0, 0),
        GATE(CLK_PDMA0, "pdma0", "aclk200_fsys", GATE_BUS_FSYS0, 1, 0, 0),
@@ -1162,17 +1156,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
        GATE(CLK_FIMC_LITE3, "fimc_lite3", "aclk333_432_gscl",
                        GATE_IP_GSCL1, 17, 0, 0),
-        /* MSCL Block */
-        GATE(CLK_MSCL0, "mscl0", "aclk400_mscl", GATE_IP_MSCL, 0, 0, 0),
-        GATE(CLK_MSCL1, "mscl1", "aclk400_mscl", GATE_IP_MSCL, 1, 0, 0),
-        GATE(CLK_MSCL2, "mscl2", "aclk400_mscl", GATE_IP_MSCL, 2, 0, 0),
-        GATE(CLK_SMMU_MSCL0, "smmu_mscl0", "dout_mscl_blk",
-                        GATE_IP_MSCL, 8, 0, 0),
-        GATE(CLK_SMMU_MSCL1, "smmu_mscl1", "dout_mscl_blk",
-                        GATE_IP_MSCL, 9, 0, 0),
-        GATE(CLK_SMMU_MSCL2, "smmu_mscl2", "dout_mscl_blk",
-                        GATE_IP_MSCL, 10, 0, 0),
        /* ISP */
        GATE(CLK_SCLK_UART_ISP, "sclk_uart_isp", "dout_uart_isp",
                        GATE_TOP_SCLK_ISP, 0, CLK_SET_RATE_PARENT, 0),
@@ -1281,32 +1264,103 @@ static struct exynos5_subcmu_reg_dump exynos5x_mfc_suspend_regs[] = {
        { DIV4_RATIO, 0, 0x3 },                 /* DIV dout_mfc_blk */
 };
-static const struct exynos5_subcmu_info exynos5x_subcmus[] = {
+static const struct samsung_gate_clock exynos5x_mscl_gate_clks[] __initconst = {
-        {
+        /* MSCL Block */
-                .div_clks       = exynos5x_disp_div_clks,
+        GATE(CLK_MSCL0, "mscl0", "aclk400_mscl", GATE_IP_MSCL, 0, 0, 0),
-                .nr_div_clks    = ARRAY_SIZE(exynos5x_disp_div_clks),
+        GATE(CLK_MSCL1, "mscl1", "aclk400_mscl", GATE_IP_MSCL, 1, 0, 0),
-                .gate_clks      = exynos5x_disp_gate_clks,
+        GATE(CLK_MSCL2, "mscl2", "aclk400_mscl", GATE_IP_MSCL, 2, 0, 0),
-                .nr_gate_clks   = ARRAY_SIZE(exynos5x_disp_gate_clks),
+        GATE(CLK_SMMU_MSCL0, "smmu_mscl0", "dout_mscl_blk",
-                .suspend_regs   = exynos5x_disp_suspend_regs,
+                        GATE_IP_MSCL, 8, 0, 0),
-                .nr_suspend_regs = ARRAY_SIZE(exynos5x_disp_suspend_regs),
+        GATE(CLK_SMMU_MSCL1, "smmu_mscl1", "dout_mscl_blk",
-                .pd_name        = "DISP",
+                        GATE_IP_MSCL, 9, 0, 0),
-        }, {
+        GATE(CLK_SMMU_MSCL2, "smmu_mscl2", "dout_mscl_blk",
-                .div_clks       = exynos5x_gsc_div_clks,
+                        GATE_IP_MSCL, 10, 0, 0),
-                .nr_div_clks    = ARRAY_SIZE(exynos5x_gsc_div_clks),
+};
-                .gate_clks      = exynos5x_gsc_gate_clks,
-                .nr_gate_clks   = ARRAY_SIZE(exynos5x_gsc_gate_clks),
+static const struct samsung_div_clock exynos5x_mscl_div_clks[] __initconst = {
-                .suspend_regs   = exynos5x_gsc_suspend_regs,
+        DIV(0, "dout_mscl_blk", "aclk400_mscl", DIV2_RATIO0, 28, 2),
-                .nr_suspend_regs = ARRAY_SIZE(exynos5x_gsc_suspend_regs),
+};
-                .pd_name        = "GSC",
-        }, {
+static struct exynos5_subcmu_reg_dump exynos5x_mscl_suspend_regs[] = {
-                .div_clks       = exynos5x_mfc_div_clks,
+        { GATE_IP_MSCL, 0xffffffff, 0xffffffff }, /* MSCL gates */
-                .nr_div_clks    = ARRAY_SIZE(exynos5x_mfc_div_clks),
+        { SRC_TOP3, 0, BIT(4) },                /* MUX mout_user_aclk400_mscl */
-                .gate_clks      = exynos5x_mfc_gate_clks,
+        { DIV2_RATIO0, 0, 0x30000000 },         /* DIV dout_mscl_blk */
-                .nr_gate_clks   = ARRAY_SIZE(exynos5x_mfc_gate_clks),
+};
-                .suspend_regs   = exynos5x_mfc_suspend_regs,
-                .nr_suspend_regs = ARRAY_SIZE(exynos5x_mfc_suspend_regs),
+static const struct samsung_gate_clock exynos5800_mau_gate_clks[] __initconst = {
-                .pd_name        = "MFC",
+        GATE(CLK_MAU_EPLL, "mau_epll", "mout_user_mau_epll",
-        },
+                        SRC_MASK_TOP7, 20, CLK_SET_RATE_PARENT, 0),
+        GATE(CLK_SCLK_MAUDIO0, "sclk_maudio0", "dout_maudio0",
+                GATE_TOP_SCLK_MAU, 0, CLK_SET_RATE_PARENT, 0),
+        GATE(CLK_SCLK_MAUPCM0, "sclk_maupcm0", "dout_maupcm0",
+                GATE_TOP_SCLK_MAU, 1, CLK_SET_RATE_PARENT, 0),
+};
+static struct exynos5_subcmu_reg_dump exynos5800_mau_suspend_regs[] = {
+        { SRC_TOP9, 0, BIT(8) },        /* MUX mout_user_mau_epll */
+};
+static const struct exynos5_subcmu_info exynos5x_disp_subcmu = {
+        .div_clks       = exynos5x_disp_div_clks,
+        .nr_div_clks    = ARRAY_SIZE(exynos5x_disp_div_clks),
+        .gate_clks      = exynos5x_disp_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5x_disp_gate_clks),
+        .suspend_regs   = exynos5x_disp_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5x_disp_suspend_regs),
+        .pd_name        = "DISP",
+};
+static const struct exynos5_subcmu_info exynos5x_gsc_subcmu = {
+        .div_clks       = exynos5x_gsc_div_clks,
+        .nr_div_clks    = ARRAY_SIZE(exynos5x_gsc_div_clks),
+        .gate_clks      = exynos5x_gsc_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5x_gsc_gate_clks),
+        .suspend_regs   = exynos5x_gsc_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5x_gsc_suspend_regs),
+        .pd_name        = "GSC",
+};
+static const struct exynos5_subcmu_info exynos5x_mfc_subcmu = {
+        .div_clks       = exynos5x_mfc_div_clks,
+        .nr_div_clks    = ARRAY_SIZE(exynos5x_mfc_div_clks),
+        .gate_clks      = exynos5x_mfc_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5x_mfc_gate_clks),
+        .suspend_regs   = exynos5x_mfc_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5x_mfc_suspend_regs),
+        .pd_name        = "MFC",
+};
+static const struct exynos5_subcmu_info exynos5x_mscl_subcmu = {
+        .div_clks       = exynos5x_mscl_div_clks,
+        .nr_div_clks    = ARRAY_SIZE(exynos5x_mscl_div_clks),
+        .gate_clks      = exynos5x_mscl_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5x_mscl_gate_clks),
+        .suspend_regs   = exynos5x_mscl_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5x_mscl_suspend_regs),
+        .pd_name        = "MSC",
+};
+static const struct exynos5_subcmu_info exynos5800_mau_subcmu = {
+        .gate_clks      = exynos5800_mau_gate_clks,
+        .nr_gate_clks   = ARRAY_SIZE(exynos5800_mau_gate_clks),
+        .suspend_regs   = exynos5800_mau_suspend_regs,
+        .nr_suspend_regs = ARRAY_SIZE(exynos5800_mau_suspend_regs),
+        .pd_name        = "MAU",
+};
+static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
+        &exynos5x_disp_subcmu,
+        &exynos5x_gsc_subcmu,
+        &exynos5x_mfc_subcmu,
+        &exynos5x_mscl_subcmu,
+};
+static const struct exynos5_subcmu_info *exynos5800_subcmus[] = {
+        &exynos5x_disp_subcmu,
+        &exynos5x_gsc_subcmu,
+        &exynos5x_mfc_subcmu,
+        &exynos5x_mscl_subcmu,
+        &exynos5800_mau_subcmu,
 };
 static const struct samsung_pll_rate_table exynos5420_pll2550x_24mhz_tbl[] __initconst = {
@@ -1539,11 +1593,17 @@ static void __init exynos5x_clk_init(struct device_node *np,
        samsung_clk_extended_sleep_init(reg_base,
                exynos5x_clk_regs, ARRAY_SIZE(exynos5x_clk_regs),
                exynos5420_set_clksrc, ARRAY_SIZE(exynos5420_set_clksrc));
-        if (soc == EXYNOS5800)
+        if (soc == EXYNOS5800) {
                samsung_clk_sleep_init(reg_base, exynos5800_clk_regs,
                                       ARRAY_SIZE(exynos5800_clk_regs));
-        exynos5_subcmus_init(ctx, ARRAY_SIZE(exynos5x_subcmus),
-                             exynos5x_subcmus);
+                exynos5_subcmus_init(ctx, ARRAY_SIZE(exynos5800_subcmus),
+                                     exynos5800_subcmus);
+        } else {
+                exynos5_subcmus_init(ctx, ARRAY_SIZE(exynos5x_subcmus),
+                                     exynos5x_subcmus);
+        }
        samsung_clk_of_add_provider(np, ctx);
 }
diff --git a/drivers/clk/socfpga/clk-periph-s10.c b/drivers/clk/socfpga/clk-periph-s10.c
index 5c50e723ecae..1a191eeeebba 100644
--- a/drivers/clk/socfpga/clk-periph-s10.c
+++ b/drivers/clk/socfpga/clk-periph-s10.c
@@ -38,7 +38,7 @@ static unsigned long clk_peri_cnt_clk_recalc_rate(struct clk_hw *hwclk,
        if (socfpgaclk->fixed_div) {
                div = socfpgaclk->fixed_div;
        } else {
-                if (!socfpgaclk->bypass_reg)
+                if (socfpgaclk->hw.reg)
                        div = ((readl(socfpgaclk->hw.reg) & 0x7ff) + 1);
        }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8dda62367816..c28ebf2810f1 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2528,7 +2528,7 @@ static int cpufreq_boost_set_sw(int state)
                }
                ret = dev_pm_qos_update_request(policy->max_freq_req, policy->max);
-                if (ret)
+                if (ret < 0)
                        break;
        }
diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index f79eede71c62..edefa669153f 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -540,6 +540,10 @@ int ccp_dev_suspend(struct sp_device *sp, pm_message_t state)
        unsigned long flags;
        unsigned int i;
+        /* If there's no device there's nothing to do */
+        if (!ccp)
+                return 0;
        spin_lock_irqsave(&ccp->cmd_lock, flags);
        ccp->suspending = 1;
@@ -564,6 +568,10 @@ int ccp_dev_resume(struct sp_device *sp)
        unsigned long flags;
        unsigned int i;
+        /* If there's no device there's nothing to do */
+        if (!ccp)
+                return 0;
        spin_lock_irqsave(&ccp->cmd_lock, flags);
        ccp->suspending = 0;
diff --git a/drivers/dma/dw-edma/dw-edma-core.h b/drivers/dma/dw-edma/dw-edma-core.h
index b6cc90cbc9dc..4e5f9f6e901b 100644
--- a/drivers/dma/dw-edma/dw-edma-core.h
+++ b/drivers/dma/dw-edma/dw-edma-core.h
@@ -50,7 +50,7 @@ struct dw_edma_burst {
 struct dw_edma_region {
        phys_addr_t                     paddr;
-        dma_addr_t                      vaddr;
+        void                            __iomem *vaddr;
        size_t                          sz;
 };
diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
index 4c96e1c948f2..dc85f55e1bb8 100644
--- a/drivers/dma/dw-edma/dw-edma-pcie.c
+++ b/drivers/dma/dw-edma/dw-edma-pcie.c
@@ -130,19 +130,19 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
        chip->id = pdev->devfn;
        chip->irq = pdev->irq;
-        dw->rg_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->rg_bar];
+        dw->rg_region.vaddr = pcim_iomap_table(pdev)[pdata->rg_bar];
        dw->rg_region.vaddr += pdata->rg_off;
        dw->rg_region.paddr = pdev->resource[pdata->rg_bar].start;
        dw->rg_region.paddr += pdata->rg_off;
        dw->rg_region.sz = pdata->rg_sz;
-        dw->ll_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->ll_bar];
+        dw->ll_region.vaddr = pcim_iomap_table(pdev)[pdata->ll_bar];
        dw->ll_region.vaddr += pdata->ll_off;
        dw->ll_region.paddr = pdev->resource[pdata->ll_bar].start;
        dw->ll_region.paddr += pdata->ll_off;
        dw->ll_region.sz = pdata->ll_sz;
-        dw->dt_region.vaddr = (dma_addr_t)pcim_iomap_table(pdev)[pdata->dt_bar];
+        dw->dt_region.vaddr = pcim_iomap_table(pdev)[pdata->dt_bar];
        dw->dt_region.vaddr += pdata->dt_off;
        dw->dt_region.paddr = pdev->resource[pdata->dt_bar].start;
        dw->dt_region.paddr += pdata->dt_off;
@@ -158,17 +158,17 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
        pci_dbg(pdev, "Mode:\t%s\n",
                dw->mode == EDMA_MODE_LEGACY ? "Legacy" : "Unroll");
-        pci_dbg(pdev, "Registers:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "Registers:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                pdata->rg_bar, pdata->rg_off, pdata->rg_sz,
-                &dw->rg_region.vaddr, &dw->rg_region.paddr);
+                dw->rg_region.vaddr, &dw->rg_region.paddr);
-        pci_dbg(pdev, "L. List:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "L. List:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                pdata->ll_bar, pdata->ll_off, pdata->ll_sz,
-                &dw->ll_region.vaddr, &dw->ll_region.paddr);
+                dw->ll_region.vaddr, &dw->ll_region.paddr);
-        pci_dbg(pdev, "Data:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%pa, p=%pa)\n",
+        pci_dbg(pdev, "Data:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
                pdata->dt_bar, pdata->dt_off, pdata->dt_sz,
-                &dw->dt_region.vaddr, &dw->dt_region.paddr);
+                dw->dt_region.vaddr, &dw->dt_region.paddr);
        pci_dbg(pdev, "Nr. IRQs:\t%u\n", dw->nr_irqs);
diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c
index 8a3180ed49a6..692de47b1670 100644
--- a/drivers/dma/dw-edma/dw-edma-v0-core.c
+++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
@@ -25,7 +25,7 @@ enum dw_edma_control {
 static inline struct dw_edma_v0_regs __iomem *__dw_regs(struct dw_edma *dw)
 {
-        return (struct dw_edma_v0_regs __iomem *)dw->rg_region.vaddr;
+        return dw->rg_region.vaddr;
 }
 #define SET(dw, name, value)                            \
@@ -192,13 +192,12 @@ u32 dw_edma_v0_core_status_abort_int(struct dw_edma *dw, enum dw_edma_dir dir)
 static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
 {
        struct dw_edma_burst *child;
-        struct dw_edma_v0_lli *lli;
+        struct dw_edma_v0_lli __iomem *lli;
-        struct dw_edma_v0_llp *llp;
+        struct dw_edma_v0_llp __iomem *llp;
        u32 control = 0, i = 0;
-        u64 sar, dar, addr;
        int j;
-        lli = (struct dw_edma_v0_lli *)chunk->ll_region.vaddr;
+        lli = chunk->ll_region.vaddr;
        if (chunk->cb)
                control = DW_EDMA_V0_CB;
@@ -214,17 +213,15 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
                /* Transfer size */
                SET_LL(&lli[i].transfer_size, child->sz);
                /* SAR - low, high */
-                sar = cpu_to_le64(child->sar);
+                SET_LL(&lli[i].sar_low, lower_32_bits(child->sar));
-                SET_LL(&lli[i].sar_low, lower_32_bits(sar));
+                SET_LL(&lli[i].sar_high, upper_32_bits(child->sar));
-                SET_LL(&lli[i].sar_high, upper_32_bits(sar));
                /* DAR - low, high */
-                dar = cpu_to_le64(child->dar);
+                SET_LL(&lli[i].dar_low, lower_32_bits(child->dar));
-                SET_LL(&lli[i].dar_low, lower_32_bits(dar));
+                SET_LL(&lli[i].dar_high, upper_32_bits(child->dar));
-                SET_LL(&lli[i].dar_high, upper_32_bits(dar));
                i++;
        }
-        llp = (struct dw_edma_v0_llp *)&lli[i];
+        llp = (void __iomem *)&lli[i];
        control = DW_EDMA_V0_LLP | DW_EDMA_V0_TCB;
        if (!chunk->cb)
                control |= DW_EDMA_V0_CB;
@@ -232,9 +229,8 @@ static void dw_edma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
        /* Channel control */
        SET_LL(&llp->control, control);
        /* Linked list  - low, high */
-        addr = cpu_to_le64(chunk->ll_region.paddr);
+        SET_LL(&llp->llp_low, lower_32_bits(chunk->ll_region.paddr));
-        SET_LL(&llp->llp_low, lower_32_bits(addr));
+        SET_LL(&llp->llp_high, upper_32_bits(chunk->ll_region.paddr));
-        SET_LL(&llp->llp_high, upper_32_bits(addr));
 }
 void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
@@ -242,7 +238,6 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
        struct dw_edma_chan *chan = chunk->chan;
        struct dw_edma *dw = chan->chip->dw;
        u32 tmp;
-        u64 llp;
        dw_edma_v0_core_write_chunk(chunk);
@@ -262,9 +257,10 @@ void dw_edma_v0_core_start(struct dw_edma_chunk *chunk, bool first)
                SET_CH(dw, chan->dir, chan->id, ch_control1,
                       (DW_EDMA_V0_CCS | DW_EDMA_V0_LLE));
                /* Linked list - low, high */
-                llp = cpu_to_le64(chunk->ll_region.paddr);
+                SET_CH(dw, chan->dir, chan->id, llp_low,
-                SET_CH(dw, chan->dir, chan->id, llp_low, lower_32_bits(llp));
+                       lower_32_bits(chunk->ll_region.paddr));
-                SET_CH(dw, chan->dir, chan->id, llp_high, upper_32_bits(llp));
+                SET_CH(dw, chan->dir, chan->id, llp_high,
+                       upper_32_bits(chunk->ll_region.paddr));
        }
        /* Doorbell */
        SET_RW(dw, chan->dir, doorbell,
diff --git a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
index 3226f528cc11..42739508c0d8 100644
--- a/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
+++ b/drivers/dma/dw-edma/dw-edma-v0-debugfs.c
@@ -14,7 +14,7 @@
 #include "dw-edma-core.h"
 #define REGS_ADDR(name) \
-        ((dma_addr_t *)&regs->name)
+        ((void __force *)&regs->name)
 #define REGISTER(name) \
        { #name, REGS_ADDR(name) }
@@ -40,36 +40,37 @@
 static struct dentry                            *base_dir;
 static struct dw_edma                           *dw;
-static struct dw_edma_v0_regs                   *regs;
+static struct dw_edma_v0_regs                   __iomem *regs;
 static struct {
-        void                                    *start;
+        void                                    __iomem *start;
-        void                                    *end;
+        void                                    __iomem *end;
 } lim[2][EDMA_V0_MAX_NR_CH];
 struct debugfs_entries {
-        char                                    name[24];
+        const char                              *name;
        dma_addr_t                              *reg;
 };
 static int dw_edma_debugfs_u32_get(void *data, u64 *val)
 {
+        void __iomem *reg = (void __force __iomem *)data;
        if (dw->mode == EDMA_MODE_LEGACY &&
-            data >= (void *)&regs->type.legacy.ch) {
+            reg >= (void __iomem *)&regs->type.legacy.ch) {
-                void *ptr = (void *)&regs->type.legacy.ch;
+                void __iomem *ptr = &regs->type.legacy.ch;
                u32 viewport_sel = 0;
                unsigned long flags;
                u16 ch;
                for (ch = 0; ch < dw->wr_ch_cnt; ch++)
-                        if (lim[0][ch].start >= data && data < lim[0][ch].end) {
+                        if (lim[0][ch].start >= reg && reg < lim[0][ch].end) {
-                                ptr += (data - lim[0][ch].start);
+                                ptr += (reg - lim[0][ch].start);
                                goto legacy_sel_wr;
                        }
                for (ch = 0; ch < dw->rd_ch_cnt; ch++)
-                        if (lim[1][ch].start >= data && data < lim[1][ch].end) {
+                        if (lim[1][ch].start >= reg && reg < lim[1][ch].end) {
-                                ptr += (data - lim[1][ch].start);
+                                ptr += (reg - lim[1][ch].start);
                                goto legacy_sel_rd;
                        }
@@ -86,7 +87,7 @@ legacy_sel_wr:
                raw_spin_unlock_irqrestore(&dw->lock, flags);
        } else {
-                *val = readl(data);
+                *val = readl(reg);
        }
        return 0;
@@ -105,7 +106,7 @@ static void dw_edma_debugfs_create_x32(const struct debugfs_entries entries[],
        }
 }
-static void dw_edma_debugfs_regs_ch(struct dw_edma_v0_ch_regs *regs,
+static void dw_edma_debugfs_regs_ch(struct dw_edma_v0_ch_regs __iomem *regs,
                                    struct dentry *dir)
 {
        int nr_entries;
@@ -288,7 +289,7 @@ void dw_edma_v0_debugfs_on(struct dw_edma_chip *chip)
        if (!dw)
                return;
-        regs = (struct dw_edma_v0_regs *)dw->rg_region.vaddr;
+        regs = dw->rg_region.vaddr;
        if (!regs)
                return;
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 23e0a356f167..ad72b3f42ffa 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1163,6 +1163,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
        switch (chan->feature & FSL_DMA_IP_MASK) {
        case FSL_DMA_IP_85XX:
                chan->toggle_ext_pause = fsl_chan_toggle_ext_pause;
+                /* Fall through */
        case FSL_DMA_IP_83XX:
                chan->toggle_ext_start = fsl_chan_toggle_ext_start;
                chan->set_src_loop_size = fsl_chan_set_src_loop_size;
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 89d710899010..de8bfd9a76e9 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -142,7 +142,7 @@ enum d40_events {
 * when the DMA hw is powered off.
 * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
 */
-static u32 d40_backup_regs[] = {
+static __maybe_unused u32 d40_backup_regs[] = {
        D40_DREG_LCPA,
        D40_DREG_LCLA,
        D40_DREG_PRMSE,
@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
 #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
-static u32 d40_backup_regs_chan[] = {
+static __maybe_unused u32 d40_backup_regs_chan[] = {
        D40_CHAN_REG_SSCFG,
        D40_CHAN_REG_SSELT,
        D40_CHAN_REG_SSPTR,
diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index d6e919d3936a..1311de74bfdd 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1366,7 +1366,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
        chan = &dmadev->chan[id];
        if (!chan) {
-                dev_err(chan2dev(chan), "MDMA channel not initialized\n");
+                dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n");
                goto exit;
        }
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 2805853e963f..b33cf6e8ab8e 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -712,7 +712,7 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
        return chan;
 }
-static int tegra_adma_runtime_suspend(struct device *dev)
+static int __maybe_unused tegra_adma_runtime_suspend(struct device *dev)
 {
        struct tegra_adma *tdma = dev_get_drvdata(dev);
        struct tegra_adma_chan_regs *ch_reg;
@@ -744,7 +744,7 @@ clk_disable:
        return 0;
 }
-static int tegra_adma_runtime_resume(struct device *dev)
+static int __maybe_unused tegra_adma_runtime_resume(struct device *dev)
 {
        struct tegra_adma *tdma = dev_get_drvdata(dev);
        struct tegra_adma_chan_regs *ch_reg;
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index ba2489d4ea24..ba27802efcd0 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1234,7 +1234,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
        if (src_icg) {
                d->ccr |= CCR_SRC_AMODE_DBLIDX;
                d->ei = 1;
-                d->fi = src_icg;
+                d->fi = src_icg + 1;
        } else if (xt->src_inc) {
                d->ccr |= CCR_SRC_AMODE_POSTINC;
                d->fi = 0;
@@ -1249,7 +1249,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
        if (dst_icg) {
                d->ccr |= CCR_DST_AMODE_DBLIDX;
                sg->ei = 1;
-                sg->fi = dst_icg;
+                sg->fi = dst_icg + 1;
        } else if (xt->dst_inc) {
                d->ccr |= CCR_DST_AMODE_POSTINC;
                sg->fi = 0;
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 1db780c0f07b..3caae7f2cf56 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -927,17 +927,33 @@ fail:
        return status;
 }
+#define GET_EFI_CONFIG_TABLE(bits)                                      \
+static void *get_efi_config_table##bits(efi_system_table_t *_sys_table, \
+                                        efi_guid_t guid)                \
+{                                                                       \
+        efi_system_table_##bits##_t *sys_table;                         \
+        efi_config_table_##bits##_t *tables;                            \
+        int i;                                                          \
+                                                                        \
+        sys_table = (typeof(sys_table))_sys_table;                      \
+        tables = (typeof(tables))(unsigned long)sys_table->tables;      \
+                                                                        \
+        for (i = 0; i < sys_table->nr_tables; i++) {                    \
+                if (efi_guidcmp(tables[i].guid, guid) != 0)             \
+                        continue;                                       \
+                                                                        \
+                return (void *)(unsigned long)tables[i].table;          \
+        }                                                               \
+                                                                        \
+        return NULL;                                                    \
+}
+GET_EFI_CONFIG_TABLE(32)
+GET_EFI_CONFIG_TABLE(64)
 void *get_efi_config_table(efi_system_table_t *sys_table, efi_guid_t guid)
 {
-        efi_config_table_t *tables = (efi_config_table_t *)sys_table->tables;
+        if (efi_is_64bit())
-        int i;
+                return get_efi_config_table64(sys_table, guid);
+        else
-        for (i = 0; i < sys_table->nr_tables; i++) {
+                return get_efi_config_table32(sys_table, guid);
-                if (efi_guidcmp(tables[i].guid, guid) != 0)
-                        continue;
-                return (void *)tables[i].table;
-        }
-        return NULL;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 567fb98c0892..9762dd6d99fa 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -363,7 +363,7 @@ struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
        /* Special handling for SPI GPIOs if used */
        if (IS_ERR(desc))
                desc = of_find_spi_gpio(dev, con_id, &of_flags);
-        if (IS_ERR(desc)) {
+        if (IS_ERR(desc) && PTR_ERR(desc) != -EPROBE_DEFER) {
                /* This quirk looks up flags and all */
                desc = of_find_spi_cs_gpio(dev, con_id, idx, flags);
                if (!IS_ERR(desc))
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index f497003f119c..cca749010cd0 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1091,9 +1091,11 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
                        lineinfo.flags |= GPIOLINE_FLAG_ACTIVE_LOW;
                if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
-                        lineinfo.flags |= GPIOLINE_FLAG_OPEN_DRAIN;
+                        lineinfo.flags |= (GPIOLINE_FLAG_OPEN_DRAIN |
+                                           GPIOLINE_FLAG_IS_OUT);
                if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
-                        lineinfo.flags |= GPIOLINE_FLAG_OPEN_SOURCE;
+                        lineinfo.flags |= (GPIOLINE_FLAG_OPEN_SOURCE |
+                                           GPIOLINE_FLAG_IS_OUT);
                if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
                        return -EFAULT;
@@ -1371,21 +1373,13 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        if (status)
                goto err_remove_from_list;
-        status = gpiochip_irqchip_init_valid_mask(chip);
-        if (status)
-                goto err_remove_from_list;
        status = gpiochip_alloc_valid_mask(chip);
        if (status)
-                goto err_remove_irqchip_mask;
+                goto err_remove_from_list;
-        status = gpiochip_add_irqchip(chip, lock_key, request_key);
-        if (status)
-                goto err_free_gpiochip_mask;
        status = of_gpiochip_add(chip);
        if (status)
-                goto err_remove_chip;
+                goto err_free_gpiochip_mask;
        status = gpiochip_init_valid_mask(chip);
        if (status)
@@ -1411,6 +1405,14 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        machine_gpiochip_add(chip);
+        status = gpiochip_irqchip_init_valid_mask(chip);
+        if (status)
+                goto err_remove_acpi_chip;
+        status = gpiochip_add_irqchip(chip, lock_key, request_key);
+        if (status)
+                goto err_remove_irqchip_mask;
        /*
         * By first adding the chardev, and then adding the device,
         * we get a device node entry in sysfs under
@@ -1422,21 +1424,21 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
        if (gpiolib_initialized) {
                status = gpiochip_setup_dev(gdev);
                if (status)
-                        goto err_remove_acpi_chip;
+                        goto err_remove_irqchip;
        }
        return 0;
+err_remove_irqchip:
+        gpiochip_irqchip_remove(chip);
+err_remove_irqchip_mask:
+        gpiochip_irqchip_free_valid_mask(chip);
 err_remove_acpi_chip:
        acpi_gpiochip_remove(chip);
 err_remove_of_chip:
        gpiochip_free_hogs(chip);
        of_gpiochip_remove(chip);
-err_remove_chip:
-        gpiochip_irqchip_remove(chip);
 err_free_gpiochip_mask:
        gpiochip_free_valid_mask(chip);
-err_remove_irqchip_mask:
-        gpiochip_irqchip_free_valid_mask(chip);
 err_remove_from_list:
        spin_lock_irqsave(&gpio_lock, flags);
        list_del(&gdev->list);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 9b384a94d2f3..3e35a8f2c5e5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -574,6 +574,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
        { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x699f, 0x1028, 0x0814, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0, 0, 0, 0, 0 },
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 4e4094f842e7..8b26c970a3cb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1143,6 +1143,9 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
        num_deps = chunk->length_dw * 4 /
                sizeof(struct drm_amdgpu_cs_chunk_sem);
+        if (p->post_deps)
+                return -EINVAL;
        p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
                                     GFP_KERNEL);
        p->num_post_deps = 0;
@@ -1166,8 +1169,7 @@ static int amdgpu_cs_process_syncobj_out_dep(struct amdgpu_cs_parser *p,
 static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p,
-                                                      struct amdgpu_cs_chunk
+                                                      struct amdgpu_cs_chunk *chunk)
-                                                      *chunk)
 {
        struct drm_amdgpu_cs_chunk_syncobj *syncobj_deps;
        unsigned num_deps;
@@ -1177,6 +1179,9 @@ static int amdgpu_cs_process_syncobj_timeline_out_dep(struct amdgpu_cs_parser *p
        num_deps = chunk->length_dw * 4 /
                sizeof(struct drm_amdgpu_cs_chunk_syncobj);
+        if (p->post_deps)
+                return -EINVAL;
        p->post_deps = kmalloc_array(num_deps, sizeof(*p->post_deps),
                                     GFP_KERNEL);
        p->num_post_deps = 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index f539a2a92774..7398b4850649 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -534,21 +534,24 @@ int amdgpu_ctx_wait_prev_fence(struct amdgpu_ctx *ctx,
                               struct drm_sched_entity *entity)
 {
        struct amdgpu_ctx_entity *centity = to_amdgpu_ctx_entity(entity);
-        unsigned idx = centity->sequence & (amdgpu_sched_jobs - 1);
+        struct dma_fence *other;
-        struct dma_fence *other = centity->fences[idx];
+        unsigned idx;
+        long r;
-        if (other) {
+        spin_lock(&ctx->ring_lock);
-                signed long r;
+        idx = centity->sequence & (amdgpu_sched_jobs - 1);
-                r = dma_fence_wait(other, true);
+        other = dma_fence_get(centity->fences[idx]);
-                if (r < 0) {
+        spin_unlock(&ctx->ring_lock);
-                        if (r != -ERESTARTSYS)
-                                DRM_ERROR("Error (%ld) waiting for fence!\n", r);
-                        return r;
+        if (!other)
-                }
+                return 0;
-        }
-        return 0;
+        r = dma_fence_wait(other, true);
+        if (r < 0 && r != -ERESTARTSYS)
+                DRM_ERROR("Error (%ld) waiting for fence!\n", r);
+        dma_fence_put(other);
+        return r;
 }
 void amdgpu_ctx_mgr_init(struct amdgpu_ctx_mgr *mgr)
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index 1cf639a51178..c066e1d3f981 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -596,14 +596,18 @@ static void gfx_v9_0_check_if_need_gfxoff(struct amdgpu_device *adev)
        case CHIP_VEGA20:
                break;
        case CHIP_RAVEN:
-                if (adev->rev_id >= 0x8 || adev->pdev->device == 0x15d8)
+                if (!(adev->rev_id >= 0x8 || adev->pdev->device == 0x15d8)
-                        break;
+                        &&((adev->gfx.rlc_fw_version != 106 &&
-                if ((adev->gfx.rlc_fw_version != 106 &&
+                             adev->gfx.rlc_fw_version < 531) ||
-                     adev->gfx.rlc_fw_version < 531) ||
+                            (adev->gfx.rlc_fw_version == 53815) ||
-                    (adev->gfx.rlc_fw_version == 53815) ||
+                            (adev->gfx.rlc_feature_version < 1) ||
-                    (adev->gfx.rlc_feature_version < 1) ||
+                            !adev->gfx.rlc.is_rlc_v2_1))
-                    !adev->gfx.rlc.is_rlc_v2_1)
                        adev->pm.pp_feature &= ~PP_GFXOFF_MASK;
+                if (adev->pm.pp_feature & PP_GFXOFF_MASK)
+                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_RLC_SMU_HS;
                break;
        default:
                break;
@@ -4869,7 +4873,7 @@ static void gfx_v9_0_ring_soft_recovery(struct amdgpu_ring *ring, unsigned vmid)
        value = REG_SET_FIELD(value, SQ_CMD, MODE, 0x01);
        value = REG_SET_FIELD(value, SQ_CMD, CHECK_VMID, 1);
        value = REG_SET_FIELD(value, SQ_CMD, VM_ID, vmid);
-        WREG32(mmSQ_CMD, value);
+        WREG32_SOC15(GC, 0, mmSQ_CMD, value);
 }
 static void gfx_v9_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
index 662612f89c70..9922bce3fd89 100644
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -552,7 +552,6 @@ static int nv_common_early_init(void *handle)
                        AMD_CG_SUPPORT_BIF_LS;
                adev->pg_flags = AMD_PG_SUPPORT_VCN |
                        AMD_PG_SUPPORT_VCN_DPG |
-                        AMD_PG_SUPPORT_MMHUB |
                        AMD_PG_SUPPORT_ATHUB;
                adev->external_rev_id = adev->rev_id + 0x1;
                break;
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 23265414d448..04fbf05d7176 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -992,11 +992,6 @@ static int soc15_common_early_init(void *handle)
                        adev->pg_flags = AMD_PG_SUPPORT_SDMA | AMD_PG_SUPPORT_VCN;
                }
-                if (adev->pm.pp_feature & PP_GFXOFF_MASK)
-                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
-                                AMD_PG_SUPPORT_CP |
-                                AMD_PG_SUPPORT_RLC_SMU_HS;
                break;
        default:
                /* FIXME: not supported yet */
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 4a29f72334d0..45be7a2132bb 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3131,13 +3131,25 @@ static enum dc_color_depth
 convert_color_depth_from_display_info(const struct drm_connector *connector,
                                      const struct drm_connector_state *state)
 {
-        uint32_t bpc = connector->display_info.bpc;
+        uint8_t bpc = (uint8_t)connector->display_info.bpc;
+        /* Assume 8 bpc by default if no bpc is specified. */
+        bpc = bpc ? bpc : 8;
        if (!state)
                state = connector->state;
        if (state) {
-                bpc = state->max_bpc;
+                /*
+                 * Cap display bpc based on the user requested value.
+                 *
+                 * The value for state->max_bpc may not correctly updated
+                 * depending on when the connector gets added to the state
+                 * or if this was called outside of atomic check, so it
+                 * can't be used directly.
+                 */
+                bpc = min(bpc, state->max_requested_bpc);
                /* Round down to the nearest even number. */
                bpc = bpc - (bpc & 1);
        }
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index fa20201eef3a..cbc480a33376 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -23,6 +23,7 @@
 */
 #include <linux/slab.h>
+#include <linux/mm.h>
 #include "dm_services.h"
@@ -1171,8 +1172,8 @@ bool dc_post_update_surfaces_to_stream(struct dc *dc)
 struct dc_state *dc_create_state(struct dc *dc)
 {
-        struct dc_state *context = kzalloc(sizeof(struct dc_state),
+        struct dc_state *context = kvzalloc(sizeof(struct dc_state),
-                                           GFP_KERNEL);
+                                            GFP_KERNEL);
        if (!context)
                return NULL;
@@ -1192,11 +1193,11 @@ struct dc_state *dc_create_state(struct dc *dc)
 struct dc_state *dc_copy_state(struct dc_state *src_ctx)
 {
        int i, j;
-        struct dc_state *new_ctx = kmemdup(src_ctx,
+        struct dc_state *new_ctx = kvmalloc(sizeof(struct dc_state), GFP_KERNEL);
-                        sizeof(struct dc_state), GFP_KERNEL);
        if (!new_ctx)
                return NULL;
+        memcpy(new_ctx, src_ctx, sizeof(struct dc_state));
        for (i = 0; i < MAX_PIPES; i++) {
                        struct pipe_ctx *cur_pipe = &new_ctx->res_ctx.pipe_ctx[i];
@@ -1230,7 +1231,7 @@ static void dc_state_free(struct kref *kref)
 {
        struct dc_state *context = container_of(kref, struct dc_state, refcount);
        dc_resource_state_destruct(context);
-        kfree(context);
+        kvfree(context);
 }
 void dc_release_state(struct dc_state *context)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index f27c6fbb192e..90c4e87ac5ad 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -2101,7 +2101,11 @@ static int vega20_get_gpu_power(struct pp_hwmgr *hwmgr,
        if (ret)
                return ret;
-        *query = metrics_table.CurrSocketPower << 8;
+        /* For the 40.46 release, they changed the value name */
+        if (hwmgr->smu_version == 0x282e00)
+                *query = metrics_table.AverageSocketPower << 8;
+        else
+                *query = metrics_table.CurrSocketPower << 8;
        return ret;
 }
@@ -2349,12 +2353,16 @@ static int vega20_force_dpm_highest(struct pp_hwmgr *hwmgr)
                data->dpm_table.soc_table.dpm_state.soft_max_level =
                data->dpm_table.soc_table.dpm_levels[soft_level].value;
-        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
+        ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload boot level to highest!",
                        return ret);
-        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
+        ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload dpm max level to highest!",
                        return ret);
@@ -2387,12 +2395,16 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr)
                data->dpm_table.soc_table.dpm_state.soft_max_level =
                data->dpm_table.soc_table.dpm_levels[soft_level].value;
-        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
+        ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload boot level to highest!",
                        return ret);
-        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
+        ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload dpm max level to highest!",
                        return ret);
@@ -2403,14 +2415,54 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr)
 static int vega20_unforce_dpm_levels(struct pp_hwmgr *hwmgr)
 {
+        struct vega20_hwmgr *data =
+                        (struct vega20_hwmgr *)(hwmgr->backend);
+        uint32_t soft_min_level, soft_max_level;
        int ret = 0;
-        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
+        /* gfxclk soft min/max settings */
+        soft_min_level =
+                vega20_find_lowest_dpm_level(&(data->dpm_table.gfx_table));
+        soft_max_level =
+                vega20_find_highest_dpm_level(&(data->dpm_table.gfx_table));
+        data->dpm_table.gfx_table.dpm_state.soft_min_level =
+                data->dpm_table.gfx_table.dpm_levels[soft_min_level].value;
+        data->dpm_table.gfx_table.dpm_state.soft_max_level =
+                data->dpm_table.gfx_table.dpm_levels[soft_max_level].value;
+        /* uclk soft min/max settings */
+        soft_min_level =
+                vega20_find_lowest_dpm_level(&(data->dpm_table.mem_table));
+        soft_max_level =
+                vega20_find_highest_dpm_level(&(data->dpm_table.mem_table));
+        data->dpm_table.mem_table.dpm_state.soft_min_level =
+                data->dpm_table.mem_table.dpm_levels[soft_min_level].value;
+        data->dpm_table.mem_table.dpm_state.soft_max_level =
+                data->dpm_table.mem_table.dpm_levels[soft_max_level].value;
+        /* socclk soft min/max settings */
+        soft_min_level =
+                vega20_find_lowest_dpm_level(&(data->dpm_table.soc_table));
+        soft_max_level =
+                vega20_find_highest_dpm_level(&(data->dpm_table.soc_table));
+        data->dpm_table.soc_table.dpm_state.soft_min_level =
+                data->dpm_table.soc_table.dpm_levels[soft_min_level].value;
+        data->dpm_table.soc_table.dpm_state.soft_max_level =
+                data->dpm_table.soc_table.dpm_levels[soft_max_level].value;
+        ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload DPM Bootup Levels!",
                        return ret);
-        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
+        ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK |
+                                                 FEATURE_DPM_UCLK_MASK |
+                                                 FEATURE_DPM_SOCCLK_MASK);
        PP_ASSERT_WITH_CODE(!ret,
                        "Failed to upload DPM Max Levels!",
                        return ret);
diff --git a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
index a0f52c86d8c7..a78b2e295895 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
@@ -907,8 +907,6 @@ struct smu_funcs
        ((smu)->funcs->register_irq_handler ? (smu)->funcs->register_irq_handler(smu) : 0)
 #define smu_set_azalia_d3_pme(smu) \
        ((smu)->funcs->set_azalia_d3_pme ? (smu)->funcs->set_azalia_d3_pme((smu)) : 0)
-#define smu_get_uclk_dpm_states(smu, clocks_in_khz, num_states) \
-        ((smu)->ppt_funcs->get_uclk_dpm_states ? (smu)->ppt_funcs->get_uclk_dpm_states((smu), (clocks_in_khz), (num_states)) : 0)
 #define smu_get_max_sustainable_clocks_by_dc(smu, max_clocks) \
        ((smu)->funcs->get_max_sustainable_clocks_by_dc ? (smu)->funcs->get_max_sustainable_clocks_by_dc((smu), (max_clocks)) : 0)
 #define smu_get_uclk_dpm_states(smu, clocks_in_khz, num_states) \
diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
index 5fde5cf65b42..53097961bf2b 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
@@ -326,7 +326,8 @@ static int smu_v11_0_setup_pptable(struct smu_context *smu)
        struct amdgpu_device *adev = smu->adev;
        const struct smc_firmware_header_v1_0 *hdr;
        int ret, index;
-        uint32_t size;
+        uint32_t size = 0;
+        uint16_t atom_table_size;
        uint8_t frev, crev;
        void *table;
        uint16_t version_major, version_minor;
@@ -354,10 +355,11 @@ static int smu_v11_0_setup_pptable(struct smu_context *smu)
                index = get_index_into_master_table(atom_master_list_of_data_tables_v2_1,
                                                    powerplayinfo);
-                ret = smu_get_atom_data_table(smu, index, (uint16_t *)&size, &frev, &crev,
+                ret = smu_get_atom_data_table(smu, index, &atom_table_size, &frev, &crev,
                                              (uint8_t **)&table);
                if (ret)
                        return ret;
+                size = atom_table_size;
        }
        if (!smu->smu_table.power_play_table)
diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
index dd6fd1c8bf24..6a14497257e4 100644
--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
@@ -3050,6 +3050,7 @@ static int vega20_get_fan_speed_percent(struct smu_context *smu,
 static int vega20_get_gpu_power(struct smu_context *smu, uint32_t *value)
 {
+        uint32_t smu_version;
        int ret = 0;
        SmuMetrics_t metrics;
@@ -3060,7 +3061,15 @@ static int vega20_get_gpu_power(struct smu_context *smu, uint32_t *value)
        if (ret)
                return ret;
-        *value = metrics.CurrSocketPower << 8;
+        ret = smu_get_smc_version(smu, NULL, &smu_version);
+        if (ret)
+                return ret;
+        /* For the 40.46 release, they changed the value name */
+        if (smu_version == 0x282e00)
+                *value = metrics.AverageSocketPower << 8;
+        else
+                *value = metrics.CurrSocketPower << 8;
        return 0;
 }
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_dev.c b/drivers/gpu/drm/arm/display/komeda/komeda_dev.c
index 5a118984de33..9d4d5075cc64 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_dev.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_dev.c
@@ -8,6 +8,7 @@
 #include <linux/iommu.h>
 #include <linux/of_device.h>
 #include <linux/of_graph.h>
+#include <linux/of_reserved_mem.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #ifdef CONFIG_DEBUG_FS
@@ -126,7 +127,7 @@ static int komeda_parse_pipe_dt(struct komeda_dev *mdev, struct device_node *np)
        pipe->of_output_port =
                of_graph_get_port_by_id(np, KOMEDA_OF_PORT_OUTPUT);
-        pipe->of_node = np;
+        pipe->of_node = of_node_get(np);
        return 0;
 }
@@ -143,6 +144,12 @@ static int komeda_parse_dt(struct device *dev, struct komeda_dev *mdev)
                return mdev->irq;
        }
+        /* Get the optional framebuffer memory resource */
+        ret = of_reserved_mem_device_init(dev);
+        if (ret && ret != -ENODEV)
+                return ret;
+        ret = 0;
        for_each_available_child_of_node(np, child) {
                if (of_node_cmp(child->name, "pipeline") == 0) {
                        ret = komeda_parse_pipe_dt(mdev, child);
@@ -289,6 +296,8 @@ void komeda_dev_destroy(struct komeda_dev *mdev)
        mdev->n_pipelines = 0;
+        of_reserved_mem_device_release(dev);
        if (funcs && funcs->cleanup)
                funcs->cleanup(mdev);
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.c b/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.c
index cd4d9f53ddef..c9a1edb9a000 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.c
@@ -35,6 +35,25 @@ komeda_get_format_caps(struct komeda_format_caps_table *table,
        return NULL;
 }
+u32 komeda_get_afbc_format_bpp(const struct drm_format_info *info, u64 modifier)
+{
+        u32 bpp;
+        switch (info->format) {
+        case DRM_FORMAT_YUV420_8BIT:
+                bpp = 12;
+                break;
+        case DRM_FORMAT_YUV420_10BIT:
+                bpp = 15;
+                break;
+        default:
+                bpp = info->cpp[0] * 8;
+                break;
+        }
+        return bpp;
+}
 /* Two assumptions
 * 1. RGB always has YTR
 * 2. Tiled RGB always has SC
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.h b/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.h
index 3631910d33b5..32273cf18f7c 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.h
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_format_caps.h
@@ -97,6 +97,9 @@ const struct komeda_format_caps *
 komeda_get_format_caps(struct komeda_format_caps_table *table,
                       u32 fourcc, u64 modifier);
+u32 komeda_get_afbc_format_bpp(const struct drm_format_info *info,
+                               u64 modifier);
 u32 *komeda_get_layer_fourcc_list(struct komeda_format_caps_table *table,
                                  u32 layer_type, u32 *n_fmts);
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
index 3b0a70ed6aa0..1b01a625f40e 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
@@ -43,7 +43,7 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
        struct drm_framebuffer *fb = &kfb->base;
        const struct drm_format_info *info = fb->format;
        struct drm_gem_object *obj;
-        u32 alignment_w = 0, alignment_h = 0, alignment_header, n_blocks;
+        u32 alignment_w = 0, alignment_h = 0, alignment_header, n_blocks, bpp;
        u64 min_size;
        obj = drm_gem_object_lookup(file, mode_cmd->handles[0]);
@@ -88,8 +88,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
        kfb->offset_payload = ALIGN(n_blocks * AFBC_HEADER_SIZE,
                                    alignment_header);
+        bpp = komeda_get_afbc_format_bpp(info, fb->modifier);
        kfb->afbc_size = kfb->offset_payload + n_blocks *
-                         ALIGN(info->cpp[0] * AFBC_SUPERBLK_PIXELS,
+                         ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
                               AFBC_SUPERBLK_ALIGNMENT);
        min_size = kfb->afbc_size + fb->offsets[0];
        if (min_size > obj->size) {
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_kms.c b/drivers/gpu/drm/arm/display/komeda/komeda_kms.c
index 419a8b0e5de8..69d9e26c60c8 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_kms.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_kms.c
@@ -14,6 +14,7 @@
 #include <drm/drm_gem_cma_helper.h>
 #include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_irq.h>
+#include <drm/drm_probe_helper.h>
 #include <drm/drm_vblank.h>
 #include "komeda_dev.h"
@@ -146,7 +147,6 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc,
        struct komeda_crtc_state *kcrtc_st = to_kcrtc_st(crtc_st);
        struct komeda_plane_state *kplane_st;
        struct drm_plane_state *plane_st;
-        struct drm_framebuffer *fb;
        struct drm_plane *plane;
        struct list_head zorder_list;
        int order = 0, err;
@@ -172,7 +172,6 @@ static int komeda_crtc_normalize_zpos(struct drm_crtc *crtc,
        list_for_each_entry(kplane_st, &zorder_list, zlist_node) {
                plane_st = &kplane_st->base;
-                fb = plane_st->fb;
                plane = plane_st->plane;
                plane_st->normalized_zpos = order++;
@@ -205,7 +204,7 @@ static int komeda_kms_check(struct drm_device *dev,
                            struct drm_atomic_state *state)
 {
        struct drm_crtc *crtc;
-        struct drm_crtc_state *old_crtc_st, *new_crtc_st;
+        struct drm_crtc_state *new_crtc_st;
        int i, err;
        err = drm_atomic_helper_check_modeset(dev, state);
@@ -216,7 +215,7 @@ static int komeda_kms_check(struct drm_device *dev,
         * so need to add all affected_planes (even unchanged) to
         * drm_atomic_state.
         */
-        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_st, new_crtc_st, i) {
+        for_each_new_crtc_in_state(state, crtc, new_crtc_st, i) {
                err = drm_atomic_add_affected_planes(state, crtc);
                if (err)
                        return err;
@@ -307,24 +306,33 @@ struct komeda_kms_dev *komeda_kms_attach(struct komeda_dev *mdev)
                               komeda_kms_irq_handler, IRQF_SHARED,
                               drm->driver->name, drm);
        if (err)
-                goto cleanup_mode_config;
+                goto free_component_binding;
        err = mdev->funcs->enable_irq(mdev);
        if (err)
-                goto cleanup_mode_config;
+                goto free_component_binding;
        drm->irq_enabled = true;
+        drm_kms_helper_poll_init(drm);
        err = drm_dev_register(drm, 0);
        if (err)
-                goto cleanup_mode_config;
+                goto free_interrupts;
        return kms;
-cleanup_mode_config:
+free_interrupts:
+        drm_kms_helper_poll_fini(drm);
        drm->irq_enabled = false;
+        mdev->funcs->disable_irq(mdev);
+free_component_binding:
+        component_unbind_all(mdev->dev, drm);
+cleanup_mode_config:
        drm_mode_config_cleanup(drm);
        komeda_kms_cleanup_private_objs(kms);
+        drm->dev_private = NULL;
+        drm_dev_put(drm);
 free_kms:
        kfree(kms);
        return ERR_PTR(err);
@@ -335,12 +343,14 @@ void komeda_kms_detach(struct komeda_kms_dev *kms)
        struct drm_device *drm = &kms->base;
        struct komeda_dev *mdev = drm->dev_private;
+        drm_dev_unregister(drm);
+        drm_kms_helper_poll_fini(drm);
+        drm_atomic_helper_shutdown(drm);
        drm->irq_enabled = false;
        mdev->funcs->disable_irq(mdev);
-        drm_dev_unregister(drm);
        component_unbind_all(mdev->dev, drm);
-        komeda_kms_cleanup_private_objs(kms);
        drm_mode_config_cleanup(drm);
+        komeda_kms_cleanup_private_objs(kms);
        drm->dev_private = NULL;
        drm_dev_put(drm);
 }
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.h b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.h
index a90bcbb3cb23..14b683164544 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.h
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline.h
@@ -480,6 +480,7 @@ void komeda_pipeline_dump_register(struct komeda_pipeline *pipe,
                                   struct seq_file *sf);
 /* component APIs */
+extern __printf(10, 11)
 struct komeda_component *
 komeda_component_add(struct komeda_pipeline *pipe,
                     size_t comp_sz, u32 id, u32 hw_id,
diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
index 617e1f7b8472..2851cac94d86 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
@@ -148,7 +148,7 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
        if (!kcrtc->master->wb_layer)
                return 0;
-        kwb_conn = kzalloc(sizeof(*wb_conn), GFP_KERNEL);
+        kwb_conn = kzalloc(sizeof(*kwb_conn), GFP_KERNEL);
        if (!kwb_conn)
                return -ENOMEM;
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index 4c7e31cb45ff..a5d1494a3dc4 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
        /* Enable extended register access */
-        ast_enable_mmio(dev);
        ast_open_key(ast);
+        ast_enable_mmio(dev);
        /* Find out whether P2A works or whether to use device-tree */
        ast_detect_config_mode(dev, &scu_rev);
@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
 {
        struct ast_private *ast = dev->dev_private;
+        /* enable standard VGA decode */
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
        ast_release_firmware(dev);
        kfree(ast->dp501_fw_addr);
        ast_mode_fini(dev);
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index ffccbef962a4..a1cb020e07e5 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -604,7 +604,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
                return -EINVAL;
        ast_open_key(ast);
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
        ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
        ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
index f7d421359d56..c1d1ac51d1c2 100644
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
 {
        struct ast_private *ast = dev->dev_private;
-        ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
+        ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
 }
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index 7925a176f900..1cb1fa74cfbc 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -1465,8 +1465,8 @@ static void ddi_dotclock_get(struct intel_crtc_state *pipe_config)
        else if (intel_crtc_has_dp_encoder(pipe_config))
                dotclock = intel_dotclock_calculate(pipe_config->port_clock,
                                                    &pipe_config->dp_m_n);
-        else if (pipe_config->has_hdmi_sink && pipe_config->pipe_bpp == 36)
+        else if (pipe_config->has_hdmi_sink && pipe_config->pipe_bpp > 24)
-                dotclock = pipe_config->port_clock * 2 / 3;
+                dotclock = pipe_config->port_clock * 24 / pipe_config->pipe_bpp;
        else
                dotclock = pipe_config->port_clock;
diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c
index 60652ebbdf61..18e4cba76720 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
@@ -539,7 +539,15 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
        intel_attach_force_audio_property(connector);
        intel_attach_broadcast_rgb_property(connector);
-        drm_connector_attach_max_bpc_property(connector, 6, 12);
+        /*
+         * Reuse the prop from the SST connector because we're
+         * not allowed to create new props after device registration.
+         */
+        connector->max_bpc_property =
+                intel_dp->attached_connector->base.max_bpc_property;
+        if (connector->max_bpc_property)
+                drm_connector_attach_max_bpc_property(connector, 6, 12);
        return connector;
diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c
index ffec807b8960..f413904a3e96 100644
--- a/drivers/gpu/drm/i915/display/intel_vdsc.c
+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c
@@ -541,7 +541,7 @@ static void intel_configure_pps_for_dsc_encoder(struct intel_encoder *encoder,
        pps_val |= DSC_PIC_HEIGHT(vdsc_cfg->pic_height) |
                DSC_PIC_WIDTH(vdsc_cfg->pic_width / num_vdsc_instances);
        DRM_INFO("PPS2 = 0x%08x\n", pps_val);
-        if (encoder->type == INTEL_OUTPUT_EDP) {
+        if (cpu_transcoder == TRANSCODER_EDP) {
                I915_WRITE(DSCA_PICTURE_PARAMETER_SET_2, pps_val);
                /*
                 * If 2 VDSC instances are needed, configure PPS for second
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 9f3fd7d96a69..75baff657e43 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -1528,9 +1528,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                        if (!intel_gvt_ggtt_validate_range(vgpu,
                                workload->wa_ctx.indirect_ctx.guest_gma,
                                workload->wa_ctx.indirect_ctx.size)) {
-                                kmem_cache_free(s->workloads, workload);
                                gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n",
                                    workload->wa_ctx.indirect_ctx.guest_gma);
+                                kmem_cache_free(s->workloads, workload);
                                return ERR_PTR(-EINVAL);
                        }
                }
@@ -1542,9 +1542,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
                        if (!intel_gvt_ggtt_validate_range(vgpu,
                                workload->wa_ctx.per_ctx.guest_gma,
                                CACHELINE_BYTES)) {
-                                kmem_cache_free(s->workloads, workload);
                                gvt_vgpu_err("invalid per_ctx at: 0x%lx\n",
                                        workload->wa_ctx.per_ctx.guest_gma);
+                                kmem_cache_free(s->workloads, workload);
                                return ERR_PTR(-EINVAL);
                        }
                }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f62e3397d936..bac1ee94f63f 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1598,6 +1598,12 @@ static int i915_driver_init_hw(struct drm_i915_private *dev_priv)
        pci_set_master(pdev);
+        /*
+         * We don't have a max segment size, so set it to the max so sg's
+         * debugging layer doesn't complain
+         */
+        dma_set_max_seg_size(&pdev->dev, UINT_MAX);
        /* overlay on gen2 is broken and can't address above 1G */
        if (IS_GEN(dev_priv, 2)) {
                ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(30));
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index 94d3992b599d..724627afdedc 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -101,6 +101,9 @@ static struct _balloon_info_ bl_info;
 static void vgt_deballoon_space(struct i915_ggtt *ggtt,
                                struct drm_mm_node *node)
 {
+        if (!drm_mm_node_allocated(node))
+                return;
        DRM_DEBUG_DRIVER("deballoon space: range [0x%llx - 0x%llx] %llu KiB.\n",
                         node->start,
                         node->start + node->size,
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 1d58f7ec5d84..f11979879e7b 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -829,7 +829,7 @@ struct intel_crtc_state {
        /*
         * Frequence the dpll for the port should run at. Differs from the
-         * adjusted dotclock e.g. for DP or 12bpc hdmi mode. This is also
+         * adjusted dotclock e.g. for DP or 10/12bpc hdmi mode. This is also
         * already multiplied by pixel_multiplier.
         */
        int port_clock;
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index 95fdbd0fbcac..945bc20f1d33 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -17,6 +17,7 @@
 #include <linux/of_address.h>
 #include <linux/of_platform.h>
 #include <linux/pm_runtime.h>
+#include <linux/dma-mapping.h>
 #include "mtk_drm_crtc.h"
 #include "mtk_drm_ddp.h"
@@ -213,6 +214,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
        struct mtk_drm_private *private = drm->dev_private;
        struct platform_device *pdev;
        struct device_node *np;
+        struct device *dma_dev;
        int ret;
        if (!iommu_present(&platform_bus_type))
@@ -275,7 +277,29 @@ static int mtk_drm_kms_init(struct drm_device *drm)
                goto err_component_unbind;
        }
-        private->dma_dev = &pdev->dev;
+        dma_dev = &pdev->dev;
+        private->dma_dev = dma_dev;
+        /*
+         * Configure the DMA segment size to make sure we get contiguous IOVA
+         * when importing PRIME buffers.
+         */
+        if (!dma_dev->dma_parms) {
+                private->dma_parms_allocated = true;
+                dma_dev->dma_parms =
+                        devm_kzalloc(drm->dev, sizeof(*dma_dev->dma_parms),
+                                     GFP_KERNEL);
+        }
+        if (!dma_dev->dma_parms) {
+                ret = -ENOMEM;
+                goto err_component_unbind;
+        }
+        ret = dma_set_max_seg_size(dma_dev, (unsigned int)DMA_BIT_MASK(32));
+        if (ret) {
+                dev_err(dma_dev, "Failed to set DMA segment size\n");
+                goto err_unset_dma_parms;
+        }
        /*
         * We don't use the drm_irq_install() helpers provided by the DRM
@@ -285,13 +309,16 @@ static int mtk_drm_kms_init(struct drm_device *drm)
        drm->irq_enabled = true;
        ret = drm_vblank_init(drm, MAX_CRTC);
        if (ret < 0)
-                goto err_component_unbind;
+                goto err_unset_dma_parms;
        drm_kms_helper_poll_init(drm);
        drm_mode_config_reset(drm);
        return 0;
+err_unset_dma_parms:
+        if (private->dma_parms_allocated)
+                dma_dev->dma_parms = NULL;
 err_component_unbind:
        component_unbind_all(drm->dev, drm);
 err_config_cleanup:
@@ -302,9 +329,14 @@ err_config_cleanup:
 static void mtk_drm_kms_deinit(struct drm_device *drm)
 {
+        struct mtk_drm_private *private = drm->dev_private;
        drm_kms_helper_poll_fini(drm);
        drm_atomic_helper_shutdown(drm);
+        if (private->dma_parms_allocated)
+                private->dma_dev->dma_parms = NULL;
        component_unbind_all(drm->dev, drm);
        drm_mode_config_cleanup(drm);
 }
@@ -320,6 +352,18 @@ static const struct file_operations mtk_drm_fops = {
        .compat_ioctl = drm_compat_ioctl,
 };
+/*
+ * We need to override this because the device used to import the memory is
+ * not dev->dev, as drm_gem_prime_import() expects.
+ */
+struct drm_gem_object *mtk_drm_gem_prime_import(struct drm_device *dev,
+                                                struct dma_buf *dma_buf)
+{
+        struct mtk_drm_private *private = dev->dev_private;
+        return drm_gem_prime_import_dev(dev, dma_buf, private->dma_dev);
+}
 static struct drm_driver mtk_drm_driver = {
        .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME |
                           DRIVER_ATOMIC,
@@ -331,7 +375,7 @@ static struct drm_driver mtk_drm_driver = {
        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
        .gem_prime_export = drm_gem_prime_export,
-        .gem_prime_import = drm_gem_prime_import,
+        .gem_prime_import = mtk_drm_gem_prime_import,
        .gem_prime_get_sg_table = mtk_gem_prime_get_sg_table,
        .gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
        .gem_prime_mmap = mtk_drm_gem_mmap_buf,
@@ -524,12 +568,15 @@ static int mtk_drm_probe(struct platform_device *pdev)
                        comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL);
                        if (!comp) {
                                ret = -ENOMEM;
+                                of_node_put(node);
                                goto err_node;
                        }
                        ret = mtk_ddp_comp_init(dev, node, comp, comp_id, NULL);
-                        if (ret)
+                        if (ret) {
+                                of_node_put(node);
                                goto err_node;
+                        }
                        private->ddp_comp[comp_id] = comp;
                }
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.h b/drivers/gpu/drm/mediatek/mtk_drm_drv.h
index 598ff3e70446..e03fea12ff59 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h
@@ -51,6 +51,8 @@ struct mtk_drm_private {
        } commit;
        struct drm_atomic_state *suspend_state;
+        bool dma_parms_allocated;
 };
 extern struct platform_driver mtk_ddp_driver;
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 126703816794..5c36c75232e6 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -771,16 +771,20 @@ nv50_msto_atomic_check(struct drm_encoder *encoder,
        struct nv50_head_atom *asyh = nv50_head_atom(crtc_state);
        int slots;
-        /* When restoring duplicated states, we need to make sure that the
+        if (crtc_state->mode_changed || crtc_state->connectors_changed) {
-         * bw remains the same and avoid recalculating it, as the connector's
+                /*
-         * bpc may have changed after the state was duplicated
+                 * When restoring duplicated states, we need to make sure that
-         */
+                 * the bw remains the same and avoid recalculating it, as the
-        if (!state->duplicated)
+                 * connector's bpc may have changed after the state was
-                asyh->dp.pbn =
+                 * duplicated
-                        drm_dp_calc_pbn_mode(crtc_state->adjusted_mode.clock,
+                 */
-                                             connector->display_info.bpc * 3);
+                if (!state->duplicated) {
+                        const int bpp = connector->display_info.bpc * 3;
+                        const int clock = crtc_state->adjusted_mode.clock;
+                        asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, bpp);
+                }
-        if (crtc_state->mode_changed) {
                slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr,
                                                      mstc->port,
                                                      asyh->dp.pbn);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
index b4e7404fe660..a11637b0f6cc 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
@@ -40,8 +40,7 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
                u8 *ptr = msg->buf;
                while (remaining) {
-                        u8 cnt = (remaining > 16) ? 16 : remaining;
+                        u8 cnt, retries, cmd;
-                        u8 cmd;
                        if (msg->flags & I2C_M_RD)
                                cmd = 1;
@@ -51,10 +50,19 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
                        if (mcnt || remaining > 16)
                                cmd |= 4; /* MOT */
-                        ret = aux->func->xfer(aux, true, cmd, msg->addr, ptr, &cnt);
+                        for (retries = 0, cnt = 0;
-                        if (ret < 0) {
+                             retries < 32 && !cnt;
-                                nvkm_i2c_aux_release(aux);
+                             retries++) {
-                                return ret;
+                                cnt = min_t(u8, remaining, 16);
+                                ret = aux->func->xfer(aux, true, cmd,
+                                                      msg->addr, ptr, &cnt);
+                                if (ret < 0)
+                                        goto out;
+                        }
+                        if (!cnt) {
+                                AUX_TRACE(aux, "no data after 32 retries");
+                                ret = -EIO;
+                                goto out;
                        }
                        ptr += cnt;
@@ -64,8 +72,10 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
                msg++;
        }
+        ret = num;
+out:
        nvkm_i2c_aux_release(aux);
-        return num;
+        return ret;
 }
 static u32
diff --git a/drivers/gpu/drm/omapdrm/dss/output.c b/drivers/gpu/drm/omapdrm/dss/output.c
index de0f882f0f7b..14b41de44ebc 100644
--- a/drivers/gpu/drm/omapdrm/dss/output.c
+++ b/drivers/gpu/drm/omapdrm/dss/output.c
@@ -4,6 +4,7 @@
 * Author: Archit Taneja <archit@ti.com>
 */
+#include <linux/bitops.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -20,7 +21,8 @@ int omapdss_device_init_output(struct omap_dss_device *out)
 {
        struct device_node *remote_node;
-        remote_node = of_graph_get_remote_node(out->dev->of_node, 0, 0);
+        remote_node = of_graph_get_remote_node(out->dev->of_node,
+                                               ffs(out->of_ports) - 1, 0);
        if (!remote_node) {
                dev_dbg(out->dev, "failed to find video sink\n");
                return 0;
diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
index 288c59dae56a..1bad0a2cc5c6 100644
--- a/drivers/gpu/drm/omapdrm/omap_drv.c
+++ b/drivers/gpu/drm/omapdrm/omap_drv.c
@@ -669,7 +669,7 @@ static int pdev_probe(struct platform_device *pdev)
        if (omapdss_is_initialized() == false)
                return -EPROBE_DEFER;
-        ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+        ret = dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
        if (ret) {
                dev_err(&pdev->dev, "Failed to set the DMA mask\n");
                return ret;
diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
index f33e349c4ec5..952201c6d821 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -59,6 +59,11 @@ module_param_named(num_heads, qxl_num_crtc, int, 0400);
 static struct drm_driver qxl_driver;
 static struct pci_driver qxl_pci_driver;
+static bool is_vga(struct pci_dev *pdev)
+{
+        return pdev->class == PCI_CLASS_DISPLAY_VGA << 8;
+}
 static int
 qxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -83,9 +88,17 @@ qxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (ret)
                goto disable_pci;
+        if (is_vga(pdev)) {
+                ret = vga_get_interruptible(pdev, VGA_RSRC_LEGACY_IO);
+                if (ret) {
+                        DRM_ERROR("can't get legacy vga ioports\n");
+                        goto disable_pci;
+                }
+        }
        ret = qxl_device_init(qdev, &qxl_driver, pdev);
        if (ret)
-                goto disable_pci;
+                goto put_vga;
        ret = qxl_modeset_init(qdev);
        if (ret)
@@ -105,6 +118,9 @@ modeset_cleanup:
        qxl_modeset_fini(qdev);
 unload:
        qxl_device_fini(qdev);
+put_vga:
+        if (is_vga(pdev))
+                vga_put(pdev, VGA_RSRC_LEGACY_IO);
 disable_pci:
        pci_disable_device(pdev);
 free_dev:
@@ -122,6 +138,8 @@ qxl_pci_remove(struct pci_dev *pdev)
        qxl_modeset_fini(qdev);
        qxl_device_fini(qdev);
+        if (is_vga(pdev))
+                vga_put(pdev, VGA_RSRC_LEGACY_IO);
        dev->dev_private = NULL;
        kfree(qdev);
diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
index 1c62578590f4..082d02c84024 100644
--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
+++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
@@ -673,10 +673,8 @@ static int rcar_lvds_parse_dt_companion(struct rcar_lvds *lvds)
        /* Locate the companion LVDS encoder for dual-link operation, if any. */
        companion = of_parse_phandle(dev->of_node, "renesas,companion", 0);
-        if (!companion) {
+        if (!companion)
-                dev_err(dev, "Companion LVDS encoder not found\n");
+                return 0;
-                return -ENXIO;
-        }
        /*
         * Sanity check: the companion encoder must have the same compatible
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 35ddbec1375a..671c90f34ede 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -95,7 +95,7 @@ static bool drm_sched_entity_is_idle(struct drm_sched_entity *entity)
        rmb(); /* for list_empty to work without lock */
        if (list_empty(&entity->list) ||
-            spsc_queue_peek(&entity->job_queue) == NULL)
+            spsc_queue_count(&entity->job_queue) == 0)
                return true;
        return false;
@@ -281,7 +281,7 @@ void drm_sched_entity_fini(struct drm_sched_entity *entity)
        /* Consumption of existing IBs wasn't completed. Forcefully
         * remove them here.
         */
-        if (spsc_queue_peek(&entity->job_queue)) {
+        if (spsc_queue_count(&entity->job_queue)) {
                if (sched) {
                        /* Park the kernel for a moment to make sure it isn't processing
                         * our enity.
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 64c43ee6bd92..df0cc8f46d7b 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -314,6 +314,7 @@ static void sun4i_tcon0_mode_set_dithering(struct sun4i_tcon *tcon,
                /* R and B components are only 5 bits deep */
                val |= SUN4I_TCON0_FRM_CTL_MODE_R;
                val |= SUN4I_TCON0_FRM_CTL_MODE_B;
+                /* Fall through */
        case MEDIA_BUS_FMT_RGB666_1X18:
        case MEDIA_BUS_FMT_RGB666_1X7X3_SPWG:
                /* Fall through: enable dithering */
diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
index a1fc8b520985..b889ad3e86e1 100644
--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
@@ -993,6 +993,7 @@ static ssize_t sun6i_dsi_transfer(struct mipi_dsi_host *host,
                        ret = sun6i_dsi_dcs_read(dsi, msg);
                        break;
                }
+                /* Else, fall through */
        default:
                ret = -EINVAL;
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index b2da31310d24..09b526518f5a 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -204,6 +204,7 @@ int virtio_gpu_object_get_sg_table(struct virtio_gpu_device *qdev,
                .interruptible = false,
                .no_wait_gpu = false
        };
+        size_t max_segment;
        /* wtf swapping */
        if (bo->pages)
@@ -215,8 +216,13 @@ int virtio_gpu_object_get_sg_table(struct virtio_gpu_device *qdev,
        if (!bo->pages)
                goto out;
-        ret = sg_alloc_table_from_pages(bo->pages, pages, nr_pages, 0,
+        max_segment = virtio_max_dma_size(qdev->vdev);
-                                        nr_pages << PAGE_SHIFT, GFP_KERNEL);
+        max_segment &= PAGE_MASK;
+        if (max_segment > SCATTERLIST_MAX_SEGMENT)
+                max_segment = SCATTERLIST_MAX_SEGMENT;
+        ret = __sg_alloc_table_from_pages(bo->pages, pages, nr_pages, 0,
+                                          nr_pages << PAGE_SHIFT,
+                                          max_segment, GFP_KERNEL);
        if (ret)
                goto out;
        return 0;
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 2310c96ccf4a..db1b55df0d13 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1153,8 +1153,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d)
        INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
-        cp2112_gpio_direction_input(gc, d->hwirq);
        if (!dev->gpio_poll) {
                dev->gpio_poll = true;
                schedule_delayed_work(&dev->gpio_poll_worker, 0);
@@ -1204,6 +1202,12 @@ static int __maybe_unused cp2112_allocate_irq(struct cp2112_device *dev,
                return PTR_ERR(dev->desc[pin]);
        }
+        ret = cp2112_gpio_direction_input(&dev->gc, pin);
+        if (ret < 0) {
+                dev_err(dev->gc.parent, "Failed to set GPIO to input dir\n");
+                goto err_desc;
+        }
        ret = gpiochip_lock_as_irq(&dev->gc, pin);
        if (ret) {
                dev_err(dev->gc.parent, "Failed to lock GPIO as interrupt\n");
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 21268c9fa71a..0179f7ed77e5 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3749,30 +3749,8 @@ static const struct hid_device_id hidpp_devices[] = {
        { L27MHZ_DEVICE(HID_ANY_ID) },
-        { /* Logitech G203/Prodigy Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
-        { /* Logitech G302 Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
-        { /* Logitech G303 Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
-        { /* Logitech G400 Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
        { /* Logitech G403 Wireless Gaming Mouse over USB */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
-        { /* Logitech G403 Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
-        { /* Logitech G403 Hero Gaming Mouse over USB */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
-        { /* Logitech G502 Proteus Core Gaming Mouse */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
-        { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
-        { /* Logitech G502 Hero Gaming Mouse over USB */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
-        { /* Logitech G700 Gaming Mouse over USB */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
-        { /* Logitech G700s Gaming Mouse over USB */
-          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
        { /* Logitech G703 Gaming Mouse over USB */
          HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
        { /* Logitech G703 Hero Gaming Mouse over USB */
diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
index 1065692f90e2..5792a104000a 100644
--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
@@ -24,6 +24,7 @@
 #define ICL_MOBILE_DEVICE_ID    0x34FC
 #define SPT_H_DEVICE_ID         0xA135
 #define CML_LP_DEVICE_ID        0x02FC
+#define EHL_Ax_DEVICE_ID        0x4BB3
 #define REVISION_ID_CHT_A0      0x6
 #define REVISION_ID_CHT_Ax_SI   0x0
diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
index aa80b4d3b740..279567baca3d 100644
--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
@@ -33,6 +33,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ICL_MOBILE_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, SPT_H_DEVICE_ID)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, CML_LP_DEVICE_ID)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, EHL_Ax_DEVICE_ID)},
        {0, }
 };
 MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 7a8ddc999a8e..1713235d28cb 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -846,6 +846,8 @@ static int wacom_intuos_general(struct wacom_wac *wacom)
                y >>= 1;
                distance >>= 1;
        }
+        if (features->type == INTUOSHT2)
+                distance = features->distance_max - distance;
        input_report_abs(input, ABS_X, x);
        input_report_abs(input, ABS_Y, y);
        input_report_abs(input, ABS_DISTANCE, distance);
@@ -1059,7 +1061,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
        input_report_key(input, BTN_BASE2, (data[11] & 0x02));
        if (data[12] & 0x80)
-                input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f));
+                input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1);
        else
                input_report_abs(input, ABS_WHEEL, 0);
@@ -1290,7 +1292,8 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                }
                if (wacom->tool[0]) {
                        input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
-                        if (wacom->features.type == INTUOSP2_BT) {
+                        if (wacom->features.type == INTUOSP2_BT ||
+                            wacom->features.type == INTUOSP2S_BT) {
                                input_report_abs(pen_input, ABS_DISTANCE,
                                                 range ? frame[13] : wacom->features.distance_max);
                        } else {
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 5f9505a087f6..23f358cb7f49 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -26,7 +26,7 @@
 static unsigned long virt_to_hvpfn(void *addr)
 {
-        unsigned long paddr;
+        phys_addr_t paddr;
        if (is_vmalloc_addr(addr))
                paddr = page_to_phys(vmalloc_to_page(addr)) +
diff --git a/drivers/hv/hv_trace.h b/drivers/hv/hv_trace.h
index 999f80a63bff..e70783e33680 100644
--- a/drivers/hv/hv_trace.h
+++ b/drivers/hv/hv_trace.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM hyperv
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 362e70e9d145..fb16a622e8ab 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -146,8 +146,6 @@ struct hv_context {
         */
        u64 guestid;
-        void *tsc_page;
        struct hv_per_cpu_context __percpu *cpu_context;
        /*
diff --git a/drivers/hwtracing/intel_th/msu.h b/drivers/hwtracing/intel_th/msu.h
index 574c16004cb2..13d9b141daaa 100644
--- a/drivers/hwtracing/intel_th/msu.h
+++ b/drivers/hwtracing/intel_th/msu.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Intel(R) Trace Hub Memory Storage Unit (MSU) data structures
 *
diff --git a/drivers/hwtracing/intel_th/pti.h b/drivers/hwtracing/intel_th/pti.h
index e9381babc84c..7dfc0431333b 100644
--- a/drivers/hwtracing/intel_th/pti.h
+++ b/drivers/hwtracing/intel_th/pti.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Intel(R) Trace Hub PTI output data structures
 *
diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
index d7fd76baec92..19ef2b0c682a 100644
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -790,7 +790,10 @@ static int bcm_iproc_i2c_xfer(struct i2c_adapter *adapter,
 static uint32_t bcm_iproc_i2c_functionality(struct i2c_adapter *adap)
 {
-        u32 val = I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+        u32 val;
+        /* We do not support the SMBUS Quick command */
+        val = I2C_FUNC_I2C | (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
        if (adap->algo->reg_slave)
                val |= I2C_FUNC_SLAVE;
diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
index e7f9305b2dd9..f5f001738df5 100644
--- a/drivers/i2c/busses/i2c-designware-slave.c
+++ b/drivers/i2c/busses/i2c-designware-slave.c
@@ -94,6 +94,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
        dev->disable_int(dev);
        dev->disable(dev);
+        synchronize_irq(dev->irq);
        dev->slave = NULL;
        pm_runtime_put(dev->dev);
diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
index 35b302d983e0..959d4912ec0d 100644
--- a/drivers/i2c/busses/i2c-emev2.c
+++ b/drivers/i2c/busses/i2c-emev2.c
@@ -69,6 +69,7 @@ struct em_i2c_device {
        struct completion msg_done;
        struct clk *sclk;
        struct i2c_client *slave;
+        int irq;
 };
 static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
        writeb(0, priv->base + I2C_OFS_SVA0);
+        /*
+         * Wait for interrupt to finish. New slave irqs cannot happen because we
+         * cleared the slave address and, thus, only extension codes will be
+         * detected which do not use the slave ptr.
+         */
+        synchronize_irq(priv->irq);
        priv->slave = NULL;
        return 0;
@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev)
 {
        struct em_i2c_device *priv;
        struct resource *r;
-        int irq, ret;
+        int ret;
        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
        if (!priv)
@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev)
        em_i2c_reset(&priv->adap);
-        irq = platform_get_irq(pdev, 0);
+        priv->irq = platform_get_irq(pdev, 0);
-        ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
+        ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
                                "em_i2c", priv);
        if (ret)
                goto err_clk;
@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev)
        if (ret)
                goto err_clk;
-        dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
+        dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
+                 priv->irq);
        return 0;
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index f2956936c3f2..2e08b4722dc4 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1194,19 +1194,28 @@ static acpi_status check_acpi_smo88xx_device(acpi_handle obj_handle,
        int i;
        status = acpi_get_object_info(obj_handle, &info);
-        if (!ACPI_SUCCESS(status) || !(info->valid & ACPI_VALID_HID))
+        if (ACPI_FAILURE(status))
                return AE_OK;
+        if (!(info->valid & ACPI_VALID_HID))
+                goto smo88xx_not_found;
        hid = info->hardware_id.string;
        if (!hid)
-                return AE_OK;
+                goto smo88xx_not_found;
        i = match_string(acpi_smo8800_ids, ARRAY_SIZE(acpi_smo8800_ids), hid);
        if (i < 0)
-                return AE_OK;
+                goto smo88xx_not_found;
+        kfree(info);
        *((bool *)return_value) = true;
        return AE_CTRL_TERMINATE;
+smo88xx_not_found:
+        kfree(info);
+        return AE_OK;
 }
 static bool is_dell_system_with_lis3lv02d(void)
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index b1b8b938d7f4..15f6cde6452f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -273,8 +273,8 @@ static inline unsigned char imx_i2c_read_reg(struct imx_i2c_struct *i2c_imx,
 }
 /* Functions for DMA support */
-static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
+static void i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
-                               dma_addr_t phy_addr)
+                                                dma_addr_t phy_addr)
 {
        struct imx_i2c_dma *dma;
        struct dma_slave_config dma_sconfig;
@@ -283,7 +283,7 @@ static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
        dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
        if (!dma)
-                return -ENOMEM;
+                return;
        dma->chan_tx = dma_request_chan(dev, "tx");
        if (IS_ERR(dma->chan_tx)) {
@@ -328,7 +328,7 @@ static int i2c_imx_dma_request(struct imx_i2c_struct *i2c_imx,
        dev_info(dev, "using %s (tx) and %s (rx) for DMA transfers\n",
                dma_chan_name(dma->chan_tx), dma_chan_name(dma->chan_rx));
-        return 0;
+        return;
 fail_rx:
        dma_release_channel(dma->chan_rx);
@@ -336,8 +336,6 @@ fail_tx:
        dma_release_channel(dma->chan_tx);
 fail_al:
        devm_kfree(dev, dma);
-        /* return successfully if there is no dma support */
-        return ret == -ENODEV ? 0 : ret;
 }
 static void i2c_imx_dma_callback(void *arg)
@@ -1165,17 +1163,13 @@ static int i2c_imx_probe(struct platform_device *pdev)
        dev_dbg(&i2c_imx->adapter.dev, "device resources: %pR\n", res);
        dev_dbg(&i2c_imx->adapter.dev, "adapter name: \"%s\"\n",
                i2c_imx->adapter.name);
+        dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
        /* Init DMA config if supported */
-        ret = i2c_imx_dma_request(i2c_imx, phy_addr);
+        i2c_imx_dma_request(i2c_imx, phy_addr);
-        if (ret < 0)
-                goto del_adapter;
-        dev_info(&i2c_imx->adapter.dev, "IMX I2C adapter registered\n");
        return 0;   /* Return OK */
-del_adapter:
-        i2c_del_adapter(&i2c_imx->adapter);
 clk_notifier_unregister:
        clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
 rpm_disable:
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 252edb433fdf..29eae1bf4f86 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -234,6 +234,10 @@ static const struct i2c_adapter_quirks mt7622_i2c_quirks = {
        .max_num_msgs = 255,
 };
+static const struct i2c_adapter_quirks mt8183_i2c_quirks = {
+        .flags = I2C_AQ_NO_ZERO_LEN,
+};
 static const struct mtk_i2c_compatible mt2712_compat = {
        .regs = mt_i2c_regs_v1,
        .pmic_i2c = 0,
@@ -298,6 +302,7 @@ static const struct mtk_i2c_compatible mt8173_compat = {
 };
 static const struct mtk_i2c_compatible mt8183_compat = {
+        .quirks = &mt8183_i2c_quirks,
        .regs = mt_i2c_regs_v2,
        .pmic_i2c = 0,
        .dcm = 0,
@@ -870,7 +875,11 @@ static irqreturn_t mtk_i2c_irq(int irqno, void *dev_id)
 static u32 mtk_i2c_functionality(struct i2c_adapter *adap)
 {
-        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+        if (adap->quirks->flags & I2C_AQ_NO_ZERO_LEN)
+                return I2C_FUNC_I2C |
+                        (I2C_FUNC_SMBUS_EMUL & ~I2C_FUNC_SMBUS_QUICK);
+        else
+                return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
 }
 static const struct i2c_algorithm mtk_i2c_algorithm = {
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index c46c4bddc7ca..cba325eb852f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -91,7 +91,7 @@
 #define SB800_PIIX4_PORT_IDX_MASK       0x06
 #define SB800_PIIX4_PORT_IDX_SHIFT      1
-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
 #define SB800_PIIX4_PORT_IDX_KERNCZ             0x02
 #define SB800_PIIX4_PORT_IDX_MASK_KERNCZ        0x18
 #define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ       3
@@ -358,18 +358,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
        /* Find which register is used for port selection */
        if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD ||
            PIIX4_dev->vendor == PCI_VENDOR_ID_HYGON) {
-                switch (PIIX4_dev->device) {
+                if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
-                case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+                    (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+                     PIIX4_dev->revision >= 0x1F)) {
                        piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
                        piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
                        piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
-                        break;
+                } else {
-                case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
-                default:
                        piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
                        piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
                        piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
-                        break;
                }
        } else {
                if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index d39a4606f72d..531c01100b56 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -139,6 +139,7 @@ struct rcar_i2c_priv {
        enum dma_data_direction dma_direction;
        struct reset_control *rstc;
+        int irq;
 };
 #define rcar_i2c_priv_to_dev(p)         ((p)->adap.dev.parent)
@@ -861,9 +862,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
        WARN_ON(!priv->slave);
+        /* disable irqs and ensure none is running before clearing ptr */
        rcar_i2c_write(priv, ICSIER, 0);
        rcar_i2c_write(priv, ICSCR, 0);
+        synchronize_irq(priv->irq);
        priv->slave = NULL;
        pm_runtime_put(rcar_i2c_priv_to_dev(priv));
@@ -918,7 +921,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
        struct i2c_adapter *adap;
        struct device *dev = &pdev->dev;
        struct i2c_timings i2c_t;
-        int irq, ret;
+        int ret;
        /* Otherwise logic will break because some bytes must always use PIO */
        BUILD_BUG_ON_MSG(RCAR_MIN_DMA_LEN < 3, "Invalid min DMA length");
@@ -984,10 +987,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
                pm_runtime_put(dev);
-        irq = platform_get_irq(pdev, 0);
+        priv->irq = platform_get_irq(pdev, 0);
-        ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+        ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
        if (ret < 0) {
-                dev_err(dev, "cannot get irq %d\n", irq);
+                dev_err(dev, "cannot get irq %d\n", priv->irq);
                goto out_pm_disable;
        }
diff --git a/drivers/i2c/busses/i2c-stm32.h b/drivers/i2c/busses/i2c-stm32.h
index 868755f82f88..2c21893905a3 100644
--- a/drivers/i2c/busses/i2c-stm32.h
+++ b/drivers/i2c/busses/i2c-stm32.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * i2c-stm32.h
 *
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index f26ed495d384..9c440fa6a3dd 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -832,7 +832,7 @@ EXPORT_SYMBOL_GPL(i2c_new_device);
 */
 void i2c_unregister_device(struct i2c_client *client)
 {
-        if (!client)
+        if (IS_ERR_OR_NULL(client))
                return;
        if (client->dev.of_node) {
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index 0e3c6529fc4c..da073d72f649 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -480,7 +480,7 @@ static int max9611_init(struct max9611_dev *max9611)
        if (ret)
                return ret;
-        regval = ret & MAX9611_TEMP_MASK;
+        regval &= MAX9611_TEMP_MASK;
        if ((regval > MAX9611_TEMP_MAX_POS &&
             regval < MAX9611_TEMP_MIN_NEG) ||
diff --git a/drivers/iio/frequency/adf4371.c b/drivers/iio/frequency/adf4371.c
index e48f15cc9ab5..ff82863cbf42 100644
--- a/drivers/iio/frequency/adf4371.c
+++ b/drivers/iio/frequency/adf4371.c
@@ -276,11 +276,11 @@ static int adf4371_set_freq(struct adf4371_state *st, unsigned long long freq,
        st->buf[0] = st->integer >> 8;
        st->buf[1] = 0x40; /* REG12 default */
        st->buf[2] = 0x00;
-        st->buf[3] = st->fract2 & 0xFF;
+        st->buf[3] = st->fract1 & 0xFF;
-        st->buf[4] = st->fract2 >> 7;
+        st->buf[4] = st->fract1 >> 8;
-        st->buf[5] = st->fract2 >> 15;
+        st->buf[5] = st->fract1 >> 16;
        st->buf[6] = ADF4371_FRAC2WORD_L(st->fract2 & 0x7F) |
-                     ADF4371_FRAC1WORD(st->fract1 >> 23);
+                     ADF4371_FRAC1WORD(st->fract1 >> 24);
        st->buf[7] = ADF4371_FRAC2WORD_H(st->fract2 >> 7);
        st->buf[8] = st->mod2 & 0xFF;
        st->buf[9] = ADF4371_MOD2WORD(st->mod2 >> 8);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 19f1730a4f24..a68d0ccf67a4 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -4724,10 +4724,14 @@ static int __init cma_init(void)
        if (ret)
                goto err;
-        cma_configfs_init();
+        ret = cma_configfs_init();
+        if (ret)
+                goto err_ib;
        return 0;
+err_ib:
+        ib_unregister_client(&cma_client);
 err:
        unregister_netdevice_notifier(&cma_nb);
        ib_sa_unregister_client(&sa_client);
diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
index 45d5164e9574..af8c85d18e62 100644
--- a/drivers/infiniband/core/counters.c
+++ b/drivers/infiniband/core/counters.c
@@ -38,6 +38,9 @@ int rdma_counter_set_auto_mode(struct ib_device *dev, u8 port,
        int ret;
        port_counter = &dev->port_data[port].port_counter;
+        if (!port_counter->hstats)
+                return -EOPNOTSUPP;
        mutex_lock(&port_counter->lock);
        if (on) {
                ret = __counter_set_mode(&port_counter->mode,
@@ -146,13 +149,11 @@ static bool auto_mode_match(struct ib_qp *qp, struct rdma_counter *counter,
        struct auto_mode_param *param = &counter->mode.param;
        bool match = true;
-        if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res))
+        if (!rdma_is_visible_in_pid_ns(&qp->res))
                return false;
-        /* Ensure that counter belong to right PID */
+        /* Ensure that counter belongs to the right PID */
-        if (!rdma_is_kernel_res(&counter->res) &&
+        if (task_pid_nr(counter->res.task) != task_pid_nr(qp->res.task))
-            !rdma_is_kernel_res(&qp->res) &&
-            (task_pid_vnr(counter->res.task) != current->pid))
                return false;
        if (auto_mask & RDMA_COUNTER_MASK_QP_TYPE)
@@ -421,7 +422,7 @@ static struct ib_qp *rdma_counter_get_qp(struct ib_device *dev, u32 qp_num)
        return qp;
 err:
-        rdma_restrack_put(&qp->res);
+        rdma_restrack_put(res);
        return NULL;
 }
@@ -509,6 +510,9 @@ int rdma_counter_bind_qpn_alloc(struct ib_device *dev, u8 port,
        if (!rdma_is_port_valid(dev, port))
                return -EINVAL;
+        if (!dev->port_data[port].port_counter.hstats)
+                return -EOPNOTSUPP;
        qp = rdma_counter_get_qp(dev, qp_num);
        if (!qp)
                return -ENOENT;
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 783e465e7c41..020c26976558 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -382,8 +382,7 @@ static int fill_res_info(struct sk_buff *msg, struct ib_device *device)
        for (i = 0; i < RDMA_RESTRACK_MAX; i++) {
                if (!names[i])
                        continue;
-                curr = rdma_restrack_count(device, i,
+                curr = rdma_restrack_count(device, i);
-                                           task_active_pid_ns(current));
                ret = fill_res_info_entry(msg, names[i], curr);
                if (ret)
                        goto err;
@@ -1952,12 +1951,16 @@ static int stat_get_doit_qp(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (fill_nldev_handle(msg, device) ||
            nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, port) ||
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_MODE, mode))
+            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_MODE, mode)) {
+                ret = -EMSGSIZE;
                goto err_msg;
+        }
        if ((mode == RDMA_COUNTER_MODE_AUTO) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK, mask))
+            nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK, mask)) {
+                ret = -EMSGSIZE;
                goto err_msg;
+        }
        nlmsg_end(msg, nlh);
        ib_device_put(device);
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index bddff426ee0f..a07665f7ef8c 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -107,10 +107,8 @@ void rdma_restrack_clean(struct ib_device *dev)
 * rdma_restrack_count() - the current usage of specific object
 * @dev:  IB device
 * @type: actual type of object to operate
- * @ns:   PID namespace
 */
-int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
+int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type)
-                        struct pid_namespace *ns)
 {
        struct rdma_restrack_root *rt = &dev->res[type];
        struct rdma_restrack_entry *e;
@@ -119,10 +117,9 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
        xa_lock(&rt->xa);
        xas_for_each(&xas, e, U32_MAX) {
-                if (ns == &init_pid_ns ||
+                if (!rdma_is_visible_in_pid_ns(e))
-                    (!rdma_is_kernel_res(e) &&
+                        continue;
-                     ns == task_active_pid_ns(e->task)))
+                cnt++;
-                        cnt++;
        }
        xa_unlock(&rt->xa);
        return cnt;
@@ -360,5 +357,7 @@ bool rdma_is_visible_in_pid_ns(struct rdma_restrack_entry *res)
         */
        if (rdma_is_kernel_res(res))
                return task_active_pid_ns(current) == &init_pid_ns;
-        return task_active_pid_ns(current) == task_active_pid_ns(res->task);
+        /* PID 0 means that resource is not found in current namespace */
+        return task_pid_vnr(res->task);
 }
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 08da840ed7ee..56553668256f 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -379,14 +379,9 @@ EXPORT_SYMBOL(ib_umem_release);
 int ib_umem_page_count(struct ib_umem *umem)
 {
-        int i;
+        int i, n = 0;
-        int n;
        struct scatterlist *sg;
-        if (umem->is_odp)
-                return ib_umem_num_pages(umem);
-        n = 0;
        for_each_sg(umem->sg_head.sgl, sg, umem->nmap, i)
                n += sg_dma_len(sg) >> PAGE_SHIFT;
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 2a75c6f8d827..c0e15db34680 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -112,10 +112,6 @@ static int ib_umem_notifier_release_trampoline(struct ib_umem_odp *umem_odp,
         * prevent any further fault handling on this MR.
         */
        ib_umem_notifier_start_account(umem_odp);
-        umem_odp->dying = 1;
-        /* Make sure that the fact the umem is dying is out before we release
-         * all pending page faults. */
-        smp_wmb();
        complete_all(&umem_odp->notifier_completion);
        umem_odp->umem.context->invalidate_range(
                umem_odp, ib_umem_start(umem_odp), ib_umem_end(umem_odp));
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 48b04d2f175f..60c8f76aab33 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -136,6 +136,13 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
                spin_unlock_irqrestore(&cmdq->lock, flags);
                return -EBUSY;
        }
+        size = req->cmd_size;
+        /* change the cmd_size to the number of 16byte cmdq unit.
+         * req->cmd_size is modified here
+         */
+        bnxt_qplib_set_cmd_slots(req);
        memset(resp, 0, sizeof(*resp));
        crsqe->resp = (struct creq_qp_event *)resp;
        crsqe->resp->cookie = req->cookie;
@@ -150,7 +157,6 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
        cmdq_ptr = (struct bnxt_qplib_cmdqe **)cmdq->pbl_ptr;
        preq = (u8 *)req;
-        size = req->cmd_size * BNXT_QPLIB_CMDQE_UNITS;
        do {
                /* Locate the next cmdq slot */
                sw_prod = HWQ_CMP(cmdq->prod, cmdq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 2138533bb642..dfeadc192e17 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -55,9 +55,7 @@
        do {                                                            \
                memset(&(req), 0, sizeof((req)));                       \
                (req).opcode = CMDQ_BASE_OPCODE_##CMD;                  \
-                (req).cmd_size = (sizeof((req)) +                       \
+                (req).cmd_size = sizeof((req));                         \
-                                BNXT_QPLIB_CMDQE_UNITS - 1) /           \
-                                BNXT_QPLIB_CMDQE_UNITS;                 \
                (req).flags = cpu_to_le16(cmd_flags);                   \
        } while (0)
@@ -95,6 +93,13 @@ static inline u32 bnxt_qplib_cmdqe_cnt_per_pg(u32 depth)
                 BNXT_QPLIB_CMDQE_UNITS);
 }
+/* Set the cmd_size to a factor of CMDQE unit */
+static inline void bnxt_qplib_set_cmd_slots(struct cmdq_base *req)
+{
+        req->cmd_size = (req->cmd_size + BNXT_QPLIB_CMDQE_UNITS - 1) /
+                         BNXT_QPLIB_CMDQE_UNITS;
+}
 #define MAX_CMDQ_IDX(depth)             ((depth) - 1)
 static inline u32 bnxt_qplib_max_cmdq_idx_per_pg(u32 depth)
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index 93613e5def9b..986c12153e62 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -141,12 +141,14 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
        if (!data)
                return -ENOMEM;
        copy = min(len, datalen - 1);
-        if (copy_from_user(data, buf, copy))
+        if (copy_from_user(data, buf, copy)) {
-                return -EFAULT;
+                ret = -EFAULT;
+                goto free_data;
+        }
        ret = debugfs_file_get(file->f_path.dentry);
        if (unlikely(ret))
-                return ret;
+                goto free_data;
        ptr = data;
        token = ptr;
        for (ptr = data; *ptr; ptr = end + 1, token = ptr) {
@@ -195,6 +197,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
        ret = len;
        debugfs_file_put(file->f_path.dentry);
+free_data:
        kfree(data);
        return ret;
 }
@@ -214,7 +217,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
                return -ENOMEM;
        ret = debugfs_file_get(file->f_path.dentry);
        if (unlikely(ret))
-                return ret;
+                goto free_data;
        bit = find_first_bit(fault->opcodes, bitsize);
        while (bit < bitsize) {
                zero = find_next_zero_bit(fault->opcodes, bitsize, bit);
@@ -232,6 +235,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
        data[size - 1] = '\n';
        data[size] = '\0';
        ret = simple_read_from_buffer(buf, len, pos, data, size);
+free_data:
        kfree(data);
        return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c
index 996fc298207e..6141f4edc6bf 100644
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -2574,18 +2574,9 @@ void hfi1_kern_read_tid_flow_free(struct rvt_qp *qp)
        hfi1_kern_clear_hw_flow(priv->rcd, qp);
 }
-static bool tid_rdma_tid_err(struct hfi1_ctxtdata *rcd,
+static bool tid_rdma_tid_err(struct hfi1_packet *packet, u8 rcv_type)
-                             struct hfi1_packet *packet, u8 rcv_type,
-                             u8 opcode)
 {
        struct rvt_qp *qp = packet->qp;
-        struct hfi1_qp_priv *qpriv = qp->priv;
-        u32 ipsn;
-        struct ib_other_headers *ohdr = packet->ohdr;
-        struct rvt_ack_entry *e;
-        struct tid_rdma_request *req;
-        struct rvt_dev_info *rdi = ib_to_rvt(qp->ibqp.device);
-        u32 i;
        if (rcv_type >= RHF_RCV_TYPE_IB)
                goto done;
@@ -2602,41 +2593,9 @@ static bool tid_rdma_tid_err(struct hfi1_ctxtdata *rcd,
        if (rcv_type == RHF_RCV_TYPE_EAGER) {
                hfi1_restart_rc(qp, qp->s_last_psn + 1, 1);
                hfi1_schedule_send(qp);
-                goto done_unlock;
-        }
-        /*
-         * For TID READ response, error out QP after freeing the tid
-         * resources.
-         */
-        if (opcode == TID_OP(READ_RESP)) {
-                ipsn = mask_psn(be32_to_cpu(ohdr->u.tid_rdma.r_rsp.verbs_psn));
-                if (cmp_psn(ipsn, qp->s_last_psn) > 0 &&
-                    cmp_psn(ipsn, qp->s_psn) < 0) {
-                        hfi1_kern_read_tid_flow_free(qp);
-                        spin_unlock(&qp->s_lock);
-                        rvt_rc_error(qp, IB_WC_LOC_QP_OP_ERR);
-                        goto done;
-                }
-                goto done_unlock;
-        }
-        /*
-         * Error out the qp for TID RDMA WRITE
-         */
-        hfi1_kern_clear_hw_flow(qpriv->rcd, qp);
-        for (i = 0; i < rvt_max_atomic(rdi); i++) {
-                e = &qp->s_ack_queue[i];
-                if (e->opcode == TID_OP(WRITE_REQ)) {
-                        req = ack_to_tid_req(e);
-                        hfi1_kern_exp_rcv_clear_all(req);
-                }
        }
-        spin_unlock(&qp->s_lock);
-        rvt_rc_error(qp, IB_WC_LOC_LEN_ERR);
-        goto done;
-done_unlock:
+        /* Since no payload is delivered, just drop the packet */
        spin_unlock(&qp->s_lock);
 done:
        return true;
@@ -2687,12 +2646,12 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
        u32 fpsn;
        lockdep_assert_held(&qp->r_lock);
+        spin_lock(&qp->s_lock);
        /* If the psn is out of valid range, drop the packet */
        if (cmp_psn(ibpsn, qp->s_last_psn) < 0 ||
            cmp_psn(ibpsn, qp->s_psn) > 0)
-                return ret;
+                goto s_unlock;
-        spin_lock(&qp->s_lock);
        /*
         * Note that NAKs implicitly ACK outstanding SEND and RDMA write
         * requests and implicitly NAK RDMA read and atomic requests issued
@@ -2740,9 +2699,12 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd,
                wqe = do_rc_completion(qp, wqe, ibp);
                if (qp->s_acked == qp->s_tail)
-                        break;
+                        goto s_unlock;
        }
+        if (qp->s_acked == qp->s_tail)
+                goto s_unlock;
        /* Handle the eflags for the request */
        if (wqe->wr.opcode != IB_WR_TID_RDMA_READ)
                goto s_unlock;
@@ -2922,7 +2884,7 @@ bool hfi1_handle_kdeth_eflags(struct hfi1_ctxtdata *rcd,
                if (lnh == HFI1_LRH_GRH)
                        goto r_unlock;
-                if (tid_rdma_tid_err(rcd, packet, rcv_type, opcode))
+                if (tid_rdma_tid_err(packet, rcv_type))
                        goto r_unlock;
        }
@@ -2942,8 +2904,15 @@ bool hfi1_handle_kdeth_eflags(struct hfi1_ctxtdata *rcd,
         */
        spin_lock(&qp->s_lock);
        qpriv = qp->priv;
+        if (qpriv->r_tid_tail == HFI1_QP_WQE_INVALID ||
+            qpriv->r_tid_tail == qpriv->r_tid_head)
+                goto unlock;
        e = &qp->s_ack_queue[qpriv->r_tid_tail];
+        if (e->opcode != TID_OP(WRITE_REQ))
+                goto unlock;
        req = ack_to_tid_req(e);
+        if (req->comp_seg == req->cur_seg)
+                goto unlock;
        flow = &req->flows[req->clear_tail];
        trace_hfi1_eflags_err_write(qp, rcv_type, rte, psn);
        trace_hfi1_rsp_handle_kdeth_eflags(qp, psn);
@@ -4509,7 +4478,7 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
        struct rvt_swqe *wqe;
        struct tid_rdma_request *req;
        struct tid_rdma_flow *flow;
-        u32 aeth, psn, req_psn, ack_psn, resync_psn, ack_kpsn;
+        u32 aeth, psn, req_psn, ack_psn, flpsn, resync_psn, ack_kpsn;
        unsigned long flags;
        u16 fidx;
@@ -4538,6 +4507,9 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
                ack_kpsn--;
        }
+        if (unlikely(qp->s_acked == qp->s_tail))
+                goto ack_op_err;
        wqe = rvt_get_swqe_ptr(qp, qp->s_acked);
        if (wqe->wr.opcode != IB_WR_TID_RDMA_WRITE)
@@ -4550,7 +4522,8 @@ void hfi1_rc_rcv_tid_rdma_ack(struct hfi1_packet *packet)
        trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail, flow);
        /* Drop stale ACK/NAK */
-        if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0)
+        if (cmp_psn(psn, full_flow_psn(flow, flow->flow_state.spsn)) < 0 ||
+            cmp_psn(req_psn, flow->flow_state.resp_ib_psn) < 0)
                goto ack_op_err;
        while (cmp_psn(ack_kpsn,
@@ -4712,7 +4685,12 @@ done:
                switch ((aeth >> IB_AETH_CREDIT_SHIFT) &
                        IB_AETH_CREDIT_MASK) {
                case 0: /* PSN sequence error */
+                        if (!req->flows)
+                                break;
                        flow = &req->flows[req->acked_tail];
+                        flpsn = full_flow_psn(flow, flow->flow_state.lpsn);
+                        if (cmp_psn(psn, flpsn) > 0)
+                                break;
                        trace_hfi1_tid_flow_rcv_tid_ack(qp, req->acked_tail,
                                                        flow);
                        req->r_ack_psn = mask_psn(be32_to_cpu(ohdr->bth[2]));
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 68c951491a08..57079110af9b 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1677,8 +1677,6 @@ tx_err:
                                    tx_buf_size, DMA_TO_DEVICE);
                kfree(tun_qp->tx_ring[i].buf.addr);
        }
-        kfree(tun_qp->tx_ring);
-        tun_qp->tx_ring = NULL;
        i = MLX4_NUM_TUNNEL_BUFS;
 err:
        while (i > 0) {
@@ -1687,6 +1685,8 @@ err:
                                    rx_buf_size, DMA_FROM_DEVICE);
                kfree(tun_qp->ring[i].addr);
        }
+        kfree(tun_qp->tx_ring);
+        tun_qp->tx_ring = NULL;
        kfree(tun_qp->ring);
        tun_qp->ring = NULL;
        return -ENOMEM;
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index ec4370f99381..af5bbb35c058 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2026,7 +2026,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
                        event_sub->eventfd =
                                eventfd_ctx_fdget(redirect_fd);
-                        if (IS_ERR(event_sub)) {
+                        if (IS_ERR(event_sub->eventfd)) {
                                err = PTR_ERR(event_sub->eventfd);
                                event_sub->eventfd = NULL;
                                goto err;
@@ -2644,12 +2644,13 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
        struct devx_async_event_file *ev_file = filp->private_data;
        struct devx_event_subscription *event_sub, *event_sub_tmp;
        struct devx_async_event_data *entry, *tmp;
+        struct mlx5_ib_dev *dev = ev_file->dev;
-        mutex_lock(&ev_file->dev->devx_event_table.event_xa_lock);
+        mutex_lock(&dev->devx_event_table.event_xa_lock);
        /* delete the subscriptions which are related to this FD */
        list_for_each_entry_safe(event_sub, event_sub_tmp,
                                 &ev_file->subscribed_events_list, file_list) {
-                devx_cleanup_subscription(ev_file->dev, event_sub);
+                devx_cleanup_subscription(dev, event_sub);
                if (event_sub->eventfd)
                        eventfd_ctx_put(event_sub->eventfd);
@@ -2658,7 +2659,7 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
                kfree_rcu(event_sub, rcu);
        }
-        mutex_unlock(&ev_file->dev->devx_event_table.event_xa_lock);
+        mutex_unlock(&dev->devx_event_table.event_xa_lock);
        /* free the pending events allocation */
        if (!ev_file->omit_data) {
@@ -2670,7 +2671,7 @@ static int devx_async_event_close(struct inode *inode, struct file *filp)
        }
        uverbs_close_fd(filp);
-        put_device(&ev_file->dev->ib_dev.dev);
+        put_device(&dev->ib_dev.dev);
        return 0;
 }
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e12a4404096b..0569bcab02d4 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1023,7 +1023,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
        props->timestamp_mask = 0x7FFFFFFFFFFFFFFFULL;
        if (IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING)) {
-                if (MLX5_CAP_GEN(mdev, pg))
+                if (dev->odp_caps.general_caps & IB_ODP_SUPPORT)
                        props->device_cap_flags |= IB_DEVICE_ON_DEMAND_PAGING;
                props->odp_caps = dev->odp_caps;
        }
@@ -6139,6 +6139,8 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
                dev->port[i].roce.last_port_state = IB_PORT_DOWN;
        }
+        mlx5_ib_internal_fill_odp_caps(dev);
        err = mlx5_ib_init_multiport_master(dev);
        if (err)
                return err;
@@ -6563,8 +6565,6 @@ static void mlx5_ib_stage_dev_res_cleanup(struct mlx5_ib_dev *dev)
 static int mlx5_ib_stage_odp_init(struct mlx5_ib_dev *dev)
 {
-        mlx5_ib_internal_fill_odp_caps(dev);
        return mlx5_ib_odp_init_one(dev);
 }
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index fe1a76d8531c..a40e0abf2338 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -57,9 +57,10 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
        int entry;
        if (umem->is_odp) {
-                unsigned int page_shift = to_ib_umem_odp(umem)->page_shift;
+                struct ib_umem_odp *odp = to_ib_umem_odp(umem);
+                unsigned int page_shift = odp->page_shift;
-                *ncont = ib_umem_page_count(umem);
+                *ncont = ib_umem_odp_num_pages(odp);
                *count = *ncont << (page_shift - PAGE_SHIFT);
                *shift = page_shift;
                if (order)
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index f6a53455bf8b..9ae587b74b12 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1475,4 +1475,18 @@ int bfregn_to_uar_index(struct mlx5_ib_dev *dev,
                        bool dyn_bfreg);
 int mlx5_ib_qp_set_counter(struct ib_qp *qp, struct rdma_counter *counter);
+static inline bool mlx5_ib_can_use_umr(struct mlx5_ib_dev *dev,
+                                       bool do_modify_atomic)
+{
+        if (MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled))
+                return false;
+        if (do_modify_atomic &&
+            MLX5_CAP_GEN(dev->mdev, atomic) &&
+            MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled))
+                return false;
+        return true;
+}
 #endif /* MLX5_IB_H */
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index b74fad08412f..3401f5f6792e 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1293,9 +1293,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
        if (err < 0)
                return ERR_PTR(err);
-        use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
+        use_umr = mlx5_ib_can_use_umr(dev, true);
-                  (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
-                   !MLX5_CAP_GEN(dev->mdev, atomic));
        if (order <= mr_cache_max_order(dev) && use_umr) {
                mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
@@ -1448,7 +1446,8 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                        goto err;
        }
-        if (flags & IB_MR_REREG_TRANS && !use_umr_mtt_update(mr, addr, len)) {
+        if (!mlx5_ib_can_use_umr(dev, true) ||
+            (flags & IB_MR_REREG_TRANS && !use_umr_mtt_update(mr, addr, len))) {
                /*
                 * UMR can't be used - MKey needs to be replaced.
                 */
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 81da82050d05..0a59912a4cef 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -301,7 +301,8 @@ void mlx5_ib_internal_fill_odp_caps(struct mlx5_ib_dev *dev)
        memset(caps, 0, sizeof(*caps));
-        if (!MLX5_CAP_GEN(dev->mdev, pg))
+        if (!MLX5_CAP_GEN(dev->mdev, pg) ||
+            !mlx5_ib_can_use_umr(dev, true))
                return;
        caps->general_caps = IB_ODP_SUPPORT;
@@ -355,7 +356,8 @@ void mlx5_ib_internal_fill_odp_caps(struct mlx5_ib_dev *dev)
        if (MLX5_CAP_GEN(dev->mdev, fixed_buffer_size) &&
            MLX5_CAP_GEN(dev->mdev, null_mkey) &&
-            MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset))
+            MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset) &&
+            !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled))
                caps->general_caps |= IB_ODP_SUPPORT_IMPLICIT;
        return;
@@ -579,7 +581,6 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                        u32 flags)
 {
        int npages = 0, current_seq, page_shift, ret, np;
-        bool implicit = false;
        struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem);
        bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
        bool prefetch = flags & MLX5_PF_FLAGS_PREFETCH;
@@ -594,7 +595,6 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                if (IS_ERR(odp))
                        return PTR_ERR(odp);
                mr = odp->private;
-                implicit = true;
        } else {
                odp = odp_mr;
        }
@@ -682,19 +682,15 @@ next_mr:
 out:
        if (ret == -EAGAIN) {
-                if (implicit || !odp->dying) {
+                unsigned long timeout = msecs_to_jiffies(MMU_NOTIFIER_TIMEOUT);
-                        unsigned long timeout =
-                                msecs_to_jiffies(MMU_NOTIFIER_TIMEOUT);
+                if (!wait_for_completion_timeout(&odp->notifier_completion,
+                                                 timeout)) {
-                        if (!wait_for_completion_timeout(
+                        mlx5_ib_warn(
-                                        &odp->notifier_completion,
+                                dev,
-                                        timeout)) {
+                                "timeout waiting for mmu notifier. seq %d against %d. notifiers_count=%d\n",
-                                mlx5_ib_warn(dev, "timeout waiting for mmu notifier. seq %d against %d. notifiers_count=%d\n",
+                                current_seq, odp->notifiers_seq,
-                                             current_seq, odp->notifiers_seq, odp->notifiers_count);
+                                odp->notifiers_count);
-                        }
-                } else {
-                        /* The MR is being killed, kill the QP as well. */
-                        ret = -EFAULT;
                }
        }
@@ -1628,8 +1624,10 @@ int mlx5_ib_odp_init_one(struct mlx5_ib_dev *dev)
 {
        int ret = 0;
-        if (dev->odp_caps.general_caps & IB_ODP_SUPPORT)
+        if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
-                ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_odp_ops);
+                return ret;
+        ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_odp_ops);
        if (dev->odp_caps.general_caps & IB_ODP_SUPPORT_IMPLICIT) {
                ret = mlx5_cmd_null_mkey(dev->mdev, &dev->null_mkey);
@@ -1639,9 +1637,6 @@ int mlx5_ib_odp_init_one(struct mlx5_ib_dev *dev)
                }
        }
-        if (!MLX5_CAP_GEN(dev->mdev, pg))
-                return ret;
        ret = mlx5_ib_create_pf_eq(dev, &dev->odp_pf_eq);
        return ret;
@@ -1649,7 +1644,7 @@ int mlx5_ib_odp_init_one(struct mlx5_ib_dev *dev)
 void mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev *dev)
 {
-        if (!MLX5_CAP_GEN(dev->mdev, pg))
+        if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
                return;
        mlx5_ib_destroy_pf_eq(dev, &dev->odp_pf_eq);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 379328b2598f..72869ff4a334 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -4162,7 +4162,7 @@ static u64 get_xlt_octo(u64 bytes)
               MLX5_IB_UMR_OCTOWORD;
 }
-static __be64 frwr_mkey_mask(void)
+static __be64 frwr_mkey_mask(bool atomic)
 {
        u64 result;
@@ -4175,10 +4175,12 @@ static __be64 frwr_mkey_mask(void)
                MLX5_MKEY_MASK_LW               |
                MLX5_MKEY_MASK_RR               |
                MLX5_MKEY_MASK_RW               |
-                MLX5_MKEY_MASK_A                |
                MLX5_MKEY_MASK_SMALL_FENCE      |
                MLX5_MKEY_MASK_FREE;
+        if (atomic)
+                result |= MLX5_MKEY_MASK_A;
        return cpu_to_be64(result);
 }
@@ -4204,7 +4206,7 @@ static __be64 sig_mkey_mask(void)
 }
 static void set_reg_umr_seg(struct mlx5_wqe_umr_ctrl_seg *umr,
-                            struct mlx5_ib_mr *mr, u8 flags)
+                            struct mlx5_ib_mr *mr, u8 flags, bool atomic)
 {
        int size = (mr->ndescs + mr->meta_ndescs) * mr->desc_size;
@@ -4212,7 +4214,7 @@ static void set_reg_umr_seg(struct mlx5_wqe_umr_ctrl_seg *umr,
        umr->flags = flags;
        umr->xlt_octowords = cpu_to_be16(get_xlt_octo(size));
-        umr->mkey_mask = frwr_mkey_mask();
+        umr->mkey_mask = frwr_mkey_mask(atomic);
 }
 static void set_linv_umr_seg(struct mlx5_wqe_umr_ctrl_seg *umr)
@@ -4811,10 +4813,22 @@ static int set_reg_wr(struct mlx5_ib_qp *qp,
 {
        struct mlx5_ib_mr *mr = to_mmr(wr->mr);
        struct mlx5_ib_pd *pd = to_mpd(qp->ibqp.pd);
+        struct mlx5_ib_dev *dev = to_mdev(pd->ibpd.device);
        int mr_list_size = (mr->ndescs + mr->meta_ndescs) * mr->desc_size;
        bool umr_inline = mr_list_size <= MLX5_IB_SQ_UMR_INLINE_THRESHOLD;
+        bool atomic = wr->access & IB_ACCESS_REMOTE_ATOMIC;
        u8 flags = 0;
+        if (!mlx5_ib_can_use_umr(dev, atomic)) {
+                mlx5_ib_warn(to_mdev(qp->ibqp.device),
+                             "Fast update of %s for MR is disabled\n",
+                             (MLX5_CAP_GEN(dev->mdev,
+                                           umr_modify_entity_size_disabled)) ?
+                                     "entity size" :
+                                     "atomic access");
+                return -EINVAL;
+        }
        if (unlikely(wr->wr.send_flags & IB_SEND_INLINE)) {
                mlx5_ib_warn(to_mdev(qp->ibqp.device),
                             "Invalid IB_SEND_INLINE send flag\n");
@@ -4826,7 +4840,7 @@ static int set_reg_wr(struct mlx5_ib_qp *qp,
        if (umr_inline)
                flags |= MLX5_UMR_INLINE;
-        set_reg_umr_seg(*seg, mr, flags);
+        set_reg_umr_seg(*seg, mr, flags, atomic);
        *seg += sizeof(struct mlx5_wqe_umr_ctrl_seg);
        *size += sizeof(struct mlx5_wqe_umr_ctrl_seg) / 16;
        handle_post_send_edge(&qp->sq, seg, *size, cur_edge);
diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig
index dace276aea14..b622fc62f2cd 100644
--- a/drivers/infiniband/sw/siw/Kconfig
+++ b/drivers/infiniband/sw/siw/Kconfig
@@ -1,6 +1,6 @@
 config RDMA_SIW
        tristate "Software RDMA over TCP/IP (iWARP) driver"
-        depends on INET && INFINIBAND && LIBCRC32C && 64BIT
+        depends on INET && INFINIBAND && LIBCRC32C
        select DMA_VIRT_OPS
        help
        This driver implements the iWARP RDMA transport over
diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
index 03fd7b2f595f..dba4535494ab 100644
--- a/drivers/infiniband/sw/siw/siw.h
+++ b/drivers/infiniband/sw/siw/siw.h
@@ -138,9 +138,9 @@ struct siw_umem {
 };
 struct siw_pble {
-        u64 addr; /* Address of assigned user buffer */
+        dma_addr_t addr; /* Address of assigned buffer */
-        u64 size; /* Size of this entry */
+        unsigned int size; /* Size of this entry */
-        u64 pbl_off; /* Total offset from start of PBL */
+        unsigned long pbl_off; /* Total offset from start of PBL */
 };
 struct siw_pbl {
@@ -214,7 +214,7 @@ struct siw_wqe {
 struct siw_cq {
        struct ib_cq base_cq;
        spinlock_t lock;
-        u64 *notify;
+        struct siw_cq_ctrl *notify;
        struct siw_cqe *queue;
        u32 cq_put;
        u32 cq_get;
@@ -734,7 +734,7 @@ static inline void siw_crc_skb(struct siw_rx_stream *srx, unsigned int len)
                  "MEM[0x%08x] %s: " fmt, mem->stag, __func__, ##__VA_ARGS__)
 #define siw_dbg_cep(cep, fmt, ...)                                             \
-        ibdev_dbg(&cep->sdev->base_dev, "CEP[0x%p] %s: " fmt,                  \
+        ibdev_dbg(&cep->sdev->base_dev, "CEP[0x%pK] %s: " fmt,                  \
                  cep, __func__, ##__VA_ARGS__)
 void siw_cq_flush(struct siw_cq *cq);
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 9ce8a1b925d2..8c1931a57f4a 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -355,8 +355,8 @@ static int siw_cm_upcall(struct siw_cep *cep, enum iw_cm_event_type reason,
                getname_local(cep->sock, &event.local_addr);
                getname_peer(cep->sock, &event.remote_addr);
        }
-        siw_dbg_cep(cep, "[QP %u]: id 0x%p, reason=%d, status=%d\n",
+        siw_dbg_cep(cep, "[QP %u]: reason=%d, status=%d\n",
-                    cep->qp ? qp_id(cep->qp) : -1, id, reason, status);
+                    cep->qp ? qp_id(cep->qp) : UINT_MAX, reason, status);
        return id->event_handler(id, &event);
 }
@@ -947,8 +947,6 @@ static void siw_accept_newconn(struct siw_cep *cep)
        siw_cep_get(new_cep);
        new_s->sk->sk_user_data = new_cep;
-        siw_dbg_cep(cep, "listen socket 0x%p, new 0x%p\n", s, new_s);
        if (siw_tcp_nagle == false) {
                int val = 1;
@@ -1011,7 +1009,8 @@ static void siw_cm_work_handler(struct work_struct *w)
        cep = work->cep;
        siw_dbg_cep(cep, "[QP %u]: work type: %d, state %d\n",
-                    cep->qp ? qp_id(cep->qp) : -1, work->type, cep->state);
+                    cep->qp ? qp_id(cep->qp) : UINT_MAX,
+                    work->type, cep->state);
        siw_cep_set_inuse(cep);
@@ -1145,9 +1144,9 @@ static void siw_cm_work_handler(struct work_struct *w)
        }
        if (release_cep) {
                siw_dbg_cep(cep,
-                            "release: timer=%s, QP[%u], id 0x%p\n",
+                            "release: timer=%s, QP[%u]\n",
                            cep->mpa_timer ? "y" : "n",
-                            cep->qp ? qp_id(cep->qp) : -1, cep->cm_id);
+                            cep->qp ? qp_id(cep->qp) : UINT_MAX);
                siw_cancel_mpatimer(cep);
@@ -1211,8 +1210,8 @@ int siw_cm_queue_work(struct siw_cep *cep, enum siw_work_type type)
                else
                        delay = MPAREP_TIMEOUT;
        }
-        siw_dbg_cep(cep, "[QP %u]: work type: %d, work 0x%p, timeout %lu\n",
+        siw_dbg_cep(cep, "[QP %u]: work type: %d, timeout %lu\n",
-                    cep->qp ? qp_id(cep->qp) : -1, type, work, delay);
+                    cep->qp ? qp_id(cep->qp) : -1, type, delay);
        queue_delayed_work(siw_cm_wq, &work->work, delay);
@@ -1376,16 +1375,16 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
        }
        if (v4)
                siw_dbg_qp(qp,
-                           "id 0x%p, pd_len %d, laddr %pI4 %d, raddr %pI4 %d\n",
+                           "pd_len %d, laddr %pI4 %d, raddr %pI4 %d\n",
-                           id, pd_len,
+                           pd_len,
                           &((struct sockaddr_in *)(laddr))->sin_addr,
                           ntohs(((struct sockaddr_in *)(laddr))->sin_port),
                           &((struct sockaddr_in *)(raddr))->sin_addr,
                           ntohs(((struct sockaddr_in *)(raddr))->sin_port));
        else
                siw_dbg_qp(qp,
-                           "id 0x%p, pd_len %d, laddr %pI6 %d, raddr %pI6 %d\n",
+                           "pd_len %d, laddr %pI6 %d, raddr %pI6 %d\n",
-                           id, pd_len,
+                           pd_len,
                           &((struct sockaddr_in6 *)(laddr))->sin6_addr,
                           ntohs(((struct sockaddr_in6 *)(laddr))->sin6_port),
                           &((struct sockaddr_in6 *)(raddr))->sin6_addr,
@@ -1508,14 +1507,13 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
        if (rv >= 0) {
                rv = siw_cm_queue_work(cep, SIW_CM_WORK_MPATIMEOUT);
                if (!rv) {
-                        siw_dbg_cep(cep, "id 0x%p, [QP %u]: exit\n", id,
+                        siw_dbg_cep(cep, "[QP %u]: exit\n", qp_id(qp));
-                                    qp_id(qp));
                        siw_cep_set_free(cep);
                        return 0;
                }
        }
 error:
-        siw_dbg_qp(qp, "failed: %d\n", rv);
+        siw_dbg(id->device, "failed: %d\n", rv);
        if (cep) {
                siw_socket_disassoc(s);
@@ -1540,7 +1538,8 @@ error:
        } else if (s) {
                sock_release(s);
        }
-        siw_qp_put(qp);
+        if (qp)
+                siw_qp_put(qp);
        return rv;
 }
@@ -1580,7 +1579,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
        siw_cancel_mpatimer(cep);
        if (cep->state != SIW_EPSTATE_RECVD_MPAREQ) {
-                siw_dbg_cep(cep, "id 0x%p: out of state\n", id);
+                siw_dbg_cep(cep, "out of state\n");
                siw_cep_set_free(cep);
                siw_cep_put(cep);
@@ -1601,7 +1600,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
                up_write(&qp->state_lock);
                goto error;
        }
-        siw_dbg_cep(cep, "id 0x%p\n", id);
+        siw_dbg_cep(cep, "[QP %d]\n", params->qpn);
        if (try_gso && cep->mpa.hdr.params.bits & MPA_RR_FLAG_GSO_EXP) {
                siw_dbg_cep(cep, "peer allows GSO on TX\n");
@@ -1611,8 +1610,8 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
            params->ird > sdev->attrs.max_ird) {
                siw_dbg_cep(
                        cep,
-                        "id 0x%p, [QP %u]: ord %d (max %d), ird %d (max %d)\n",
+                        "[QP %u]: ord %d (max %d), ird %d (max %d)\n",
-                        id, qp_id(qp), params->ord, sdev->attrs.max_ord,
+                        qp_id(qp), params->ord, sdev->attrs.max_ord,
                        params->ird, sdev->attrs.max_ird);
                rv = -EINVAL;
                up_write(&qp->state_lock);
@@ -1624,8 +1623,8 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
        if (params->private_data_len > max_priv_data) {
                siw_dbg_cep(
                        cep,
-                        "id 0x%p, [QP %u]: private data length: %d (max %d)\n",
+                        "[QP %u]: private data length: %d (max %d)\n",
-                        id, qp_id(qp), params->private_data_len, max_priv_data);
+                        qp_id(qp), params->private_data_len, max_priv_data);
                rv = -EINVAL;
                up_write(&qp->state_lock);
                goto error;
@@ -1679,7 +1678,7 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
                qp_attrs.flags = SIW_MPA_CRC;
        qp_attrs.state = SIW_QP_STATE_RTS;
-        siw_dbg_cep(cep, "id 0x%p, [QP%u]: moving to rts\n", id, qp_id(qp));
+        siw_dbg_cep(cep, "[QP%u]: moving to rts\n", qp_id(qp));
        /* Associate QP with CEP */
        siw_cep_get(cep);
@@ -1700,8 +1699,8 @@ int siw_accept(struct iw_cm_id *id, struct iw_cm_conn_param *params)
        if (rv)
                goto error;
-        siw_dbg_cep(cep, "id 0x%p, [QP %u]: send mpa reply, %d byte pdata\n",
+        siw_dbg_cep(cep, "[QP %u]: send mpa reply, %d byte pdata\n",
-                    id, qp_id(qp), params->private_data_len);
+                    qp_id(qp), params->private_data_len);
        rv = siw_send_mpareqrep(cep, params->private_data,
                                params->private_data_len);
@@ -1759,14 +1758,14 @@ int siw_reject(struct iw_cm_id *id, const void *pdata, u8 pd_len)
        siw_cancel_mpatimer(cep);
        if (cep->state != SIW_EPSTATE_RECVD_MPAREQ) {
-                siw_dbg_cep(cep, "id 0x%p: out of state\n", id);
+                siw_dbg_cep(cep, "out of state\n");
                siw_cep_set_free(cep);
                siw_cep_put(cep); /* put last reference */
                return -ECONNRESET;
        }
-        siw_dbg_cep(cep, "id 0x%p, cep->state %d, pd_len %d\n", id, cep->state,
+        siw_dbg_cep(cep, "cep->state %d, pd_len %d\n", cep->state,
                    pd_len);
        if (__mpa_rr_revision(cep->mpa.hdr.params.bits) >= MPA_REVISION_1) {
@@ -1804,14 +1803,14 @@ static int siw_listen_address(struct iw_cm_id *id, int backlog,
        rv = kernel_setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (char *)&s_val,
                               sizeof(s_val));
        if (rv) {
-                siw_dbg(id->device, "id 0x%p: setsockopt error: %d\n", id, rv);
+                siw_dbg(id->device, "setsockopt error: %d\n", rv);
                goto error;
        }
        rv = s->ops->bind(s, laddr, addr_family == AF_INET ?
                                    sizeof(struct sockaddr_in) :
                                    sizeof(struct sockaddr_in6));
        if (rv) {
-                siw_dbg(id->device, "id 0x%p: socket bind error: %d\n", id, rv);
+                siw_dbg(id->device, "socket bind error: %d\n", rv);
                goto error;
        }
        cep = siw_cep_alloc(sdev);
@@ -1824,13 +1823,13 @@ static int siw_listen_address(struct iw_cm_id *id, int backlog,
        rv = siw_cm_alloc_work(cep, backlog);
        if (rv) {
                siw_dbg(id->device,
-                        "id 0x%p: alloc_work error %d, backlog %d\n", id,
+                        "alloc_work error %d, backlog %d\n",
                        rv, backlog);
                goto error;
        }
        rv = s->ops->listen(s, backlog);
        if (rv) {
-                siw_dbg(id->device, "id 0x%p: listen error %d\n", id, rv);
+                siw_dbg(id->device, "listen error %d\n", rv);
                goto error;
        }
        cep->cm_id = id;
@@ -1914,8 +1913,7 @@ static void siw_drop_listeners(struct iw_cm_id *id)
                list_del(p);
-                siw_dbg_cep(cep, "id 0x%p: drop cep, state %d\n", id,
+                siw_dbg_cep(cep, "drop cep, state %d\n", cep->state);
-                            cep->state);
                siw_cep_set_inuse(cep);
@@ -1952,7 +1950,7 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
        struct net_device *dev = to_siw_dev(id->device)->netdev;
        int rv = 0, listeners = 0;
-        siw_dbg(id->device, "id 0x%p: backlog %d\n", id, backlog);
+        siw_dbg(id->device, "backlog %d\n", backlog);
        /*
         * For each attached address of the interface, create a
@@ -1964,12 +1962,16 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
                struct sockaddr_in s_laddr, *s_raddr;
                const struct in_ifaddr *ifa;
+                if (!in_dev) {
+                        rv = -ENODEV;
+                        goto out;
+                }
                memcpy(&s_laddr, &id->local_addr, sizeof(s_laddr));
                s_raddr = (struct sockaddr_in *)&id->remote_addr;
                siw_dbg(id->device,
-                        "id 0x%p: laddr %pI4:%d, raddr %pI4:%d\n",
+                        "laddr %pI4:%d, raddr %pI4:%d\n",
-                        id, &s_laddr.sin_addr, ntohs(s_laddr.sin_port),
+                        &s_laddr.sin_addr, ntohs(s_laddr.sin_port),
                        &s_raddr->sin_addr, ntohs(s_raddr->sin_port));
                rtnl_lock();
@@ -1993,22 +1995,27 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
                struct sockaddr_in6 *s_laddr = &to_sockaddr_in6(id->local_addr),
                        *s_raddr = &to_sockaddr_in6(id->remote_addr);
+                if (!in6_dev) {
+                        rv = -ENODEV;
+                        goto out;
+                }
                siw_dbg(id->device,
-                        "id 0x%p: laddr %pI6:%d, raddr %pI6:%d\n",
+                        "laddr %pI6:%d, raddr %pI6:%d\n",
-                        id, &s_laddr->sin6_addr, ntohs(s_laddr->sin6_port),
+                        &s_laddr->sin6_addr, ntohs(s_laddr->sin6_port),
                        &s_raddr->sin6_addr, ntohs(s_raddr->sin6_port));
-                read_lock_bh(&in6_dev->lock);
+                rtnl_lock();
                list_for_each_entry(ifp, &in6_dev->addr_list, if_list) {
-                        struct sockaddr_in6 bind_addr;
+                        if (ifp->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
+                                continue;
                        if (ipv6_addr_any(&s_laddr->sin6_addr) ||
                            ipv6_addr_equal(&s_laddr->sin6_addr, &ifp->addr)) {
-                                bind_addr.sin6_family = AF_INET6;
+                                struct sockaddr_in6 bind_addr  = {
-                                bind_addr.sin6_port = s_laddr->sin6_port;
+                                        .sin6_family = AF_INET6,
-                                bind_addr.sin6_flowinfo = 0;
+                                        .sin6_port = s_laddr->sin6_port,
-                                bind_addr.sin6_addr = ifp->addr;
+                                        .sin6_flowinfo = 0,
-                                bind_addr.sin6_scope_id = dev->ifindex;
+                                        .sin6_addr = ifp->addr,
+                                        .sin6_scope_id = dev->ifindex };
                                rv = siw_listen_address(id, backlog,
                                                (struct sockaddr *)&bind_addr,
@@ -2017,28 +2024,26 @@ int siw_create_listen(struct iw_cm_id *id, int backlog)
                                        listeners++;
                        }
                }
-                read_unlock_bh(&in6_dev->lock);
+                rtnl_unlock();
                in6_dev_put(in6_dev);
        } else {
-                return -EAFNOSUPPORT;
+                rv = -EAFNOSUPPORT;
        }
+out:
        if (listeners)
                rv = 0;
        else if (!rv)
                rv = -EINVAL;
-        siw_dbg(id->device, "id 0x%p: %s\n", id, rv ? "FAIL" : "OK");
+        siw_dbg(id->device, "%s\n", rv ? "FAIL" : "OK");
        return rv;
 }
 int siw_destroy_listen(struct iw_cm_id *id)
 {
-        siw_dbg(id->device, "id 0x%p\n", id);
        if (!id->provider_data) {
-                siw_dbg(id->device, "id 0x%p: no cep(s)\n", id);
+                siw_dbg(id->device, "no cep(s)\n");
                return 0;
        }
        siw_drop_listeners(id);
diff --git a/drivers/infiniband/sw/siw/siw_cq.c b/drivers/infiniband/sw/siw/siw_cq.c
index e381ae9b7d62..d8db3bee9da7 100644
--- a/drivers/infiniband/sw/siw/siw_cq.c
+++ b/drivers/infiniband/sw/siw/siw_cq.c
@@ -71,9 +71,10 @@ int siw_reap_cqe(struct siw_cq *cq, struct ib_wc *wc)
                                wc->wc_flags = IB_WC_WITH_INVALIDATE;
                        }
                        wc->qp = cqe->base_qp;
-                        siw_dbg_cq(cq, "idx %u, type %d, flags %2x, id 0x%p\n",
+                        siw_dbg_cq(cq,
+                                   "idx %u, type %d, flags %2x, id 0x%pK\n",
                                   cq->cq_get % cq->num_cqe, cqe->opcode,
-                                   cqe->flags, (void *)cqe->id);
+                                   cqe->flags, (void *)(uintptr_t)cqe->id);
                }
                WRITE_ONCE(cqe->flags, 0);
                cq->cq_get++;
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index d0f140daf659..05a92f997f60 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -160,10 +160,8 @@ static int siw_init_cpulist(void)
 out_err:
        siw_cpu_info.num_nodes = 0;
-        while (i) {
+        while (--i >= 0)
                kfree(siw_cpu_info.tx_valid_cpus[i]);
-                siw_cpu_info.tx_valid_cpus[i--] = NULL;
-        }
        kfree(siw_cpu_info.tx_valid_cpus);
        siw_cpu_info.tx_valid_cpus = NULL;
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 67171c82b0c4..87a56039f0ef 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -197,12 +197,12 @@ int siw_check_mem(struct ib_pd *pd, struct siw_mem *mem, u64 addr,
         */
        if (addr < mem->va || addr + len > mem->va + mem->len) {
                siw_dbg_pd(pd, "MEM interval len %d\n", len);
-                siw_dbg_pd(pd, "[0x%016llx, 0x%016llx] out of bounds\n",
+                siw_dbg_pd(pd, "[0x%pK, 0x%pK] out of bounds\n",
-                           (unsigned long long)addr,
+                           (void *)(uintptr_t)addr,
-                           (unsigned long long)(addr + len));
+                           (void *)(uintptr_t)(addr + len));
-                siw_dbg_pd(pd, "[0x%016llx, 0x%016llx] STag=0x%08x\n",
+                siw_dbg_pd(pd, "[0x%pK, 0x%pK] STag=0x%08x\n",
-                           (unsigned long long)mem->va,
+                           (void *)(uintptr_t)mem->va,
-                           (unsigned long long)(mem->va + mem->len),
+                           (void *)(uintptr_t)(mem->va + mem->len),
                           mem->stag);
                return -E_BASE_BOUNDS;
@@ -330,7 +330,7 @@ out:
 * Optionally, provides remaining len within current element, and
 * current PBL index for later resume at same element.
 */
-u64 siw_pbl_get_buffer(struct siw_pbl *pbl, u64 off, int *len, int *idx)
+dma_addr_t siw_pbl_get_buffer(struct siw_pbl *pbl, u64 off, int *len, int *idx)
 {
        int i = idx ? *idx : 0;
diff --git a/drivers/infiniband/sw/siw/siw_mem.h b/drivers/infiniband/sw/siw/siw_mem.h
index f43daf280891..db138c8423da 100644
--- a/drivers/infiniband/sw/siw/siw_mem.h
+++ b/drivers/infiniband/sw/siw/siw_mem.h
@@ -9,7 +9,7 @@
 struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable);
 void siw_umem_release(struct siw_umem *umem, bool dirty);
 struct siw_pbl *siw_pbl_alloc(u32 num_buf);
-u64 siw_pbl_get_buffer(struct siw_pbl *pbl, u64 off, int *len, int *idx);
+dma_addr_t siw_pbl_get_buffer(struct siw_pbl *pbl, u64 off, int *len, int *idx);
 struct siw_mem *siw_mem_id2obj(struct siw_device *sdev, int stag_index);
 int siw_mem_add(struct siw_device *sdev, struct siw_mem *m);
 int siw_invalidate_stag(struct ib_pd *pd, u32 stag);
diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
index e27bd5b35b96..430314c8abd9 100644
--- a/drivers/infiniband/sw/siw/siw_qp.c
+++ b/drivers/infiniband/sw/siw/siw_qp.c
@@ -949,7 +949,7 @@ skip_irq:
                                rv = -EINVAL;
                                goto out;
                        }
-                        wqe->sqe.sge[0].laddr = (u64)&wqe->sqe.sge[1];
+                        wqe->sqe.sge[0].laddr = (uintptr_t)&wqe->sqe.sge[1];
                        wqe->sqe.sge[0].lkey = 0;
                        wqe->sqe.num_sge = 1;
                }
@@ -1013,18 +1013,24 @@ out:
 */
 static bool siw_cq_notify_now(struct siw_cq *cq, u32 flags)
 {
-        u64 cq_notify;
+        u32 cq_notify;
        if (!cq->base_cq.comp_handler)
                return false;
-        cq_notify = READ_ONCE(*cq->notify);
+        /* Read application shared notification state */
+        cq_notify = READ_ONCE(cq->notify->flags);
        if ((cq_notify & SIW_NOTIFY_NEXT_COMPLETION) ||
            ((cq_notify & SIW_NOTIFY_SOLICITED) &&
             (flags & SIW_WQE_SOLICITED))) {
-                /* dis-arm CQ */
+                /*
-                smp_store_mb(*cq->notify, SIW_NOTIFY_NOT);
+                 * CQ notification is one-shot: Since the
+                 * current CQE causes user notification,
+                 * the CQ gets dis-aremd and must be re-aremd
+                 * by the user for a new notification.
+                 */
+                WRITE_ONCE(cq->notify->flags, SIW_NOTIFY_NOT);
                return true;
        }
diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
index f87657a11657..c0a887240325 100644
--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
@@ -38,9 +38,10 @@ static int siw_rx_umem(struct siw_rx_stream *srx, struct siw_umem *umem,
                p = siw_get_upage(umem, dest_addr);
                if (unlikely(!p)) {
-                        pr_warn("siw: %s: [QP %u]: bogus addr: %p, %p\n",
+                        pr_warn("siw: %s: [QP %u]: bogus addr: %pK, %pK\n",
                                __func__, qp_id(rx_qp(srx)),
-                                (void *)dest_addr, (void *)umem->fp_addr);
+                                (void *)(uintptr_t)dest_addr,
+                                (void *)(uintptr_t)umem->fp_addr);
                        /* siw internal error */
                        srx->skb_copied += copied;
                        srx->skb_new -= copied;
@@ -50,7 +51,7 @@ static int siw_rx_umem(struct siw_rx_stream *srx, struct siw_umem *umem,
                pg_off = dest_addr & ~PAGE_MASK;
                bytes = min(len, (int)PAGE_SIZE - pg_off);
-                siw_dbg_qp(rx_qp(srx), "page %p, bytes=%u\n", p, bytes);
+                siw_dbg_qp(rx_qp(srx), "page %pK, bytes=%u\n", p, bytes);
                dest = kmap_atomic(p);
                rv = skb_copy_bits(srx->skb, srx->skb_offset, dest + pg_off,
@@ -104,11 +105,11 @@ static int siw_rx_kva(struct siw_rx_stream *srx, void *kva, int len)
 {
        int rv;
-        siw_dbg_qp(rx_qp(srx), "kva: 0x%p, len: %u\n", kva, len);
+        siw_dbg_qp(rx_qp(srx), "kva: 0x%pK, len: %u\n", kva, len);
        rv = skb_copy_bits(srx->skb, srx->skb_offset, kva, len);
        if (unlikely(rv)) {
-                pr_warn("siw: [QP %u]: %s, len %d, kva 0x%p, rv %d\n",
+                pr_warn("siw: [QP %u]: %s, len %d, kva 0x%pK, rv %d\n",
                        qp_id(rx_qp(srx)), __func__, len, kva, rv);
                return rv;
@@ -132,7 +133,7 @@ static int siw_rx_pbl(struct siw_rx_stream *srx, int *pbl_idx,
        while (len) {
                int bytes;
-                u64 buf_addr =
+                dma_addr_t buf_addr =
                        siw_pbl_get_buffer(pbl, offset, &bytes, pbl_idx);
                if (!buf_addr)
                        break;
@@ -485,8 +486,8 @@ int siw_proc_send(struct siw_qp *qp)
                mem_p = *mem;
                if (mem_p->mem_obj == NULL)
                        rv = siw_rx_kva(srx,
-                                        (void *)(sge->laddr + frx->sge_off),
+                                (void *)(uintptr_t)(sge->laddr + frx->sge_off),
-                                        sge_bytes);
+                                sge_bytes);
                else if (!mem_p->is_pbl)
                        rv = siw_rx_umem(srx, mem_p->umem,
                                         sge->laddr + frx->sge_off, sge_bytes);
@@ -598,8 +599,8 @@ int siw_proc_write(struct siw_qp *qp)
        if (mem->mem_obj == NULL)
                rv = siw_rx_kva(srx,
-                                (void *)(srx->ddp_to + srx->fpdu_part_rcvd),
+                        (void *)(uintptr_t)(srx->ddp_to + srx->fpdu_part_rcvd),
-                                bytes);
+                        bytes);
        else if (!mem->is_pbl)
                rv = siw_rx_umem(srx, mem->umem,
                                 srx->ddp_to + srx->fpdu_part_rcvd, bytes);
@@ -841,8 +842,9 @@ int siw_proc_rresp(struct siw_qp *qp)
        bytes = min(srx->fpdu_part_rem, srx->skb_new);
        if (mem_p->mem_obj == NULL)
-                rv = siw_rx_kva(srx, (void *)(sge->laddr + wqe->processed),
+                rv = siw_rx_kva(srx,
-                                bytes);
+                        (void *)(uintptr_t)(sge->laddr + wqe->processed),
+                        bytes);
        else if (!mem_p->is_pbl)
                rv = siw_rx_umem(srx, mem_p->umem, sge->laddr + wqe->processed,
                                 bytes);
diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
index 43020d2040fc..438a2917a47c 100644
--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
@@ -26,7 +26,7 @@ static struct page *siw_get_pblpage(struct siw_mem *mem, u64 addr, int *idx)
 {
        struct siw_pbl *pbl = mem->pbl;
        u64 offset = addr - mem->va;
-        u64 paddr = siw_pbl_get_buffer(pbl, offset, NULL, idx);
+        dma_addr_t paddr = siw_pbl_get_buffer(pbl, offset, NULL, idx);
        if (paddr)
                return virt_to_page(paddr);
@@ -37,7 +37,7 @@ static struct page *siw_get_pblpage(struct siw_mem *mem, u64 addr, int *idx)
 /*
 * Copy short payload at provided destination payload address
 */
-static int siw_try_1seg(struct siw_iwarp_tx *c_tx, u64 paddr)
+static int siw_try_1seg(struct siw_iwarp_tx *c_tx, void *paddr)
 {
        struct siw_wqe *wqe = &c_tx->wqe_active;
        struct siw_sge *sge = &wqe->sqe.sge[0];
@@ -50,16 +50,16 @@ static int siw_try_1seg(struct siw_iwarp_tx *c_tx, u64 paddr)
                return 0;
        if (tx_flags(wqe) & SIW_WQE_INLINE) {
-                memcpy((void *)paddr, &wqe->sqe.sge[1], bytes);
+                memcpy(paddr, &wqe->sqe.sge[1], bytes);
        } else {
                struct siw_mem *mem = wqe->mem[0];
                if (!mem->mem_obj) {
                        /* Kernel client using kva */
-                        memcpy((void *)paddr, (void *)sge->laddr, bytes);
+                        memcpy(paddr,
+                               (const void *)(uintptr_t)sge->laddr, bytes);
                } else if (c_tx->in_syscall) {
-                        if (copy_from_user((void *)paddr,
+                        if (copy_from_user(paddr, u64_to_user_ptr(sge->laddr),
-                                           (const void __user *)sge->laddr,
                                           bytes))
                                return -EFAULT;
                } else {
@@ -79,12 +79,12 @@ static int siw_try_1seg(struct siw_iwarp_tx *c_tx, u64 paddr)
                        buffer = kmap_atomic(p);
                        if (likely(PAGE_SIZE - off >= bytes)) {
-                                memcpy((void *)paddr, buffer + off, bytes);
+                                memcpy(paddr, buffer + off, bytes);
                                kunmap_atomic(buffer);
                        } else {
                                unsigned long part = bytes - (PAGE_SIZE - off);
-                                memcpy((void *)paddr, buffer + off, part);
+                                memcpy(paddr, buffer + off, part);
                                kunmap_atomic(buffer);
                                if (!mem->is_pbl)
@@ -98,7 +98,7 @@ static int siw_try_1seg(struct siw_iwarp_tx *c_tx, u64 paddr)
                                        return -EFAULT;
                                buffer = kmap_atomic(p);
-                                memcpy((void *)(paddr + part), buffer,
+                                memcpy(paddr + part, buffer,
                                       bytes - part);
                                kunmap_atomic(buffer);
                        }
@@ -166,7 +166,7 @@ static int siw_qp_prepare_tx(struct siw_iwarp_tx *c_tx)
                c_tx->ctrl_len = sizeof(struct iwarp_send);
                crc = (char *)&c_tx->pkt.send_pkt.crc;
-                data = siw_try_1seg(c_tx, (u64)crc);
+                data = siw_try_1seg(c_tx, crc);
                break;
        case SIW_OP_SEND_REMOTE_INV:
@@ -189,7 +189,7 @@ static int siw_qp_prepare_tx(struct siw_iwarp_tx *c_tx)
                c_tx->ctrl_len = sizeof(struct iwarp_send_inv);
                crc = (char *)&c_tx->pkt.send_pkt.crc;
-                data = siw_try_1seg(c_tx, (u64)crc);
+                data = siw_try_1seg(c_tx, crc);
                break;
        case SIW_OP_WRITE:
@@ -201,7 +201,7 @@ static int siw_qp_prepare_tx(struct siw_iwarp_tx *c_tx)
                c_tx->ctrl_len = sizeof(struct iwarp_rdma_write);
                crc = (char *)&c_tx->pkt.write_pkt.crc;
-                data = siw_try_1seg(c_tx, (u64)crc);
+                data = siw_try_1seg(c_tx, crc);
                break;
        case SIW_OP_READ_RESPONSE:
@@ -216,7 +216,7 @@ static int siw_qp_prepare_tx(struct siw_iwarp_tx *c_tx)
                c_tx->ctrl_len = sizeof(struct iwarp_rdma_rresp);
                crc = (char *)&c_tx->pkt.write_pkt.crc;
-                data = siw_try_1seg(c_tx, (u64)crc);
+                data = siw_try_1seg(c_tx, crc);
                break;
        default:
@@ -398,15 +398,13 @@ static int siw_0copy_tx(struct socket *s, struct page **page,
 #define MAX_TRAILER (MPA_CRC_SIZE + 4)
-static void siw_unmap_pages(struct page **pages, int hdr_len, int num_maps)
+static void siw_unmap_pages(struct page **pp, unsigned long kmap_mask)
 {
-        if (hdr_len) {
+        while (kmap_mask) {
-                ++pages;
+                if (kmap_mask & BIT(0))
-                --num_maps;
+                        kunmap(*pp);
-        }
+                pp++;
-        while (num_maps-- > 0) {
+                kmap_mask >>= 1;
-                kunmap(*pages);
-                pages++;
        }
 }
@@ -437,6 +435,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
        unsigned int data_len = c_tx->bytes_unsent, hdr_len = 0, trl_len = 0,
                     sge_off = c_tx->sge_off, sge_idx = c_tx->sge_idx,
                     pbl_idx = c_tx->pbl_idx;
+        unsigned long kmap_mask = 0L;
        if (c_tx->state == SIW_SEND_HDR) {
                if (c_tx->use_sendpage) {
@@ -463,8 +462,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                if (!(tx_flags(wqe) & SIW_WQE_INLINE)) {
                        mem = wqe->mem[sge_idx];
-                        if (!mem->mem_obj)
+                        is_kva = mem->mem_obj == NULL ? 1 : 0;
-                                is_kva = 1;
                } else {
                        is_kva = 1;
                }
@@ -473,7 +471,8 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                         * tx from kernel virtual address: either inline data
                         * or memory region with assigned kernel buffer
                         */
-                        iov[seg].iov_base = (void *)(sge->laddr + sge_off);
+                        iov[seg].iov_base =
+                                (void *)(uintptr_t)(sge->laddr + sge_off);
                        iov[seg].iov_len = sge_len;
                        if (do_crc)
@@ -500,12 +499,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                                        p = siw_get_upage(mem->umem,
                                                          sge->laddr + sge_off);
                                if (unlikely(!p)) {
-                                        if (hdr_len)
+                                        siw_unmap_pages(page_array, kmap_mask);
-                                                seg--;
-                                        if (!c_tx->use_sendpage && seg) {
-                                                siw_unmap_pages(page_array,
-                                                                hdr_len, seg);
-                                        }
                                        wqe->processed -= c_tx->bytes_unsent;
                                        rv = -EFAULT;
                                        goto done_crc;
@@ -515,6 +509,10 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                                if (!c_tx->use_sendpage) {
                                        iov[seg].iov_base = kmap(p) + fp_off;
                                        iov[seg].iov_len = plen;
+                                        /* Remember for later kunmap() */
+                                        kmap_mask |= BIT(seg);
                                        if (do_crc)
                                                crypto_shash_update(
                                                        c_tx->mpa_crc_hd,
@@ -526,13 +524,13 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                                                page_address(p) + fp_off,
                                                plen);
                        } else {
-                                u64 pa = ((sge->laddr + sge_off) & PAGE_MASK);
+                                u64 va = sge->laddr + sge_off;
-                                page_array[seg] = virt_to_page(pa);
+                                page_array[seg] = virt_to_page(va & PAGE_MASK);
                                if (do_crc)
                                        crypto_shash_update(
                                                c_tx->mpa_crc_hd,
-                                                (void *)(sge->laddr + sge_off),
+                                                (void *)(uintptr_t)va,
                                                plen);
                        }
@@ -543,10 +541,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
                        if (++seg > (int)MAX_ARRAY) {
                                siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
-                                if (!is_kva && !c_tx->use_sendpage) {
+                                siw_unmap_pages(page_array, kmap_mask);
-                                        siw_unmap_pages(page_array, hdr_len,
-                                                        seg - 1);
-                                }
                                wqe->processed -= c_tx->bytes_unsent;
                                rv = -EMSGSIZE;
                                goto done_crc;
@@ -597,8 +592,7 @@ sge_done:
        } else {
                rv = kernel_sendmsg(s, &msg, iov, seg + 1,
                                    hdr_len + data_len + trl_len);
-                if (!is_kva)
+                siw_unmap_pages(page_array, kmap_mask);
-                        siw_unmap_pages(page_array, hdr_len, seg);
        }
        if (rv < (int)hdr_len) {
                /* Not even complete hdr pushed or negative rv */
@@ -829,7 +823,8 @@ static int siw_qp_sq_proc_tx(struct siw_qp *qp, struct siw_wqe *wqe)
                                        rv = -EINVAL;
                                        goto tx_error;
                                }
-                                wqe->sqe.sge[0].laddr = (u64)&wqe->sqe.sge[1];
+                                wqe->sqe.sge[0].laddr =
+                                        (u64)(uintptr_t)&wqe->sqe.sge[1];
                        }
                }
                wqe->wr_status = SIW_WR_INPROGRESS;
@@ -924,7 +919,7 @@ tx_error:
 static int siw_fastreg_mr(struct ib_pd *pd, struct siw_sqe *sqe)
 {
-        struct ib_mr *base_mr = (struct ib_mr *)sqe->base_mr;
+        struct ib_mr *base_mr = (struct ib_mr *)(uintptr_t)sqe->base_mr;
        struct siw_device *sdev = to_siw_dev(pd->device);
        struct siw_mem *mem = siw_mem_id2obj(sdev, sqe->rkey  >> 8);
        int rv = 0;
@@ -954,8 +949,7 @@ static int siw_fastreg_mr(struct ib_pd *pd, struct siw_sqe *sqe)
        mem->stag = sqe->rkey;
        mem->perms = sqe->access;
-        siw_dbg_mem(mem, "STag now valid, MR va: 0x%016llx -> 0x%016llx\n",
+        siw_dbg_mem(mem, "STag 0x%08x now valid\n", sqe->rkey);
-                    mem->va, base_mr->iova);
        mem->va = base_mr->iova;
        mem->stag_valid = 1;
 out:
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 32dc79d0e898..da52c90e06d4 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -424,8 +424,7 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
                 */
                qp->srq = to_siw_srq(attrs->srq);
                qp->attrs.rq_size = 0;
-                siw_dbg(base_dev, "QP [%u]: [SRQ 0x%p] attached\n",
+                siw_dbg(base_dev, "QP [%u]: SRQ attached\n", qp->qp_num);
-                        qp->qp_num, qp->srq);
        } else if (num_rqe) {
                if (qp->kernel_verbs)
                        qp->recvq = vzalloc(num_rqe * sizeof(struct siw_rqe));
@@ -610,7 +609,7 @@ int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
                                          base_ucontext);
        struct siw_qp_attrs qp_attrs;
-        siw_dbg_qp(qp, "state %d, cep 0x%p\n", qp->attrs.state, qp->cep);
+        siw_dbg_qp(qp, "state %d\n", qp->attrs.state);
        /*
         * Mark QP as in process of destruction to prevent from
@@ -662,7 +661,7 @@ static int siw_copy_inline_sgl(const struct ib_send_wr *core_wr,
        void *kbuf = &sqe->sge[1];
        int num_sge = core_wr->num_sge, bytes = 0;
-        sqe->sge[0].laddr = (u64)kbuf;
+        sqe->sge[0].laddr = (uintptr_t)kbuf;
        sqe->sge[0].lkey = 0;
        while (num_sge--) {
@@ -825,7 +824,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
                        break;
                case IB_WR_REG_MR:
-                        sqe->base_mr = (uint64_t)reg_wr(wr)->mr;
+                        sqe->base_mr = (uintptr_t)reg_wr(wr)->mr;
                        sqe->rkey = reg_wr(wr)->key;
                        sqe->access = reg_wr(wr)->access & IWARP_ACCESS_MASK;
                        sqe->opcode = SIW_OP_REG_MR;
@@ -842,8 +841,9 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
                        rv = -EINVAL;
                        break;
                }
-                siw_dbg_qp(qp, "opcode %d, flags 0x%x, wr_id 0x%p\n",
+                siw_dbg_qp(qp, "opcode %d, flags 0x%x, wr_id 0x%pK\n",
-                           sqe->opcode, sqe->flags, (void *)sqe->id);
+                           sqe->opcode, sqe->flags,
+                           (void *)(uintptr_t)sqe->id);
                if (unlikely(rv < 0))
                        break;
@@ -1049,7 +1049,7 @@ int siw_create_cq(struct ib_cq *base_cq, const struct ib_cq_init_attr *attr,
        spin_lock_init(&cq->lock);
-        cq->notify = &((struct siw_cq_ctrl *)&cq->queue[size])->notify;
+        cq->notify = (struct siw_cq_ctrl *)&cq->queue[size];
        if (udata) {
                struct siw_uresp_create_cq uresp = {};
@@ -1141,11 +1141,17 @@ int siw_req_notify_cq(struct ib_cq *base_cq, enum ib_cq_notify_flags flags)
        siw_dbg_cq(cq, "flags: 0x%02x\n", flags);
        if ((flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED)
-                /* CQ event for next solicited completion */
+                /*
-                smp_store_mb(*cq->notify, SIW_NOTIFY_SOLICITED);
+                 * Enable CQ event for next solicited completion.
+                 * and make it visible to all associated producers.
+                 */
+                smp_store_mb(cq->notify->flags, SIW_NOTIFY_SOLICITED);
        else
-                /* CQ event for any signalled completion */
+                /*
-                smp_store_mb(*cq->notify, SIW_NOTIFY_ALL);
+                 * Enable CQ event for any signalled completion.
+                 * and make it visible to all associated producers.
+                 */
+                smp_store_mb(cq->notify->flags, SIW_NOTIFY_ALL);
        if (flags & IB_CQ_REPORT_MISSED_EVENTS)
                return cq->cq_put - cq->cq_get;
@@ -1199,8 +1205,8 @@ struct ib_mr *siw_reg_user_mr(struct ib_pd *pd, u64 start, u64 len,
        unsigned long mem_limit = rlimit(RLIMIT_MEMLOCK);
        int rv;
-        siw_dbg_pd(pd, "start: 0x%016llx, va: 0x%016llx, len: %llu\n",
+        siw_dbg_pd(pd, "start: 0x%pK, va: 0x%pK, len: %llu\n",
-                   (unsigned long long)start, (unsigned long long)rnic_va,
+                   (void *)(uintptr_t)start, (void *)(uintptr_t)rnic_va,
                   (unsigned long long)len);
        if (atomic_inc_return(&sdev->num_mr) > SIW_MAX_MR) {
@@ -1357,7 +1363,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle,
        struct siw_mem *mem = mr->mem;
        struct siw_pbl *pbl = mem->pbl;
        struct siw_pble *pble;
-        u64 pbl_size;
+        unsigned long pbl_size;
        int i, rv;
        if (!pbl) {
@@ -1396,16 +1402,18 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle,
                        pbl_size += sg_dma_len(slp);
                }
                siw_dbg_mem(mem,
-                        "sge[%d], size %llu, addr 0x%016llx, total %llu\n",
+                        "sge[%d], size %u, addr 0x%p, total %lu\n",
-                        i, pble->size, pble->addr, pbl_size);
+                        i, pble->size, (void *)(uintptr_t)pble->addr,
+                        pbl_size);
        }
        rv = ib_sg_to_pages(base_mr, sl, num_sle, sg_off, siw_set_pbl_page);
        if (rv > 0) {
                mem->len = base_mr->length;
                mem->va = base_mr->iova;
                siw_dbg_mem(mem,
-                        "%llu bytes, start 0x%016llx, %u SLE to %u entries\n",
+                        "%llu bytes, start 0x%pK, %u SLE to %u entries\n",
-                        mem->len, mem->va, num_sle, pbl->num_buf);
+                        mem->len, (void *)(uintptr_t)mem->va, num_sle,
+                        pbl->num_buf);
        }
        return rv;
 }
@@ -1523,7 +1531,7 @@ int siw_create_srq(struct ib_srq *base_srq,
        }
        spin_lock_init(&srq->lock);
-        siw_dbg_pd(base_srq->pd, "[SRQ 0x%p]: success\n", srq);
+        siw_dbg_pd(base_srq->pd, "[SRQ]: success\n");
        return 0;
@@ -1644,8 +1652,7 @@ int siw_post_srq_recv(struct ib_srq *base_srq, const struct ib_recv_wr *wr,
        if (unlikely(!srq->kernel_verbs)) {
                siw_dbg_pd(base_srq->pd,
-                           "[SRQ 0x%p]: no kernel post_recv for mapped srq\n",
+                           "[SRQ]: no kernel post_recv for mapped srq\n");
-                           srq);
                rv = -EINVAL;
                goto out;
        }
@@ -1667,8 +1674,7 @@ int siw_post_srq_recv(struct ib_srq *base_srq, const struct ib_recv_wr *wr,
                }
                if (unlikely(wr->num_sge > srq->max_sge)) {
                        siw_dbg_pd(base_srq->pd,
-                                   "[SRQ 0x%p]: too many sge's: %d\n", srq,
+                                   "[SRQ]: too many sge's: %d\n", wr->num_sge);
-                                   wr->num_sge);
                        rv = -EINVAL;
                        break;
                }
@@ -1687,7 +1693,7 @@ int siw_post_srq_recv(struct ib_srq *base_srq, const struct ib_recv_wr *wr,
        spin_unlock_irqrestore(&srq->lock, flags);
 out:
        if (unlikely(rv < 0)) {
-                siw_dbg_pd(base_srq->pd, "[SRQ 0x%p]: error %d\n", srq, rv);
+                siw_dbg_pd(base_srq->pd, "[SRQ]: error %d\n", rv);
                *bad_wr = wr;
        }
        return rv;
diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
index 88ae7c2ac3c8..e486a8a74c40 100644
--- a/drivers/input/serio/hyperv-keyboard.c
+++ b/drivers/input/serio/hyperv-keyboard.c
@@ -237,40 +237,17 @@ static void hv_kbd_handle_received_packet(struct hv_device *hv_dev,
 static void hv_kbd_on_channel_callback(void *context)
 {
+        struct vmpacket_descriptor *desc;
        struct hv_device *hv_dev = context;
-        void *buffer;
-        int bufferlen = 0x100; /* Start with sensible size */
        u32 bytes_recvd;
        u64 req_id;
-        int error;
-        buffer = kmalloc(bufferlen, GFP_ATOMIC);
+        foreach_vmbus_pkt(desc, hv_dev->channel) {
-        if (!buffer)
+                bytes_recvd = desc->len8 * 8;
-                return;
+                req_id = desc->trans_id;
-        while (1) {
-                error = vmbus_recvpacket_raw(hv_dev->channel, buffer, bufferlen,
-                                             &bytes_recvd, &req_id);
-                switch (error) {
-                case 0:
-                        if (bytes_recvd == 0) {
-                                kfree(buffer);
-                                return;
-                        }
-                        hv_kbd_handle_received_packet(hv_dev, buffer,
-                                                      bytes_recvd, req_id);
-                        break;
-                case -ENOBUFS:
+                hv_kbd_handle_received_packet(hv_dev, desc, bytes_recvd,
-                        kfree(buffer);
+                                              req_id);
-                        /* Handle large packet */
-                        bufferlen = bytes_recvd;
-                        buffer = kmalloc(bytes_recvd, GFP_ATOMIC);
-                        if (!buffer)
-                                return;
-                        break;
-                }
        }
 }
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index a9a9fabd3968..c5c93e48b4db 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1186,8 +1186,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_master *master, u32 sid,
                        ste_live = true;
                        break;
                case STRTAB_STE_0_CFG_ABORT:
-                        if (disable_bypass)
+                        BUG_ON(!disable_bypass);
-                                break;
+                        break;
                default:
                        BUG(); /* STE corruption */
                }
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index a7f9c3edbcb2..f68a62c3c32b 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -459,13 +459,11 @@ static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys,
 {
        struct iommu_domain *domain = iommu_get_dma_domain(dev);
        struct iommu_dma_cookie *cookie = domain->iova_cookie;
-        size_t iova_off = 0;
+        struct iova_domain *iovad = &cookie->iovad;
+        size_t iova_off = iova_offset(iovad, phys);
        dma_addr_t iova;
-        if (cookie->type == IOMMU_DMA_IOVA_COOKIE) {
+        size = iova_align(iovad, size + iova_off);
-                iova_off = iova_offset(&cookie->iovad, phys);
-                size = iova_align(&cookie->iovad, size + iova_off);
-        }
        iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
        if (!iova)
@@ -574,7 +572,7 @@ static void *iommu_dma_alloc_remap(struct device *dev, size_t size,
        struct iova_domain *iovad = &cookie->iovad;
        bool coherent = dev_is_dma_coherent(dev);
        int ioprot = dma_info_to_prot(DMA_BIDIRECTIONAL, coherent, attrs);
-        pgprot_t prot = arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs);
+        pgprot_t prot = dma_pgprot(dev, PAGE_KERNEL, attrs);
        unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap;
        struct page **pages;
        struct sg_table sgt;
@@ -764,7 +762,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
                 * - and wouldn't make the resulting output segment too long
                 */
                if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
-                    (cur_len + s_length <= max_len)) {
+                    (max_len - cur_len >= s_length)) {
                        /* ...then concatenate it with the previous one */
                        cur_len += s_length;
                } else {
@@ -967,15 +965,18 @@ static void *iommu_dma_alloc_pages(struct device *dev, size_t size,
 {
        bool coherent = dev_is_dma_coherent(dev);
        size_t alloc_size = PAGE_ALIGN(size);
+        int node = dev_to_node(dev);
        struct page *page = NULL;
        void *cpu_addr;
        page = dma_alloc_contiguous(dev, alloc_size, gfp);
        if (!page)
+                page = alloc_pages_node(node, gfp, get_order(alloc_size));
+        if (!page)
                return NULL;
        if (IS_ENABLED(CONFIG_DMA_REMAP) && (!coherent || PageHighMem(page))) {
-                pgprot_t prot = arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs);
+                pgprot_t prot = dma_pgprot(dev, PAGE_KERNEL, attrs);
                cpu_addr = dma_common_contiguous_remap(page, alloc_size,
                                VM_USERMAP, prot, __builtin_return_address(0));
@@ -1035,7 +1036,7 @@ static int iommu_dma_mmap(struct device *dev, struct vm_area_struct *vma,
        unsigned long pfn, off = vma->vm_pgoff;
        int ret;
-        vma->vm_page_prot = arch_dma_mmap_pgprot(dev, vma->vm_page_prot, attrs);
+        vma->vm_page_prot = dma_pgprot(dev, vma->vm_page_prot, attrs);
        if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                return ret;
@@ -1147,16 +1148,21 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev,
        if (!msi_page)
                return NULL;
-        iova = __iommu_dma_map(dev, msi_addr, size, prot);
+        iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
-        if (iova == DMA_MAPPING_ERROR)
+        if (!iova)
                goto out_free_page;
+        if (iommu_map(domain, iova, msi_addr, size, prot))
+                goto out_free_iova;
        INIT_LIST_HEAD(&msi_page->list);
        msi_page->phys = msi_addr;
        msi_page->iova = iova;
        list_add(&msi_page->list, &cookie->msi_page_list);
        return msi_page;
+out_free_iova:
+        iommu_dma_free_iova(cookie, iova, size);
 out_free_page:
        kfree(msi_page);
        return NULL;
diff --git a/drivers/iommu/intel-iommu-debugfs.c b/drivers/iommu/intel-iommu-debugfs.c
index 2b25d9c59336..471f05d452e0 100644
--- a/drivers/iommu/intel-iommu-debugfs.c
+++ b/drivers/iommu/intel-iommu-debugfs.c
@@ -235,7 +235,7 @@ static void ctx_tbl_walk(struct seq_file *m, struct intel_iommu *iommu, u16 bus)
                tbl_wlk.ctx_entry = context;
                m->private = &tbl_wlk;
-                if (pasid_supported(iommu) && is_pasid_enabled(context)) {
+                if (dmar_readq(iommu->reg + DMAR_RTADDR_REG) & DMA_RTADDR_SMT) {
                        pasid_dir_ptr = context->lo & VTD_PAGE_MASK;
                        pasid_dir_size = get_pasid_dir_size(context);
                        pasid_dir_walk(m, pasid_dir_ptr, pasid_dir_size);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index bdaed2da8a55..12d094d08c0a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3449,6 +3449,7 @@ static bool iommu_need_mapping(struct device *dev)
                                dmar_domain = to_dmar_domain(domain);
                                dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                        }
+                        dmar_remove_one_dev_info(dev);
                        get_private_domain_for_dev(dev);
                }
@@ -4790,7 +4791,8 @@ static void __dmar_remove_one_dev_info(struct device_domain_info *info)
        /* free the private domain */
        if (domain->flags & DOMAIN_FLAG_LOSE_CHILDREN &&
-            !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY))
+            !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY) &&
+            list_empty(&domain->devices))
                domain_exit(info->domain);
        free_devinfo_mem(info);
@@ -4803,7 +4805,8 @@ static void dmar_remove_one_dev_info(struct device *dev)
        spin_lock_irqsave(&device_domain_lock, flags);
        info = dev->archdata.iommu;
-        __dmar_remove_one_dev_info(info);
+        if (info)
+                __dmar_remove_one_dev_info(info);
        spin_unlock_irqrestore(&device_domain_lock, flags);
 }
@@ -5281,6 +5284,7 @@ static int intel_iommu_add_device(struct device *dev)
                if (device_def_domain_type(dev) == IOMMU_DOMAIN_IDENTITY) {
                        ret = iommu_request_dm_for_dev(dev);
                        if (ret) {
+                                dmar_remove_one_dev_info(dev);
                                dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                                domain_add_dev_info(si_domain, dev);
                                dev_info(dev,
@@ -5291,6 +5295,7 @@ static int intel_iommu_add_device(struct device *dev)
                if (device_def_domain_type(dev) == IOMMU_DOMAIN_DMA) {
                        ret = iommu_request_dma_domain_for_dev(dev);
                        if (ret) {
+                                dmar_remove_one_dev_info(dev);
                                dmar_domain->flags |= DOMAIN_FLAG_LOSE_CHILDREN;
                                if (!get_private_domain_for_dev(dev)) {
                                        dev_warn(dev,
@@ -5316,6 +5321,8 @@ static void intel_iommu_remove_device(struct device *dev)
        if (!iommu)
                return;
+        dmar_remove_one_dev_info(dev);
        iommu_group_remove_device(dev);
        iommu_device_unlink(&iommu->iommu, dev);
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index b6b5acc92ca2..2a48ea3f1b30 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1599,7 +1599,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
        unsigned long freed;
        c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (!dm_bufio_trylock(c))
+        if (sc->gfp_mask & __GFP_FS)
+                dm_bufio_lock(c);
+        else if (!dm_bufio_trylock(c))
                return SHRINK_STOP;
        freed  = __scan(c, sc->nr_to_scan, sc->gfp_mask);
diff --git a/drivers/md/dm-dust.c b/drivers/md/dm-dust.c
index 845f376a72d9..8288887b7f94 100644
--- a/drivers/md/dm-dust.c
+++ b/drivers/md/dm-dust.c
@@ -25,6 +25,7 @@ struct dust_device {
        unsigned long long badblock_count;
        spinlock_t dust_lock;
        unsigned int blksz;
+        int sect_per_block_shift;
        unsigned int sect_per_block;
        sector_t start;
        bool fail_read_on_bb:1;
@@ -79,7 +80,7 @@ static int dust_remove_block(struct dust_device *dd, unsigned long long block)
        unsigned long flags;
        spin_lock_irqsave(&dd->dust_lock, flags);
-        bblock = dust_rb_search(&dd->badblocklist, block * dd->sect_per_block);
+        bblock = dust_rb_search(&dd->badblocklist, block);
        if (bblock == NULL) {
                if (!dd->quiet_mode) {
@@ -113,7 +114,7 @@ static int dust_add_block(struct dust_device *dd, unsigned long long block)
        }
        spin_lock_irqsave(&dd->dust_lock, flags);
-        bblock->bb = block * dd->sect_per_block;
+        bblock->bb = block;
        if (!dust_rb_insert(&dd->badblocklist, bblock)) {
                if (!dd->quiet_mode) {
                        DMERR("%s: block %llu already in badblocklist",
@@ -138,7 +139,7 @@ static int dust_query_block(struct dust_device *dd, unsigned long long block)
        unsigned long flags;
        spin_lock_irqsave(&dd->dust_lock, flags);
-        bblock = dust_rb_search(&dd->badblocklist, block * dd->sect_per_block);
+        bblock = dust_rb_search(&dd->badblocklist, block);
        if (bblock != NULL)
                DMINFO("%s: block %llu found in badblocklist", __func__, block);
        else
@@ -165,6 +166,7 @@ static int dust_map_read(struct dust_device *dd, sector_t thisblock,
        int ret = DM_MAPIO_REMAPPED;
        if (fail_read_on_bb) {
+                thisblock >>= dd->sect_per_block_shift;
                spin_lock_irqsave(&dd->dust_lock, flags);
                ret = __dust_map_read(dd, thisblock);
                spin_unlock_irqrestore(&dd->dust_lock, flags);
@@ -195,6 +197,7 @@ static int dust_map_write(struct dust_device *dd, sector_t thisblock,
        unsigned long flags;
        if (fail_read_on_bb) {
+                thisblock >>= dd->sect_per_block_shift;
                spin_lock_irqsave(&dd->dust_lock, flags);
                __dust_map_write(dd, thisblock);
                spin_unlock_irqrestore(&dd->dust_lock, flags);
@@ -331,6 +334,8 @@ static int dust_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        dd->blksz = blksz;
        dd->start = tmp;
+        dd->sect_per_block_shift = __ffs(sect_per_block);
        /*
         * Whether to fail a read on a "bad" block.
         * Defaults to false; enabled later by message.
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index b1b0de402dfc..9118ab85cb3a 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1943,7 +1943,22 @@ offload_to_thread:
                        queue_work(ic->wait_wq, &dio->work);
                        return;
                }
+                if (journal_read_pos != NOT_FOUND)
+                        dio->range.n_sectors = ic->sectors_per_block;
                wait_and_add_new_range(ic, &dio->range);
+                /*
+                 * wait_and_add_new_range drops the spinlock, so the journal
+                 * may have been changed arbitrarily. We need to recheck.
+                 * To simplify the code, we restrict I/O size to just one block.
+                 */
+                if (journal_read_pos != NOT_FOUND) {
+                        sector_t next_sector;
+                        unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
+                        if (unlikely(new_pos != journal_read_pos)) {
+                                remove_range_unlocked(ic, &dio->range);
+                                goto retry;
+                        }
+                }
        }
        spin_unlock_irq(&ic->endio_wait.lock);
diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
index df2011de7be2..1bbe4a34ef4c 100644
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -566,8 +566,10 @@ static int run_io_job(struct kcopyd_job *job)
         * no point in continuing.
         */
        if (test_bit(DM_KCOPYD_WRITE_SEQ, &job->flags) &&
-            job->master_job->write_err)
+            job->master_job->write_err) {
+                job->write_err = job->master_job->write_err;
                return -EIO;
+        }
        io_job_start(job->kc->throttle);
@@ -619,6 +621,7 @@ static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
                        else
                                job->read_err = 1;
                        push(&kc->complete_jobs, job);
+                        wake(kc);
                        break;
                }
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8a60a4a070ac..1f933dd197cd 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3194,7 +3194,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                          */
                        r = rs_prepare_reshape(rs);
                        if (r)
-                                return r;
+                                goto bad;
                        /* Reshaping ain't recovery, so disable recovery */
                        rs_setup_recovery(rs, MaxSector);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 7b6c3ee9e755..8820931ec7d2 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1342,7 +1342,7 @@ void dm_table_event(struct dm_table *t)
 }
 EXPORT_SYMBOL(dm_table_event);
-sector_t dm_table_get_size(struct dm_table *t)
+inline sector_t dm_table_get_size(struct dm_table *t)
 {
        return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
 }
@@ -1367,6 +1367,9 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
        unsigned int l, n = 0, k = 0;
        sector_t *node;
+        if (unlikely(sector >= dm_table_get_size(t)))
+                return &t->targets[t->num_targets];
        for (l = 0; l < t->depth; l++) {
                n = get_child(n, k);
                node = get_node(t, l, n);
diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
index 8545dcee9fd0..595a73110e17 100644
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
 *
@@ -34,7 +35,7 @@
 *    (1) Super block (1 block)
 *    (2) Chunk mapping table (nr_map_blocks)
 *    (3) Bitmap blocks (nr_bitmap_blocks)
- * All metadata blocks are stored in conventional zones, starting from the
+ * All metadata blocks are stored in conventional zones, starting from
 * the first conventional zone found on disk.
 */
 struct dmz_super {
@@ -233,7 +234,7 @@ void dmz_unlock_map(struct dmz_metadata *zmd)
 * Lock/unlock metadata access. This is a "read" lock on a semaphore
 * that prevents metadata flush from running while metadata are being
 * modified. The actual metadata write mutual exclusion is achieved with
- * the map lock and zone styate management (active and reclaim state are
+ * the map lock and zone state management (active and reclaim state are
 * mutually exclusive).
 */
 void dmz_lock_metadata(struct dmz_metadata *zmd)
@@ -402,15 +403,18 @@ static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
        sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
        struct bio *bio;
+        if (dmz_bdev_is_dying(zmd->dev))
+                return ERR_PTR(-EIO);
        /* Get a new block and a BIO to read it */
        mblk = dmz_alloc_mblock(zmd, mblk_no);
        if (!mblk)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        bio = bio_alloc(GFP_NOIO, 1);
        if (!bio) {
                dmz_free_mblock(zmd, mblk);
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        }
        spin_lock(&zmd->mblk_lock);
@@ -541,8 +545,8 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
        if (!mblk) {
                /* Cache miss: read the block from disk */
                mblk = dmz_get_mblock_slow(zmd, mblk_no);
-                if (!mblk)
+                if (IS_ERR(mblk))
-                        return ERR_PTR(-ENOMEM);
+                        return mblk;
        }
        /* Wait for on-going read I/O and check for error */
@@ -570,16 +574,19 @@ static void dmz_dirty_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
 /*
 * Issue a metadata block write BIO.
 */
-static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+static int dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
-                             unsigned int set)
+                            unsigned int set)
 {
        sector_t block = zmd->sb[set].block + mblk->no;
        struct bio *bio;
+        if (dmz_bdev_is_dying(zmd->dev))
+                return -EIO;
        bio = bio_alloc(GFP_NOIO, 1);
        if (!bio) {
                set_bit(DMZ_META_ERROR, &mblk->state);
-                return;
+                return -ENOMEM;
        }
        set_bit(DMZ_META_WRITING, &mblk->state);
@@ -591,6 +598,8 @@ static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
        bio_set_op_attrs(bio, REQ_OP_WRITE, REQ_META | REQ_PRIO);
        bio_add_page(bio, mblk->page, DMZ_BLOCK_SIZE, 0);
        submit_bio(bio);
+        return 0;
 }
 /*
@@ -602,6 +611,9 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block,
        struct bio *bio;
        int ret;
+        if (dmz_bdev_is_dying(zmd->dev))
+                return -EIO;
        bio = bio_alloc(GFP_NOIO, 1);
        if (!bio)
                return -ENOMEM;
@@ -659,22 +671,29 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
 {
        struct dmz_mblock *mblk;
        struct blk_plug plug;
-        int ret = 0;
+        int ret = 0, nr_mblks_submitted = 0;
        /* Issue writes */
        blk_start_plug(&plug);
-        list_for_each_entry(mblk, write_list, link)
+        list_for_each_entry(mblk, write_list, link) {
-                dmz_write_mblock(zmd, mblk, set);
+                ret = dmz_write_mblock(zmd, mblk, set);
+                if (ret)
+                        break;
+                nr_mblks_submitted++;
+        }
        blk_finish_plug(&plug);
        /* Wait for completion */
        list_for_each_entry(mblk, write_list, link) {
+                if (!nr_mblks_submitted)
+                        break;
                wait_on_bit_io(&mblk->state, DMZ_META_WRITING,
                               TASK_UNINTERRUPTIBLE);
                if (test_bit(DMZ_META_ERROR, &mblk->state)) {
                        clear_bit(DMZ_META_ERROR, &mblk->state);
                        ret = -EIO;
                }
+                nr_mblks_submitted--;
        }
        /* Flush drive cache (this will also sync data) */
@@ -736,6 +755,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
         */
        dmz_lock_flush(zmd);
+        if (dmz_bdev_is_dying(zmd->dev)) {
+                ret = -EIO;
+                goto out;
+        }
        /* Get dirty blocks */
        spin_lock(&zmd->mblk_lock);
        list_splice_init(&zmd->mblk_dirty_list, &write_list);
@@ -1542,7 +1566,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
        struct dm_zone *zone;
        if (list_empty(&zmd->map_rnd_list))
-                return NULL;
+                return ERR_PTR(-EBUSY);
        list_for_each_entry(zone, &zmd->map_rnd_list, link) {
                if (dmz_is_buf(zone))
@@ -1553,7 +1577,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
                        return dzone;
        }
-        return NULL;
+        return ERR_PTR(-EBUSY);
 }
 /*
@@ -1564,7 +1588,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
        struct dm_zone *zone;
        if (list_empty(&zmd->map_seq_list))
-                return NULL;
+                return ERR_PTR(-EBUSY);
        list_for_each_entry(zone, &zmd->map_seq_list, link) {
                if (!zone->bzone)
@@ -1573,7 +1597,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
                        return zone;
        }
-        return NULL;
+        return ERR_PTR(-EBUSY);
 }
 /*
@@ -1628,9 +1652,13 @@ again:
                if (op != REQ_OP_WRITE)
                        goto out;
-                /* Alloate a random zone */
+                /* Allocate a random zone */
                dzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
                if (!dzone) {
+                        if (dmz_bdev_is_dying(zmd->dev)) {
+                                dzone = ERR_PTR(-EIO);
+                                goto out;
+                        }
                        dmz_wait_for_free_zones(zmd);
                        goto again;
                }
@@ -1725,9 +1753,13 @@ again:
        if (bzone)
                goto out;
-        /* Alloate a random zone */
+        /* Allocate a random zone */
        bzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
        if (!bzone) {
+                if (dmz_bdev_is_dying(zmd->dev)) {
+                        bzone = ERR_PTR(-EIO);
+                        goto out;
+                }
                dmz_wait_for_free_zones(zmd);
                goto again;
        }
diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
index edf4b95eb075..d240d7ca8a8a 100644
--- a/drivers/md/dm-zoned-reclaim.c
+++ b/drivers/md/dm-zoned-reclaim.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
 *
@@ -37,7 +38,7 @@ enum {
 /*
 * Number of seconds of target BIO inactivity to consider the target idle.
 */
-#define DMZ_IDLE_PERIOD         (10UL * HZ)
+#define DMZ_IDLE_PERIOD                 (10UL * HZ)
 /*
 * Percentage of unmapped (free) random zones below which reclaim starts
@@ -134,6 +135,9 @@ static int dmz_reclaim_copy(struct dmz_reclaim *zrc,
                set_bit(DM_KCOPYD_WRITE_SEQ, &flags);
        while (block < end_block) {
+                if (dev->flags & DMZ_BDEV_DYING)
+                        return -EIO;
                /* Get a valid region from the source zone */
                ret = dmz_first_valid_block(zmd, src_zone, &block);
                if (ret <= 0)
@@ -215,7 +219,7 @@ static int dmz_reclaim_buf(struct dmz_reclaim *zrc, struct dm_zone *dzone)
        dmz_unlock_flush(zmd);
-        return 0;
+        return ret;
 }
 /*
@@ -259,7 +263,7 @@ static int dmz_reclaim_seq_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
        dmz_unlock_flush(zmd);
-        return 0;
+        return ret;
 }
 /*
@@ -312,7 +316,7 @@ static int dmz_reclaim_rnd_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
        dmz_unlock_flush(zmd);
-        return 0;
+        return ret;
 }
 /*
@@ -334,7 +338,7 @@ static void dmz_reclaim_empty(struct dmz_reclaim *zrc, struct dm_zone *dzone)
 /*
 * Find a candidate zone for reclaim and process it.
 */
-static void dmz_reclaim(struct dmz_reclaim *zrc)
+static int dmz_do_reclaim(struct dmz_reclaim *zrc)
 {
        struct dmz_metadata *zmd = zrc->metadata;
        struct dm_zone *dzone;
@@ -344,8 +348,8 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
        /* Get a data zone */
        dzone = dmz_get_zone_for_reclaim(zmd);
-        if (!dzone)
+        if (IS_ERR(dzone))
-                return;
+                return PTR_ERR(dzone);
        start = jiffies;
@@ -391,13 +395,20 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
 out:
        if (ret) {
                dmz_unlock_zone_reclaim(dzone);
-                return;
+                return ret;
        }
-        (void) dmz_flush_metadata(zrc->metadata);
+        ret = dmz_flush_metadata(zrc->metadata);
+        if (ret) {
+                dmz_dev_debug(zrc->dev,
+                              "Metadata flush for zone %u failed, err %d\n",
+                              dmz_id(zmd, rzone), ret);
+                return ret;
+        }
        dmz_dev_debug(zrc->dev, "Reclaimed zone %u in %u ms",
                      dmz_id(zmd, rzone), jiffies_to_msecs(jiffies - start));
+        return 0;
 }
 /*
@@ -427,7 +438,7 @@ static bool dmz_should_reclaim(struct dmz_reclaim *zrc)
                return false;
        /*
-         * If the percentage of unmappped random zones is low,
+         * If the percentage of unmapped random zones is low,
         * reclaim even if the target is busy.
         */
        return p_unmap_rnd <= DMZ_RECLAIM_LOW_UNMAP_RND;
@@ -442,6 +453,10 @@ static void dmz_reclaim_work(struct work_struct *work)
        struct dmz_metadata *zmd = zrc->metadata;
        unsigned int nr_rnd, nr_unmap_rnd;
        unsigned int p_unmap_rnd;
+        int ret;
+        if (dmz_bdev_is_dying(zrc->dev))
+                return;
        if (!dmz_should_reclaim(zrc)) {
                mod_delayed_work(zrc->wq, &zrc->work, DMZ_IDLE_PERIOD);
@@ -471,7 +486,17 @@ static void dmz_reclaim_work(struct work_struct *work)
                      (dmz_target_idle(zrc) ? "Idle" : "Busy"),
                      p_unmap_rnd, nr_unmap_rnd, nr_rnd);
-        dmz_reclaim(zrc);
+        ret = dmz_do_reclaim(zrc);
+        if (ret) {
+                dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
+                if (ret == -EIO)
+                        /*
+                         * LLD might be performing some error handling sequence
+                         * at the underlying device. To not interfere, do not
+                         * attempt to schedule the next reclaim run immediately.
+                         */
+                        return;
+        }
        dmz_schedule_reclaim(zrc);
 }
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 51d029bbb740..31478fef6032 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
 *
@@ -133,6 +134,8 @@ static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
        refcount_inc(&bioctx->ref);
        generic_make_request(clone);
+        if (clone->bi_status == BLK_STS_IOERR)
+                return -EIO;
        if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
                zone->wp_block += nr_blocks;
@@ -277,8 +280,8 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
        /* Get the buffer zone. One will be allocated if needed */
        bzone = dmz_get_chunk_buffer(zmd, zone);
-        if (!bzone)
+        if (IS_ERR(bzone))
-                return -ENOSPC;
+                return PTR_ERR(bzone);
        if (dmz_is_readonly(bzone))
                return -EROFS;
@@ -389,6 +392,11 @@ static void dmz_handle_bio(struct dmz_target *dmz, struct dm_chunk_work *cw,
        dmz_lock_metadata(zmd);
+        if (dmz->dev->flags & DMZ_BDEV_DYING) {
+                ret = -EIO;
+                goto out;
+        }
        /*
         * Get the data zone mapping the chunk. There may be no
         * mapping for read and discard. If a mapping is obtained,
@@ -493,6 +501,8 @@ static void dmz_flush_work(struct work_struct *work)
        /* Flush dirty metadata blocks */
        ret = dmz_flush_metadata(dmz->metadata);
+        if (ret)
+                dmz_dev_debug(dmz->dev, "Metadata flush failed, rc=%d\n", ret);
        /* Process queued flush requests */
        while (1) {
@@ -513,22 +523,24 @@ static void dmz_flush_work(struct work_struct *work)
 * Get a chunk work and start it to process a new BIO.
 * If the BIO chunk has no work yet, create one.
 */
-static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+static int dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
 {
        unsigned int chunk = dmz_bio_chunk(dmz->dev, bio);
        struct dm_chunk_work *cw;
+        int ret = 0;
        mutex_lock(&dmz->chunk_lock);
        /* Get the BIO chunk work. If one is not active yet, create one */
        cw = radix_tree_lookup(&dmz->chunk_rxtree, chunk);
        if (!cw) {
-                int ret;
                /* Create a new chunk work */
                cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOIO);
-                if (!cw)
+                if (unlikely(!cw)) {
+                        ret = -ENOMEM;
                        goto out;
+                }
                INIT_WORK(&cw->work, dmz_chunk_work);
                refcount_set(&cw->refcount, 0);
@@ -539,7 +551,6 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
                ret = radix_tree_insert(&dmz->chunk_rxtree, chunk, cw);
                if (unlikely(ret)) {
                        kfree(cw);
-                        cw = NULL;
                        goto out;
                }
        }
@@ -547,10 +558,38 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
        bio_list_add(&cw->bio_list, bio);
        dmz_get_chunk_work(cw);
+        dmz_reclaim_bio_acc(dmz->reclaim);
        if (queue_work(dmz->chunk_wq, &cw->work))
                dmz_get_chunk_work(cw);
 out:
        mutex_unlock(&dmz->chunk_lock);
+        return ret;
+}
+/*
+ * Check the backing device availability. If it's on the way out,
+ * start failing I/O. Reclaim and metadata components also call this
+ * function to cleanly abort operation in the event of such failure.
+ */
+bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev)
+{
+        struct gendisk *disk;
+        if (!(dmz_dev->flags & DMZ_BDEV_DYING)) {
+                disk = dmz_dev->bdev->bd_disk;
+                if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
+                        dmz_dev_warn(dmz_dev, "Backing device queue dying");
+                        dmz_dev->flags |= DMZ_BDEV_DYING;
+                } else if (disk->fops->check_events) {
+                        if (disk->fops->check_events(disk, 0) &
+                                        DISK_EVENT_MEDIA_CHANGE) {
+                                dmz_dev_warn(dmz_dev, "Backing device offline");
+                                dmz_dev->flags |= DMZ_BDEV_DYING;
+                        }
+                }
+        }
+        return dmz_dev->flags & DMZ_BDEV_DYING;
 }
 /*
@@ -564,6 +603,10 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
        sector_t sector = bio->bi_iter.bi_sector;
        unsigned int nr_sectors = bio_sectors(bio);
        sector_t chunk_sector;
+        int ret;
+        if (dmz_bdev_is_dying(dmz->dev))
+                return DM_MAPIO_KILL;
        dmz_dev_debug(dev, "BIO op %d sector %llu + %u => chunk %llu, block %llu, %u blocks",
                      bio_op(bio), (unsigned long long)sector, nr_sectors,
@@ -601,8 +644,14 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
                dm_accept_partial_bio(bio, dev->zone_nr_sectors - chunk_sector);
        /* Now ready to handle this BIO */
-        dmz_reclaim_bio_acc(dmz->reclaim);
+        ret = dmz_queue_chunk_work(dmz, bio);
-        dmz_queue_chunk_work(dmz, bio);
+        if (ret) {
+                dmz_dev_debug(dmz->dev,
+                              "BIO op %d, can't process chunk %llu, err %i\n",
+                              bio_op(bio), (u64)dmz_bio_chunk(dmz->dev, bio),
+                              ret);
+                return DM_MAPIO_REQUEUE;
+        }
        return DM_MAPIO_SUBMITTED;
 }
@@ -855,6 +904,9 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev)
 {
        struct dmz_target *dmz = ti->private;
+        if (dmz_bdev_is_dying(dmz->dev))
+                return -ENODEV;
        *bdev = dmz->dev->bdev;
        return 0;
diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
index ed8de49c9a08..d8e70b0ade35 100644
--- a/drivers/md/dm-zoned.h
+++ b/drivers/md/dm-zoned.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
 *
@@ -56,6 +57,8 @@ struct dmz_dev {
        unsigned int            nr_zones;
+        unsigned int            flags;
        sector_t                zone_nr_sectors;
        unsigned int            zone_nr_sectors_shift;
@@ -67,6 +70,9 @@ struct dmz_dev {
                                 (dev)->zone_nr_sectors_shift)
 #define dmz_chunk_block(dev, b) ((b) & ((dev)->zone_nr_blocks - 1))
+/* Device flags. */
+#define DMZ_BDEV_DYING          (1 << 0)
 /*
 * Zone descriptor.
 */
@@ -245,4 +251,9 @@ void dmz_resume_reclaim(struct dmz_reclaim *zrc);
 void dmz_reclaim_bio_acc(struct dmz_reclaim *zrc);
 void dmz_schedule_reclaim(struct dmz_reclaim *zrc);
+/*
+ * Functions defined in dm-zoned-target.c
+ */
+bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev);
 #endif /* DM_ZONED_H */
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 58b319757b1e..8aae0624a297 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -628,39 +628,40 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
        new_parent = shadow_current(s);
+        pn = dm_block_data(new_parent);
+        size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
+                sizeof(__le64) : s->info->value_type.size;
+        /* create & init the left block */
        r = new_block(s->info, &left);
        if (r < 0)
                return r;
+        ln = dm_block_data(left);
+        nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
+        ln->header.flags = pn->header.flags;
+        ln->header.nr_entries = cpu_to_le32(nr_left);
+        ln->header.max_entries = pn->header.max_entries;
+        ln->header.value_size = pn->header.value_size;
+        memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
+        memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
+        /* create & init the right block */
        r = new_block(s->info, &right);
        if (r < 0) {
                unlock_block(s->info, left);
                return r;
        }
-        pn = dm_block_data(new_parent);
-        ln = dm_block_data(left);
        rn = dm_block_data(right);
-        nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
        nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left;
-        ln->header.flags = pn->header.flags;
-        ln->header.nr_entries = cpu_to_le32(nr_left);
-        ln->header.max_entries = pn->header.max_entries;
-        ln->header.value_size = pn->header.value_size;
        rn->header.flags = pn->header.flags;
        rn->header.nr_entries = cpu_to_le32(nr_right);
        rn->header.max_entries = pn->header.max_entries;
        rn->header.value_size = pn->header.value_size;
-        memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
        memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0]));
-        size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
-                sizeof(__le64) : s->info->value_type.size;
-        memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
        memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left),
               nr_right * size);
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index aec449243966..25328582cc48 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -249,7 +249,7 @@ static int out(struct sm_metadata *smm)
        }
        if (smm->recursion_count == 1)
-                apply_bops(smm);
+                r = apply_bops(smm);
        smm->recursion_count--;
diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
index 29e3f5da59c1..11ec048929e8 100644
--- a/drivers/media/platform/omap/omap_vout_vrfb.c
+++ b/drivers/media/platform/omap/omap_vout_vrfb.c
@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
         */
        pixsize = vout->bpp * vout->vrfb_bpp;
-        dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
+        dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp;
-                  (vout->pix.width * vout->bpp)) + 1;
        xt->src_start = vout->buf_phy_addr[vb->i];
        xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
diff --git a/drivers/mfd/rk808.c b/drivers/mfd/rk808.c
index 601cefb5c9d8..050478cabc95 100644
--- a/drivers/mfd/rk808.c
+++ b/drivers/mfd/rk808.c
@@ -729,7 +729,7 @@ static int rk808_remove(struct i2c_client *client)
        return 0;
 }
-static int rk8xx_suspend(struct device *dev)
+static int __maybe_unused rk8xx_suspend(struct device *dev)
 {
        struct rk808 *rk808 = i2c_get_clientdata(rk808_i2c_client);
        int ret = 0;
@@ -749,7 +749,7 @@ static int rk8xx_suspend(struct device *dev)
        return ret;
 }
-static int rk8xx_resume(struct device *dev)
+static int __maybe_unused rk8xx_resume(struct device *dev)
 {
        struct rk808 *rk808 = i2c_get_clientdata(rk808_i2c_client);
        int ret = 0;
@@ -768,7 +768,7 @@ static int rk8xx_resume(struct device *dev)
        return ret;
 }
-SIMPLE_DEV_PM_OPS(rk8xx_pm_ops, rk8xx_suspend, rk8xx_resume);
+static SIMPLE_DEV_PM_OPS(rk8xx_pm_ops, rk8xx_suspend, rk8xx_resume);
 static struct i2c_driver rk808_i2c_driver = {
        .driver = {
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 6abfc8e92fcc..16900357afc2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -465,6 +465,7 @@ config PCI_ENDPOINT_TEST
 config XILINX_SDFEC
        tristate "Xilinx SDFEC 16"
+        depends on HAS_IOMEM
        help
          This option enables support for the Xilinx SDFEC (Soft Decision
          Forward Error Correction) driver. This enables a char driver
diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c
index 0c4894dd9c02..7a8f9d0b71b5 100644
--- a/drivers/misc/habanalabs/device.c
+++ b/drivers/misc/habanalabs/device.c
@@ -970,7 +970,8 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass)
        rc = hl_ctx_init(hdev, hdev->kernel_ctx, true);
        if (rc) {
                dev_err(hdev->dev, "failed to initialize kernel context\n");
-                goto free_ctx;
+                kfree(hdev->kernel_ctx);
+                goto mmu_fini;
        }
        rc = hl_cb_pool_init(hdev);
@@ -1053,8 +1054,6 @@ release_ctx:
        if (hl_ctx_put(hdev->kernel_ctx) != 1)
                dev_err(hdev->dev,
                        "kernel ctx is still alive on initialization failure\n");
-free_ctx:
-        kfree(hdev->kernel_ctx);
 mmu_fini:
        hl_mmu_fini(hdev);
 eq_fini:
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index a0e181714891..271c5c8f53b4 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -2729,9 +2729,10 @@ void goya_ring_doorbell(struct hl_device *hdev, u32 hw_queue_id, u32 pi)
                                GOYA_ASYNC_EVENT_ID_PI_UPDATE);
 }
-void goya_flush_pq_write(struct hl_device *hdev, u64 *pq, u64 exp_val)
+void goya_pqe_write(struct hl_device *hdev, __le64 *pqe, struct hl_bd *bd)
 {
-        /* Not needed in Goya */
+        /* The QMANs are on the SRAM so need to copy to IO space */
+        memcpy_toio((void __iomem *) pqe, bd, sizeof(struct hl_bd));
 }
 static void *goya_dma_alloc_coherent(struct hl_device *hdev, size_t size,
@@ -3313,9 +3314,11 @@ static int goya_validate_dma_pkt_no_mmu(struct hl_device *hdev,
        int rc;
        dev_dbg(hdev->dev, "DMA packet details:\n");
-        dev_dbg(hdev->dev, "source == 0x%llx\n", user_dma_pkt->src_addr);
+        dev_dbg(hdev->dev, "source == 0x%llx\n",
-        dev_dbg(hdev->dev, "destination == 0x%llx\n", user_dma_pkt->dst_addr);
+                le64_to_cpu(user_dma_pkt->src_addr));
-        dev_dbg(hdev->dev, "size == %u\n", user_dma_pkt->tsize);
+        dev_dbg(hdev->dev, "destination == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->dst_addr));
+        dev_dbg(hdev->dev, "size == %u\n", le32_to_cpu(user_dma_pkt->tsize));
        ctl = le32_to_cpu(user_dma_pkt->ctl);
        user_dir = (ctl & GOYA_PKT_LIN_DMA_CTL_DMA_DIR_MASK) >>
@@ -3344,9 +3347,11 @@ static int goya_validate_dma_pkt_mmu(struct hl_device *hdev,
                                struct packet_lin_dma *user_dma_pkt)
 {
        dev_dbg(hdev->dev, "DMA packet details:\n");
-        dev_dbg(hdev->dev, "source == 0x%llx\n", user_dma_pkt->src_addr);
+        dev_dbg(hdev->dev, "source == 0x%llx\n",
-        dev_dbg(hdev->dev, "destination == 0x%llx\n", user_dma_pkt->dst_addr);
+                le64_to_cpu(user_dma_pkt->src_addr));
-        dev_dbg(hdev->dev, "size == %u\n", user_dma_pkt->tsize);
+        dev_dbg(hdev->dev, "destination == 0x%llx\n",
+                le64_to_cpu(user_dma_pkt->dst_addr));
+        dev_dbg(hdev->dev, "size == %u\n", le32_to_cpu(user_dma_pkt->tsize));
        /*
         * WA for HW-23.
@@ -3386,7 +3391,8 @@ static int goya_validate_wreg32(struct hl_device *hdev,
        dev_dbg(hdev->dev, "WREG32 packet details:\n");
        dev_dbg(hdev->dev, "reg_offset == 0x%x\n", reg_offset);
-        dev_dbg(hdev->dev, "value      == 0x%x\n", wreg_pkt->value);
+        dev_dbg(hdev->dev, "value      == 0x%x\n",
+                le32_to_cpu(wreg_pkt->value));
        if (reg_offset != (mmDMA_CH_0_WR_COMP_ADDR_LO & 0x1FFF)) {
                dev_err(hdev->dev, "WREG32 packet with illegal address 0x%x\n",
@@ -3428,12 +3434,13 @@ static int goya_validate_cb(struct hl_device *hdev,
        while (cb_parsed_length < parser->user_cb_size) {
                enum packet_id pkt_id;
                u16 pkt_size;
-                void *user_pkt;
+                struct goya_packet *user_pkt;
-                user_pkt = (void *) (uintptr_t)
+                user_pkt = (struct goya_packet *) (uintptr_t)
                        (parser->user_cb->kernel_address + cb_parsed_length);
-                pkt_id = (enum packet_id) (((*(u64 *) user_pkt) &
+                pkt_id = (enum packet_id) (
+                                (le64_to_cpu(user_pkt->header) &
                                PACKET_HEADER_PACKET_ID_MASK) >>
                                        PACKET_HEADER_PACKET_ID_SHIFT);
@@ -3453,7 +3460,8 @@ static int goya_validate_cb(struct hl_device *hdev,
                         * need to validate here as well because patch_cb() is
                         * not called in MMU path while this function is called
                         */
-                        rc = goya_validate_wreg32(hdev, parser, user_pkt);
+                        rc = goya_validate_wreg32(hdev,
+                                parser, (struct packet_wreg32 *) user_pkt);
                        break;
                case PACKET_WREG_BULK:
@@ -3481,10 +3489,10 @@ static int goya_validate_cb(struct hl_device *hdev,
                case PACKET_LIN_DMA:
                        if (is_mmu)
                                rc = goya_validate_dma_pkt_mmu(hdev, parser,
-                                                user_pkt);
+                                        (struct packet_lin_dma *) user_pkt);
                        else
                                rc = goya_validate_dma_pkt_no_mmu(hdev, parser,
-                                                user_pkt);
+                                        (struct packet_lin_dma *) user_pkt);
                        break;
                case PACKET_MSG_LONG:
@@ -3657,15 +3665,16 @@ static int goya_patch_cb(struct hl_device *hdev,
                enum packet_id pkt_id;
                u16 pkt_size;
                u32 new_pkt_size = 0;
-                void *user_pkt, *kernel_pkt;
+                struct goya_packet *user_pkt, *kernel_pkt;
-                user_pkt = (void *) (uintptr_t)
+                user_pkt = (struct goya_packet *) (uintptr_t)
                        (parser->user_cb->kernel_address + cb_parsed_length);
-                kernel_pkt = (void *) (uintptr_t)
+                kernel_pkt = (struct goya_packet *) (uintptr_t)
                        (parser->patched_cb->kernel_address +
                                        cb_patched_cur_length);
-                pkt_id = (enum packet_id) (((*(u64 *) user_pkt) &
+                pkt_id = (enum packet_id) (
+                                (le64_to_cpu(user_pkt->header) &
                                PACKET_HEADER_PACKET_ID_MASK) >>
                                        PACKET_HEADER_PACKET_ID_SHIFT);
@@ -3680,15 +3689,18 @@ static int goya_patch_cb(struct hl_device *hdev,
                switch (pkt_id) {
                case PACKET_LIN_DMA:
-                        rc = goya_patch_dma_packet(hdev, parser, user_pkt,
+                        rc = goya_patch_dma_packet(hdev, parser,
-                                                kernel_pkt, &new_pkt_size);
+                                        (struct packet_lin_dma *) user_pkt,
+                                        (struct packet_lin_dma *) kernel_pkt,
+                                        &new_pkt_size);
                        cb_patched_cur_length += new_pkt_size;
                        break;
                case PACKET_WREG_32:
                        memcpy(kernel_pkt, user_pkt, pkt_size);
                        cb_patched_cur_length += pkt_size;
-                        rc = goya_validate_wreg32(hdev, parser, kernel_pkt);
+                        rc = goya_validate_wreg32(hdev, parser,
+                                        (struct packet_wreg32 *) kernel_pkt);
                        break;
                case PACKET_WREG_BULK:
@@ -4352,6 +4364,8 @@ static int goya_unmask_irq_arr(struct hl_device *hdev, u32 *irq_arr,
        size_t total_pkt_size;
        long result;
        int rc;
+        int irq_num_entries, irq_arr_index;
+        __le32 *goya_irq_arr;
        total_pkt_size = sizeof(struct armcp_unmask_irq_arr_packet) +
                        irq_arr_size;
@@ -4369,8 +4383,16 @@ static int goya_unmask_irq_arr(struct hl_device *hdev, u32 *irq_arr,
        if (!pkt)
                return -ENOMEM;
-        pkt->length = cpu_to_le32(irq_arr_size / sizeof(irq_arr[0]));
+        irq_num_entries = irq_arr_size / sizeof(irq_arr[0]);
-        memcpy(&pkt->irqs, irq_arr, irq_arr_size);
+        pkt->length = cpu_to_le32(irq_num_entries);
+        /* We must perform any necessary endianness conversation on the irq
+         * array being passed to the goya hardware
+         */
+        for (irq_arr_index = 0, goya_irq_arr = (__le32 *) &pkt->irqs;
+                        irq_arr_index < irq_num_entries ; irq_arr_index++)
+                goya_irq_arr[irq_arr_index] =
+                                cpu_to_le32(irq_arr[irq_arr_index]);
        pkt->armcp_pkt.ctl = cpu_to_le32(ARMCP_PACKET_UNMASK_RAZWI_IRQ_ARRAY <<
                                                ARMCP_PKT_CTL_OPCODE_SHIFT);
@@ -5042,7 +5064,7 @@ static const struct hl_asic_funcs goya_funcs = {
        .resume = goya_resume,
        .cb_mmap = goya_cb_mmap,
        .ring_doorbell = goya_ring_doorbell,
-        .flush_pq_write = goya_flush_pq_write,
+        .pqe_write = goya_pqe_write,
        .asic_dma_alloc_coherent = goya_dma_alloc_coherent,
        .asic_dma_free_coherent = goya_dma_free_coherent,
        .get_int_queue_base = goya_get_int_queue_base,
diff --git a/drivers/misc/habanalabs/goya/goyaP.h b/drivers/misc/habanalabs/goya/goyaP.h
index f8c611883dc1..d7f48c9c41cd 100644
--- a/drivers/misc/habanalabs/goya/goyaP.h
+++ b/drivers/misc/habanalabs/goya/goyaP.h
@@ -177,7 +177,7 @@ int goya_late_init(struct hl_device *hdev);
 void goya_late_fini(struct hl_device *hdev);
 void goya_ring_doorbell(struct hl_device *hdev, u32 hw_queue_id, u32 pi);
-void goya_flush_pq_write(struct hl_device *hdev, u64 *pq, u64 exp_val);
+void goya_pqe_write(struct hl_device *hdev, __le64 *pqe, struct hl_bd *bd);
 void goya_update_eq_ci(struct hl_device *hdev, u32 val);
 void goya_restore_phase_topology(struct hl_device *hdev);
 int goya_context_switch(struct hl_device *hdev, u32 asid);
diff --git a/drivers/misc/habanalabs/habanalabs.h b/drivers/misc/habanalabs/habanalabs.h
index 6a4c64b97f38..ce83adafcf2d 100644
--- a/drivers/misc/habanalabs/habanalabs.h
+++ b/drivers/misc/habanalabs/habanalabs.h
@@ -441,7 +441,11 @@ enum hl_pll_frequency {
 * @resume: handles IP specific H/W or SW changes for resume.
 * @cb_mmap: maps a CB.
 * @ring_doorbell: increment PI on a given QMAN.
- * @flush_pq_write: flush PQ entry write if necessary, WARN if flushing failed.
+ * @pqe_write: Write the PQ entry to the PQ. This is ASIC-specific
+ *             function because the PQs are located in different memory areas
+ *             per ASIC (SRAM, DRAM, Host memory) and therefore, the method of
+ *             writing the PQE must match the destination memory area
+ *             properties.
 * @asic_dma_alloc_coherent: Allocate coherent DMA memory by calling
 *                           dma_alloc_coherent(). This is ASIC function because
 *                           its implementation is not trivial when the driver
@@ -510,7 +514,8 @@ struct hl_asic_funcs {
        int (*cb_mmap)(struct hl_device *hdev, struct vm_area_struct *vma,
                        u64 kaddress, phys_addr_t paddress, u32 size);
        void (*ring_doorbell)(struct hl_device *hdev, u32 hw_queue_id, u32 pi);
-        void (*flush_pq_write)(struct hl_device *hdev, u64 *pq, u64 exp_val);
+        void (*pqe_write)(struct hl_device *hdev, __le64 *pqe,
+                        struct hl_bd *bd);
        void* (*asic_dma_alloc_coherent)(struct hl_device *hdev, size_t size,
                                        dma_addr_t *dma_handle, gfp_t flag);
        void (*asic_dma_free_coherent)(struct hl_device *hdev, size_t size,
diff --git a/drivers/misc/habanalabs/hw_queue.c b/drivers/misc/habanalabs/hw_queue.c
index e3b5517897ea..5f5673b74985 100644
--- a/drivers/misc/habanalabs/hw_queue.c
+++ b/drivers/misc/habanalabs/hw_queue.c
@@ -290,23 +290,19 @@ static void int_hw_queue_schedule_job(struct hl_cs_job *job)
        struct hl_device *hdev = job->cs->ctx->hdev;
        struct hl_hw_queue *q = &hdev->kernel_queues[job->hw_queue_id];
        struct hl_bd bd;
-        u64 *pi, *pbd = (u64 *) &bd;
+        __le64 *pi;
        bd.ctl = 0;
-        bd.len = __cpu_to_le32(job->job_cb_size);
+        bd.len = cpu_to_le32(job->job_cb_size);
-        bd.ptr = __cpu_to_le64((u64) (uintptr_t) job->user_cb);
+        bd.ptr = cpu_to_le64((u64) (uintptr_t) job->user_cb);
-        pi = (u64 *) (uintptr_t) (q->kernel_address +
+        pi = (__le64 *) (uintptr_t) (q->kernel_address +
                ((q->pi & (q->int_queue_len - 1)) * sizeof(bd)));
-        pi[0] = pbd[0];
-        pi[1] = pbd[1];
        q->pi++;
        q->pi &= ((q->int_queue_len << 1) - 1);
-        /* Flush PQ entry write. Relevant only for specific ASICs */
+        hdev->asic_funcs->pqe_write(hdev, pi, &bd);
-        hdev->asic_funcs->flush_pq_write(hdev, pi, pbd[0]);
        hdev->asic_funcs->ring_doorbell(hdev, q->hw_queue_id, q->pi);
 }
diff --git a/drivers/misc/habanalabs/include/goya/goya_packets.h b/drivers/misc/habanalabs/include/goya/goya_packets.h
index a14407b975e4..ef54bad20509 100644
--- a/drivers/misc/habanalabs/include/goya/goya_packets.h
+++ b/drivers/misc/habanalabs/include/goya/goya_packets.h
@@ -52,6 +52,19 @@ enum goya_dma_direction {
 #define GOYA_PKT_CTL_MB_SHIFT           31
 #define GOYA_PKT_CTL_MB_MASK            0x80000000
+/* All packets have, at least, an 8-byte header, which contains
+ * the packet type. The kernel driver uses the packet header for packet
+ * validation and to perform any necessary required preparation before
+ * sending them off to the hardware.
+ */
+struct goya_packet {
+        __le64 header;
+        /* The rest of the packet data follows. Use the corresponding
+         * packet_XXX struct to deference the data, based on packet type
+         */
+        u8 contents[0];
+};
 struct packet_nop {
        __le32 reserved;
        __le32 ctl;
diff --git a/drivers/misc/habanalabs/irq.c b/drivers/misc/habanalabs/irq.c
index ea9f72ff456c..199791b57caf 100644
--- a/drivers/misc/habanalabs/irq.c
+++ b/drivers/misc/habanalabs/irq.c
@@ -80,8 +80,7 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
        struct hl_cs_job *job;
        bool shadow_index_valid;
        u16 shadow_index;
-        u32 *cq_entry;
+        struct hl_cq_entry *cq_entry, *cq_base;
-        u32 *cq_base;
        if (hdev->disabled) {
                dev_dbg(hdev->dev,
@@ -90,29 +89,29 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                return IRQ_HANDLED;
        }
-        cq_base = (u32 *) (uintptr_t) cq->kernel_address;
+        cq_base = (struct hl_cq_entry *) (uintptr_t) cq->kernel_address;
        while (1) {
-                bool entry_ready = ((cq_base[cq->ci] & CQ_ENTRY_READY_MASK)
+                bool entry_ready = ((le32_to_cpu(cq_base[cq->ci].data) &
+                                        CQ_ENTRY_READY_MASK)
                                                >> CQ_ENTRY_READY_SHIFT);
                if (!entry_ready)
                        break;
-                cq_entry = (u32 *) &cq_base[cq->ci];
+                cq_entry = (struct hl_cq_entry *) &cq_base[cq->ci];
-                /*
+                /* Make sure we read CQ entry contents after we've
-                 * Make sure we read CQ entry contents after we've
                 * checked the ownership bit.
                 */
                dma_rmb();
-                shadow_index_valid =
+                shadow_index_valid = ((le32_to_cpu(cq_entry->data) &
-                        ((*cq_entry & CQ_ENTRY_SHADOW_INDEX_VALID_MASK)
+                                        CQ_ENTRY_SHADOW_INDEX_VALID_MASK)
                                        >> CQ_ENTRY_SHADOW_INDEX_VALID_SHIFT);
-                shadow_index = (u16)
+                shadow_index = (u16) ((le32_to_cpu(cq_entry->data) &
-                        ((*cq_entry & CQ_ENTRY_SHADOW_INDEX_MASK)
+                                        CQ_ENTRY_SHADOW_INDEX_MASK)
                                        >> CQ_ENTRY_SHADOW_INDEX_SHIFT);
                queue = &hdev->kernel_queues[cq->hw_queue_id];
@@ -122,8 +121,7 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                        queue_work(hdev->cq_wq, &job->finish_work);
                }
-                /*
+                /* Update ci of the context's queue. There is no
-                 * Update ci of the context's queue. There is no
                 * need to protect it with spinlock because this update is
                 * done only inside IRQ and there is a different IRQ per
                 * queue
@@ -131,7 +129,8 @@ irqreturn_t hl_irq_handler_cq(int irq, void *arg)
                queue->ci = hl_queue_inc_ptr(queue->ci);
                /* Clear CQ entry ready bit */
-                cq_base[cq->ci] &= ~CQ_ENTRY_READY_MASK;
+                cq_entry->data = cpu_to_le32(le32_to_cpu(cq_entry->data) &
+                                                ~CQ_ENTRY_READY_MASK);
                cq->ci = hl_cq_inc_ptr(cq->ci);
diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c
index 42d237cae1dc..365fb0cb8dff 100644
--- a/drivers/misc/habanalabs/memory.c
+++ b/drivers/misc/habanalabs/memory.c
@@ -1629,6 +1629,8 @@ void hl_vm_ctx_fini(struct hl_ctx *ctx)
                        dev_dbg(hdev->dev,
                                "page list 0x%p of asid %d is still alive\n",
                                phys_pg_list, ctx->asid);
+                        atomic64_sub(phys_pg_list->total_size,
+                                        &hdev->dram_used_mem);
                        free_phys_pg_pack(hdev, phys_pg_list);
                        idr_remove(&vm->phys_pg_pack_handles, i);
                }
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index d681e8aaca83..fe914ff5f5d6 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -1292,6 +1292,12 @@ int mmc_attach_sd(struct mmc_host *host)
                        goto err;
        }
+        /*
+         * Some SD cards claims an out of spec VDD voltage range. Let's treat
+         * these bits as being in-valid and especially also bit7.
+         */
+        ocr &= ~0x7FFF;
        rocr = mmc_select_voltage(host, ocr);
        /*
diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c
index 163d1cf4367e..44139fceac24 100644
--- a/drivers/mmc/host/sdhci-cadence.c
+++ b/drivers/mmc/host/sdhci-cadence.c
@@ -369,6 +369,7 @@ static int sdhci_cdns_probe(struct platform_device *pdev)
        host->mmc_host_ops.execute_tuning = sdhci_cdns_execute_tuning;
        host->mmc_host_ops.hs400_enhanced_strobe =
                                sdhci_cdns_hs400_enhanced_strobe;
+        sdhci_enable_v4_mode(host);
        sdhci_get_of_property(pdev);
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index d4e7e8b7be77..e7d1920729fb 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -357,6 +357,9 @@ static int sdhci_at91_probe(struct platform_device *pdev)
        pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
        pm_runtime_use_autosuspend(&pdev->dev);
+        /* HS200 is broken at this moment */
+        host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
        ret = sdhci_add_host(host);
        if (ret)
                goto pm_runtime_disable;
diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index 83a4767ca680..d07b9793380f 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -217,10 +217,11 @@ static inline void _sdhci_sprd_set_clock(struct sdhci_host *host,
        struct sdhci_sprd_host *sprd_host = TO_SPRD_HOST(host);
        u32 div, val, mask;
-        div = sdhci_sprd_calc_div(sprd_host->base_rate, clk);
+        sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL);
-        clk |= ((div & 0x300) >> 2) | ((div & 0xFF) << 8);
+        div = sdhci_sprd_calc_div(sprd_host->base_rate, clk);
-        sdhci_enable_clk(host, clk);
+        div = ((div & 0x300) >> 2) | ((div & 0xFF) << 8);
+        sdhci_enable_clk(host, div);
        /* enable auto gate sdhc_enable_auto_gate */
        val = sdhci_readl(host, SDHCI_SPRD_REG_32_BUSY_POSI);
@@ -373,6 +374,11 @@ static unsigned int sdhci_sprd_get_max_timeout_count(struct sdhci_host *host)
        return 1 << 31;
 }
+static unsigned int sdhci_sprd_get_ro(struct sdhci_host *host)
+{
+        return 0;
+}
 static struct sdhci_ops sdhci_sprd_ops = {
        .read_l = sdhci_sprd_readl,
        .write_l = sdhci_sprd_writel,
@@ -385,6 +391,7 @@ static struct sdhci_ops sdhci_sprd_ops = {
        .set_uhs_signaling = sdhci_sprd_set_uhs_signaling,
        .hw_reset = sdhci_sprd_hw_reset,
        .get_max_timeout_count = sdhci_sprd_get_max_timeout_count,
+        .get_ro = sdhci_sprd_get_ro,
 };
 static void sdhci_sprd_request(struct mmc_host *mmc, struct mmc_request *mrq)
@@ -501,9 +508,12 @@ static void sdhci_sprd_phy_param_parse(struct sdhci_sprd_host *sprd_host,
 }
 static const struct sdhci_pltfm_data sdhci_sprd_pdata = {
-        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+        .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
+                  SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+                  SDHCI_QUIRK_MISSING_CAPS,
        .quirks2 = SDHCI_QUIRK2_BROKEN_HS200 |
-                   SDHCI_QUIRK2_USE_32BIT_BLK_CNT,
+                   SDHCI_QUIRK2_USE_32BIT_BLK_CNT |
+                   SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
        .ops = &sdhci_sprd_ops,
 };
@@ -605,6 +615,16 @@ static int sdhci_sprd_probe(struct platform_device *pdev)
        sdhci_enable_v4_mode(host);
+        /*
+         * Supply the existing CAPS, but clear the UHS-I modes. This
+         * will allow these modes to be specified only by device
+         * tree properties through mmc_of_parse().
+         */
+        host->caps = sdhci_readl(host, SDHCI_CAPABILITIES);
+        host->caps1 = sdhci_readl(host, SDHCI_CAPABILITIES_1);
+        host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_SDR104 |
+                         SDHCI_SUPPORT_DDR50);
        ret = sdhci_setup_host(host);
        if (ret)
                goto pm_runtime_disable;
diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
index f4d4761cf20a..02d8f524bb9e 100644
--- a/drivers/mmc/host/sdhci-tegra.c
+++ b/drivers/mmc/host/sdhci-tegra.c
@@ -258,6 +258,16 @@ static void tegra210_sdhci_writew(struct sdhci_host *host, u16 val, int reg)
        }
 }
+static unsigned int tegra_sdhci_get_ro(struct sdhci_host *host)
+{
+        /*
+         * Write-enable shall be assumed if GPIO is missing in a board's
+         * device-tree because SDHCI's WRITE_PROTECT bit doesn't work on
+         * Tegra.
+         */
+        return mmc_gpio_get_ro(host->mmc);
+}
 static bool tegra_sdhci_is_pad_and_regulator_valid(struct sdhci_host *host)
 {
        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
@@ -1224,6 +1234,7 @@ static const struct cqhci_host_ops sdhci_tegra_cqhci_ops = {
 };
 static const struct sdhci_ops tegra_sdhci_ops = {
+        .get_ro     = tegra_sdhci_get_ro,
        .read_w     = tegra_sdhci_readw,
        .write_l    = tegra_sdhci_writel,
        .set_clock  = tegra_sdhci_set_clock,
@@ -1279,6 +1290,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra30 = {
 };
 static const struct sdhci_ops tegra114_sdhci_ops = {
+        .get_ro     = tegra_sdhci_get_ro,
        .read_w     = tegra_sdhci_readw,
        .write_w    = tegra_sdhci_writew,
        .write_l    = tegra_sdhci_writel,
@@ -1332,6 +1344,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra124 = {
 };
 static const struct sdhci_ops tegra210_sdhci_ops = {
+        .get_ro     = tegra_sdhci_get_ro,
        .read_w     = tegra_sdhci_readw,
        .write_w    = tegra210_sdhci_writew,
        .write_l    = tegra_sdhci_writel,
@@ -1366,6 +1379,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra210 = {
 };
 static const struct sdhci_ops tegra186_sdhci_ops = {
+        .get_ro     = tegra_sdhci_get_ro,
        .read_w     = tegra_sdhci_readw,
        .write_l    = tegra_sdhci_writel,
        .set_clock  = tegra_sdhci_set_clock,
diff --git a/drivers/mtd/hyperbus/Kconfig b/drivers/mtd/hyperbus/Kconfig
index b4e3caf7d799..a4d8968d133d 100644
--- a/drivers/mtd/hyperbus/Kconfig
+++ b/drivers/mtd/hyperbus/Kconfig
@@ -1,5 +1,6 @@
 menuconfig MTD_HYPERBUS
        tristate "HyperBus support"
+        depends on HAS_IOMEM
        select MTD_CFI
        select MTD_MAP_BANK_WIDTH_2
        select MTD_CFI_AMDSTD
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 895510d40ce4..47602af4ee34 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -81,6 +81,7 @@ static int sa1100_probe_subdev(struct sa_subdev_info *subdev, struct resource *r
        default:
                printk(KERN_WARNING "SA1100 flash: unknown base address "
                       "0x%08lx, assuming CS0\n", phys);
+                /* Fall through */
        case SA1100_CS0_PHYS:
                subdev->map.bankwidth = (MSC0 & MSC_RBW) ? 2 : 4;
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 03cc788511d5..654bdc41fc99 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -3780,8 +3780,6 @@ static int spi_nor_init_params(struct spi_nor *nor,
                default:
                        /* Kept only for backward compatibility purpose. */
                        params->quad_enable = spansion_quad_enable;
-                        if (nor->clear_sr_bp)
-                                nor->clear_sr_bp = spi_nor_spansion_clear_sr_bp;
                        break;
                }
@@ -4035,6 +4033,9 @@ static int spi_nor_init(struct spi_nor *nor)
        int err;
        if (nor->clear_sr_bp) {
+                if (nor->quad_enable == spansion_quad_enable)
+                        nor->clear_sr_bp = spi_nor_spansion_clear_sr_bp;
                err = nor->clear_sr_bp(nor);
                if (err) {
                        dev_err(nor->dev,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 02fd7822c14a..931d9d935686 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1126,6 +1126,8 @@ static void bond_compute_features(struct bonding *bond)
 done:
        bond_dev->vlan_features = vlan_features;
        bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+                                    NETIF_F_HW_VLAN_CTAG_TX |
+                                    NETIF_F_HW_VLAN_STAG_TX |
                                    NETIF_F_GSO_UDP_L4;
        bond_dev->mpls_features = mpls_features;
        bond_dev->gso_max_segs = gso_max_segs;
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 3811fdbda13e..28c963a21dac 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -478,6 +478,7 @@ static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port,
                                unsigned long *supported,
                                struct phylink_link_state *state)
 {
+        struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
        __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
        if (!phy_interface_mode_is_rgmii(state->interface) &&
@@ -487,8 +488,10 @@ static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port,
            state->interface != PHY_INTERFACE_MODE_INTERNAL &&
            state->interface != PHY_INTERFACE_MODE_MOCA) {
                bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
-                dev_err(ds->dev,
+                if (port != core_readl(priv, CORE_IMP0_PRT_ID))
-                        "Unsupported interface: %d\n", state->interface);
+                        dev_err(ds->dev,
+                                "Unsupported interface: %d for port %d\n",
+                                state->interface, port);
                return;
        }
@@ -526,6 +529,9 @@ static void bcm_sf2_sw_mac_config(struct dsa_switch *ds, int port,
        u32 id_mode_dis = 0, port_mode;
        u32 reg, offset;
+        if (port == core_readl(priv, CORE_IMP0_PRT_ID))
+                return;
        if (priv->type == BCM7445_DEVICE_ID)
                offset = CORE_STS_OVERRIDE_GMIIP_PORT(port);
        else
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index d073baffc20b..df976b259e43 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1223,12 +1223,8 @@ static int sja1105_fdb_dump(struct dsa_switch *ds, int port,
 {
        struct sja1105_private *priv = ds->priv;
        struct device *dev = ds->dev;
-        u16 rx_vid, tx_vid;
        int i;
-        rx_vid = dsa_8021q_rx_vid(ds, port);
-        tx_vid = dsa_8021q_tx_vid(ds, port);
        for (i = 0; i < SJA1105_MAX_L2_LOOKUP_COUNT; i++) {
                struct sja1105_l2_lookup_entry l2_lookup = {0};
                u8 macaddr[ETH_ALEN];
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index e47ea92e2ae3..d10b421ed1f1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3057,12 +3057,13 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
        /* if VF indicate to PF this function is going down (PF will delete sp
         * elements and clear initializations
         */
-        if (IS_VF(bp))
+        if (IS_VF(bp)) {
+                bnx2x_clear_vlan_info(bp);
                bnx2x_vfpf_close_vf(bp);
-        else if (unload_mode != UNLOAD_RECOVERY)
+        } else if (unload_mode != UNLOAD_RECOVERY) {
                /* if this is a normal/close unload need to clean up chip*/
                bnx2x_chip_cleanup(bp, unload_mode, keep_link);
-        else {
+        } else {
                /* Send the UNLOAD_REQUEST to the MCP */
                bnx2x_send_unload_req(bp, unload_mode);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index c2f6e44e9a3f..8b08cb18e363 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -425,6 +425,8 @@ void bnx2x_set_reset_global(struct bnx2x *bp);
 void bnx2x_disable_close_the_gate(struct bnx2x *bp);
 int bnx2x_init_hw_func_cnic(struct bnx2x *bp);
+void bnx2x_clear_vlan_info(struct bnx2x *bp);
 /**
 * bnx2x_sp_event - handle ramrods completion.
 *
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2cc14db8f0ec..192ff8d5da32 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -8482,11 +8482,21 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
        return rc;
 }
+void bnx2x_clear_vlan_info(struct bnx2x *bp)
+{
+        struct bnx2x_vlan_entry *vlan;
+        /* Mark that hw forgot all entries */
+        list_for_each_entry(vlan, &bp->vlan_reg, link)
+                vlan->hw = false;
+        bp->vlan_cnt = 0;
+}
 static int bnx2x_del_all_vlans(struct bnx2x *bp)
 {
        struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
        unsigned long ramrod_flags = 0, vlan_flags = 0;
-        struct bnx2x_vlan_entry *vlan;
        int rc;
        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
@@ -8495,10 +8505,7 @@ static int bnx2x_del_all_vlans(struct bnx2x *bp)
        if (rc)
                return rc;
-        /* Mark that hw forgot all entries */
+        bnx2x_clear_vlan_info(bp);
-        list_for_each_entry(vlan, &bp->vlan_reg, link)
-                vlan->hw = false;
-        bp->vlan_cnt = 0;
        return 0;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 7070349915bc..8dce4069472b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2021,9 +2021,9 @@ static void __bnxt_poll_work_done(struct bnxt *bp, struct bnxt_napi *bnapi)
        if (bnapi->events & BNXT_RX_EVENT) {
                struct bnxt_rx_ring_info *rxr = bnapi->rx_ring;
-                bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod);
                if (bnapi->events & BNXT_AGG_EVENT)
                        bnxt_db_write(bp, &rxr->rx_agg_db, rxr->rx_agg_prod);
+                bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod);
        }
        bnapi->events = 0;
 }
@@ -5064,6 +5064,7 @@ static void bnxt_set_db(struct bnxt *bp, struct bnxt_db_info *db, u32 ring_type,
 static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
 {
+        bool agg_rings = !!(bp->flags & BNXT_FLAG_AGG_RINGS);
        int i, rc = 0;
        u32 type;
@@ -5139,7 +5140,9 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                if (rc)
                        goto err_out;
                bnxt_set_db(bp, &rxr->rx_db, type, map_idx, ring->fw_ring_id);
-                bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod);
+                /* If we have agg rings, post agg buffers first. */
+                if (!agg_rings)
+                        bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod);
                bp->grp_info[map_idx].rx_fw_ring_id = ring->fw_ring_id;
                if (bp->flags & BNXT_FLAG_CHIP_P5) {
                        struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
@@ -5158,7 +5161,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                }
        }
-        if (bp->flags & BNXT_FLAG_AGG_RINGS) {
+        if (agg_rings) {
                type = HWRM_RING_ALLOC_AGG;
                for (i = 0; i < bp->rx_nr_rings; i++) {
                        struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
@@ -5174,6 +5177,7 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
                        bnxt_set_db(bp, &rxr->rx_agg_db, type, map_idx,
                                    ring->fw_ring_id);
                        bnxt_db_write(bp, &rxr->rx_agg_db, rxr->rx_agg_prod);
+                        bnxt_db_write(bp, &rxr->rx_db, rxr->rx_prod);
                        bp->grp_info[grp_idx].agg_fw_ring_id = ring->fw_ring_id;
                }
        }
@@ -7016,19 +7020,29 @@ static void bnxt_hwrm_clear_vnic_rss(struct bnxt *bp)
                bnxt_hwrm_vnic_set_rss(bp, i, false);
 }
-static void bnxt_hwrm_resource_free(struct bnxt *bp, bool close_path,
+static void bnxt_clear_vnic(struct bnxt *bp)
-                                    bool irq_re_init)
 {
-        if (bp->vnic_info) {
+        if (!bp->vnic_info)
-                bnxt_hwrm_clear_vnic_filter(bp);
+                return;
+        bnxt_hwrm_clear_vnic_filter(bp);
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5)) {
                /* clear all RSS setting before free vnic ctx */
                bnxt_hwrm_clear_vnic_rss(bp);
                bnxt_hwrm_vnic_ctx_free(bp);
-                /* before free the vnic, undo the vnic tpa settings */
-                if (bp->flags & BNXT_FLAG_TPA)
-                        bnxt_set_tpa(bp, false);
-                bnxt_hwrm_vnic_free(bp);
        }
+        /* before free the vnic, undo the vnic tpa settings */
+        if (bp->flags & BNXT_FLAG_TPA)
+                bnxt_set_tpa(bp, false);
+        bnxt_hwrm_vnic_free(bp);
+        if (bp->flags & BNXT_FLAG_CHIP_P5)
+                bnxt_hwrm_vnic_ctx_free(bp);
+}
+static void bnxt_hwrm_resource_free(struct bnxt *bp, bool close_path,
+                                    bool irq_re_init)
+{
+        bnxt_clear_vnic(bp);
        bnxt_hwrm_ring_free(bp, close_path);
        bnxt_hwrm_ring_grp_free(bp);
        if (irq_re_init) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 549c90d3e465..c05d663212b2 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -98,10 +98,13 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
        if (idx)
                req->dimensions = cpu_to_le16(1);
-        if (req->req_type == cpu_to_le16(HWRM_NVM_SET_VARIABLE))
+        if (req->req_type == cpu_to_le16(HWRM_NVM_SET_VARIABLE)) {
                memcpy(data_addr, buf, bytesize);
+                rc = hwrm_send_message(bp, msg, msg_len, HWRM_CMD_TIMEOUT);
-        rc = hwrm_send_message(bp, msg, msg_len, HWRM_CMD_TIMEOUT);
+        } else {
+                rc = hwrm_send_message_silent(bp, msg, msg_len,
+                                              HWRM_CMD_TIMEOUT);
+        }
        if (!rc && req->req_type == cpu_to_le16(HWRM_NVM_GET_VARIABLE))
                memcpy(buf, data_addr, bytesize);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index c7ee63d69679..8445a0cce849 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2016,21 +2016,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
        mutex_lock(&bp->hwrm_cmd_lock);
        hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
                                      INSTALL_PACKAGE_TIMEOUT);
-        if (hwrm_err)
+        if (hwrm_err) {
-                goto flash_pkg_exit;
-        if (resp->error_code) {
                u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
-                if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+                if (resp->error_code && error_code ==
+                    NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
                        install.flags |= cpu_to_le16(
                               NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
                        hwrm_err = _hwrm_send_message(bp, &install,
                                                      sizeof(install),
                                                      INSTALL_PACKAGE_TIMEOUT);
-                        if (hwrm_err)
-                                goto flash_pkg_exit;
                }
+                if (hwrm_err)
+                        goto flash_pkg_exit;
        }
        if (resp->result) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 6fe4a7174271..dd621f6bd127 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -1236,7 +1236,7 @@ static int __bnxt_tc_del_flow(struct bnxt *bp,
 static void bnxt_tc_set_flow_dir(struct bnxt *bp, struct bnxt_tc_flow *flow,
                                 u16 src_fid)
 {
-        flow->dir = (bp->pf.fw_fid == src_fid) ? BNXT_DIR_RX : BNXT_DIR_TX;
+        flow->l2_key.dir = (bp->pf.fw_fid == src_fid) ? BNXT_DIR_RX : BNXT_DIR_TX;
 }
 static void bnxt_tc_set_src_fid(struct bnxt *bp, struct bnxt_tc_flow *flow,
@@ -1285,9 +1285,7 @@ static int bnxt_tc_add_flow(struct bnxt *bp, u16 src_fid,
                goto free_node;
        bnxt_tc_set_src_fid(bp, flow, src_fid);
+        bnxt_tc_set_flow_dir(bp, flow, flow->src_fid);
-        if (bp->fw_cap & BNXT_FW_CAP_OVS_64BIT_HANDLE)
-                bnxt_tc_set_flow_dir(bp, flow, src_fid);
        if (!bnxt_tc_can_offload(bp, flow)) {
                rc = -EOPNOTSUPP;
@@ -1407,7 +1405,7 @@ static void bnxt_fill_cfa_stats_req(struct bnxt *bp,
                 * 2. 15th bit of flow_handle must specify the flow
                 *    direction (TX/RX).
                 */
-                if (flow_node->flow.dir == BNXT_DIR_RX)
+                if (flow_node->flow.l2_key.dir == BNXT_DIR_RX)
                        handle = CFA_FLOW_INFO_REQ_FLOW_HANDLE_DIR_RX |
                                 CFA_FLOW_INFO_REQ_FLOW_HANDLE_MAX_MASK;
                else
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
index ffec57d1a5ec..4f05305052f2 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
@@ -23,6 +23,9 @@ struct bnxt_tc_l2_key {
        __be16          inner_vlan_tci;
        __be16          ether_type;
        u8              num_vlans;
+        u8              dir;
+#define BNXT_DIR_RX     1
+#define BNXT_DIR_TX     0
 };
 struct bnxt_tc_l3_key {
@@ -98,9 +101,6 @@ struct bnxt_tc_flow {
        /* flow applicable to pkts ingressing on this fid */
        u16                             src_fid;
-        u8                              dir;
-#define BNXT_DIR_RX     1
-#define BNXT_DIR_TX     0
        struct bnxt_tc_l2_key           l2_key;
        struct bnxt_tc_l2_key           l2_mask;
        struct bnxt_tc_l3_key           l3_key;
diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c
index 73632b843749..b821c9e1604c 100644
--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c
+++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c
@@ -10,7 +10,7 @@
 #include "cavium_ptp.h"
-#define DRV_NAME        "Cavium PTP Driver"
+#define DRV_NAME "cavium_ptp"
 #define PCI_DEVICE_ID_CAVIUM_PTP        0xA00C
 #define PCI_DEVICE_ID_CAVIUM_RST        0xA00E
diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
index 032224178b64..6dd65f9b347c 100644
--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
+++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
@@ -237,8 +237,10 @@ int octeon_setup_iq(struct octeon_device *oct,
        }
        oct->num_iqs++;
-        if (oct->fn_list.enable_io_queues(oct))
+        if (oct->fn_list.enable_io_queues(oct)) {
+                octeon_delete_instr_queue(oct, iq_no);
                return 1;
+        }
        return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 02959035ed3f..d692251ee252 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -3236,8 +3236,10 @@ static ssize_t blocked_fl_write(struct file *filp, const char __user *ubuf,
                return -ENOMEM;
        err = bitmap_parse_user(ubuf, count, t, adap->sge.egr_sz);
-        if (err)
+        if (err) {
+                kvfree(t);
                return err;
+        }
        bitmap_copy(adap->sge.blocked_fl, t, adap->sge.egr_sz);
        kvfree(t);
diff --git a/drivers/net/ethernet/ezchip/nps_enet.h b/drivers/net/ethernet/ezchip/nps_enet.h
index 133acca0bf31..092da2d90026 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.h
+++ b/drivers/net/ethernet/ezchip/nps_enet.h
@@ -167,7 +167,7 @@ struct nps_enet_priv {
 };
 /**
- * nps_reg_set - Sets ENET register with provided value.
+ * nps_enet_reg_set - Sets ENET register with provided value.
 * @priv:       Pointer to EZchip ENET private data structure.
 * @reg:        Register offset from base address.
 * @value:      Value to set in register.
@@ -179,7 +179,7 @@ static inline void nps_enet_reg_set(struct nps_enet_priv *priv,
 }
 /**
- * nps_reg_get - Gets value of specified ENET register.
+ * nps_enet_reg_get - Gets value of specified ENET register.
 * @priv:       Pointer to EZchip ENET private data structure.
 * @reg:        Register offset from base address.
 *
diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 497298752381..aca95f64bde8 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -50,7 +50,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
                                  u64_stats_fetch_begin(&priv->tx[ring].statss);
                                s->tx_packets += priv->tx[ring].pkt_done;
                                s->tx_bytes += priv->tx[ring].bytes_done;
-                        } while (u64_stats_fetch_retry(&priv->rx[ring].statss,
+                        } while (u64_stats_fetch_retry(&priv->tx[ring].statss,
                                                       start));
                }
        }
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index d654c234aaf7..c5be4ebd8437 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1605,7 +1605,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
        struct net_device *netdev;
        struct ibmveth_adapter *adapter;
        unsigned char *mac_addr_p;
-        unsigned int *mcastFilterSize_p;
+        __be32 *mcastFilterSize_p;
        long ret;
        unsigned long ret_attr;
@@ -1627,8 +1627,9 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
                return -EINVAL;
        }
-        mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
+        mcastFilterSize_p = (__be32 *)vio_get_attribute(dev,
-                                                VETH_MCAST_FILTER_SIZE, NULL);
+                                                        VETH_MCAST_FILTER_SIZE,
+                                                        NULL);
        if (!mcastFilterSize_p) {
                dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE "
                        "attribute\n");
@@ -1645,7 +1646,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
        adapter->vdev = dev;
        adapter->netdev = netdev;
-        adapter->mcastFilterSize = *mcastFilterSize_p;
+        adapter->mcastFilterSize = be32_to_cpu(*mcastFilterSize_p);
        adapter->pool_config = 0;
        netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 3da680073265..cebd20f3128d 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1568,6 +1568,8 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                lpar_rc = send_subcrq_indirect(adapter, handle_array[queue_num],
                                               (u64)tx_buff->indir_dma,
                                               (u64)num_entries);
+                dma_unmap_single(dev, tx_buff->indir_dma,
+                                 sizeof(tx_buff->indir_arr), DMA_TO_DEVICE);
        } else {
                tx_buff->num_entries = num_entries;
                lpar_rc = send_subcrq(adapter, handle_array[queue_num],
@@ -2788,7 +2790,6 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter,
        union sub_crq *next;
        int index;
        int i, j;
-        u8 *first;
 restart_loop:
        while (pending_scrq(adapter, scrq)) {
@@ -2818,14 +2819,6 @@ restart_loop:
                                txbuff->data_dma[j] = 0;
                        }
-                        /* if sub_crq was sent indirectly */
-                        first = &txbuff->indir_arr[0].generic.first;
-                        if (*first == IBMVNIC_CRQ_CMD) {
-                                dma_unmap_single(dev, txbuff->indir_dma,
-                                                 sizeof(txbuff->indir_arr),
-                                                 DMA_TO_DEVICE);
-                                *first = 0;
-                        }
                        if (txbuff->last_frag) {
                                dev_kfree_skb_any(txbuff->skb);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index cbaf712d6529..7882148abb43 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7897,11 +7897,8 @@ static void ixgbe_service_task(struct work_struct *work)
                return;
        }
        if (ixgbe_check_fw_error(adapter)) {
-                if (!test_bit(__IXGBE_DOWN, &adapter->state)) {
+                if (!test_bit(__IXGBE_DOWN, &adapter->state))
-                        rtnl_lock();
                        unregister_netdev(adapter->netdev);
-                        rtnl_unlock();
-                }
                ixgbe_service_event_complete(adapter);
                return;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 6c01314e87b0..db3552f2d087 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -1187,7 +1187,7 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
        err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp);
        if (err) {
                en_err(priv, "Failed to allocate RSS indirection QP\n");
-                goto rss_err;
+                goto qp_alloc_err;
        }
        rss_map->indir_qp->event = mlx4_en_sqp_event;
@@ -1241,6 +1241,7 @@ indir_err:
                       MLX4_QP_STATE_RST, NULL, 0, 0, rss_map->indir_qp);
        mlx4_qp_remove(mdev->dev, rss_map->indir_qp);
        mlx4_qp_free(mdev->dev, rss_map->indir_qp);
+qp_alloc_err:
        kfree(rss_map->indir_qp);
        rss_map->indir_qp = NULL;
 rss_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index ce1be2a84231..65bec19a438f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -184,8 +184,13 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
 struct mlx5e_tx_wqe {
        struct mlx5_wqe_ctrl_seg ctrl;
-        struct mlx5_wqe_eth_seg  eth;
+        union {
-        struct mlx5_wqe_data_seg data[0];
+                struct {
+                        struct mlx5_wqe_eth_seg  eth;
+                        struct mlx5_wqe_data_seg data[0];
+                };
+                u8 tls_progress_params_ctx[0];
+        };
 };
 struct mlx5e_rx_wqe_ll {
@@ -1100,6 +1105,8 @@ u32 mlx5e_ethtool_get_rxfh_key_size(struct mlx5e_priv *priv);
 u32 mlx5e_ethtool_get_rxfh_indir_size(struct mlx5e_priv *priv);
 int mlx5e_ethtool_get_ts_info(struct mlx5e_priv *priv,
                              struct ethtool_ts_info *info);
+int mlx5e_ethtool_flash_device(struct mlx5e_priv *priv,
+                               struct ethtool_flash *flash);
 void mlx5e_ethtool_get_pauseparam(struct mlx5e_priv *priv,
                                  struct ethtool_pauseparam *pauseparam);
 int mlx5e_ethtool_set_pauseparam(struct mlx5e_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
index f3d98748b211..c7f86453c638 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c
@@ -76,26 +76,21 @@ static int mlx5e_tx_reporter_err_cqe_recover(struct mlx5e_txqsq *sq)
        u8 state;
        int err;
-        if (!test_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state))
-                return 0;
        err = mlx5_core_query_sq_state(mdev, sq->sqn, &state);
        if (err) {
                netdev_err(dev, "Failed to query SQ 0x%x state. err = %d\n",
                           sq->sqn, err);
-                return err;
+                goto out;
        }
-        if (state != MLX5_SQC_STATE_ERR) {
+        if (state != MLX5_SQC_STATE_ERR)
-                netdev_err(dev, "SQ 0x%x not in ERROR state\n", sq->sqn);
+                goto out;
-                return -EINVAL;
-        }
        mlx5e_tx_disable_queue(sq->txq);
        err = mlx5e_wait_for_sq_flush(sq);
        if (err)
-                return err;
+                goto out;
        /* At this point, no new packets will arrive from the stack as TXQ is
         * marked with QUEUE_STATE_DRV_XOFF. In addition, NAPI cleared all
@@ -104,13 +99,17 @@ static int mlx5e_tx_reporter_err_cqe_recover(struct mlx5e_txqsq *sq)
        err = mlx5e_sq_to_ready(sq, state);
        if (err)
-                return err;
+                goto out;
        mlx5e_reset_txqsq_cc_pc(sq);
        sq->stats->recover++;
+        clear_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state);
        mlx5e_activate_txqsq(sq);
        return 0;
+out:
+        clear_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state);
+        return err;
 }
 static int mlx5_tx_health_report(struct devlink_health_reporter *tx_reporter,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
index aaffa6f68dc0..7f78c004d12f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
@@ -143,7 +143,10 @@ void mlx5e_activate_xsk(struct mlx5e_channel *c)
 {
        set_bit(MLX5E_RQ_STATE_ENABLED, &c->xskrq.state);
        /* TX queue is created active. */
+        spin_lock(&c->xskicosq_lock);
        mlx5e_trigger_irq(&c->xskicosq);
+        spin_unlock(&c->xskicosq_lock);
 }
 void mlx5e_deactivate_xsk(struct mlx5e_channel *c)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
index 407da83474ef..b7298f9ee3d3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
@@ -11,12 +11,14 @@
 #include "accel/tls.h"
 #define MLX5E_KTLS_STATIC_UMR_WQE_SZ \
-        (sizeof(struct mlx5e_umr_wqe) + MLX5_ST_SZ_BYTES(tls_static_params))
+        (offsetof(struct mlx5e_umr_wqe, tls_static_params_ctx) + \
+         MLX5_ST_SZ_BYTES(tls_static_params))
 #define MLX5E_KTLS_STATIC_WQEBBS \
        (DIV_ROUND_UP(MLX5E_KTLS_STATIC_UMR_WQE_SZ, MLX5_SEND_WQE_BB))
 #define MLX5E_KTLS_PROGRESS_WQE_SZ \
-        (sizeof(struct mlx5e_tx_wqe) + MLX5_ST_SZ_BYTES(tls_progress_params))
+        (offsetof(struct mlx5e_tx_wqe, tls_progress_params_ctx) + \
+         MLX5_ST_SZ_BYTES(tls_progress_params))
 #define MLX5E_KTLS_PROGRESS_WQEBBS \
        (DIV_ROUND_UP(MLX5E_KTLS_PROGRESS_WQE_SZ, MLX5_SEND_WQE_BB))
 #define MLX5E_KTLS_MAX_DUMP_WQEBBS 2
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
index 3766545ce259..7833ddef0427 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
@@ -69,7 +69,7 @@ build_static_params(struct mlx5e_umr_wqe *wqe, u16 pc, u32 sqn,
        cseg->qpn_ds           = cpu_to_be32((sqn << MLX5_WQE_CTRL_QPN_SHIFT) |
                                             STATIC_PARAMS_DS_CNT);
        cseg->fm_ce_se         = fence ? MLX5_FENCE_MODE_INITIATOR_SMALL : 0;
-        cseg->imm              = cpu_to_be32(priv_tx->tisn);
+        cseg->tisn             = cpu_to_be32(priv_tx->tisn << 8);
        ucseg->flags = MLX5_UMR_INLINE;
        ucseg->bsf_octowords = cpu_to_be16(MLX5_ST_SZ_BYTES(tls_static_params) / 16);
@@ -80,7 +80,7 @@ build_static_params(struct mlx5e_umr_wqe *wqe, u16 pc, u32 sqn,
 static void
 fill_progress_params_ctx(void *ctx, struct mlx5e_ktls_offload_context_tx *priv_tx)
 {
-        MLX5_SET(tls_progress_params, ctx, pd, priv_tx->tisn);
+        MLX5_SET(tls_progress_params, ctx, tisn, priv_tx->tisn);
        MLX5_SET(tls_progress_params, ctx, record_tracker_state,
                 MLX5E_TLS_PROGRESS_PARAMS_RECORD_TRACKER_STATE_START);
        MLX5_SET(tls_progress_params, ctx, auth_state,
@@ -104,18 +104,20 @@ build_progress_params(struct mlx5e_tx_wqe *wqe, u16 pc, u32 sqn,
                                             PROGRESS_PARAMS_DS_CNT);
        cseg->fm_ce_se         = fence ? MLX5_FENCE_MODE_INITIATOR_SMALL : 0;
-        fill_progress_params_ctx(wqe->data, priv_tx);
+        fill_progress_params_ctx(wqe->tls_progress_params_ctx, priv_tx);
 }
 static void tx_fill_wi(struct mlx5e_txqsq *sq,
                       u16 pi, u8 num_wqebbs,
-                       skb_frag_t *resync_dump_frag)
+                       skb_frag_t *resync_dump_frag,
+                       u32 num_bytes)
 {
        struct mlx5e_tx_wqe_info *wi = &sq->db.wqe_info[pi];
        wi->skb              = NULL;
        wi->num_wqebbs       = num_wqebbs;
        wi->resync_dump_frag = resync_dump_frag;
+        wi->num_bytes        = num_bytes;
 }
 void mlx5e_ktls_tx_offload_set_pending(struct mlx5e_ktls_offload_context_tx *priv_tx)
@@ -143,7 +145,7 @@ post_static_params(struct mlx5e_txqsq *sq,
        umr_wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_STATIC_UMR_WQE_SZ, &pi);
        build_static_params(umr_wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, NULL);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, NULL, 0);
        sq->pc += MLX5E_KTLS_STATIC_WQEBBS;
 }
@@ -157,7 +159,7 @@ post_progress_params(struct mlx5e_txqsq *sq,
        wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_PROGRESS_WQE_SZ, &pi);
        build_progress_params(wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, NULL);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, NULL, 0);
        sq->pc += MLX5E_KTLS_PROGRESS_WQEBBS;
 }
@@ -248,43 +250,37 @@ tx_post_resync_params(struct mlx5e_txqsq *sq,
        mlx5e_ktls_tx_post_param_wqes(sq, priv_tx, skip_static_post, true);
 }
+struct mlx5e_dump_wqe {
+        struct mlx5_wqe_ctrl_seg ctrl;
+        struct mlx5_wqe_data_seg data;
+};
 static int
 tx_post_resync_dump(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                    skb_frag_t *frag, u32 tisn, bool first)
 {
        struct mlx5_wqe_ctrl_seg *cseg;
-        struct mlx5_wqe_eth_seg  *eseg;
        struct mlx5_wqe_data_seg *dseg;
-        struct mlx5e_tx_wqe *wqe;
+        struct mlx5e_dump_wqe *wqe;
        dma_addr_t dma_addr = 0;
-        u16 ds_cnt, ds_cnt_inl;
        u8  num_wqebbs;
-        u16 pi, ihs;
+        u16 ds_cnt;
        int fsz;
+        u16 pi;
-        ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
-        ihs    = eth_get_headlen(skb->dev, skb->data, skb_headlen(skb));
-        ds_cnt_inl = DIV_ROUND_UP(ihs - INL_HDR_START_SZ, MLX5_SEND_WQE_DS);
-        ds_cnt += ds_cnt_inl;
-        ds_cnt += 1; /* one frag */
        wqe = mlx5e_sq_fetch_wqe(sq, sizeof(*wqe), &pi);
+        ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
        num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
        cseg = &wqe->ctrl;
-        eseg = &wqe->eth;
+        dseg = &wqe->data;
-        dseg =  wqe->data;
        cseg->opmod_idx_opcode = cpu_to_be32((sq->pc << 8)  | MLX5_OPCODE_DUMP);
        cseg->qpn_ds           = cpu_to_be32((sq->sqn << 8) | ds_cnt);
-        cseg->imm              = cpu_to_be32(tisn);
+        cseg->tisn             = cpu_to_be32(tisn << 8);
        cseg->fm_ce_se         = first ? MLX5_FENCE_MODE_INITIATOR_SMALL : 0;
-        eseg->inline_hdr.sz = cpu_to_be16(ihs);
-        memcpy(eseg->inline_hdr.start, skb->data, ihs);
-        dseg += ds_cnt_inl;
        fsz = skb_frag_size(frag);
        dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz,
                                    DMA_TO_DEVICE);
@@ -296,7 +292,7 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        dseg->byte_count = cpu_to_be32(fsz);
        mlx5e_dma_push(sq, dma_addr, fsz, MLX5E_DMA_MAP_PAGE);
-        tx_fill_wi(sq, pi, num_wqebbs, frag);
+        tx_fill_wi(sq, pi, num_wqebbs, frag, fsz);
        sq->pc += num_wqebbs;
        WARN(num_wqebbs > MLX5E_KTLS_MAX_DUMP_WQEBBS,
@@ -323,7 +319,7 @@ static void tx_post_fence_nop(struct mlx5e_txqsq *sq)
        struct mlx5_wq_cyc *wq = &sq->wq;
        u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
-        tx_fill_wi(sq, pi, 1, NULL);
+        tx_fill_wi(sq, pi, 1, NULL, 0);
        mlx5e_post_nop_fence(wq, sq->sqn, &sq->pc);
 }
@@ -434,7 +430,7 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
        priv_tx->expected_seq = seq + datalen;
        cseg = &(*wqe)->ctrl;
-        cseg->imm = cpu_to_be32(priv_tx->tisn);
+        cseg->tisn = cpu_to_be32(priv_tx->tisn << 8);
        stats->tls_encrypted_packets += skb_is_gso(skb) ? skb_shinfo(skb)->gso_segs : 1;
        stats->tls_encrypted_bytes   += datalen;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
index 8657e0f26995..2c75b2752f58 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
@@ -437,12 +437,6 @@ arfs_hash_bucket(struct arfs_table *arfs_t, __be16 src_port,
        return &arfs_t->rules_hash[bucket_idx];
 }
-static u8 arfs_get_ip_proto(const struct sk_buff *skb)
-{
-        return (skb->protocol == htons(ETH_P_IP)) ?
-                ip_hdr(skb)->protocol : ipv6_hdr(skb)->nexthdr;
-}
 static struct arfs_table *arfs_get_table(struct mlx5e_arfs_tables *arfs,
                                         u8 ip_proto, __be16 etype)
 {
@@ -602,31 +596,9 @@ out:
        arfs_may_expire_flow(priv);
 }
-/* return L4 destination port from ip4/6 packets */
-static __be16 arfs_get_dst_port(const struct sk_buff *skb)
-{
-        char *transport_header;
-        transport_header = skb_transport_header(skb);
-        if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
-                return ((struct tcphdr *)transport_header)->dest;
-        return ((struct udphdr *)transport_header)->dest;
-}
-/* return L4 source port from ip4/6 packets */
-static __be16 arfs_get_src_port(const struct sk_buff *skb)
-{
-        char *transport_header;
-        transport_header = skb_transport_header(skb);
-        if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
-                return ((struct tcphdr *)transport_header)->source;
-        return ((struct udphdr *)transport_header)->source;
-}
 static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
                                         struct arfs_table *arfs_t,
-                                         const struct sk_buff *skb,
+                                         const struct flow_keys *fk,
                                         u16 rxq, u32 flow_id)
 {
        struct arfs_rule *rule;
@@ -641,19 +613,19 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
        INIT_WORK(&rule->arfs_work, arfs_handle_work);
        tuple = &rule->tuple;
-        tuple->etype = skb->protocol;
+        tuple->etype = fk->basic.n_proto;
+        tuple->ip_proto = fk->basic.ip_proto;
        if (tuple->etype == htons(ETH_P_IP)) {
-                tuple->src_ipv4 = ip_hdr(skb)->saddr;
+                tuple->src_ipv4 = fk->addrs.v4addrs.src;
-                tuple->dst_ipv4 = ip_hdr(skb)->daddr;
+                tuple->dst_ipv4 = fk->addrs.v4addrs.dst;
        } else {
-                memcpy(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
+                memcpy(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
                       sizeof(struct in6_addr));
-                memcpy(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
+                memcpy(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
                       sizeof(struct in6_addr));
        }
-        tuple->ip_proto = arfs_get_ip_proto(skb);
+        tuple->src_port = fk->ports.src;
-        tuple->src_port = arfs_get_src_port(skb);
+        tuple->dst_port = fk->ports.dst;
-        tuple->dst_port = arfs_get_dst_port(skb);
        rule->flow_id = flow_id;
        rule->filter_id = priv->fs.arfs.last_filter_id++ % RPS_NO_FILTER;
@@ -664,37 +636,33 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
        return rule;
 }
-static bool arfs_cmp_ips(struct arfs_tuple *tuple,
+static bool arfs_cmp(const struct arfs_tuple *tuple, const struct flow_keys *fk)
-                         const struct sk_buff *skb)
 {
-        if (tuple->etype == htons(ETH_P_IP) &&
+        if (tuple->src_port != fk->ports.src || tuple->dst_port != fk->ports.dst)
-            tuple->src_ipv4 == ip_hdr(skb)->saddr &&
+                return false;
-            tuple->dst_ipv4 == ip_hdr(skb)->daddr)
+        if (tuple->etype != fk->basic.n_proto)
-                return true;
+                return false;
-        if (tuple->etype == htons(ETH_P_IPV6) &&
+        if (tuple->etype == htons(ETH_P_IP))
-            (!memcmp(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
+                return tuple->src_ipv4 == fk->addrs.v4addrs.src &&
-                     sizeof(struct in6_addr))) &&
+                       tuple->dst_ipv4 == fk->addrs.v4addrs.dst;
-            (!memcmp(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
+        if (tuple->etype == htons(ETH_P_IPV6))
-                     sizeof(struct in6_addr))))
+                return !memcmp(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
-                return true;
+                               sizeof(struct in6_addr)) &&
+                       !memcmp(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
+                               sizeof(struct in6_addr));
        return false;
 }
 static struct arfs_rule *arfs_find_rule(struct arfs_table *arfs_t,
-                                        const struct sk_buff *skb)
+                                        const struct flow_keys *fk)
 {
        struct arfs_rule *arfs_rule;
        struct hlist_head *head;
-        __be16 src_port = arfs_get_src_port(skb);
-        __be16 dst_port = arfs_get_dst_port(skb);
-        head = arfs_hash_bucket(arfs_t, src_port, dst_port);
+        head = arfs_hash_bucket(arfs_t, fk->ports.src, fk->ports.dst);
        hlist_for_each_entry(arfs_rule, head, hlist) {
-                if (arfs_rule->tuple.src_port == src_port &&
+                if (arfs_cmp(&arfs_rule->tuple, fk))
-                    arfs_rule->tuple.dst_port == dst_port &&
-                    arfs_cmp_ips(&arfs_rule->tuple, skb)) {
                        return arfs_rule;
-                }
        }
        return NULL;
@@ -707,20 +675,24 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
        struct mlx5e_arfs_tables *arfs = &priv->fs.arfs;
        struct arfs_table *arfs_t;
        struct arfs_rule *arfs_rule;
+        struct flow_keys fk;
+        if (!skb_flow_dissect_flow_keys(skb, &fk, 0))
+                return -EPROTONOSUPPORT;
-        if (skb->protocol != htons(ETH_P_IP) &&
+        if (fk.basic.n_proto != htons(ETH_P_IP) &&
-            skb->protocol != htons(ETH_P_IPV6))
+            fk.basic.n_proto != htons(ETH_P_IPV6))
                return -EPROTONOSUPPORT;
        if (skb->encapsulation)
                return -EPROTONOSUPPORT;
-        arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol);
+        arfs_t = arfs_get_table(arfs, fk.basic.ip_proto, fk.basic.n_proto);
        if (!arfs_t)
                return -EPROTONOSUPPORT;
        spin_lock_bh(&arfs->arfs_lock);
-        arfs_rule = arfs_find_rule(arfs_t, skb);
+        arfs_rule = arfs_find_rule(arfs_t, &fk);
        if (arfs_rule) {
                if (arfs_rule->rxq == rxq_index) {
                        spin_unlock_bh(&arfs->arfs_lock);
@@ -728,8 +700,7 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
                }
                arfs_rule->rxq = rxq_index;
        } else {
-                arfs_rule = arfs_alloc_rule(priv, arfs_t, skb,
+                arfs_rule = arfs_alloc_rule(priv, arfs_t, &fk, rxq_index, flow_id);
-                                            rxq_index, flow_id);
                if (!arfs_rule) {
                        spin_unlock_bh(&arfs->arfs_lock);
                        return -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 03bed714bac3..20e628c907e5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1081,6 +1081,14 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv,
        link_modes = autoneg == AUTONEG_ENABLE ? ethtool2ptys_adver_func(adver) :
                mlx5e_port_speed2linkmodes(mdev, speed, !ext);
+        if ((link_modes & MLX5E_PROT_MASK(MLX5E_56GBASE_R4)) &&
+            autoneg != AUTONEG_ENABLE) {
+                netdev_err(priv->netdev, "%s: 56G link speed requires autoneg enabled\n",
+                           __func__);
+                err = -EINVAL;
+                goto out;
+        }
        link_modes = link_modes & eproto.cap;
        if (!link_modes) {
                netdev_err(priv->netdev, "%s: Not supported link mode(s) requested",
@@ -1338,6 +1346,9 @@ int mlx5e_ethtool_set_pauseparam(struct mlx5e_priv *priv,
        struct mlx5_core_dev *mdev = priv->mdev;
        int err;
+        if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+                return -EOPNOTSUPP;
        if (pauseparam->autoneg)
                return -EINVAL;
@@ -1679,6 +1690,40 @@ static int mlx5e_get_module_eeprom(struct net_device *netdev,
        return 0;
 }
+int mlx5e_ethtool_flash_device(struct mlx5e_priv *priv,
+                               struct ethtool_flash *flash)
+{
+        struct mlx5_core_dev *mdev = priv->mdev;
+        struct net_device *dev = priv->netdev;
+        const struct firmware *fw;
+        int err;
+        if (flash->region != ETHTOOL_FLASH_ALL_REGIONS)
+                return -EOPNOTSUPP;
+        err = request_firmware_direct(&fw, flash->data, &dev->dev);
+        if (err)
+                return err;
+        dev_hold(dev);
+        rtnl_unlock();
+        err = mlx5_firmware_flash(mdev, fw, NULL);
+        release_firmware(fw);
+        rtnl_lock();
+        dev_put(dev);
+        return err;
+}
+static int mlx5e_flash_device(struct net_device *dev,
+                              struct ethtool_flash *flash)
+{
+        struct mlx5e_priv *priv = netdev_priv(dev);
+        return mlx5e_ethtool_flash_device(priv, flash);
+}
 static int set_pflag_cqe_based_moder(struct net_device *netdev, bool enable,
                                     bool is_rx_cq)
 {
@@ -1961,6 +2006,7 @@ const struct ethtool_ops mlx5e_ethtool_ops = {
        .set_wol           = mlx5e_set_wol,
        .get_module_info   = mlx5e_get_module_info,
        .get_module_eeprom = mlx5e_get_module_eeprom,
+        .flash_device      = mlx5e_flash_device,
        .get_priv_flags    = mlx5e_get_priv_flags,
        .set_priv_flags    = mlx5e_set_priv_flags,
        .self_test         = mlx5e_self_test,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 6c712c5be4d8..9d5f6e56188f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1321,7 +1321,6 @@ err_free_txqsq:
 void mlx5e_activate_txqsq(struct mlx5e_txqsq *sq)
 {
        sq->txq = netdev_get_tx_queue(sq->channel->netdev, sq->txq_ix);
-        clear_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state);
        set_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
        netdev_tx_reset_queue(sq->txq);
        netif_tx_start_queue(sq->txq);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 7ecfc53cf5f6..00b2d4a86159 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1480,7 +1480,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
                              struct mlx5_flow_spec *spec,
                              struct flow_cls_offload *f,
                              struct net_device *filter_dev,
-                              u8 *match_level, u8 *tunnel_match_level)
+                              u8 *inner_match_level, u8 *outer_match_level)
 {
        struct netlink_ext_ack *extack = f->common.extack;
        void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
@@ -1495,8 +1495,9 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
        struct flow_dissector *dissector = rule->match.dissector;
        u16 addr_type = 0;
        u8 ip_proto = 0;
+        u8 *match_level;
-        *match_level = MLX5_MATCH_NONE;
+        match_level = outer_match_level;
        if (dissector->used_keys &
            ~(BIT(FLOW_DISSECTOR_KEY_META) |
@@ -1524,12 +1525,14 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
        }
        if (mlx5e_get_tc_tun(filter_dev)) {
-                if (parse_tunnel_attr(priv, spec, f, filter_dev, tunnel_match_level))
+                if (parse_tunnel_attr(priv, spec, f, filter_dev,
+                                      outer_match_level))
                        return -EOPNOTSUPP;
-                /* In decap flow, header pointers should point to the inner
+                /* At this point, header pointers should point to the inner
                 * headers, outer header were already set by parse_tunnel_attr
                 */
+                match_level = inner_match_level;
                headers_c = get_match_headers_criteria(MLX5_FLOW_CONTEXT_ACTION_DECAP,
                                                       spec);
                headers_v = get_match_headers_value(MLX5_FLOW_CONTEXT_ACTION_DECAP,
@@ -1831,35 +1834,41 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
                            struct flow_cls_offload *f,
                            struct net_device *filter_dev)
 {
+        u8 inner_match_level, outer_match_level, non_tunnel_match_level;
        struct netlink_ext_ack *extack = f->common.extack;
        struct mlx5_core_dev *dev = priv->mdev;
        struct mlx5_eswitch *esw = dev->priv.eswitch;
        struct mlx5e_rep_priv *rpriv = priv->ppriv;
-        u8 match_level, tunnel_match_level = MLX5_MATCH_NONE;
        struct mlx5_eswitch_rep *rep;
        int err;
-        err = __parse_cls_flower(priv, spec, f, filter_dev, &match_level, &tunnel_match_level);
+        inner_match_level = MLX5_MATCH_NONE;
+        outer_match_level = MLX5_MATCH_NONE;
+        err = __parse_cls_flower(priv, spec, f, filter_dev, &inner_match_level,
+                                 &outer_match_level);
+        non_tunnel_match_level = (inner_match_level == MLX5_MATCH_NONE) ?
+                                 outer_match_level : inner_match_level;
        if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH)) {
                rep = rpriv->rep;
                if (rep->vport != MLX5_VPORT_UPLINK &&
                    (esw->offloads.inline_mode != MLX5_INLINE_MODE_NONE &&
-                    esw->offloads.inline_mode < match_level)) {
+                    esw->offloads.inline_mode < non_tunnel_match_level)) {
                        NL_SET_ERR_MSG_MOD(extack,
                                           "Flow is not offloaded due to min inline setting");
                        netdev_warn(priv->netdev,
                                    "Flow is not offloaded due to min inline setting, required %d actual %d\n",
-                                    match_level, esw->offloads.inline_mode);
+                                    non_tunnel_match_level, esw->offloads.inline_mode);
                        return -EOPNOTSUPP;
                }
        }
        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
-                flow->esw_attr->match_level = match_level;
+                flow->esw_attr->inner_match_level = inner_match_level;
-                flow->esw_attr->tunnel_match_level = tunnel_match_level;
+                flow->esw_attr->outer_match_level = outer_match_level;
        } else {
-                flow->nic_attr->match_level = match_level;
+                flow->nic_attr->match_level = non_tunnel_match_level;
        }
        return err;
@@ -3158,7 +3167,7 @@ mlx5e_flow_esw_attr_init(struct mlx5_esw_flow_attr *esw_attr,
        esw_attr->parse_attr = parse_attr;
        esw_attr->chain = f->common.chain_index;
-        esw_attr->prio = TC_H_MAJ(f->common.prio) >> 16;
+        esw_attr->prio = f->common.prio;
        esw_attr->in_rep = in_rep;
        esw_attr->in_mdev = in_mdev;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index a38e8a3c7c9a..04685dbb280c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -377,8 +377,8 @@ struct mlx5_esw_flow_attr {
                struct mlx5_termtbl_handle *termtbl;
        } dests[MLX5_MAX_FLOW_FWD_VPORTS];
        u32     mod_hdr_id;
-        u8      match_level;
+        u8      inner_match_level;
-        u8      tunnel_match_level;
+        u8      outer_match_level;
        struct mlx5_fc *counter;
        u32     chain;
        u16     prio;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 089ae4d48a82..0323fd078271 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -207,14 +207,10 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
        mlx5_eswitch_set_rule_source_port(esw, spec, attr);
-        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) {
+        if (attr->outer_match_level != MLX5_MATCH_NONE)
-                if (attr->tunnel_match_level != MLX5_MATCH_NONE)
-                        spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
-                if (attr->match_level != MLX5_MATCH_NONE)
-                        spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
-        } else if (attr->match_level != MLX5_MATCH_NONE) {
                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
-        }
+        if (attr->inner_match_level != MLX5_MATCH_NONE)
+                spec->match_criteria_enable |= MLX5_MATCH_INNER_HEADERS;
        if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
                flow_act.modify_id = attr->mod_hdr_id;
@@ -290,7 +286,7 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw,
        mlx5_eswitch_set_rule_source_port(esw, spec, attr);
        spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
-        if (attr->match_level != MLX5_MATCH_NONE)
+        if (attr->outer_match_level != MLX5_MATCH_NONE)
                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
        rule = mlx5_add_flow_rules(fast_fdb, spec, &flow_act, dest, i);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 9314777d99e3..d685122d9ff7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -590,7 +590,8 @@ mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter,
                        data_size = crdump_size - offset;
                else
                        data_size = MLX5_CR_DUMP_CHUNK_SIZE;
-                err = devlink_fmsg_binary_put(fmsg, cr_data, data_size);
+                err = devlink_fmsg_binary_put(fmsg, (char *)cr_data + offset,
+                                              data_size);
                if (err)
                        goto free_data;
        }
@@ -700,6 +701,16 @@ static void poll_health(struct timer_list *t)
        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
                goto out;
+        fatal_error = check_fatal_sensors(dev);
+        if (fatal_error && !health->fatal_error) {
+                mlx5_core_err(dev, "Fatal error %u detected\n", fatal_error);
+                dev->priv.health.fatal_error = fatal_error;
+                print_health_info(dev);
+                mlx5_trigger_health_work(dev);
+                goto out;
+        }
        count = ioread32be(health->health_counter);
        if (count == health->prev)
                ++health->miss_counter;
@@ -718,15 +729,6 @@ static void poll_health(struct timer_list *t)
        if (health->synd && health->synd != prev_synd)
                queue_work(health->wq, &health->report_work);
-        fatal_error = check_fatal_sensors(dev);
-        if (fatal_error && !health->fatal_error) {
-                mlx5_core_err(dev, "Fatal error %u detected\n", fatal_error);
-                dev->priv.health.fatal_error = fatal_error;
-                print_health_info(dev);
-                mlx5_trigger_health_work(dev);
-        }
 out:
        mod_timer(&health->timer, get_next_poll_jiffies());
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
index ebd81f6b556e..90cb50fe17fd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
@@ -122,6 +122,14 @@ static int mlx5i_get_ts_info(struct net_device *netdev,
        return mlx5e_ethtool_get_ts_info(priv, info);
 }
+static int mlx5i_flash_device(struct net_device *netdev,
+                              struct ethtool_flash *flash)
+{
+        struct mlx5e_priv *priv = mlx5i_epriv(netdev);
+        return mlx5e_ethtool_flash_device(priv, flash);
+}
 enum mlx5_ptys_width {
        MLX5_PTYS_WIDTH_1X      = 1 << 0,
        MLX5_PTYS_WIDTH_2X      = 1 << 1,
@@ -233,6 +241,7 @@ const struct ethtool_ops mlx5i_ethtool_ops = {
        .get_ethtool_stats  = mlx5i_get_ethtool_stats,
        .get_ringparam      = mlx5i_get_ringparam,
        .set_ringparam      = mlx5i_set_ringparam,
+        .flash_device       = mlx5i_flash_device,
        .get_channels       = mlx5i_get_channels,
        .set_channels       = mlx5i_set_channels,
        .get_coalesce       = mlx5i_get_coalesce,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/crypto.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/crypto.c
index ea9ee88491e5..ea1d4d26ece0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/crypto.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/crypto.c
@@ -27,6 +27,7 @@ int mlx5_create_encryption_key(struct mlx5_core_dev *mdev,
        case 128:
                general_obj_key_size =
                        MLX5_GENERAL_OBJECT_TYPE_ENCRYPTION_KEY_KEY_SIZE_128;
+                key_p += sz_bytes;
                break;
        case 256:
                general_obj_key_size =
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
index e8ac90564dbe..84a87d059333 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
@@ -471,7 +471,7 @@ int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
                                 unsigned int priority)
 {
-        rulei->priority = priority >> 16;
+        rulei->priority = priority;
 }
 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
index 63b07edd9d81..38bb1cfe4e8c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
@@ -29,7 +29,7 @@
 struct mlxsw_sp_ptp_state {
        struct mlxsw_sp *mlxsw_sp;
-        struct rhashtable unmatched_ht;
+        struct rhltable unmatched_ht;
        spinlock_t unmatched_lock; /* protects the HT */
        struct delayed_work ht_gc_dw;
        u32 gc_cycle;
@@ -45,7 +45,7 @@ struct mlxsw_sp1_ptp_key {
 struct mlxsw_sp1_ptp_unmatched {
        struct mlxsw_sp1_ptp_key key;
-        struct rhash_head ht_node;
+        struct rhlist_head ht_node;
        struct rcu_head rcu;
        struct sk_buff *skb;
        u64 timestamp;
@@ -359,7 +359,7 @@ static int mlxsw_sp_ptp_parse(struct sk_buff *skb,
 /* Returns NULL on successful insertion, a pointer on conflict, or an ERR_PTR on
 * error.
 */
-static struct mlxsw_sp1_ptp_unmatched *
+static int
 mlxsw_sp1_ptp_unmatched_save(struct mlxsw_sp *mlxsw_sp,
                             struct mlxsw_sp1_ptp_key key,
                             struct sk_buff *skb,
@@ -368,41 +368,51 @@ mlxsw_sp1_ptp_unmatched_save(struct mlxsw_sp *mlxsw_sp,
        int cycles = MLXSW_SP1_PTP_HT_GC_TIMEOUT / MLXSW_SP1_PTP_HT_GC_INTERVAL;
        struct mlxsw_sp_ptp_state *ptp_state = mlxsw_sp->ptp_state;
        struct mlxsw_sp1_ptp_unmatched *unmatched;
-        struct mlxsw_sp1_ptp_unmatched *conflict;
+        int err;
        unmatched = kzalloc(sizeof(*unmatched), GFP_ATOMIC);
        if (!unmatched)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
        unmatched->key = key;
        unmatched->skb = skb;
        unmatched->timestamp = timestamp;
        unmatched->gc_cycle = mlxsw_sp->ptp_state->gc_cycle + cycles;
-        conflict = rhashtable_lookup_get_insert_fast(&ptp_state->unmatched_ht,
+        err = rhltable_insert(&ptp_state->unmatched_ht, &unmatched->ht_node,
-                                            &unmatched->ht_node,
+                              mlxsw_sp1_ptp_unmatched_ht_params);
-                                            mlxsw_sp1_ptp_unmatched_ht_params);
+        if (err)
-        if (conflict)
                kfree(unmatched);
-        return conflict;
+        return err;
 }
 static struct mlxsw_sp1_ptp_unmatched *
 mlxsw_sp1_ptp_unmatched_lookup(struct mlxsw_sp *mlxsw_sp,
-                               struct mlxsw_sp1_ptp_key key)
+                               struct mlxsw_sp1_ptp_key key, int *p_length)
 {
-        return rhashtable_lookup(&mlxsw_sp->ptp_state->unmatched_ht, &key,
+        struct mlxsw_sp1_ptp_unmatched *unmatched, *last = NULL;
-                                 mlxsw_sp1_ptp_unmatched_ht_params);
+        struct rhlist_head *tmp, *list;
+        int length = 0;
+        list = rhltable_lookup(&mlxsw_sp->ptp_state->unmatched_ht, &key,
+                               mlxsw_sp1_ptp_unmatched_ht_params);
+        rhl_for_each_entry_rcu(unmatched, tmp, list, ht_node) {
+                last = unmatched;
+                length++;
+        }
+        *p_length = length;
+        return last;
 }
 static int
 mlxsw_sp1_ptp_unmatched_remove(struct mlxsw_sp *mlxsw_sp,
                               struct mlxsw_sp1_ptp_unmatched *unmatched)
 {
-        return rhashtable_remove_fast(&mlxsw_sp->ptp_state->unmatched_ht,
+        return rhltable_remove(&mlxsw_sp->ptp_state->unmatched_ht,
-                                      &unmatched->ht_node,
+                               &unmatched->ht_node,
-                                      mlxsw_sp1_ptp_unmatched_ht_params);
+                               mlxsw_sp1_ptp_unmatched_ht_params);
 }
 /* This function is called in the following scenarios:
@@ -489,75 +499,38 @@ static void mlxsw_sp1_ptp_got_piece(struct mlxsw_sp *mlxsw_sp,
                                    struct mlxsw_sp1_ptp_key key,
                                    struct sk_buff *skb, u64 timestamp)
 {
-        struct mlxsw_sp1_ptp_unmatched *unmatched, *conflict;
+        struct mlxsw_sp1_ptp_unmatched *unmatched;
+        int length;
        int err;
        rcu_read_lock();
-        unmatched = mlxsw_sp1_ptp_unmatched_lookup(mlxsw_sp, key);
        spin_lock(&mlxsw_sp->ptp_state->unmatched_lock);
-        if (unmatched) {
+        unmatched = mlxsw_sp1_ptp_unmatched_lookup(mlxsw_sp, key, &length);
-                /* There was an unmatched entry when we looked, but it may have
-                 * been removed before we took the lock.
-                 */
-                err = mlxsw_sp1_ptp_unmatched_remove(mlxsw_sp, unmatched);
-                if (err)
-                        unmatched = NULL;
-        }
-        if (!unmatched) {
-                /* We have no unmatched entry, but one may have been added after
-                 * we looked, but before we took the lock.
-                 */
-                unmatched = mlxsw_sp1_ptp_unmatched_save(mlxsw_sp, key,
-                                                         skb, timestamp);
-                if (IS_ERR(unmatched)) {
-                        if (skb)
-                                mlxsw_sp1_ptp_packet_finish(mlxsw_sp, skb,
-                                                            key.local_port,
-                                                            key.ingress, NULL);
-                        unmatched = NULL;
-                } else if (unmatched) {
-                        /* Save just told us, under lock, that the entry is
-                         * there, so this has to work.
-                         */
-                        err = mlxsw_sp1_ptp_unmatched_remove(mlxsw_sp,
-                                                             unmatched);
-                        WARN_ON_ONCE(err);
-                }
-        }
-        /* If unmatched is non-NULL here, it comes either from the lookup, or
-         * from the save attempt above. In either case the entry was removed
-         * from the hash table. If unmatched is NULL, a new unmatched entry was
-         * added to the hash table, and there was no conflict.
-         */
        if (skb && unmatched && unmatched->timestamp) {
                unmatched->skb = skb;
        } else if (timestamp && unmatched && unmatched->skb) {
                unmatched->timestamp = timestamp;
-        } else if (unmatched) {
+        } else {
-                /* unmatched holds an older entry of the same type: either an
+                /* Either there is no entry to match, or one that is there is
-                 * skb if we are handling skb, or a timestamp if we are handling
+                 * incompatible.
-                 * timestamp. We can't match that up, so save what we have.
                 */
-                conflict = mlxsw_sp1_ptp_unmatched_save(mlxsw_sp, key,
+                if (length < 100)
-                                                        skb, timestamp);
+                        err = mlxsw_sp1_ptp_unmatched_save(mlxsw_sp, key,
-                if (IS_ERR(conflict)) {
+                                                           skb, timestamp);
-                        if (skb)
+                else
-                                mlxsw_sp1_ptp_packet_finish(mlxsw_sp, skb,
+                        err = -E2BIG;
-                                                            key.local_port,
+                if (err && skb)
-                                                            key.ingress, NULL);
+                        mlxsw_sp1_ptp_packet_finish(mlxsw_sp, skb,
-                } else {
+                                                    key.local_port,
-                        /* Above, we removed an object with this key from the
+                                                    key.ingress, NULL);
-                         * hash table, under lock, so conflict can not be a
+                unmatched = NULL;
-                         * valid pointer.
+        }
-                         */
-                        WARN_ON_ONCE(conflict);
+        if (unmatched) {
-                }
+                err = mlxsw_sp1_ptp_unmatched_remove(mlxsw_sp, unmatched);
+                WARN_ON_ONCE(err);
        }
        spin_unlock(&mlxsw_sp->ptp_state->unmatched_lock);
@@ -669,9 +642,8 @@ mlxsw_sp1_ptp_ht_gc_collect(struct mlxsw_sp_ptp_state *ptp_state,
        local_bh_disable();
        spin_lock(&ptp_state->unmatched_lock);
-        err = rhashtable_remove_fast(&ptp_state->unmatched_ht,
+        err = rhltable_remove(&ptp_state->unmatched_ht, &unmatched->ht_node,
-                                     &unmatched->ht_node,
+                              mlxsw_sp1_ptp_unmatched_ht_params);
-                                     mlxsw_sp1_ptp_unmatched_ht_params);
        spin_unlock(&ptp_state->unmatched_lock);
        if (err)
@@ -702,7 +674,7 @@ static void mlxsw_sp1_ptp_ht_gc(struct work_struct *work)
        ptp_state = container_of(dwork, struct mlxsw_sp_ptp_state, ht_gc_dw);
        gc_cycle = ptp_state->gc_cycle++;
-        rhashtable_walk_enter(&ptp_state->unmatched_ht, &iter);
+        rhltable_walk_enter(&ptp_state->unmatched_ht, &iter);
        rhashtable_walk_start(&iter);
        while ((obj = rhashtable_walk_next(&iter))) {
                if (IS_ERR(obj))
@@ -855,8 +827,8 @@ struct mlxsw_sp_ptp_state *mlxsw_sp1_ptp_init(struct mlxsw_sp *mlxsw_sp)
        spin_lock_init(&ptp_state->unmatched_lock);
-        err = rhashtable_init(&ptp_state->unmatched_ht,
+        err = rhltable_init(&ptp_state->unmatched_ht,
-                              &mlxsw_sp1_ptp_unmatched_ht_params);
+                            &mlxsw_sp1_ptp_unmatched_ht_params);
        if (err)
                goto err_hashtable_init;
@@ -891,7 +863,7 @@ err_fifo_clr:
 err_mtptpt1_set:
        mlxsw_sp_ptp_mtptpt_set(mlxsw_sp, MLXSW_REG_MTPTPT_TRAP_ID_PTP0, 0);
 err_mtptpt_set:
-        rhashtable_destroy(&ptp_state->unmatched_ht);
+        rhltable_destroy(&ptp_state->unmatched_ht);
 err_hashtable_init:
        kfree(ptp_state);
        return ERR_PTR(err);
@@ -906,8 +878,8 @@ void mlxsw_sp1_ptp_fini(struct mlxsw_sp_ptp_state *ptp_state)
        mlxsw_sp1_ptp_set_fifo_clr_on_trap(mlxsw_sp, false);
        mlxsw_sp_ptp_mtptpt_set(mlxsw_sp, MLXSW_REG_MTPTPT_TRAP_ID_PTP1, 0);
        mlxsw_sp_ptp_mtptpt_set(mlxsw_sp, MLXSW_REG_MTPTPT_TRAP_ID_PTP0, 0);
-        rhashtable_free_and_destroy(&ptp_state->unmatched_ht,
+        rhltable_free_and_destroy(&ptp_state->unmatched_ht,
-                                    &mlxsw_sp1_ptp_unmatched_free_fn, NULL);
+                                  &mlxsw_sp1_ptp_unmatched_free_fn, NULL);
        kfree(ptp_state);
 }
diff --git a/drivers/net/ethernet/mscc/ocelot_ace.c b/drivers/net/ethernet/mscc/ocelot_ace.c
index 39aca1ab4687..86fc6e6b46dd 100644
--- a/drivers/net/ethernet/mscc/ocelot_ace.c
+++ b/drivers/net/ethernet/mscc/ocelot_ace.c
@@ -317,7 +317,7 @@ static void is2_action_set(struct vcap_data *data,
                break;
        case OCELOT_ACL_ACTION_TRAP:
                VCAP_ACT_SET(PORT_MASK, 0x0);
-                VCAP_ACT_SET(MASK_MODE, 0x0);
+                VCAP_ACT_SET(MASK_MODE, 0x1);
                VCAP_ACT_SET(POLICE_ENA, 0x0);
                VCAP_ACT_SET(POLICE_IDX, 0x0);
                VCAP_ACT_SET(CPU_QU_NUM, 0x0);
diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c
index 59487d446a09..b894bc0c9c16 100644
--- a/drivers/net/ethernet/mscc/ocelot_flower.c
+++ b/drivers/net/ethernet/mscc/ocelot_flower.c
@@ -13,12 +13,6 @@ struct ocelot_port_block {
        struct ocelot_port *port;
 };
-static u16 get_prio(u32 prio)
-{
-        /* prio starts from 0x1000 while the ids starts from 0 */
-        return prio >> 16;
-}
 static int ocelot_flower_parse_action(struct flow_cls_offload *f,
                                      struct ocelot_ace_rule *rule)
 {
@@ -168,7 +162,7 @@ static int ocelot_flower_parse(struct flow_cls_offload *f,
        }
 finished_key_parsing:
-        ocelot_rule->prio = get_prio(f->common.prio);
+        ocelot_rule->prio = f->common.prio;
        ocelot_rule->id = f->cookie;
        return ocelot_flower_parse_action(f, ocelot_rule);
 }
@@ -218,7 +212,7 @@ static int ocelot_flower_destroy(struct flow_cls_offload *f,
        struct ocelot_ace_rule rule;
        int ret;
-        rule.prio = get_prio(f->common.prio);
+        rule.prio = f->common.prio;
        rule.port = port_block->port;
        rule.id = f->cookie;
@@ -236,7 +230,7 @@ static int ocelot_flower_stats_update(struct flow_cls_offload *f,
        struct ocelot_ace_rule rule;
        int ret;
-        rule.prio = get_prio(f->common.prio);
+        rule.prio = f->common.prio;
        rule.port = port_block->port;
        rule.id = f->cookie;
        ret = ocelot_ace_rule_stats_update(&rule);
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index d8b7fba96d58..337b0cbfd153 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -3919,7 +3919,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         * setup (if available). */
        status = myri10ge_request_irq(mgp);
        if (status != 0)
-                goto abort_with_firmware;
+                goto abort_with_slices;
        myri10ge_free_irq(mgp);
        /* Save configuration space to be restored if the
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index e209f150c5f2..9917d64694c6 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -1416,6 +1416,13 @@ nfp_flower_setup_indr_tc_block(struct net_device *netdev, struct nfp_app *app,
        switch (f->command) {
        case FLOW_BLOCK_BIND:
+                cb_priv = nfp_flower_indr_block_cb_priv_lookup(app, netdev);
+                if (cb_priv &&
+                    flow_block_cb_is_busy(nfp_flower_setup_indr_block_cb,
+                                          cb_priv,
+                                          &nfp_block_cb_list))
+                        return -EBUSY;
                cb_priv = kmalloc(sizeof(*cb_priv), GFP_KERNEL);
                if (!cb_priv)
                        return -ENOMEM;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
index 86e968cd5ffd..124a43dc136a 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/qos_conf.c
@@ -93,7 +93,7 @@ nfp_flower_install_rate_limiter(struct nfp_app *app, struct net_device *netdev,
                return -EOPNOTSUPP;
        }
-        if (flow->common.prio != (1 << 16)) {
+        if (flow->common.prio != 1) {
                NL_SET_ERR_MSG_MOD(extack, "unsupported offload: qos rate limit offload requires highest priority");
                return -EOPNOTSUPP;
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 829dd60ab937..1efff7f68ef6 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1325,7 +1325,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
                                              &drv_version);
                if (rc) {
                        DP_NOTICE(cdev, "Failed sending drv version command\n");
-                        return rc;
+                        goto err4;
                }
        }
@@ -1333,6 +1333,8 @@ static int qed_slowpath_start(struct qed_dev *cdev,
        return 0;
+err4:
+        qed_ll2_dealloc_if(cdev);
 err3:
        qed_hw_stop(cdev);
 err2:
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index e1dd6ea60d67..bae0074ab9aa 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -5921,6 +5921,7 @@ static struct sk_buff *rtl8169_try_rx_copy(void *data,
        skb = napi_alloc_skb(&tp->napi, pkt_size);
        if (skb)
                skb_copy_to_linear_data(skb, data, pkt_size);
+        dma_sync_single_for_device(d, addr, pkt_size, DMA_FROM_DEVICE);
        return skb;
 }
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ef8f08931fe8..6cacd5e893ac 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Renesas Ethernet AVB device driver
 *
- * Copyright (C) 2014-2015 Renesas Electronics Corporation
+ * Copyright (C) 2014-2019 Renesas Electronics Corporation
 * Copyright (C) 2015 Renesas Solutions Corp.
 * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
 *
@@ -513,7 +513,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev)
                        kfree(ts_skb);
                        if (tag == tfa_tag) {
                                skb_tstamp_tx(skb, &shhwtstamps);
+                                dev_consume_skb_any(skb);
                                break;
+                        } else {
+                                dev_kfree_skb_any(skb);
                        }
                }
                ravb_modify(ndev, TCCR, TCCR_TFR, TCCR_TFR);
@@ -1564,7 +1567,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                        }
                        goto unmap;
                }
-                ts_skb->skb = skb;
+                ts_skb->skb = skb_get(skb);
                ts_skb->tag = priv->ts_skb_tag++;
                priv->ts_skb_tag &= 0x3ff;
                list_add_tail(&ts_skb->list, &priv->ts_skb_list);
@@ -1693,6 +1696,7 @@ static int ravb_close(struct net_device *ndev)
        /* Clear the timestamp list */
        list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
                list_del(&ts_skb->list);
+                kfree_skb(ts_skb->skb);
                kfree(ts_skb);
        }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 37c0bc699cd9..6c305b6ecad0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -94,7 +94,7 @@ static int tc_fill_entry(struct stmmac_priv *priv,
        struct stmmac_tc_entry *entry, *frag = NULL;
        struct tc_u32_sel *sel = cls->knode.sel;
        u32 off, data, mask, real_off, rem;
-        u32 prio = cls->common.prio;
+        u32 prio = cls->common.prio << 16;
        int ret;
        /* Only 1 match per entry */
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 32a89744972d..a46b8b2e44e1 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2775,6 +2775,7 @@ static int cpsw_probe(struct platform_device *pdev)
        if (!cpsw)
                return -ENOMEM;
+        platform_set_drvdata(pdev, cpsw);
        cpsw->dev = dev;
        mode = devm_gpiod_get_array_optional(dev, "mode", GPIOD_OUT_LOW);
@@ -2879,7 +2880,6 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_cpts;
        }
-        platform_set_drvdata(pdev, cpsw);
        priv = netdev_priv(ndev);
        priv->cpsw = cpsw;
        priv->ndev = ndev;
diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
index 8479a440527b..12466a72cefc 100644
--- a/drivers/net/ethernet/toshiba/tc35815.c
+++ b/drivers/net/ethernet/toshiba/tc35815.c
@@ -1504,7 +1504,7 @@ tc35815_rx(struct net_device *dev, int limit)
                        pci_unmap_single(lp->pci_dev,
                                         lp->rx_skbs[cur_bd].skb_dma,
                                         RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
-                        if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN)
+                        if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN != 0)
                                memmove(skb->data, skb->data - NET_IP_ALIGN,
                                        pkt_len);
                        data = skb_put(skb, pkt_len);
diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c
index 78a7de3fb622..c62f474b6d08 100644
--- a/drivers/net/ethernet/tundra/tsi108_eth.c
+++ b/drivers/net/ethernet/tundra/tsi108_eth.c
@@ -371,9 +371,10 @@ tsi108_stat_carry_one(int carry, int carry_bit, int carry_shift,
 static void tsi108_stat_carry(struct net_device *dev)
 {
        struct tsi108_prv_data *data = netdev_priv(dev);
+        unsigned long flags;
        u32 carry1, carry2;
-        spin_lock_irq(&data->misclock);
+        spin_lock_irqsave(&data->misclock, flags);
        carry1 = TSI_READ(TSI108_STAT_CARRY1);
        carry2 = TSI_READ(TSI108_STAT_CARRY2);
@@ -441,7 +442,7 @@ static void tsi108_stat_carry(struct net_device *dev)
                              TSI108_STAT_TXPAUSEDROP_CARRY,
                              &data->tx_pause_drop);
-        spin_unlock_irq(&data->misclock);
+        spin_unlock_irqrestore(&data->misclock, flags);
 }
 /* Read a stat counter atomically with respect to carries.
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 3544e1991579..e8fce6d715ef 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1239,12 +1239,15 @@ static void netvsc_get_stats64(struct net_device *net,
                               struct rtnl_link_stats64 *t)
 {
        struct net_device_context *ndev_ctx = netdev_priv(net);
-        struct netvsc_device *nvdev = rcu_dereference_rtnl(ndev_ctx->nvdev);
+        struct netvsc_device *nvdev;
        struct netvsc_vf_pcpu_stats vf_tot;
        int i;
+        rcu_read_lock();
+        nvdev = rcu_dereference(ndev_ctx->nvdev);
        if (!nvdev)
-                return;
+                goto out;
        netdev_stats_to_stats64(t, &net->stats);
@@ -1283,6 +1286,8 @@ static void netvsc_get_stats64(struct net_device *net,
                t->rx_packets   += packets;
                t->multicast    += multicast;
        }
+out:
+        rcu_read_unlock();
 }
 static int netvsc_set_mac_addr(struct net_device *ndev, void *p)
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
index b41696e16bdc..c20e7ef18bc9 100644
--- a/drivers/net/ieee802154/mac802154_hwsim.c
+++ b/drivers/net/ieee802154/mac802154_hwsim.c
@@ -802,7 +802,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
                err = hwsim_subscribe_all_others(phy);
                if (err < 0) {
                        mutex_unlock(&hwsim_phys_lock);
-                        goto err_reg;
+                        goto err_subscribe;
                }
        }
        list_add_tail(&phy->list, &hwsim_phys);
@@ -812,6 +812,8 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
        return idx;
+err_subscribe:
+        ieee802154_unregister_hw(phy->hw);
 err_reg:
        kfree(pib);
 err_pib:
@@ -901,9 +903,9 @@ static __init int hwsim_init_module(void)
        return 0;
 platform_drv:
-        genl_unregister_family(&hwsim_genl_family);
-platform_dev:
        platform_device_unregister(mac802154hwsim_dev);
+platform_dev:
+        genl_unregister_family(&hwsim_genl_family);
        return rc;
 }
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index c5c417a3c0ce..bcc40a236624 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -73,46 +73,47 @@ static void nsim_dev_port_debugfs_exit(struct nsim_dev_port *nsim_dev_port)
        debugfs_remove_recursive(nsim_dev_port->ddir);
 }
+static struct net *nsim_devlink_net(struct devlink *devlink)
+{
+        return &init_net;
+}
 static u64 nsim_dev_ipv4_fib_resource_occ_get(void *priv)
 {
-        struct nsim_dev *nsim_dev = priv;
+        struct net *net = priv;
-        return nsim_fib_get_val(nsim_dev->fib_data,
+        return nsim_fib_get_val(net, NSIM_RESOURCE_IPV4_FIB, false);
-                                NSIM_RESOURCE_IPV4_FIB, false);
 }
 static u64 nsim_dev_ipv4_fib_rules_res_occ_get(void *priv)
 {
-        struct nsim_dev *nsim_dev = priv;
+        struct net *net = priv;
-        return nsim_fib_get_val(nsim_dev->fib_data,
+        return nsim_fib_get_val(net, NSIM_RESOURCE_IPV4_FIB_RULES, false);
-                                NSIM_RESOURCE_IPV4_FIB_RULES, false);
 }
 static u64 nsim_dev_ipv6_fib_resource_occ_get(void *priv)
 {
-        struct nsim_dev *nsim_dev = priv;
+        struct net *net = priv;
-        return nsim_fib_get_val(nsim_dev->fib_data,
+        return nsim_fib_get_val(net, NSIM_RESOURCE_IPV6_FIB, false);
-                                NSIM_RESOURCE_IPV6_FIB, false);
 }
 static u64 nsim_dev_ipv6_fib_rules_res_occ_get(void *priv)
 {
-        struct nsim_dev *nsim_dev = priv;
+        struct net *net = priv;
-        return nsim_fib_get_val(nsim_dev->fib_data,
+        return nsim_fib_get_val(net, NSIM_RESOURCE_IPV6_FIB_RULES, false);
-                                NSIM_RESOURCE_IPV6_FIB_RULES, false);
 }
 static int nsim_dev_resources_register(struct devlink *devlink)
 {
-        struct nsim_dev *nsim_dev = devlink_priv(devlink);
        struct devlink_resource_size_params params = {
                .size_max = (u64)-1,
                .size_granularity = 1,
                .unit = DEVLINK_RESOURCE_UNIT_ENTRY
        };
+        struct net *net = nsim_devlink_net(devlink);
        int err;
        u64 n;
@@ -126,8 +127,7 @@ static int nsim_dev_resources_register(struct devlink *devlink)
                goto out;
        }
-        n = nsim_fib_get_val(nsim_dev->fib_data,
+        n = nsim_fib_get_val(net, NSIM_RESOURCE_IPV4_FIB, true);
-                             NSIM_RESOURCE_IPV4_FIB, true);
        err = devlink_resource_register(devlink, "fib", n,
                                        NSIM_RESOURCE_IPV4_FIB,
                                        NSIM_RESOURCE_IPV4, &params);
@@ -136,8 +136,7 @@ static int nsim_dev_resources_register(struct devlink *devlink)
                return err;
        }
-        n = nsim_fib_get_val(nsim_dev->fib_data,
+        n = nsim_fib_get_val(net, NSIM_RESOURCE_IPV4_FIB_RULES, true);
-                             NSIM_RESOURCE_IPV4_FIB_RULES, true);
        err = devlink_resource_register(devlink, "fib-rules", n,
                                        NSIM_RESOURCE_IPV4_FIB_RULES,
                                        NSIM_RESOURCE_IPV4, &params);
@@ -156,8 +155,7 @@ static int nsim_dev_resources_register(struct devlink *devlink)
                goto out;
        }
-        n = nsim_fib_get_val(nsim_dev->fib_data,
+        n = nsim_fib_get_val(net, NSIM_RESOURCE_IPV6_FIB, true);
-                             NSIM_RESOURCE_IPV6_FIB, true);
        err = devlink_resource_register(devlink, "fib", n,
                                        NSIM_RESOURCE_IPV6_FIB,
                                        NSIM_RESOURCE_IPV6, &params);
@@ -166,8 +164,7 @@ static int nsim_dev_resources_register(struct devlink *devlink)
                return err;
        }
-        n = nsim_fib_get_val(nsim_dev->fib_data,
+        n = nsim_fib_get_val(net, NSIM_RESOURCE_IPV6_FIB_RULES, true);
-                             NSIM_RESOURCE_IPV6_FIB_RULES, true);
        err = devlink_resource_register(devlink, "fib-rules", n,
                                        NSIM_RESOURCE_IPV6_FIB_RULES,
                                        NSIM_RESOURCE_IPV6, &params);
@@ -179,19 +176,19 @@ static int nsim_dev_resources_register(struct devlink *devlink)
        devlink_resource_occ_get_register(devlink,
                                          NSIM_RESOURCE_IPV4_FIB,
                                          nsim_dev_ipv4_fib_resource_occ_get,
-                                          nsim_dev);
+                                          net);
        devlink_resource_occ_get_register(devlink,
                                          NSIM_RESOURCE_IPV4_FIB_RULES,
                                          nsim_dev_ipv4_fib_rules_res_occ_get,
-                                          nsim_dev);
+                                          net);
        devlink_resource_occ_get_register(devlink,
                                          NSIM_RESOURCE_IPV6_FIB,
                                          nsim_dev_ipv6_fib_resource_occ_get,
-                                          nsim_dev);
+                                          net);
        devlink_resource_occ_get_register(devlink,
                                          NSIM_RESOURCE_IPV6_FIB_RULES,
                                          nsim_dev_ipv6_fib_rules_res_occ_get,
-                                          nsim_dev);
+                                          net);
 out:
        return err;
 }
@@ -199,11 +196,11 @@ out:
 static int nsim_dev_reload(struct devlink *devlink,
                           struct netlink_ext_ack *extack)
 {
-        struct nsim_dev *nsim_dev = devlink_priv(devlink);
        enum nsim_resource_id res_ids[] = {
                NSIM_RESOURCE_IPV4_FIB, NSIM_RESOURCE_IPV4_FIB_RULES,
                NSIM_RESOURCE_IPV6_FIB, NSIM_RESOURCE_IPV6_FIB_RULES
        };
+        struct net *net = nsim_devlink_net(devlink);
        int i;
        for (i = 0; i < ARRAY_SIZE(res_ids); ++i) {
@@ -212,8 +209,7 @@ static int nsim_dev_reload(struct devlink *devlink,
                err = devlink_resource_size_get(devlink, res_ids[i], &val);
                if (!err) {
-                        err = nsim_fib_set_max(nsim_dev->fib_data,
+                        err = nsim_fib_set_max(net, res_ids[i], val, extack);
-                                               res_ids[i], val, extack);
                        if (err)
                                return err;
                }
@@ -285,15 +281,9 @@ nsim_dev_create(struct nsim_bus_dev *nsim_bus_dev, unsigned int port_count)
        mutex_init(&nsim_dev->port_list_lock);
        nsim_dev->fw_update_status = true;
-        nsim_dev->fib_data = nsim_fib_create();
-        if (IS_ERR(nsim_dev->fib_data)) {
-                err = PTR_ERR(nsim_dev->fib_data);
-                goto err_devlink_free;
-        }
        err = nsim_dev_resources_register(devlink);
        if (err)
-                goto err_fib_destroy;
+                goto err_devlink_free;
        err = devlink_register(devlink, &nsim_bus_dev->dev);
        if (err)
@@ -315,8 +305,6 @@ err_dl_unregister:
        devlink_unregister(devlink);
 err_resources_unregister:
        devlink_resources_unregister(devlink, NULL);
-err_fib_destroy:
-        nsim_fib_destroy(nsim_dev->fib_data);
 err_devlink_free:
        devlink_free(devlink);
        return ERR_PTR(err);
@@ -330,7 +318,6 @@ static void nsim_dev_destroy(struct nsim_dev *nsim_dev)
        nsim_dev_debugfs_exit(nsim_dev);
        devlink_unregister(devlink);
        devlink_resources_unregister(devlink, NULL);
-        nsim_fib_destroy(nsim_dev->fib_data);
        mutex_destroy(&nsim_dev->port_list_lock);
        devlink_free(devlink);
 }
diff --git a/drivers/net/netdevsim/fib.c b/drivers/net/netdevsim/fib.c
index 8c57ba747772..f61d094746c0 100644
--- a/drivers/net/netdevsim/fib.c
+++ b/drivers/net/netdevsim/fib.c
@@ -18,6 +18,7 @@
 #include <net/ip_fib.h>
 #include <net/ip6_fib.h>
 #include <net/fib_rules.h>
+#include <net/netns/generic.h>
 #include "netdevsim.h"
@@ -32,14 +33,15 @@ struct nsim_per_fib_data {
 };
 struct nsim_fib_data {
-        struct notifier_block fib_nb;
        struct nsim_per_fib_data ipv4;
        struct nsim_per_fib_data ipv6;
 };
-u64 nsim_fib_get_val(struct nsim_fib_data *fib_data,
+static unsigned int nsim_fib_net_id;
-                     enum nsim_resource_id res_id, bool max)
+u64 nsim_fib_get_val(struct net *net, enum nsim_resource_id res_id, bool max)
 {
+        struct nsim_fib_data *fib_data = net_generic(net, nsim_fib_net_id);
        struct nsim_fib_entry *entry;
        switch (res_id) {
@@ -62,10 +64,10 @@ u64 nsim_fib_get_val(struct nsim_fib_data *fib_data,
        return max ? entry->max : entry->num;
 }
-int nsim_fib_set_max(struct nsim_fib_data *fib_data,
+int nsim_fib_set_max(struct net *net, enum nsim_resource_id res_id, u64 val,
-                     enum nsim_resource_id res_id, u64 val,
                     struct netlink_ext_ack *extack)
 {
+        struct nsim_fib_data *fib_data = net_generic(net, nsim_fib_net_id);
        struct nsim_fib_entry *entry;
        int err = 0;
@@ -118,9 +120,9 @@ static int nsim_fib_rule_account(struct nsim_fib_entry *entry, bool add,
        return err;
 }
-static int nsim_fib_rule_event(struct nsim_fib_data *data,
+static int nsim_fib_rule_event(struct fib_notifier_info *info, bool add)
-                               struct fib_notifier_info *info, bool add)
 {
+        struct nsim_fib_data *data = net_generic(info->net, nsim_fib_net_id);
        struct netlink_ext_ack *extack = info->extack;
        int err = 0;
@@ -155,9 +157,9 @@ static int nsim_fib_account(struct nsim_fib_entry *entry, bool add,
        return err;
 }
-static int nsim_fib_event(struct nsim_fib_data *data,
+static int nsim_fib_event(struct fib_notifier_info *info, bool add)
-                          struct fib_notifier_info *info, bool add)
 {
+        struct nsim_fib_data *data = net_generic(info->net, nsim_fib_net_id);
        struct netlink_ext_ack *extack = info->extack;
        int err = 0;
@@ -176,22 +178,18 @@ static int nsim_fib_event(struct nsim_fib_data *data,
 static int nsim_fib_event_nb(struct notifier_block *nb, unsigned long event,
                             void *ptr)
 {
-        struct nsim_fib_data *data = container_of(nb, struct nsim_fib_data,
-                                                  fib_nb);
        struct fib_notifier_info *info = ptr;
        int err = 0;
        switch (event) {
        case FIB_EVENT_RULE_ADD: /* fall through */
        case FIB_EVENT_RULE_DEL:
-                err = nsim_fib_rule_event(data, info,
+                err = nsim_fib_rule_event(info, event == FIB_EVENT_RULE_ADD);
-                                          event == FIB_EVENT_RULE_ADD);
                break;
        case FIB_EVENT_ENTRY_ADD:  /* fall through */
        case FIB_EVENT_ENTRY_DEL:
-                err = nsim_fib_event(data, info,
+                err = nsim_fib_event(info, event == FIB_EVENT_ENTRY_ADD);
-                                     event == FIB_EVENT_ENTRY_ADD);
                break;
        }
@@ -201,23 +199,30 @@ static int nsim_fib_event_nb(struct notifier_block *nb, unsigned long event,
 /* inconsistent dump, trying again */
 static void nsim_fib_dump_inconsistent(struct notifier_block *nb)
 {
-        struct nsim_fib_data *data = container_of(nb, struct nsim_fib_data,
+        struct nsim_fib_data *data;
-                                                  fib_nb);
+        struct net *net;
+        rcu_read_lock();
+        for_each_net_rcu(net) {
+                data = net_generic(net, nsim_fib_net_id);
+                data->ipv4.fib.num = 0ULL;
+                data->ipv4.rules.num = 0ULL;
-        data->ipv4.fib.num = 0ULL;
+                data->ipv6.fib.num = 0ULL;
-        data->ipv4.rules.num = 0ULL;
+                data->ipv6.rules.num = 0ULL;
-        data->ipv6.fib.num = 0ULL;
+        }
-        data->ipv6.rules.num = 0ULL;
+        rcu_read_unlock();
 }
-struct nsim_fib_data *nsim_fib_create(void)
+static struct notifier_block nsim_fib_nb = {
-{
+        .notifier_call = nsim_fib_event_nb,
-        struct nsim_fib_data *data;
+};
-        int err;
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+/* Initialize per network namespace state */
-        if (!data)
+static int __net_init nsim_fib_netns_init(struct net *net)
-                return ERR_PTR(-ENOMEM);
+{
+        struct nsim_fib_data *data = net_generic(net, nsim_fib_net_id);
        data->ipv4.fib.max = (u64)-1;
        data->ipv4.rules.max = (u64)-1;
@@ -225,22 +230,37 @@ struct nsim_fib_data *nsim_fib_create(void)
        data->ipv6.fib.max = (u64)-1;
        data->ipv6.rules.max = (u64)-1;
-        data->fib_nb.notifier_call = nsim_fib_event_nb;
+        return 0;
-        err = register_fib_notifier(&data->fib_nb, nsim_fib_dump_inconsistent);
+}
-        if (err) {
-                pr_err("Failed to register fib notifier\n");
-                goto err_out;
-        }
-        return data;
+static struct pernet_operations nsim_fib_net_ops = {
+        .init = nsim_fib_netns_init,
+        .id   = &nsim_fib_net_id,
+        .size = sizeof(struct nsim_fib_data),
+};
-err_out:
+void nsim_fib_exit(void)
-        kfree(data);
+{
-        return ERR_PTR(err);
+        unregister_pernet_subsys(&nsim_fib_net_ops);
+        unregister_fib_notifier(&nsim_fib_nb);
 }
-void nsim_fib_destroy(struct nsim_fib_data *data)
+int nsim_fib_init(void)
 {
-        unregister_fib_notifier(&data->fib_nb);
+        int err;
-        kfree(data);
+        err = register_pernet_subsys(&nsim_fib_net_ops);
+        if (err < 0) {
+                pr_err("Failed to register pernet subsystem\n");
+                goto err_out;
+        }
+        err = register_fib_notifier(&nsim_fib_nb, nsim_fib_dump_inconsistent);
+        if (err < 0) {
+                pr_err("Failed to register fib notifier\n");
+                goto err_out;
+        }
+err_out:
+        return err;
 }
diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 0740940f41b1..55f57f76d01b 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -357,12 +357,18 @@ static int __init nsim_module_init(void)
        if (err)
                goto err_dev_exit;
-        err = rtnl_link_register(&nsim_link_ops);
+        err = nsim_fib_init();
        if (err)
                goto err_bus_exit;
+        err = rtnl_link_register(&nsim_link_ops);
+        if (err)
+                goto err_fib_exit;
        return 0;
+err_fib_exit:
+        nsim_fib_exit();
 err_bus_exit:
        nsim_bus_exit();
 err_dev_exit:
@@ -373,6 +379,7 @@ err_dev_exit:
 static void __exit nsim_module_exit(void)
 {
        rtnl_link_unregister(&nsim_link_ops);
+        nsim_fib_exit();
        nsim_bus_exit();
        nsim_dev_exit();
 }
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 79c05af2a7c0..9404637d34b7 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -169,12 +169,10 @@ int nsim_dev_port_add(struct nsim_bus_dev *nsim_bus_dev,
 int nsim_dev_port_del(struct nsim_bus_dev *nsim_bus_dev,
                      unsigned int port_index);
-struct nsim_fib_data *nsim_fib_create(void);
+int nsim_fib_init(void);
-void nsim_fib_destroy(struct nsim_fib_data *fib_data);
+void nsim_fib_exit(void);
-u64 nsim_fib_get_val(struct nsim_fib_data *fib_data,
+u64 nsim_fib_get_val(struct net *net, enum nsim_resource_id res_id, bool max);
-                     enum nsim_resource_id res_id, bool max);
+int nsim_fib_set_max(struct net *net, enum nsim_resource_id res_id, u64 val,
-int nsim_fib_set_max(struct nsim_fib_data *fib_data,
-                     enum nsim_resource_id res_id, u64 val,
                     struct netlink_ext_ack *extack);
 #if IS_ENABLED(CONFIG_XFRM_OFFLOAD)
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 222ccd9ecfce..6ad8b1c63c34 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -257,36 +257,20 @@ static int at803x_config_init(struct phy_device *phydev)
         *   after HW reset: RX delay enabled and TX delay disabled
         *   after SW reset: RX delay enabled, while TX delay retains the
         *   value before reset.
-         *
-         * So let's first disable the RX and TX delays in PHY and enable
-         * them based on the mode selected (this also takes care of RGMII
-         * mode where we expect delays to be disabled)
         */
-        ret = at803x_disable_rx_delay(phydev);
-        if (ret < 0)
-                return ret;
-        ret = at803x_disable_tx_delay(phydev);
-        if (ret < 0)
-                return ret;
        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
-            phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) {
+            phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
-                /* If RGMII_ID or RGMII_RXID are specified enable RX delay,
-                 * otherwise keep it disabled
-                 */
                ret = at803x_enable_rx_delay(phydev);
-                if (ret < 0)
+        else
-                        return ret;
+                ret = at803x_disable_rx_delay(phydev);
-        }
+        if (ret < 0)
+                return ret;
        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
-            phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
+            phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
-                /* If RGMII_ID or RGMII_TXID are specified enable TX delay,
-                 * otherwise keep it disabled
-                 */
                ret = at803x_enable_tx_delay(phydev);
-        }
+        else
+                ret = at803x_disable_tx_delay(phydev);
        return ret;
 }
diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
index b9d4145781ca..58bb25e4af10 100644
--- a/drivers/net/phy/phy-c45.c
+++ b/drivers/net/phy/phy-c45.c
@@ -219,6 +219,20 @@ int genphy_c45_read_link(struct phy_device *phydev)
        int val, devad;
        bool link = true;
+        if (phydev->c45_ids.devices_in_package & MDIO_DEVS_AN) {
+                val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_CTRL1);
+                if (val < 0)
+                        return val;
+                /* Autoneg is being started, therefore disregard current
+                 * link status and report link as down.
+                 */
+                if (val & MDIO_AN_CTRL1_RESTART) {
+                        phydev->link = 0;
+                        return 0;
+                }
+        }
        while (mmd_mask && link) {
                devad = __ffs(mmd_mask);
                mmd_mask &= ~BIT(devad);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 7ddd91df99e3..27ebc2c6c2d0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1752,7 +1752,17 @@ EXPORT_SYMBOL(genphy_aneg_done);
 */
 int genphy_update_link(struct phy_device *phydev)
 {
-        int status;
+        int status = 0, bmcr;
+        bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
+        /* Autoneg is being started, therefore disregard BMSR value and
+         * report link as down.
+         */
+        if (bmcr & BMCR_ANRESTART)
+                goto done;
        /* The link state is latched low so that momentary link
         * drops can be detected. Do not double-read the status
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index abfa0da9bbd2..e8089def5a46 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1004,6 +1004,8 @@ static void __team_compute_features(struct team *team)
        team->dev->vlan_features = vlan_features;
        team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+                                     NETIF_F_HW_VLAN_CTAG_TX |
+                                     NETIF_F_HW_VLAN_STAG_TX |
                                     NETIF_F_GSO_UDP_L4;
        team->dev->hard_header_len = max_hard_header_len;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 5519248a791e..32b08b18e120 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -163,7 +163,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        }
        if (!timeout) {
                dev_err(&udev->dev, "firmware not ready in time\n");
-                return -ETIMEDOUT;
+                ret = -ETIMEDOUT;
+                goto err;
        }
        /* enable ethernet mode (?) */
diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
index d62b6706a537..fc5895f85cee 100644
--- a/drivers/net/usb/kalmia.c
+++ b/drivers/net/usb/kalmia.c
@@ -113,16 +113,16 @@ kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
        status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_1),
                                         usb_buf, 24);
        if (status != 0)
-                return status;
+                goto out;
        memcpy(usb_buf, init_msg_2, 12);
        status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_2),
                                         usb_buf, 28);
        if (status != 0)
-                return status;
+                goto out;
        memcpy(ethernet_addr, usb_buf + 10, ETH_ALEN);
+out:
        kfree(usb_buf);
        return status;
 }
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 3d92ea6fcc02..f033fee225a1 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3792,7 +3792,7 @@ static int lan78xx_probe(struct usb_interface *intf,
        ret = register_netdev(netdev);
        if (ret != 0) {
                netif_err(dev, probe, netdev, "couldn't register the device\n");
-                goto out3;
+                goto out4;
        }
        usb_set_intfdata(intf, dev);
@@ -3807,12 +3807,14 @@ static int lan78xx_probe(struct usb_interface *intf,
        ret = lan78xx_phy_init(dev);
        if (ret < 0)
-                goto out4;
+                goto out5;
        return 0;
-out4:
+out5:
        unregister_netdev(netdev);
+out4:
+        usb_free_urb(dev->urb_intr);
 out3:
        lan78xx_unbind(dev, intf);
 out2:
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 0cc03a9ff545..eee0f5007ee3 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -799,8 +799,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
        ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
                              RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
                              value, index, tmp, size, 500);
+        if (ret < 0)
+                memset(data, 0xff, size);
+        else
+                memcpy(data, tmp, size);
-        memcpy(data, tmp, size);
        kfree(tmp);
        return ret;
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index e9fc168bb734..489cba9b284d 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -351,13 +351,15 @@ int i2400m_barker_db_init(const char *_options)
                        }
                        result = i2400m_barker_db_add(barker);
                        if (result < 0)
-                                goto error_add;
+                                goto error_parse_add;
                }
                kfree(options_orig);
        }
        return 0;
+error_parse_add:
 error_parse:
+        kfree(options_orig);
 error_add:
        kfree(i2400m_barker_db);
        return result;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index cb22d447fcb8..fe776e35b9d0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -554,7 +554,7 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                cpu_to_le32(vif->bss_conf.use_short_slot ?
                            MAC_FLG_SHORT_SLOT : 0);
-        cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP);
+        cmd->filter_flags = 0;
        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                u8 txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, i);
@@ -623,6 +623,8 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
        /* We need the dtim_period to set the MAC as associated */
        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period &&
            !force_assoc_off) {
+                struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+                u8 ap_sta_id = mvmvif->ap_sta_id;
                u32 dtim_offs;
                /*
@@ -658,6 +660,29 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
                               dtim_offs);
                ctxt_sta->is_assoc = cpu_to_le32(1);
+                /*
+                 * allow multicast data frames only as long as the station is
+                 * authorized, i.e., GTK keys are already installed (if needed)
+                 */
+                if (ap_sta_id < IWL_MVM_STATION_COUNT) {
+                        struct ieee80211_sta *sta;
+                        rcu_read_lock();
+                        sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
+                        if (!IS_ERR_OR_NULL(sta)) {
+                                struct iwl_mvm_sta *mvmsta =
+                                        iwl_mvm_sta_from_mac80211(sta);
+                                if (mvmsta->sta_state ==
+                                    IEEE80211_STA_AUTHORIZED)
+                                        cmd.filter_flags |=
+                                                cpu_to_le32(MAC_FILTER_ACCEPT_GRP);
+                        }
+                        rcu_read_unlock();
+                }
        } else {
                ctxt_sta->is_assoc = cpu_to_le32(0);
@@ -703,7 +728,8 @@ static int iwl_mvm_mac_ctxt_cmd_listener(struct iwl_mvm *mvm,
                                       MAC_FILTER_IN_CONTROL_AND_MGMT |
                                       MAC_FILTER_IN_BEACON |
                                       MAC_FILTER_IN_PROBE_REQUEST |
-                                       MAC_FILTER_IN_CRC32);
+                                       MAC_FILTER_IN_CRC32 |
+                                       MAC_FILTER_ACCEPT_GRP);
        ieee80211_hw_set(mvm->hw, RX_INCLUDES_FCS);
        /* Allocate sniffer station */
@@ -727,7 +753,8 @@ static int iwl_mvm_mac_ctxt_cmd_ibss(struct iwl_mvm *mvm,
        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, NULL, action);
        cmd.filter_flags = cpu_to_le32(MAC_FILTER_IN_BEACON |
-                                       MAC_FILTER_IN_PROBE_REQUEST);
+                                       MAC_FILTER_IN_PROBE_REQUEST |
+                                       MAC_FILTER_ACCEPT_GRP);
        /* cmd.ibss.beacon_time/cmd.ibss.beacon_tsf are curently ignored */
        cmd.ibss.bi = cpu_to_le32(vif->bss_conf.beacon_int);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 1c904b5226aa..a7bc00d1296f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3327,10 +3327,20 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                /* enable beacon filtering */
                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
+                /*
+                 * Now that the station is authorized, i.e., keys were already
+                 * installed, need to indicate to the FW that
+                 * multicast data frames can be forwarded to the driver
+                 */
+                iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
                                     true);
        } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                   new_state == IEEE80211_STA_ASSOC) {
+                /* Multicast data frames are no longer allowed */
+                iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
                /* disable beacon filtering */
                ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
                WARN_ON(ret &&
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index de711c1160d3..7c5aaeaf7fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -1063,6 +1063,23 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                else if (iwl_trans->cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
                        iwl_trans->cfg = &iwl9560_2ac_160_cfg_qu_c0_jf_b0;
        }
+        /* same thing for QuZ... */
+        if (iwl_trans->hw_rev == CSR_HW_REV_TYPE_QUZ) {
+                if (cfg == &iwl_ax101_cfg_qu_hr)
+                        cfg = &iwl_ax101_cfg_quz_hr;
+                else if (cfg == &iwl_ax201_cfg_qu_hr)
+                        cfg = &iwl_ax201_cfg_quz_hr;
+                else if (cfg == &iwl9461_2ac_cfg_qu_b0_jf_b0)
+                        cfg = &iwl9461_2ac_cfg_quz_a0_jf_b0_soc;
+                else if (cfg == &iwl9462_2ac_cfg_qu_b0_jf_b0)
+                        cfg = &iwl9462_2ac_cfg_quz_a0_jf_b0_soc;
+                else if (cfg == &iwl9560_2ac_cfg_qu_b0_jf_b0)
+                        cfg = &iwl9560_2ac_cfg_quz_a0_jf_b0_soc;
+                else if (cfg == &iwl9560_2ac_160_cfg_qu_b0_jf_b0)
+                        cfg = &iwl9560_2ac_160_cfg_quz_a0_jf_b0_soc;
+        }
 #endif
        pci_set_drvdata(pdev, iwl_trans);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index f5df5b370d78..935e35dafce5 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3603,6 +3603,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
        } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
                   CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
                   ((trans->cfg != &iwl_ax200_cfg_cc &&
+                     trans->cfg != &iwl_ax201_cfg_qu_hr &&
                     trans->cfg != &killer1650x_2ax_cfg &&
                     trans->cfg != &killer1650w_2ax_cfg &&
                     trans->cfg != &iwl_ax201_cfg_quz_hr) ||
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 38d110338987..9ef6b8fe03c1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -99,10 +99,7 @@ void iwl_pcie_gen2_update_byte_tbl(struct iwl_trans_pcie *trans_pcie,
        u16 len = byte_cnt;
        __le16 bc_ent;
-        if (trans_pcie->bc_table_dword)
+        if (WARN(idx >= txq->n_window, "%d >= %d\n", idx, txq->n_window))
-                len = DIV_ROUND_UP(len, 4);
-        if (WARN_ON(len > 0xFFF || idx >= txq->n_window))
                return;
        filled_tfd_size = offsetof(struct iwl_tfh_tfd, tbs) +
@@ -117,11 +114,20 @@ void iwl_pcie_gen2_update_byte_tbl(struct iwl_trans_pcie *trans_pcie,
         */
        num_fetch_chunks = DIV_ROUND_UP(filled_tfd_size, 64) - 1;
-        bc_ent = cpu_to_le16(len | (num_fetch_chunks << 12));
+        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
-        if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
+                /* Starting from 22560, the HW expects bytes */
+                WARN_ON(trans_pcie->bc_table_dword);
+                WARN_ON(len > 0x3FFF);
+                bc_ent = cpu_to_le16(len | (num_fetch_chunks << 14));
                scd_bc_tbl_gen3->tfd_offset[idx] = bc_ent;
-        else
+        } else {
+                /* Until 22560, the HW expects DW */
+                WARN_ON(!trans_pcie->bc_table_dword);
+                len = DIV_ROUND_UP(len, 4);
+                WARN_ON(len > 0xFFF);
+                bc_ent = cpu_to_le16(len | (num_fetch_chunks << 12));
                scd_bc_tbl->tfd_offset[idx] = bc_ent;
+        }
 }
 /*
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index 627ed1fc7b15..645f4d15fb61 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -136,11 +136,11 @@ static const struct ieee80211_ops mt76x0u_ops = {
        .release_buffered_frames = mt76_release_buffered_frames,
 };
-static int mt76x0u_init_hardware(struct mt76x02_dev *dev)
+static int mt76x0u_init_hardware(struct mt76x02_dev *dev, bool reset)
 {
        int err;
-        mt76x0_chip_onoff(dev, true, true);
+        mt76x0_chip_onoff(dev, true, reset);
        if (!mt76x02_wait_for_mac(&dev->mt76))
                return -ETIMEDOUT;
@@ -173,7 +173,7 @@ static int mt76x0u_register_device(struct mt76x02_dev *dev)
        if (err < 0)
                goto out_err;
-        err = mt76x0u_init_hardware(dev);
+        err = mt76x0u_init_hardware(dev, true);
        if (err < 0)
                goto out_err;
@@ -309,7 +309,7 @@ static int __maybe_unused mt76x0_resume(struct usb_interface *usb_intf)
        if (ret < 0)
                goto err;
-        ret = mt76x0u_init_hardware(dev);
+        ret = mt76x0u_init_hardware(dev, false);
        if (ret)
                goto err;
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
index c9b957ac5733..ecbe78b8027b 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
@@ -6095,6 +6095,15 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
        }
        /*
+         * Clear encryption initialization vectors on start, but keep them
+         * for watchdog reset. Otherwise we will have wrong IVs and not be
+         * able to keep connections after reset.
+         */
+        if (!test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags))
+                for (i = 0; i < 256; i++)
+                        rt2800_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0);
+        /*
         * Clear all beacons
         */
        for (i = 0; i < 8; i++)
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
index 7e43690a861c..2b216edd0c7d 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
@@ -658,6 +658,7 @@ enum rt2x00_state_flags {
        DEVICE_STATE_ENABLED_RADIO,
        DEVICE_STATE_SCANNING,
        DEVICE_STATE_FLUSHING,
+        DEVICE_STATE_RESET,
        /*
         * Driver configuration
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
index 35414f97a978..9d158237ac67 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -1256,13 +1256,14 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
 int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
 {
-        int retval;
+        int retval = 0;
        if (test_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags)) {
                /*
                 * This is special case for ieee80211_restart_hw(), otherwise
                 * mac80211 never call start() two times in row without stop();
                 */
+                set_bit(DEVICE_STATE_RESET, &rt2x00dev->flags);
                rt2x00dev->ops->lib->pre_reset_hw(rt2x00dev);
                rt2x00lib_stop(rt2x00dev);
        }
@@ -1273,14 +1274,14 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
         */
        retval = rt2x00lib_load_firmware(rt2x00dev);
        if (retval)
-                return retval;
+                goto out;
        /*
         * Initialize the device.
         */
        retval = rt2x00lib_initialize(rt2x00dev);
        if (retval)
-                return retval;
+                goto out;
        rt2x00dev->intf_ap_count = 0;
        rt2x00dev->intf_sta_count = 0;
@@ -1289,11 +1290,13 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
        /* Enable the radio */
        retval = rt2x00lib_enable_radio(rt2x00dev);
        if (retval)
-                return retval;
+                goto out;
        set_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags);
-        return 0;
+out:
+        clear_bit(DEVICE_STATE_RESET, &rt2x00dev->flags);
+        return retval;
 }
 void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1d9940d4e8c7..c9262ffeefe4 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                        skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
                        nskb = xenvif_alloc_skb(0);
                        if (unlikely(nskb == NULL)) {
+                                skb_shinfo(skb)->nr_frags = 0;
                                kfree_skb(skb);
                                xenvif_tx_err(queue, &txreq, extra_count, idx);
                                if (net_ratelimit())
@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                        if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
                                /* Failure in xenvif_set_skb_gso is fatal. */
+                                skb_shinfo(skb)->nr_frags = 0;
                                kfree_skb(skb);
                                kfree_skb(nskb);
                                break;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 8f3fbe5ca937..d3d6b7bd6903 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1286,6 +1286,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
         */
        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                mutex_lock(&ctrl->scan_lock);
+                mutex_lock(&ctrl->subsys->lock);
+                nvme_mpath_start_freeze(ctrl->subsys);
+                nvme_mpath_wait_freeze(ctrl->subsys);
                nvme_start_freeze(ctrl);
                nvme_wait_freeze(ctrl);
        }
@@ -1316,6 +1319,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
                nvme_update_formats(ctrl);
        if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
                nvme_unfreeze(ctrl);
+                nvme_mpath_unfreeze(ctrl->subsys);
+                mutex_unlock(&ctrl->subsys->lock);
                mutex_unlock(&ctrl->scan_lock);
        }
        if (effects & NVME_CMD_EFFECTS_CCC)
@@ -1715,6 +1720,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
        if (ns->head->disk) {
                nvme_update_disk_info(ns->head->disk, ns, id);
                blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+                revalidate_disk(ns->head->disk);
        }
 #endif
 }
@@ -2251,6 +2257,16 @@ static const struct nvme_core_quirk_entry core_quirks[] = {
                .vid = 0x1179,
                .mn = "THNSF5256GPUK TOSHIBA",
                .quirks = NVME_QUIRK_NO_APST,
+        },
+        {
+                /*
+                 * This LiteON CL1-3D*-Q11 firmware version has a race
+                 * condition associated with actions related to suspend to idle
+                 * LiteON has resolved the problem in future firmware
+                 */
+                .vid = 0x14a4,
+                .fr = "22301111",
+                .quirks = NVME_QUIRK_SIMPLE_SUSPEND,
        }
 };
@@ -2487,6 +2503,7 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
                if (ret) {
                        dev_err(ctrl->device,
                                "failed to register subsystem device.\n");
+                        put_device(&subsys->dev);
                        goto out_unlock;
                }
                ida_init(&subsys->ns_ida);
@@ -2509,7 +2526,6 @@ out_put_subsystem:
        nvme_put_subsystem(subsys);
 out_unlock:
        mutex_unlock(&nvme_subsystems_lock);
-        put_device(&subsys->dev);
        return ret;
 }
@@ -2591,6 +2607,9 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                        goto out_free;
        }
+        if (!(ctrl->ops->flags & NVME_F_FABRICS))
+                ctrl->cntlid = le16_to_cpu(id->cntlid);
        if (!ctrl->identified) {
                int i;
@@ -2691,7 +2710,6 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                        goto out_free;
                }
        } else {
-                ctrl->cntlid = le16_to_cpu(id->cntlid);
                ctrl->hmpre = le32_to_cpu(id->hmpre);
                ctrl->hmmin = le32_to_cpu(id->hmmin);
                ctrl->hmminds = le32_to_cpu(id->hmminds);
@@ -3571,6 +3589,13 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
        struct nvme_ns *ns, *next;
        LIST_HEAD(ns_list);
+        /*
+         * make sure to requeue I/O to all namespaces as these
+         * might result from the scan itself and must complete
+         * for the scan_work to make progress
+         */
+        nvme_mpath_clear_ctrl_paths(ctrl);
        /* prevent racing with ns scanning */
        flush_work(&ctrl->scan_work);
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 4f0d0d12744e..af831d3d15d0 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -12,6 +12,36 @@ module_param(multipath, bool, 0444);
 MODULE_PARM_DESC(multipath,
        "turn on native support for multiple controllers per subsystem");
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_mq_unfreeze_queue(h->disk->queue);
+}
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_mq_freeze_queue_wait(h->disk->queue);
+}
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+        struct nvme_ns_head *h;
+        lockdep_assert_held(&subsys->lock);
+        list_for_each_entry(h, &subsys->nsheads, entry)
+                if (h->disk)
+                        blk_freeze_queue_start(h->disk->queue);
+}
 /*
 * If multipathing is enabled we need to always use the subsystem instance
 * number for numbering our devices to avoid conflicts between subsystems that
@@ -104,18 +134,34 @@ static const char *nvme_ana_state_names[] = {
        [NVME_ANA_CHANGE]               = "change",
 };
-void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+bool nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
        struct nvme_ns_head *head = ns->head;
+        bool changed = false;
        int node;
        if (!head)
-                return;
+                goto out;
        for_each_node(node) {
-                if (ns == rcu_access_pointer(head->current_path[node]))
+                if (ns == rcu_access_pointer(head->current_path[node])) {
                        rcu_assign_pointer(head->current_path[node], NULL);
+                        changed = true;
+                }
        }
+out:
+        return changed;
+}
+void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
+{
+        struct nvme_ns *ns;
+        mutex_lock(&ctrl->scan_lock);
+        list_for_each_entry(ns, &ctrl->namespaces, list)
+                if (nvme_mpath_clear_current_path(ns))
+                        kblockd_schedule_work(&ns->head->requeue_work);
+        mutex_unlock(&ctrl->scan_lock);
 }
 static bool nvme_path_is_disabled(struct nvme_ns *ns)
@@ -226,6 +272,24 @@ inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head)
        return ns;
 }
+static bool nvme_available_path(struct nvme_ns_head *head)
+{
+        struct nvme_ns *ns;
+        list_for_each_entry_rcu(ns, &head->list, siblings) {
+                switch (ns->ctrl->state) {
+                case NVME_CTRL_LIVE:
+                case NVME_CTRL_RESETTING:
+                case NVME_CTRL_CONNECTING:
+                        /* fallthru */
+                        return true;
+                default:
+                        break;
+                }
+        }
+        return false;
+}
 static blk_qc_t nvme_ns_head_make_request(struct request_queue *q,
                struct bio *bio)
 {
@@ -252,14 +316,14 @@ static blk_qc_t nvme_ns_head_make_request(struct request_queue *q,
                                      disk_devt(ns->head->disk),
                                      bio->bi_iter.bi_sector);
                ret = direct_make_request(bio);
-        } else if (!list_empty_careful(&head->list)) {
+        } else if (nvme_available_path(head)) {
-                dev_warn_ratelimited(dev, "no path available - requeuing I/O\n");
+                dev_warn_ratelimited(dev, "no usable path - requeuing I/O\n");
                spin_lock_irq(&head->requeue_lock);
                bio_list_add(&head->requeue_list, bio);
                spin_unlock_irq(&head->requeue_lock);
        } else {
-                dev_warn_ratelimited(dev, "no path - failing I/O\n");
+                dev_warn_ratelimited(dev, "no available path - failing I/O\n");
                bio->bi_status = BLK_STS_IOERR;
                bio_endio(bio);
@@ -364,6 +428,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)
                srcu_read_unlock(&head->srcu, srcu_idx);
        }
+        synchronize_srcu(&ns->head->srcu);
        kblockd_schedule_work(&ns->head->requeue_work);
 }
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 26b563f9985b..2d678fb968c7 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -92,6 +92,11 @@ enum nvme_quirks {
         * Broken Write Zeroes.
         */
        NVME_QUIRK_DISABLE_WRITE_ZEROES         = (1 << 9),
+        /*
+         * Force simple suspend/resume path.
+         */
+        NVME_QUIRK_SIMPLE_SUSPEND               = (1 << 10),
 };
 /*
@@ -490,6 +495,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
        return ctrl->ana_log_buf != NULL;
 }
+void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
+void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
+void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
 void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
                        struct nvme_ctrl *ctrl, int *flags);
 void nvme_failover_req(struct request *req);
@@ -500,7 +508,8 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head);
 int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id);
 void nvme_mpath_uninit(struct nvme_ctrl *ctrl);
 void nvme_mpath_stop(struct nvme_ctrl *ctrl);
-void nvme_mpath_clear_current_path(struct nvme_ns *ns);
+bool nvme_mpath_clear_current_path(struct nvme_ns *ns);
+void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl);
 struct nvme_ns *nvme_find_path(struct nvme_ns_head *head);
 static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
@@ -548,7 +557,11 @@ static inline void nvme_mpath_add_disk(struct nvme_ns *ns,
 static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
 {
 }
-static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
+static inline bool nvme_mpath_clear_current_path(struct nvme_ns *ns)
+{
+        return false;
+}
+static inline void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 {
 }
 static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
@@ -568,6 +581,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
 static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl)
 {
 }
+static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+{
+}
+static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+{
+}
 #endif /* CONFIG_NVME_MULTIPATH */
 #ifdef CONFIG_NVM
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index db160cee42ad..732d5b63ec05 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2695,7 +2695,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie)
 {
        struct nvme_dev *dev = data;
-        nvme_reset_ctrl_sync(&dev->ctrl);
+        flush_work(&dev->ctrl.reset_work);
        flush_work(&dev->ctrl.scan_work);
        nvme_put_ctrl(&dev->ctrl);
 }
@@ -2761,6 +2761,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
+        nvme_reset_ctrl(&dev->ctrl);
        nvme_get_ctrl(&dev->ctrl);
        async_schedule(nvme_async_probe, dev);
@@ -2846,7 +2847,7 @@ static int nvme_resume(struct device *dev)
        struct nvme_dev *ndev = pci_get_drvdata(to_pci_dev(dev));
        struct nvme_ctrl *ctrl = &ndev->ctrl;
-        if (pm_resume_via_firmware() || !ctrl->npss ||
+        if (ndev->last_ps == U32_MAX ||
            nvme_set_power_state(ctrl, ndev->last_ps) != 0)
                nvme_reset_ctrl(ctrl);
        return 0;
@@ -2859,6 +2860,8 @@ static int nvme_suspend(struct device *dev)
        struct nvme_ctrl *ctrl = &ndev->ctrl;
        int ret = -EBUSY;
+        ndev->last_ps = U32_MAX;
        /*
         * The platform does not remove power for a kernel managed suspend so
         * use host managed nvme power settings for lowest idle power if
@@ -2866,8 +2869,15 @@ static int nvme_suspend(struct device *dev)
         * shutdown.  But if the firmware is involved after the suspend or the
         * device does not support any non-default power states, shut down the
         * device fully.
+         *
+         * If ASPM is not enabled for the device, shut down the device and allow
+         * the PCI bus layer to put it into D3 in order to take the PCIe link
+         * down, so as to allow the platform to achieve its minimum low-power
+         * state (which may not be possible if the link is up).
         */
-        if (pm_suspend_via_firmware() || !ctrl->npss) {
+        if (pm_suspend_via_firmware() || !ctrl->npss ||
+            !pcie_aspm_enabled(pdev) ||
+            (ndev->ctrl.quirks & NVME_QUIRK_SIMPLE_SUSPEND)) {
                nvme_dev_disable(ndev, true);
                return 0;
        }
@@ -2880,7 +2890,6 @@ static int nvme_suspend(struct device *dev)
            ctrl->state != NVME_CTRL_ADMIN_ONLY)
                goto unfreeze;
-        ndev->last_ps = 0;
        ret = nvme_get_power_state(ctrl, &ndev->last_ps);
        if (ret < 0)
                goto unfreeze;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index a249db528d54..1a6449bc547b 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -562,13 +562,17 @@ out_destroy_cm_id:
        return ret;
 }
+static void __nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
+{
+        rdma_disconnect(queue->cm_id);
+        ib_drain_qp(queue->qp);
+}
 static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
 {
        if (!test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
                return;
+        __nvme_rdma_stop_queue(queue);
-        rdma_disconnect(queue->cm_id);
-        ib_drain_qp(queue->qp);
 }
 static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
@@ -607,11 +611,13 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
        else
                ret = nvmf_connect_admin_queue(&ctrl->ctrl);
-        if (!ret)
+        if (!ret) {
                set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
-        else
+        } else {
+                __nvme_rdma_stop_queue(queue);
                dev_info(ctrl->ctrl.device,
                        "failed to connect queue: %d ret=%d\n", idx, ret);
+        }
        return ret;
 }
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index cd52b9f15376..98613a45bd3b 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -675,6 +675,7 @@ static void nvmet_port_subsys_drop_link(struct config_item *parent,
 found:
        list_del(&p->entry);
+        nvmet_port_del_ctrls(port, subsys);
        nvmet_port_disc_changed(port, subsys);
        if (list_empty(&port->subsystems))
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index dad0243c7c96..3a67e244e568 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -46,6 +46,9 @@ inline u16 errno_to_nvme_status(struct nvmet_req *req, int errno)
        u16 status;
        switch (errno) {
+        case 0:
+                status = NVME_SC_SUCCESS;
+                break;
        case -ENOSPC:
                req->error_loc = offsetof(struct nvme_rw_command, length);
                status = NVME_SC_CAP_EXCEEDED | NVME_SC_DNR;
@@ -280,6 +283,18 @@ void nvmet_unregister_transport(const struct nvmet_fabrics_ops *ops)
 }
 EXPORT_SYMBOL_GPL(nvmet_unregister_transport);
+void nvmet_port_del_ctrls(struct nvmet_port *port, struct nvmet_subsys *subsys)
+{
+        struct nvmet_ctrl *ctrl;
+        mutex_lock(&subsys->lock);
+        list_for_each_entry(ctrl, &subsys->ctrls, subsys_entry) {
+                if (ctrl->port == port)
+                        ctrl->ops->delete_ctrl(ctrl);
+        }
+        mutex_unlock(&subsys->lock);
+}
 int nvmet_enable_port(struct nvmet_port *port)
 {
        const struct nvmet_fabrics_ops *ops;
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index b16dc3981c69..0940c5024a34 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -654,6 +654,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port)
        mutex_lock(&nvme_loop_ports_mutex);
        list_del_init(&port->entry);
        mutex_unlock(&nvme_loop_ports_mutex);
+        /*
+         * Ensure any ctrls that are in the process of being
+         * deleted are in fact deleted before we return
+         * and free the port. This is to prevent active
+         * ctrls from using a port after it's freed.
+         */
+        flush_workqueue(nvme_delete_wq);
 }
 static const struct nvmet_fabrics_ops nvme_loop_ops = {
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 6ee66c610739..c51f8dd01dc4 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -418,6 +418,9 @@ void nvmet_port_send_ana_event(struct nvmet_port *port);
 int nvmet_register_transport(const struct nvmet_fabrics_ops *ops);
 void nvmet_unregister_transport(const struct nvmet_fabrics_ops *ops);
+void nvmet_port_del_ctrls(struct nvmet_port *port,
+                          struct nvmet_subsys *subsys);
 int nvmet_enable_port(struct nvmet_port *port);
 void nvmet_disable_port(struct nvmet_port *port);
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 7f84bb4903ca..a296eaf52a5b 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -277,7 +277,7 @@ EXPORT_SYMBOL_GPL(of_irq_parse_raw);
 * of_irq_parse_one - Resolve an interrupt for a device
 * @device: the device whose interrupt is to be resolved
 * @index: index of the interrupt to resolve
- * @out_irq: structure of_irq filled by this function
+ * @out_irq: structure of_phandle_args filled by this function
 *
 * This function resolves an interrupt for a node by walking the interrupt tree,
 * finding which interrupt controller node it is attached to, and returning the
diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
index c1b67dd7cd6e..83c766233181 100644
--- a/drivers/of/resolver.c
+++ b/drivers/of/resolver.c
@@ -206,16 +206,22 @@ static int adjust_local_phandle_references(struct device_node *local_fixups,
        for_each_child_of_node(local_fixups, child) {
                for_each_child_of_node(overlay, overlay_child)
-                        if (!node_name_cmp(child, overlay_child))
+                        if (!node_name_cmp(child, overlay_child)) {
+                                of_node_put(overlay_child);
                                break;
+                        }
-                if (!overlay_child)
+                if (!overlay_child) {
+                        of_node_put(child);
                        return -EINVAL;
+                }
                err = adjust_local_phandle_references(child, overlay_child,
                                phandle_delta);
-                if (err)
+                if (err) {
+                        of_node_put(child);
                        return err;
+                }
        }
        return 0;
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index e44af7f4d37f..464f8f92653f 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -1170,6 +1170,26 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp)
 module_param_call(policy, pcie_aspm_set_policy, pcie_aspm_get_policy,
        NULL, 0644);
+/**
+ * pcie_aspm_enabled - Check if PCIe ASPM has been enabled for a device.
+ * @pdev: Target device.
+ */
+bool pcie_aspm_enabled(struct pci_dev *pdev)
+{
+        struct pci_dev *bridge = pci_upstream_bridge(pdev);
+        bool ret;
+        if (!bridge)
+                return false;
+        mutex_lock(&aspm_lock);
+        ret = bridge->link_state ? !!bridge->link_state->aspm_enabled : false;
+        mutex_unlock(&aspm_lock);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(pcie_aspm_enabled);
 #ifdef CONFIG_PCIEASPM_DEBUG
 static ssize_t link_state_show(struct device *dev,
                struct device_attribute *attr,
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 208aacf39329..44c4ae1abd00 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5256,7 +5256,7 @@ static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
         */
        if (ioread32(map + 0x2240c) & 0x2) {
                pci_info(pdev, FW_BUG "GPU left initialized by EFI, resetting\n");
-                ret = pci_reset_function(pdev);
+                ret = pci_reset_bus(pdev);
                if (ret < 0)
                        pci_err(pdev, "Failed to reset GPU: %d\n", ret);
        }
diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
index e504d255d5ce..430731cdf827 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -707,7 +707,7 @@ static int cros_ec_ishtp_reset(struct ishtp_cl_device *cl_device)
 */
 static int __maybe_unused cros_ec_ishtp_suspend(struct device *device)
 {
-        struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+        struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
        struct ishtp_cl *cros_ish_cl = ishtp_get_drvdata(cl_device);
        struct ishtp_cl_data *client_data = ishtp_get_client_data(cros_ish_cl);
@@ -722,7 +722,7 @@ static int __maybe_unused cros_ec_ishtp_suspend(struct device *device)
 */
 static int __maybe_unused cros_ec_ishtp_resume(struct device *device)
 {
-        struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+        struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
        struct ishtp_cl *cros_ish_cl = ishtp_get_drvdata(cl_device);
        struct ishtp_cl_data *client_data = ishtp_get_client_data(cros_ish_cl);
diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c
index 30de448de802..86d88aec94a1 100644
--- a/drivers/power/supply/ab8500_charger.c
+++ b/drivers/power/supply/ab8500_charger.c
@@ -742,6 +742,7 @@ static int ab8500_charger_max_usb_curr(struct ab8500_charger *di,
                                                USB_CH_IP_CUR_LVL_1P5;
                        break;
                }
+                /* Else, fall through */
        case USB_STAT_HM_IDGND:
                dev_err(di->dev, "USB Type - Charging not allowed\n");
                di->max_usb_in_curr.usb_type_max = USB_CH_IP_CUR_LVL_0P05;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index c7ee07ce3615..28db887d38ed 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -629,6 +629,7 @@ struct qeth_seqno {
 struct qeth_reply {
        struct list_head list;
        struct completion received;
+        spinlock_t lock;
        int (*callback)(struct qeth_card *, struct qeth_reply *,
                unsigned long);
        u32 seqno;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 4d0caeebc802..6502b148541e 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -544,6 +544,7 @@ static struct qeth_reply *qeth_alloc_reply(struct qeth_card *card)
        if (reply) {
                refcount_set(&reply->refcnt, 1);
                init_completion(&reply->received);
+                spin_lock_init(&reply->lock);
        }
        return reply;
 }
@@ -799,6 +800,13 @@ static void qeth_issue_next_read_cb(struct qeth_card *card,
        if (!reply->callback) {
                rc = 0;
+                goto no_callback;
+        }
+        spin_lock_irqsave(&reply->lock, flags);
+        if (reply->rc) {
+                /* Bail out when the requestor has already left: */
+                rc = reply->rc;
        } else {
                if (cmd) {
                        reply->offset = (u16)((char *)cmd - (char *)iob->data);
@@ -807,7 +815,9 @@ static void qeth_issue_next_read_cb(struct qeth_card *card,
                        rc = reply->callback(card, reply, (unsigned long)iob);
                }
        }
+        spin_unlock_irqrestore(&reply->lock, flags);
+no_callback:
        if (rc <= 0)
                qeth_notify_reply(reply, rc);
        qeth_put_reply(reply);
@@ -1749,6 +1759,16 @@ static int qeth_send_control_data(struct qeth_card *card,
                rc = (timeout == -ERESTARTSYS) ? -EINTR : -ETIME;
        qeth_dequeue_reply(card, reply);
+        if (reply_cb) {
+                /* Wait until the callback for a late reply has completed: */
+                spin_lock_irq(&reply->lock);
+                if (rc)
+                        /* Zap any callback that's still pending: */
+                        reply->rc = rc;
+                spin_unlock_irq(&reply->lock);
+        }
        if (!rc)
                rc = reply->rc;
        qeth_put_reply(reply);
@@ -4354,6 +4374,10 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
            get_user(req_len, &ureq->hdr.req_len))
                return -EFAULT;
+        /* Sanitize user input, to avoid overflows in iob size calculation: */
+        if (req_len > QETH_BUFSIZE)
+                return -EINVAL;
        iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_SNMP_CONTROL, req_len);
        if (!iob)
                return -ENOMEM;
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index abcad097ff2f..f47b4b281b14 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -459,6 +459,7 @@ static void sas_discover_domain(struct work_struct *work)
                pr_notice("ATA device seen but CONFIG_SCSI_SAS_ATA=N so cannot attach\n");
                /* Fall through */
 #endif
+                /* Fall through - only for the #else condition above. */
        default:
                error = -ENXIO;
                pr_err("unhandled device %d\n", dev->dev_type);
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 2c3bb8a966e5..bade2e025ecf 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -824,6 +824,7 @@ struct lpfc_hba {
        uint32_t cfg_cq_poll_threshold;
        uint32_t cfg_cq_max_proc_limit;
        uint32_t cfg_fcp_cpu_map;
+        uint32_t cfg_fcp_mq_threshold;
        uint32_t cfg_hdw_queue;
        uint32_t cfg_irq_chann;
        uint32_t cfg_suppress_rsp;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index ea62322ffe2b..8d8c495b5b60 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -5709,6 +5709,19 @@ LPFC_ATTR_RW(nvme_embed_cmd, 1, 0, 2,
             "Embed NVME Command in WQE");
 /*
+ * lpfc_fcp_mq_threshold: Set the maximum number of Hardware Queues
+ * the driver will advertise it supports to the SCSI layer.
+ *
+ *      0    = Set nr_hw_queues by the number of CPUs or HW queues.
+ *      1,128 = Manually specify the maximum nr_hw_queue value to be set,
+ *
+ * Value range is [0,128]. Default value is 8.
+ */
+LPFC_ATTR_R(fcp_mq_threshold, LPFC_FCP_MQ_THRESHOLD_DEF,
+            LPFC_FCP_MQ_THRESHOLD_MIN, LPFC_FCP_MQ_THRESHOLD_MAX,
+            "Set the number of SCSI Queues advertised");
+/*
 * lpfc_hdw_queue: Set the number of Hardware Queues the driver
 * will advertise it supports to the NVME and  SCSI layers. This also
 * will map to the number of CQ/WQ pairs the driver will create.
@@ -6030,6 +6043,7 @@ struct device_attribute *lpfc_hba_attrs[] = {
        &dev_attr_lpfc_cq_poll_threshold,
        &dev_attr_lpfc_cq_max_proc_limit,
        &dev_attr_lpfc_fcp_cpu_map,
+        &dev_attr_lpfc_fcp_mq_threshold,
        &dev_attr_lpfc_hdw_queue,
        &dev_attr_lpfc_irq_chann,
        &dev_attr_lpfc_suppress_rsp,
@@ -7112,6 +7126,7 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
        /* Initialize first burst. Target vs Initiator are different. */
        lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
        lpfc_nvmet_fb_size_init(phba, lpfc_nvmet_fb_size);
+        lpfc_fcp_mq_threshold_init(phba, lpfc_fcp_mq_threshold);
        lpfc_hdw_queue_init(phba, lpfc_hdw_queue);
        lpfc_irq_chann_init(phba, lpfc_irq_chann);
        lpfc_enable_bbcr_init(phba, lpfc_enable_bbcr);
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index faf43b1d3dbe..1ac98becb5ba 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -4309,10 +4309,12 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
        shost->max_cmd_len = 16;
        if (phba->sli_rev == LPFC_SLI_REV4) {
-                if (phba->cfg_fcp_io_sched == LPFC_FCP_SCHED_BY_HDWQ)
+                if (!phba->cfg_fcp_mq_threshold ||
-                        shost->nr_hw_queues = phba->cfg_hdw_queue;
+                    phba->cfg_fcp_mq_threshold > phba->cfg_hdw_queue)
-                else
+                        phba->cfg_fcp_mq_threshold = phba->cfg_hdw_queue;
-                        shost->nr_hw_queues = phba->sli4_hba.num_present_cpu;
+                shost->nr_hw_queues = min_t(int, 2 * num_possible_nodes(),
+                                            phba->cfg_fcp_mq_threshold);
                shost->dma_boundary =
                        phba->sli4_hba.pc_sli4_params.sge_supp_len-1;
@@ -10776,12 +10778,31 @@ lpfc_cpu_affinity_check(struct lpfc_hba *phba, int vectors)
        /* This loop sets up all CPUs that are affinitized with a
         * irq vector assigned to the driver. All affinitized CPUs
         * will get a link to that vectors IRQ and EQ.
+         *
+         * NULL affinity mask handling:
+         * If irq count is greater than one, log an error message.
+         * If the null mask is received for the first irq, find the
+         * first present cpu, and assign the eq index to ensure at
+         * least one EQ is assigned.
         */
        for (idx = 0; idx <  phba->cfg_irq_chann; idx++) {
                /* Get a CPU mask for all CPUs affinitized to this vector */
                maskp = pci_irq_get_affinity(phba->pcidev, idx);
-                if (!maskp)
+                if (!maskp) {
-                        continue;
+                        if (phba->cfg_irq_chann > 1)
+                                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                                "3329 No affinity mask found "
+                                                "for vector %d (%d)\n",
+                                                idx, phba->cfg_irq_chann);
+                        if (!idx) {
+                                cpu = cpumask_first(cpu_present_mask);
+                                cpup = &phba->sli4_hba.cpu_map[cpu];
+                                cpup->eq = idx;
+                                cpup->irq = pci_irq_vector(phba->pcidev, idx);
+                                cpup->flag |= LPFC_CPU_FIRST_IRQ;
+                        }
+                        break;
+                }
                i = 0;
                /* Loop through all CPUs associated with vector idx */
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index 3aeca387b22a..329f7aa7e169 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -44,6 +44,11 @@
 #define LPFC_HBA_HDWQ_MAX       128
 #define LPFC_HBA_HDWQ_DEF       0
+/* FCP MQ queue count limiting */
+#define LPFC_FCP_MQ_THRESHOLD_MIN       0
+#define LPFC_FCP_MQ_THRESHOLD_MAX       128
+#define LPFC_FCP_MQ_THRESHOLD_DEF       8
 /* Common buffer size to accomidate SCSI and NVME IO buffers */
 #define LPFC_COMMON_IO_BUF_SZ   768
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 8d560c562e9c..6b7b390b2e52 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2956,6 +2956,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
        dma_free_coherent(&ha->pdev->dev, vha->gnl.size, vha->gnl.l,
            vha->gnl.ldma);
+        vha->gnl.l = NULL;
        vfree(vha->scan.l);
        if (vha->qpair && vha->qpair->vp_idx == vha->vp_idx) {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 2e58cff9d200..98e60a34afd9 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3440,6 +3440,12 @@ skip_dpc:
        return 0;
 probe_failed:
+        if (base_vha->gnl.l) {
+                dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
+                                base_vha->gnl.l, base_vha->gnl.ldma);
+                base_vha->gnl.l = NULL;
+        }
        if (base_vha->timer_active)
                qla2x00_stop_timer(base_vha);
        base_vha->flags.online = 0;
@@ -3673,7 +3679,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
        if (!atomic_read(&pdev->enable_cnt)) {
                dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
                    base_vha->gnl.l, base_vha->gnl.ldma);
+                base_vha->gnl.l = NULL;
                scsi_host_put(base_vha->host);
                kfree(ha);
                pci_set_drvdata(pdev, NULL);
@@ -3713,6 +3719,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
        dma_free_coherent(&ha->pdev->dev,
                base_vha->gnl.size, base_vha->gnl.l, base_vha->gnl.ldma);
+        base_vha->gnl.l = NULL;
        vfree(base_vha->scan.l);
        if (IS_QLAFX00(ha))
@@ -4816,6 +4824,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
                    "Alloc failed for scan database.\n");
                dma_free_coherent(&ha->pdev->dev, vha->gnl.size,
                    vha->gnl.l, vha->gnl.ldma);
+                vha->gnl.l = NULL;
                scsi_remove_host(vha->host);
                return NULL;
        }
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index e274053109d0..029da74bb2f5 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7062,6 +7062,9 @@ static inline int ufshcd_config_vreg_lpm(struct ufs_hba *hba,
 static inline int ufshcd_config_vreg_hpm(struct ufs_hba *hba,
                                         struct ufs_vreg *vreg)
 {
+        if (!vreg)
+                return 0;
        return ufshcd_config_vreg_load(hba->dev, vreg, vreg->max_uA);
 }
diff --git a/drivers/soc/ixp4xx/Kconfig b/drivers/soc/ixp4xx/Kconfig
index de2e62c3310a..e3eb19b85fa4 100644
--- a/drivers/soc/ixp4xx/Kconfig
+++ b/drivers/soc/ixp4xx/Kconfig
@@ -1,4 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
+if ARCH_IXP4XX || COMPILE_TEST
 menu "IXP4xx SoC drivers"
 config IXP4XX_QMGR
@@ -15,3 +17,5 @@ config IXP4XX_NPE
          and is automatically selected by Ethernet and HSS drivers.
 endmenu
+endif
diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
index bb77c220b6f8..ccc6d53fe788 100644
--- a/drivers/soc/ti/pm33xx.c
+++ b/drivers/soc/ti/pm33xx.c
@@ -141,7 +141,7 @@ static int __init am43xx_map_gic(void)
 }
 #ifdef CONFIG_SUSPEND
-struct wkup_m3_wakeup_src rtc_wake_src(void)
+static struct wkup_m3_wakeup_src rtc_wake_src(void)
 {
        u32 i;
@@ -157,7 +157,7 @@ struct wkup_m3_wakeup_src rtc_wake_src(void)
        return rtc_ext_wakeup;
 }
-int am33xx_rtc_only_idle(unsigned long wfi_flags)
+static int am33xx_rtc_only_idle(unsigned long wfi_flags)
 {
        omap_rtc_power_off_program(&omap_rtc->dev);
        am33xx_do_wfi_sram(wfi_flags);
@@ -252,7 +252,7 @@ static int am33xx_pm_begin(suspend_state_t state)
        if (state == PM_SUSPEND_MEM && pm_ops->check_off_mode_enable()) {
                nvmem = devm_nvmem_device_get(&omap_rtc->dev,
                                              "omap_rtc_scratch0");
-                if (nvmem)
+                if (!IS_ERR(nvmem))
                        nvmem_device_write(nvmem, RTC_SCRATCH_MAGIC_REG * 4, 4,
                                           (void *)&rtc_magic_val);
                rtc_only_idle = 1;
@@ -278,9 +278,12 @@ static void am33xx_pm_end(void)
        struct nvmem_device *nvmem;
        nvmem = devm_nvmem_device_get(&omap_rtc->dev, "omap_rtc_scratch0");
+        if (IS_ERR(nvmem))
+                return;
        m3_ipc->ops->finish_low_power(m3_ipc);
        if (rtc_only_idle) {
-                if (retrigger_irq)
+                if (retrigger_irq) {
                        /*
                         * 32 bits of Interrupt Set-Pending correspond to 32
                         * 32 interrupts. Compute the bit offset of the
@@ -291,8 +294,10 @@ static void am33xx_pm_end(void)
                        writel_relaxed(1 << (retrigger_irq & 31),
                                       gic_dist_base + GIC_INT_SET_PENDING_BASE
                                       + retrigger_irq / 32 * 4);
-                        nvmem_device_write(nvmem, RTC_SCRATCH_MAGIC_REG * 4, 4,
+                }
-                                           (void *)&val);
+                nvmem_device_write(nvmem, RTC_SCRATCH_MAGIC_REG * 4, 4,
+                                   (void *)&val);
        }
        rtc_only_idle = 0;
@@ -415,7 +420,7 @@ static int am33xx_pm_rtc_setup(void)
                nvmem = devm_nvmem_device_get(&omap_rtc->dev,
                                              "omap_rtc_scratch0");
-                if (nvmem) {
+                if (!IS_ERR(nvmem)) {
                        nvmem_device_read(nvmem, RTC_SCRATCH_MAGIC_REG * 4,
                                          4, (void *)&rtc_magic_val);
                        if ((rtc_magic_val & 0xffff) != RTC_REG_BOOT_MAGIC)
diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
index 3a01cfd70fdc..f518273cfbe3 100644
--- a/drivers/soundwire/Kconfig
+++ b/drivers/soundwire/Kconfig
@@ -4,7 +4,7 @@
 #
 menuconfig SOUNDWIRE
-        bool "SoundWire support"
+        tristate "SoundWire support"
        help
          SoundWire is a 2-Pin interface with data and clock line ratified
          by the MIPI Alliance. SoundWire is used for transporting data
@@ -17,17 +17,12 @@ if SOUNDWIRE
 comment "SoundWire Devices"
-config SOUNDWIRE_BUS
-        tristate
-        select REGMAP_SOUNDWIRE
 config SOUNDWIRE_CADENCE
        tristate
 config SOUNDWIRE_INTEL
        tristate "Intel SoundWire Master driver"
        select SOUNDWIRE_CADENCE
-        select SOUNDWIRE_BUS
        depends on X86 && ACPI && SND_SOC
        help
          SoundWire Intel Master driver.
diff --git a/drivers/soundwire/Makefile b/drivers/soundwire/Makefile
index fd99a831b92a..45b7e5001653 100644
--- a/drivers/soundwire/Makefile
+++ b/drivers/soundwire/Makefile
@@ -5,7 +5,7 @@
 #Bus Objs
 soundwire-bus-objs := bus_type.o bus.o slave.o mipi_disco.o stream.o
-obj-$(CONFIG_SOUNDWIRE_BUS) += soundwire-bus.o
+obj-$(CONFIG_SOUNDWIRE) += soundwire-bus.o
 #Cadence Objs
 soundwire-cadence-objs := cadence_master.o
diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
index ff4badc9b3de..60e8bdee5c75 100644
--- a/drivers/soundwire/cadence_master.c
+++ b/drivers/soundwire/cadence_master.c
@@ -81,8 +81,8 @@
 #define CDNS_MCP_INTSET                         0x4C
-#define CDNS_SDW_SLAVE_STAT                     0x50
+#define CDNS_MCP_SLAVE_STAT                     0x50
-#define CDNS_MCP_SLAVE_STAT_MASK                BIT(1, 0)
+#define CDNS_MCP_SLAVE_STAT_MASK                GENMASK(1, 0)
 #define CDNS_MCP_SLAVE_INTSTAT0                 0x54
 #define CDNS_MCP_SLAVE_INTSTAT1                 0x58
@@ -96,8 +96,8 @@
 #define CDNS_MCP_SLAVE_INTMASK0                 0x5C
 #define CDNS_MCP_SLAVE_INTMASK1                 0x60
-#define CDNS_MCP_SLAVE_INTMASK0_MASK            GENMASK(30, 0)
+#define CDNS_MCP_SLAVE_INTMASK0_MASK            GENMASK(31, 0)
-#define CDNS_MCP_SLAVE_INTMASK1_MASK            GENMASK(16, 0)
+#define CDNS_MCP_SLAVE_INTMASK1_MASK            GENMASK(15, 0)
 #define CDNS_MCP_PORT_INTSTAT                   0x64
 #define CDNS_MCP_PDI_STAT                       0x6C
diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
index 2edf3ee91300..caf4d4df4bd3 100644
--- a/drivers/staging/comedi/drivers/dt3000.c
+++ b/drivers/staging/comedi/drivers/dt3000.c
@@ -342,9 +342,9 @@ static irqreturn_t dt3k_interrupt(int irq, void *d)
 static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
                            unsigned int flags)
 {
-        int divider, base, prescale;
+        unsigned int divider, base, prescale;
-        /* This function needs improvment */
+        /* This function needs improvement */
        /* Don't know if divider==0 works. */
        for (prescale = 0; prescale < 16; prescale++) {
@@ -358,7 +358,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
                        divider = (*nanosec) / base;
                        break;
                case CMDF_ROUND_UP:
-                        divider = (*nanosec) / base;
+                        divider = DIV_ROUND_UP(*nanosec, base);
                        break;
                }
                if (divider < 65536) {
@@ -368,7 +368,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
        }
        prescale = 15;
-        base = timer_base * (1 << prescale);
+        base = timer_base * (prescale + 1);
        divider = 65535;
        *nanosec = divider * base;
        return (prescale << 16) | (divider);
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 04eda111920e..661bb9358364 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1132,14 +1132,16 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
        struct se_cmd *se_cmd = cmd->se_cmd;
        struct tcmu_dev *udev = cmd->tcmu_dev;
        bool read_len_valid = false;
-        uint32_t read_len = se_cmd->data_length;
+        uint32_t read_len;
        /*
         * cmd has been completed already from timeout, just reclaim
         * data area space and free cmd
         */
-        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+                WARN_ON_ONCE(se_cmd);
                goto out;
+        }
        list_del_init(&cmd->queue_entry);
@@ -1152,6 +1154,7 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                goto done;
        }
+        read_len = se_cmd->data_length;
        if (se_cmd->data_direction == DMA_FROM_DEVICE &&
            (entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) {
                read_len_valid = true;
@@ -1307,6 +1310,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                 */
                scsi_status = SAM_STAT_CHECK_CONDITION;
                list_del_init(&cmd->queue_entry);
+                cmd->se_cmd = NULL;
        } else {
                list_del_init(&cmd->queue_entry);
                idr_remove(&udev->commands, id);
@@ -2022,6 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
                idr_remove(&udev->commands, i);
                if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+                        WARN_ON(!cmd->se_cmd);
                        list_del_init(&cmd->queue_entry);
                        if (err_level == 1) {
                                /*
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index b5abfe89190c..df8812c30640 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -454,9 +454,11 @@ err_clk:
        imx_disable_unprepare_clks(dev);
 disable_hsic_regulator:
        if (data->hsic_pad_regulator)
-                ret = regulator_disable(data->hsic_pad_regulator);
+                /* don't overwrite original ret (cf. EPROBE_DEFER) */
+                regulator_disable(data->hsic_pad_regulator);
        if (pdata.flags & CI_HDRC_PMQOS)
                pm_qos_remove_request(&data->pm_qos_req);
+        data->ci_pdev = NULL;
        return ret;
 }
@@ -469,14 +471,17 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev)
                pm_runtime_disable(&pdev->dev);
                pm_runtime_put_noidle(&pdev->dev);
        }
-        ci_hdrc_remove_device(data->ci_pdev);
+        if (data->ci_pdev)
+                ci_hdrc_remove_device(data->ci_pdev);
        if (data->override_phy_control)
                usb_phy_shutdown(data->phy);
-        imx_disable_unprepare_clks(&pdev->dev);
+        if (data->ci_pdev) {
-        if (data->plat_data->flags & CI_HDRC_PMQOS)
+                imx_disable_unprepare_clks(&pdev->dev);
-                pm_qos_remove_request(&data->pm_qos_req);
+                if (data->plat_data->flags & CI_HDRC_PMQOS)
-        if (data->hsic_pad_regulator)
+                        pm_qos_remove_request(&data->pm_qos_req);
-                regulator_disable(data->hsic_pad_regulator);
+                if (data->hsic_pad_regulator)
+                        regulator_disable(data->hsic_pad_regulator);
+        }
        return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 183b41753c98..62f4fb9b362f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1301,10 +1301,6 @@ made_compressed_probe:
        tty_port_init(&acm->port);
        acm->port.ops = &acm_port_ops;
-        minor = acm_alloc_minor(acm);
-        if (minor < 0)
-                goto alloc_fail1;
        ctrlsize = usb_endpoint_maxp(epctrl);
        readsize = usb_endpoint_maxp(epread) *
                                (quirks == SINGLE_RX_URB ? 1 : 2);
@@ -1312,6 +1308,13 @@ made_compressed_probe:
        acm->writesize = usb_endpoint_maxp(epwrite) * 20;
        acm->control = control_interface;
        acm->data = data_interface;
+        usb_get_intf(acm->control); /* undone in destruct() */
+        minor = acm_alloc_minor(acm);
+        if (minor < 0)
+                goto alloc_fail1;
        acm->minor = minor;
        acm->dev = usb_dev;
        if (h.usb_cdc_acm_descriptor)
@@ -1458,7 +1461,6 @@ skip_countries:
        usb_driver_claim_interface(&acm_driver, data_interface, acm);
        usb_set_intfdata(data_interface, acm);
-        usb_get_intf(control_interface);
        tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
                        &control_interface->dev);
        if (IS_ERR(tty_dev)) {
diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
index 1359b78a624e..6cf22c27f2d2 100644
--- a/drivers/usb/core/buffer.c
+++ b/drivers/usb/core/buffer.c
@@ -66,9 +66,7 @@ int hcd_buffer_create(struct usb_hcd *hcd)
        char            name[16];
        int             i, size;
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
+        if (hcd->localmem_pool || !hcd_uses_dma(hcd))
-            (!is_device_dma_capable(hcd->self.sysdev) &&
-             !hcd->localmem_pool))
                return 0;
        for (i = 0; i < HCD_BUFFER_POOLS; i++) {
@@ -129,8 +127,7 @@ void *hcd_buffer_alloc(
                return gen_pool_dma_alloc(hcd->localmem_pool, size, dma);
        /* some USB hosts just use PIO */
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
+        if (!hcd_uses_dma(hcd)) {
-            !is_device_dma_capable(bus->sysdev)) {
                *dma = ~(dma_addr_t) 0;
                return kmalloc(size, mem_flags);
        }
@@ -160,8 +157,7 @@ void hcd_buffer_free(
                return;
        }
-        if (!IS_ENABLED(CONFIG_HAS_DMA) ||
+        if (!hcd_uses_dma(hcd)) {
-            !is_device_dma_capable(bus->sysdev)) {
                kfree(addr);
                return;
        }
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 65de6f73b672..558890ada0e5 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -193,9 +193,10 @@ int usb_register_dev(struct usb_interface *intf,
                intf->minor = minor;
                break;
        }
-        up_write(&minor_rwsem);
+        if (intf->minor < 0) {
-        if (intf->minor < 0)
+                up_write(&minor_rwsem);
                return -EXFULL;
+        }
        /* create a usb class device for this usb interface */
        snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -203,12 +204,11 @@ int usb_register_dev(struct usb_interface *intf,
                                      MKDEV(USB_MAJOR, minor), class_driver,
                                      "%s", kbasename(name));
        if (IS_ERR(intf->usb_dev)) {
-                down_write(&minor_rwsem);
                usb_minors[minor] = NULL;
                intf->minor = -1;
-                up_write(&minor_rwsem);
                retval = PTR_ERR(intf->usb_dev);
        }
+        up_write(&minor_rwsem);
        return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
@@ -234,12 +234,12 @@ void usb_deregister_dev(struct usb_interface *intf,
                return;
        dev_dbg(&intf->dev, "removing %d minor\n", intf->minor);
+        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
        down_write(&minor_rwsem);
        usb_minors[intf->minor] = NULL;
        up_write(&minor_rwsem);
-        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
        intf->usb_dev = NULL;
        intf->minor = -1;
        destroy_usb_class();
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 2ccbc2f83570..8592c0344fe8 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1412,7 +1412,7 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
        if (usb_endpoint_xfer_control(&urb->ep->desc)) {
                if (hcd->self.uses_pio_for_control)
                        return ret;
-                if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {
+                if (hcd_uses_dma(hcd)) {
                        if (is_vmalloc_addr(urb->setup_packet)) {
                                WARN_ONCE(1, "setup packet is not dma capable\n");
                                return -EAGAIN;
@@ -1446,7 +1446,7 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
        dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
        if (urb->transfer_buffer_length != 0
            && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
-                if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {
+                if (hcd_uses_dma(hcd)) {
                        if (urb->num_sgs) {
                                int n;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index e844bb7b5676..5adf489428aa 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2218,14 +2218,14 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                                (struct usb_cdc_dmm_desc *)buffer;
                        break;
                case USB_CDC_MDLM_TYPE:
-                        if (elength < sizeof(struct usb_cdc_mdlm_desc *))
+                        if (elength < sizeof(struct usb_cdc_mdlm_desc))
                                goto next_desc;
                        if (desc)
                                return -EINVAL;
                        desc = (struct usb_cdc_mdlm_desc *)buffer;
                        break;
                case USB_CDC_MDLM_DETAIL_TYPE:
-                        if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *))
+                        if (elength < sizeof(struct usb_cdc_mdlm_detail_desc))
                                goto next_desc;
                        if (detail)
                                return -EINVAL;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index ee144ff8af5b..111787a137ee 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -4608,7 +4608,7 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
        buf = urb->transfer_buffer;
-        if (hcd->self.uses_dma) {
+        if (hcd_uses_dma(hcd)) {
                if (!buf && (urb->transfer_dma & 3)) {
                        dev_err(hsotg->dev,
                                "%s: unaligned transfer with no transfer_buffer",
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 9118b42c70b6..76883ff4f5bb 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget)
         * disconnect callbacks?
         */
        spin_lock_irqsave(&cdev->lock, flags);
+        cdev->suspended = 0;
        if (cdev->config)
                reset_config(cdev);
        if (cdev->driver->disconnect)
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 29cc5693e05c..7c96c4665178 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -261,7 +261,7 @@ struct fsg_common;
 struct fsg_common {
        struct usb_gadget       *gadget;
        struct usb_composite_dev *cdev;
-        struct fsg_dev          *fsg, *new_fsg;
+        struct fsg_dev          *fsg;
        wait_queue_head_t       io_wait;
        wait_queue_head_t       fsg_wait;
@@ -290,6 +290,7 @@ struct fsg_common {
        unsigned int            bulk_out_maxpacket;
        enum fsg_state          state;          /* For exception handling */
        unsigned int            exception_req_tag;
+        void                    *exception_arg;
        enum data_direction     data_dir;
        u32                     data_size;
@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 /* These routines may be called in process context or in_irq */
-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
+                              void *arg)
 {
        unsigned long           flags;
@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
        if (common->state <= new_state) {
                common->exception_req_tag = common->ep0_req_tag;
                common->state = new_state;
+                common->exception_arg = arg;
                if (common->thread_task)
                        send_sig_info(SIGUSR1, SEND_SIG_PRIV,
                                      common->thread_task);
@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
        spin_unlock_irqrestore(&common->lock, flags);
 }
+static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+{
+        __raise_exception(common, new_state, NULL);
+}
 /*-------------------------------------------------------------------------*/
@@ -2285,16 +2292,16 @@ reset:
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
        struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->new_fsg = fsg;
-        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+        __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
        return USB_GADGET_DELAYED_STATUS;
 }
 static void fsg_disable(struct usb_function *f)
 {
        struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->new_fsg = NULL;
-        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+        __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
 }
@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common)
        enum fsg_state          old_state;
        struct fsg_lun          *curlun;
        unsigned int            exception_req_tag;
+        struct fsg_dev          *new_fsg;
        /*
         * Clear the existing signals.  Anything but SIGUSR1 is converted
@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common)
        common->next_buffhd_to_fill = &common->buffhds[0];
        common->next_buffhd_to_drain = &common->buffhds[0];
        exception_req_tag = common->exception_req_tag;
+        new_fsg = common->exception_arg;
        old_state = common->state;
        common->state = FSG_STATE_NORMAL;
@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common)
                break;
        case FSG_STATE_CONFIG_CHANGE:
-                do_set_interface(common, common->new_fsg);
+                do_set_interface(common, new_fsg);
-                if (common->new_fsg)
+                if (new_fsg)
                        usb_composite_setup_continue(common->cdev);
                break;
@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
        DBG(fsg, "unbind\n");
        if (fsg->common->fsg == fsg) {
-                fsg->common->new_fsg = NULL;
+                __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
-                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
                /* FIXME: make interruptible or killable somehow? */
                wait_event(common->fsg_wait, common->fsg != fsg);
        }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 87062d22134d..1f4c3fbd1df8 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -19,6 +19,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/sizes.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 #include <linux/sys_soc.h>
 #include <linux/uaccess.h>
 #include <linux/usb/ch9.h>
@@ -2450,9 +2451,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
        if (usb3->forced_b_device)
                return -EBUSY;
-        if (!strncmp(buf, "host", strlen("host")))
+        if (sysfs_streq(buf, "host"))
                new_mode_is_host = true;
-        else if (!strncmp(buf, "peripheral", strlen("peripheral")))
+        else if (sysfs_streq(buf, "peripheral"))
                new_mode_is_host = false;
        else
                return -EINVAL;
diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 77cc36efae95..0dbfa5c10703 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -1629,6 +1629,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        /* see what we found out */
                        temp = check_reset_complete(fotg210, wIndex, status_reg,
                                        fotg210_readl(fotg210, status_reg));
+                        /* restart schedule */
+                        fotg210->command |= CMD_RUN;
+                        fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
                }
                if (!(temp & (PORT_RESUME|PORT_RESET))) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c1582fbd1150..38e920ac7f82 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -968,6 +968,11 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
+        /* Motorola devices */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) },    /* mdm6600 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) },    /* mdm9600 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) },    /* mdm ram dl */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) },    /* mdm qc dl */
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
@@ -1549,6 +1554,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff),  /* Telewell TW-LTE 4G v2 */
          .driver_info = RSVD(2) },
        { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) },    /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
@@ -1952,11 +1958,15 @@ static const struct usb_device_id option_ids[] = {
          .driver_info = RSVD(4) },
        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
          .driver_info = RSVD(4) },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff),                     /* D-Link DWM-222 A2 */
+          .driver_info = RSVD(4) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },    /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/A3 */
        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */
          .driver_info = RSVD(4) },
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),                     /* BroadMobi BM818 */
+          .driver_info = RSVD(4) },
        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                   /* OLICARD300 - MT6225 */
        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
        { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
diff --git a/drivers/video/fbdev/acornfb.c b/drivers/video/fbdev/acornfb.c
index 92f23e3bc27a..7cacae5a8797 100644
--- a/drivers/video/fbdev/acornfb.c
+++ b/drivers/video/fbdev/acornfb.c
@@ -858,6 +858,7 @@ static void acornfb_parse_dram(char *opt)
                case 'M':
                case 'm':
                        size *= 1024;
+                        /* Fall through */
                case 'K':
                case 'k':
                        size *= 1024;
diff --git a/drivers/watchdog/wdt285.c b/drivers/watchdog/wdt285.c
index 4eacfb1ce1ac..eb729d704836 100644
--- a/drivers/watchdog/wdt285.c
+++ b/drivers/watchdog/wdt285.c
@@ -168,7 +168,7 @@ static long watchdog_ioctl(struct file *file, unsigned int cmd,
                soft_margin = new_margin;
                reload = soft_margin * (mem_fclk_21285 / 256);
                watchdog_ping();
-                /* Fall */
+                /* Fall through */
        case WDIOC_GETTIMEOUT:
                ret = put_user(soft_margin, int_arg);
                break;
diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index a2a87117d262..fd5133e26a38 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -74,6 +74,7 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net,
                        cell = rcu_dereference_raw(net->ws_cell);
                        if (cell) {
                                afs_get_cell(cell);
+                                ret = 0;
                                break;
                        }
                        ret = -EDESTADDRREQ;
@@ -108,6 +109,9 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net,
        done_seqretry(&net->cells_lock, seq);
+        if (ret != 0 && cell)
+                afs_put_cell(net, cell);
        return ret == 0 ? cell : ERR_PTR(ret);
 }
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 4f1b6f466ff5..b86195e4dc6c 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -505,18 +505,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
        struct afs_call *call = container_of(work, struct afs_call, work);
        struct afs_uuid *r = call->request;
-        struct {
-                __be32  match;
-        } reply;
        _enter("");
        if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
-                reply.match = htonl(0);
+                afs_send_empty_reply(call);
        else
-                reply.match = htonl(1);
+                rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+                                        1, 1, "K-1");
-        afs_send_simple_reply(call, &reply, sizeof(reply));
        afs_put_call(call);
        _leave("");
 }
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index e640d67274be..139b4e3cc946 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -440,7 +440,7 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
 * iterate through the data blob that lists the contents of an AFS directory
 */
 static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
-                           struct key *key)
+                           struct key *key, afs_dataversion_t *_dir_version)
 {
        struct afs_vnode *dvnode = AFS_FS_I(dir);
        struct afs_xdr_dir_page *dbuf;
@@ -460,6 +460,7 @@ static int afs_dir_iterate(struct inode *dir, struct dir_context *ctx,
        req = afs_read_dir(dvnode, key);
        if (IS_ERR(req))
                return PTR_ERR(req);
+        *_dir_version = req->data_version;
        /* round the file position up to the next entry boundary */
        ctx->pos += sizeof(union afs_xdr_dirent) - 1;
@@ -514,7 +515,10 @@ out:
 */
 static int afs_readdir(struct file *file, struct dir_context *ctx)
 {
-        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file));
+        afs_dataversion_t dir_version;
+        return afs_dir_iterate(file_inode(file), ctx, afs_file_key(file),
+                               &dir_version);
 }
 /*
@@ -555,7 +559,8 @@ static int afs_lookup_one_filldir(struct dir_context *ctx, const char *name,
 * - just returns the FID the dentry name maps to if found
 */
 static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
-                             struct afs_fid *fid, struct key *key)
+                             struct afs_fid *fid, struct key *key,
+                             afs_dataversion_t *_dir_version)
 {
        struct afs_super_info *as = dir->i_sb->s_fs_info;
        struct afs_lookup_one_cookie cookie = {
@@ -568,7 +573,7 @@ static int afs_do_lookup_one(struct inode *dir, struct dentry *dentry,
        _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
        /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie.ctx, key);
+        ret = afs_dir_iterate(dir, &cookie.ctx, key, _dir_version);
        if (ret < 0) {
                _leave(" = %d [iter]", ret);
                return ret;
@@ -642,6 +647,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
        struct afs_server *server;
        struct afs_vnode *dvnode = AFS_FS_I(dir), *vnode;
        struct inode *inode = NULL, *ti;
+        afs_dataversion_t data_version = READ_ONCE(dvnode->status.data_version);
        int ret, i;
        _enter("{%lu},%p{%pd},", dir->i_ino, dentry, dentry);
@@ -669,12 +675,14 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
                cookie->fids[i].vid = as->volume->vid;
        /* search the directory */
-        ret = afs_dir_iterate(dir, &cookie->ctx, key);
+        ret = afs_dir_iterate(dir, &cookie->ctx, key, &data_version);
        if (ret < 0) {
                inode = ERR_PTR(ret);
                goto out;
        }
+        dentry->d_fsdata = (void *)(unsigned long)data_version;
        inode = ERR_PTR(-ENOENT);
        if (!cookie->found)
                goto out;
@@ -951,7 +959,8 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
                                 inode ? AFS_FS_I(inode) : NULL);
        } else {
                trace_afs_lookup(dvnode, &dentry->d_name,
-                                 inode ? AFS_FS_I(inode) : NULL);
+                                 IS_ERR_OR_NULL(inode) ? NULL
+                                 : AFS_FS_I(inode));
        }
        return d;
 }
@@ -968,7 +977,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
        struct dentry *parent;
        struct inode *inode;
        struct key *key;
-        long dir_version, de_version;
+        afs_dataversion_t dir_version;
+        long de_version;
        int ret;
        if (flags & LOOKUP_RCU)
@@ -1014,20 +1024,20 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
         * on a 32-bit system, we only have 32 bits in the dentry to store the
         * version.
         */
-        dir_version = (long)dir->status.data_version;
+        dir_version = dir->status.data_version;
        de_version = (long)dentry->d_fsdata;
-        if (de_version == dir_version)
+        if (de_version == (long)dir_version)
-                goto out_valid;
+                goto out_valid_noupdate;
-        dir_version = (long)dir->invalid_before;
+        dir_version = dir->invalid_before;
-        if (de_version - dir_version >= 0)
+        if (de_version - (long)dir_version >= 0)
                goto out_valid;
        _debug("dir modified");
        afs_stat_v(dir, n_reval);
        /* search the directory for this vnode */
-        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key);
+        ret = afs_do_lookup_one(&dir->vfs_inode, dentry, &fid, key, &dir_version);
        switch (ret) {
        case 0:
                /* the filename maps to something */
@@ -1080,7 +1090,8 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
        }
 out_valid:
-        dentry->d_fsdata = (void *)dir_version;
+        dentry->d_fsdata = (void *)(unsigned long)dir_version;
+out_valid_noupdate:
        dput(parent);
        key_put(key);
        _leave(" = 1 [valid]");
@@ -1186,6 +1197,20 @@ static void afs_prep_for_new_inode(struct afs_fs_cursor *fc,
 }
 /*
+ * Note that a dentry got changed.  We need to set d_fsdata to the data version
+ * number derived from the result of the operation.  It doesn't matter if
+ * d_fsdata goes backwards as we'll just revalidate.
+ */
+static void afs_update_dentry_version(struct afs_fs_cursor *fc,
+                                      struct dentry *dentry,
+                                      struct afs_status_cb *scb)
+{
+        if (fc->ac.error == 0)
+                dentry->d_fsdata =
+                        (void *)(unsigned long)scb->status.data_version;
+}
+/*
 * create a directory on an AFS filesystem
 */
 static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
@@ -1227,6 +1252,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
                afs_check_for_remote_deletion(&fc, dvnode);
                afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                        &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                ret = afs_end_vnode_operation(&fc);
                if (ret < 0)
@@ -1319,6 +1345,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)
                afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                        &data_version, scb);
+                afs_update_dentry_version(&fc, dentry, scb);
                ret = afs_end_vnode_operation(&fc);
                if (ret == 0) {
                        afs_dir_remove_subdir(dentry);
@@ -1458,6 +1485,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
                                        &data_version, &scb[0]);
                afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                        &data_version_2, &scb[1]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                ret = afs_end_vnode_operation(&fc);
                if (ret == 0 && !(scb[1].have_status || scb[1].have_error))
                        ret = afs_dir_remove_link(dvnode, dentry, key);
@@ -1526,6 +1554,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
                afs_check_for_remote_deletion(&fc, dvnode);
                afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                        &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                ret = afs_end_vnode_operation(&fc);
                if (ret < 0)
@@ -1607,6 +1636,7 @@ static int afs_link(struct dentry *from, struct inode *dir,
                afs_vnode_commit_status(&fc, vnode, fc.cb_break_2,
                                        NULL, &scb[1]);
                ihold(&vnode->vfs_inode);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                d_instantiate(dentry, &vnode->vfs_inode);
                mutex_unlock(&vnode->io_lock);
@@ -1686,6 +1716,7 @@ static int afs_symlink(struct inode *dir, struct dentry *dentry,
                afs_check_for_remote_deletion(&fc, dvnode);
                afs_vnode_commit_status(&fc, dvnode, fc.cb_break,
                                        &data_version, &scb[0]);
+                afs_update_dentry_version(&fc, dentry, &scb[0]);
                afs_vnode_new_inode(&fc, dentry, &iget_data, &scb[1]);
                ret = afs_end_vnode_operation(&fc);
                if (ret < 0)
@@ -1791,6 +1822,17 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                }
        }
+        /* This bit is potentially nasty as there's a potential race with
+         * afs_d_revalidate{,_rcu}().  We have to change d_fsdata on the dentry
+         * to reflect it's new parent's new data_version after the op, but
+         * d_revalidate may see old_dentry between the op having taken place
+         * and the version being updated.
+         *
+         * So drop the old_dentry for now to make other threads go through
+         * lookup instead - which we hold a lock against.
+         */
+        d_drop(old_dentry);
        ret = -ERESTARTSYS;
        if (afs_begin_vnode_operation(&fc, orig_dvnode, key, true)) {
                afs_dataversion_t orig_data_version;
@@ -1802,9 +1844,9 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                if (orig_dvnode != new_dvnode) {
                        if (mutex_lock_interruptible_nested(&new_dvnode->io_lock, 1) < 0) {
                                afs_end_vnode_operation(&fc);
-                                goto error_rehash;
+                                goto error_rehash_old;
                        }
-                        new_data_version = new_dvnode->status.data_version;
+                        new_data_version = new_dvnode->status.data_version + 1;
                } else {
                        new_data_version = orig_data_version;
                        new_scb = &scb[0];
@@ -1827,7 +1869,7 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                }
                ret = afs_end_vnode_operation(&fc);
                if (ret < 0)
-                        goto error_rehash;
+                        goto error_rehash_old;
        }
        if (ret == 0) {
@@ -1853,10 +1895,26 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                drop_nlink(new_inode);
                        spin_unlock(&new_inode->i_lock);
                }
+                /* Now we can update d_fsdata on the dentries to reflect their
+                 * new parent's data_version.
+                 *
+                 * Note that if we ever implement RENAME_EXCHANGE, we'll have
+                 * to update both dentries with opposing dir versions.
+                 */
+                if (new_dvnode != orig_dvnode) {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[1]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[1]);
+                } else {
+                        afs_update_dentry_version(&fc, old_dentry, &scb[0]);
+                        afs_update_dentry_version(&fc, new_dentry, &scb[0]);
+                }
                d_move(old_dentry, new_dentry);
                goto error_tmp;
        }
+error_rehash_old:
+        d_rehash(new_dentry);
 error_rehash:
        if (rehash)
                d_rehash(rehash);
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 56b69576274d..dd3c55c9101c 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -191,11 +191,13 @@ void afs_put_read(struct afs_read *req)
        int i;
        if (refcount_dec_and_test(&req->usage)) {
-                for (i = 0; i < req->nr_pages; i++)
+                if (req->pages) {
-                        if (req->pages[i])
+                        for (i = 0; i < req->nr_pages; i++)
-                                put_page(req->pages[i]);
+                                if (req->pages[i])
-                if (req->pages != req->array)
+                                        put_page(req->pages[i]);
-                        kfree(req->pages);
+                        if (req->pages != req->array)
+                                kfree(req->pages);
+                }
                kfree(req);
        }
 }
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index d7e0fd3c00df..cfb0ac4bd039 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -56,23 +56,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
                struct afs_uuid__xdr *xdr;
                struct afs_uuid *uuid;
                int j;
+                int n = entry->nr_servers;
                tmp = ntohl(uvldb->serverFlags[i]);
                if (tmp & AFS_VLSF_DONTUSE ||
                    (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
                        continue;
                if (tmp & AFS_VLSF_RWVOL) {
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RW;
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RW;
                        if (vlflags & AFS_VLF_BACKEXISTS)
-                                entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
+                                entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
                }
                if (tmp & AFS_VLSF_ROVOL)
-                        entry->fs_mask[i] |= AFS_VOL_VTM_RO;
+                        entry->fs_mask[n] |= AFS_VOL_VTM_RO;
-                if (!entry->fs_mask[i])
+                if (!entry->fs_mask[n])
                        continue;
                xdr = &uvldb->serverNumber[i];
-                uuid = (struct afs_uuid *)&entry->fs_server[i];
+                uuid = (struct afs_uuid *)&entry->fs_server[n];
                uuid->time_low                  = xdr->time_low;
                uuid->time_mid                  = htons(ntohl(xdr->time_mid));
                uuid->time_hi_and_version       = htons(ntohl(xdr->time_hi_and_version));
diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
index 2575503170fc..ca2452806ebf 100644
--- a/fs/afs/yfsclient.c
+++ b/fs/afs/yfsclient.c
@@ -2171,7 +2171,7 @@ int yfs_fs_store_opaque_acl2(struct afs_fs_cursor *fc, const struct afs_acl *acl
               key_serial(fc->key), vnode->fid.vid, vnode->fid.vnode);
        size = round_up(acl->size, 4);
-        call = afs_alloc_flat_call(net, &yfs_RXYFSStoreStatus,
+        call = afs_alloc_flat_call(net, &yfs_RXYFSStoreOpaqueACL2,
                                   sizeof(__be32) * 2 +
                                   sizeof(struct yfs_xdr_YFSFid) +
                                   sizeof(__be32) + size,
diff --git a/fs/block_dev.c b/fs/block_dev.c
index eb657ab94060..677cb364d33f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -345,24 +345,15 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
        struct bio *bio;
        bool is_poll = (iocb->ki_flags & IOCB_HIPRI) != 0;
        bool is_read = (iov_iter_rw(iter) == READ), is_sync;
-        bool nowait = (iocb->ki_flags & IOCB_NOWAIT) != 0;
        loff_t pos = iocb->ki_pos;
        blk_qc_t qc = BLK_QC_T_NONE;
-        gfp_t gfp;
+        int ret = 0;
-        int ret;
        if ((pos | iov_iter_alignment(iter)) &
            (bdev_logical_block_size(bdev) - 1))
                return -EINVAL;
-        if (nowait)
+        bio = bio_alloc_bioset(GFP_KERNEL, nr_pages, &blkdev_dio_pool);
-                gfp = GFP_NOWAIT;
-        else
-                gfp = GFP_KERNEL;
-        bio = bio_alloc_bioset(gfp, nr_pages, &blkdev_dio_pool);
-        if (!bio)
-                return -EAGAIN;
        dio = container_of(bio, struct blkdev_dio, bio);
        dio->is_sync = is_sync = is_sync_kiocb(iocb);
@@ -384,7 +375,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
        if (!is_poll)
                blk_start_plug(&plug);
-        ret = 0;
        for (;;) {
                bio_set_dev(bio, bdev);
                bio->bi_iter.bi_sector = pos >> 9;
@@ -409,14 +399,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                        task_io_account_write(bio->bi_iter.bi_size);
                }
-                /*
+                dio->size += bio->bi_iter.bi_size;
-                 * Tell underlying layer to not block for resource shortage.
-                 * And if we would have blocked, return error inline instead
-                 * of through the bio->bi_end_io() callback.
-                 */
-                if (nowait)
-                        bio->bi_opf |= (REQ_NOWAIT | REQ_NOWAIT_INLINE);
                pos += bio->bi_iter.bi_size;
                nr_pages = iov_iter_npages(iter, BIO_MAX_PAGES);
@@ -428,13 +411,7 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                                polled = true;
                        }
-                        dio->size += bio->bi_iter.bi_size;
                        qc = submit_bio(bio);
-                        if (qc == BLK_QC_T_EAGAIN) {
-                                dio->size -= bio->bi_iter.bi_size;
-                                ret = -EAGAIN;
-                                goto error;
-                        }
                        if (polled)
                                WRITE_ONCE(iocb->ki_cookie, qc);
@@ -455,19 +432,8 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
                        atomic_inc(&dio->ref);
                }
-                dio->size += bio->bi_iter.bi_size;
+                submit_bio(bio);
-                qc = submit_bio(bio);
+                bio = bio_alloc(GFP_KERNEL, nr_pages);
-                if (qc == BLK_QC_T_EAGAIN) {
-                        dio->size -= bio->bi_iter.bi_size;
-                        ret = -EAGAIN;
-                        goto error;
-                }
-                bio = bio_alloc(gfp, nr_pages);
-                if (!bio) {
-                        ret = -EAGAIN;
-                        goto error;
-                }
        }
        if (!is_poll)
@@ -487,7 +453,6 @@ __blkdev_direct_IO(struct kiocb *iocb, struct iov_iter *iter, int nr_pages)
        }
        __set_current_state(TASK_RUNNING);
-out:
        if (!ret)
                ret = blk_status_to_errno(dio->bio.bi_status);
        if (likely(!ret))
@@ -495,10 +460,6 @@ out:
        bio_put(&dio->bio);
        return ret;
-error:
-        if (!is_poll)
-                blk_finish_plug(&plug);
-        goto out;
 }
 static ssize_t
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 299e11e6c554..94660063a162 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -401,7 +401,6 @@ struct btrfs_dev_replace {
 struct raid_kobject {
        u64 flags;
        struct kobject kobj;
-        struct list_head list;
 };
 /*
@@ -915,8 +914,6 @@ struct btrfs_fs_info {
        u32 thread_pool_size;
        struct kobject *space_info_kobj;
-        struct list_head pending_raid_kobjs;
-        spinlock_t pending_raid_kobjs_lock; /* uncontended */
        u64 total_pinned;
@@ -2698,7 +2695,6 @@ int btrfs_can_relocate(struct btrfs_fs_info *fs_info, u64 bytenr);
 int btrfs_make_block_group(struct btrfs_trans_handle *trans,
                           u64 bytes_used, u64 type, u64 chunk_offset,
                           u64 size);
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info);
 struct btrfs_trans_handle *btrfs_start_trans_remove_block_group(
                                struct btrfs_fs_info *fs_info,
                                const u64 chunk_offset);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5f7ee70b3d1a..97beb351a10c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2683,8 +2683,6 @@ int open_ctree(struct super_block *sb,
        INIT_LIST_HEAD(&fs_info->delayed_iputs);
        INIT_LIST_HEAD(&fs_info->delalloc_roots);
        INIT_LIST_HEAD(&fs_info->caching_block_groups);
-        INIT_LIST_HEAD(&fs_info->pending_raid_kobjs);
-        spin_lock_init(&fs_info->pending_raid_kobjs_lock);
        spin_lock_init(&fs_info->delalloc_root_lock);
        spin_lock_init(&fs_info->trans_lock);
        spin_lock_init(&fs_info->fs_roots_radix_lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d3b58e388535..8b7eb22d508a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4,6 +4,7 @@
 */
 #include <linux/sched.h>
+#include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
@@ -7888,33 +7889,6 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
        return 0;
 }
-/* link_block_group will queue up kobjects to add when we're reclaim-safe */
-void btrfs_add_raid_kobjects(struct btrfs_fs_info *fs_info)
-{
-        struct btrfs_space_info *space_info;
-        struct raid_kobject *rkobj;
-        LIST_HEAD(list);
-        int ret = 0;
-        spin_lock(&fs_info->pending_raid_kobjs_lock);
-        list_splice_init(&fs_info->pending_raid_kobjs, &list);
-        spin_unlock(&fs_info->pending_raid_kobjs_lock);
-        list_for_each_entry(rkobj, &list, list) {
-                space_info = btrfs_find_space_info(fs_info, rkobj->flags);
-                ret = kobject_add(&rkobj->kobj, &space_info->kobj,
-                                "%s", btrfs_bg_type_to_raid_name(rkobj->flags));
-                if (ret) {
-                        kobject_put(&rkobj->kobj);
-                        break;
-                }
-        }
-        if (ret)
-                btrfs_warn(fs_info,
-                           "failed to add kobject for block cache, ignoring");
-}
 static void link_block_group(struct btrfs_block_group_cache *cache)
 {
        struct btrfs_space_info *space_info = cache->space_info;
@@ -7929,18 +7903,36 @@ static void link_block_group(struct btrfs_block_group_cache *cache)
        up_write(&space_info->groups_sem);
        if (first) {
-                struct raid_kobject *rkobj = kzalloc(sizeof(*rkobj), GFP_NOFS);
+                struct raid_kobject *rkobj;
+                unsigned int nofs_flag;
+                int ret;
+                /*
+                 * Setup a NOFS context because kobject_add(), deep in its call
+                 * chain, does GFP_KERNEL allocations, and we are often called
+                 * in a context where if reclaim is triggered we can deadlock
+                 * (we are either holding a transaction handle or some lock
+                 * required for a transaction commit).
+                 */
+                nofs_flag = memalloc_nofs_save();
+                rkobj = kzalloc(sizeof(*rkobj), GFP_KERNEL);
                if (!rkobj) {
+                        memalloc_nofs_restore(nofs_flag);
                        btrfs_warn(cache->fs_info,
                                "couldn't alloc memory for raid level kobject");
                        return;
                }
                rkobj->flags = cache->flags;
                kobject_init(&rkobj->kobj, &btrfs_raid_ktype);
+                ret = kobject_add(&rkobj->kobj, &space_info->kobj, "%s",
-                spin_lock(&fs_info->pending_raid_kobjs_lock);
+                                  btrfs_bg_type_to_raid_name(rkobj->flags));
-                list_add_tail(&rkobj->list, &fs_info->pending_raid_kobjs);
+                memalloc_nofs_restore(nofs_flag);
-                spin_unlock(&fs_info->pending_raid_kobjs_lock);
+                if (ret) {
+                        kobject_put(&rkobj->kobj);
+                        btrfs_warn(fs_info,
+                           "failed to add kobject for block cache, ignoring");
+                        return;
+                }
                space_info->block_group_kobjs[index] = &rkobj->kobj;
        }
 }
@@ -8206,7 +8198,6 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
                        inc_block_group_ro(cache, 1);
        }
-        btrfs_add_raid_kobjects(info);
        btrfs_init_global_block_rsv(info);
        ret = check_chunk_block_group_mappings(info);
 error:
@@ -8975,6 +8966,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
        struct btrfs_device *device;
        struct list_head *devices;
        u64 group_trimmed;
+        u64 range_end = U64_MAX;
        u64 start;
        u64 end;
        u64 trimmed = 0;
@@ -8984,16 +8976,23 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
        int dev_ret = 0;
        int ret = 0;
+        /*
+         * Check range overflow if range->len is set.
+         * The default range->len is U64_MAX.
+         */
+        if (range->len != U64_MAX &&
+            check_add_overflow(range->start, range->len, &range_end))
+                return -EINVAL;
        cache = btrfs_lookup_first_block_group(fs_info, range->start);
        for (; cache; cache = next_block_group(cache)) {
-                if (cache->key.objectid >= (range->start + range->len)) {
+                if (cache->key.objectid >= range_end) {
                        btrfs_put_block_group(cache);
                        break;
                }
                start = max(range->start, cache->key.objectid);
-                end = min(range->start + range->len,
+                end = min(range_end, cache->key.objectid + cache->key.offset);
-                                cache->key.objectid + cache->key.offset);
                if (end - start >= range->minlen) {
                        if (!block_group_cache_done(cache)) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d74b74ca07af..a447d3ec48d5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3087,16 +3087,6 @@ static int btrfs_relocate_chunk(struct btrfs_fs_info *fs_info, u64 chunk_offset)
        if (ret)
                return ret;
-        /*
-         * We add the kobjects here (and after forcing data chunk creation)
-         * since relocation is the only place we'll create chunks of a new
-         * type at runtime.  The only place where we'll remove the last
-         * chunk of a type is the call immediately below this one.  Even
-         * so, we're protected against races with the cleaner thread since
-         * we're covered by the delete_unused_bgs_mutex.
-         */
-        btrfs_add_raid_kobjects(fs_info);
        trans = btrfs_start_trans_remove_block_group(root->fs_info,
                                                     chunk_offset);
        if (IS_ERR(trans)) {
@@ -3223,9 +3213,6 @@ static int btrfs_may_alloc_data_chunk(struct btrfs_fs_info *fs_info,
                        btrfs_end_transaction(trans);
                        if (ret < 0)
                                return ret;
-                        btrfs_add_raid_kobjects(fs_info);
                        return 1;
                }
        }
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index e078cc55b989..b3c8b886bf64 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -913,8 +913,9 @@ get_more_pages:
                        if (page_offset(page) >= ceph_wbc.i_size) {
                                dout("%p page eof %llu\n",
                                     page, ceph_wbc.i_size);
-                                if (ceph_wbc.size_stable ||
+                                if ((ceph_wbc.size_stable ||
-                                    page_offset(page) >= i_size_read(inode))
+                                    page_offset(page) >= i_size_read(inode)) &&
+                                    clear_page_dirty_for_io(page))
                                        mapping->a_ops->invalidatepage(page,
                                                                0, PAGE_SIZE);
                                unlock_page(page);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index d98dcd976c80..ce0f5658720a 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1301,6 +1301,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
 {
        struct ceph_inode_info *ci = cap->ci;
        struct inode *inode = &ci->vfs_inode;
+        struct ceph_buffer *old_blob = NULL;
        struct cap_msg_args arg;
        int held, revoking;
        int wake = 0;
@@ -1365,7 +1366,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
        ci->i_requested_max_size = arg.max_size;
        if (flushing & CEPH_CAP_XATTR_EXCL) {
-                __ceph_build_xattrs_blob(ci);
+                old_blob = __ceph_build_xattrs_blob(ci);
                arg.xattr_version = ci->i_xattrs.version;
                arg.xattr_buf = ci->i_xattrs.blob;
        } else {
@@ -1409,6 +1410,8 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
        spin_unlock(&ci->i_ceph_lock);
+        ceph_buffer_put(old_blob);
        ret = send_cap_msg(&arg);
        if (ret < 0) {
                dout("error sending cap msg, must requeue %p\n", inode);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 791f84a13bb8..18500edefc56 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -736,6 +736,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
        int issued, new_issued, info_caps;
        struct timespec64 mtime, atime, ctime;
        struct ceph_buffer *xattr_blob = NULL;
+        struct ceph_buffer *old_blob = NULL;
        struct ceph_string *pool_ns = NULL;
        struct ceph_cap *new_cap = NULL;
        int err = 0;
@@ -881,7 +882,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
        if ((ci->i_xattrs.version == 0 || !(issued & CEPH_CAP_XATTR_EXCL))  &&
            le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) {
                if (ci->i_xattrs.blob)
-                        ceph_buffer_put(ci->i_xattrs.blob);
+                        old_blob = ci->i_xattrs.blob;
                ci->i_xattrs.blob = xattr_blob;
                if (xattr_blob)
                        memcpy(ci->i_xattrs.blob->vec.iov_base,
@@ -1022,8 +1023,8 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
 out:
        if (new_cap)
                ceph_put_cap(mdsc, new_cap);
-        if (xattr_blob)
+        ceph_buffer_put(old_blob);
-                ceph_buffer_put(xattr_blob);
+        ceph_buffer_put(xattr_blob);
        ceph_put_string(pool_ns);
        return err;
 }
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index ac9b53b89365..5083e238ad15 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -111,8 +111,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct inode *inode,
                req->r_wait_for_completion = ceph_lock_wait_for_completion;
        err = ceph_mdsc_do_request(mdsc, inode, req);
+        if (!err && operation == CEPH_MDS_OP_GETFILELOCK) {
-        if (operation == CEPH_MDS_OP_GETFILELOCK) {
                fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
                if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
                        fl->fl_type = F_RDLCK;
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 4c6494eb02b5..ccfcc66aaf44 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -465,6 +465,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
        struct inode *inode = &ci->vfs_inode;
        struct ceph_cap_snap *capsnap;
        struct ceph_snap_context *old_snapc, *new_snapc;
+        struct ceph_buffer *old_blob = NULL;
        int used, dirty;
        capsnap = kzalloc(sizeof(*capsnap), GFP_NOFS);
@@ -541,7 +542,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
        capsnap->gid = inode->i_gid;
        if (dirty & CEPH_CAP_XATTR_EXCL) {
-                __ceph_build_xattrs_blob(ci);
+                old_blob = __ceph_build_xattrs_blob(ci);
                capsnap->xattr_blob =
                        ceph_buffer_get(ci->i_xattrs.blob);
                capsnap->xattr_version = ci->i_xattrs.version;
@@ -584,6 +585,7 @@ update_snapc:
        }
        spin_unlock(&ci->i_ceph_lock);
+        ceph_buffer_put(old_blob);
        kfree(capsnap);
        ceph_put_snap_context(old_snapc);
 }
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index d2352fd95dbc..6b9f1ee7de85 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -926,7 +926,7 @@ extern int ceph_getattr(const struct path *path, struct kstat *stat,
 int __ceph_setxattr(struct inode *, const char *, const void *, size_t, int);
 ssize_t __ceph_getxattr(struct inode *, const char *, void *, size_t);
 extern ssize_t ceph_listxattr(struct dentry *, char *, size_t);
-extern void __ceph_build_xattrs_blob(struct ceph_inode_info *ci);
+extern struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci);
 extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci);
 extern const struct xattr_handler *ceph_xattr_handlers[];
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 37b458a9af3a..939eab7aa219 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -754,12 +754,15 @@ static int __get_required_blob_size(struct ceph_inode_info *ci, int name_size,
 /*
 * If there are dirty xattrs, reencode xattrs into the prealloc_blob
- * and swap into place.
+ * and swap into place.  It returns the old i_xattrs.blob (or NULL) so
+ * that it can be freed by the caller as the i_ceph_lock is likely to be
+ * held.
 */
-void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci)
 {
        struct rb_node *p;
        struct ceph_inode_xattr *xattr = NULL;
+        struct ceph_buffer *old_blob = NULL;
        void *dest;
        dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
@@ -790,12 +793,14 @@ void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
                        dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
                if (ci->i_xattrs.blob)
-                        ceph_buffer_put(ci->i_xattrs.blob);
+                        old_blob = ci->i_xattrs.blob;
                ci->i_xattrs.blob = ci->i_xattrs.prealloc_blob;
                ci->i_xattrs.prealloc_blob = NULL;
                ci->i_xattrs.dirty = false;
                ci->i_xattrs.version++;
        }
+        return old_blob;
 }
 static inline int __get_request_mask(struct inode *in) {
@@ -1036,6 +1041,7 @@ int __ceph_setxattr(struct inode *inode, const char *name,
        struct ceph_inode_info *ci = ceph_inode(inode);
        struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
        struct ceph_cap_flush *prealloc_cf = NULL;
+        struct ceph_buffer *old_blob = NULL;
        int issued;
        int err;
        int dirty = 0;
@@ -1109,13 +1115,15 @@ retry:
                struct ceph_buffer *blob;
                spin_unlock(&ci->i_ceph_lock);
-                dout(" preaallocating new blob size=%d\n", required_blob_size);
+                ceph_buffer_put(old_blob); /* Shouldn't be required */
+                dout(" pre-allocating new blob size=%d\n", required_blob_size);
                blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
                if (!blob)
                        goto do_sync_unlocked;
                spin_lock(&ci->i_ceph_lock);
+                /* prealloc_blob can't be released while holding i_ceph_lock */
                if (ci->i_xattrs.prealloc_blob)
-                        ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+                        old_blob = ci->i_xattrs.prealloc_blob;
                ci->i_xattrs.prealloc_blob = blob;
                goto retry;
        }
@@ -1131,6 +1139,7 @@ retry:
        }
        spin_unlock(&ci->i_ceph_lock);
+        ceph_buffer_put(old_blob);
        if (lock_snap_rwsem)
                up_read(&mdsc->snap_rwsem);
        if (dirty)
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 4b21a90015a9..99caf77df4a2 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -152,5 +152,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "2.21"
+#define CIFS_VERSION   "2.22"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index e23234207fc2..592a6cea2b79 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -579,6 +579,7 @@ extern void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page,
                                unsigned int *len, unsigned int *offset);
 void extract_unc_hostname(const char *unc, const char **h, size_t *len);
+int copy_path_name(char *dst, const char *src);
 #ifdef CONFIG_CIFS_DFS_UPCALL
 static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index e2f95965065d..3907653e63c7 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -942,10 +942,8 @@ PsxDelete:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else { /* BB add path length overrun check */
+        } else {
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fileName, name_len);
        }
        params = 6 + name_len;
@@ -1015,10 +1013,8 @@ DelFileRetry:
                                              remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {                /* BB improve check for buffer overruns BB */
+        } else {
-                name_len = strnlen(name, PATH_MAX);
+                name_len = copy_path_name(pSMB->fileName, name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->fileName, name, name_len);
        }
        pSMB->SearchAttributes =
            cpu_to_le16(ATTR_READONLY | ATTR_HIDDEN | ATTR_SYSTEM);
@@ -1062,10 +1058,8 @@ RmDirRetry:
                                              remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {                /* BB improve check for buffer overruns BB */
+        } else {
-                name_len = strnlen(name, PATH_MAX);
+                name_len = copy_path_name(pSMB->DirName, name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->DirName, name, name_len);
        }
        pSMB->BufferFormat = 0x04;
@@ -1107,10 +1101,8 @@ MkDirRetry:
                                              remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {                /* BB improve check for buffer overruns BB */
+        } else {
-                name_len = strnlen(name, PATH_MAX);
+                name_len = copy_path_name(pSMB->DirName, name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->DirName, name, name_len);
        }
        pSMB->BufferFormat = 0x04;
@@ -1157,10 +1149,8 @@ PsxCreat:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, name, name_len);
        }
        params = 6 + name_len;
@@ -1324,11 +1314,9 @@ OldOpenRetry:
                                      fileName, PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {                /* BB improve check for buffer overruns BB */
+        } else {
                count = 0;      /* no pad */
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->fileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->fileName, fileName, name_len);
        }
        if (*pOplock & REQ_OPLOCK)
                pSMB->OpenFlags = cpu_to_le16(REQ_OPLOCK);
@@ -1442,11 +1430,8 @@ openRetry:
                /* BB improve check for buffer overruns BB */
                /* no pad */
                count = 0;
-                name_len = strnlen(path, PATH_MAX);
+                name_len = copy_path_name(req->fileName, path);
-                /* trailing null */
-                name_len++;
                req->NameLength = cpu_to_le16(name_len);
-                strncpy(req->fileName, path, name_len);
        }
        if (*oplock & REQ_OPLOCK)
@@ -2812,15 +2797,10 @@ renameRetry:
                                       remap);
                name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                name_len2 *= 2; /* convert to bytes */
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(from_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->OldFileName, from_name);
-                name_len++;     /* trailing null */
+                name_len2 = copy_path_name(pSMB->OldFileName+name_len+1, to_name);
-                strncpy(pSMB->OldFileName, from_name, name_len);
-                name_len2 = strnlen(to_name, PATH_MAX);
-                name_len2++;    /* trailing null */
                pSMB->OldFileName[name_len] = 0x04;  /* 2nd buffer format */
-                strncpy(&pSMB->OldFileName[name_len + 1], to_name, name_len2);
-                name_len2++;    /* trailing null */
                name_len2++;    /* signature byte */
        }
@@ -2962,15 +2942,10 @@ copyRetry:
                                       toName, PATH_MAX, nls_codepage, remap);
                name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                name_len2 *= 2; /* convert to bytes */
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fromName, PATH_MAX);
+                name_len = copy_path_name(pSMB->OldFileName, fromName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->OldFileName, fromName, name_len);
-                name_len2 = strnlen(toName, PATH_MAX);
-                name_len2++;    /* trailing null */
                pSMB->OldFileName[name_len] = 0x04;  /* 2nd buffer format */
-                strncpy(&pSMB->OldFileName[name_len + 1], toName, name_len2);
+                name_len2 = copy_path_name(pSMB->OldFileName+name_len+1, toName);
-                name_len2++;    /* trailing null */
                name_len2++;    /* signature byte */
        }
@@ -3021,10 +2996,8 @@ createSymLinkRetry:
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fromName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, fromName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fromName, name_len);
        }
        params = 6 + name_len;
        pSMB->MaxSetupCount = 0;
@@ -3044,10 +3017,8 @@ createSymLinkRetry:
                                        PATH_MAX, nls_codepage, remap);
                name_len_target++;      /* trailing null */
                name_len_target *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len_target = strnlen(toName, PATH_MAX);
+                name_len_target = copy_path_name(data_offset, toName);
-                name_len_target++;      /* trailing null */
-                strncpy(data_offset, toName, name_len_target);
        }
        pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -3109,10 +3080,8 @@ createHardLinkRetry:
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(toName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, toName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, toName, name_len);
        }
        params = 6 + name_len;
        pSMB->MaxSetupCount = 0;
@@ -3131,10 +3100,8 @@ createHardLinkRetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len_target++;      /* trailing null */
                name_len_target *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len_target = strnlen(fromName, PATH_MAX);
+                name_len_target = copy_path_name(data_offset, fromName);
-                name_len_target++;      /* trailing null */
-                strncpy(data_offset, fromName, name_len_target);
        }
        pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -3213,15 +3180,10 @@ winCreateHardLinkRetry:
                                       remap);
                name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                name_len2 *= 2; /* convert to bytes */
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(from_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->OldFileName, from_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->OldFileName, from_name, name_len);
-                name_len2 = strnlen(to_name, PATH_MAX);
-                name_len2++;    /* trailing null */
                pSMB->OldFileName[name_len] = 0x04;     /* 2nd buffer format */
-                strncpy(&pSMB->OldFileName[name_len + 1], to_name, name_len2);
+                name_len2 = copy_path_name(pSMB->OldFileName+name_len+1, to_name);
-                name_len2++;    /* trailing null */
                name_len2++;    /* signature byte */
        }
@@ -3271,10 +3233,8 @@ querySymLinkRetry:
                                           remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(searchName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, searchName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
        }
        params = 2 /* level */  + 4 /* rsrvd */  + name_len /* incl null */ ;
@@ -3691,10 +3651,8 @@ queryAclRetry:
                name_len *= 2;
                pSMB->FileName[name_len] = 0;
                pSMB->FileName[name_len+1] = 0;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(searchName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, searchName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
        }
        params = 2 /* level */  + 4 /* rsrvd */  + name_len /* incl null */ ;
@@ -3776,10 +3734,8 @@ setAclRetry:
                                           PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fileName, name_len);
        }
        params = 6 + name_len;
        pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -4184,9 +4140,7 @@ QInfRetry:
                name_len++;     /* trailing null */
                name_len *= 2;
        } else {
-                name_len = strnlen(search_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, search_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, search_name, name_len);
        }
        pSMB->BufferFormat = 0x04;
        name_len++; /* account for buffer type byte */
@@ -4321,10 +4275,8 @@ QPathInfoRetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(search_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, search_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, search_name, name_len);
        }
        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
@@ -4490,10 +4442,8 @@ UnixQPathInfoRetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(searchName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, searchName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
        }
        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
@@ -4593,17 +4543,16 @@ findFirstRetry:
                        pSMB->FileName[name_len+1] = 0;
                        name_len += 2;
                }
-        } else {        /* BB add check for overrun of SMB buf BB */
+        } else {
-                name_len = strnlen(searchName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, searchName);
-/* BB fix here and in unicode clause above ie
-                if (name_len > buffersize-header)
-                        free buffer exit; BB */
-                strncpy(pSMB->FileName, searchName, name_len);
                if (msearch) {
-                        pSMB->FileName[name_len] = CIFS_DIR_SEP(cifs_sb);
+                        if (WARN_ON_ONCE(name_len > PATH_MAX-2))
-                        pSMB->FileName[name_len+1] = '*';
+                                name_len = PATH_MAX-2;
-                        pSMB->FileName[name_len+2] = 0;
+                        /* overwrite nul byte */
-                        name_len += 3;
+                        pSMB->FileName[name_len-1] = CIFS_DIR_SEP(cifs_sb);
+                        pSMB->FileName[name_len] = '*';
+                        pSMB->FileName[name_len+1] = 0;
+                        name_len += 2;
                }
        }
@@ -4898,10 +4847,8 @@ GetInodeNumberRetry:
                                           remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(search_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, search_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, search_name, name_len);
        }
        params = 2 /* level */  + 4 /* rsrvd */  + name_len /* incl null */ ;
@@ -5008,9 +4955,7 @@ getDFSRetry:
                name_len++;     /* trailing null */
                name_len *= 2;
        } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(search_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->RequestFileName, search_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->RequestFileName, search_name, name_len);
        }
        if (ses->server->sign)
@@ -5663,10 +5608,8 @@ SetEOFRetry:
                                       PATH_MAX, cifs_sb->local_nls, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(file_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, file_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, file_name, name_len);
        }
        params = 6 + name_len;
        data_count = sizeof(struct file_end_of_file_info);
@@ -5959,10 +5902,8 @@ SetTimesRetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fileName, name_len);
        }
        params = 6 + name_len;
@@ -6040,10 +5981,8 @@ SetAttrLgcyRetry:
                                       PATH_MAX, nls_codepage);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->fileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->fileName, fileName, name_len);
        }
        pSMB->attr = cpu_to_le16(dos_attrs);
        pSMB->BufferFormat = 0x04;
@@ -6203,10 +6142,8 @@ setPermsRetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(file_name, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, file_name);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, file_name, name_len);
        }
        params = 6 + name_len;
@@ -6298,10 +6235,8 @@ QAllEAsRetry:
                                       PATH_MAX, nls_codepage, remap);
                list_len++;     /* trailing null */
                list_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                list_len = strnlen(searchName, PATH_MAX);
+                list_len = copy_path_name(pSMB->FileName, searchName);
-                list_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, list_len);
        }
        params = 2 /* level */ + 4 /* reserved */ + list_len /* includes NUL */;
@@ -6480,10 +6415,8 @@ SetEARetry:
                                       PATH_MAX, nls_codepage, remap);
                name_len++;     /* trailing null */
                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
+        } else {
-                name_len = strnlen(fileName, PATH_MAX);
+                name_len = copy_path_name(pSMB->FileName, fileName);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, fileName, name_len);
        }
        params = 6 + name_len;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index a15a6e738eb5..5299effa6f7d 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1113,7 +1113,7 @@ cifs_demultiplex_thread(void *p)
                mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
        set_freezable();
-        allow_signal(SIGKILL);
+        allow_kernel_signal(SIGKILL);
        while (server->tcpStatus != CifsExiting) {
                if (try_to_freeze())
                        continue;
@@ -2981,6 +2981,7 @@ static int
 cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
 {
        int rc = 0;
+        int is_domain = 0;
        const char *delim, *payload;
        char *desc;
        ssize_t len;
@@ -3028,6 +3029,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
                        rc = PTR_ERR(key);
                        goto out_err;
                }
+                is_domain = 1;
        }
        down_read(&key->sem);
@@ -3085,6 +3087,26 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
                goto out_key_put;
        }
+        /*
+         * If we have a domain key then we must set the domainName in the
+         * for the request.
+         */
+        if (is_domain && ses->domainName) {
+                vol->domainname = kstrndup(ses->domainName,
+                                           strlen(ses->domainName),
+                                           GFP_KERNEL);
+                if (!vol->domainname) {
+                        cifs_dbg(FYI, "Unable to allocate %zd bytes for "
+                                 "domain\n", len);
+                        rc = -ENOMEM;
+                        kfree(vol->username);
+                        vol->username = NULL;
+                        kzfree(vol->password);
+                        vol->password = NULL;
+                        goto out_key_put;
+                }
+        }
 out_key_put:
        up_read(&key->sem);
        key_put(key);
@@ -4209,16 +4231,19 @@ build_unc_path_to_root(const struct smb_vol *vol,
                strlen(vol->prepath) + 1 : 0;
        unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
+        if (unc_len > MAX_TREE_SIZE)
+                return ERR_PTR(-EINVAL);
        full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
        if (full_path == NULL)
                return ERR_PTR(-ENOMEM);
-        strncpy(full_path, vol->UNC, unc_len);
+        memcpy(full_path, vol->UNC, unc_len);
        pos = full_path + unc_len;
        if (pplen) {
                *pos = CIFS_DIR_SEP(cifs_sb);
-                strncpy(pos + 1, vol->prepath, pplen);
+                memcpy(pos + 1, vol->prepath, pplen);
                pos += pplen;
        }
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index f26a48dd2e39..be424e81e3ad 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -69,11 +69,10 @@ cifs_build_path_to_root(struct smb_vol *vol, struct cifs_sb_info *cifs_sb,
                return full_path;
        if (dfsplen)
-                strncpy(full_path, tcon->treeName, dfsplen);
+                memcpy(full_path, tcon->treeName, dfsplen);
        full_path[dfsplen] = CIFS_DIR_SEP(cifs_sb);
-        strncpy(full_path + dfsplen + 1, vol->prepath, pplen);
+        memcpy(full_path + dfsplen + 1, vol->prepath, pplen);
        convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
-        full_path[dfsplen + pplen] = 0; /* add trailing null */
        return full_path;
 }
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index f383877a6511..5ad83bdb9bea 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -1011,3 +1011,25 @@ void extract_unc_hostname(const char *unc, const char **h, size_t *len)
        *h = unc;
        *len = end - unc;
 }
+/**
+ * copy_path_name - copy src path to dst, possibly truncating
+ *
+ * returns number of bytes written (including trailing nul)
+ */
+int copy_path_name(char *dst, const char *src)
+{
+        int name_len;
+        /*
+         * PATH_MAX includes nul, so if strlen(src) >= PATH_MAX it
+         * will truncate and strlen(dst) will be PATH_MAX-1
+         */
+        name_len = strscpy(dst, src, PATH_MAX);
+        if (WARN_ON_ONCE(name_len < 0))
+                name_len = PATH_MAX-1;
+        /* we count the trailing nul */
+        name_len++;
+        return name_len;
+}
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index dcd49ad60c83..4c764ff7edd2 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -159,13 +159,16 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
                                 const struct nls_table *nls_cp)
 {
        char *bcc_ptr = *pbcc_area;
+        int len;
        /* copy user */
        /* BB what about null user mounts - check that we do this BB */
        /* copy user */
        if (ses->user_name != NULL) {
-                strncpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
+                len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
-                bcc_ptr += strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
+                if (WARN_ON_ONCE(len < 0))
+                        len = CIFS_MAX_USERNAME_LEN - 1;
+                bcc_ptr += len;
        }
        /* else null user mount */
        *bcc_ptr = 0;
@@ -173,8 +176,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
        /* copy domain */
        if (ses->domainName != NULL) {
-                strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+                len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
-                bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+                if (WARN_ON_ONCE(len < 0))
+                        len = CIFS_MAX_DOMAINNAME_LEN - 1;
+                bcc_ptr += len;
        } /* else we will send a null domain name
             so the server will default to its own domain */
        *bcc_ptr = 0;
@@ -242,9 +247,10 @@ static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
        kfree(ses->serverOS);
-        ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
+        ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
        if (ses->serverOS) {
-                strncpy(ses->serverOS, bcc_ptr, len);
+                memcpy(ses->serverOS, bcc_ptr, len);
+                ses->serverOS[len] = 0;
                if (strncmp(ses->serverOS, "OS/2", 4) == 0)
                        cifs_dbg(FYI, "OS/2 server\n");
        }
@@ -258,9 +264,11 @@ static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
        kfree(ses->serverNOS);
-        ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
+        ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
-        if (ses->serverNOS)
+        if (ses->serverNOS) {
-                strncpy(ses->serverNOS, bcc_ptr, len);
+                memcpy(ses->serverNOS, bcc_ptr, len);
+                ses->serverNOS[len] = 0;
+        }
        bcc_ptr += len + 1;
        bleft -= len + 1;
diff --git a/fs/io_uring.c b/fs/io_uring.c
index d542f1cf4428..cfb48bd088e1 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -679,6 +679,13 @@ static void io_put_req(struct io_kiocb *req)
                io_free_req(req);
 }
+static unsigned io_cqring_events(struct io_cq_ring *ring)
+{
+        /* See comment at the top of this file */
+        smp_rmb();
+        return READ_ONCE(ring->r.tail) - READ_ONCE(ring->r.head);
+}
 /*
 * Find and free completed poll iocbs
 */
@@ -771,7 +778,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 static int io_iopoll_getevents(struct io_ring_ctx *ctx, unsigned int *nr_events,
                                long min)
 {
-        while (!list_empty(&ctx->poll_list)) {
+        while (!list_empty(&ctx->poll_list) && !need_resched()) {
                int ret;
                ret = io_do_iopoll(ctx, nr_events, min);
@@ -798,6 +805,12 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
                unsigned int nr_events = 0;
                io_iopoll_getevents(ctx, &nr_events, 1);
+                /*
+                 * Ensure we allow local-to-the-cpu processing to take place,
+                 * in this case we need to ensure that we reap all events.
+                 */
+                cond_resched();
        }
        mutex_unlock(&ctx->uring_lock);
 }
@@ -805,11 +818,42 @@ static void io_iopoll_reap_events(struct io_ring_ctx *ctx)
 static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
                           long min)
 {
-        int ret = 0;
+        int iters, ret = 0;
+        /*
+         * We disallow the app entering submit/complete with polling, but we
+         * still need to lock the ring to prevent racing with polled issue
+         * that got punted to a workqueue.
+         */
+        mutex_lock(&ctx->uring_lock);
+        iters = 0;
        do {
                int tmin = 0;
+                /*
+                 * Don't enter poll loop if we already have events pending.
+                 * If we do, we can potentially be spinning for commands that
+                 * already triggered a CQE (eg in error).
+                 */
+                if (io_cqring_events(ctx->cq_ring))
+                        break;
+                /*
+                 * If a submit got punted to a workqueue, we can have the
+                 * application entering polling for a command before it gets
+                 * issued. That app will hold the uring_lock for the duration
+                 * of the poll right here, so we need to take a breather every
+                 * now and then to ensure that the issue has a chance to add
+                 * the poll to the issued list. Otherwise we can spin here
+                 * forever, while the workqueue is stuck trying to acquire the
+                 * very same mutex.
+                 */
+                if (!(++iters & 7)) {
+                        mutex_unlock(&ctx->uring_lock);
+                        mutex_lock(&ctx->uring_lock);
+                }
                if (*nr_events < min)
                        tmin = min - *nr_events;
@@ -819,6 +863,7 @@ static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
                ret = 0;
        } while (min && !*nr_events && !need_resched());
+        mutex_unlock(&ctx->uring_lock);
        return ret;
 }
@@ -1097,10 +1142,8 @@ static int io_import_fixed(struct io_ring_ctx *ctx, int rw,
                        iter->bvec = bvec + seg_skip;
                        iter->nr_segs -= seg_skip;
-                        iter->count -= (seg_skip << PAGE_SHIFT);
+                        iter->count -= bvec->bv_len + offset;
                        iter->iov_offset = offset & ~PAGE_MASK;
-                        if (iter->iov_offset)
-                                iter->count -= iter->iov_offset;
                }
        }
@@ -2025,6 +2068,15 @@ static int io_queue_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,
 {
        int ret;
+        ret = io_req_defer(ctx, req, s->sqe);
+        if (ret) {
+                if (ret != -EIOCBQUEUED) {
+                        io_free_req(req);
+                        io_cqring_add_event(ctx, s->sqe->user_data, ret);
+                }
+                return 0;
+        }
        ret = __io_submit_sqe(ctx, req, s, true);
        if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
                struct io_uring_sqe *sqe_copy;
@@ -2097,13 +2149,6 @@ err:
                return;
        }
-        ret = io_req_defer(ctx, req, s->sqe);
-        if (ret) {
-                if (ret != -EIOCBQUEUED)
-                        goto err_req;
-                return;
-        }
        /*
         * If we already have a head request, queue this one for async
         * submittal once the head completes. If we don't have a head but
@@ -2280,15 +2325,7 @@ static int io_sq_thread(void *data)
                        unsigned nr_events = 0;
                        if (ctx->flags & IORING_SETUP_IOPOLL) {
-                                /*
-                                 * We disallow the app entering submit/complete
-                                 * with polling, but we still need to lock the
-                                 * ring to prevent racing with polled issue
-                                 * that got punted to a workqueue.
-                                 */
-                                mutex_lock(&ctx->uring_lock);
                                io_iopoll_check(ctx, &nr_events, 0);
-                                mutex_unlock(&ctx->uring_lock);
                        } else {
                                /*
                                 * Normal IO, just pretend everything completed.
@@ -2433,13 +2470,6 @@ static int io_ring_submit(struct io_ring_ctx *ctx, unsigned int to_submit)
        return submit;
 }
-static unsigned io_cqring_events(struct io_cq_ring *ring)
-{
-        /* See comment at the top of this file */
-        smp_rmb();
-        return READ_ONCE(ring->r.tail) - READ_ONCE(ring->r.head);
-}
 /*
 * Wait until events become available, if we don't already have some. The
 * application must reap them itself, as they reside on the shared cq ring.
@@ -3190,9 +3220,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
                min_complete = min(min_complete, ctx->cq_entries);
                if (ctx->flags & IORING_SETUP_IOPOLL) {
-                        mutex_lock(&ctx->uring_lock);
                        ret = io_iopoll_check(ctx, &nr_events, min_complete);
-                        mutex_unlock(&ctx->uring_lock);
                } else {
                        ret = io_cqring_wait(ctx, min_complete, sig, sigsz);
                }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 8d501093660f..0adfd8840110 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1487,7 +1487,7 @@ static int nfs_finish_open(struct nfs_open_context *ctx,
        if (S_ISREG(file->f_path.dentry->d_inode->i_mode))
                nfs_file_set_open_context(file, ctx);
        else
-                err = -ESTALE;
+                err = -EOPENSTALE;
 out:
        return err;
 }
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 0cb442406168..222d7115db71 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -401,15 +401,21 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
        unsigned long bytes = 0;
        struct nfs_direct_req *dreq = hdr->dreq;
-        if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
-                goto out_put;
        spin_lock(&dreq->lock);
-        if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) && (hdr->good_bytes == 0))
+        if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
                dreq->error = hdr->error;
-        else
+        if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+                spin_unlock(&dreq->lock);
+                goto out_put;
+        }
+        if (hdr->good_bytes != 0)
                nfs_direct_good_bytes(dreq, hdr);
+        if (test_bit(NFS_IOHDR_EOF, &hdr->flags))
+                dreq->error = 0;
        spin_unlock(&dreq->lock);
        while (!list_empty(&hdr->pages)) {
@@ -782,16 +788,19 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
        bool request_commit = false;
        struct nfs_page *req = nfs_list_entry(hdr->pages.next);
-        if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
-                goto out_put;
        nfs_init_cinfo_from_dreq(&cinfo, dreq);
        spin_lock(&dreq->lock);
        if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
                dreq->error = hdr->error;
-        if (dreq->error == 0) {
+        if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+                spin_unlock(&dreq->lock);
+                goto out_put;
+        }
+        if (hdr->good_bytes != 0) {
                nfs_direct_good_bytes(dreq, hdr);
                if (nfs_write_need_commit(hdr)) {
                        if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index b04e20d28162..5657b7f2611f 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -8,6 +8,7 @@
 */
 #include <linux/nfs_fs.h>
+#include <linux/nfs_mount.h>
 #include <linux/nfs_page.h>
 #include <linux/module.h>
 #include <linux/sched/mm.h>
@@ -928,7 +929,9 @@ retry:
        pgm = &pgio->pg_mirrors[0];
        pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize;
-        pgio->pg_maxretrans = io_maxretrans;
+        if (NFS_SERVER(pgio->pg_inode)->flags &
+                        (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
+                pgio->pg_maxretrans = io_maxretrans;
        return;
 out_nolseg:
        if (pgio->pg_error < 0)
@@ -940,6 +943,7 @@ out_mds:
                        pgio->pg_lseg);
        pnfs_put_lseg(pgio->pg_lseg);
        pgio->pg_lseg = NULL;
+        pgio->pg_maxretrans = 0;
        nfs_pageio_reset_read_mds(pgio);
 }
@@ -1000,7 +1004,9 @@ retry:
                pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].wsize;
        }
-        pgio->pg_maxretrans = io_maxretrans;
+        if (NFS_SERVER(pgio->pg_inode)->flags &
+                        (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
+                pgio->pg_maxretrans = io_maxretrans;
        return;
 out_mds:
@@ -1010,6 +1016,7 @@ out_mds:
                        pgio->pg_lseg);
        pnfs_put_lseg(pgio->pg_lseg);
        pgio->pg_lseg = NULL;
+        pgio->pg_maxretrans = 0;
        nfs_pageio_reset_write_mds(pgio);
 }
@@ -1148,8 +1155,6 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task,
                break;
        case -NFS4ERR_RETRY_UNCACHED_REP:
                break;
-        case -EAGAIN:
-                return -NFS4ERR_RESET_TO_PNFS;
        /* Invalidate Layout errors */
        case -NFS4ERR_PNFS_NO_LAYOUT:
        case -ESTALE:           /* mapped NFS4ERR_STALE */
@@ -1210,7 +1215,6 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task,
        case -EBADHANDLE:
        case -ELOOP:
        case -ENOSPC:
-        case -EAGAIN:
                break;
        case -EJUKEBOX:
                nfs_inc_stats(lseg->pls_layout->plh_inode, NFSIOS_DELAY);
@@ -1445,16 +1449,6 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data)
        ff_layout_read_prepare_common(task, hdr);
 }
-static void
-ff_layout_io_prepare_transmit(struct rpc_task *task,
-                void *data)
-{
-        struct nfs_pgio_header *hdr = data;
-        if (!pnfs_is_valid_lseg(hdr->lseg))
-                rpc_exit(task, -EAGAIN);
-}
 static void ff_layout_read_call_done(struct rpc_task *task, void *data)
 {
        struct nfs_pgio_header *hdr = data;
@@ -1740,7 +1734,6 @@ static void ff_layout_commit_release(void *data)
 static const struct rpc_call_ops ff_layout_read_call_ops_v3 = {
        .rpc_call_prepare = ff_layout_read_prepare_v3,
-        .rpc_call_prepare_transmit = ff_layout_io_prepare_transmit,
        .rpc_call_done = ff_layout_read_call_done,
        .rpc_count_stats = ff_layout_read_count_stats,
        .rpc_release = ff_layout_read_release,
@@ -1748,7 +1741,6 @@ static const struct rpc_call_ops ff_layout_read_call_ops_v3 = {
 static const struct rpc_call_ops ff_layout_read_call_ops_v4 = {
        .rpc_call_prepare = ff_layout_read_prepare_v4,
-        .rpc_call_prepare_transmit = ff_layout_io_prepare_transmit,
        .rpc_call_done = ff_layout_read_call_done,
        .rpc_count_stats = ff_layout_read_count_stats,
        .rpc_release = ff_layout_read_release,
@@ -1756,7 +1748,6 @@ static const struct rpc_call_ops ff_layout_read_call_ops_v4 = {
 static const struct rpc_call_ops ff_layout_write_call_ops_v3 = {
        .rpc_call_prepare = ff_layout_write_prepare_v3,
-        .rpc_call_prepare_transmit = ff_layout_io_prepare_transmit,
        .rpc_call_done = ff_layout_write_call_done,
        .rpc_count_stats = ff_layout_write_count_stats,
        .rpc_release = ff_layout_write_release,
@@ -1764,7 +1755,6 @@ static const struct rpc_call_ops ff_layout_write_call_ops_v3 = {
 static const struct rpc_call_ops ff_layout_write_call_ops_v4 = {
        .rpc_call_prepare = ff_layout_write_prepare_v4,
-        .rpc_call_prepare_transmit = ff_layout_io_prepare_transmit,
        .rpc_call_done = ff_layout_write_call_done,
        .rpc_count_stats = ff_layout_write_count_stats,
        .rpc_release = ff_layout_write_release,
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 8a1758200b57..c764cfe456e5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1403,12 +1403,21 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
        if (NFS_PROTO(inode)->have_delegation(inode, FMODE_READ))
                return 0;
+        /* No fileid? Just exit */
+        if (!(fattr->valid & NFS_ATTR_FATTR_FILEID))
+                return 0;
        /* Has the inode gone and changed behind our back? */
-        if ((fattr->valid & NFS_ATTR_FATTR_FILEID) && nfsi->fileid != fattr->fileid)
+        if (nfsi->fileid != fattr->fileid) {
+                /* Is this perhaps the mounted-on fileid? */
+                if ((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) &&
+                    nfsi->fileid == fattr->mounted_on_fileid)
+                        return 0;
                return -ESTALE;
+        }
        if ((fattr->valid & NFS_ATTR_FATTR_TYPE) && (inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT))
                return -ESTALE;
        if (!nfs_file_has_buffered_writers(nfsi)) {
                /* Verify a few of the more important attributes */
                if ((fattr->valid & NFS_ATTR_FATTR_CHANGE) != 0 && !inode_eq_iversion_raw(inode, fattr->change_attr))
@@ -1768,18 +1777,6 @@ int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fa
 EXPORT_SYMBOL_GPL(nfs_post_op_update_inode_force_wcc);
-static inline bool nfs_fileid_valid(struct nfs_inode *nfsi,
-                                    struct nfs_fattr *fattr)
-{
-        bool ret1 = true, ret2 = true;
-        if (fattr->valid & NFS_ATTR_FATTR_FILEID)
-                ret1 = (nfsi->fileid == fattr->fileid);
-        if (fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID)
-                ret2 = (nfsi->fileid == fattr->mounted_on_fileid);
-        return ret1 || ret2;
-}
 /*
 * Many nfs protocol calls return the new file attributes after
 * an operation.  Here we update the inode to reflect the state
@@ -1810,7 +1807,15 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                        nfs_display_fhandle_hash(NFS_FH(inode)),
                        atomic_read(&inode->i_count), fattr->valid);
-        if (!nfs_fileid_valid(nfsi, fattr)) {
+        /* No fileid? Just exit */
+        if (!(fattr->valid & NFS_ATTR_FATTR_FILEID))
+                return 0;
+        /* Has the inode gone and changed behind our back? */
+        if (nfsi->fileid != fattr->fileid) {
+                /* Is this perhaps the mounted-on fileid? */
+                if ((fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID) &&
+                    nfsi->fileid == fattr->mounted_on_fileid)
+                        return 0;
                printk(KERN_ERR "NFS: server %s error: fileid changed\n"
                        "fsid %s: expected fileid 0x%Lx, got 0x%Lx\n",
                        NFS_SERVER(inode)->nfs_client->cl_hostname,
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index a2346a2f8361..e64f810223be 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -775,3 +775,13 @@ static inline bool nfs_error_is_fatal(int err)
        }
 }
+static inline bool nfs_error_is_fatal_on_server(int err)
+{
+        switch (err) {
+        case 0:
+        case -ERESTARTSYS:
+        case -EINTR:
+                return false;
+        }
+        return nfs_error_is_fatal(err);
+}
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 96db471ca2e5..339663d04bf8 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -73,13 +73,13 @@ nfs4_file_open(struct inode *inode, struct file *filp)
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                switch (err) {
-                case -EPERM:
-                case -EACCES:
-                case -EDQUOT:
-                case -ENOSPC:
-                case -EROFS:
-                        goto out_put_ctx;
                default:
+                        goto out_put_ctx;
+                case -ENOENT:
+                case -ESTALE:
+                case -EISDIR:
+                case -ENOTDIR:
+                case -ELOOP:
                        goto out_drop;
                }
        }
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index ed4e1b07447b..20b3717cd7ca 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -590,7 +590,7 @@ static void nfs_pgio_rpcsetup(struct nfs_pgio_header *hdr,
        }
        hdr->res.fattr   = &hdr->fattr;
-        hdr->res.count   = count;
+        hdr->res.count   = 0;
        hdr->res.eof     = 0;
        hdr->res.verf    = &hdr->verf;
        nfs_fattr_init(&hdr->fattr);
@@ -1251,20 +1251,23 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
 int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
                      struct nfs_pgio_header *hdr)
 {
-        LIST_HEAD(failed);
+        LIST_HEAD(pages);
        desc->pg_io_completion = hdr->io_completion;
        desc->pg_dreq = hdr->dreq;
-        while (!list_empty(&hdr->pages)) {
+        list_splice_init(&hdr->pages, &pages);
-                struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+        while (!list_empty(&pages)) {
+                struct nfs_page *req = nfs_list_entry(pages.next);
                if (!nfs_pageio_add_request(desc, req))
-                        nfs_list_move_request(req, &failed);
+                        break;
        }
        nfs_pageio_complete(desc);
-        if (!list_empty(&failed)) {
+        if (!list_empty(&pages)) {
-                list_move(&failed, &hdr->pages);
+                int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
-                return desc->pg_error < 0 ? desc->pg_error : -EIO;
+                hdr->completion_ops->error_cleanup(&pages, err);
+                nfs_set_pgio_error(hdr, err, hdr->io_start);
+                return err;
        }
        return 0;
 }
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index c0046c348910..82af4809b869 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -627,11 +627,16 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv,
                        /* Add this address as an alias */
                        rpc_clnt_add_xprt(clp->cl_rpcclient, &xprt_args,
                                        rpc_clnt_test_and_add_xprt, NULL);
-                } else
+                        continue;
-                        clp = get_v3_ds_connect(mds_srv,
+                }
-                                        (struct sockaddr *)&da->da_addr,
+                clp = get_v3_ds_connect(mds_srv,
-                                        da->da_addrlen, IPPROTO_TCP,
+                                (struct sockaddr *)&da->da_addr,
-                                        timeo, retrans);
+                                da->da_addrlen, IPPROTO_TCP,
+                                timeo, retrans);
+                if (IS_ERR(clp))
+                        continue;
+                clp->cl_rpcclient->cl_softerr = 0;
+                clp->cl_rpcclient->cl_softrtry = 0;
        }
        if (IS_ERR(clp)) {
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index 5552fa8b6e12..0f7288b94633 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -594,7 +594,8 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
                /* Emulate the eof flag, which isn't normally needed in NFSv2
                 * as it is guaranteed to always return the file attributes
                 */
-                if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
+                if ((hdr->res.count == 0 && hdr->args.count > 0) ||
+                    hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
                        hdr->res.eof = 1;
        }
        return 0;
@@ -615,8 +616,10 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task,
 static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
 {
-        if (task->tk_status >= 0)
+        if (task->tk_status >= 0) {
+                hdr->res.count = hdr->args.count;
                nfs_writeback_update_inode(hdr);
+        }
        return 0;
 }
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index c19841c82b6a..cfe0b586eadd 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -91,19 +91,25 @@ void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio)
 }
 EXPORT_SYMBOL_GPL(nfs_pageio_reset_read_mds);
-static void nfs_readpage_release(struct nfs_page *req)
+static void nfs_readpage_release(struct nfs_page *req, int error)
 {
        struct inode *inode = d_inode(nfs_req_openctx(req)->dentry);
+        struct page *page = req->wb_page;
        dprintk("NFS: read done (%s/%llu %d@%lld)\n", inode->i_sb->s_id,
                (unsigned long long)NFS_FILEID(inode), req->wb_bytes,
                (long long)req_offset(req));
+        if (nfs_error_is_fatal_on_server(error) && error != -ETIMEDOUT)
+                SetPageError(page);
        if (nfs_page_group_sync_on_bit(req, PG_UNLOCKPAGE)) {
-                if (PageUptodate(req->wb_page))
+                struct address_space *mapping = page_file_mapping(page);
-                        nfs_readpage_to_fscache(inode, req->wb_page, 0);
-                unlock_page(req->wb_page);
+                if (PageUptodate(page))
+                        nfs_readpage_to_fscache(inode, page, 0);
+                else if (!PageError(page) && !PagePrivate(page))
+                        generic_error_remove_page(mapping, page);
+                unlock_page(page);
        }
        nfs_release_request(req);
 }
@@ -131,7 +137,7 @@ int nfs_readpage_async(struct nfs_open_context *ctx, struct inode *inode,
                             &nfs_async_read_completion_ops);
        if (!nfs_pageio_add_request(&pgio, new)) {
                nfs_list_remove_request(new);
-                nfs_readpage_release(new);
+                nfs_readpage_release(new, pgio.pg_error);
        }
        nfs_pageio_complete(&pgio);
@@ -153,6 +159,7 @@ static void nfs_page_group_set_uptodate(struct nfs_page *req)
 static void nfs_read_completion(struct nfs_pgio_header *hdr)
 {
        unsigned long bytes = 0;
+        int error;
        if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
                goto out;
@@ -179,14 +186,19 @@ static void nfs_read_completion(struct nfs_pgio_header *hdr)
                                zero_user_segment(page, start, end);
                        }
                }
+                error = 0;
                bytes += req->wb_bytes;
                if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) {
                        if (bytes <= hdr->good_bytes)
                                nfs_page_group_set_uptodate(req);
+                        else {
+                                error = hdr->error;
+                                xchg(&nfs_req_openctx(req)->error, error);
+                        }
                } else
                        nfs_page_group_set_uptodate(req);
                nfs_list_remove_request(req);
-                nfs_readpage_release(req);
+                nfs_readpage_release(req, error);
        }
 out:
        hdr->release(hdr);
@@ -213,7 +225,7 @@ nfs_async_read_error(struct list_head *head, int error)
        while (!list_empty(head)) {
                req = nfs_list_entry(head->next);
                nfs_list_remove_request(req);
-                nfs_readpage_release(req);
+                nfs_readpage_release(req, error);
        }
 }
@@ -337,8 +349,13 @@ int nfs_readpage(struct file *file, struct page *page)
                        goto out;
        }
+        xchg(&ctx->error, 0);
        error = nfs_readpage_async(ctx, inode, page);
+        if (!error) {
+                error = wait_on_page_locked_killable(page);
+                if (!PageUptodate(page) && !error)
+                        error = xchg(&ctx->error, 0);
+        }
 out:
        put_nfs_open_context(ctx);
        return error;
@@ -372,8 +389,8 @@ readpage_async_filler(void *data, struct page *page)
                zero_user_segment(page, len, PAGE_SIZE);
        if (!nfs_pageio_add_request(desc->pgio, new)) {
                nfs_list_remove_request(new);
-                nfs_readpage_release(new);
                error = desc->pgio->pg_error;
+                nfs_readpage_release(new, error);
                goto out;
        }
        return 0;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 92d9cadc6102..85ca49549b39 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -57,6 +57,7 @@ static const struct rpc_call_ops nfs_commit_ops;
 static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops;
 static const struct nfs_commit_completion_ops nfs_commit_completion_ops;
 static const struct nfs_rw_ops nfs_rw_write_ops;
+static void nfs_inode_remove_request(struct nfs_page *req);
 static void nfs_clear_request_commit(struct nfs_page *req);
 static void nfs_init_cinfo_from_inode(struct nfs_commit_info *cinfo,
                                      struct inode *inode);
@@ -591,23 +592,13 @@ release_request:
 static void nfs_write_error(struct nfs_page *req, int error)
 {
+        nfs_set_pageerror(page_file_mapping(req->wb_page));
        nfs_mapping_set_error(req->wb_page, error);
+        nfs_inode_remove_request(req);
        nfs_end_page_writeback(req);
        nfs_release_request(req);
 }
-static bool
-nfs_error_is_fatal_on_server(int err)
-{
-        switch (err) {
-        case 0:
-        case -ERESTARTSYS:
-        case -EINTR:
-                return false;
-        }
-        return nfs_error_is_fatal(err);
-}
 /*
 * Find an associated nfs write request, and prepare to flush it out
 * May return an error if the user signalled nfs_wait_on_request().
@@ -615,7 +606,6 @@ nfs_error_is_fatal_on_server(int err)
 static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                                struct page *page)
 {
-        struct address_space *mapping;
        struct nfs_page *req;
        int ret = 0;
@@ -630,12 +620,11 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
        WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
        /* If there is a fatal error that covers this write, just exit */
-        ret = 0;
+        ret = pgio->pg_error;
-        mapping = page_file_mapping(page);
+        if (nfs_error_is_fatal_on_server(ret))
-        if (test_bit(AS_ENOSPC, &mapping->flags) ||
-            test_bit(AS_EIO, &mapping->flags))
                goto out_launder;
+        ret = 0;
        if (!nfs_pageio_add_request(pgio, req)) {
                ret = pgio->pg_error;
                /*
@@ -647,6 +636,7 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                } else
                        ret = -EAGAIN;
                nfs_redirty_request(req);
+                pgio->pg_error = 0;
        } else
                nfs_add_stats(page_file_mapping(page)->host,
                                NFSIOS_WRITEPAGES, 1);
@@ -666,7 +656,7 @@ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
        ret = nfs_page_async_flush(pgio, page);
        if (ret == -EAGAIN) {
                redirty_page_for_writepage(wbc, page);
-                ret = 0;
+                ret = AOP_WRITEPAGE_ACTIVATE;
        }
        return ret;
 }
@@ -685,10 +675,11 @@ static int nfs_writepage_locked(struct page *page,
        nfs_pageio_init_write(&pgio, inode, 0,
                                false, &nfs_async_write_completion_ops);
        err = nfs_do_writepage(page, wbc, &pgio);
+        pgio.pg_error = 0;
        nfs_pageio_complete(&pgio);
        if (err < 0)
                return err;
-        if (pgio.pg_error < 0)
+        if (nfs_error_is_fatal(pgio.pg_error))
                return pgio.pg_error;
        return 0;
 }
@@ -698,7 +689,8 @@ int nfs_writepage(struct page *page, struct writeback_control *wbc)
        int ret;
        ret = nfs_writepage_locked(page, wbc);
-        unlock_page(page);
+        if (ret != AOP_WRITEPAGE_ACTIVATE)
+                unlock_page(page);
        return ret;
 }
@@ -707,7 +699,8 @@ static int nfs_writepages_callback(struct page *page, struct writeback_control *
        int ret;
        ret = nfs_do_writepage(page, wbc, data);
-        unlock_page(page);
+        if (ret != AOP_WRITEPAGE_ACTIVATE)
+                unlock_page(page);
        return ret;
 }
@@ -733,13 +726,14 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
                                &nfs_async_write_completion_ops);
        pgio.pg_io_completion = ioc;
        err = write_cache_pages(mapping, wbc, nfs_writepages_callback, &pgio);
+        pgio.pg_error = 0;
        nfs_pageio_complete(&pgio);
        nfs_io_completion_put(ioc);
        if (err < 0)
                goto out_err;
        err = pgio.pg_error;
-        if (err < 0)
+        if (nfs_error_is_fatal(err))
                goto out_err;
        return 0;
 out_err:
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index 26ad75ae2be0..96352ab7bd81 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -571,7 +571,7 @@ nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)
 */
 static int nfsd_reply_cache_stats_show(struct seq_file *m, void *v)
 {
-        struct nfsd_net *nn = v;
+        struct nfsd_net *nn = m->private;
        seq_printf(m, "max entries:           %u\n", nn->max_drc_entries);
        seq_printf(m, "num entries:           %u\n",
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 13c548733860..3cf4f6aa48d6 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1171,13 +1171,17 @@ static struct inode *nfsd_get_inode(struct super_block *sb, umode_t mode)
        return inode;
 }
-static int __nfsd_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int __nfsd_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode, struct nfsdfs_client *ncl)
 {
        struct inode *inode;
        inode = nfsd_get_inode(dir->i_sb, mode);
        if (!inode)
                return -ENOMEM;
+        if (ncl) {
+                inode->i_private = ncl;
+                kref_get(&ncl->cl_ref);
+        }
        d_add(dentry, inode);
        inc_nlink(dir);
        fsnotify_mkdir(dir, dentry);
@@ -1194,17 +1198,14 @@ static struct dentry *nfsd_mkdir(struct dentry *parent, struct nfsdfs_client *nc
        dentry = d_alloc_name(parent, name);
        if (!dentry)
                goto out_err;
-        ret = __nfsd_mkdir(d_inode(parent), dentry, S_IFDIR | 0600);
+        ret = __nfsd_mkdir(d_inode(parent), dentry, S_IFDIR | 0600, ncl);
        if (ret)
                goto out_err;
-        if (ncl) {
-                d_inode(dentry)->i_private = ncl;
-                kref_get(&ncl->cl_ref);
-        }
 out:
        inode_unlock(dir);
        return dentry;
 out_err:
+        dput(dentry);
        dentry = ERR_PTR(ret);
        goto out;
 }
@@ -1214,11 +1215,9 @@ static void clear_ncl(struct inode *inode)
        struct nfsdfs_client *ncl = inode->i_private;
        inode->i_private = NULL;
-        synchronize_rcu();
        kref_put(&ncl->cl_ref, ncl->cl_release);
 }
 static struct nfsdfs_client *__get_nfsdfs_client(struct inode *inode)
 {
        struct nfsdfs_client *nc = inode->i_private;
@@ -1232,9 +1231,9 @@ struct nfsdfs_client *get_nfsdfs_client(struct inode *inode)
 {
        struct nfsdfs_client *nc;
-        rcu_read_lock();
+        inode_lock_shared(inode);
        nc = __get_nfsdfs_client(inode);
-        rcu_read_unlock();
+        inode_unlock_shared(inode);
        return nc;
 }
 /* from __rpc_unlink */
diff --git a/fs/read_write.c b/fs/read_write.c
index 1f5088dec566..5bbf587f5bc1 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1811,10 +1811,7 @@ static int generic_remap_check_len(struct inode *inode_in,
        return (remap_flags & REMAP_FILE_DEDUP) ? -EBADE : -EINVAL;
 }
-/*
+/* Read a page's worth of file data into the page cache. */
- * Read a page's worth of file data into the page cache.  Return the page
- * locked.
- */
 static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset)
 {
        struct page *page;
@@ -1826,11 +1823,33 @@ static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset)
                put_page(page);
                return ERR_PTR(-EIO);
        }
-        lock_page(page);
        return page;
 }
 /*
+ * Lock two pages, ensuring that we lock in offset order if the pages are from
+ * the same file.
+ */
+static void vfs_lock_two_pages(struct page *page1, struct page *page2)
+{
+        /* Always lock in order of increasing index. */
+        if (page1->index > page2->index)
+                swap(page1, page2);
+        lock_page(page1);
+        if (page1 != page2)
+                lock_page(page2);
+}
+/* Unlock two pages, being careful not to unlock the same page twice. */
+static void vfs_unlock_two_pages(struct page *page1, struct page *page2)
+{
+        unlock_page(page1);
+        if (page1 != page2)
+                unlock_page(page2);
+}
+/*
 * Compare extents of two files to see if they are the same.
 * Caller must have locked both inodes to prevent write races.
 */
@@ -1867,10 +1886,24 @@ static int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
                dest_page = vfs_dedupe_get_page(dest, destoff);
                if (IS_ERR(dest_page)) {
                        error = PTR_ERR(dest_page);
-                        unlock_page(src_page);
                        put_page(src_page);
                        goto out_error;
                }
+                vfs_lock_two_pages(src_page, dest_page);
+                /*
+                 * Now that we've locked both pages, make sure they're still
+                 * mapped to the file data we're interested in.  If not,
+                 * someone is invalidating pages on us and we lose.
+                 */
+                if (!PageUptodate(src_page) || !PageUptodate(dest_page) ||
+                    src_page->mapping != src->i_mapping ||
+                    dest_page->mapping != dest->i_mapping) {
+                        same = false;
+                        goto unlock;
+                }
                src_addr = kmap_atomic(src_page);
                dest_addr = kmap_atomic(dest_page);
@@ -1882,8 +1915,8 @@ static int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
                kunmap_atomic(dest_addr);
                kunmap_atomic(src_addr);
-                unlock_page(dest_page);
+unlock:
-                unlock_page(src_page);
+                vfs_unlock_two_pages(src_page, dest_page);
                put_page(dest_page);
                put_page(src_page);
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 04f09689cd6d..1600034a929b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -119,6 +119,7 @@ static int traverse(struct seq_file *m, loff_t offset)
                }
                if (seq_has_overflowed(m))
                        goto Eoverflow;
+                p = m->op->next(m, p, &m->index);
                if (pos + m->count > offset) {
                        m->from = offset - pos;
                        m->count -= m->from;
@@ -126,7 +127,6 @@ static int traverse(struct seq_file *m, loff_t offset)
                }
                pos += m->count;
                m->count = 0;
-                p = m->op->next(m, p, &m->index);
                if (pos == offset)
                        break;
        }
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 80d7301ab76d..c0b84e960b20 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -51,7 +51,7 @@
 static void shrink_liability(struct ubifs_info *c, int nr_to_write)
 {
        down_read(&c->vfs_sb->s_umount);
-        writeback_inodes_sb(c->vfs_sb, WB_REASON_FS_FREE_SPACE);
+        writeback_inodes_sb_nr(c->vfs_sb, nr_to_write, WB_REASON_FS_FREE_SPACE);
        up_read(&c->vfs_sb->s_umount);
 }
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index b52624e28fa1..3b4b4114f208 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -129,7 +129,6 @@ static void __orphan_drop(struct ubifs_info *c, struct ubifs_orphan *o)
 static void orphan_delete(struct ubifs_info *c, struct ubifs_orphan *orph)
 {
        if (orph->del) {
-                spin_unlock(&c->orphan_lock);
                dbg_gen("deleted twice ino %lu", orph->inum);
                return;
        }
@@ -138,7 +137,6 @@ static void orphan_delete(struct ubifs_info *c, struct ubifs_orphan *orph)
                orph->del = 1;
                orph->dnext = c->orph_dnext;
                c->orph_dnext = orph;
-                spin_unlock(&c->orphan_lock);
                dbg_gen("delete later ino %lu", orph->inum);
                return;
        }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 2c0803b0ac3a..8c1d571334bc 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -609,6 +609,10 @@ static int init_constants_early(struct ubifs_info *c)
        c->max_bu_buf_len = UBIFS_MAX_BULK_READ * UBIFS_MAX_DATA_NODE_SZ;
        if (c->max_bu_buf_len > c->leb_size)
                c->max_bu_buf_len = c->leb_size;
+        /* Log is ready, preserve one LEB for commits. */
+        c->min_log_bytes = c->leb_size;
        return 0;
 }
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ccbdbd62f0d8..fe6d804a38dc 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -880,6 +880,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
        /* len == 0 means wake all */
        struct userfaultfd_wake_range range = { .len = 0, };
        unsigned long new_flags;
+        bool still_valid;
        WRITE_ONCE(ctx->released, true);
@@ -895,8 +896,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
         * taking the mmap_sem for writing.
         */
        down_write(&mm->mmap_sem);
-        if (!mmget_still_valid(mm))
+        still_valid = mmget_still_valid(mm);
-                goto skip_mm;
        prev = NULL;
        for (vma = mm->mmap; vma; vma = vma->vm_next) {
                cond_resched();
@@ -907,19 +907,20 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
                        continue;
                }
                new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
-                prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+                if (still_valid) {
-                                 new_flags, vma->anon_vma,
+                        prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
-                                 vma->vm_file, vma->vm_pgoff,
+                                         new_flags, vma->anon_vma,
-                                 vma_policy(vma),
+                                         vma->vm_file, vma->vm_pgoff,
-                                 NULL_VM_UFFD_CTX);
+                                         vma_policy(vma),
-                if (prev)
+                                         NULL_VM_UFFD_CTX);
-                        vma = prev;
+                        if (prev)
-                else
+                                vma = prev;
-                        prev = vma;
+                        else
+                                prev = vma;
+                }
                vma->vm_flags = new_flags;
                vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
        }
-skip_mm:
        up_write(&mm->mmap_sem);
        mmput(mm);
 wakeup:
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index baf0b72c0a37..07aad70f3931 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -3835,15 +3835,28 @@ xfs_bmapi_read(
        XFS_STATS_INC(mp, xs_blk_mapr);
        ifp = XFS_IFORK_PTR(ip, whichfork);
+        if (!ifp) {
+                /* No CoW fork?  Return a hole. */
+                if (whichfork == XFS_COW_FORK) {
+                        mval->br_startoff = bno;
+                        mval->br_startblock = HOLESTARTBLOCK;
+                        mval->br_blockcount = len;
+                        mval->br_state = XFS_EXT_NORM;
+                        *nmap = 1;
+                        return 0;
+                }
-        /* No CoW fork?  Return a hole. */
+                /*
-        if (whichfork == XFS_COW_FORK && !ifp) {
+                 * A missing attr ifork implies that the inode says we're in
-                mval->br_startoff = bno;
+                 * extents or btree format but failed to pass the inode fork
-                mval->br_startblock = HOLESTARTBLOCK;
+                 * verifier while trying to load it.  Treat that as a file
-                mval->br_blockcount = len;
+                 * corruption too.
-                mval->br_state = XFS_EXT_NORM;
+                 */
-                *nmap = 1;
+#ifdef DEBUG
-                return 0;
+                xfs_alert(mp, "%s: inode %llu missing fork %d",
+                                __func__, ip->i_ino, whichfork);
+#endif /* DEBUG */
+                return -EFSCORRUPTED;
        }
        if (!(ifp->if_flags & XFS_IFEXTENTS)) {
diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index d1c77fd0815d..0bf56e94bfe9 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -487,10 +487,8 @@ xfs_da3_split(
        ASSERT(state->path.active == 0);
        oldblk = &state->path.blk[0];
        error = xfs_da3_root_split(state, oldblk, addblk);
-        if (error) {
+        if (error)
-                addblk->bp = NULL;
+                goto out;
-                return error;   /* GROT: dir is inconsistent */
-        }
        /*
         * Update pointers to the node which used to be block 0 and just got
@@ -505,7 +503,10 @@ xfs_da3_split(
         */
        node = oldblk->bp->b_addr;
        if (node->hdr.info.forw) {
-                ASSERT(be32_to_cpu(node->hdr.info.forw) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.forw) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                node = addblk->bp->b_addr;
                node->hdr.info.back = cpu_to_be32(oldblk->blkno);
                xfs_trans_log_buf(state->args->trans, addblk->bp,
@@ -514,15 +515,19 @@ xfs_da3_split(
        }
        node = oldblk->bp->b_addr;
        if (node->hdr.info.back) {
-                ASSERT(be32_to_cpu(node->hdr.info.back) == addblk->blkno);
+                if (be32_to_cpu(node->hdr.info.back) != addblk->blkno) {
+                        error = -EFSCORRUPTED;
+                        goto out;
+                }
                node = addblk->bp->b_addr;
                node->hdr.info.forw = cpu_to_be32(oldblk->blkno);
                xfs_trans_log_buf(state->args->trans, addblk->bp,
                                  XFS_DA_LOGRANGE(node, &node->hdr.info,
                                  sizeof(node->hdr.info)));
        }
+out:
        addblk->bp = NULL;
-        return 0;
+        return error;
 }
 /*
diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index afcc6642690a..1fc44efc344d 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -741,7 +741,8 @@ xfs_dir2_leafn_lookup_for_entry(
        ents = dp->d_ops->leaf_ents_p(leaf);
        xfs_dir3_leaf_check(dp, bp);
-        ASSERT(leafhdr.count > 0);
+        if (leafhdr.count <= 0)
+                return -EFSCORRUPTED;
        /*
         * Look up the hash value in the leaf entries.
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index 7fcf7569743f..7bd7534f5051 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -547,63 +547,12 @@ xfs_file_compat_ioctl(
        struct inode            *inode = file_inode(filp);
        struct xfs_inode        *ip = XFS_I(inode);
        struct xfs_mount        *mp = ip->i_mount;
-        void                    __user *arg = (void __user *)p;
+        void                    __user *arg = compat_ptr(p);
        int                     error;
        trace_xfs_file_compat_ioctl(ip);
        switch (cmd) {
-        /* No size or alignment issues on any arch */
-        case XFS_IOC_DIOINFO:
-        case XFS_IOC_FSGEOMETRY_V4:
-        case XFS_IOC_FSGEOMETRY:
-        case XFS_IOC_AG_GEOMETRY:
-        case XFS_IOC_FSGETXATTR:
-        case XFS_IOC_FSSETXATTR:
-        case XFS_IOC_FSGETXATTRA:
-        case XFS_IOC_FSSETDM:
-        case XFS_IOC_GETBMAP:
-        case XFS_IOC_GETBMAPA:
-        case XFS_IOC_GETBMAPX:
-        case XFS_IOC_FSCOUNTS:
-        case XFS_IOC_SET_RESBLKS:
-        case XFS_IOC_GET_RESBLKS:
-        case XFS_IOC_FSGROWFSLOG:
-        case XFS_IOC_GOINGDOWN:
-        case XFS_IOC_ERROR_INJECTION:
-        case XFS_IOC_ERROR_CLEARALL:
-        case FS_IOC_GETFSMAP:
-        case XFS_IOC_SCRUB_METADATA:
-        case XFS_IOC_BULKSTAT:
-        case XFS_IOC_INUMBERS:
-                return xfs_file_ioctl(filp, cmd, p);
-#if !defined(BROKEN_X86_ALIGNMENT) || defined(CONFIG_X86_X32)
-        /*
-         * These are handled fine if no alignment issues.  To support x32
-         * which uses native 64-bit alignment we must emit these cases in
-         * addition to the ia-32 compat set below.
-         */
-        case XFS_IOC_ALLOCSP:
-        case XFS_IOC_FREESP:
-        case XFS_IOC_RESVSP:
-        case XFS_IOC_UNRESVSP:
-        case XFS_IOC_ALLOCSP64:
-        case XFS_IOC_FREESP64:
-        case XFS_IOC_RESVSP64:
-        case XFS_IOC_UNRESVSP64:
-        case XFS_IOC_FSGEOMETRY_V1:
-        case XFS_IOC_FSGROWFSDATA:
-        case XFS_IOC_FSGROWFSRT:
-        case XFS_IOC_ZERO_RANGE:
-#ifdef CONFIG_X86_X32
-        /*
-         * x32 special: this gets a different cmd number from the ia-32 compat
-         * case below; the associated data will match native 64-bit alignment.
-         */
-        case XFS_IOC_SWAPEXT:
-#endif
-                return xfs_file_ioctl(filp, cmd, p);
-#endif
 #if defined(BROKEN_X86_ALIGNMENT)
        case XFS_IOC_ALLOCSP_32:
        case XFS_IOC_FREESP_32:
@@ -705,6 +654,7 @@ xfs_file_compat_ioctl(
        case XFS_IOC_FSSETDM_BY_HANDLE_32:
                return xfs_compat_fssetdm_by_handle(filp, arg);
        default:
-                return -ENOIOCTLCMD;
+                /* try the native version */
+                return xfs_file_ioctl(filp, cmd, (unsigned long)arg);
        }
 }
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ff3c1fae5357..fe285d123d69 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -793,6 +793,7 @@ xfs_setattr_nonsize(
 out_cancel:
        xfs_trans_cancel(tp);
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out_dqrele:
        xfs_qm_dqrele(udqp);
        xfs_qm_dqrele(gdqp);
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 00e9f5c388d3..7fc3c1ad36bc 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -429,10 +429,7 @@ xfs_log_reserve(
        ASSERT(*ticp == NULL);
        tic = xlog_ticket_alloc(log, unit_bytes, cnt, client, permanent,
-                                KM_SLEEP | KM_MAYFAIL);
+                                KM_SLEEP);
-        if (!tic)
-                return -ENOMEM;
        *ticp = tic;
        xlog_grant_push_ail(log, tic->t_cnt ? tic->t_unit_res * tic->t_cnt
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index 0c954cad7449..a339bd5fa260 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -32,7 +32,7 @@ xfs_break_leased_layouts(
        struct xfs_inode        *ip = XFS_I(inode);
        int                     error;
-        while ((error = break_layout(inode, false) == -EWOULDBLOCK)) {
+        while ((error = break_layout(inode, false)) == -EWOULDBLOCK) {
                xfs_iunlock(ip, *iolock);
                *did_unlock = true;
                error = break_layout(inode, true);
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index c4ec7afd1170..edbe37b7f636 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -1190,11 +1190,11 @@ xfs_reflink_remap_blocks(
 }
 /*
- * Grab the exclusive iolock for a data copy from src to dest, making
+ * Grab the exclusive iolock for a data copy from src to dest, making sure to
- * sure to abide vfs locking order (lowest pointer value goes first) and
+ * abide vfs locking order (lowest pointer value goes first) and breaking the
- * breaking the pnfs layout leases on dest before proceeding.  The loop
+ * layout leases before proceeding.  The loop is needed because we cannot call
- * is needed because we cannot call the blocking break_layout() with the
+ * the blocking break_layout() with the iolocks held, and therefore have to
- * src iolock held, and therefore have to back out both locks.
+ * back out both locks.
 */
 static int
 xfs_iolock_two_inodes_and_break_layout(
@@ -1203,33 +1203,44 @@ xfs_iolock_two_inodes_and_break_layout(
 {
        int                     error;
-retry:
+        if (src > dest)
-        if (src < dest) {
+                swap(src, dest);
-                inode_lock_shared(src);
-                inode_lock_nested(dest, I_MUTEX_NONDIR2);
-        } else {
-                /* src >= dest */
-                inode_lock(dest);
-        }
-        error = break_layout(dest, false);
+retry:
-        if (error == -EWOULDBLOCK) {
+        /* Wait to break both inodes' layouts before we start locking. */
-                inode_unlock(dest);
+        error = break_layout(src, true);
-                if (src < dest)
+        if (error)
-                        inode_unlock_shared(src);
+                return error;
+        if (src != dest) {
                error = break_layout(dest, true);
                if (error)
                        return error;
-                goto retry;
        }
+        /* Lock one inode and make sure nobody got in and leased it. */
+        inode_lock(src);
+        error = break_layout(src, false);
        if (error) {
+                inode_unlock(src);
+                if (error == -EWOULDBLOCK)
+                        goto retry;
+                return error;
+        }
+        if (src == dest)
+                return 0;
+        /* Lock the other inode and make sure nobody got in and leased it. */
+        inode_lock_nested(dest, I_MUTEX_NONDIR2);
+        error = break_layout(dest, false);
+        if (error) {
+                inode_unlock(src);
                inode_unlock(dest);
-                if (src < dest)
+                if (error == -EWOULDBLOCK)
-                        inode_unlock_shared(src);
+                        goto retry;
                return error;
        }
-        if (src > dest)
-                inode_lock_shared_nested(src, I_MUTEX_NONDIR2);
        return 0;
 }
@@ -1247,10 +1258,10 @@ xfs_reflink_remap_unlock(
        xfs_iunlock(dest, XFS_MMAPLOCK_EXCL);
        if (!same_inode)
-                xfs_iunlock(src, XFS_MMAPLOCK_SHARED);
+                xfs_iunlock(src, XFS_MMAPLOCK_EXCL);
        inode_unlock(inode_out);
        if (!same_inode)
-                inode_unlock_shared(inode_in);
+                inode_unlock(inode_in);
 }
 /*
@@ -1325,7 +1336,7 @@ xfs_reflink_remap_prep(
        if (same_inode)
                xfs_ilock(src, XFS_MMAPLOCK_EXCL);
        else
-                xfs_lock_two_inodes(src, XFS_MMAPLOCK_SHARED, dest,
+                xfs_lock_two_inodes(src, XFS_MMAPLOCK_EXCL, dest,
                                XFS_MMAPLOCK_EXCL);
        /* Check file eligibility and prepare for block sharing. */
diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
index bb6cb347018c..f6947da70d71 100644
--- a/include/asm-generic/5level-fixup.h
+++ b/include/asm-generic/5level-fixup.h
@@ -19,9 +19,24 @@
 #define p4d_alloc(mm, pgd, address)     (pgd)
 #define p4d_offset(pgd, start)          (pgd)
-#define p4d_none(p4d)                   0
-#define p4d_bad(p4d)                    0
+#ifndef __ASSEMBLY__
-#define p4d_present(p4d)                1
+static inline int p4d_none(p4d_t p4d)
+{
+        return 0;
+}
+static inline int p4d_bad(p4d_t p4d)
+{
+        return 0;
+}
+static inline int p4d_present(p4d_t p4d)
+{
+        return 1;
+}
+#endif
 #define p4d_ERROR(p4d)                  do { } while (0)
 #define p4d_clear(p4d)                  pgd_clear(p4d)
 #define p4d_val(p4d)                    pgd_val(p4d)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 1b1fa1557e68..feff3fe4467e 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -311,7 +311,6 @@ enum req_flag_bits {
        __REQ_RAHEAD,           /* read ahead, can fail anytime */
        __REQ_BACKGROUND,       /* background IO */
        __REQ_NOWAIT,           /* Don't wait if request will block */
-        __REQ_NOWAIT_INLINE,    /* Return would-block error inline */
        /*
         * When a shared kthread needs to issue a bio for a cgroup, doing
         * so synchronously can lead to priority inversions as the kthread
@@ -346,7 +345,6 @@ enum req_flag_bits {
 #define REQ_RAHEAD              (1ULL << __REQ_RAHEAD)
 #define REQ_BACKGROUND          (1ULL << __REQ_BACKGROUND)
 #define REQ_NOWAIT              (1ULL << __REQ_NOWAIT)
-#define REQ_NOWAIT_INLINE       (1ULL << __REQ_NOWAIT_INLINE)
 #define REQ_CGROUP_PUNT         (1ULL << __REQ_CGROUP_PUNT)
 #define REQ_NOUNMAP             (1ULL << __REQ_NOUNMAP)
@@ -420,13 +418,12 @@ static inline int op_stat_group(unsigned int op)
 typedef unsigned int blk_qc_t;
 #define BLK_QC_T_NONE           -1U
-#define BLK_QC_T_EAGAIN         -2U
 #define BLK_QC_T_SHIFT          16
 #define BLK_QC_T_INTERNAL       (1U << 31)
 static inline bool blk_qc_t_valid(blk_qc_t cookie)
 {
-        return cookie != BLK_QC_T_NONE && cookie != BLK_QC_T_EAGAIN;
+        return cookie != BLK_QC_T_NONE;
 }
 static inline unsigned int blk_qc_t_to_queue_num(blk_qc_t cookie)
diff --git a/include/linux/ceph/buffer.h b/include/linux/ceph/buffer.h
index 5e58bb29b1a3..11cdc7c60480 100644
--- a/include/linux/ceph/buffer.h
+++ b/include/linux/ceph/buffer.h
@@ -30,7 +30,8 @@ static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b)
 static inline void ceph_buffer_put(struct ceph_buffer *b)
 {
-        kref_put(&b->kref, ceph_buffer_release);
+        if (b)
+                kref_put(&b->kref, ceph_buffer_release);
 }
 extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end);
diff --git a/include/linux/dma-contiguous.h b/include/linux/dma-contiguous.h
index c05d4e661489..03f8e98e3bcc 100644
--- a/include/linux/dma-contiguous.h
+++ b/include/linux/dma-contiguous.h
@@ -160,10 +160,7 @@ bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 static inline struct page *dma_alloc_contiguous(struct device *dev, size_t size,
                gfp_t gfp)
 {
-        int node = dev ? dev_to_node(dev) : NUMA_NO_NODE;
+        return NULL;
-        size_t align = get_order(PAGE_ALIGN(size));
-        return alloc_pages_node(node, gfp, align);
 }
 static inline void dma_free_contiguous(struct device *dev, struct page *page,
diff --git a/include/linux/dma-noncoherent.h b/include/linux/dma-noncoherent.h
index 3813211a9aad..0bff3d7fac92 100644
--- a/include/linux/dma-noncoherent.h
+++ b/include/linux/dma-noncoherent.h
@@ -42,13 +42,18 @@ void arch_dma_free(struct device *dev, size_t size, void *cpu_addr,
                dma_addr_t dma_addr, unsigned long attrs);
 long arch_dma_coherent_to_pfn(struct device *dev, void *cpu_addr,
                dma_addr_t dma_addr);
-#ifdef CONFIG_ARCH_HAS_DMA_MMAP_PGPROT
 pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
                unsigned long attrs);
+#ifdef CONFIG_MMU
+pgprot_t dma_pgprot(struct device *dev, pgprot_t prot, unsigned long attrs);
 #else
-# define arch_dma_mmap_pgprot(dev, prot, attrs) pgprot_noncached(prot)
+static inline pgprot_t dma_pgprot(struct device *dev, pgprot_t prot,
-#endif
+                unsigned long attrs)
+{
+        return prot;    /* no protection bits supported without page tables */
+}
+#endif /* CONFIG_MMU */
 #ifdef CONFIG_DMA_NONCOHERENT_CACHE_SYNC
 void arch_dma_cache_sync(struct device *dev, void *vaddr, size_t size,
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index fb07b503dc45..f33881688f42 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -510,22 +510,18 @@ alloc_pages(gfp_t gfp_mask, unsigned int order)
 }
 extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
                        struct vm_area_struct *vma, unsigned long addr,
-                        int node, bool hugepage);
+                        int node);
-#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
-        alloc_pages_vma(gfp_mask, order, vma, addr, numa_node_id(), true)
 #else
 #define alloc_pages(gfp_mask, order) \
                alloc_pages_node(numa_node_id(), gfp_mask, order)
-#define alloc_pages_vma(gfp_mask, order, vma, addr, node, false)\
+#define alloc_pages_vma(gfp_mask, order, vma, addr, node)\
-        alloc_pages(gfp_mask, order)
-#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
        alloc_pages(gfp_mask, order)
 #endif
 #define alloc_page(gfp_mask) alloc_pages(gfp_mask, 0)
 #define alloc_page_vma(gfp_mask, vma, addr)                     \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id(), false)
+        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id())
 #define alloc_page_vma_node(gfp_mask, vma, addr, node)          \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, node, false)
+        alloc_pages_vma(gfp_mask, 0, vma, addr, node)
 extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
 extern unsigned long get_zeroed_page(gfp_t gfp_mask);
diff --git a/include/linux/gpio.h b/include/linux/gpio.h
index 40915b461f18..f757a58191a6 100644
--- a/include/linux/gpio.h
+++ b/include/linux/gpio.h
@@ -241,30 +241,6 @@ static inline int irq_to_gpio(unsigned irq)
        return -EINVAL;
 }
-static inline int
-gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
-                       unsigned int gpio_offset, unsigned int pin_offset,
-                       unsigned int npins)
-{
-        WARN_ON(1);
-        return -EINVAL;
-}
-static inline int
-gpiochip_add_pingroup_range(struct gpio_chip *chip,
-                        struct pinctrl_dev *pctldev,
-                        unsigned int gpio_offset, const char *pin_group)
-{
-        WARN_ON(1);
-        return -EINVAL;
-}
-static inline void
-gpiochip_remove_pin_ranges(struct gpio_chip *chip)
-{
-        WARN_ON(1);
-}
 static inline int devm_gpio_request(struct device *dev, unsigned gpio,
                                    const char *label)
 {
diff --git a/include/linux/key.h b/include/linux/key.h
index 91f391cd272e..50028338a4cc 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -94,11 +94,11 @@ struct keyring_index_key {
        union {
                struct {
 #ifdef __LITTLE_ENDIAN /* Put desc_len at the LSB of x */
-                        u8      desc_len;
+                        u16     desc_len;
-                        char    desc[sizeof(long) - 1]; /* First few chars of description */
+                        char    desc[sizeof(long) - 2]; /* First few chars of description */
 #else
-                        char    desc[sizeof(long) - 1]; /* First few chars of description */
+                        char    desc[sizeof(long) - 2]; /* First few chars of description */
-                        u8      desc_len;
+                        u16     desc_len;
 #endif
                };
                unsigned long x;
diff --git a/include/linux/logic_pio.h b/include/linux/logic_pio.h
index cbd9d8495690..88e1e6304a71 100644
--- a/include/linux/logic_pio.h
+++ b/include/linux/logic_pio.h
@@ -117,6 +117,7 @@ struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode);
 unsigned long logic_pio_trans_hwaddr(struct fwnode_handle *fwnode,
                        resource_size_t hw_addr, resource_size_t size);
 int logic_pio_register_range(struct logic_pio_hwaddr *newrange);
+void logic_pio_unregister_range(struct logic_pio_hwaddr *range);
 resource_size_t logic_pio_to_hwaddr(unsigned long pio);
 unsigned long logic_pio_trans_cpuaddr(resource_size_t hw_addr);
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 44c41462be33..2cd4359cb38c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -668,6 +668,7 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec,
 void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
                        int val);
+void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val);
 static inline void mod_lruvec_state(struct lruvec *lruvec,
                                    enum node_stat_item idx, int val)
@@ -1072,6 +1073,14 @@ static inline void mod_lruvec_page_state(struct page *page,
        mod_node_page_state(page_pgdat(page), idx, val);
 }
+static inline void __mod_lruvec_slab_state(void *p, enum node_stat_item idx,
+                                           int val)
+{
+        struct page *page = virt_to_head_page(p);
+        __mod_node_page_state(page_pgdat(page), idx, val);
+}
 static inline
 unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
                                            gfp_t gfp_mask,
@@ -1159,6 +1168,16 @@ static inline void __dec_lruvec_page_state(struct page *page,
        __mod_lruvec_page_state(page, idx, -1);
 }
+static inline void __inc_lruvec_slab_state(void *p, enum node_stat_item idx)
+{
+        __mod_lruvec_slab_state(p, idx, 1);
+}
+static inline void __dec_lruvec_slab_state(void *p, enum node_stat_item idx)
+{
+        __mod_lruvec_slab_state(p, idx, -1);
+}
 /* idx can be of type enum memcg_stat_item or node_stat_item */
 static inline void inc_memcg_state(struct mem_cgroup *memcg,
                                   int idx)
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 5228c62af416..bac395f1d00a 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -139,6 +139,8 @@ struct mempolicy *mpol_shared_policy_lookup(struct shared_policy *sp,
 struct mempolicy *get_task_policy(struct task_struct *p);
 struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
                unsigned long addr);
+struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+                                                unsigned long addr);
 bool vma_policy_mof(struct vm_area_struct *vma);
 extern void numa_default_policy(void);
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index ce9839c8bc1a..c2f056b5766d 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -446,11 +446,11 @@ enum {
 };
 enum {
-        MLX5_OPC_MOD_TLS_TIS_STATIC_PARAMS = 0x20,
+        MLX5_OPC_MOD_TLS_TIS_STATIC_PARAMS = 0x1,
 };
 enum {
-        MLX5_OPC_MOD_TLS_TIS_PROGRESS_PARAMS = 0x20,
+        MLX5_OPC_MOD_TLS_TIS_PROGRESS_PARAMS = 0x1,
 };
 enum {
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index ec571fd7fcf8..b8b570c30b5e 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -10054,9 +10054,8 @@ struct mlx5_ifc_tls_static_params_bits {
 };
 struct mlx5_ifc_tls_progress_params_bits {
-        u8         valid[0x1];
+        u8         reserved_at_0[0x8];
-        u8         reserved_at_1[0x7];
+        u8         tisn[0x18];
-        u8         pd[0x18];
        u8         next_record_tcp_sn[0x20];
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 3a37a89eb7a7..6a7a1083b6fb 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -159,7 +159,16 @@ struct page {
                        /** @pgmap: Points to the hosting device page map. */
                        struct dev_pagemap *pgmap;
                        void *zone_device_data;
-                        unsigned long _zd_pad_1;        /* uses mapping */
+                        /*
+                         * ZONE_DEVICE private pages are counted as being
+                         * mapped so the next 3 words hold the mapping, index,
+                         * and private fields from the source anonymous or
+                         * page cache page while the page is migrated to device
+                         * private memory.
+                         * ZONE_DEVICE MEMORY_DEVICE_FS_DAX pages also
+                         * use the mapping, index, and private fields when
+                         * pmem backed DAX files are mapped.
+                         */
                };
                /** @rcu_head: You can use this to free a page by RCU. */
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index d77d717c620c..3f38c30d2f13 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -215,8 +215,9 @@ enum node_stat_item {
        NR_INACTIVE_FILE,       /*  "     "     "   "       "         */
        NR_ACTIVE_FILE,         /*  "     "     "   "       "         */
        NR_UNEVICTABLE,         /*  "     "     "   "       "         */
-        NR_SLAB_RECLAIMABLE,
+        NR_SLAB_RECLAIMABLE,    /* Please do not reorder this item */
-        NR_SLAB_UNRECLAIMABLE,
+        NR_SLAB_UNRECLAIMABLE,  /* and this one without looking at
+                                 * memcg_flush_percpu_vmstats() first. */
        NR_ISOLATED_ANON,       /* Temporary isolated pages from anon lru */
        NR_ISOLATED_FILE,       /* Temporary isolated pages from file lru */
        WORKINGSET_NODES,
diff --git a/include/linux/netfilter/nf_conntrack_h323_types.h b/include/linux/netfilter/nf_conntrack_h323_types.h
index 7a6871ac8784..74c6f9241944 100644
--- a/include/linux/netfilter/nf_conntrack_h323_types.h
+++ b/include/linux/netfilter/nf_conntrack_h323_types.h
@@ -4,6 +4,9 @@
 * Copyright (c) 2006 Jing Min Zhao <zhaojingmin@users.sourceforge.net>
 */
+#ifndef _NF_CONNTRACK_H323_TYPES_H
+#define _NF_CONNTRACK_H323_TYPES_H
 typedef struct TransportAddress_ipAddress {     /* SEQUENCE */
        int options;            /* No use */
        unsigned int ip;
@@ -931,3 +934,5 @@ typedef struct RasMessage {	/* CHOICE */
                InfoRequestResponse infoRequestResponse;
        };
 } RasMessage;
+#endif /* _NF_CONNTRACK_H323_TYPES_H */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 9e700d9f9f28..82e4cd1b7ac3 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1567,8 +1567,10 @@ extern bool pcie_ports_native;
 #ifdef CONFIG_PCIEASPM
 bool pcie_aspm_support_enabled(void);
+bool pcie_aspm_enabled(struct pci_dev *pdev);
 #else
 static inline bool pcie_aspm_support_enabled(void) { return false; }
+static inline bool pcie_aspm_enabled(struct pci_dev *pdev) { return false; }
 #endif
 #ifdef CONFIG_PCIEAER
diff --git a/include/linux/signal.h b/include/linux/signal.h
index b5d99482d3fe..1a5f88316b08 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -282,6 +282,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
 extern void exit_signals(struct task_struct *tsk);
 extern void kernel_sigaction(int, __sighandler_t);
+#define SIG_KTHREAD ((__force __sighandler_t)2)
+#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
 static inline void allow_signal(int sig)
 {
        /*
@@ -289,7 +292,17 @@ static inline void allow_signal(int sig)
         * know it'll be handled, so that they don't get converted to
         * SIGKILL or just silently dropped.
         */
-        kernel_sigaction(sig, (__force __sighandler_t)2);
+        kernel_sigaction(sig, SIG_KTHREAD);
+}
+static inline void allow_kernel_signal(int sig)
+{
+        /*
+         * Kernel threads handle their own signals. Let the signal code
+         * know signals sent by the kernel will be handled, so that they
+         * don't get silently dropped.
+         */
+        kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
 }
 static inline void disallow_signal(int sig)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d8af86d995d6..ba5583522d24 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1374,6 +1374,14 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
        to->l4_hash = from->l4_hash;
 };
+static inline void skb_copy_decrypted(struct sk_buff *to,
+                                      const struct sk_buff *from)
+{
+#ifdef CONFIG_TLS_DEVICE
+        to->decrypted = from->decrypted;
+#endif
+}
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 97523818cb14..fc0bed59fc84 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -292,6 +292,9 @@ struct ucred {
 #define MSG_BATCH       0x40000 /* sendmmsg(): more messages coming */
 #define MSG_EOF         MSG_FIN
 #define MSG_NO_SHARED_FRAGS 0x80000 /* sendpage() internal : page frags are not shared */
+#define MSG_SENDPAGE_DECRYPTED  0x100000 /* sendpage() internal : page may carry
+                                          * plain text and require encryption
+                                          */
 #define MSG_ZEROCOPY    0x4000000       /* Use user data in kernel path */
 #define MSG_FASTOPEN    0x20000000      /* Send data in TCP SYN */
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index baa3ecdb882f..27536b961552 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -98,7 +98,6 @@ typedef void			(*rpc_action)(struct rpc_task *);
 struct rpc_call_ops {
        void (*rpc_call_prepare)(struct rpc_task *, void *);
-        void (*rpc_call_prepare_transmit)(struct rpc_task *, void *);
        void (*rpc_call_done)(struct rpc_task *, void *);
        void (*rpc_count_stats)(struct rpc_task *, void *);
        void (*rpc_release)(void *);
diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
index 7acb953298a7..84ff2844df2a 100644
--- a/include/linux/timekeeper_internal.h
+++ b/include/linux/timekeeper_internal.h
@@ -57,6 +57,7 @@ struct tk_read_base {
 * @cs_was_changed_seq: The sequence number of clocksource change events
 * @next_leap_ktime:    CLOCK_MONOTONIC time value of a pending leap-second
 * @raw_sec:            CLOCK_MONOTONIC_RAW  time in seconds
+ * @monotonic_to_boot:  CLOCK_MONOTONIC to CLOCK_BOOTTIME offset
 * @cycle_interval:     Number of clock cycles in one NTP interval
 * @xtime_interval:     Number of clock shifted nano seconds in one NTP
 *                      interval.
@@ -84,6 +85,9 @@ struct tk_read_base {
 *
 * wall_to_monotonic is no longer the boot time, getboottime must be
 * used instead.
+ *
+ * @monotonic_to_boottime is a timespec64 representation of @offs_boot to
+ * accelerate the VDSO update for CLOCK_BOOTTIME.
 */
 struct timekeeper {
        struct tk_read_base     tkr_mono;
@@ -99,6 +103,7 @@ struct timekeeper {
        u8                      cs_was_changed_seq;
        ktime_t                 next_leap_ktime;
        u64                     raw_sec;
+        struct timespec64       monotonic_to_boot;
        /* The following members are for timekeeping internal use */
        u64                     cycle_interval;
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 5150436783e8..30a8cdcfd4a4 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -548,6 +548,7 @@ extern int trace_event_get_offsets(struct trace_event_call *call);
 #define is_signed_type(type)    (((type)(-1)) < (type)1)
+int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set);
 int trace_set_clr_event(const char *system, const char *event, int set);
 /*
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 83d35d993e8c..e87826e23d59 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1457,7 +1457,7 @@ typedef void (*usb_complete_t)(struct urb *);
 * field rather than determining a dma address themselves.
 *
 * Note that transfer_buffer must still be set if the controller
- * does not support DMA (as indicated by bus.uses_dma) and when talking
+ * does not support DMA (as indicated by hcd_uses_dma()) and when talking
 * to root hub. If you have to trasfer between highmem zone and the device
 * on such controller, create a bounce buffer or bail out with an error.
 * If transfer_buffer cannot be set (is in highmem) and the controller is DMA
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index bab27ccc8ff5..a20e7815d814 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -422,6 +422,9 @@ static inline bool hcd_periodic_completion_in_progress(struct usb_hcd *hcd,
        return hcd->high_prio_bh.completing_ep == ep;
 }
+#define hcd_uses_dma(hcd) \
+        (IS_ENABLED(CONFIG_HAS_DMA) && (hcd)->self.uses_dma)
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
 extern int usb_hcd_check_unlink_urb(struct usb_hcd *hcd, struct urb *urb,
                int status);
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index f37d12877754..adcc6a97db61 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -308,6 +308,7 @@ do {									     \
                                                                             \
  case _FP_CLS_COMBINE(FP_CLS_NORMAL,FP_CLS_ZERO):                           \
    R##_e = X##_e;                                                           \
+          /* Fall through */                                                 \
  case _FP_CLS_COMBINE(FP_CLS_NAN,FP_CLS_NORMAL):                            \
  case _FP_CLS_COMBINE(FP_CLS_NAN,FP_CLS_INF):                               \
  case _FP_CLS_COMBINE(FP_CLS_NAN,FP_CLS_ZERO):                              \
@@ -318,6 +319,7 @@ do {									     \
                                                                             \
  case _FP_CLS_COMBINE(FP_CLS_ZERO,FP_CLS_NORMAL):                           \
    R##_e = Y##_e;                                                           \
+          /* Fall through */                                                 \
  case _FP_CLS_COMBINE(FP_CLS_NORMAL,FP_CLS_NAN):                            \
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_NAN):                               \
  case _FP_CLS_COMBINE(FP_CLS_ZERO,FP_CLS_NAN):                              \
@@ -415,6 +417,7 @@ do {							\
  case _FP_CLS_COMBINE(FP_CLS_NAN,FP_CLS_INF):          \
  case _FP_CLS_COMBINE(FP_CLS_NAN,FP_CLS_ZERO):         \
    R##_s = X##_s;                                      \
+        /* Fall through */                              \
                                                        \
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_INF):          \
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_NORMAL):       \
@@ -428,6 +431,7 @@ do {							\
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_NAN):          \
  case _FP_CLS_COMBINE(FP_CLS_ZERO,FP_CLS_NAN):         \
    R##_s = Y##_s;                                      \
+        /* Fall through */                              \
                                                        \
  case _FP_CLS_COMBINE(FP_CLS_NORMAL,FP_CLS_INF):       \
  case _FP_CLS_COMBINE(FP_CLS_NORMAL,FP_CLS_ZERO):      \
@@ -493,6 +497,7 @@ do {							\
                                                        \
  case _FP_CLS_COMBINE(FP_CLS_NORMAL,FP_CLS_ZERO):      \
    FP_SET_EXCEPTION(FP_EX_DIVZERO);                    \
+          /* Fall through */                            \
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_ZERO):         \
  case _FP_CLS_COMBINE(FP_CLS_INF,FP_CLS_NORMAL):       \
    R##_c = FP_CLS_INF;                                 \
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index becdad576859..3f62b347b04a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -206,7 +206,7 @@ static inline int ipv6_mc_may_pull(struct sk_buff *skb,
                                   unsigned int len)
 {
        if (skb_transport_offset(skb) + ipv6_transport_len(skb) < len)
-                return -EINVAL;
+                return 0;
        return pskb_may_pull(skb, len);
 }
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ded574b32c20..ffc95b382eb5 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -278,6 +278,7 @@ struct hci_dev {
        __u16           conn_info_min_age;
        __u16           conn_info_max_age;
        __u16           auth_payload_timeout;
+        __u8            min_enc_key_size;
        __u8            ssp_debug_mode;
        __u8            hw_error_code;
        __u32           clock;
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 010f26b31c89..bac79e817776 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -171,7 +171,7 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
                              struct sk_buff *parent);
 void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
-                            void *reasm_data);
+                            void *reasm_data, bool try_coalesce);
 struct sk_buff *inet_frag_pull_head(struct inet_frag_queue *q);
 #endif
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 4a9da951a794..ab40d7afdc54 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -52,7 +52,7 @@ struct bpf_prog;
 #define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
 struct net {
-        refcount_t              passive;        /* To decided when the network
+        refcount_t              passive;        /* To decide when the network
                                                 * namespace should be freed.
                                                 */
        refcount_t              count;          /* To decided when the network
@@ -61,7 +61,6 @@ struct net {
        spinlock_t              rules_mod_lock;
        u32                     hash_mix;
-        atomic64_t              cookie_gen;
        struct list_head        list;           /* list of network namespaces */
        struct list_head        exit_list;      /* To linked to call pernet exit
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 9b624566b82d..475d6f28ca67 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -421,8 +421,7 @@ struct nft_set {
        unsigned char                   *udata;
        /* runtime data below here */
        const struct nft_set_ops        *ops ____cacheline_aligned;
-        u16                             flags:13,
+        u16                             flags:14,
-                                        bound:1,
                                        genmask:2;
        u8                              klen;
        u8                              dlen;
@@ -1348,12 +1347,15 @@ struct nft_trans_rule {
 struct nft_trans_set {
        struct nft_set                  *set;
        u32                             set_id;
+        bool                            bound;
 };
 #define nft_trans_set(trans)    \
        (((struct nft_trans_set *)trans->data)->set)
 #define nft_trans_set_id(trans) \
        (((struct nft_trans_set *)trans->data)->set_id)
+#define nft_trans_set_bound(trans)      \
+        (((struct nft_trans_set *)trans->data)->bound)
 struct nft_trans_chain {
        bool                            update;
@@ -1384,12 +1386,15 @@ struct nft_trans_table {
 struct nft_trans_elem {
        struct nft_set                  *set;
        struct nft_set_elem             elem;
+        bool                            bound;
 };
 #define nft_trans_elem_set(trans)       \
        (((struct nft_trans_elem *)trans->data)->set)
 #define nft_trans_elem(trans)   \
        (((struct nft_trans_elem *)trans->data)->elem)
+#define nft_trans_elem_set_bound(trans) \
+        (((struct nft_trans_elem *)trans->data)->bound)
 struct nft_trans_obj {
        struct nft_object               *obj;
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 3196663a10e3..c8b9dec376f5 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -73,4 +73,6 @@ int nft_flow_rule_offload_commit(struct net *net);
        (__reg)->key            = __key;                                \
        memset(&(__reg)->mask, 0xff, (__reg)->len);
+int nft_chain_offload_priority(struct nft_base_chain *basechain);
 #endif
diff --git a/include/net/netlink.h b/include/net/netlink.h
index e4650e5b64a1..b140c8f1be22 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -684,9 +684,8 @@ static inline int nlmsg_parse(const struct nlmsghdr *nlh, int hdrlen,
                              const struct nla_policy *policy,
                              struct netlink_ext_ack *extack)
 {
-        return __nla_parse(tb, maxtype, nlmsg_attrdata(nlh, hdrlen),
+        return __nlmsg_parse(nlh, hdrlen, tb, maxtype, policy,
-                           nlmsg_attrlen(nlh, hdrlen), policy,
+                             NL_VALIDATE_STRICT, extack);
-                           NL_VALIDATE_STRICT, extack);
 }
 /**
diff --git a/include/net/nexthop.h b/include/net/nexthop.h
index 25f1f9a8419b..95f766c31c90 100644
--- a/include/net/nexthop.h
+++ b/include/net/nexthop.h
@@ -141,12 +141,6 @@ static inline unsigned int nexthop_num_path(const struct nexthop *nh)
                nh_grp = rcu_dereference_rtnl(nh->nh_grp);
                rc = nh_grp->num_nh;
-        } else {
-                const struct nh_info *nhi;
-                nhi = rcu_dereference_rtnl(nh->nh_info);
-                if (nhi->reject_nh)
-                        rc = 0;
        }
        return rc;
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index e429809ca90d..98be18ef1ed3 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -646,7 +646,7 @@ tc_cls_common_offload_init(struct flow_cls_common_offload *cls_common,
 {
        cls_common->chain_index = tp->chain->index;
        cls_common->protocol = tp->protocol;
-        cls_common->prio = tp->prio;
+        cls_common->prio = tp->prio >> 16;
        if (tc_skip_sw(flags) || flags & TCA_CLS_FLAGS_VERBOSE)
                cls_common->extack = extack;
 }
diff --git a/include/net/route.h b/include/net/route.h
index 630a0493f1f3..dfce19c9fa96 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -233,7 +233,7 @@ void rt_del_uncached_list(struct rtable *rt);
 int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                       u32 table_id, struct fib_info *fi,
-                       int *fa_index, int fa_start);
+                       int *fa_index, int fa_start, unsigned int flags);
 static inline void ip_rt_put(struct rtable *rt)
 {
diff --git a/include/net/sock.h b/include/net/sock.h
index 228db3998e46..2c53f1a1d905 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2482,6 +2482,7 @@ static inline bool sk_fullsock(const struct sock *sk)
 /* Checks if this SKB belongs to an HW offloaded socket
 * and whether any SW fallbacks are required based on dev.
+ * Check decrypted mark in case skb_orphan() cleared socket.
 */
 static inline struct sk_buff *sk_validate_xmit_skb(struct sk_buff *skb,
                                                   struct net_device *dev)
@@ -2489,8 +2490,15 @@ static inline struct sk_buff *sk_validate_xmit_skb(struct sk_buff *skb,
 #ifdef CONFIG_SOCK_VALIDATE_XMIT
        struct sock *sk = skb->sk;
-        if (sk && sk_fullsock(sk) && sk->sk_validate_xmit_skb)
+        if (sk && sk_fullsock(sk) && sk->sk_validate_xmit_skb) {
                skb = sk->sk_validate_xmit_skb(sk, dev, skb);
+#ifdef CONFIG_TLS_DEVICE
+        } else if (unlikely(skb->decrypted)) {
+                pr_warn_ratelimited("unencrypted skb with no associated socket - dropping\n");
+                kfree_skb(skb);
+                skb = NULL;
+#endif
+        }
 #endif
        return skb;
diff --git a/include/rdma/restrack.h b/include/rdma/restrack.h
index b0fc6b26bdf5..83df1ec6664e 100644
--- a/include/rdma/restrack.h
+++ b/include/rdma/restrack.h
@@ -105,8 +105,7 @@ struct rdma_restrack_entry {
 };
 int rdma_restrack_count(struct ib_device *dev,
-                        enum rdma_restrack_type type,
+                        enum rdma_restrack_type type);
-                        struct pid_namespace *ns);
 void rdma_restrack_kadd(struct rdma_restrack_entry *res);
 void rdma_restrack_uadd(struct rdma_restrack_entry *res);
diff --git a/include/soc/arc/mcip.h b/include/soc/arc/mcip.h
index 50f49e043668..d1a93c73f006 100644
--- a/include/soc/arc/mcip.h
+++ b/include/soc/arc/mcip.h
@@ -46,7 +46,9 @@ struct mcip_cmd {
 #define CMD_IDU_ENABLE                  0x71
 #define CMD_IDU_DISABLE                 0x72
 #define CMD_IDU_SET_MODE                0x74
+#define CMD_IDU_READ_MODE               0x75
 #define CMD_IDU_SET_DEST                0x76
+#define CMD_IDU_ACK_CIRQ                0x79
 #define CMD_IDU_SET_MASK                0x7C
 #define IDU_M_TRIG_LEVEL                0x0
@@ -119,4 +121,13 @@ static inline void __mcip_cmd_data(unsigned int cmd, unsigned int param,
        __mcip_cmd(cmd, param);
 }
+/*
+ * Read MCIP register
+ */
+static inline unsigned int __mcip_cmd_read(unsigned int cmd, unsigned int param)
+{
+        __mcip_cmd(cmd, param);
+        return read_aux_reg(ARC_REG_MCIP_READBACK);
+}
 #endif
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index cc1d060cbf13..fa06b528c73c 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -498,10 +498,10 @@ rxrpc_tx_points;
 #define E_(a, b)        { a, b }
 TRACE_EVENT(rxrpc_local,
-            TP_PROTO(struct rxrpc_local *local, enum rxrpc_local_trace op,
+            TP_PROTO(unsigned int local_debug_id, enum rxrpc_local_trace op,
                     int usage, const void *where),
-            TP_ARGS(local, op, usage, where),
+            TP_ARGS(local_debug_id, op, usage, where),
            TP_STRUCT__entry(
                    __field(unsigned int,       local           )
@@ -511,7 +511,7 @@ TRACE_EVENT(rxrpc_local,
                             ),
            TP_fast_assign(
-                    __entry->local = local->debug_id;
+                    __entry->local = local_debug_id;
                    __entry->op = op;
                    __entry->usage = usage;
                    __entry->where = where;
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index fa1c753dcdbc..a5aa7d3ac6a1 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1466,8 +1466,8 @@ union bpf_attr {
 *              If no cookie has been set yet, generate a new cookie. Once
 *              generated, the socket cookie remains stable for the life of the
 *              socket. This helper can be useful for monitoring per socket
- *              networking traffic statistics as it provides a unique socket
+ *              networking traffic statistics as it provides a global socket
- *              identifier per namespace.
+ *              identifier that can be assumed unique.
 *      Return
 *              A 8-byte long non-decreasing number on success, or 0 if the
 *              socket field is missing inside *skb*.
diff --git a/include/uapi/linux/jffs2.h b/include/uapi/linux/jffs2.h
index a18b719f49d4..784ba0b9690a 100644
--- a/include/uapi/linux/jffs2.h
+++ b/include/uapi/linux/jffs2.h
@@ -77,11 +77,6 @@
 #define JFFS2_ACL_VERSION               0x0001
-// Maybe later...
-//#define JFFS2_NODETYPE_CHECKPOINT (JFFS2_FEATURE_RWCOMPAT_DELETE | JFFS2_NODE_ACCURATE | 3)
-//#define JFFS2_NODETYPE_OPTIONS (JFFS2_FEATURE_RWCOMPAT_COPY | JFFS2_NODE_ACCURATE | 4)
 #define JFFS2_INO_FLAG_PREREAD    1     /* Do read_inode() for this one at
                                           mount time, don't wait for it to
                                           happen later */
diff --git a/include/uapi/linux/netfilter/xt_nfacct.h b/include/uapi/linux/netfilter/xt_nfacct.h
index 5c8a4d760ee3..b5123ab8d54a 100644
--- a/include/uapi/linux/netfilter/xt_nfacct.h
+++ b/include/uapi/linux/netfilter/xt_nfacct.h
@@ -11,4 +11,9 @@ struct xt_nfacct_match_info {
        struct nf_acct  *nfacct;
 };
+struct xt_nfacct_match_info_v1 {
+        char            name[NFACCT_NAME_MAX];
+        struct nf_acct  *nfacct __attribute__((aligned(8)));
+};
 #endif /* _XT_NFACCT_MATCH_H */
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index fd6b5f66e2c5..cba368e55863 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -250,6 +250,7 @@ struct rds_info_rdma_connection {
        __u32           rdma_mr_max;
        __u32           rdma_mr_size;
        __u8            tos;
+        __u8            sl;
        __u32           cache_allocs;
 };
@@ -265,6 +266,7 @@ struct rds6_info_rdma_connection {
        __u32           rdma_mr_max;
        __u32           rdma_mr_size;
        __u8            tos;
+        __u8            sl;
        __u32           cache_allocs;
 };
diff --git a/include/uapi/rdma/siw-abi.h b/include/uapi/rdma/siw-abi.h
index 7de68f1dc707..af735f55b291 100644
--- a/include/uapi/rdma/siw-abi.h
+++ b/include/uapi/rdma/siw-abi.h
@@ -180,6 +180,7 @@ struct siw_cqe {
 * to control CQ arming.
 */
 struct siw_cq_ctrl {
-        __aligned_u64 notify;
+        __u32 flags;
+        __u32 pad;
 };
 #endif
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 5d141f16f6fa..272071e9112f 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1707,20 +1707,26 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
        if (err)
                goto free_used_maps;
-        err = bpf_prog_new_fd(prog);
+        /* Upon success of bpf_prog_alloc_id(), the BPF prog is
-        if (err < 0) {
+         * effectively publicly exposed. However, retrieving via
-                /* failed to allocate fd.
+         * bpf_prog_get_fd_by_id() will take another reference,
-                 * bpf_prog_put() is needed because the above
+         * therefore it cannot be gone underneath us.
-                 * bpf_prog_alloc_id() has published the prog
+         *
-                 * to the userspace and the userspace may
+         * Only for the time /after/ successful bpf_prog_new_fd()
-                 * have refcnt-ed it through BPF_PROG_GET_FD_BY_ID.
+         * and before returning to userspace, we might just hold
-                 */
+         * one reference and any parallel close on that fd could
-                bpf_prog_put(prog);
+         * rip everything out. Hence, below notifications must
-                return err;
+         * happen before bpf_prog_new_fd().
-        }
+         *
+         * Also, any failure handling from this point onwards must
+         * be using bpf_prog_put() given the program is exposed.
+         */
        bpf_prog_kallsyms_add(prog);
        perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
+        err = bpf_prog_new_fd(prog);
+        if (err < 0)
+                bpf_prog_put(prog);
        return err;
 free_used_maps:
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c84d83f86141..b5c14c9d7b98 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -985,9 +985,6 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
        reg->smax_value = S64_MAX;
        reg->umin_value = 0;
        reg->umax_value = U64_MAX;
-        /* constant backtracking is enabled for root only for now */
-        reg->precise = capable(CAP_SYS_ADMIN) ? false : true;
 }
 /* Mark a register as having a completely unknown (scalar) value. */
@@ -1014,7 +1011,11 @@ static void mark_reg_unknown(struct bpf_verifier_env *env,
                        __mark_reg_not_init(regs + regno);
                return;
        }
-        __mark_reg_unknown(regs + regno);
+        regs += regno;
+        __mark_reg_unknown(regs);
+        /* constant backtracking is enabled for root without bpf2bpf calls */
+        regs->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ?
+                        true : false;
 }
 static void __mark_reg_not_init(struct bpf_reg_state *reg)
diff --git a/kernel/configs.c b/kernel/configs.c
index b062425ccf8d..c09ea4c995e1 100644
--- a/kernel/configs.c
+++ b/kernel/configs.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /*
 * kernel/configs.c
 * Echo the kernel .config file used to build the kernel
@@ -6,21 +7,6 @@
 * Copyright (C) 2002 Randy Dunlap <rdunlap@xenotime.net>
 * Copyright (C) 2002 Al Stone <ahs3@fc.hp.com>
 * Copyright (C) 2002 Hewlett-Packard Company
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- * NON INFRINGEMENT.  See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 #include <linux/kernel.h>
diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
index 2bd410f934b3..69cfb4345388 100644
--- a/kernel/dma/contiguous.c
+++ b/kernel/dma/contiguous.c
@@ -230,9 +230,7 @@ bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 */
 struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t gfp)
 {
-        int node = dev ? dev_to_node(dev) : NUMA_NO_NODE;
+        size_t count = size >> PAGE_SHIFT;
-        size_t count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        size_t align = get_order(PAGE_ALIGN(size));
        struct page *page = NULL;
        struct cma *cma = NULL;
@@ -243,14 +241,12 @@ struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t gfp)
        /* CMA can be used only in the context which permits sleeping */
        if (cma && gfpflags_allow_blocking(gfp)) {
+                size_t align = get_order(size);
                size_t cma_align = min_t(size_t, align, CONFIG_CMA_ALIGNMENT);
                page = cma_alloc(cma, count, cma_align, gfp & __GFP_NOWARN);
        }
-        /* Fallback allocation of normal pages */
-        if (!page)
-                page = alloc_pages_node(node, gfp, align);
        return page;
 }
diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
index 59bdceea3737..706113c6bebc 100644
--- a/kernel/dma/direct.c
+++ b/kernel/dma/direct.c
@@ -47,9 +47,6 @@ u64 dma_direct_get_required_mask(struct device *dev)
 {
        u64 max_dma = phys_to_dma_direct(dev, (max_pfn - 1) << PAGE_SHIFT);
-        if (dev->bus_dma_mask && dev->bus_dma_mask < max_dma)
-                max_dma = dev->bus_dma_mask;
        return (1ULL << (fls64(max_dma) - 1)) * 2 - 1;
 }
@@ -88,6 +85,8 @@ static bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size)
 struct page *__dma_direct_alloc_pages(struct device *dev, size_t size,
                dma_addr_t *dma_handle, gfp_t gfp, unsigned long attrs)
 {
+        size_t alloc_size = PAGE_ALIGN(size);
+        int node = dev_to_node(dev);
        struct page *page = NULL;
        u64 phys_mask;
@@ -98,8 +97,14 @@ struct page *__dma_direct_alloc_pages(struct device *dev, size_t size,
        gfp &= ~__GFP_ZERO;
        gfp |= __dma_direct_optimal_gfp_mask(dev, dev->coherent_dma_mask,
                        &phys_mask);
+        page = dma_alloc_contiguous(dev, alloc_size, gfp);
+        if (page && !dma_coherent_ok(dev, page_to_phys(page), size)) {
+                dma_free_contiguous(dev, page, alloc_size);
+                page = NULL;
+        }
 again:
-        page = dma_alloc_contiguous(dev, size, gfp);
+        if (!page)
+                page = alloc_pages_node(node, gfp, get_order(alloc_size));
        if (page && !dma_coherent_ok(dev, page_to_phys(page), size)) {
                dma_free_contiguous(dev, page, size);
                page = NULL;
@@ -130,10 +135,12 @@ void *dma_direct_alloc_pages(struct device *dev, size_t size,
        if (!page)
                return NULL;
-        if (attrs & DMA_ATTR_NO_KERNEL_MAPPING) {
+        if ((attrs & DMA_ATTR_NO_KERNEL_MAPPING) &&
+            !force_dma_unencrypted(dev)) {
                /* remove any dirty cache lines on the kernel alias */
                if (!PageHighMem(page))
                        arch_dma_prep_coherent(page, size);
+                *dma_handle = phys_to_dma(dev, page_to_phys(page));
                /* return the page pointer as the opaque cookie */
                return page;
        }
@@ -178,7 +185,8 @@ void dma_direct_free_pages(struct device *dev, size_t size, void *cpu_addr,
 {
        unsigned int page_order = get_order(size);
-        if (attrs & DMA_ATTR_NO_KERNEL_MAPPING) {
+        if ((attrs & DMA_ATTR_NO_KERNEL_MAPPING) &&
+            !force_dma_unencrypted(dev)) {
                /* cpu_addr is a struct page cookie, not a kernel address */
                __dma_direct_free_pages(dev, size, cpu_addr);
                return;
diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
index b945239621d8..b0038ca3aa92 100644
--- a/kernel/dma/mapping.c
+++ b/kernel/dma/mapping.c
@@ -150,6 +150,23 @@ int dma_get_sgtable_attrs(struct device *dev, struct sg_table *sgt,
 }
 EXPORT_SYMBOL(dma_get_sgtable_attrs);
+#ifdef CONFIG_MMU
+/*
+ * Return the page attributes used for mapping dma_alloc_* memory, either in
+ * kernel space if remapping is needed, or to userspace through dma_mmap_*.
+ */
+pgprot_t dma_pgprot(struct device *dev, pgprot_t prot, unsigned long attrs)
+{
+        if (dev_is_dma_coherent(dev) ||
+            (IS_ENABLED(CONFIG_DMA_NONCOHERENT_CACHE_SYNC) &&
+             (attrs & DMA_ATTR_NON_CONSISTENT)))
+                return prot;
+        if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_MMAP_PGPROT))
+                return arch_dma_mmap_pgprot(dev, prot, attrs);
+        return pgprot_noncached(prot);
+}
+#endif /* CONFIG_MMU */
 /*
 * Create userspace mapping for the DMA-coherent memory.
 */
@@ -164,7 +181,7 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
        unsigned long pfn;
        int ret = -ENXIO;
-        vma->vm_page_prot = arch_dma_mmap_pgprot(dev, vma->vm_page_prot, attrs);
+        vma->vm_page_prot = dma_pgprot(dev, vma->vm_page_prot, attrs);
        if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                return ret;
diff --git a/kernel/dma/remap.c b/kernel/dma/remap.c
index a594aec07882..ffe78f0b2fe4 100644
--- a/kernel/dma/remap.c
+++ b/kernel/dma/remap.c
@@ -218,7 +218,7 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
        /* create a coherent mapping */
        ret = dma_common_contiguous_remap(page, size, VM_USERMAP,
-                        arch_dma_mmap_pgprot(dev, PAGE_KERNEL, attrs),
+                        dma_pgprot(dev, PAGE_KERNEL, attrs),
                        __builtin_return_address(0));
        if (!ret) {
                __dma_direct_free_pages(dev, size, page);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 9484e88dabc2..9be995fc3c5a 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -295,6 +295,18 @@ static void irq_sysfs_add(int irq, struct irq_desc *desc)
        }
 }
+static void irq_sysfs_del(struct irq_desc *desc)
+{
+        /*
+         * If irq_sysfs_init() has not yet been invoked (early boot), then
+         * irq_kobj_base is NULL and the descriptor was never added.
+         * kobject_del() complains about a object with no parent, so make
+         * it conditional.
+         */
+        if (irq_kobj_base)
+                kobject_del(&desc->kobj);
+}
 static int __init irq_sysfs_init(void)
 {
        struct irq_desc *desc;
@@ -325,6 +337,7 @@ static struct kobj_type irq_kobj_type = {
 };
 static void irq_sysfs_add(int irq, struct irq_desc *desc) {}
+static void irq_sysfs_del(struct irq_desc *desc) {}
 #endif /* CONFIG_SYSFS */
@@ -438,7 +451,7 @@ static void free_desc(unsigned int irq)
         * The sysfs entry must be serialized against a concurrent
         * irq_sysfs_init() as well.
         */
-        kobject_del(&desc->kobj);
+        irq_sysfs_del(desc);
        delete_irq_desc(irq);
        /*
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 95a260f9214b..136ce049c4ad 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -263,8 +263,10 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize,
 {
        char namebuf[KSYM_NAME_LEN];
-        if (is_ksym_addr(addr))
+        if (is_ksym_addr(addr)) {
-                return !!get_symbol_pos(addr, symbolsize, offset);
+                get_symbol_pos(addr, symbolsize, offset);
+                return 1;
+        }
        return !!module_address_lookup(addr, symbolsize, offset, NULL, namebuf) ||
               !!__bpf_address_lookup(addr, symbolsize, offset, namebuf);
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9873fc627d61..d9770a5393c8 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -470,6 +470,7 @@ static DECLARE_DELAYED_WORK(optimizing_work, kprobe_optimizer);
 */
 static void do_optimize_kprobes(void)
 {
+        lockdep_assert_held(&text_mutex);
        /*
         * The optimization/unoptimization refers online_cpus via
         * stop_machine() and cpu-hotplug modifies online_cpus.
@@ -487,9 +488,7 @@ static void do_optimize_kprobes(void)
            list_empty(&optimizing_list))
                return;
-        mutex_lock(&text_mutex);
        arch_optimize_kprobes(&optimizing_list);
-        mutex_unlock(&text_mutex);
 }
 /*
@@ -500,6 +499,7 @@ static void do_unoptimize_kprobes(void)
 {
        struct optimized_kprobe *op, *tmp;
+        lockdep_assert_held(&text_mutex);
        /* See comment in do_optimize_kprobes() */
        lockdep_assert_cpus_held();
@@ -507,7 +507,6 @@ static void do_unoptimize_kprobes(void)
        if (list_empty(&unoptimizing_list))
                return;
-        mutex_lock(&text_mutex);
        arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
        /* Loop free_list for disarming */
        list_for_each_entry_safe(op, tmp, &freeing_list, list) {
@@ -524,7 +523,6 @@ static void do_unoptimize_kprobes(void)
                } else
                        list_del_init(&op->list);
        }
-        mutex_unlock(&text_mutex);
 }
 /* Reclaim all kprobes on the free_list */
@@ -556,6 +554,7 @@ static void kprobe_optimizer(struct work_struct *work)
 {
        mutex_lock(&kprobe_mutex);
        cpus_read_lock();
+        mutex_lock(&text_mutex);
        /* Lock modules while optimizing kprobes */
        mutex_lock(&module_mutex);
@@ -583,6 +582,7 @@ static void kprobe_optimizer(struct work_struct *work)
        do_free_cleaned_kprobes();
        mutex_unlock(&module_mutex);
+        mutex_unlock(&text_mutex);
        cpus_read_unlock();
        mutex_unlock(&kprobe_mutex);
diff --git a/kernel/module.c b/kernel/module.c
index 5933395af9a0..9ee93421269c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -65,9 +65,9 @@
 /*
 * Modules' sections will be aligned on page boundaries
 * to ensure complete separation of code and data, but
- * only when CONFIG_STRICT_MODULE_RWX=y
+ * only when CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
 */
-#ifdef CONFIG_STRICT_MODULE_RWX
+#ifdef CONFIG_ARCH_HAS_STRICT_MODULE_RWX
 # define debug_align(X) ALIGN(X, PAGE_SIZE)
 #else
 # define debug_align(X) (X)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2b037f195473..010d578118d6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3904,7 +3904,7 @@ void __noreturn do_task_dead(void)
 static inline void sched_submit_work(struct task_struct *tsk)
 {
-        if (!tsk->state || tsk_is_pi_blocked(tsk))
+        if (!tsk->state)
                return;
        /*
@@ -3920,6 +3920,9 @@ static inline void sched_submit_work(struct task_struct *tsk)
                preempt_enable_no_resched();
        }
+        if (tsk_is_pi_blocked(tsk))
+                return;
        /*
         * If we are going to sleep and we have plugged IO queued,
         * make sure to submit it to avoid deadlocks.
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 636ca6f88c8e..867b4bb6d4be 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -40,6 +40,7 @@ struct sugov_policy {
        struct task_struct      *thread;
        bool                    work_in_progress;
+        bool                    limits_changed;
        bool                    need_freq_update;
 };
@@ -89,8 +90,11 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
            !cpufreq_this_cpu_can_update(sg_policy->policy))
                return false;
-        if (unlikely(sg_policy->need_freq_update))
+        if (unlikely(sg_policy->limits_changed)) {
+                sg_policy->limits_changed = false;
+                sg_policy->need_freq_update = true;
                return true;
+        }
        delta_ns = time - sg_policy->last_freq_update_time;
@@ -437,7 +441,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
 static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
 {
        if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
-                sg_policy->need_freq_update = true;
+                sg_policy->limits_changed = true;
 }
 static void sugov_update_single(struct update_util_data *hook, u64 time,
@@ -457,7 +461,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
        if (!sugov_should_update_freq(sg_policy, time))
                return;
-        busy = sugov_cpu_is_busy(sg_cpu);
+        /* Limits may have changed, don't skip frequency update */
+        busy = !sg_policy->need_freq_update && sugov_cpu_is_busy(sg_cpu);
        util = sugov_get_util(sg_cpu);
        max = sg_cpu->max;
@@ -831,6 +836,7 @@ static int sugov_start(struct cpufreq_policy *policy)
        sg_policy->last_freq_update_time        = 0;
        sg_policy->next_freq                    = 0;
        sg_policy->work_in_progress             = false;
+        sg_policy->limits_changed               = false;
        sg_policy->need_freq_update             = false;
        sg_policy->cached_raw_freq              = 0;
@@ -879,7 +885,7 @@ static void sugov_limits(struct cpufreq_policy *policy)
                mutex_unlock(&sg_policy->work_lock);
        }
-        sg_policy->need_freq_update = true;
+        sg_policy->limits_changed = true;
 }
 struct cpufreq_governor schedutil_gov = {
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 23fbbcc414d5..6e52b67b420e 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1131,7 +1131,15 @@ static void psi_trigger_destroy(struct kref *ref)
         * deadlock while waiting for psi_poll_work to acquire trigger_lock
         */
        if (kworker_to_destroy) {
+                /*
+                 * After the RCU grace period has expired, the worker
+                 * can no longer be found through group->poll_kworker.
+                 * But it might have been already scheduled before
+                 * that - deschedule it cleanly before destroying it.
+                 */
                kthread_cancel_delayed_work_sync(&group->poll_work);
+                atomic_set(&group->poll_scheduled, 0);
                kthread_destroy_worker(kworker_to_destroy);
        }
        kfree(t);
diff --git a/kernel/signal.c b/kernel/signal.c
index e667be6907d7..534fec266a33 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -90,6 +90,11 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
            handler == SIG_DFL && !(force && sig_kernel_only(sig)))
                return true;
+        /* Only allow kernel generated signals to this kthread */
+        if (unlikely((t->flags & PF_KTHREAD) &&
+                     (handler == SIG_KTHREAD_KERNEL) && !force))
+                return true;
        return sig_handler_ignored(handler, sig);
 }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index d911c8470149..ca69290bee2a 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -146,6 +146,11 @@ static void tk_set_wall_to_mono(struct timekeeper *tk, struct timespec64 wtm)
 static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
 {
        tk->offs_boot = ktime_add(tk->offs_boot, delta);
+        /*
+         * Timespec representation for VDSO update to avoid 64bit division
+         * on every update.
+         */
+        tk->monotonic_to_boot = ktime_to_timespec64(tk->offs_boot);
 }
 /*
diff --git a/kernel/time/vsyscall.c b/kernel/time/vsyscall.c
index 8cf3596a4ce6..4bc37ac3bb05 100644
--- a/kernel/time/vsyscall.c
+++ b/kernel/time/vsyscall.c
@@ -17,7 +17,7 @@ static inline void update_vdso_data(struct vdso_data *vdata,
                                    struct timekeeper *tk)
 {
        struct vdso_timestamp *vdso_ts;
-        u64 nsec;
+        u64 nsec, sec;
        vdata[CS_HRES_COARSE].cycle_last        = tk->tkr_mono.cycle_last;
        vdata[CS_HRES_COARSE].mask              = tk->tkr_mono.mask;
@@ -45,23 +45,27 @@ static inline void update_vdso_data(struct vdso_data *vdata,
        }
        vdso_ts->nsec   = nsec;
-        /* CLOCK_MONOTONIC_RAW */
+        /* Copy MONOTONIC time for BOOTTIME */
-        vdso_ts         = &vdata[CS_RAW].basetime[CLOCK_MONOTONIC_RAW];
+        sec     = vdso_ts->sec;
-        vdso_ts->sec    = tk->raw_sec;
+        /* Add the boot offset */
-        vdso_ts->nsec   = tk->tkr_raw.xtime_nsec;
+        sec     += tk->monotonic_to_boot.tv_sec;
+        nsec    += (u64)tk->monotonic_to_boot.tv_nsec << tk->tkr_mono.shift;
        /* CLOCK_BOOTTIME */
        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_BOOTTIME];
-        vdso_ts->sec    = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+        vdso_ts->sec    = sec;
-        nsec = tk->tkr_mono.xtime_nsec;
-        nsec += ((u64)(tk->wall_to_monotonic.tv_nsec +
-                       ktime_to_ns(tk->offs_boot)) << tk->tkr_mono.shift);
        while (nsec >= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift)) {
                nsec -= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift);
                vdso_ts->sec++;
        }
        vdso_ts->nsec   = nsec;
+        /* CLOCK_MONOTONIC_RAW */
+        vdso_ts         = &vdata[CS_RAW].basetime[CLOCK_MONOTONIC_RAW];
+        vdso_ts->sec    = tk->raw_sec;
+        vdso_ts->nsec   = tk->tkr_raw.xtime_nsec;
        /* CLOCK_TAI */
        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_TAI];
        vdso_ts->sec    = tk->xtime_sec + (s64)tk->tai_offset;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index eca34503f178..f9821a3374e9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3095,6 +3095,14 @@ t_probe_next(struct seq_file *m, loff_t *pos)
                hnd = &iter->probe_entry->hlist;
        hash = iter->probe->ops.func_hash->filter_hash;
+        /*
+         * A probe being registered may temporarily have an empty hash
+         * and it's at the end of the func_probes list.
+         */
+        if (!hash || hash == EMPTY_HASH)
+                return NULL;
        size = 1 << hash->size_bits;
 retry:
@@ -4320,12 +4328,21 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
        mutex_unlock(&ftrace_lock);
+        /*
+         * Note, there's a small window here that the func_hash->filter_hash
+         * may be NULL or empty. Need to be carefule when reading the loop.
+         */
        mutex_lock(&probe->ops.func_hash->regex_lock);
        orig_hash = &probe->ops.func_hash->filter_hash;
        old_hash = *orig_hash;
        hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+        if (!hash) {
+                ret = -ENOMEM;
+                goto out;
+        }
        ret = ftrace_match_records(hash, glob, strlen(glob));
        /* Nothing found? */
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 525a97fbbc60..563e80f9006a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1567,9 +1567,9 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu,
 /**
 * update_max_tr_single - only copy one trace over, and reset the rest
- * @tr - tracer
+ * @tr: tracer
- * @tsk - task with the latency
+ * @tsk: task with the latency
- * @cpu - the cpu of the buffer to copy.
+ * @cpu: the cpu of the buffer to copy.
 *
 * Flip the trace of a single CPU buffer between the @tr and the max_tr.
 */
@@ -1767,7 +1767,7 @@ static void __init apply_trace_boot_options(void);
 /**
 * register_tracer - register a tracer with the ftrace system.
- * @type - the plugin for the tracer
+ * @type: the plugin for the tracer
 *
 * Register a new plugin tracer.
 */
@@ -2230,9 +2230,9 @@ static bool tracing_record_taskinfo_skip(int flags)
 /**
 * tracing_record_taskinfo - record the task info of a task
 *
- * @task  - task to record
+ * @task:  task to record
- * @flags - TRACE_RECORD_CMDLINE for recording comm
+ * @flags: TRACE_RECORD_CMDLINE for recording comm
- *        - TRACE_RECORD_TGID for recording tgid
+ *         TRACE_RECORD_TGID for recording tgid
 */
 void tracing_record_taskinfo(struct task_struct *task, int flags)
 {
@@ -2258,10 +2258,10 @@ void tracing_record_taskinfo(struct task_struct *task, int flags)
 /**
 * tracing_record_taskinfo_sched_switch - record task info for sched_switch
 *
- * @prev - previous task during sched_switch
+ * @prev: previous task during sched_switch
- * @next - next task during sched_switch
+ * @next: next task during sched_switch
- * @flags - TRACE_RECORD_CMDLINE for recording comm
+ * @flags: TRACE_RECORD_CMDLINE for recording comm
- *          TRACE_RECORD_TGID for recording tgid
+ *         TRACE_RECORD_TGID for recording tgid
 */
 void tracing_record_taskinfo_sched_switch(struct task_struct *prev,
                                          struct task_struct *next, int flags)
@@ -3072,7 +3072,9 @@ static void trace_printk_start_stop_comm(int enabled)
 /**
 * trace_vbprintk - write binary msg to tracing buffer
- *
+ * @ip:    The address of the caller
+ * @fmt:   The string format to write to the buffer
+ * @args:  Arguments for @fmt
 */
 int trace_vbprintk(unsigned long ip, const char *fmt, va_list args)
 {
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index c7506bc81b75..648930823b57 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -787,7 +787,7 @@ static int __ftrace_set_clr_event(struct trace_array *tr, const char *match,
        return ret;
 }
-static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
+int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
 {
        char *event = NULL, *sub = NULL, *match;
        int ret;
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index dbef0d135075..fb6bfbc5bf86 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -895,7 +895,8 @@ void trace_probe_cleanup(struct trace_probe *tp)
        for (i = 0; i < tp->nr_args; i++)
                traceprobe_free_probe_arg(&tp->args[i]);
-        kfree(call->class->system);
+        if (call->class)
+                kfree(call->class->system);
        kfree(call->name);
        kfree(call->print_fmt);
 }
diff --git a/lib/kfifo.c b/lib/kfifo.c
index 117ad0e7fbf4..70dab9ac7827 100644
--- a/lib/kfifo.c
+++ b/lib/kfifo.c
@@ -68,7 +68,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
 {
        size /= esize;
-        size = roundup_pow_of_two(size);
+        if (!is_power_of_2(size))
+                size = rounddown_pow_of_two(size);
        fifo->in = 0;
        fifo->out = 0;
diff --git a/lib/logic_pio.c b/lib/logic_pio.c
index feea48fd1a0d..905027574e5d 100644
--- a/lib/logic_pio.c
+++ b/lib/logic_pio.c
@@ -35,7 +35,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
        struct logic_pio_hwaddr *range;
        resource_size_t start;
        resource_size_t end;
-        resource_size_t mmio_sz = 0;
+        resource_size_t mmio_end = 0;
        resource_size_t iio_sz = MMIO_UPPER_LIMIT;
        int ret = 0;
@@ -46,7 +46,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
        end = new_range->hw_start + new_range->size;
        mutex_lock(&io_range_mutex);
-        list_for_each_entry_rcu(range, &io_range_list, list) {
+        list_for_each_entry(range, &io_range_list, list) {
                if (range->fwnode == new_range->fwnode) {
                        /* range already there */
                        goto end_register;
@@ -56,7 +56,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
                        /* for MMIO ranges we need to check for overlap */
                        if (start >= range->hw_start + range->size ||
                            end < range->hw_start) {
-                                mmio_sz += range->size;
+                                mmio_end = range->io_start + range->size;
                        } else {
                                ret = -EFAULT;
                                goto end_register;
@@ -69,16 +69,16 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
        /* range not registered yet, check for available space */
        if (new_range->flags == LOGIC_PIO_CPU_MMIO) {
-                if (mmio_sz + new_range->size - 1 > MMIO_UPPER_LIMIT) {
+                if (mmio_end + new_range->size - 1 > MMIO_UPPER_LIMIT) {
                        /* if it's too big check if 64K space can be reserved */
-                        if (mmio_sz + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
+                        if (mmio_end + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
                                ret = -E2BIG;
                                goto end_register;
                        }
                        new_range->size = SZ_64K;
                        pr_warn("Requested IO range too big, new size set to 64K\n");
                }
-                new_range->io_start = mmio_sz;
+                new_range->io_start = mmio_end;
        } else if (new_range->flags == LOGIC_PIO_INDIRECT) {
                if (iio_sz + new_range->size - 1 > IO_SPACE_LIMIT) {
                        ret = -E2BIG;
@@ -99,6 +99,20 @@ end_register:
 }
 /**
+ * logic_pio_unregister_range - unregister a logical PIO range for a host
+ * @range: pointer to the IO range which has been already registered.
+ *
+ * Unregister a previously-registered IO range node.
+ */
+void logic_pio_unregister_range(struct logic_pio_hwaddr *range)
+{
+        mutex_lock(&io_range_mutex);
+        list_del_rcu(&range->list);
+        mutex_unlock(&io_range_mutex);
+        synchronize_rcu();
+}
+/**
 * find_io_range_by_fwnode - find logical PIO range for given FW node
 * @fwnode: FW node handle associated with logical PIO range
 *
@@ -108,26 +122,38 @@ end_register:
 */
 struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode)
 {
-        struct logic_pio_hwaddr *range;
+        struct logic_pio_hwaddr *range, *found_range = NULL;
+        rcu_read_lock();
        list_for_each_entry_rcu(range, &io_range_list, list) {
-                if (range->fwnode == fwnode)
+                if (range->fwnode == fwnode) {
-                        return range;
+                        found_range = range;
+                        break;
+                }
        }
-        return NULL;
+        rcu_read_unlock();
+        return found_range;
 }
 /* Return a registered range given an input PIO token */
 static struct logic_pio_hwaddr *find_io_range(unsigned long pio)
 {
-        struct logic_pio_hwaddr *range;
+        struct logic_pio_hwaddr *range, *found_range = NULL;
+        rcu_read_lock();
        list_for_each_entry_rcu(range, &io_range_list, list) {
-                if (in_range(pio, range->io_start, range->size))
+                if (in_range(pio, range->io_start, range->size)) {
-                        return range;
+                        found_range = range;
+                        break;
+                }
        }
-        pr_err("PIO entry token %lx invalid\n", pio);
+        rcu_read_unlock();
-        return NULL;
+        if (!found_range)
+                pr_err("PIO entry token 0x%lx invalid\n", pio);
+        return found_range;
 }
 /**
@@ -180,14 +206,23 @@ unsigned long logic_pio_trans_cpuaddr(resource_size_t addr)
 {
        struct logic_pio_hwaddr *range;
+        rcu_read_lock();
        list_for_each_entry_rcu(range, &io_range_list, list) {
                if (range->flags != LOGIC_PIO_CPU_MMIO)
                        continue;
-                if (in_range(addr, range->hw_start, range->size))
+                if (in_range(addr, range->hw_start, range->size)) {
-                        return addr - range->hw_start + range->io_start;
+                        unsigned long cpuaddr;
+                        cpuaddr = addr - range->hw_start + range->io_start;
+                        rcu_read_unlock();
+                        return cpuaddr;
+                }
        }
-        pr_err("addr %llx not registered in io_range_list\n",
+        rcu_read_unlock();
-               (unsigned long long) addr);
+        pr_err("addr %pa not registered in io_range_list\n", &addr);
        return ~0UL;
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1334ede667a8..de1f15969e27 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
 #include <linux/shmem_fs.h>
 #include <linux/oom.h>
 #include <linux/numa.h>
+#include <linux/page_owner.h>
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -644,30 +645,40 @@ release:
 *          available
 * never: never stall for any thp allocation
 */
-static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma)
+static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma, unsigned long addr)
 {
        const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE);
+        gfp_t this_node = 0;
+#ifdef CONFIG_NUMA
+        struct mempolicy *pol;
+        /*
+         * __GFP_THISNODE is used only when __GFP_DIRECT_RECLAIM is not
+         * specified, to express a general desire to stay on the current
+         * node for optimistic allocation attempts. If the defrag mode
+         * and/or madvise hint requires the direct reclaim then we prefer
+         * to fallback to other node rather than node reclaim because that
+         * can lead to excessive reclaim even though there is free memory
+         * on other nodes. We expect that NUMA preferences are specified
+         * by memory policies.
+         */
+        pol = get_vma_policy(vma, addr);
+        if (pol->mode != MPOL_BIND)
+                this_node = __GFP_THISNODE;
+        mpol_cond_put(pol);
+#endif
-        /* Always do synchronous compaction */
        if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
                return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY);
-        /* Kick kcompactd and fail quickly */
        if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM;
+                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM | this_node;
-        /* Synchronous compaction if madvised, otherwise kick kcompactd */
        if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT |
+                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                        (vma_madvised ? __GFP_DIRECT_RECLAIM :
+                                                             __GFP_KSWAPD_RECLAIM | this_node);
-                                        __GFP_KSWAPD_RECLAIM);
-        /* Only do synchronous compaction if madvised */
        if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT |
+                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                       (vma_madvised ? __GFP_DIRECT_RECLAIM : 0);
+                                                             this_node);
+        return GFP_TRANSHUGE_LIGHT | this_node;
-        return GFP_TRANSHUGE_LIGHT;
 }
 /* Caller must hold page table lock. */
@@ -739,8 +750,8 @@ vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                        pte_free(vma->vm_mm, pgtable);
                return ret;
        }
-        gfp = alloc_hugepage_direct_gfpmask(vma);
+        gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
-        page = alloc_hugepage_vma(gfp, vma, haddr, HPAGE_PMD_ORDER);
+        page = alloc_pages_vma(gfp, HPAGE_PMD_ORDER, vma, haddr, numa_node_id());
        if (unlikely(!page)) {
                count_vm_event(THP_FAULT_FALLBACK);
                return VM_FAULT_FALLBACK;
@@ -1347,8 +1358,9 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd)
 alloc:
        if (__transparent_hugepage_enabled(vma) &&
            !transparent_hugepage_debug_cow()) {
-                huge_gfp = alloc_hugepage_direct_gfpmask(vma);
+                huge_gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
-                new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
+                new_page = alloc_pages_vma(huge_gfp, HPAGE_PMD_ORDER, vma,
+                                haddr, numa_node_id());
        } else
                new_page = NULL;
@@ -2505,6 +2517,9 @@ static void __split_huge_page(struct page *page, struct list_head *list,
        }
        ClearPageCompound(head);
+        split_page_owner(head, HPAGE_PMD_ORDER);
        /* See comment in __split_huge_page_tail() */
        if (PageAnon(head)) {
                /* Additional pin to swap cache */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ede7e7f5d1ab..6d7296dd11b8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3856,6 +3856,25 @@ retry:
                page = alloc_huge_page(vma, haddr, 0);
                if (IS_ERR(page)) {
+                        /*
+                         * Returning error will result in faulting task being
+                         * sent SIGBUS.  The hugetlb fault mutex prevents two
+                         * tasks from racing to fault in the same page which
+                         * could result in false unable to allocate errors.
+                         * Page migration does not take the fault mutex, but
+                         * does a clear then write of pte's under page table
+                         * lock.  Page fault code could race with migration,
+                         * notice the clear pte and try to allocate a page
+                         * here.  Before returning error, get ptl and make
+                         * sure there really is no pte entry.
+                         */
+                        ptl = huge_pte_lock(h, mm, ptep);
+                        if (!huge_pte_none(huge_ptep_get(ptep))) {
+                                ret = 0;
+                                spin_unlock(ptl);
+                                goto out;
+                        }
+                        spin_unlock(ptl);
                        ret = vmf_error(PTR_ERR(page));
                        goto out;
                }
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 2277b82902d8..95d16a42db6b 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -407,8 +407,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
        if (IS_ENABLED(CONFIG_KASAN_GENERIC))
                return shadow_byte < 0 ||
                        shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
-        else
-                return tag != (u8)shadow_byte;
+        /* else CONFIG_KASAN_SW_TAGS: */
+        if ((u8)shadow_byte == KASAN_TAG_INVALID)
+                return true;
+        if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
+                return true;
+        return false;
 }
 static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 6e9e8cca663e..f6e602918dac 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1966,6 +1966,7 @@ static void kmemleak_disable(void)
        /* stop any memory operation tracing */
        kmemleak_enabled = 0;
+        kmemleak_early_log = 0;
        /* check whether it is too early for a kernel thread */
        if (kmemleak_initialized)
@@ -2009,7 +2010,6 @@ void __init kmemleak_init(void)
 #ifdef CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF
        if (!kmemleak_skip_disable) {
-                kmemleak_early_log = 0;
                kmemleak_disable();
                return;
        }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index cdbb7a84cb6e..9ec5e12486a7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -752,15 +752,13 @@ void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
        /* Update memcg */
        __mod_memcg_state(memcg, idx, val);
+        /* Update lruvec */
+        __this_cpu_add(pn->lruvec_stat_local->count[idx], val);
        x = val + __this_cpu_read(pn->lruvec_stat_cpu->count[idx]);
        if (unlikely(abs(x) > MEMCG_CHARGE_BATCH)) {
                struct mem_cgroup_per_node *pi;
-                /*
-                 * Batch local counters to keep them in sync with
-                 * the hierarchical ones.
-                 */
-                __this_cpu_add(pn->lruvec_stat_local->count[idx], x);
                for (pi = pn; pi; pi = parent_nodeinfo(pi, pgdat->node_id))
                        atomic_long_add(x, &pi->lruvec_stat[idx]);
                x = 0;
@@ -768,6 +766,26 @@ void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
        __this_cpu_write(pn->lruvec_stat_cpu->count[idx], x);
 }
+void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val)
+{
+        struct page *page = virt_to_head_page(p);
+        pg_data_t *pgdat = page_pgdat(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
+        rcu_read_lock();
+        memcg = memcg_from_slab_page(page);
+        /* Untracked pages have no memcg, no lruvec. Update only the node */
+        if (!memcg || memcg == root_mem_cgroup) {
+                __mod_node_page_state(pgdat, idx, val);
+        } else {
+                lruvec = mem_cgroup_lruvec(pgdat, memcg);
+                __mod_lruvec_state(lruvec, idx, val);
+        }
+        rcu_read_unlock();
+}
 /**
 * __count_memcg_events - account VM events in a cgroup
 * @memcg: the memory cgroup
@@ -1130,26 +1148,45 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
                css_put(&prev->css);
 }
-static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+static void __invalidate_reclaim_iterators(struct mem_cgroup *from,
+                                        struct mem_cgroup *dead_memcg)
 {
-        struct mem_cgroup *memcg = dead_memcg;
        struct mem_cgroup_reclaim_iter *iter;
        struct mem_cgroup_per_node *mz;
        int nid;
        int i;
-        for (; memcg; memcg = parent_mem_cgroup(memcg)) {
+        for_each_node(nid) {
-                for_each_node(nid) {
+                mz = mem_cgroup_nodeinfo(from, nid);
-                        mz = mem_cgroup_nodeinfo(memcg, nid);
+                for (i = 0; i <= DEF_PRIORITY; i++) {
-                        for (i = 0; i <= DEF_PRIORITY; i++) {
+                        iter = &mz->iter[i];
-                                iter = &mz->iter[i];
+                        cmpxchg(&iter->position,
-                                cmpxchg(&iter->position,
+                                dead_memcg, NULL);
-                                        dead_memcg, NULL);
-                        }
                }
        }
 }
+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+{
+        struct mem_cgroup *memcg = dead_memcg;
+        struct mem_cgroup *last;
+        do {
+                __invalidate_reclaim_iterators(memcg, dead_memcg);
+                last = memcg;
+        } while ((memcg = parent_mem_cgroup(memcg)));
+        /*
+         * When cgruop1 non-hierarchy mode is used,
+         * parent_mem_cgroup() does not walk all the way up to the
+         * cgroup root (root_mem_cgroup). So we have to handle
+         * dead_memcg from cgroup root separately.
+         */
+        if (last != root_mem_cgroup)
+                __invalidate_reclaim_iterators(root_mem_cgroup,
+                                                dead_memcg);
+}
 /**
 * mem_cgroup_scan_tasks - iterate over tasks of a memory cgroup hierarchy
 * @memcg: hierarchy root
@@ -3221,6 +3258,72 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
        }
 }
+static void memcg_flush_percpu_vmstats(struct mem_cgroup *memcg, bool slab_only)
+{
+        unsigned long stat[MEMCG_NR_STAT];
+        struct mem_cgroup *mi;
+        int node, cpu, i;
+        int min_idx, max_idx;
+        if (slab_only) {
+                min_idx = NR_SLAB_RECLAIMABLE;
+                max_idx = NR_SLAB_UNRECLAIMABLE;
+        } else {
+                min_idx = 0;
+                max_idx = MEMCG_NR_STAT;
+        }
+        for (i = min_idx; i < max_idx; i++)
+                stat[i] = 0;
+        for_each_online_cpu(cpu)
+                for (i = min_idx; i < max_idx; i++)
+                        stat[i] += per_cpu(memcg->vmstats_percpu->stat[i], cpu);
+        for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+                for (i = min_idx; i < max_idx; i++)
+                        atomic_long_add(stat[i], &mi->vmstats[i]);
+        if (!slab_only)
+                max_idx = NR_VM_NODE_STAT_ITEMS;
+        for_each_node(node) {
+                struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
+                struct mem_cgroup_per_node *pi;
+                for (i = min_idx; i < max_idx; i++)
+                        stat[i] = 0;
+                for_each_online_cpu(cpu)
+                        for (i = min_idx; i < max_idx; i++)
+                                stat[i] += per_cpu(
+                                        pn->lruvec_stat_cpu->count[i], cpu);
+                for (pi = pn; pi; pi = parent_nodeinfo(pi, node))
+                        for (i = min_idx; i < max_idx; i++)
+                                atomic_long_add(stat[i], &pi->lruvec_stat[i]);
+        }
+}
+static void memcg_flush_percpu_vmevents(struct mem_cgroup *memcg)
+{
+        unsigned long events[NR_VM_EVENT_ITEMS];
+        struct mem_cgroup *mi;
+        int cpu, i;
+        for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+                events[i] = 0;
+        for_each_online_cpu(cpu)
+                for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+                        events[i] += per_cpu(memcg->vmstats_percpu->events[i],
+                                             cpu);
+        for (mi = memcg; mi; mi = parent_mem_cgroup(mi))
+                for (i = 0; i < NR_VM_EVENT_ITEMS; i++)
+                        atomic_long_add(events[i], &mi->vmevents[i]);
+}
 #ifdef CONFIG_MEMCG_KMEM
 static int memcg_online_kmem(struct mem_cgroup *memcg)
 {
@@ -3270,7 +3373,14 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
        if (!parent)
                parent = root_mem_cgroup;
+        /*
+         * Deactivate and reparent kmem_caches. Then flush percpu
+         * slab statistics to have precise values at the parent and
+         * all ancestor levels. It's required to keep slab stats
+         * accurate after the reparenting of kmem_caches.
+         */
        memcg_deactivate_kmem_caches(memcg, parent);
+        memcg_flush_percpu_vmstats(memcg, true);
        kmemcg_id = memcg->kmemcg_id;
        BUG_ON(kmemcg_id < 0);
@@ -4643,6 +4753,12 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
        int node;
+        /*
+         * Flush percpu vmstats and vmevents to guarantee the value correctness
+         * on parent's and all ancestor levels.
+         */
+        memcg_flush_percpu_vmstats(memcg, false);
+        memcg_flush_percpu_vmevents(memcg);
        for_each_node(node)
                free_mem_cgroup_per_node_info(memcg, node);
        free_percpu(memcg->vmstats_percpu);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index f48693f75b37..65e0874fce17 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -403,7 +403,7 @@ static const struct mempolicy_operations mpol_ops[MPOL_MAX] = {
        },
 };
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                unsigned long flags);
 struct queue_pages {
@@ -429,11 +429,14 @@ static inline bool queue_pages_required(struct page *page,
 }
 /*
- * queue_pages_pmd() has three possible return values:
+ * queue_pages_pmd() has four possible return values:
- * 1 - pages are placed on the right node or queued successfully.
+ * 0 - pages are placed on the right node or queued successfully.
- * 0 - THP was split.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
- * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
+ *     specified.
- *        page was already on a node that does not follow the policy.
+ * 2 - THP was split.
+ * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an
+ *        existing page was already on a node that does not follow the
+ *        policy.
 */
 static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
                                unsigned long end, struct mm_walk *walk)
@@ -451,23 +454,20 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
        if (is_huge_zero_page(page)) {
                spin_unlock(ptl);
                __split_huge_pmd(walk->vma, pmd, addr, false, NULL);
+                ret = 2;
                goto out;
        }
-        if (!queue_pages_required(page, qp)) {
+        if (!queue_pages_required(page, qp))
-                ret = 1;
                goto unlock;
-        }
-        ret = 1;
        flags = qp->flags;
        /* go to thp migration */
        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-                if (!vma_migratable(walk->vma)) {
+                if (!vma_migratable(walk->vma) ||
-                        ret = -EIO;
+                    migrate_page_add(page, qp->pagelist, flags)) {
+                        ret = 1;
                        goto unlock;
                }
-                migrate_page_add(page, qp->pagelist, flags);
        } else
                ret = -EIO;
 unlock:
@@ -479,6 +479,13 @@ out:
 /*
 * Scan through pages checking if pages follow certain conditions,
 * and move them to the pagelist if they do.
+ *
+ * queue_pages_pte_range() has three possible return values:
+ * 0 - pages are placed on the right node or queued successfully.
+ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * -EIO - only MPOL_MF_STRICT was specified and an existing page was already
+ *        on a node that does not follow the policy.
 */
 static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
                        unsigned long end, struct mm_walk *walk)
@@ -488,17 +495,17 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
        struct queue_pages *qp = walk->private;
        unsigned long flags = qp->flags;
        int ret;
+        bool has_unmovable = false;
        pte_t *pte;
        spinlock_t *ptl;
        ptl = pmd_trans_huge_lock(pmd, vma);
        if (ptl) {
                ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
-                if (ret > 0)
+                if (ret != 2)
-                        return 0;
-                else if (ret < 0)
                        return ret;
        }
+        /* THP was split, fall through to pte walk */
        if (pmd_trans_unstable(pmd))
                return 0;
@@ -519,14 +526,28 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
                if (!queue_pages_required(page, qp))
                        continue;
                if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
-                        if (!vma_migratable(vma))
+                        /* MPOL_MF_STRICT must be specified if we get here */
+                        if (!vma_migratable(vma)) {
+                                has_unmovable = true;
                                break;
-                        migrate_page_add(page, qp->pagelist, flags);
+                        }
+                        /*
+                         * Do not abort immediately since there may be
+                         * temporary off LRU pages in the range.  Still
+                         * need migrate other LRU pages.
+                         */
+                        if (migrate_page_add(page, qp->pagelist, flags))
+                                has_unmovable = true;
                } else
                        break;
        }
        pte_unmap_unlock(pte - 1, ptl);
        cond_resched();
+        if (has_unmovable)
+                return 1;
        return addr != end ? -EIO : 0;
 }
@@ -639,7 +660,13 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
 *
 * If pages found in a given range are on a set of nodes (determined by
 * @nodes and @flags,) it's isolated and queued to the pagelist which is
- * passed via @private.)
+ * passed via @private.
+ *
+ * queue_pages_range() has three possible return values:
+ * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ *     specified.
+ * 0 - queue pages successfully or no misplaced page.
+ * -EIO - there is misplaced page and only MPOL_MF_STRICT was specified.
 */
 static int
 queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
@@ -940,7 +967,7 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
 /*
 * page migration, thp tail pages can be passed.
 */
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                unsigned long flags)
 {
        struct page *head = compound_head(page);
@@ -953,8 +980,19 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
                        mod_node_page_state(page_pgdat(head),
                                NR_ISOLATED_ANON + page_is_file_cache(head),
                                hpage_nr_pages(head));
+                } else if (flags & MPOL_MF_STRICT) {
+                        /*
+                         * Non-movable page may reach here.  And, there may be
+                         * temporary off LRU pages or non-LRU movable pages.
+                         * Treat them as unmovable pages since they can't be
+                         * isolated, so they can't be moved at the moment.  It
+                         * should return -EIO for this case too.
+                         */
+                        return -EIO;
                }
        }
+        return 0;
 }
 /* page allocation callback for NUMA node migration */
@@ -1142,8 +1180,8 @@ static struct page *new_page(struct page *page, unsigned long start)
        } else if (PageTransHuge(page)) {
                struct page *thp;
-                thp = alloc_hugepage_vma(GFP_TRANSHUGE, vma, address,
+                thp = alloc_pages_vma(GFP_TRANSHUGE, HPAGE_PMD_ORDER, vma,
-                                         HPAGE_PMD_ORDER);
+                                address, numa_node_id());
                if (!thp)
                        return NULL;
                prep_transhuge_page(thp);
@@ -1157,9 +1195,10 @@ static struct page *new_page(struct page *page, unsigned long start)
 }
 #else
-static void migrate_page_add(struct page *page, struct list_head *pagelist,
+static int migrate_page_add(struct page *page, struct list_head *pagelist,
                                unsigned long flags)
 {
+        return -EIO;
 }
 int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
@@ -1182,6 +1221,7 @@ static long do_mbind(unsigned long start, unsigned long len,
        struct mempolicy *new;
        unsigned long end;
        int err;
+        int ret;
        LIST_HEAD(pagelist);
        if (flags & ~(unsigned long)MPOL_MF_VALID)
@@ -1243,10 +1283,15 @@ static long do_mbind(unsigned long start, unsigned long len,
        if (err)
                goto mpol_out;
-        err = queue_pages_range(mm, start, end, nmask,
+        ret = queue_pages_range(mm, start, end, nmask,
                          flags | MPOL_MF_INVERT, &pagelist);
-        if (!err)
-                err = mbind_range(mm, start, end, new);
+        if (ret < 0) {
+                err = -EIO;
+                goto up_out;
+        }
+        err = mbind_range(mm, start, end, new);
        if (!err) {
                int nr_failed = 0;
@@ -1259,13 +1304,14 @@ static long do_mbind(unsigned long start, unsigned long len,
                                putback_movable_pages(&pagelist);
                }
-                if (nr_failed && (flags & MPOL_MF_STRICT))
+                if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))
                        err = -EIO;
        } else
                putback_movable_pages(&pagelist);
+up_out:
        up_write(&mm->mmap_sem);
- mpol_out:
+mpol_out:
        mpol_put(new);
        return err;
 }
@@ -1688,7 +1734,7 @@ struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
 * freeing by another task.  It is the caller's responsibility to free the
 * extra reference for shared policies.
 */
-static struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
                                                unsigned long addr)
 {
        struct mempolicy *pol = __get_vma_policy(vma, addr);
@@ -2037,7 +2083,6 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
 *      @vma:  Pointer to VMA or NULL if not available.
 *      @addr: Virtual Address of the allocation. Must be inside the VMA.
 *      @node: Which node to prefer for allocation (modulo policy).
- *      @hugepage: for hugepages try only the preferred node if possible
 *
 *      This function allocates a page from the kernel page pool and applies
 *      a NUMA policy associated with the VMA or the current process.
@@ -2048,7 +2093,7 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
 */
 struct page *
 alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
-                unsigned long addr, int node, bool hugepage)
+                unsigned long addr, int node)
 {
        struct mempolicy *pol;
        struct page *page;
@@ -2066,31 +2111,6 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
                goto out;
        }
-        if (unlikely(IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hugepage)) {
-                int hpage_node = node;
-                /*
-                 * For hugepage allocation and non-interleave policy which
-                 * allows the current node (or other explicitly preferred
-                 * node) we only try to allocate from the current/preferred
-                 * node and don't fall back to other nodes, as the cost of
-                 * remote accesses would likely offset THP benefits.
-                 *
-                 * If the policy is interleave, or does not allow the current
-                 * node in its nodemask, we allocate the standard way.
-                 */
-                if (pol->mode == MPOL_PREFERRED && !(pol->flags & MPOL_F_LOCAL))
-                        hpage_node = pol->v.preferred_node;
-                nmask = policy_nodemask(gfp, pol);
-                if (!nmask || node_isset(hpage_node, *nmask)) {
-                        mpol_cond_put(pol);
-                        page = __alloc_pages_node(hpage_node,
-                                                gfp | __GFP_THISNODE, order);
-                        goto out;
-                }
-        }
        nmask = policy_nodemask(gfp, pol);
        preferred_nid = policy_node(gfp, pol, node);
        page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask);
diff --git a/mm/memremap.c b/mm/memremap.c
index 86432650f829..ed70c4e8e52a 100644
--- a/mm/memremap.c
+++ b/mm/memremap.c
@@ -403,6 +403,30 @@ void __put_devmap_managed_page(struct page *page)
                mem_cgroup_uncharge(page);
+                /*
+                 * When a device_private page is freed, the page->mapping field
+                 * may still contain a (stale) mapping value. For example, the
+                 * lower bits of page->mapping may still identify the page as
+                 * an anonymous page. Ultimately, this entire field is just
+                 * stale and wrong, and it will cause errors if not cleared.
+                 * One example is:
+                 *
+                 *  migrate_vma_pages()
+                 *    migrate_vma_insert_page()
+                 *      page_add_new_anon_rmap()
+                 *        __page_set_anon_rmap()
+                 *          ...checks page->mapping, via PageAnon(page) call,
+                 *            and incorrectly concludes that the page is an
+                 *            anonymous page. Therefore, it incorrectly,
+                 *            silently fails to set up the new anon rmap.
+                 *
+                 * For other types of ZONE_DEVICE pages, migration is either
+                 * handled differently or not done at all, so there is no need
+                 * to clear page->mapping.
+                 */
+                if (is_device_private_page(page))
+                        page->mapping = NULL;
                page->pgmap->ops->page_free(page);
        } else if (!count)
                __put_page(page);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 272c6de1bf4e..9c9194959271 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2238,27 +2238,12 @@ static int move_freepages(struct zone *zone,
        unsigned int order;
        int pages_moved = 0;
-#ifndef CONFIG_HOLES_IN_ZONE
-        /*
-         * page_zone is not safe to call in this context when
-         * CONFIG_HOLES_IN_ZONE is set. This bug check is probably redundant
-         * anyway as we check zone boundaries in move_freepages_block().
-         * Remove at a later date when no bug reports exist related to
-         * grouping pages by mobility
-         */
-        VM_BUG_ON(pfn_valid(page_to_pfn(start_page)) &&
-                  pfn_valid(page_to_pfn(end_page)) &&
-                  page_zone(start_page) != page_zone(end_page));
-#endif
        for (page = start_page; page <= end_page;) {
                if (!pfn_valid_within(page_to_pfn(page))) {
                        page++;
                        continue;
                }
-                /* Make sure we are not inadvertently changing nodes */
-                VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
                if (!PageBuddy(page)) {
                        /*
                         * We assume that pages that could be isolated for
@@ -2273,6 +2258,10 @@ static int move_freepages(struct zone *zone,
                        continue;
                }
+                /* Make sure we are not inadvertently changing nodes */
+                VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
+                VM_BUG_ON_PAGE(page_zone(page) != zone, page);
                order = page_order(page);
                move_to_free_area(page, &zone->free_area[order], migratetype);
                page += 1 << order;
diff --git a/mm/rmap.c b/mm/rmap.c
index e5dfe2ae6b0d..003377e24232 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1475,7 +1475,15 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                        /*
                         * No need to invalidate here it will synchronize on
                         * against the special swap migration pte.
+                         *
+                         * The assignment to subpage above was computed from a
+                         * swap PTE which results in an invalid pointer.
+                         * Since only PAGE_SIZE pages can currently be
+                         * migrated, just set it to page. This will need to be
+                         * changed when hugepage migrations to device private
+                         * memory are supported.
                         */
+                        subpage = page;
                        goto discard;
                }
diff --git a/mm/shmem.c b/mm/shmem.c
index 626d8c74b973..2bed4761f279 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1466,7 +1466,7 @@ static struct page *shmem_alloc_hugepage(gfp_t gfp,
        shmem_pseudo_vma_init(&pvma, info, hindex);
        page = alloc_pages_vma(gfp | __GFP_COMP | __GFP_NORETRY | __GFP_NOWARN,
-                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id(), true);
+                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id());
        shmem_pseudo_vma_destroy(&pvma);
        if (page)
                prep_transhuge_page(page);
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 2a09796edef8..98e924864554 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -147,7 +147,7 @@ static inline void check_bogus_address(const unsigned long ptr, unsigned long n,
                                       bool to_user)
 {
        /* Reject if object wraps past end of memory. */
-        if (ptr + n < ptr)
+        if (ptr + (n - 1) < ptr)
                usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
        /* Reject if NULL or ZERO-allocation. */
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index e0fc963acc41..7ba11e12a11f 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3279,9 +3279,19 @@ retry:
                        goto overflow;
                /*
+                 * If required width exeeds current VA block, move
+                 * base downwards and then recheck.
+                 */
+                if (base + end > va->va_end) {
+                        base = pvm_determine_end_from_reverse(&va, align) - end;
+                        term_area = area;
+                        continue;
+                }
+                /*
                 * If this VA does not fit, move base downwards and recheck.
                 */
-                if (base + start < va->va_start || base + end > va->va_end) {
+                if (base + start < va->va_start) {
                        va = node_to_va(rb_prev(&va->rb_node));
                        base = pvm_determine_end_from_reverse(&va, align) - end;
                        term_area = area;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index dbdc46a84f63..a6c5d0b28321 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -88,9 +88,6 @@ struct scan_control {
        /* Can pages be swapped as part of reclaim? */
        unsigned int may_swap:1;
-        /* e.g. boosted watermark reclaim leaves slabs alone */
-        unsigned int may_shrinkslab:1;
        /*
         * Cgroups are not reclaimed below their configured memory.low,
         * unless we threaten to OOM. If any cgroups are skipped due to
@@ -2714,10 +2711,8 @@ static bool shrink_node(pg_data_t *pgdat, struct scan_control *sc)
                        shrink_node_memcg(pgdat, memcg, sc, &lru_pages);
                        node_lru_pages += lru_pages;
-                        if (sc->may_shrinkslab) {
+                        shrink_slab(sc->gfp_mask, pgdat->node_id, memcg,
-                                shrink_slab(sc->gfp_mask, pgdat->node_id,
+                                        sc->priority);
-                                    memcg, sc->priority);
-                        }
                        /* Record the group's reclaim efficiency */
                        vmpressure(sc->gfp_mask, memcg, false,
@@ -3194,7 +3189,6 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
                .may_writepage = !laptop_mode,
                .may_unmap = 1,
                .may_swap = 1,
-                .may_shrinkslab = 1,
        };
        /*
@@ -3226,6 +3220,7 @@ unsigned long try_to_free_pages(struct zonelist *zonelist, int order,
 #ifdef CONFIG_MEMCG
+/* Only used by soft limit reclaim. Do not reuse for anything else. */
 unsigned long mem_cgroup_shrink_node(struct mem_cgroup *memcg,
                                                gfp_t gfp_mask, bool noswap,
                                                pg_data_t *pgdat,
@@ -3238,11 +3233,11 @@ unsigned long mem_cgroup_shrink_node(struct mem_cgroup *memcg,
                .may_unmap = 1,
                .reclaim_idx = MAX_NR_ZONES - 1,
                .may_swap = !noswap,
-                .may_shrinkslab = 1,
        };
        unsigned long lru_pages;
-        set_task_reclaim_state(current, &sc.reclaim_state);
+        WARN_ON_ONCE(!current->reclaim_state);
        sc.gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                        (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK);
@@ -3260,7 +3255,6 @@ unsigned long mem_cgroup_shrink_node(struct mem_cgroup *memcg,
        trace_mm_vmscan_memcg_softlimit_reclaim_end(sc.nr_reclaimed);
-        set_task_reclaim_state(current, NULL);
        *nr_scanned = sc.nr_scanned;
        return sc.nr_reclaimed;
@@ -3286,7 +3280,6 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
                .may_writepage = !laptop_mode,
                .may_unmap = 1,
                .may_swap = may_swap,
-                .may_shrinkslab = 1,
        };
        set_task_reclaim_state(current, &sc.reclaim_state);
@@ -3598,7 +3591,6 @@ restart:
                 */
                sc.may_writepage = !laptop_mode && !nr_boost_reclaim;
                sc.may_swap = !nr_boost_reclaim;
-                sc.may_shrinkslab = !nr_boost_reclaim;
                /*
                 * Do some background aging of the anon list, to give
diff --git a/mm/workingset.c b/mm/workingset.c
index e0b4edcb88c8..c963831d354f 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -380,14 +380,12 @@ void workingset_update_node(struct xa_node *node)
        if (node->count && node->count == node->nr_values) {
                if (list_empty(&node->private_list)) {
                        list_lru_add(&shadow_nodes, &node->private_list);
-                        __inc_lruvec_page_state(virt_to_page(node),
+                        __inc_lruvec_slab_state(node, WORKINGSET_NODES);
-                                                WORKINGSET_NODES);
                }
        } else {
                if (!list_empty(&node->private_list)) {
                        list_lru_del(&shadow_nodes, &node->private_list);
-                        __dec_lruvec_page_state(virt_to_page(node),
+                        __dec_lruvec_slab_state(node, WORKINGSET_NODES);
-                                                WORKINGSET_NODES);
                }
        }
 }
@@ -480,7 +478,7 @@ static enum lru_status shadow_lru_isolate(struct list_head *item,
        }
        list_lru_isolate(lru, item);
-        __dec_lruvec_page_state(virt_to_page(node), WORKINGSET_NODES);
+        __dec_lruvec_slab_state(node, WORKINGSET_NODES);
        spin_unlock(lru_lock);
@@ -503,7 +501,7 @@ static enum lru_status shadow_lru_isolate(struct list_head *item,
         * shadow entries we were tracking ...
         */
        xas_store(&xas, NULL);
-        __inc_lruvec_page_state(virt_to_page(node), WORKINGSET_NODERECLAIM);
+        __inc_lruvec_slab_state(node, WORKINGSET_NODERECLAIM);
 out_invalid:
        xa_unlock_irq(&mapping->i_pages);
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 1a029a7432ee..75b7962439ff 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -41,6 +41,7 @@
 #include <linux/workqueue.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/wait.h>
 #include <linux/zpool.h>
 #include <linux/magic.h>
@@ -145,6 +146,8 @@ struct z3fold_header {
 * @release_wq: workqueue for safe page release
 * @work:       work_struct for safe page release
 * @inode:      inode for z3fold pseudo filesystem
+ * @destroying: bool to stop migration once we start destruction
+ * @isolated: int to count the number of pages currently in isolation
 *
 * This structure is allocated at pool creation time and maintains metadata
 * pertaining to a particular z3fold pool.
@@ -163,8 +166,11 @@ struct z3fold_pool {
        const struct zpool_ops *zpool_ops;
        struct workqueue_struct *compact_wq;
        struct workqueue_struct *release_wq;
+        struct wait_queue_head isolate_wait;
        struct work_struct work;
        struct inode *inode;
+        bool destroying;
+        int isolated;
 };
 /*
@@ -769,6 +775,7 @@ static struct z3fold_pool *z3fold_create_pool(const char *name, gfp_t gfp,
                goto out_c;
        spin_lock_init(&pool->lock);
        spin_lock_init(&pool->stale_lock);
+        init_waitqueue_head(&pool->isolate_wait);
        pool->unbuddied = __alloc_percpu(sizeof(struct list_head)*NCHUNKS, 2);
        if (!pool->unbuddied)
                goto out_pool;
@@ -808,6 +815,15 @@ out:
        return NULL;
 }
+static bool pool_isolated_are_drained(struct z3fold_pool *pool)
+{
+        bool ret;
+        spin_lock(&pool->lock);
+        ret = pool->isolated == 0;
+        spin_unlock(&pool->lock);
+        return ret;
+}
 /**
 * z3fold_destroy_pool() - destroys an existing z3fold pool
 * @pool:       the z3fold pool to be destroyed
@@ -817,9 +833,35 @@ out:
 static void z3fold_destroy_pool(struct z3fold_pool *pool)
 {
        kmem_cache_destroy(pool->c_handle);
-        z3fold_unregister_migration(pool);
+        /*
-        destroy_workqueue(pool->release_wq);
+         * We set pool-> destroying under lock to ensure that
+         * z3fold_page_isolate() sees any changes to destroying. This way we
+         * avoid the need for any memory barriers.
+         */
+        spin_lock(&pool->lock);
+        pool->destroying = true;
+        spin_unlock(&pool->lock);
+        /*
+         * We need to ensure that no pages are being migrated while we destroy
+         * these workqueues, as migration can queue work on either of the
+         * workqueues.
+         */
+        wait_event(pool->isolate_wait, !pool_isolated_are_drained(pool));
+        /*
+         * We need to destroy pool->compact_wq before pool->release_wq,
+         * as any pending work on pool->compact_wq will call
+         * queue_work(pool->release_wq, &pool->work).
+         *
+         * There are still outstanding pages until both workqueues are drained,
+         * so we cannot unregister migration until then.
+         */
        destroy_workqueue(pool->compact_wq);
+        destroy_workqueue(pool->release_wq);
+        z3fold_unregister_migration(pool);
        kfree(pool);
 }
@@ -1297,6 +1339,28 @@ static u64 z3fold_get_pool_size(struct z3fold_pool *pool)
        return atomic64_read(&pool->pages_nr);
 }
+/*
+ * z3fold_dec_isolated() expects to be called while pool->lock is held.
+ */
+static void z3fold_dec_isolated(struct z3fold_pool *pool)
+{
+        assert_spin_locked(&pool->lock);
+        VM_BUG_ON(pool->isolated <= 0);
+        pool->isolated--;
+        /*
+         * If we have no more isolated pages, we have to see if
+         * z3fold_destroy_pool() is waiting for a signal.
+         */
+        if (pool->isolated == 0 && waitqueue_active(&pool->isolate_wait))
+                wake_up_all(&pool->isolate_wait);
+}
+static void z3fold_inc_isolated(struct z3fold_pool *pool)
+{
+        pool->isolated++;
+}
 static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode)
 {
        struct z3fold_header *zhdr;
@@ -1323,6 +1387,34 @@ static bool z3fold_page_isolate(struct page *page, isolate_mode_t mode)
                spin_lock(&pool->lock);
                if (!list_empty(&page->lru))
                        list_del(&page->lru);
+                /*
+                 * We need to check for destruction while holding pool->lock, as
+                 * otherwise destruction could see 0 isolated pages, and
+                 * proceed.
+                 */
+                if (unlikely(pool->destroying)) {
+                        spin_unlock(&pool->lock);
+                        /*
+                         * If this page isn't stale, somebody else holds a
+                         * reference to it. Let't drop our refcount so that they
+                         * can call the release logic.
+                         */
+                        if (unlikely(kref_put(&zhdr->refcount,
+                                              release_z3fold_page_locked))) {
+                                /*
+                                 * If we get here we have kref problems, so we
+                                 * should freak out.
+                                 */
+                                WARN(1, "Z3fold is experiencing kref problems\n");
+                                z3fold_page_unlock(zhdr);
+                                return false;
+                        }
+                        z3fold_page_unlock(zhdr);
+                        return false;
+                }
+                z3fold_inc_isolated(pool);
                spin_unlock(&pool->lock);
                z3fold_page_unlock(zhdr);
                return true;
@@ -1391,6 +1483,10 @@ static int z3fold_page_migrate(struct address_space *mapping, struct page *newpa
        queue_work_on(new_zhdr->cpu, pool->compact_wq, &new_zhdr->work);
+        spin_lock(&pool->lock);
+        z3fold_dec_isolated(pool);
+        spin_unlock(&pool->lock);
        page_mapcount_reset(page);
        put_page(page);
        return 0;
@@ -1410,10 +1506,14 @@ static void z3fold_page_putback(struct page *page)
        INIT_LIST_HEAD(&page->lru);
        if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) {
                atomic64_dec(&pool->pages_nr);
+                spin_lock(&pool->lock);
+                z3fold_dec_isolated(pool);
+                spin_unlock(&pool->lock);
                return;
        }
        spin_lock(&pool->lock);
        list_add(&page->lru, &pool->lru);
+        z3fold_dec_isolated(pool);
        spin_unlock(&pool->lock);
        z3fold_page_unlock(zhdr);
 }
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 57fbb7ced69f..e98bb6ab4f7e 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -54,6 +54,7 @@
 #include <linux/mount.h>
 #include <linux/pseudo_fs.h>
 #include <linux/migrate.h>
+#include <linux/wait.h>
 #include <linux/pagemap.h>
 #include <linux/fs.h>
@@ -268,6 +269,10 @@ struct zs_pool {
 #ifdef CONFIG_COMPACTION
        struct inode *inode;
        struct work_struct free_work;
+        /* A wait queue for when migration races with async_free_zspage() */
+        struct wait_queue_head migration_wait;
+        atomic_long_t isolated_pages;
+        bool destroying;
 #endif
 };
@@ -1862,6 +1867,31 @@ static void dec_zspage_isolation(struct zspage *zspage)
        zspage->isolated--;
 }
+static void putback_zspage_deferred(struct zs_pool *pool,
+                                    struct size_class *class,
+                                    struct zspage *zspage)
+{
+        enum fullness_group fg;
+        fg = putback_zspage(class, zspage);
+        if (fg == ZS_EMPTY)
+                schedule_work(&pool->free_work);
+}
+static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+{
+        VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+        atomic_long_dec(&pool->isolated_pages);
+        /*
+         * There's no possibility of racing, since wait_for_isolated_drain()
+         * checks the isolated count under &class->lock after enqueuing
+         * on migration_wait.
+         */
+        if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+                wake_up_all(&pool->migration_wait);
+}
 static void replace_sub_page(struct size_class *class, struct zspage *zspage,
                                struct page *newpage, struct page *oldpage)
 {
@@ -1931,6 +1961,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
         */
        if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
                get_zspage_mapping(zspage, &class_idx, &fullness);
+                atomic_long_inc(&pool->isolated_pages);
                remove_zspage(class, zspage, fullness);
        }
@@ -2030,8 +2061,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
         * Page migration is done so let's putback isolated zspage to
         * the list if @page is final isolated subpage in the zspage.
         */
-        if (!is_zspage_isolated(zspage))
+        if (!is_zspage_isolated(zspage)) {
-                putback_zspage(class, zspage);
+                /*
+                 * We cannot race with zs_destroy_pool() here because we wait
+                 * for isolation to hit zero before we start destroying.
+                 * Also, we ensure that everyone can see pool->destroying before
+                 * we start waiting.
+                 */
+                putback_zspage_deferred(pool, class, zspage);
+                zs_pool_dec_isolated(pool);
+        }
        reset_page(page);
        put_page(page);
@@ -2077,13 +2116,12 @@ static void zs_page_putback(struct page *page)
        spin_lock(&class->lock);
        dec_zspage_isolation(zspage);
        if (!is_zspage_isolated(zspage)) {
-                fg = putback_zspage(class, zspage);
                /*
                 * Due to page_lock, we cannot free zspage immediately
                 * so let's defer.
                 */
-                if (fg == ZS_EMPTY)
+                putback_zspage_deferred(pool, class, zspage);
-                        schedule_work(&pool->free_work);
+                zs_pool_dec_isolated(pool);
        }
        spin_unlock(&class->lock);
 }
@@ -2107,8 +2145,36 @@ static int zs_register_migration(struct zs_pool *pool)
        return 0;
 }
+static bool pool_isolated_are_drained(struct zs_pool *pool)
+{
+        return atomic_long_read(&pool->isolated_pages) == 0;
+}
+/* Function for resolving migration */
+static void wait_for_isolated_drain(struct zs_pool *pool)
+{
+        /*
+         * We're in the process of destroying the pool, so there are no
+         * active allocations. zs_page_isolate() fails for completely free
+         * zspages, so we need only wait for the zs_pool's isolated
+         * count to hit zero.
+         */
+        wait_event(pool->migration_wait,
+                   pool_isolated_are_drained(pool));
+}
 static void zs_unregister_migration(struct zs_pool *pool)
 {
+        pool->destroying = true;
+        /*
+         * We need a memory barrier here to ensure global visibility of
+         * pool->destroying. Thus pool->isolated pages will either be 0 in which
+         * case we don't care, or it will be > 0 and pool->destroying will
+         * ensure that we wake up once isolation hits 0.
+         */
+        smp_mb();
+        wait_for_isolated_drain(pool); /* This can block */
        flush_work(&pool->free_work);
        iput(pool->inode);
 }
@@ -2346,6 +2412,10 @@ struct zs_pool *zs_create_pool(const char *name)
        if (!pool->name)
                goto err;
+#ifdef CONFIG_COMPACTION
+        init_waitqueue_head(&pool->migration_wait);
+#endif
        if (create_cache(pool))
                goto err;
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 67d7f83009ae..1d5bdf3a4b65 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -2303,7 +2303,7 @@ __batadv_mcast_flags_dump(struct sk_buff *msg, u32 portid,
        while (bucket_tmp < hash->size) {
                if (batadv_mcast_flags_dump_bucket(msg, portid, cb, hash,
-                                                   *bucket, &idx_tmp))
+                                                   bucket_tmp, &idx_tmp))
                        break;
                bucket_tmp++;
@@ -2420,8 +2420,10 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
-        batadv_mcast_want_rtr4_update(bat_priv, orig, BATADV_NO_FLAGS);
+        batadv_mcast_want_rtr4_update(bat_priv, orig,
-        batadv_mcast_want_rtr6_update(bat_priv, orig, BATADV_NO_FLAGS);
+                                      BATADV_MCAST_WANT_NO_RTR4);
+        batadv_mcast_want_rtr6_update(bat_priv, orig,
+                                      BATADV_MCAST_WANT_NO_RTR6);
        spin_unlock_bh(&orig->mcast_handler_lock);
 }
diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
index 6f08fd122a8d..7e052d6f759b 100644
--- a/net/batman-adv/netlink.c
+++ b/net/batman-adv/netlink.c
@@ -164,7 +164,7 @@ batadv_netlink_get_ifindex(const struct nlmsghdr *nlh, int attrtype)
 {
        struct nlattr *attr = nlmsg_find_attr(nlh, GENL_HDRLEN, attrtype);
-        return attr ? nla_get_u32(attr) : 0;
+        return (attr && nla_len(attr) == sizeof(u32)) ? nla_get_u32(attr) : 0;
 }
 /**
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b9585e7d9d2e..04bc79359a17 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3202,6 +3202,7 @@ struct hci_dev *hci_alloc_dev(void)
        hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
        hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
+        hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
        mutex_init(&hdev->lock);
        mutex_init(&hdev->req_lock);
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index bb67f4a5479a..402e2cc54044 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -433,6 +433,35 @@ static int auto_accept_delay_set(void *data, u64 val)
        return 0;
 }
+static int min_encrypt_key_size_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+        if (val < 1 || val > 16)
+                return -EINVAL;
+        hci_dev_lock(hdev);
+        hdev->min_enc_key_size = val;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+static int min_encrypt_key_size_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+        hci_dev_lock(hdev);
+        *val = hdev->min_enc_key_size;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+DEFINE_SIMPLE_ATTRIBUTE(min_encrypt_key_size_fops,
+                        min_encrypt_key_size_get,
+                        min_encrypt_key_size_set, "%llu\n");
 static int auto_accept_delay_get(void *data, u64 *val)
 {
        struct hci_dev *hdev = data;
@@ -545,6 +574,8 @@ void hci_debugfs_create_bredr(struct hci_dev *hdev)
        if (lmp_ssp_capable(hdev)) {
                debugfs_create_file("ssp_debug_mode", 0444, hdev->debugfs,
                                    hdev, &ssp_debug_mode_fops);
+                debugfs_create_file("min_encrypt_key_size", 0644, hdev->debugfs,
+                                    hdev, &min_encrypt_key_size_fops);
                debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
                                    hdev, &auto_accept_delay_fops);
        }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 5abd423b55fa..8d889969ae7e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -101,6 +101,7 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
 {
        struct sk_buff *skb;
        struct sock *sk = sock->sk;
+        int ret;
        BT_DBG("session %p data %p size %d", session, data, size);
@@ -114,13 +115,17 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
        }
        skb_put_u8(skb, hdr);
-        if (data && size > 0)
+        if (data && size > 0) {
                skb_put_data(skb, data, size);
+                ret = size;
+        } else {
+                ret = 0;
+        }
        skb_queue_tail(transmit, skb);
        wake_up_interruptible(sk_sleep(sk));
-        return 0;
+        return ret;
 }
 static int hidp_send_ctrl_message(struct hidp_session *session,
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cc506fe99b4d..dfc1edb168b7 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1361,7 +1361,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
         * actually encrypted before enforcing a key size.
         */
        return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
-                hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
+                hcon->enc_key_size >= hcon->hdev->min_enc_key_size);
 }
 static void l2cap_do_start(struct l2cap_chan *chan)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index c8177a89f52c..4096d8a74a2b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -221,7 +221,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
                        return NF_DROP;
                }
-                ADD_COUNTER(*(counter_base + i), 1, skb->len);
+                ADD_COUNTER(*(counter_base + i), skb->len, 1);
                /* these should only watch: not modify, nor tell us
                 * what to do with the packet
@@ -959,8 +959,8 @@ static void get_counters(const struct ebt_counter *oldcounters,
                        continue;
                counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
                for (i = 0; i < nentries; i++)
-                        ADD_COUNTER(counters[i], counter_base[i].pcnt,
+                        ADD_COUNTER(counters[i], counter_base[i].bcnt,
-                                    counter_base[i].bcnt);
+                                    counter_base[i].pcnt);
        }
 }
@@ -1280,7 +1280,7 @@ static int do_update_counters(struct net *net, const char *name,
        /* we add to the counters of the first cpu */
        for (i = 0; i < num_counters; i++)
-                ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
+                ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
        write_unlock_bh(&t->lock);
        ret = 0;
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 5d6724cee38f..4f75df40fb12 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
        if (key) {
                kfree(key->key);
                key->key = NULL;
-                crypto_free_sync_skcipher(key->tfm);
+                if (key->tfm) {
-                key->tfm = NULL;
+                        crypto_free_sync_skcipher(key->tfm);
+                        key->tfm = NULL;
+                }
        }
 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 0b2df09b2554..78ae6e8c953d 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1496,7 +1496,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
        struct ceph_osds up, acting;
        bool force_resend = false;
        bool unpaused = false;
-        bool legacy_change;
+        bool legacy_change = false;
        bool split = false;
        bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
        bool recovery_deletes = ceph_osdmap_flag(osdc,
@@ -1584,15 +1584,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
                t->osd = acting.primary;
        }
-        if (unpaused || legacy_change || force_resend ||
+        if (unpaused || legacy_change || force_resend || split)
-            (split && con && CEPH_HAVE_FEATURE(con->peer_features,
-                                               RESEND_ON_SPLIT)))
                ct_res = CALC_TARGET_NEED_RESEND;
        else
                ct_res = CALC_TARGET_NO_ACTION;
 out:
-        dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
+        dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
+             legacy_change, force_resend, split, ct_res, t->osd);
        return ct_res;
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index 7878f918b8c0..4c6a252d4212 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -8757,13 +8757,13 @@ sk_reuseport_is_valid_access(int off, int size,
                return size == size_default;
        /* Fields that allow narrowing */
-        case offsetof(struct sk_reuseport_md, eth_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):
                if (size < FIELD_SIZEOF(struct sk_buff, protocol))
                        return false;
                /* fall through */
-        case offsetof(struct sk_reuseport_md, ip_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):
-        case offsetof(struct sk_reuseport_md, bind_inany):
+        case bpf_ctx_range(struct sk_reuseport_md, bind_inany):
-        case offsetof(struct sk_reuseport_md, len):
+        case bpf_ctx_range(struct sk_reuseport_md, len):
                bpf_ctx_record_field_size(info, size_default);
                return bpf_ctx_narrow_access_ok(off, size, size_default);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 3e6fedb57bc1..2470b4b404e6 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -142,8 +142,8 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
                mutex_unlock(&flow_dissector_mutex);
                return -ENOENT;
        }
-        bpf_prog_put(attached);
        RCU_INIT_POINTER(net->flow_dissector_prog, NULL);
+        bpf_prog_put(attached);
        mutex_unlock(&flow_dissector_mutex);
        return 0;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index d57b0cc995a0..545fac19a711 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1992,6 +1992,19 @@ void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 }
 EXPORT_SYMBOL(skb_set_owner_w);
+static bool can_skb_orphan_partial(const struct sk_buff *skb)
+{
+#ifdef CONFIG_TLS_DEVICE
+        /* Drivers depend on in-order delivery for crypto offload,
+         * partial orphan breaks out-of-order-OK logic.
+         */
+        if (skb->decrypted)
+                return false;
+#endif
+        return (skb->destructor == sock_wfree ||
+                (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
+}
 /* This helper is used by netem, as it can hold packets in its
 * delay queue. We want to allow the owner socket to send more
 * packets, as if they were already TX completed by a typical driver.
@@ -2003,11 +2016,7 @@ void skb_orphan_partial(struct sk_buff *skb)
        if (skb_is_tcp_pure_ack(skb))
                return;
-        if (skb->destructor == sock_wfree
+        if (can_skb_orphan_partial(skb)) {
-#ifdef CONFIG_INET
-            || skb->destructor == tcp_wfree
-#endif
-                ) {
                struct sock *sk = skb->sk;
                if (refcount_inc_not_zero(&sk->sk_refcnt)) {
@@ -3278,16 +3287,17 @@ static __init int net_inuse_init(void)
 core_initcall(net_inuse_init);
-static void assign_proto_idx(struct proto *prot)
+static int assign_proto_idx(struct proto *prot)
 {
        prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
        if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
                pr_err("PROTO_INUSE_NR exhausted\n");
-                return;
+                return -ENOSPC;
        }
        set_bit(prot->inuse_idx, proto_inuse_idx);
+        return 0;
 }
 static void release_proto_idx(struct proto *prot)
@@ -3296,8 +3306,9 @@ static void release_proto_idx(struct proto *prot)
                clear_bit(prot->inuse_idx, proto_inuse_idx);
 }
 #else
-static inline void assign_proto_idx(struct proto *prot)
+static inline int assign_proto_idx(struct proto *prot)
 {
+        return 0;
 }
 static inline void release_proto_idx(struct proto *prot)
@@ -3346,6 +3357,8 @@ static int req_prot_init(const struct proto *prot)
 int proto_register(struct proto *prot, int alloc_slab)
 {
+        int ret = -ENOBUFS;
        if (alloc_slab) {
                prot->slab = kmem_cache_create_usercopy(prot->name,
                                        prot->obj_size, 0,
@@ -3382,20 +3395,27 @@ int proto_register(struct proto *prot, int alloc_slab)
        }
        mutex_lock(&proto_list_mutex);
+        ret = assign_proto_idx(prot);
+        if (ret) {
+                mutex_unlock(&proto_list_mutex);
+                goto out_free_timewait_sock_slab_name;
+        }
        list_add(&prot->node, &proto_list);
-        assign_proto_idx(prot);
        mutex_unlock(&proto_list_mutex);
-        return 0;
+        return ret;
 out_free_timewait_sock_slab_name:
-        kfree(prot->twsk_prot->twsk_slab_name);
+        if (alloc_slab && prot->twsk_prot)
+                kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
-        req_prot_cleanup(prot->rsk_prot);
+        if (alloc_slab) {
+                req_prot_cleanup(prot->rsk_prot);
-        kmem_cache_destroy(prot->slab);
+                kmem_cache_destroy(prot->slab);
-        prot->slab = NULL;
+                prot->slab = NULL;
+        }
 out:
-        return -ENOBUFS;
+        return ret;
 }
 EXPORT_SYMBOL(proto_register);
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 3312a5849a97..c13ffbd33d8d 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -19,6 +19,7 @@ static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
 static DEFINE_MUTEX(sock_diag_table_mutex);
 static struct workqueue_struct *broadcast_wq;
+static atomic64_t cookie_gen;
 u64 sock_gen_cookie(struct sock *sk)
 {
@@ -27,7 +28,7 @@ u64 sock_gen_cookie(struct sock *sk)
                if (res)
                        return res;
-                res = atomic64_inc_return(&sock_net(sk)->cookie_gen);
+                res = atomic64_inc_return(&cookie_gen);
                atomic64_cmpxchg(&sk->sk_cookie, 0, res);
        }
 }
diff --git a/net/core/stream.c b/net/core/stream.c
index e94bb02a5629..4f1d4aa5fb38 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -120,7 +120,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
        int err = 0;
        long vm_wait = 0;
        long current_timeo = *timeo_p;
-        bool noblock = (*timeo_p ? false : true);
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        if (sk_stream_memory_free(sk))
@@ -133,11 +132,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                        goto do_error;
-                if (!*timeo_p) {
+                if (!*timeo_p)
-                        if (noblock)
+                        goto do_eagain;
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                        goto do_nonblock;
-                }
                if (signal_pending(current))
                        goto do_interrupted;
                sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -169,7 +165,13 @@ out:
 do_error:
        err = -EPIPE;
        goto out;
-do_nonblock:
+do_eagain:
+        /* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
+         * be generated later.
+         * When TCP receives ACK packets that make room, tcp_check_space()
+         * only calls tcp_new_space() if SOCK_NOSPACE is set.
+         */
+        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
        err = -EAGAIN;
        goto out;
 do_interrupted:
diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 4ec5b7f85d51..09d9286b27cc 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -153,6 +153,9 @@ static void dsa_switch_mdb_add_bitmap(struct dsa_switch *ds,
 {
        int port;
+        if (!ds->ops->port_mdb_add)
+                return;
        for_each_set_bit(port, bitmap, ds->num_ports)
                ds->ops->port_mdb_add(ds, port, mdb);
 }
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index e4aba5d485be..bbe9b3b2d395 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -170,7 +170,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *skb,
        reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
        if (!reasm_data)
                goto out_oom;
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->dev = ldev;
        skb->tstamp = fq->q.stamp;
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index dacbd58e1799..badc5cfe4dc6 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -1092,7 +1092,7 @@ static struct packet_type ieee802154_packet_type = {
 static int __init af_ieee802154_init(void)
 {
-        int rc = -EINVAL;
+        int rc;
        rc = proto_register(&ieee802154_raw_prot, 1);
        if (rc)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 2b2b3d291ab0..1ab2fb6bb37d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2145,7 +2145,7 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                if (filter->dump_exceptions) {
                        err = fib_dump_info_fnhe(skb, cb, tb->tb_id, fi,
-                                                 &i_fa, s_fa);
+                                                 &i_fa, s_fa, flags);
                        if (err < 0)
                                goto stop;
                }
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 1510e951f451..4298aae74e0e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -582,7 +582,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
        if (!rt)
                goto out;
-        net = dev_net(rt->dst.dev);
+        if (rt->dst.dev)
+                net = dev_net(rt->dst.dev);
+        else if (skb_in->dev)
+                net = dev_net(skb_in->dev);
+        else
+                goto out;
        /*
         *      Find the original header. It is expected to be valid, of course.
@@ -902,7 +908,7 @@ static bool icmp_redirect(struct sk_buff *skb)
                return false;
        }
-        icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway);
+        icmp_socket_deliver(skb, ntohl(icmp_hdr(skb)->un.gateway));
        return true;
 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 180f6896b98b..480d0b22db1a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1475,7 +1475,7 @@ EXPORT_SYMBOL(__ip_mc_inc_group);
 void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 {
-        __ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE);
+        __ip_mc_inc_group(in_dev, addr, GFP_KERNEL);
 }
 EXPORT_SYMBOL(ip_mc_inc_group);
@@ -2197,7 +2197,7 @@ static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
        iml->sflist = NULL;
        iml->sfmode = mode;
        rcu_assign_pointer(inet->mc_list, iml);
-        __ip_mc_inc_group(in_dev, addr, mode);
+        ____ip_mc_inc_group(in_dev, addr, mode, GFP_KERNEL);
        err = 0;
 done:
        return err;
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index a999451345f9..10d31733297d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -475,11 +475,12 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
 EXPORT_SYMBOL(inet_frag_reasm_prepare);
 void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
-                            void *reasm_data)
+                            void *reasm_data, bool try_coalesce)
 {
        struct sk_buff **nextp = (struct sk_buff **)reasm_data;
        struct rb_node *rbn;
        struct sk_buff *fp;
+        int sum_truesize;
        skb_push(head, head->data - skb_network_header(head));
@@ -487,25 +488,41 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
        fp = FRAG_CB(head)->next_frag;
        rbn = rb_next(&head->rbnode);
        rb_erase(&head->rbnode, &q->rb_fragments);
+        sum_truesize = head->truesize;
        while (rbn || fp) {
                /* fp points to the next sk_buff in the current run;
                 * rbn points to the next run.
                 */
                /* Go through the current run. */
                while (fp) {
-                        *nextp = fp;
+                        struct sk_buff *next_frag = FRAG_CB(fp)->next_frag;
-                        nextp = &fp->next;
+                        bool stolen;
-                        fp->prev = NULL;
+                        int delta;
-                        memset(&fp->rbnode, 0, sizeof(fp->rbnode));
-                        fp->sk = NULL;
+                        sum_truesize += fp->truesize;
-                        head->data_len += fp->len;
-                        head->len += fp->len;
                        if (head->ip_summed != fp->ip_summed)
                                head->ip_summed = CHECKSUM_NONE;
                        else if (head->ip_summed == CHECKSUM_COMPLETE)
                                head->csum = csum_add(head->csum, fp->csum);
-                        head->truesize += fp->truesize;
-                        fp = FRAG_CB(fp)->next_frag;
+                        if (try_coalesce && skb_try_coalesce(head, fp, &stolen,
+                                                             &delta)) {
+                                kfree_skb_partial(fp, stolen);
+                        } else {
+                                fp->prev = NULL;
+                                memset(&fp->rbnode, 0, sizeof(fp->rbnode));
+                                fp->sk = NULL;
+                                head->data_len += fp->len;
+                                head->len += fp->len;
+                                head->truesize += fp->truesize;
+                                *nextp = fp;
+                                nextp = &fp->next;
+                        }
+                        fp = next_frag;
                }
                /* Move to the next run. */
                if (rbn) {
@@ -516,7 +533,7 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
                        rbn = rbnext;
                }
        }
-        sub_frag_mem_limit(q->fqdir, head->truesize);
+        sub_frag_mem_limit(q->fqdir, sum_truesize);
        *nextp = NULL;
        skb_mark_not_on_list(head);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 4385eb9e781f..cfeb8890f94e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -393,6 +393,11 @@ err:
        return err;
 }
+static bool ip_frag_coalesce_ok(const struct ipq *qp)
+{
+        return qp->q.key.v4.user == IP_DEFRAG_LOCAL_DELIVER;
+}
 /* Build a new IP datagram from all its fragments. */
 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
                         struct sk_buff *prev_tail, struct net_device *dev)
@@ -421,7 +426,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
        if (len > 65535)
                goto out_oversize;
-        inet_frag_reasm_finish(&qp->q, skb, reasm_data);
+        inet_frag_reasm_finish(&qp->q, skb, reasm_data,
+                               ip_frag_coalesce_ok(qp));
        skb->dev = dev;
        IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 517300d587a7..b6a6f18c3dd1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2728,7 +2728,8 @@ EXPORT_SYMBOL_GPL(ip_route_output_flow);
 /* called with rcu_read_lock held */
 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
                        struct rtable *rt, u32 table_id, struct flowi4 *fl4,
-                        struct sk_buff *skb, u32 portid, u32 seq)
+                        struct sk_buff *skb, u32 portid, u32 seq,
+                        unsigned int flags)
 {
        struct rtmsg *r;
        struct nlmsghdr *nlh;
@@ -2736,7 +2737,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
        u32 error;
        u32 metrics[RTAX_MAX];
-        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), 0);
+        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), flags);
        if (!nlh)
                return -EMSGSIZE;
@@ -2860,7 +2861,7 @@ nla_put_failure:
 static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, u32 table_id,
                            struct fnhe_hash_bucket *bucket, int genid,
-                            int *fa_index, int fa_start)
+                            int *fa_index, int fa_start, unsigned int flags)
 {
        int i;
@@ -2891,7 +2892,7 @@ static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                        err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt,
                                           table_id, NULL, skb,
                                           NETLINK_CB(cb->skb).portid,
-                                           cb->nlh->nlmsg_seq);
+                                           cb->nlh->nlmsg_seq, flags);
                        if (err)
                                return err;
 next:
@@ -2904,7 +2905,7 @@ next:
 int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                       u32 table_id, struct fib_info *fi,
-                       int *fa_index, int fa_start)
+                       int *fa_index, int fa_start, unsigned int flags)
 {
        struct net *net = sock_net(cb->skb->sk);
        int nhsel, genid = fnhe_genid(net);
@@ -2922,7 +2923,8 @@ int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                err = 0;
                if (bucket)
                        err = fnhe_dump_bucket(net, skb, cb, table_id, bucket,
-                                               genid, fa_index, fa_start);
+                                               genid, fa_index, fa_start,
+                                               flags);
                rcu_read_unlock();
                if (err)
                        return err;
@@ -3183,7 +3185,8 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                                    fl4.flowi4_tos, res.fi, 0);
        } else {
                err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
-                                   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+                                   NETLINK_CB(in_skb).portid,
+                                   nlh->nlmsg_seq, 0);
        }
        if (err < 0)
                goto errout_rcu;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 776905899ac0..77b485d60b9d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -984,6 +984,9 @@ new_segment:
                        if (!skb)
                                goto wait_for_memory;
+#ifdef CONFIG_TLS_DEVICE
+                        skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
                        skb_entail(sk, skb);
                        copy = size_goal;
                }
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 3d1e15401384..8a56e09cfb0e 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -398,10 +398,14 @@ more_data:
 static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
        struct sk_msg tmp, *msg_tx = NULL;
-        int flags = msg->msg_flags | MSG_NO_SHARED_FRAGS;
        int copied = 0, err = 0;
        struct sk_psock *psock;
        long timeo;
+        int flags;
+        /* Don't let internal do_tcp_sendpages() flags through */
+        flags = (msg->msg_flags & ~MSG_SENDPAGE_DECRYPTED);
+        flags |= MSG_NO_SHARED_FRAGS;
        psock = sk_psock_get(sk);
        if (unlikely(!psock))
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6e4afc48d7bb..979520e46e33 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1320,6 +1320,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
        buff = sk_stream_alloc_skb(sk, nsize, gfp, true);
        if (!buff)
                return -ENOMEM; /* We'll just try again later. */
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -1874,6 +1875,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
        buff = sk_stream_alloc_skb(sk, 0, gfp, true);
        if (unlikely(!buff))
                return -ENOMEM;
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -2143,6 +2145,7 @@ static int tcp_mtu_probe(struct sock *sk)
        sk_mem_charge(sk, nskb->truesize);
        skb = tcp_send_head(sk);
+        skb_copy_decrypted(nskb, skb);
        TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
        TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index dc73888c7859..6a576ff92c39 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -478,7 +478,7 @@ static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
        if (!idev) {
                idev = ipv6_add_dev(dev);
                if (IS_ERR(idev))
-                        return NULL;
+                        return idev;
        }
        if (dev->flags&IFF_UP)
@@ -1045,7 +1045,8 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
        int err = 0;
        if (addr_type == IPV6_ADDR_ANY ||
-            addr_type & IPV6_ADDR_MULTICAST ||
+            (addr_type & IPV6_ADDR_MULTICAST &&
+             !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
            (!(idev->dev->flags & IFF_LOOPBACK) &&
             !netif_is_l3_master(idev->dev) &&
             addr_type & IPV6_ADDR_LOOPBACK))
@@ -2465,8 +2466,8 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return ERR_PTR(-ENOBUFS);
+                return idev;
        if (idev->cnf.disable_ipv6)
                return ERR_PTR(-EACCES);
@@ -3158,7 +3159,7 @@ static void init_loopback(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3373,7 +3374,7 @@ static void addrconf_sit_config(struct net_device *dev)
         */
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3398,7 +3399,7 @@ static void addrconf_gre_config(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -4772,8 +4773,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
                         IFA_F_MCAUTOJOIN | IFA_F_OPTIMISTIC;
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return -ENOBUFS;
+                return PTR_ERR(idev);
        if (!ipv6_allow_optimistic_dad(net, idev))
                cfg.ifa_flags &= ~IFA_F_OPTIMISTIC;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 0f82c150543b..fed9666a2f7d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -348,7 +348,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->ignore_df = 1;
        skb->dev = dev;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index ca05b16f1bb9..1f5d4d196dcc 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -282,7 +282,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, true);
        skb->dev = dev;
        ipv6_hdr(skb)->payload_len = htons(payload_len);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4d458067d80d..111c400199ec 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1546,6 +1546,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (is_multicast_ether_addr(mac))
                return -EINVAL;
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
        sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
        if (!sta)
                return -ENOMEM;
@@ -1553,10 +1558,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                sta->sta.tdls = true;
-        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !sdata->u.mgd.associated)
-                return -EINVAL;
        err = sta_apply_parameters(local, sta, params);
        if (err) {
                sta_info_free(local, sta);
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index d25e91d7bdc1..44b675016393 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -133,12 +133,12 @@ static int mpls_xmit(struct sk_buff *skb)
        mpls_stats_inc_outucastpkts(out_dev, skb);
        if (rt) {
-                if (rt->rt_gw_family == AF_INET)
+                if (rt->rt_gw_family == AF_INET6)
-                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
-                                         skb);
-                else if (rt->rt_gw_family == AF_INET6)
                        err = neigh_xmit(NEIGH_ND_TABLE, out_dev, &rt->rt_gw6,
                                         skb);
+                else
+                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
+                                         skb);
        } else if (rt6) {
                if (ipv6_addr_v4mapped(&rt6->rt6i_gateway)) {
                        /* 6PE (RFC 4798) */
diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c
index 5c3fad8cba57..0187e65176c0 100644
--- a/net/ncsi/ncsi-cmd.c
+++ b/net/ncsi/ncsi-cmd.c
@@ -54,7 +54,7 @@ static void ncsi_cmd_build_header(struct ncsi_pkt_hdr *h,
        checksum = ncsi_calculate_checksum((unsigned char *)h,
                                           sizeof(*h) + nca->payload);
        pchecksum = (__be32 *)((void *)h + sizeof(struct ncsi_pkt_hdr) +
-                    nca->payload);
+                    ALIGN(nca->payload, 4));
        *pchecksum = htonl(checksum);
 }
@@ -309,14 +309,21 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca)
 int ncsi_xmit_cmd(struct ncsi_cmd_arg *nca)
 {
+        struct ncsi_cmd_handler *nch = NULL;
        struct ncsi_request *nr;
+        unsigned char type;
        struct ethhdr *eh;
-        struct ncsi_cmd_handler *nch = NULL;
        int i, ret;
+        /* Use OEM generic handler for Netlink request */
+        if (nca->req_flags == NCSI_REQ_FLAG_NETLINK_DRIVEN)
+                type = NCSI_PKT_CMD_OEM;
+        else
+                type = nca->type;
        /* Search for the handler */
        for (i = 0; i < ARRAY_SIZE(ncsi_cmd_handlers); i++) {
-                if (ncsi_cmd_handlers[i].type == nca->type) {
+                if (ncsi_cmd_handlers[i].type == type) {
                        if (ncsi_cmd_handlers[i].handler)
                                nch = &ncsi_cmd_handlers[i];
                        else
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 7581bf919885..d876bd55f356 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -47,7 +47,8 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
        if (ntohs(h->code) != NCSI_PKT_RSP_C_COMPLETED ||
            ntohs(h->reason) != NCSI_PKT_RSP_R_NO_ERROR) {
                netdev_dbg(nr->ndp->ndev.dev,
-                           "NCSI: non zero response/reason code\n");
+                           "NCSI: non zero response/reason code %04xh, %04xh\n",
+                            ntohs(h->code), ntohs(h->reason));
                return -EPERM;
        }
@@ -55,7 +56,7 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
         * sender doesn't support checksum according to NCSI
         * specification.
         */
-        pchecksum = (__be32 *)((void *)(h + 1) + payload - 4);
+        pchecksum = (__be32 *)((void *)(h + 1) + ALIGN(payload, 4) - 4);
        if (ntohl(*pchecksum) == 0)
                return 0;
@@ -63,7 +64,9 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
                                           sizeof(*h) + payload - 4);
        if (*pchecksum != htonl(checksum)) {
-                netdev_dbg(nr->ndp->ndev.dev, "NCSI: checksum mismatched\n");
+                netdev_dbg(nr->ndp->ndev.dev,
+                           "NCSI: checksum mismatched; recd: %08x calc: %08x\n",
+                           *pchecksum, htonl(checksum));
                return -EINVAL;
        }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a542761e90d1..81a8ef42b88d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -453,13 +453,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 * table location, we assume id gets exposed to userspace.
 *
 * Following nf_conn items do not change throughout lifetime
- * of the nf_conn after it has been committed to main hash table:
+ * of the nf_conn:
 *
 * 1. nf_conn address
- * 2. nf_conn->ext address
+ * 2. nf_conn->master address (normally NULL)
- * 3. nf_conn->master address (normally NULL)
+ * 3. the associated net namespace
- * 4. tuple
+ * 4. the original direction tuple
- * 5. the associated net namespace
 */
 u32 nf_ct_get_id(const struct nf_conn *ct)
 {
@@ -469,9 +468,10 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
        net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
        a = (unsigned long)ct;
-        b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+        b = (unsigned long)ct->master;
-        c = (unsigned long)ct->ext;
+        c = (unsigned long)nf_ct_net(ct);
-        d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+        d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                   sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
                                   &ct_id_seed);
 #ifdef CONFIG_64BIT
        return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index e3d797252a98..80a8f9ae4c93 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -111,15 +111,16 @@ static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
 #define NF_FLOWTABLE_TCP_PICKUP_TIMEOUT (120 * HZ)
 #define NF_FLOWTABLE_UDP_PICKUP_TIMEOUT (30 * HZ)
-static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+static inline __s32 nf_flow_timeout_delta(unsigned int timeout)
+{
+        return (__s32)(timeout - (u32)jiffies);
+}
+static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
 {
        const struct nf_conntrack_l4proto *l4proto;
+        int l4num = nf_ct_protonum(ct);
        unsigned int timeout;
-        int l4num;
-        l4num = nf_ct_protonum(ct);
-        if (l4num == IPPROTO_TCP)
-                flow_offload_fixup_tcp(&ct->proto.tcp);
        l4proto = nf_ct_l4proto_find(l4num);
        if (!l4proto)
@@ -132,7 +133,20 @@ static void flow_offload_fixup_ct_state(struct nf_conn *ct)
        else
                return;
-        ct->timeout = nfct_time_stamp + timeout;
+        if (nf_flow_timeout_delta(ct->timeout) > (__s32)timeout)
+                ct->timeout = nfct_time_stamp + timeout;
+}
+static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+{
+        if (nf_ct_protonum(ct) == IPPROTO_TCP)
+                flow_offload_fixup_tcp(&ct->proto.tcp);
+}
+static void flow_offload_fixup_ct(struct nf_conn *ct)
+{
+        flow_offload_fixup_ct_state(ct);
+        flow_offload_fixup_ct_timeout(ct);
 }
 void flow_offload_free(struct flow_offload *flow)
@@ -208,6 +222,11 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
+static inline bool nf_flow_has_expired(const struct flow_offload *flow)
+{
+        return nf_flow_timeout_delta(flow->timeout) <= 0;
+}
 static void flow_offload_del(struct nf_flowtable *flow_table,
                             struct flow_offload *flow)
 {
@@ -223,6 +242,11 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
        e = container_of(flow, struct flow_offload_entry, flow);
        clear_bit(IPS_OFFLOAD_BIT, &e->ct->status);
+        if (nf_flow_has_expired(flow))
+                flow_offload_fixup_ct(e->ct);
+        else if (flow->flags & FLOW_OFFLOAD_TEARDOWN)
+                flow_offload_fixup_ct_timeout(e->ct);
        flow_offload_free(flow);
 }
@@ -298,11 +322,6 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
        return err;
 }
-static inline bool nf_flow_has_expired(const struct flow_offload *flow)
-{
-        return (__s32)(flow->timeout - (u32)jiffies) <= 0;
-}
 static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
 {
        struct nf_flowtable *flow_table = data;
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index cdfc33517e85..d68c801dd614 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -214,6 +214,25 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
        return true;
 }
+static int nf_flow_offload_dst_check(struct dst_entry *dst)
+{
+        if (unlikely(dst_xfrm(dst)))
+                return dst_check(dst, 0) ? 0 : -1;
+        return 0;
+}
+static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+                                      const struct nf_hook_state *state,
+                                      struct dst_entry *dst)
+{
+        skb_orphan(skb);
+        skb_dst_set_noref(skb, dst);
+        skb->tstamp = 0;
+        dst_output(state->net, state->sk, skb);
+        return NF_STOLEN;
+}
 unsigned int
 nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
                        const struct nf_hook_state *state)
@@ -254,6 +273,11 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (nf_flow_nat_ip(flow, skb, thoff, dir) < 0)
                return NF_DROP;
@@ -261,6 +285,13 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        iph = ip_hdr(skb);
        ip_decrease_ttl(iph);
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet_skb_parm));
+                IPCB(skb)->iif = skb->dev->ifindex;
+                IPCB(skb)->flags = IPSKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
        skb_dst_set_noref(skb, &rt->dst);
@@ -467,6 +498,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
                                sizeof(*ip6h)))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (skb_try_make_writable(skb, sizeof(*ip6h)))
                return NF_DROP;
@@ -477,6 +513,13 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        ip6h = ipv6_hdr(skb);
        ip6h->hop_limit--;
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+                IP6CB(skb)->iif = skb->dev->ifindex;
+                IP6CB(skb)->flags = IP6SKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
        skb_dst_set_noref(skb, &rt->dst);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 605a7cfe7ca7..d47469f824a1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -138,9 +138,14 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
                return;
        list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
-                if (trans->msg_type == NFT_MSG_NEWSET &&
+                switch (trans->msg_type) {
-                    nft_trans_set(trans) == set) {
+                case NFT_MSG_NEWSET:
-                        set->bound = true;
+                        if (nft_trans_set(trans) == set)
+                                nft_trans_set_bound(trans) = true;
+                        break;
+                case NFT_MSG_NEWSETELEM:
+                        if (nft_trans_elem_set(trans) == set)
+                                nft_trans_elem_set_bound(trans) = true;
                        break;
                }
        }
@@ -1662,6 +1667,10 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
                chain->flags |= NFT_BASE_CHAIN | flags;
                basechain->policy = NF_ACCEPT;
+                if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
+                    nft_chain_offload_priority(basechain) < 0)
+                        return -EOPNOTSUPP;
                flow_block_init(&basechain->flow_block);
        } else {
                chain = kzalloc(sizeof(*chain), GFP_KERNEL);
@@ -6906,7 +6915,7 @@ static int __nf_tables_abort(struct net *net)
                        break;
                case NFT_MSG_NEWSET:
                        trans->ctx.table->use--;
-                        if (nft_trans_set(trans)->bound) {
+                        if (nft_trans_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
@@ -6918,7 +6927,7 @@ static int __nf_tables_abort(struct net *net)
                        nft_trans_destroy(trans);
                        break;
                case NFT_MSG_NEWSETELEM:
-                        if (nft_trans_elem_set(trans)->bound) {
+                        if (nft_trans_elem_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 64f5fd5f240e..c0d18c1d77ac 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -103,10 +103,11 @@ void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
 }
 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
-                                         __be16 proto,
+                                         __be16 proto, int priority,
-                                        struct netlink_ext_ack *extack)
+                                         struct netlink_ext_ack *extack)
 {
        common->protocol = proto;
+        common->prio = priority;
        common->extack = extack;
 }
@@ -124,6 +125,15 @@ static int nft_setup_cb_call(struct nft_base_chain *basechain,
        return 0;
 }
+int nft_chain_offload_priority(struct nft_base_chain *basechain)
+{
+        if (basechain->ops.priority <= 0 ||
+            basechain->ops.priority > USHRT_MAX)
+                return -1;
+        return 0;
+}
 static int nft_flow_offload_rule(struct nft_trans *trans,
                                 enum flow_cls_command command)
 {
@@ -142,7 +152,8 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
        if (flow)
                proto = flow->proto;
-        nft_flow_offload_common_init(&cls_flow.common, proto, &extack);
+        nft_flow_offload_common_init(&cls_flow.common, proto,
+                                     basechain->ops.priority, &extack);
        cls_flow.command = command;
        cls_flow.cookie = (unsigned long) rule;
        if (flow)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index aa5f571d4361..01705ad74a9a 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -72,11 +72,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 {
        struct nft_flow_offload *priv = nft_expr_priv(expr);
        struct nf_flowtable *flowtable = &priv->flowtable->data;
+        struct tcphdr _tcph, *tcph = NULL;
        enum ip_conntrack_info ctinfo;
        struct nf_flow_route route;
        struct flow_offload *flow;
        enum ip_conntrack_dir dir;
-        bool is_tcp = false;
        struct nf_conn *ct;
        int ret;
@@ -89,7 +89,10 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
        case IPPROTO_TCP:
-                is_tcp = true;
+                tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff,
+                                          sizeof(_tcph), &_tcph);
+                if (unlikely(!tcph || tcph->fin || tcph->rst))
+                        goto out;
                break;
        case IPPROTO_UDP:
                break;
@@ -115,7 +118,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        if (!flow)
                goto err_flow_alloc;
-        if (is_tcp) {
+        if (tcph) {
                ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
                ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
        }
@@ -146,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
        return nft_chain_validate_hooks(ctx->chain, hook_mask);
 }
+static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = {
+        [NFTA_FLOW_TABLE_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_NAME_MAXLEN - 1 },
+};
 static int nft_flow_offload_init(const struct nft_ctx *ctx,
                                 const struct nft_expr *expr,
                                 const struct nlattr * const tb[])
@@ -204,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
 static struct nft_expr_type nft_flow_offload_type __read_mostly = {
        .name           = "flow_offload",
        .ops            = &nft_flow_offload_ops,
+        .policy         = nft_flow_offload_policy,
        .maxattr        = NFTA_FLOW_MAX,
        .owner          = THIS_MODULE,
 };
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index d0ab1adf5bff..5aab6df74e0f 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -54,25 +54,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
        nfnl_acct_put(info->nfacct);
 }
-static struct xt_match nfacct_mt_reg __read_mostly = {
+static struct xt_match nfacct_mt_reg[] __read_mostly = {
-        .name       = "nfacct",
+        {
-        .family     = NFPROTO_UNSPEC,
+                .name       = "nfacct",
-        .checkentry = nfacct_mt_checkentry,
+                .revision   = 0,
-        .match      = nfacct_mt,
+                .family     = NFPROTO_UNSPEC,
-        .destroy    = nfacct_mt_destroy,
+                .checkentry = nfacct_mt_checkentry,
-        .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .match      = nfacct_mt,
-        .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .destroy    = nfacct_mt_destroy,
-        .me         = THIS_MODULE,
+                .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "nfacct",
+                .revision   = 1,
+                .family     = NFPROTO_UNSPEC,
+                .checkentry = nfacct_mt_checkentry,
+                .match      = nfacct_mt,
+                .destroy    = nfacct_mt_destroy,
+                .matchsize  = sizeof(struct xt_nfacct_match_info_v1),
+                .usersize   = offsetof(struct xt_nfacct_match_info_v1, nfacct),
+                .me         = THIS_MODULE,
+        },
 };
 static int __init nfacct_mt_init(void)
 {
-        return xt_register_match(&nfacct_mt_reg);
+        return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 static void __exit nfacct_mt_exit(void)
 {
-        xt_unregister_match(&nfacct_mt_reg);
+        xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 module_init(nfacct_mt_init);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 848c6eb55064..d8da6477d6be 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -67,6 +67,7 @@ struct ovs_conntrack_info {
        struct md_mark mark;
        struct md_labels labels;
        char timeout[CTNL_TIMEOUT_NAME_MAX];
+        struct nf_ct_timeout *nf_ct_timeout;
 #if IS_ENABLED(CONFIG_NF_NAT)
        struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -697,6 +698,14 @@ static bool skb_nfct_cached(struct net *net,
                if (help && rcu_access_pointer(help->helper) != info->helper)
                        return false;
        }
+        if (info->nf_ct_timeout) {
+                struct nf_conn_timeout *timeout_ext;
+                timeout_ext = nf_ct_timeout_find(ct);
+                if (!timeout_ext || info->nf_ct_timeout !=
+                    rcu_dereference(timeout_ext->timeout))
+                        return false;
+        }
        /* Force conntrack entry direction to the current packet? */
        if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
                /* Delete the conntrack entry if confirmed, else just release
@@ -1565,7 +1574,7 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                case OVS_CT_ATTR_TIMEOUT:
                        memcpy(info->timeout, nla_data(a), nla_len(a));
                        if (!memchr(info->timeout, '\0', nla_len(a))) {
-                                OVS_NLERR(log, "Invalid conntrack helper");
+                                OVS_NLERR(log, "Invalid conntrack timeout");
                                return -EINVAL;
                        }
                        break;
@@ -1657,6 +1666,10 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                                      ct_info.timeout))
                        pr_info_ratelimited("Failed to associated timeout "
                                            "policy `%s'\n", ct_info.timeout);
+                else
+                        ct_info.nf_ct_timeout = rcu_dereference(
+                                nf_ct_timeout_find(ct_info.ct)->timeout);
        }
        if (helper) {
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8d54f3047768..e2742b006d25 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2618,6 +2618,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        mutex_lock(&po->pg_vec_lock);
+        /* packet_sendmsg() check on tx_ring.pg_vec was lockless,
+         * we need to confirm it under protection of pg_vec_lock.
+         */
+        if (unlikely(!po->tx_ring.pg_vec)) {
+                err = -EBUSY;
+                goto out;
+        }
        if (likely(saddr == NULL)) {
                dev     = packet_cached_dev_get(po);
                proto   = po->num;
diff --git a/net/rds/ib.c b/net/rds/ib.c
index ec05d91aa9a2..45acab2de0cf 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -291,7 +291,7 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                                    void *buffer)
 {
        struct rds_info_rdma_connection *iinfo = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -301,15 +301,16 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo->src_addr = conn->c_laddr.s6_addr32[3];
        iinfo->dst_addr = conn->c_faddr.s6_addr32[3];
-        iinfo->tos = conn->c_tos;
+        if (ic) {
+                iinfo->tos = conn->c_tos;
+                iinfo->sl = ic->i_sl;
+        }
        memset(&iinfo->src_gid, 0, sizeof(iinfo->src_gid));
        memset(&iinfo->dst_gid, 0, sizeof(iinfo->dst_gid));
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo->src_gid,
                               (union ib_gid *)&iinfo->dst_gid);
@@ -329,7 +330,7 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
                                     void *buffer)
 {
        struct rds6_info_rdma_connection *iinfo6 = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -337,6 +338,10 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo6->src_addr = conn->c_laddr;
        iinfo6->dst_addr = conn->c_faddr;
+        if (ic) {
+                iinfo6->tos = conn->c_tos;
+                iinfo6->sl = ic->i_sl;
+        }
        memset(&iinfo6->src_gid, 0, sizeof(iinfo6->src_gid));
        memset(&iinfo6->dst_gid, 0, sizeof(iinfo6->dst_gid));
@@ -344,7 +349,6 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo6->src_gid,
                               (union ib_gid *)&iinfo6->dst_gid);
                rds_ibdev = ic->rds_ibdev;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 303c6ee8bdb7..f2b558e8b5ea 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -220,6 +220,7 @@ struct rds_ib_connection {
        /* Send/Recv vectors */
        int                     i_scq_vector;
        int                     i_rcq_vector;
+        u8                      i_sl;
 };
 /* This assumes that atomic_t is at least 32 bits */
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index fddaa09f7b0d..233f1368162b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -152,6 +152,9 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                  RDS_PROTOCOL_MINOR(conn->c_version),
                  ic->i_flowctl ? ", flow control" : "");
+        /* receive sl from the peer */
+        ic->i_sl = ic->i_cm_id->route.path_rec->sl;
        atomic_set(&ic->i_cq_quiesce, 0);
        /* Init rings and fill recv. this needs to wait until protocol
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 9986d6065c4d..5f741e51b4ba 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -43,6 +43,9 @@ static struct rdma_cm_id *rds_rdma_listen_id;
 static struct rdma_cm_id *rds6_rdma_listen_id;
 #endif
+/* Per IB specification 7.7.3, service level is a 4-bit field. */
+#define TOS_TO_SL(tos)          ((tos) & 0xF)
 static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                                         struct rdma_cm_event *event,
                                         bool isv6)
@@ -97,10 +100,13 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                        struct rds_ib_connection *ibic;
                        ibic = conn->c_transport_data;
-                        if (ibic && ibic->i_cm_id == cm_id)
+                        if (ibic && ibic->i_cm_id == cm_id) {
+                                cm_id->route.path_rec[0].sl =
+                                        TOS_TO_SL(conn->c_tos);
                                ret = trans->cm_initiate_connect(cm_id, isv6);
-                        else
+                        } else {
                                rds_conn_drop(conn);
+                        }
                }
                break;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d09eaf153544..0dbbfd1b6487 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -193,7 +193,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 service_in_use:
        write_unlock(&local->services_lock);
-        rxrpc_put_local(local);
+        rxrpc_unuse_local(local);
        ret = -EADDRINUSE;
 error_unlock:
        release_sock(&rx->sk);
@@ -402,7 +402,7 @@ EXPORT_SYMBOL(rxrpc_kernel_check_life);
 */
 void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
 {
-        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                          rxrpc_propose_ack_ping_for_check_life);
        rxrpc_send_ack_packet(call, true, NULL);
 }
@@ -901,7 +901,7 @@ static int rxrpc_release_sock(struct sock *sk)
        rxrpc_queue_work(&rxnet->service_conn_reaper);
        rxrpc_queue_work(&rxnet->client_conn_reaper);
-        rxrpc_put_local(rx->local);
+        rxrpc_unuse_local(rx->local);
        rx->local = NULL;
        key_put(rx->key);
        rx->key = NULL;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 822f45386e31..145335611af6 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -254,7 +254,8 @@ struct rxrpc_security {
 */
 struct rxrpc_local {
        struct rcu_head         rcu;
-        atomic_t                usage;
+        atomic_t                active_users;   /* Number of users of the local endpoint */
+        atomic_t                usage;          /* Number of references to the structure */
        struct rxrpc_net        *rxnet;         /* The network ns in which this resides */
        struct list_head        link;
        struct socket           *socket;        /* my UDP socket */
@@ -649,7 +650,6 @@ struct rxrpc_call {
        /* receive-phase ACK management */
        u8                      ackr_reason;    /* reason to ACK */
-        u16                     ackr_skew;      /* skew on packet being ACK'd */
        rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
        rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
@@ -743,7 +743,7 @@ int rxrpc_reject_call(struct rxrpc_sock *);
 /*
 * call_event.c
 */
-void rxrpc_propose_ACK(struct rxrpc_call *, u8, u16, u32, bool, bool,
+void rxrpc_propose_ACK(struct rxrpc_call *, u8, u32, bool, bool,
                       enum rxrpc_propose_ack_trace);
 void rxrpc_process_call(struct work_struct *);
@@ -1002,6 +1002,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
 struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
 struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
 void rxrpc_put_local(struct rxrpc_local *);
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
+void rxrpc_unuse_local(struct rxrpc_local *);
 void rxrpc_queue_local(struct rxrpc_local *);
 void rxrpc_destroy_all_locals(struct rxrpc_net *);
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index bc2adeb3acb9..c767679bfa5d 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -43,8 +43,7 @@ static void rxrpc_propose_ping(struct rxrpc_call *call,
 * propose an ACK be sent
 */
 static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                                u16 skew, u32 serial, bool immediate,
+                                u32 serial, bool immediate, bool background,
-                                bool background,
                                enum rxrpc_propose_ack_trace why)
 {
        enum rxrpc_propose_ack_outcome outcome = rxrpc_propose_ack_use;
@@ -69,14 +68,12 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
                if (RXRPC_ACK_UPDATEABLE & (1 << ack_reason)) {
                        outcome = rxrpc_propose_ack_update;
                        call->ackr_serial = serial;
-                        call->ackr_skew = skew;
                }
                if (!immediate)
                        goto trace;
        } else if (prior > rxrpc_ack_priority[call->ackr_reason]) {
                call->ackr_reason = ack_reason;
                call->ackr_serial = serial;
-                call->ackr_skew = skew;
        } else {
                outcome = rxrpc_propose_ack_subsume;
        }
@@ -137,11 +134,11 @@ trace:
 * propose an ACK be sent, locking the call structure
 */
 void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                       u16 skew, u32 serial, bool immediate, bool background,
+                       u32 serial, bool immediate, bool background,
                       enum rxrpc_propose_ack_trace why)
 {
        spin_lock_bh(&call->lock);
-        __rxrpc_propose_ACK(call, ack_reason, skew, serial,
+        __rxrpc_propose_ACK(call, ack_reason, serial,
                            immediate, background, why);
        spin_unlock_bh(&call->lock);
 }
@@ -239,7 +236,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                ack_ts = ktime_sub(now, call->acks_latest_ts);
                if (ktime_to_ns(ack_ts) < call->peer->rtt)
                        goto out;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                rxrpc_send_ack_packet(call, true, NULL);
                goto out;
@@ -372,7 +369,7 @@ recheck_state:
        if (time_after_eq(now, t)) {
                trace_rxrpc_timer(call, rxrpc_timer_exp_keepalive, now);
                cmpxchg(&call->keepalive_at, t, now + MAX_JIFFY_OFFSET);
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, true,
                                  rxrpc_propose_ack_ping_for_keepalive);
                set_bit(RXRPC_CALL_EV_PING, &call->events);
        }
@@ -407,7 +404,7 @@ recheck_state:
        send_ack = NULL;
        if (test_and_clear_bit(RXRPC_CALL_EV_ACK_LOST, &call->events)) {
                call->acks_lost_top = call->tx_top;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                send_ack = &call->acks_lost_ping;
        }
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 5bd6f1546e5c..dd47d465d1d3 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -196,15 +196,14 @@ send_extra_data:
 * Ping the other end to fill our RTT cache and to retrieve the rwind
 * and MTU parameters.
 */
-static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb)
-                            int skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        ktime_t now = skb->tstamp;
        if (call->peer->rtt_usage < 3 ||
            ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000), now))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  true, true,
                                  rxrpc_propose_ack_ping_for_params);
 }
@@ -419,8 +418,7 @@ static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
 /*
 * Process a DATA packet, adding the packet to the Rx ring.
 */
-static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb)
-                             u16 skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        enum rxrpc_call_state state;
@@ -600,11 +598,11 @@ skip:
 ack:
        if (ack)
-                rxrpc_propose_ACK(call, ack, skew, ack_serial,
+                rxrpc_propose_ACK(call, ack, ack_serial,
                                  immediate_ack, true,
                                  rxrpc_propose_ack_input_data);
        else
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, skew, serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                  false, true,
                                  rxrpc_propose_ack_input_data);
@@ -822,8 +820,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
 * soft-ACK means that the packet may be discarded and retransmission
 * requested.  A phase is complete when all packets are hard-ACK'd.
 */
-static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
-                            u16 skew)
 {
        struct rxrpc_ack_summary summary = { 0 };
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -867,11 +864,11 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
        if (buf.ack.reason == RXRPC_ACK_PING) {
                _proto("Rx ACK %%%u PING Request", sp->hdr.serial);
                rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ping);
        } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
                rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ack);
        }
@@ -948,7 +945,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
            RXRPC_TX_ANNO_LAST &&
            summary.nr_acks == call->tx_top - hard_ack &&
            rxrpc_is_client_call(call))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  false, true,
                                  rxrpc_propose_ack_ping_for_lost_reply);
@@ -1004,7 +1001,7 @@ static void rxrpc_input_abort(struct rxrpc_call *call, struct sk_buff *skb)
 * Process an incoming call packet.
 */
 static void rxrpc_input_call_packet(struct rxrpc_call *call,
-                                    struct sk_buff *skb, u16 skew)
+                                    struct sk_buff *skb)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned long timo;
@@ -1023,11 +1020,11 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
        switch (sp->hdr.type) {
        case RXRPC_PACKET_TYPE_DATA:
-                rxrpc_input_data(call, skb, skew);
+                rxrpc_input_data(call, skb);
                break;
        case RXRPC_PACKET_TYPE_ACK:
-                rxrpc_input_ack(call, skb, skew);
+                rxrpc_input_ack(call, skb);
                break;
        case RXRPC_PACKET_TYPE_BUSY:
@@ -1108,8 +1105,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
 {
        _enter("%p,%p", local, skb);
-        skb_queue_tail(&local->event_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->event_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        }
 }
 /*
@@ -1119,8 +1120,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
 {
        CHECK_SLAB_OKAY(&local->usage);
-        skb_queue_tail(&local->reject_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->reject_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        }
 }
 /*
@@ -1173,7 +1178,6 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
        struct rxrpc_peer *peer = NULL;
        struct rxrpc_sock *rx = NULL;
        unsigned int channel;
-        int skew = 0;
        _enter("%p", udp_sk);
@@ -1301,15 +1305,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                        goto out;
                }
-                /* Note the serial number skew here */
+                if ((int)sp->hdr.serial - (int)conn->hi_serial > 0)
-                skew = (int)sp->hdr.serial - (int)conn->hi_serial;
+                        conn->hi_serial = sp->hdr.serial;
-                if (skew >= 0) {
-                        if (skew > 0)
-                                conn->hi_serial = sp->hdr.serial;
-                } else {
-                        skew = -skew;
-                        skew = min(skew, 65535);
-                }
                /* Call-bound packets are routed by connection channel. */
                channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -1372,11 +1369,11 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                call = rxrpc_new_incoming_call(local, rx, skb);
                if (!call)
                        goto reject_packet;
-                rxrpc_send_ping(call, skb, skew);
+                rxrpc_send_ping(call, skb);
                mutex_unlock(&call->user_mutex);
        }
-        rxrpc_input_call_packet(call, skb, skew);
+        rxrpc_input_call_packet(call, skb);
        goto discard;
 discard:
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index b1c71bad510b..72a6e12a9304 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -79,6 +79,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
        local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
        if (local) {
                atomic_set(&local->usage, 1);
+                atomic_set(&local->active_users, 1);
                local->rxnet = rxnet;
                INIT_LIST_HEAD(&local->link);
                INIT_WORK(&local->processor, rxrpc_local_processor);
@@ -92,7 +93,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
                local->debug_id = atomic_inc_return(&rxrpc_debug_id);
                memcpy(&local->srx, srx, sizeof(*srx));
                local->srx.srx_service = 0;
-                trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
        }
        _leave(" = %p", local);
@@ -266,11 +267,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
                 * bind the transport socket may still fail if we're attempting
                 * to use a local address that the dying object is still using.
                 */
-                if (!rxrpc_get_local_maybe(local)) {
+                if (!rxrpc_use_local(local))
-                        cursor = cursor->next;
-                        list_del_init(&local->link);
                        break;
-                }
                age = "old";
                goto found;
@@ -284,7 +282,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
        if (ret < 0)
                goto sock_error;
-        list_add_tail(&local->link, cursor);
+        if (cursor != &rxnet->local_endpoints)
+                list_replace_init(cursor, &local->link);
+        else
+                list_add_tail(&local->link, cursor);
        age = "new";
 found:
@@ -320,7 +321,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
        int n;
        n = atomic_inc_return(&local->usage);
-        trace_rxrpc_local(local, rxrpc_local_got, n, here);
+        trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
        return local;
 }
@@ -334,7 +335,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
        if (local) {
                int n = atomic_fetch_add_unless(&local->usage, 1, 0);
                if (n > 0)
-                        trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
+                        trace_rxrpc_local(local->debug_id, rxrpc_local_got,
+                                          n + 1, here);
                else
                        local = NULL;
        }
@@ -342,24 +344,18 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 }
 /*
- * Queue a local endpoint.
+ * Queue a local endpoint and pass the caller's reference to the work item.
 */
 void rxrpc_queue_local(struct rxrpc_local *local)
 {
        const void *here = __builtin_return_address(0);
+        unsigned int debug_id = local->debug_id;
+        int n = atomic_read(&local->usage);
        if (rxrpc_queue_work(&local->processor))
-                trace_rxrpc_local(local, rxrpc_local_queued,
+                trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
-                                  atomic_read(&local->usage), here);
+        else
-}
+                rxrpc_put_local(local);
-/*
- * A local endpoint reached its end of life.
- */
-static void __rxrpc_put_local(struct rxrpc_local *local)
-{
-        _enter("%d", local->debug_id);
-        rxrpc_queue_work(&local->processor);
 }
 /*
@@ -372,10 +368,47 @@ void rxrpc_put_local(struct rxrpc_local *local)
        if (local) {
                n = atomic_dec_return(&local->usage);
-                trace_rxrpc_local(local, rxrpc_local_put, n, here);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
                if (n == 0)
-                        __rxrpc_put_local(local);
+                        call_rcu(&local->rcu, rxrpc_local_rcu);
+        }
+}
+/*
+ * Start using a local endpoint.
+ */
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        local = rxrpc_get_local_maybe(local);
+        if (!local)
+                return NULL;
+        au = atomic_fetch_add_unless(&local->active_users, 1, 0);
+        if (au == 0) {
+                rxrpc_put_local(local);
+                return NULL;
+        }
+        return local;
+}
+/*
+ * Cease using a local endpoint.  Once the number of active users reaches 0, we
+ * start the closure of the transport in the work processor.
+ */
+void rxrpc_unuse_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        if (local) {
+                au = atomic_dec_return(&local->active_users);
+                if (au == 0)
+                        rxrpc_queue_local(local);
+                else
+                        rxrpc_put_local(local);
        }
 }
@@ -393,16 +426,6 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
        _enter("%d", local->debug_id);
-        /* We can get a race between an incoming call packet queueing the
-         * processor again and the work processor starting the destruction
-         * process which will shut down the UDP socket.
-         */
-        if (local->dead) {
-                _leave(" [already dead]");
-                return;
-        }
-        local->dead = true;
        mutex_lock(&rxnet->local_mutex);
        list_del_init(&local->link);
        mutex_unlock(&rxnet->local_mutex);
@@ -422,13 +445,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
         */
        rxrpc_purge_queue(&local->reject_queue);
        rxrpc_purge_queue(&local->event_queue);
-        _debug("rcu local %d", local->debug_id);
-        call_rcu(&local->rcu, rxrpc_local_rcu);
 }
 /*
- * Process events on an endpoint
+ * Process events on an endpoint.  The work item carries a ref which
+ * we must release.
 */
 static void rxrpc_local_processor(struct work_struct *work)
 {
@@ -436,13 +457,15 @@ static void rxrpc_local_processor(struct work_struct *work)
                container_of(work, struct rxrpc_local, processor);
        bool again;
-        trace_rxrpc_local(local, rxrpc_local_processing,
+        trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
                          atomic_read(&local->usage), NULL);
        do {
                again = false;
-                if (atomic_read(&local->usage) == 0)
+                if (atomic_read(&local->active_users) == 0) {
-                        return rxrpc_local_destroyer(local);
+                        rxrpc_local_destroyer(local);
+                        break;
+                }
                if (!skb_queue_empty(&local->reject_queue)) {
                        rxrpc_reject_packets(local);
@@ -454,6 +477,8 @@ static void rxrpc_local_processor(struct work_struct *work)
                        again = true;
                }
        } while (again);
+        rxrpc_put_local(local);
 }
 /*
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 948e3fe249ec..369e516c4bdf 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -87,7 +87,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
        *_top = top;
        pkt->ack.bufferSpace    = htons(8);
-        pkt->ack.maxSkew        = htons(call->ackr_skew);
+        pkt->ack.maxSkew        = htons(0);
        pkt->ack.firstPacket    = htonl(hard_ack + 1);
        pkt->ack.previousPacket = htonl(call->ackr_prev_seq);
        pkt->ack.serial         = htonl(serial);
@@ -228,7 +228,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
                        if (ping)
                                clear_bit(RXRPC_CALL_PINGING, &call->flags);
                        rxrpc_propose_ACK(call, pkt->ack.reason,
-                                          ntohs(pkt->ack.maxSkew),
                                          ntohl(pkt->ack.serial),
                                          false, true,
                                          rxrpc_propose_ack_retry_tx);
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 5abf46cf9e6c..9a7e1bc9791d 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -141,7 +141,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
        ASSERTCMP(call->rx_hard_ack, ==, call->rx_top);
        if (call->state == RXRPC_CALL_CLIENT_RECV_REPLY) {
-                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, serial, false, true,
                                  rxrpc_propose_ack_terminal_ack);
                //rxrpc_send_ack_packet(call, false, NULL);
        }
@@ -159,7 +159,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
                call->state = RXRPC_CALL_SERVER_ACK_REQUEST;
                call->expect_req_by = jiffies + MAX_JIFFY_OFFSET;
                write_unlock_bh(&call->state_lock);
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial, false, true,
                                  rxrpc_propose_ack_processing_op);
                break;
        default:
@@ -212,7 +212,7 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
                if (after_eq(hard_ack, call->ackr_consumed + 2) ||
                    after_eq(top, call->ackr_seen + 2) ||
                    (hard_ack == top && after(hard_ack, call->ackr_consumed)))
-                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial,
+                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                          true, true,
                                          rxrpc_propose_ack_rotate_rx);
                if (call->ackr_reason && call->ackr_reason != RXRPC_ACK_DELAY)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index b100870f02a6..37dced00b63d 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -307,6 +307,17 @@ static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index)
        return tcf_idr_search(tn, a, index);
 }
+static size_t tcf_skbedit_get_fill_size(const struct tc_action *act)
+{
+        return nla_total_size(sizeof(struct tc_skbedit))
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_PRIORITY */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_QUEUE_MAPPING */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MARK */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_PTYPE */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MASK */
+                + nla_total_size_64bit(sizeof(u64)); /* TCA_SKBEDIT_FLAGS */
+}
 static struct tc_action_ops act_skbedit_ops = {
        .kind           =       "skbedit",
        .id             =       TCA_ID_SKBEDIT,
@@ -316,6 +327,7 @@ static struct tc_action_ops act_skbedit_ops = {
        .init           =       tcf_skbedit_init,
        .cleanup        =       tcf_skbedit_cleanup,
        .walk           =       tcf_skbedit_walker,
+        .get_fill_size  =       tcf_skbedit_get_fill_size,
        .lookup         =       tcf_skbedit_search,
        .size           =       sizeof(struct tcf_skbedit),
 };
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c39db507ba3f..e25d414ae12f 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1195,7 +1195,8 @@ unlock:
        spin_unlock_bh(qdisc_lock(sch));
 free_sched:
-        kfree(new_admin);
+        if (new_admin)
+                call_rcu(&new_admin->rcu, taprio_free_sched_cb);
        return err;
 }
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index a554d6d15d1b..1cf5bb5b73c4 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -546,7 +546,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
         */
        if (net->sctp.pf_enable &&
           (transport->state == SCTP_ACTIVE) &&
-           (asoc->pf_retrans < transport->pathmaxrxt) &&
+           (transport->error_count < transport->pathmaxrxt) &&
           (transport->error_count > asoc->pf_retrans)) {
                sctp_assoc_control_transport(asoc, transport,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 25946604af85..e83cdaa2ab76 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -316,6 +316,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
                nstr_list[i] = htons(str_list[i]);
        if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
+                kfree(nstr_list);
                retval = -EAGAIN;
                goto out;
        }
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index f0de323d15d6..6c8f09c1ce51 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -76,13 +76,11 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        struct smc_connection *conn = &smc->conn;
        struct sock *sk = &smc->sk;
-        bool noblock;
        long timeo;
        int rc = 0;
        /* similar to sk_stream_wait_memory */
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
-        noblock = timeo ? false : true;
        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -97,8 +95,8 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
                        break;
                }
                if (!timeo) {
-                        if (noblock)
+                        /* ensure EPOLLOUT is subsequently generated */
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                        rc = -EAGAIN;
                        break;
                }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d8679b6027e9..a07b516e503a 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1970,6 +1970,7 @@ call_bind(struct rpc_task *task)
 static void
 call_bind_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        int status = -EIO;
        if (rpc_task_transmitted(task)) {
@@ -1977,14 +1978,15 @@ call_bind_status(struct rpc_task *task)
                return;
        }
-        if (task->tk_status >= 0) {
+        dprint_status(task);
-                dprint_status(task);
+        trace_rpc_bind_status(task);
+        if (task->tk_status >= 0)
+                goto out_next;
+        if (xprt_bound(xprt)) {
                task->tk_status = 0;
-                task->tk_action = call_connect;
+                goto out_next;
-                return;
        }
-        trace_rpc_bind_status(task);
        switch (task->tk_status) {
        case -ENOMEM:
                dprintk("RPC: %5u rpcbind out of memory\n", task->tk_pid);
@@ -2003,6 +2005,9 @@ call_bind_status(struct rpc_task *task)
                task->tk_rebind_retry--;
                rpc_delay(task, 3*HZ);
                goto retry_timeout;
+        case -ENOBUFS:
+                rpc_delay(task, HZ >> 2);
+                goto retry_timeout;
        case -EAGAIN:
                goto retry_timeout;
        case -ETIMEDOUT:
@@ -2026,7 +2031,6 @@ call_bind_status(struct rpc_task *task)
        case -ENETDOWN:
        case -EHOSTUNREACH:
        case -ENETUNREACH:
-        case -ENOBUFS:
        case -EPIPE:
                dprintk("RPC: %5u remote rpcbind unreachable: %d\n",
                                task->tk_pid, task->tk_status);
@@ -2043,7 +2047,9 @@ call_bind_status(struct rpc_task *task)
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_connect;
+        return;
 retry_timeout:
        task->tk_status = 0;
        task->tk_action = call_bind;
@@ -2090,6 +2096,7 @@ call_connect(struct rpc_task *task)
 static void
 call_connect_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        struct rpc_clnt *clnt = task->tk_client;
        int status = task->tk_status;
@@ -2099,8 +2106,17 @@ call_connect_status(struct rpc_task *task)
        }
        dprint_status(task);
        trace_rpc_connect_status(task);
+        if (task->tk_status == 0) {
+                clnt->cl_stats->netreconn++;
+                goto out_next;
+        }
+        if (xprt_connected(xprt)) {
+                task->tk_status = 0;
+                goto out_next;
+        }
        task->tk_status = 0;
        switch (status) {
        case -ECONNREFUSED:
@@ -2117,8 +2133,6 @@ call_connect_status(struct rpc_task *task)
        case -ENETDOWN:
        case -ENETUNREACH:
        case -EHOSTUNREACH:
-        case -EADDRINUSE:
-        case -ENOBUFS:
        case -EPIPE:
                xprt_conditional_disconnect(task->tk_rqstp->rq_xprt,
                                            task->tk_rqstp->rq_connect_cookie);
@@ -2127,17 +2141,20 @@ call_connect_status(struct rpc_task *task)
                /* retry with existing socket, after a delay */
                rpc_delay(task, 3*HZ);
                /* fall through */
+        case -EADDRINUSE:
        case -ENOTCONN:
        case -EAGAIN:
        case -ETIMEDOUT:
                goto out_retry;
-        case 0:
+        case -ENOBUFS:
-                clnt->cl_stats->netreconn++;
+                rpc_delay(task, HZ >> 2);
-                task->tk_action = call_transmit;
+                goto out_retry;
-                return;
        }
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_transmit;
+        return;
 out_retry:
        /* Check for timeouts before looping back to call_bind */
        task->tk_action = call_bind;
@@ -2365,7 +2382,7 @@ call_status(struct rpc_task *task)
        case -ECONNABORTED:
        case -ENOTCONN:
                rpc_force_rebind(clnt);
-                /* fall through */
+                break;
        case -EADDRINUSE:
                rpc_delay(task, 3*HZ);
                /* fall through */
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 783748dc5e6f..2e71f5455c6c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1408,13 +1408,6 @@ xprt_request_transmit(struct rpc_rqst *req, struct rpc_task *snd_task)
                        status = -EBADMSG;
                        goto out_dequeue;
                }
-                if (task->tk_ops->rpc_call_prepare_transmit) {
-                        task->tk_ops->rpc_call_prepare_transmit(task,
-                                        task->tk_calldata);
-                        status = task->tk_status;
-                        if (status < 0)
-                                goto out_dequeue;
-                }
                if (RPC_SIGNALLED(task)) {
                        status = -ERESTARTSYS;
                        goto out_dequeue;
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index b88d48d00913..0f1eaed1bd1b 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -75,6 +75,7 @@ void tipc_set_node_addr(struct net *net, u32 addr)
                tipc_set_node_id(net, node_id);
        }
        tn->trial_addr = addr;
+        tn->addr_trial_end = jiffies;
        pr_info("32-bit node address hash set to %x\n", addr);
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 66d3a07bc571..c2c5c53cad22 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -106,8 +106,6 @@ struct tipc_stats {
 * @transmitq: queue for sent, non-acked messages
 * @backlogq: queue for messages waiting to be sent
 * @snt_nxt: next sequence number to use for outbound messages
- * @prev_from: sequence number of most previous retransmission request
- * @stale_limit: time when repeated identical retransmits must force link reset
 * @ackers: # of peers that needs to ack each packet before it can be released
 * @acked: # last packet acked by a certain peer. Used for broadcast.
 * @rcv_nxt: next sequence number to expect for inbound messages
@@ -164,9 +162,7 @@ struct tipc_link {
                u16 limit;
        } backlog[5];
        u16 snd_nxt;
-        u16 prev_from;
        u16 window;
-        unsigned long stale_limit;
        /* Reception */
        u16 rcv_nxt;
@@ -1044,47 +1040,53 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
 * link_retransmit_failure() - Detect repeated retransmit failures
 * @l: tipc link sender
 * @r: tipc link receiver (= l in case of unicast)
- * @from: seqno of the 1st packet in retransmit request
 * @rc: returned code
 *
 * Return: true if the repeated retransmit failures happens, otherwise
 * false
 */
 static bool link_retransmit_failure(struct tipc_link *l, struct tipc_link *r,
-                                    u16 from, int *rc)
+                                    int *rc)
 {
        struct sk_buff *skb = skb_peek(&l->transmq);
        struct tipc_msg *hdr;
        if (!skb)
                return false;
-        hdr = buf_msg(skb);
-        /* Detect repeated retransmit failures on same packet */
+        if (!TIPC_SKB_CB(skb)->retr_cnt)
-        if (r->prev_from != from) {
+                return false;
-                r->prev_from = from;
-                r->stale_limit = jiffies + msecs_to_jiffies(r->tolerance);
-        } else if (time_after(jiffies, r->stale_limit)) {
-                pr_warn("Retransmission failure on link <%s>\n", l->name);
-                link_print(l, "State of link ");
-                pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
-                        msg_user(hdr), msg_type(hdr), msg_size(hdr),
-                        msg_errcode(hdr));
-                pr_info("sqno %u, prev: %x, src: %x\n",
-                        msg_seqno(hdr), msg_prevnode(hdr), msg_orignode(hdr));
-                trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
-                trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
-                trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
-                if (link_is_bc_sndlink(l))
+        if (!time_after(jiffies, TIPC_SKB_CB(skb)->retr_stamp +
-                        *rc = TIPC_LINK_DOWN_EVT;
+                        msecs_to_jiffies(r->tolerance)))
+                return false;
+        hdr = buf_msg(skb);
+        if (link_is_bc_sndlink(l) && !less(r->acked, msg_seqno(hdr)))
+                return false;
+        pr_warn("Retransmission failure on link <%s>\n", l->name);
+        link_print(l, "State of link ");
+        pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
+                msg_user(hdr), msg_type(hdr), msg_size(hdr), msg_errcode(hdr));
+        pr_info("sqno %u, prev: %x, dest: %x\n",
+                msg_seqno(hdr), msg_prevnode(hdr), msg_destnode(hdr));
+        pr_info("retr_stamp %d, retr_cnt %d\n",
+                jiffies_to_msecs(TIPC_SKB_CB(skb)->retr_stamp),
+                TIPC_SKB_CB(skb)->retr_cnt);
+        trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
+        trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
+        trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
+        if (link_is_bc_sndlink(l)) {
+                r->state = LINK_RESET;
+                *rc = TIPC_LINK_DOWN_EVT;
+        } else {
                *rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
-                return true;
        }
-        return false;
+        return true;
 }
 /* tipc_link_bc_retrans() - retransmit zero or more packets
@@ -1110,7 +1112,7 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
        trace_tipc_link_retrans(r, from, to, &l->transmq);
-        if (link_retransmit_failure(l, r, from, &rc))
+        if (link_retransmit_failure(l, r, &rc))
                return rc;
        skb_queue_walk(&l->transmq, skb) {
@@ -1119,11 +1121,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                        continue;
                if (more(msg_seqno(hdr), to))
                        break;
-                if (link_is_bc_sndlink(l)) {
-                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
+                if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
-                                continue;
+                        continue;
-                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
+                TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
-                }
                _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE, GFP_ATOMIC);
                if (!_skb)
                        return 0;
@@ -1133,6 +1134,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                _skb->priority = TC_PRIO_CONTROL;
                __skb_queue_tail(xmitq, _skb);
                l->stats.retransmitted++;
+                /* Increase actual retrans counter & mark first time */
+                if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                        TIPC_SKB_CB(skb)->retr_stamp = jiffies;
        }
        return 0;
 }
@@ -1357,12 +1362,10 @@ static int tipc_link_advance_transmq(struct tipc_link *l, u16 acked, u16 gap,
        struct tipc_msg *hdr;
        u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
        u16 ack = l->rcv_nxt - 1;
+        bool passed = false;
        u16 seqno, n = 0;
        int rc = 0;
-        if (gap && link_retransmit_failure(l, l, acked + 1, &rc))
-                return rc;
        skb_queue_walk_safe(&l->transmq, skb, tmp) {
                seqno = buf_seqno(skb);
@@ -1372,12 +1375,17 @@ next_gap_ack:
                        __skb_unlink(skb, &l->transmq);
                        kfree_skb(skb);
                } else if (less_eq(seqno, acked + gap)) {
-                        /* retransmit skb */
+                        /* First, check if repeated retrans failures occurs? */
+                        if (!passed && link_retransmit_failure(l, l, &rc))
+                                return rc;
+                        passed = true;
+                        /* retransmit skb if unrestricted*/
                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
                                continue;
                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_UC_RETR_TIME;
+                        _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE,
-                        _skb = __pskb_copy(skb, MIN_H_SIZE, GFP_ATOMIC);
+                                           GFP_ATOMIC);
                        if (!_skb)
                                continue;
                        hdr = buf_msg(_skb);
@@ -1386,6 +1394,10 @@ next_gap_ack:
                        _skb->priority = TC_PRIO_CONTROL;
                        __skb_queue_tail(xmitq, _skb);
                        l->stats.retransmitted++;
+                        /* Increase actual retrans counter & mark first time */
+                        if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                                TIPC_SKB_CB(skb)->retr_stamp = jiffies;
                } else {
                        /* retry with Gap ACK blocks if any */
                        if (!ga || n >= ga->gack_cnt)
@@ -2577,7 +2589,7 @@ int tipc_link_dump(struct tipc_link *l, u16 dqueues, char *buf)
        i += scnprintf(buf + i, sz - i, " %x", l->peer_caps);
        i += scnprintf(buf + i, sz - i, " %u", l->silent_intv_cnt);
        i += scnprintf(buf + i, sz - i, " %u", l->rst_cnt);
-        i += scnprintf(buf + i, sz - i, " %u", l->prev_from);
+        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", l->acked);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index da509f0eb9ca..d7ebc9e955f6 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -102,13 +102,15 @@ struct plist;
 #define TIPC_MEDIA_INFO_OFFSET  5
 struct tipc_skb_cb {
-        u32 bytes_read;
-        u32 orig_member;
        struct sk_buff *tail;
        unsigned long nxt_retr;
-        bool validated;
+        unsigned long retr_stamp;
+        u32 bytes_read;
+        u32 orig_member;
        u16 chain_imp;
        u16 ackers;
+        u16 retr_cnt;
+        bool validated;
 };
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 7c0b2b778703..43922d86e510 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -373,9 +373,9 @@ static int tls_push_data(struct sock *sk,
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_prot_info *prot = &tls_ctx->prot_info;
        struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx);
-        int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
        struct tls_record_info *record = ctx->open_record;
+        int tls_push_record_flags;
        struct page_frag *pfrag;
        size_t orig_size = size;
        u32 max_open_record_len;
@@ -390,6 +390,9 @@ static int tls_push_data(struct sock *sk,
        if (sk->sk_err)
                return -sk->sk_err;
+        flags |= MSG_SENDPAGE_DECRYPTED;
+        tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
        if (tls_is_partially_sent_record(tls_ctx)) {
                rc = tls_push_partial_record(sk, tls_ctx, flags);
@@ -576,7 +579,9 @@ void tls_device_write_space(struct sock *sk, struct tls_context *ctx)
                gfp_t sk_allocation = sk->sk_allocation;
                sk->sk_allocation = GFP_ATOMIC;
-                tls_push_partial_record(sk, ctx, MSG_DONTWAIT | MSG_NOSIGNAL);
+                tls_push_partial_record(sk, ctx,
+                                        MSG_DONTWAIT | MSG_NOSIGNAL |
+                                        MSG_SENDPAGE_DECRYPTED);
                sk->sk_allocation = sk_allocation;
        }
 }
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 9cbbae606ced..43252a801c3f 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,6 +308,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
        if (free_ctx)
                icsk->icsk_ulp_data = NULL;
        sk->sk_prot = ctx->sk_proto;
+        if (sk->sk_write_space == tls_write_space)
+                sk->sk_write_space = ctx->sk_write_space;
        write_unlock_bh(&sk->sk_callback_lock);
        release_sock(sk);
        if (ctx->tx_conf == TLS_SW)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4831ad745f91..327479ce69f5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2788,7 +2788,7 @@ static void reg_process_pending_hints(void)
        /* When last_request->processed becomes true this will be rescheduled */
        if (lr && !lr->processed) {
-                reg_process_hint(lr);
+                pr_debug("Pending regulatory request, waiting for it to be processed...\n");
                return;
        }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d0e35b7b9e35..e74837824cea 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -233,25 +233,30 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
        switch (params->cipher) {
        case WLAN_CIPHER_SUITE_TKIP:
+                /* Extended Key ID can only be used with CCMP/GCMP ciphers */
+                if ((pairwise && key_idx) ||
+                    params->mode != NL80211_KEY_RX_TX)
+                        return -EINVAL;
+                break;
        case WLAN_CIPHER_SUITE_CCMP:
        case WLAN_CIPHER_SUITE_CCMP_256:
        case WLAN_CIPHER_SUITE_GCMP:
        case WLAN_CIPHER_SUITE_GCMP_256:
-                /* IEEE802.11-2016 allows only 0 and - when using Extended Key
+                /* IEEE802.11-2016 allows only 0 and - when supporting
-                 * ID - 1 as index for pairwise keys.
+                 * Extended Key ID - 1 as index for pairwise keys.
                 * @NL80211_KEY_NO_TX is only allowed for pairwise keys when
                 * the driver supports Extended Key ID.
                 * @NL80211_KEY_SET_TX can't be set when installing and
                 * validating a key.
                 */
-                if (params->mode == NL80211_KEY_NO_TX) {
+                if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
-                        if (!wiphy_ext_feature_isset(&rdev->wiphy,
+                    params->mode == NL80211_KEY_SET_TX)
-                                                     NL80211_EXT_FEATURE_EXT_KEY_ID))
+                        return -EINVAL;
-                                return -EINVAL;
+                if (wiphy_ext_feature_isset(&rdev->wiphy,
-                        else if (!pairwise || key_idx < 0 || key_idx > 1)
+                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
+                        if (pairwise && (key_idx < 0 || key_idx > 1))
                                return -EINVAL;
-                } else if ((pairwise && key_idx) ||
+                } else if (pairwise && key_idx) {
-                           params->mode == NL80211_KEY_SET_TX) {
                        return -EINVAL;
                }
                break;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 83de74ca729a..688aac7a6943 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -365,7 +365,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL);
        if (!umem->pages) {
                err = -ENOMEM;
-                goto out_account;
+                goto out_pin;
        }
        for (i = 0; i < umem->npgs; i++)
@@ -373,6 +373,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        return 0;
+out_pin:
+        xdp_umem_unpin_pages(umem);
 out_account:
        xdp_umem_unaccount_pages(umem);
        return err;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8ca637a72697..ec94f5795ea4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3269,7 +3269,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
        struct flowi4 *fl4 = &fl->u.ip4;
        int oif = 0;
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl4, 0, sizeof(struct flowi4));
@@ -3387,7 +3387,7 @@ decode_session6(struct sk_buff *skb, struct flowi *fl, bool reverse)
        nexthdr = nh[nhoff];
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl6, 0, sizeof(struct flowi6));
diff --git a/samples/auxdisplay/cfag12864b-example.c b/samples/auxdisplay/cfag12864b-example.c
index 85571e90191f..bfeab44f81d0 100644
--- a/samples/auxdisplay/cfag12864b-example.c
+++ b/samples/auxdisplay/cfag12864b-example.c
@@ -245,7 +245,7 @@ int main(int argc, char *argv[])
        if (argc != 2) {
                printf(
-                        "Sintax:  %s fbdev\n"
+                        "Syntax:  %s fbdev\n"
                        "Usually: /dev/fb0, /dev/fb1...\n", argv[0]);
                return -1;
        }
diff --git a/scripts/coccinelle/api/atomic_as_refcounter.cocci b/scripts/coccinelle/api/atomic_as_refcounter.cocci
index 988120e0fd67..0f78d94abc35 100644
--- a/scripts/coccinelle/api/atomic_as_refcounter.cocci
+++ b/scripts/coccinelle/api/atomic_as_refcounter.cocci
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0-only
 // Check if refcount_t type and API should be used
 // instead of atomic_t type when dealing with refcounters
 //
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 7325f382dbf4..957b9e3e1492 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -595,7 +595,7 @@ struct key *request_key_and_link(struct key_type *type,
        key = check_cached_key(&ctx);
        if (key)
-                return key;
+                goto error_free;
        /* search all the process keyrings for a key */
        rcu_read_lock();
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 9a94672e7adc..ade699131065 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1228,24 +1228,11 @@ hashalg_fail:
 static int __init init_digests(void)
 {
-        u8 digest[TPM_MAX_DIGEST_SIZE];
-        int ret;
-        int i;
-        ret = tpm_get_random(chip, digest, TPM_MAX_DIGEST_SIZE);
-        if (ret < 0)
-                return ret;
-        if (ret < TPM_MAX_DIGEST_SIZE)
-                return -EFAULT;
        digests = kcalloc(chip->nr_allocated_banks, sizeof(*digests),
                          GFP_KERNEL);
        if (!digests)
                return -ENOMEM;
-        for (i = 0; i < chip->nr_allocated_banks; i++)
-                memcpy(digests[i].digest, digest, TPM_MAX_DIGEST_SIZE);
        return 0;
 }
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 7737b2670064..6d9592f0ae1d 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1835,8 +1835,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client,
        if (cptr->type == USER_CLIENT) {
                info->input_pool = cptr->data.user.fifo_pool_size;
                info->input_free = info->input_pool;
-                if (cptr->data.user.fifo)
+                info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);
-                        info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);
        } else {
                info->input_pool = 0;
                info->input_free = 0;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index ea69261f269a..eaaa8b5830bb 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -263,3 +263,20 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
        return 0;
 }
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)
+{
+        unsigned long flags;
+        int cells;
+        if (!f)
+                return 0;
+        snd_use_lock_use(&f->use_lock);
+        spin_lock_irqsave(&f->lock, flags);
+        cells = snd_seq_unused_cells(f->pool);
+        spin_unlock_irqrestore(&f->lock, flags);
+        snd_use_lock_free(&f->use_lock);
+        return cells;
+}
diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
index edc68743943d..b56a7b897c9c 100644
--- a/sound/core/seq/seq_fifo.h
+++ b/sound/core/seq/seq_fifo.h
@@ -53,5 +53,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file, poll_table
 /* resize pool in fifo */
 int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);
 #endif
diff --git a/sound/firewire/oxfw/oxfw-pcm.c b/sound/firewire/oxfw/oxfw-pcm.c
index 9ea39348cdf5..7c6d1c277d4d 100644
--- a/sound/firewire/oxfw/oxfw-pcm.c
+++ b/sound/firewire/oxfw/oxfw-pcm.c
@@ -248,7 +248,7 @@ static int pcm_playback_hw_params(struct snd_pcm_substream *substream,
                unsigned int channels = params_channels(hw_params);
                mutex_lock(&oxfw->mutex);
-                err = snd_oxfw_stream_reserve_duplex(oxfw, &oxfw->tx_stream,
+                err = snd_oxfw_stream_reserve_duplex(oxfw, &oxfw->rx_stream,
                                                     rate, channels);
                if (err >= 0)
                        ++oxfw->substreams_count;
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 485edaba0037..5bf24fb819d2 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -6051,6 +6051,24 @@ void snd_hda_gen_free(struct hda_codec *codec)
 }
 EXPORT_SYMBOL_GPL(snd_hda_gen_free);
+/**
+ * snd_hda_gen_reboot_notify - Make codec enter D3 before rebooting
+ * @codec: the HDA codec
+ *
+ * This can be put as patch_ops reboot_notify function.
+ */
+void snd_hda_gen_reboot_notify(struct hda_codec *codec)
+{
+        /* Make the codec enter D3 to avoid spurious noises from the internal
+         * speaker during (and after) reboot
+         */
+        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+        snd_hda_codec_write(codec, codec->core.afg, 0,
+                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+        msleep(10);
+}
+EXPORT_SYMBOL_GPL(snd_hda_gen_reboot_notify);
 #ifdef CONFIG_PM
 /**
 * snd_hda_gen_check_power_status - check the loopback power save state
@@ -6078,6 +6096,7 @@ static const struct hda_codec_ops generic_patch_ops = {
        .init = snd_hda_gen_init,
        .free = snd_hda_gen_free,
        .unsol_event = snd_hda_jack_unsol_event,
+        .reboot_notify = snd_hda_gen_reboot_notify,
 #ifdef CONFIG_PM
        .check_power_status = snd_hda_gen_check_power_status,
 #endif
@@ -6100,7 +6119,7 @@ static int snd_hda_parse_generic_codec(struct hda_codec *codec)
        err = snd_hda_parse_pin_defcfg(codec, &spec->autocfg, NULL, 0);
        if (err < 0)
-                return err;
+                goto error;
        err = snd_hda_gen_parse_auto_config(codec, &spec->autocfg);
        if (err < 0)
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 35a670a71c42..5f199dcb0d18 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -332,6 +332,7 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
                                  struct auto_pin_cfg *cfg);
 int snd_hda_gen_build_controls(struct hda_codec *codec);
 int snd_hda_gen_build_pcms(struct hda_codec *codec);
+void snd_hda_gen_reboot_notify(struct hda_codec *codec);
 /* standard jack event callbacks */
 void snd_hda_gen_hp_automute(struct hda_codec *codec,
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index a6d8c0d77b84..99fc0917339b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2508,6 +2508,9 @@ static const struct pci_device_id azx_ids[] = {
        /* AMD, X370 & co */
        { PCI_DEVICE(0x1022, 0x1457),
          .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+        /* AMD, X570 & co */
+        { PCI_DEVICE(0x1022, 0x1487),
+          .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
        /* AMD Stoney */
        { PCI_DEVICE(0x1022, 0x157a),
          .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 0d51823d7270..6d1fb7c11f17 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1175,6 +1175,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
        SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE),
        SND_PCI_QUIRK(0x1102, 0x0010, "Sound Blaster Z", QUIRK_SBZ),
        SND_PCI_QUIRK(0x1102, 0x0023, "Sound Blaster Z", QUIRK_SBZ),
+        SND_PCI_QUIRK(0x1102, 0x0027, "Sound Blaster Z", QUIRK_SBZ),
        SND_PCI_QUIRK(0x1102, 0x0033, "Sound Blaster ZxR", QUIRK_SBZ),
        SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
        SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index f299f137eaea..968d3caab6ac 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -163,23 +163,10 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
 {
        struct conexant_spec *spec = codec->spec;
-        switch (codec->core.vendor_id) {
-        case 0x14f12008: /* CX8200 */
-        case 0x14f150f2: /* CX20722 */
-        case 0x14f150f4: /* CX20724 */
-                break;
-        default:
-                return;
-        }
        /* Turn the problematic codec into D3 to avoid spurious noises
           from the internal speaker during (and after) reboot */
        cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
+        snd_hda_gen_reboot_notify(codec);
-        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-        snd_hda_codec_write(codec, codec->core.afg, 0,
-                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-        msleep(10);
 }
 static void cx_auto_free(struct hda_codec *codec)
@@ -624,18 +611,20 @@ static void cxt_fixup_hp_gate_mic_jack(struct hda_codec *codec,
 /* update LED status via GPIO */
 static void cxt_update_gpio_led(struct hda_codec *codec, unsigned int mask,
-                                bool enabled)
+                                bool led_on)
 {
        struct conexant_spec *spec = codec->spec;
        unsigned int oldval = spec->gpio_led;
        if (spec->mute_led_polarity)
-                enabled = !enabled;
+                led_on = !led_on;
-        if (enabled)
+        if (led_on)
-                spec->gpio_led &= ~mask;
-        else
                spec->gpio_led |= mask;
+        else
+                spec->gpio_led &= ~mask;
+        codec_dbg(codec, "mask:%d enabled:%d gpio_led:%d\n",
+                        mask, led_on, spec->gpio_led);
        if (spec->gpio_led != oldval)
                snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
                                    spec->gpio_led);
@@ -646,8 +635,8 @@ static void cxt_fixup_gpio_mute_hook(void *private_data, int enabled)
 {
        struct hda_codec *codec = private_data;
        struct conexant_spec *spec = codec->spec;
+        /* muted -> LED on */
-        cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, enabled);
+        cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, !enabled);
 }
 /* turn on/off mic-mute LED via GPIO per capture hook */
@@ -669,7 +658,6 @@ static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
                { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 },
                {}
        };
-        codec_info(codec, "action: %d gpio_led: %d\n", action, spec->gpio_led);
        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
                spec->gen.vmaster_mute.hook = cxt_fixup_gpio_mute_hook;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index de224cbea7a0..e333b3e30e31 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -869,15 +869,6 @@ static void alc_reboot_notify(struct hda_codec *codec)
                alc_shutup(codec);
 }
-/* power down codec to D3 at reboot/shutdown; set as reboot_notify ops */
-static void alc_d3_at_reboot(struct hda_codec *codec)
-{
-        snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
-        snd_hda_codec_write(codec, codec->core.afg, 0,
-                            AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-        msleep(10);
-}
 #define alc_free        snd_hda_gen_free
 #ifdef CONFIG_PM
@@ -5152,7 +5143,7 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
        struct alc_spec *spec = codec->spec;
        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-                spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
+                spec->reboot_notify = snd_hda_gen_reboot_notify; /* reduce noise */
                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                codec->power_save_node = 0; /* avoid click noises */
                snd_hda_apply_pincfgs(codec, pincfgs);
@@ -6987,6 +6978,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+        SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
        SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
        SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
        SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 2c03e0f6bf72..f70211e6b174 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -550,6 +550,15 @@ int line6_init_pcm(struct usb_line6 *line6,
        line6pcm->volume_monitor = 255;
        line6pcm->line6 = line6;
+        spin_lock_init(&line6pcm->out.lock);
+        spin_lock_init(&line6pcm->in.lock);
+        line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
+        line6->line6pcm = line6pcm;
+        pcm->private_data = line6pcm;
+        pcm->private_free = line6_cleanup_pcm;
        line6pcm->max_packet_size_in =
                usb_maxpacket(line6->usbdev,
                        usb_rcvisocpipe(line6->usbdev, ep_read), 0);
@@ -562,15 +571,6 @@ int line6_init_pcm(struct usb_line6 *line6,
                return -EINVAL;
        }
-        spin_lock_init(&line6pcm->out.lock);
-        spin_lock_init(&line6pcm->in.lock);
-        line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
-        line6->line6pcm = line6pcm;
-        pcm->private_data = line6pcm;
-        pcm->private_free = line6_cleanup_pcm;
        err = line6_create_audio_out_urbs(line6pcm);
        if (err < 0)
                return err;
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 7498b5191b68..eceab19766db 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -68,6 +68,7 @@ struct mixer_build {
        unsigned char *buffer;
        unsigned int buflen;
        DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+        DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
        struct usb_audio_term oterm;
        const struct usbmix_name_map *map;
        const struct usbmix_selector_map *selector_map;
@@ -738,12 +739,13 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
                                       struct uac_mixer_unit_descriptor *desc)
 {
        int mu_channels;
-        void *c;
        if (desc->bLength < sizeof(*desc))
                return -EINVAL;
        if (!desc->bNrInPins)
                return -EINVAL;
+        if (desc->bLength < sizeof(*desc) + desc->bNrInPins)
+                return -EINVAL;
        switch (state->mixer->protocol) {
        case UAC_VERSION_1:
@@ -759,13 +761,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
                break;
        }
-        if (!mu_channels)
-                return 0;
-        c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
-        if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
-                return 0; /* no bmControls -> skip */
        return mu_channels;
 }
@@ -773,16 +768,25 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
 * parse the source unit recursively until it reaches to a terminal
 * or a branched unit.
 */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
                            struct usb_audio_term *term)
 {
        int protocol = state->mixer->protocol;
        int err;
        void *p1;
+        unsigned char *hdr;
        memset(term, 0, sizeof(*term));
-        while ((p1 = find_audio_control_unit(state, id)) != NULL) {
+        for (;;) {
-                unsigned char *hdr = p1;
+                /* a loop in the terminal chain? */
+                if (test_and_set_bit(id, state->termbitmap))
+                        return -EINVAL;
+                p1 = find_audio_control_unit(state, id);
+                if (!p1)
+                        break;
+                hdr = p1;
                term->id = id;
                if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
@@ -800,7 +804,7 @@ static int check_input_term(struct mixer_build *state, int id,
                                        /* call recursively to verify that the
                                         * referenced clock entity is valid */
-                                        err = check_input_term(state, d->bCSourceID, term);
+                                        err = __check_input_term(state, d->bCSourceID, term);
                                        if (err < 0)
                                                return err;
@@ -834,7 +838,7 @@ static int check_input_term(struct mixer_build *state, int id,
                        case UAC2_CLOCK_SELECTOR: {
                                struct uac_selector_unit_descriptor *d = p1;
                                /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                if (err < 0)
                                        return err;
                                term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -897,7 +901,7 @@ static int check_input_term(struct mixer_build *state, int id,
                                /* call recursively to verify that the
                                 * referenced clock entity is valid */
-                                err = check_input_term(state, d->bCSourceID, term);
+                                err = __check_input_term(state, d->bCSourceID, term);
                                if (err < 0)
                                        return err;
@@ -948,7 +952,7 @@ static int check_input_term(struct mixer_build *state, int id,
                        case UAC3_CLOCK_SELECTOR: {
                                struct uac_selector_unit_descriptor *d = p1;
                                /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                if (err < 0)
                                        return err;
                                term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
@@ -964,7 +968,7 @@ static int check_input_term(struct mixer_build *state, int id,
                                        return -EINVAL;
                                /* call recursively to retrieve the channel info */
-                                err = check_input_term(state, d->baSourceID[0], term);
+                                err = __check_input_term(state, d->baSourceID[0], term);
                                if (err < 0)
                                        return err;
@@ -982,6 +986,15 @@ static int check_input_term(struct mixer_build *state, int id,
        return -ENODEV;
 }
+static int check_input_term(struct mixer_build *state, int id,
+                            struct usb_audio_term *term)
+{
+        memset(term, 0, sizeof(*term));
+        memset(state->termbitmap, 0, sizeof(state->termbitmap));
+        return __check_input_term(state, id, term);
+}
 /*
 * Feature Unit
 */
@@ -1988,6 +2001,31 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
 * Mixer Unit
 */
+/* check whether the given in/out overflows bmMixerControls matrix */
+static bool mixer_bitmap_overflow(struct uac_mixer_unit_descriptor *desc,
+                                  int protocol, int num_ins, int num_outs)
+{
+        u8 *hdr = (u8 *)desc;
+        u8 *c = uac_mixer_unit_bmControls(desc, protocol);
+        size_t rest; /* remaining bytes after bmMixerControls */
+        switch (protocol) {
+        case UAC_VERSION_1:
+        default:
+                rest = 1; /* iMixer */
+                break;
+        case UAC_VERSION_2:
+                rest = 2; /* bmControls + iMixer */
+                break;
+        case UAC_VERSION_3:
+                rest = 6; /* bmControls + wMixerDescrStr */
+                break;
+        }
+        /* overflow? */
+        return c + (num_ins * num_outs + 7) / 8 + rest > hdr + hdr[0];
+}
 /*
 * build a mixer unit control
 *
@@ -2116,6 +2154,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
                if (err < 0)
                        return err;
                num_ins += iterm.channels;
+                if (mixer_bitmap_overflow(desc, state->mixer->protocol,
+                                          num_ins, num_outs))
+                        break;
                for (; ich < num_ins; ich++) {
                        int och, ich_has_controls = 0;
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 199fa157a411..27dcb3743690 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1155,17 +1155,17 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 {
        struct usb_mixer_interface *mixer;
        struct usb_mixer_elem_info *cval;
-        int unitid = 12; /* SamleRate ExtensionUnit ID */
+        int unitid = 12; /* SampleRate ExtensionUnit ID */
        list_for_each_entry(mixer, &chip->mixer_list, list) {
-                cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+                if (mixer->id_elems[unitid]) {
-                if (cval) {
+                        cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
                        snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
                                                    cval->control << 8,
                                                    samplerate_id);
                        snd_usb_mixer_notify_id(mixer, unitid);
+                        break;
                }
-                break;
        }
 }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 75b96929f76c..e4bbf79de956 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -339,6 +339,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
                ep = 0x81;
                ifnum = 2;
                goto add_sync_ep_from_ifnum;
+        case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
        case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
                ep = 0x81;
                ifnum = 1;
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 5215e0870bcb..6a71324be628 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -204,7 +204,11 @@ int do_pin_fd(int fd, const char *name)
        if (err)
                return err;
-        return bpf_obj_pin(fd, name);
+        err = bpf_obj_pin(fd, name);
+        if (err)
+                p_err("can't pin the object (%s): %s", name, strerror(errno));
+        return err;
 }
 int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
@@ -237,7 +241,7 @@ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
        fd = get_fd_by_id(id);
        if (fd < 0) {
-                p_err("can't get prog by id (%u): %s", id, strerror(errno));
+                p_err("can't open object by id (%u): %s", id, strerror(errno));
                return -1;
        }
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 66f04a4846a5..43fdbbfe41bb 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -363,7 +363,9 @@ static int do_show(int argc, char **argv)
                if (fd < 0)
                        return -1;
-                return show_prog(fd);
+                err = show_prog(fd);
+                close(fd);
+                return err;
        }
        if (argc)
diff --git a/tools/hv/hv_get_dhcp_info.sh b/tools/hv/hv_get_dhcp_info.sh
index c38686c44656..2f2a3c7df3de 100755
--- a/tools/hv/hv_get_dhcp_info.sh
+++ b/tools/hv/hv_get_dhcp_info.sh
@@ -13,7 +13,7 @@
 #       the script prints the string "Disabled" to stdout.
 #
 # Each Distro is expected to implement this script in a distro specific
-# fashion. For instance on Distros that ship with Network Manager enabled,
+# fashion. For instance, on Distros that ship with Network Manager enabled,
 # this script can be based on the Network Manager APIs for retrieving DHCP
 # information.
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index d7e06fe0270e..e9ef4ca6a655 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -700,7 +700,7 @@ static void kvp_get_ipconfig_info(char *if_name,
        /*
-         * Gather the DNS  state.
+         * Gather the DNS state.
         * Since there is no standard way to get this information
         * across various distributions of interest; we just invoke
         * an external script that needs to be ported across distros
@@ -809,7 +809,7 @@ kvp_get_ip_info(int family, char *if_name, int op,
        int sn_offset = 0;
        int error = 0;
        char *buffer;
-        struct hv_kvp_ipaddr_value *ip_buffer;
+        struct hv_kvp_ipaddr_value *ip_buffer = NULL;
        char cidr_mask[5]; /* /xyz */
        int weight;
        int i;
@@ -1051,7 +1051,7 @@ static int parse_ip_val_buffer(char *in_buf, int *offset,
        char *start;
        /*
-         * in_buf has sequence of characters that are seperated by
+         * in_buf has sequence of characters that are separated by
         * the character ';'. The last sequence does not have the
         * terminating ";" character.
         */
@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[])
                        daemonize = 0;
                        break;
                case 'h':
+                        print_usage(argv);
+                        exit(0);
                default:
                        print_usage(argv);
                        exit(EXIT_FAILURE);
@@ -1490,7 +1492,7 @@ int main(int argc, char *argv[])
                case KVP_OP_GET_IP_INFO:
                        kvp_ip_val = &hv_msg->body.kvp_ip_val;
-                        error =  kvp_mac_to_ip(kvp_ip_val);
+                        error = kvp_mac_to_ip(kvp_ip_val);
                        if (error)
                                hv_msg->error = error;
diff --git a/tools/hv/hv_set_ifconfig.sh b/tools/hv/hv_set_ifconfig.sh
index 7ed9f85ef908..d10fe35b7f25 100755
--- a/tools/hv/hv_set_ifconfig.sh
+++ b/tools/hv/hv_set_ifconfig.sh
@@ -12,7 +12,7 @@
 # be used to configure the interface.
 #
 # Each Distro is expected to implement this script in a distro specific
-# fashion. For instance on Distros that ship with Network Manager enabled,
+# fashion. For instance, on Distros that ship with Network Manager enabled,
 # this script can be based on the Network Manager APIs for configuring the
 # interface.
 #
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index efe1e34dd91b..92902a88f671 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -42,7 +42,7 @@ static int vss_do_freeze(char *dir, unsigned int cmd)
         * If a partition is mounted more than once, only the first
         * FREEZE/THAW can succeed and the later ones will get
         * EBUSY/EINVAL respectively: there could be 2 cases:
-         * 1) a user may mount the same partition to differnt directories
+         * 1) a user may mount the same partition to different directories
         *  by mistake or on purpose;
         * 2) The subvolume of btrfs appears to have the same partition
         * mounted more than once.
@@ -218,6 +218,8 @@ int main(int argc, char *argv[])
                        daemonize = 0;
                        break;
                case 'h':
+                        print_usage(argv);
+                        exit(0);
                default:
                        print_usage(argv);
                        exit(EXIT_FAILURE);
diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus
index 55e7374bade0..099f2c44dbed 100644
--- a/tools/hv/lsvmbus
+++ b/tools/hv/lsvmbus
@@ -4,10 +4,10 @@
 import os
 from optparse import OptionParser
+help_msg = "print verbose messages. Try -vv, -vvv for  more verbose messages"
 parser = OptionParser()
-parser.add_option("-v", "--verbose", dest="verbose",
+parser.add_option(
-                   help="print verbose messages. Try -vv, -vvv for \
+        "-v", "--verbose", dest="verbose", help=help_msg, action="count")
-                        more verbose messages", action="count")
 (options, args) = parser.parse_args()
@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path):
        exit(-1)
 vmbus_dev_dict = {
-        '{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]',
+        '{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]',
-        '{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]',
+        '{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]',
-        '{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]',
+        '{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]',
-        '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]',
+        '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]',
-        '{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]',
+        '{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]',
-        '{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]',
+        '{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]',
-        '{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]',
+        '{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]',
-        '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse',
+        '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse',
-        '{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard',
+        '{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard',
-        '{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter',
+        '{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter',
-        '{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter',
+        '{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter',
-        '{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller',
+        '{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller',
-        '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller',
+        '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller',
-        '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter',
+        '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter',
-        '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter',
+        '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter',
-        '{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through',
+        '{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through',
-        '{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]',
+        '{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]',
-        '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]',
+        '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]',
-        '{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]',
+        '{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]',
 }
 def get_vmbus_dev_attr(dev_name, attr):
        try:
                f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r')
@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr):
        return lines
 class VMBus_Dev:
        pass
@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path):
        chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping')
        chn_vp_mapping = [c.strip() for c in chn_vp_mapping]
-        chn_vp_mapping = sorted(chn_vp_mapping,
+        chn_vp_mapping = sorted(
-                key = lambda c : int(c.split(':')[0]))
+                chn_vp_mapping, key=lambda c: int(c.split(':')[0]))
-        chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' %
+        chn_vp_mapping = [
-                                (c.split(':')[0], c.split(':')[1])
+                '\tRel_ID=%s, target_cpu=%s' %
-                                        for c in chn_vp_mapping]
+                (c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping
+        ]
        d = VMBus_Dev()
        d.sysfs_path = '%s/%s' % (vmbus_sys_path, f)
        d.vmbus_id = vmbus_id
@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path):
        vmbus_dev_list.append(d)
-vmbus_dev_list  = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id))
+vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id))
 format0 = '%2s: %s'
 format1 = '%2s: Class_ID = %s - %s\n%s'
@@ -95,9 +98,15 @@ for d in vmbus_dev_list:
        if verbose == 0:
                print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc))
        elif verbose == 1:
-                print (('VMBUS ID ' + format1) %        \
+                print(
-                        (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping))
+                        ('VMBUS ID ' + format1) %
+                        (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)
+                )
        else:
-                print (('VMBUS ID ' + format2) % \
+                print(
-                        (d.vmbus_id, d.class_id, d.dev_desc, \
+                        ('VMBUS ID ' + format2) %
-                        d.device_id, d.sysfs_path, d.chn_vp_mapping))
+                        (
+                                d.vmbus_id, d.class_id, d.dev_desc,
+                                d.device_id, d.sysfs_path, d.chn_vp_mapping
+                        )
+                )
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 4e455018da65..a5aa7d3ac6a1 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1466,8 +1466,8 @@ union bpf_attr {
 *              If no cookie has been set yet, generate a new cookie. Once
 *              generated, the socket cookie remains stable for the life of the
 *              socket. This helper can be useful for monitoring per socket
- *              networking traffic statistics as it provides a unique socket
+ *              networking traffic statistics as it provides a global socket
- *              identifier per namespace.
+ *              identifier that can be assumed unique.
 *      Return
 *              A 8-byte long non-decreasing number on success, or 0 if the
 *              socket field is missing inside *skb*.
@@ -1571,8 +1571,11 @@ union bpf_attr {
 *              but this is only implemented for native XDP (with driver
 *              support) as of this writing).
 *
- *              All values for *flags* are reserved for future usage, and must
+ *              The lower two bits of *flags* are used as the return code if
- *              be left at zero.
+ *              the map lookup fails. This is so that the return value can be
+ *              one of the XDP program return codes up to XDP_TX, as chosen by
+ *              the caller. Any higher bits in the *flags* argument must be
+ *              unset.
 *
 *              When used to redirect packets to net devices, this helper
 *              provides a high performance increase over **bpf_redirect**\ ().
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 2586b6cb8f34..2b57d7ea7836 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -182,7 +182,6 @@ struct bpf_program {
        bpf_program_clear_priv_t clear_priv;
        enum bpf_attach_type expected_attach_type;
-        int btf_fd;
        void *func_info;
        __u32 func_info_rec_size;
        __u32 func_info_cnt;
@@ -313,7 +312,6 @@ void bpf_program__unload(struct bpf_program *prog)
        prog->instances.nr = -1;
        zfree(&prog->instances.fds);
-        zclose(prog->btf_fd);
        zfree(&prog->func_info);
        zfree(&prog->line_info);
 }
@@ -392,7 +390,6 @@ bpf_program__init(void *data, size_t size, char *section_name, int idx,
        prog->instances.fds = NULL;
        prog->instances.nr = -1;
        prog->type = BPF_PROG_TYPE_UNSPEC;
-        prog->btf_fd = -1;
        return 0;
 errout:
@@ -2288,9 +2285,6 @@ bpf_program_reloc_btf_ext(struct bpf_program *prog, struct bpf_object *obj,
                prog->line_info_rec_size = btf_ext__line_info_rec_size(obj->btf_ext);
        }
-        if (!insn_offset)
-                prog->btf_fd = btf__fd(obj->btf);
        return 0;
 }
@@ -2463,7 +2457,7 @@ load_program(struct bpf_program *prog, struct bpf_insn *insns, int insns_cnt,
        char *cp, errmsg[STRERR_BUFSIZE];
        int log_buf_size = BPF_LOG_BUF_SIZE;
        char *log_buf;
-        int ret;
+        int btf_fd, ret;
        if (!insns || !insns_cnt)
                return -EINVAL;
@@ -2478,7 +2472,12 @@ load_program(struct bpf_program *prog, struct bpf_insn *insns, int insns_cnt,
        load_attr.license = license;
        load_attr.kern_version = kern_version;
        load_attr.prog_ifindex = prog->prog_ifindex;
-        load_attr.prog_btf_fd = prog->btf_fd >= 0 ? prog->btf_fd : 0;
+        /* if .BTF.ext was loaded, kernel supports associated BTF for prog */
+        if (prog->obj->btf_ext)
+                btf_fd = bpf_object__btf_fd(prog->obj);
+        else
+                btf_fd = -1;
+        load_attr.prog_btf_fd = btf_fd >= 0 ? btf_fd : 0;
        load_attr.func_info = prog->func_info;
        load_attr.func_info_rec_size = prog->func_info_rec_size;
        load_attr.func_info_cnt = prog->func_info_cnt;
@@ -5000,13 +4999,15 @@ int libbpf_num_possible_cpus(void)
        static const char *fcpu = "/sys/devices/system/cpu/possible";
        int len = 0, n = 0, il = 0, ir = 0;
        unsigned int start = 0, end = 0;
+        int tmp_cpus = 0;
        static int cpus;
        char buf[128];
        int error = 0;
        int fd = -1;
-        if (cpus > 0)
+        tmp_cpus = READ_ONCE(cpus);
-                return cpus;
+        if (tmp_cpus > 0)
+                return tmp_cpus;
        fd = open(fcpu, O_RDONLY);
        if (fd < 0) {
@@ -5029,7 +5030,7 @@ int libbpf_num_possible_cpus(void)
        }
        buf[len] = '\0';
-        for (ir = 0, cpus = 0; ir <= len; ir++) {
+        for (ir = 0, tmp_cpus = 0; ir <= len; ir++) {
                /* Each sub string separated by ',' has format \d+-\d+ or \d+ */
                if (buf[ir] == ',' || buf[ir] == '\0') {
                        buf[ir] = '\0';
@@ -5041,13 +5042,15 @@ int libbpf_num_possible_cpus(void)
                        } else if (n == 1) {
                                end = start;
                        }
-                        cpus += end - start + 1;
+                        tmp_cpus += end - start + 1;
                        il = ir + 1;
                }
        }
-        if (cpus <= 0) {
+        if (tmp_cpus <= 0) {
-                pr_warning("Invalid #CPUs %d from %s\n", cpus, fcpu);
+                pr_warning("Invalid #CPUs %d from %s\n", tmp_cpus, fcpu);
                return -EINVAL;
        }
-        return cpus;
+        WRITE_ONCE(cpus, tmp_cpus);
+        return tmp_cpus;
 }
diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile
index 045f5f7d68ab..13f1e8b9ac52 100644
--- a/tools/power/x86/turbostat/Makefile
+++ b/tools/power/x86/turbostat/Makefile
@@ -9,9 +9,10 @@ ifeq ("$(origin O)", "command line")
 endif
 turbostat : turbostat.c
-override CFLAGS +=      -Wall -I../../../include
+override CFLAGS +=      -O2 -Wall -I../../../include
 override CFLAGS +=      -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"'
 override CFLAGS +=      -DINTEL_FAMILY_HEADER='"../../../../arch/x86/include/asm/intel-family.h"'
+override CFLAGS +=      -D_FORTIFY_SOURCE=2
 %: %.c
        @mkdir -p $(BUILD_OUTPUT)
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 75fc4fb9901c..b2a86438f074 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -39,7 +39,6 @@ FILE *outf;
 int *fd_percpu;
 struct timeval interval_tv = {5, 0};
 struct timespec interval_ts = {5, 0};
-struct timespec one_msec = {0, 1000000};
 unsigned int num_iterations;
 unsigned int debug;
 unsigned int quiet;
@@ -60,6 +59,7 @@ unsigned int do_irtl_hsw;
 unsigned int units = 1000000;   /* MHz etc */
 unsigned int genuine_intel;
 unsigned int authentic_amd;
+unsigned int hygon_genuine;
 unsigned int max_level, max_extended_level;
 unsigned int has_invariant_tsc;
 unsigned int do_nhm_platform_info;
@@ -100,6 +100,7 @@ unsigned int has_hwp_epp;		/* IA32_HWP_REQUEST[bits 31:24] */
 unsigned int has_hwp_pkg;               /* IA32_HWP_REQUEST_PKG */
 unsigned int has_misc_feature_control;
 unsigned int first_counter_read = 1;
+int ignore_stdin;
 #define RAPL_PKG                (1 << 0)
                                        /* 0x610 MSR_PKG_POWER_LIMIT */
@@ -166,6 +167,7 @@ size_t cpu_present_setsize, cpu_affinity_setsize, cpu_subset_size;
 struct thread_data {
        struct timeval tv_begin;
        struct timeval tv_end;
+        struct timeval tv_delta;
        unsigned long long tsc;
        unsigned long long aperf;
        unsigned long long mperf;
@@ -506,6 +508,7 @@ unsigned long long bic_enabled = (0xFFFFFFFFFFFFFFFFULL & ~BIC_DISABLED_BY_DEFAU
 unsigned long long bic_present = BIC_USEC | BIC_TOD | BIC_sysfs | BIC_APIC | BIC_X2APIC;
 #define DO_BIC(COUNTER_NAME) (bic_enabled & bic_present & COUNTER_NAME)
+#define DO_BIC_READ(COUNTER_NAME) (bic_present & COUNTER_NAME)
 #define ENABLE_BIC(COUNTER_NAME) (bic_enabled |= COUNTER_NAME)
 #define BIC_PRESENT(COUNTER_BIT) (bic_present |= COUNTER_BIT)
 #define BIC_NOT_PRESENT(COUNTER_BIT) (bic_present &= ~COUNTER_BIT)
@@ -849,7 +852,6 @@ int dump_counters(struct thread_data *t, struct core_data *c,
                outp += sprintf(outp, "pc8: %016llX\n", p->pc8);
                outp += sprintf(outp, "pc9: %016llX\n", p->pc9);
                outp += sprintf(outp, "pc10: %016llX\n", p->pc10);
-                outp += sprintf(outp, "pc10: %016llX\n", p->pc10);
                outp += sprintf(outp, "cpu_lpi: %016llX\n", p->cpu_lpi);
                outp += sprintf(outp, "sys_lpi: %016llX\n", p->sys_lpi);
                outp += sprintf(outp, "Joules PKG: %0X\n", p->energy_pkg);
@@ -911,7 +913,7 @@ int format_counters(struct thread_data *t, struct core_data *c,
        if (DO_BIC(BIC_TOD))
                outp += sprintf(outp, "%10ld.%06ld\t", t->tv_end.tv_sec, t->tv_end.tv_usec);
-        interval_float = tv_delta.tv_sec + tv_delta.tv_usec/1000000.0;
+        interval_float = t->tv_delta.tv_sec + t->tv_delta.tv_usec/1000000.0;
        tsc = t->tsc * tsc_tweak;
@@ -1287,6 +1289,14 @@ delta_core(struct core_data *new, struct core_data *old)
        }
 }
+int soft_c1_residency_display(int bic)
+{
+        if (!DO_BIC(BIC_CPU_c1) || use_c1_residency_msr)
+                return 0;
+        return DO_BIC_READ(bic);
+}
 /*
 * old = new - old
 */
@@ -1309,6 +1319,7 @@ delta_thread(struct thread_data *new, struct thread_data *old,
         * over-write old w/ new so we can print end of interval values
         */
+        timersub(&new->tv_begin, &old->tv_begin, &old->tv_delta);
        old->tv_begin = new->tv_begin;
        old->tv_end = new->tv_end;
@@ -1322,7 +1333,8 @@ delta_thread(struct thread_data *new, struct thread_data *old,
        old->c1 = new->c1 - old->c1;
-        if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz)) {
+        if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz) ||
+            soft_c1_residency_display(BIC_Avg_MHz)) {
                if ((new->aperf > old->aperf) && (new->mperf > old->mperf)) {
                        old->aperf = new->aperf - old->aperf;
                        old->mperf = new->mperf - old->mperf;
@@ -1404,6 +1416,8 @@ void clear_counters(struct thread_data *t, struct core_data *c, struct pkg_data
        t->tv_begin.tv_usec = 0;
        t->tv_end.tv_sec = 0;
        t->tv_end.tv_usec = 0;
+        t->tv_delta.tv_sec = 0;
+        t->tv_delta.tv_usec = 0;
        t->tsc = 0;
        t->aperf = 0;
@@ -1573,6 +1587,9 @@ void compute_average(struct thread_data *t, struct core_data *c,
        for_all_cpus(sum_counters, t, c, p);
+        /* Use the global time delta for the average. */
+        average.threads.tv_delta = tv_delta;
        average.threads.tsc /= topo.num_cpus;
        average.threads.aperf /= topo.num_cpus;
        average.threads.mperf /= topo.num_cpus;
@@ -1714,7 +1731,7 @@ void get_apic_id(struct thread_data *t)
        if (!DO_BIC(BIC_X2APIC))
                return;
-        if (authentic_amd) {
+        if (authentic_amd || hygon_genuine) {
                unsigned int topology_extensions;
                if (max_extended_level < 0x8000001e)
@@ -1762,19 +1779,20 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
        struct msr_counter *mp;
        int i;
-        gettimeofday(&t->tv_begin, (struct timezone *)NULL);
        if (cpu_migrate(cpu)) {
                fprintf(outf, "Could not migrate to CPU %d\n", cpu);
                return -1;
        }
+        gettimeofday(&t->tv_begin, (struct timezone *)NULL);
        if (first_counter_read)
                get_apic_id(t);
 retry:
        t->tsc = rdtsc();       /* we are running on local CPU of interest */
-        if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz)) {
+        if (DO_BIC(BIC_Avg_MHz) || DO_BIC(BIC_Busy) || DO_BIC(BIC_Bzy_MHz) ||
+            soft_c1_residency_display(BIC_Avg_MHz)) {
                unsigned long long tsc_before, tsc_between, tsc_after, aperf_time, mperf_time;
                /*
@@ -1851,20 +1869,20 @@ retry:
        if (!(t->flags & CPU_IS_FIRST_THREAD_IN_CORE))
                goto done;
-        if (DO_BIC(BIC_CPU_c3)) {
+        if (DO_BIC(BIC_CPU_c3) || soft_c1_residency_display(BIC_CPU_c3)) {
                if (get_msr(cpu, MSR_CORE_C3_RESIDENCY, &c->c3))
                        return -6;
        }
-        if (DO_BIC(BIC_CPU_c6) && !do_knl_cstates) {
+        if ((DO_BIC(BIC_CPU_c6) || soft_c1_residency_display(BIC_CPU_c6)) && !do_knl_cstates) {
                if (get_msr(cpu, MSR_CORE_C6_RESIDENCY, &c->c6))
                        return -7;
-        } else if (do_knl_cstates) {
+        } else if (do_knl_cstates || soft_c1_residency_display(BIC_CPU_c6)) {
                if (get_msr(cpu, MSR_KNL_CORE_C6_RESIDENCY, &c->c6))
                        return -7;
        }
-        if (DO_BIC(BIC_CPU_c7))
+        if (DO_BIC(BIC_CPU_c7) || soft_c1_residency_display(BIC_CPU_c7))
                if (get_msr(cpu, MSR_CORE_C7_RESIDENCY, &c->c7))
                        return -8;
@@ -2912,6 +2930,7 @@ int snapshot_cpu_lpi_us(void)
        if (retval != 1) {
                fprintf(stderr, "Disabling Low Power Idle CPU output\n");
                BIC_NOT_PRESENT(BIC_CPU_LPI);
+                fclose(fp);
                return -1;
        }
@@ -2938,6 +2957,7 @@ int snapshot_sys_lpi_us(void)
        if (retval != 1) {
                fprintf(stderr, "Disabling Low Power Idle System output\n");
                BIC_NOT_PRESENT(BIC_SYS_LPI);
+                fclose(fp);
                return -1;
        }
        fclose(fp);
@@ -2985,8 +3005,6 @@ static void signal_handler (int signal)
                        fprintf(stderr, "SIGUSR1\n");
                break;
        }
-        /* make sure this manually-invoked interval is at least 1ms long */
-        nanosleep(&one_msec, NULL);
 }
 void setup_signal_handler(void)
@@ -3005,29 +3023,38 @@ void setup_signal_handler(void)
 void do_sleep(void)
 {
-        struct timeval select_timeout;
+        struct timeval tout;
+        struct timespec rest;
        fd_set readfds;
        int retval;
        FD_ZERO(&readfds);
        FD_SET(0, &readfds);
-        if (!isatty(fileno(stdin))) {
+        if (ignore_stdin) {
                nanosleep(&interval_ts, NULL);
                return;
        }
-        select_timeout = interval_tv;
+        tout = interval_tv;
-        retval = select(1, &readfds, NULL, NULL, &select_timeout);
+        retval = select(1, &readfds, NULL, NULL, &tout);
        if (retval == 1) {
                switch (getc(stdin)) {
                case 'q':
                        exit_requested = 1;
                        break;
+                case EOF:
+                        /*
+                         * 'stdin' is a pipe closed on the other end. There
+                         * won't be any further input.
+                         */
+                        ignore_stdin = 1;
+                        /* Sleep the rest of the time */
+                        rest.tv_sec = (tout.tv_sec + tout.tv_usec / 1000000);
+                        rest.tv_nsec = (tout.tv_usec % 1000000) * 1000;
+                        nanosleep(&rest, NULL);
                }
-                /* make sure this manually-invoked interval is at least 1ms long */
-                nanosleep(&one_msec, NULL);
        }
 }
@@ -3209,6 +3236,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
                break;
        case INTEL_FAM6_HASWELL_CORE:   /* HSW */
        case INTEL_FAM6_HASWELL_X:      /* HSX */
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_HASWELL_GT3E:   /* HSW */
        case INTEL_FAM6_BROADWELL_CORE: /* BDW */
        case INTEL_FAM6_BROADWELL_GT3E: /* BDW */
@@ -3405,6 +3433,7 @@ int has_config_tdp(unsigned int family, unsigned int model)
        case INTEL_FAM6_IVYBRIDGE:      /* IVB */
        case INTEL_FAM6_HASWELL_CORE:   /* HSW */
        case INTEL_FAM6_HASWELL_X:      /* HSX */
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_HASWELL_GT3E:   /* HSW */
        case INTEL_FAM6_BROADWELL_CORE: /* BDW */
        case INTEL_FAM6_BROADWELL_GT3E: /* BDW */
@@ -3803,6 +3832,7 @@ double get_tdp_amd(unsigned int family)
 {
        switch (family) {
        case 0x17:
+        case 0x18:
        default:
                /* This is the max stock TDP of HEDT/Server Fam17h chips */
                return 250.0;
@@ -3841,6 +3871,7 @@ void rapl_probe_intel(unsigned int family, unsigned int model)
        case INTEL_FAM6_SANDYBRIDGE:
        case INTEL_FAM6_IVYBRIDGE:
        case INTEL_FAM6_HASWELL_CORE:   /* HSW */
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_HASWELL_GT3E:   /* HSW */
        case INTEL_FAM6_BROADWELL_CORE: /* BDW */
        case INTEL_FAM6_BROADWELL_GT3E: /* BDW */
@@ -3982,6 +4013,7 @@ void rapl_probe_amd(unsigned int family, unsigned int model)
        switch (family) {
        case 0x17: /* Zen, Zen+ */
+        case 0x18: /* Hygon Dhyana */
                do_rapl = RAPL_AMD_F17H | RAPL_PER_CORE_ENERGY;
                if (rapl_joules) {
                        BIC_PRESENT(BIC_Pkg_J);
@@ -4002,7 +4034,7 @@ void rapl_probe_amd(unsigned int family, unsigned int model)
        rapl_energy_units = ldexp(1.0, -(msr >> 8 & 0x1f));
        rapl_power_units = ldexp(1.0, -(msr & 0xf));
-        tdp = get_tdp_amd(model);
+        tdp = get_tdp_amd(family);
        rapl_joule_counter_range = 0xFFFFFFFF * rapl_energy_units / tdp;
        if (!quiet)
@@ -4018,7 +4050,7 @@ void rapl_probe(unsigned int family, unsigned int model)
 {
        if (genuine_intel)
                rapl_probe_intel(family, model);
-        if (authentic_amd)
+        if (authentic_amd || hygon_genuine)
                rapl_probe_amd(family, model);
 }
@@ -4032,6 +4064,7 @@ void perf_limit_reasons_probe(unsigned int family, unsigned int model)
        switch (model) {
        case INTEL_FAM6_HASWELL_CORE:   /* HSW */
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_HASWELL_GT3E:   /* HSW */
                do_gfx_perf_limit_reasons = 1;
        case INTEL_FAM6_HASWELL_X:      /* HSX */
@@ -4251,6 +4284,7 @@ int has_snb_msrs(unsigned int family, unsigned int model)
        case INTEL_FAM6_IVYBRIDGE_X:    /* IVB Xeon */
        case INTEL_FAM6_HASWELL_CORE:   /* HSW */
        case INTEL_FAM6_HASWELL_X:      /* HSW */
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_HASWELL_GT3E:   /* HSW */
        case INTEL_FAM6_BROADWELL_CORE: /* BDW */
        case INTEL_FAM6_BROADWELL_GT3E: /* BDW */
@@ -4267,7 +4301,7 @@ int has_snb_msrs(unsigned int family, unsigned int model)
 }
 /*
- * HSW adds support for additional MSRs:
+ * HSW ULT added support for C8/C9/C10 MSRs:
 *
 * MSR_PKG_C8_RESIDENCY         0x00000630
 * MSR_PKG_C9_RESIDENCY         0x00000631
@@ -4278,13 +4312,13 @@ int has_snb_msrs(unsigned int family, unsigned int model)
 * MSR_PKGC10_IRTL              0x00000635
 *
 */
-int has_hsw_msrs(unsigned int family, unsigned int model)
+int has_c8910_msrs(unsigned int family, unsigned int model)
 {
        if (!genuine_intel)
                return 0;
        switch (model) {
-        case INTEL_FAM6_HASWELL_CORE:
+        case INTEL_FAM6_HASWELL_ULT:    /* HSW */
        case INTEL_FAM6_BROADWELL_CORE: /* BDW */
        case INTEL_FAM6_SKYLAKE_MOBILE: /* SKL */
        case INTEL_FAM6_CANNONLAKE_MOBILE:      /* CNL */
@@ -4568,9 +4602,6 @@ unsigned int intel_model_duplicates(unsigned int model)
        case INTEL_FAM6_XEON_PHI_KNM:
                return INTEL_FAM6_XEON_PHI_KNL;
-        case INTEL_FAM6_HASWELL_ULT:
-                return INTEL_FAM6_HASWELL_CORE;
        case INTEL_FAM6_BROADWELL_X:
        case INTEL_FAM6_BROADWELL_XEON_D:       /* BDX-DE */
                return INTEL_FAM6_BROADWELL_X;
@@ -4582,7 +4613,11 @@ unsigned int intel_model_duplicates(unsigned int model)
                return INTEL_FAM6_SKYLAKE_MOBILE;
        case INTEL_FAM6_ICELAKE_MOBILE:
+        case INTEL_FAM6_ICELAKE_NNPI:
                return INTEL_FAM6_CANNONLAKE_MOBILE;
+        case INTEL_FAM6_ATOM_TREMONT_X:
+                return INTEL_FAM6_ATOM_GOLDMONT_X;
        }
        return model;
 }
@@ -4600,6 +4635,8 @@ void process_cpuid()
                genuine_intel = 1;
        else if (ebx == 0x68747541 && ecx == 0x444d4163 && edx == 0x69746e65)
                authentic_amd = 1;
+        else if (ebx == 0x6f677948 && ecx == 0x656e6975 && edx == 0x6e65476e)
+                hygon_genuine = 1;
        if (!quiet)
                fprintf(outf, "CPUID(0): %.4s%.4s%.4s ",
@@ -4820,12 +4857,12 @@ void process_cpuid()
                BIC_NOT_PRESENT(BIC_CPU_c7);
                BIC_NOT_PRESENT(BIC_Pkgpc7);
        }
-        if (has_hsw_msrs(family, model)) {
+        if (has_c8910_msrs(family, model)) {
                BIC_PRESENT(BIC_Pkgpc8);
                BIC_PRESENT(BIC_Pkgpc9);
                BIC_PRESENT(BIC_Pkgpc10);
        }
-        do_irtl_hsw = has_hsw_msrs(family, model);
+        do_irtl_hsw = has_c8910_msrs(family, model);
        if (has_skl_msrs(family, model)) {
                BIC_PRESENT(BIC_Totl_c0);
                BIC_PRESENT(BIC_Any_c0);
@@ -5123,7 +5160,7 @@ int initialize_counters(int cpu_id)
 void allocate_output_buffer()
 {
-        output_buffer = calloc(1, (1 + topo.num_cpus) * 1024);
+        output_buffer = calloc(1, (1 + topo.num_cpus) * 2048);
        outp = output_buffer;
        if (outp == NULL)
                err(-1, "calloc output buffer");
@@ -5269,7 +5306,7 @@ int get_and_dump_counters(void)
 }
 void print_version() {
-        fprintf(outf, "turbostat version 19.03.20"
+        fprintf(outf, "turbostat version 19.08.31"
                " - Len Brown <lenb@kernel.org>\n");
 }
diff --git a/tools/power/x86/x86_energy_perf_policy/Makefile b/tools/power/x86/x86_energy_perf_policy/Makefile
index 1fdeef864e7c..666b325a62a2 100644
--- a/tools/power/x86/x86_energy_perf_policy/Makefile
+++ b/tools/power/x86/x86_energy_perf_policy/Makefile
@@ -9,8 +9,9 @@ ifeq ("$(origin O)", "command line")
 endif
 x86_energy_perf_policy : x86_energy_perf_policy.c
-override CFLAGS +=      -Wall -I../../../include
+override CFLAGS +=      -O2 -Wall -I../../../include
 override CFLAGS +=      -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"'
+override CFLAGS +=      -D_FORTIFY_SOURCE=2
 %: %.c
        @mkdir -p $(BUILD_OUTPUT)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.8 b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.8
index 17db1c3af4d0..78c6361898b1 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.8
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.8
@@ -40,7 +40,7 @@ in the same processor package.
 Hardware P-States (HWP) are effectively an expansion of hardware
 P-state control from the opportunistic turbo-mode P-state range
 to include the entire range of available P-states.
-On Broadwell Xeon, the initial HWP implementation, EBP influenced HWP.
+On Broadwell Xeon, the initial HWP implementation, EPB influenced HWP.
 That influence was removed in subsequent generations,
 where it was moved to the
 Energy_Performance_Preference (EPP) field in
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 34a796b303fe..3fe1eed900d4 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -545,7 +545,7 @@ void cmdline(int argc, char **argv)
        progname = argv[0];
-        while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw",
+        while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw:",
                                long_options, &option_index)) != -1) {
                switch (opt) {
                case 'a':
@@ -1259,6 +1259,15 @@ void probe_dev_msr(void)
                if (system("/sbin/modprobe msr > /dev/null 2>&1"))
                        err(-5, "no /dev/cpu/0/msr, Try \"# modprobe msr\" ");
 }
+static void get_cpuid_or_exit(unsigned int leaf,
+                             unsigned int *eax, unsigned int *ebx,
+                             unsigned int *ecx, unsigned int *edx)
+{
+        if (!__get_cpuid(leaf, eax, ebx, ecx, edx))
+                errx(1, "Processor not supported\n");
+}
 /*
 * early_cpuid()
 * initialize turbo_is_enabled, has_hwp, has_epb
@@ -1266,15 +1275,10 @@ void probe_dev_msr(void)
 */
 void early_cpuid(void)
 {
-        unsigned int eax, ebx, ecx, edx, max_level;
+        unsigned int eax, ebx, ecx, edx;
        unsigned int fms, family, model;
-        __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
+        get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
-        if (max_level < 6)
-                errx(1, "Processor not supported\n");
-        __get_cpuid(1, &fms, &ebx, &ecx, &edx);
        family = (fms >> 8) & 0xf;
        model = (fms >> 4) & 0xf;
        if (family == 6 || family == 0xf)
@@ -1288,7 +1292,7 @@ void early_cpuid(void)
                bdx_highest_ratio = msr & 0xFF;
        }
-        __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
+        get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
        turbo_is_enabled = (eax >> 1) & 1;
        has_hwp = (eax >> 7) & 1;
        has_epb = (ecx >> 3) & 1;
@@ -1306,7 +1310,7 @@ void parse_cpuid(void)
        eax = ebx = ecx = edx = 0;
-        __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
+        get_cpuid_or_exit(0, &max_level, &ebx, &ecx, &edx);
        if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e)
                genuine_intel = 1;
@@ -1315,7 +1319,7 @@ void parse_cpuid(void)
                fprintf(stderr, "CPUID(0): %.4s%.4s%.4s ",
                        (char *)&ebx, (char *)&edx, (char *)&ecx);
-        __get_cpuid(1, &fms, &ebx, &ecx, &edx);
+        get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
        family = (fms >> 8) & 0xf;
        model = (fms >> 4) & 0xf;
        stepping = fms & 0xf;
@@ -1340,7 +1344,7 @@ void parse_cpuid(void)
                errx(1, "CPUID: no MSR");
-        __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
+        get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
        /* turbo_is_enabled already set */
        /* has_hwp already set */
        has_hwp_notify = eax & (1 << 8);
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index c085964e1d05..96752ebd938f 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -34,6 +34,9 @@ TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test
 BPF_OBJ_FILES = $(patsubst %.c,%.o, $(notdir $(wildcard progs/*.c)))
 TEST_GEN_FILES = $(BPF_OBJ_FILES)
+BTF_C_FILES = $(wildcard progs/btf_dump_test_case_*.c)
+TEST_FILES = $(BTF_C_FILES)
 # Also test sub-register code-gen if LLVM has eBPF v3 processor support which
 # contains both ALU32 and JMP32 instructions.
 SUBREG_CODEGEN := $(shell echo "int cal(int a) { return a > 0; }" | \
@@ -68,7 +71,8 @@ TEST_PROGS := test_kmod.sh \
 TEST_PROGS_EXTENDED := with_addr.sh \
        with_tunnels.sh \
        tcp_client.py \
-        tcp_server.py
+        tcp_server.py \
+        test_xdp_vlan.sh
 # Compile but not part of 'make run_tests'
 TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr test_skb_cgroup_id_user \
diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index f7a0744db31e..5dc109f4c097 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -34,3 +34,4 @@ CONFIG_NET_MPLS_GSO=m
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
 CONFIG_IPV6_SIT=m
+CONFIG_BPF_JIT=y
diff --git a/tools/testing/selftests/bpf/test_btf_dump.c b/tools/testing/selftests/bpf/test_btf_dump.c
index 8f850823d35f..6e75dd3cb14f 100644
--- a/tools/testing/selftests/bpf/test_btf_dump.c
+++ b/tools/testing/selftests/bpf/test_btf_dump.c
@@ -97,6 +97,13 @@ int test_btf_dump_case(int n, struct btf_dump_test_case *test_case)
        }
        snprintf(test_file, sizeof(test_file), "progs/%s.c", test_case->name);
+        if (access(test_file, R_OK) == -1)
+                /*
+                 * When the test is run with O=, kselftest copies TEST_FILES
+                 * without preserving the directory structure.
+                 */
+                snprintf(test_file, sizeof(test_file), "%s.c",
+                        test_case->name);
        /*
         * Diff test output and expected test output, contained between
         * START-EXPECTED-OUTPUT and END-EXPECTED-OUTPUT lines in test case.
diff --git a/tools/testing/selftests/bpf/test_cgroup_storage.c b/tools/testing/selftests/bpf/test_cgroup_storage.c
index 2fc4625c1a15..655729004391 100644
--- a/tools/testing/selftests/bpf/test_cgroup_storage.c
+++ b/tools/testing/selftests/bpf/test_cgroup_storage.c
@@ -20,9 +20,9 @@ int main(int argc, char **argv)
                BPF_MOV64_IMM(BPF_REG_2, 0), /* flags, not used */
                BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
                             BPF_FUNC_get_local_storage),
-                BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+                BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
                BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 0x1),
-                BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
+                BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
                BPF_LD_MAP_FD(BPF_REG_1, 0), /* map fd */
                BPF_MOV64_IMM(BPF_REG_2, 0), /* flags, not used */
@@ -30,7 +30,7 @@ int main(int argc, char **argv)
                             BPF_FUNC_get_local_storage),
                BPF_MOV64_IMM(BPF_REG_1, 1),
                BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
-                BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+                BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
                BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x1),
                BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
                BPF_EXIT_INSN(),
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index fb679ac3d4b0..0e6652733462 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -13,6 +13,7 @@
 #include <bpf/bpf.h>
 #include "cgroup_helpers.h"
+#include "bpf_endian.h"
 #include "bpf_rlimit.h"
 #include "bpf_util.h"
@@ -232,7 +233,8 @@ static struct sock_test tests[] = {
                        /* if (ip == expected && port == expected) */
                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
                                    offsetof(struct bpf_sock, src_ip6[3])),
-                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
+                                    __bpf_constant_ntohl(0x00000001), 4),
                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
                                    offsetof(struct bpf_sock, src_port)),
                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
@@ -261,7 +263,8 @@ static struct sock_test tests[] = {
                        /* if (ip == expected && port == expected) */
                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
                                    offsetof(struct bpf_sock, src_ip4)),
-                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
+                                    __bpf_constant_ntohl(0x7F000001), 4),
                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
                                    offsetof(struct bpf_sock, src_port)),
                        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
diff --git a/tools/testing/selftests/bpf/verifier/loops1.c b/tools/testing/selftests/bpf/verifier/loops1.c
index 5e980a5ab69d..1fc4e61e9f9f 100644
--- a/tools/testing/selftests/bpf/verifier/loops1.c
+++ b/tools/testing/selftests/bpf/verifier/loops1.c
@@ -159,3 +159,31 @@
        .errstr = "loop detected",
        .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 },
+{
+        "not-taken loop with back jump to 1st insn",
+        .insns = {
+        BPF_MOV64_IMM(BPF_REG_0, 123),
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 4, -2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .prog_type = BPF_PROG_TYPE_XDP,
+        .retval = 123,
+},
+{
+        "taken loop with back jump to 1st insn",
+        .insns = {
+        BPF_MOV64_IMM(BPF_REG_1, 10),
+        BPF_MOV64_IMM(BPF_REG_2, 0),
+        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
+        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, -3),
+        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .prog_type = BPF_PROG_TYPE_XDP,
+        .retval = 55,
+},
diff --git a/tools/testing/selftests/kvm/include/evmcs.h b/tools/testing/selftests/kvm/include/evmcs.h
index 4059014d93ea..4912d23844bc 100644
--- a/tools/testing/selftests/kvm/include/evmcs.h
+++ b/tools/testing/selftests/kvm/include/evmcs.h
@@ -220,6 +220,8 @@ struct hv_enlightened_vmcs {
 struct hv_enlightened_vmcs *current_evmcs;
 struct hv_vp_assist_page *current_vp_assist;
+int vcpu_enable_evmcs(struct kvm_vm *vm, int vcpu_id);
 static inline int enable_vp_assist(uint64_t vp_assist_pa, void *vp_assist)
 {
        u64 val = (vp_assist_pa & HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_MASK) |
diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c
index 6cb34a0fa200..0a5e487dbc50 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/processor.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c
@@ -1060,9 +1060,11 @@ struct kvm_x86_state *vcpu_save_state(struct kvm_vm *vm, uint32_t vcpuid)
        TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XSAVE, r: %i",
                r);
-        r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs);
+        if (kvm_check_cap(KVM_CAP_XCRS)) {
-        TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i",
+                r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs);
-                r);
+                TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i",
+                            r);
+        }
        r = ioctl(vcpu->fd, KVM_GET_SREGS, &state->sregs);
        TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_SREGS, r: %i",
@@ -1103,9 +1105,11 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
        TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XSAVE, r: %i",
                r);
-        r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs);
+        if (kvm_check_cap(KVM_CAP_XCRS)) {
-        TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i",
+                r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs);
-                r);
+                TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i",
+                            r);
+        }
        r = ioctl(vcpu->fd, KVM_SET_SREGS, &state->sregs);
        TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_SREGS, r: %i",
diff --git a/tools/testing/selftests/kvm/lib/x86_64/vmx.c b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
index 204f847bd065..9cef0455b819 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/vmx.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
@@ -12,6 +12,26 @@
 bool enable_evmcs;
+int vcpu_enable_evmcs(struct kvm_vm *vm, int vcpu_id)
+{
+        uint16_t evmcs_ver;
+        struct kvm_enable_cap enable_evmcs_cap = {
+                .cap = KVM_CAP_HYPERV_ENLIGHTENED_VMCS,
+                 .args[0] = (unsigned long)&evmcs_ver
+        };
+        vcpu_ioctl(vm, vcpu_id, KVM_ENABLE_CAP, &enable_evmcs_cap);
+        /* KVM should return supported EVMCS version range */
+        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
+                    (evmcs_ver & 0xff) > 0,
+                    "Incorrect EVMCS version range: %x:%x\n",
+                    evmcs_ver & 0xff, evmcs_ver >> 8);
+        return evmcs_ver;
+}
 /* Allocate memory regions for nested VMX tests.
 *
 * Input Args:
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index f95c08343b48..92915e6408e7 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -79,11 +79,6 @@ int main(int argc, char *argv[])
        struct kvm_x86_state *state;
        struct ucall uc;
        int stage;
-        uint16_t evmcs_ver;
-        struct kvm_enable_cap enable_evmcs_cap = {
-                .cap = KVM_CAP_HYPERV_ENLIGHTENED_VMCS,
-                 .args[0] = (unsigned long)&evmcs_ver
-        };
        /* Create VM */
        vm = vm_create_default(VCPU_ID, 0, guest_code);
@@ -96,13 +91,7 @@ int main(int argc, char *argv[])
                exit(KSFT_SKIP);
        }
-        vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
+        vcpu_enable_evmcs(vm, VCPU_ID);
-        /* KVM should return supported EVMCS version range */
-        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
-                    (evmcs_ver & 0xff) > 0,
-                    "Incorrect EVMCS version range: %x:%x\n",
-                    evmcs_ver & 0xff, evmcs_ver >> 8);
        run = vcpu_state(vm, VCPU_ID);
@@ -146,7 +135,7 @@ int main(int argc, char *argv[])
                kvm_vm_restart(vm, O_RDWR);
                vm_vcpu_add(vm, VCPU_ID);
                vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
-                vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
+                vcpu_enable_evmcs(vm, VCPU_ID);
                vcpu_load_state(vm, VCPU_ID, state);
                run = vcpu_state(vm, VCPU_ID);
                free(state);
diff --git a/tools/testing/selftests/kvm/x86_64/hyperv_cpuid.c b/tools/testing/selftests/kvm/x86_64/hyperv_cpuid.c
index f72b3043db0e..ee59831fbc98 100644
--- a/tools/testing/selftests/kvm/x86_64/hyperv_cpuid.c
+++ b/tools/testing/selftests/kvm/x86_64/hyperv_cpuid.c
@@ -18,6 +18,7 @@
 #include "test_util.h"
 #include "kvm_util.h"
 #include "processor.h"
+#include "vmx.h"
 #define VCPU_ID 0
@@ -106,12 +107,7 @@ int main(int argc, char *argv[])
 {
        struct kvm_vm *vm;
        int rv;
-        uint16_t evmcs_ver;
        struct kvm_cpuid2 *hv_cpuid_entries;
-        struct kvm_enable_cap enable_evmcs_cap = {
-                .cap = KVM_CAP_HYPERV_ENLIGHTENED_VMCS,
-                 .args[0] = (unsigned long)&evmcs_ver
-        };
        /* Tell stdout not to buffer its content */
        setbuf(stdout, NULL);
@@ -136,14 +132,14 @@ int main(int argc, char *argv[])
        free(hv_cpuid_entries);
-        rv = _vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
+        if (!kvm_check_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS)) {
-        if (rv) {
                fprintf(stderr,
                        "Enlightened VMCS is unsupported, skip related test\n");
                goto vm_free;
        }
+        vcpu_enable_evmcs(vm, VCPU_ID);
        hv_cpuid_entries = kvm_get_supported_hv_cpuid(vm);
        if (!hv_cpuid_entries)
                return 1;
diff --git a/tools/testing/selftests/kvm/x86_64/platform_info_test.c b/tools/testing/selftests/kvm/x86_64/platform_info_test.c
index 40050e44ec0a..f9334bd3cce9 100644
--- a/tools/testing/selftests/kvm/x86_64/platform_info_test.c
+++ b/tools/testing/selftests/kvm/x86_64/platform_info_test.c
@@ -99,8 +99,8 @@ int main(int argc, char *argv[])
        msr_platform_info = vcpu_get_msr(vm, VCPU_ID, MSR_PLATFORM_INFO);
        vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO,
                msr_platform_info | MSR_PLATFORM_INFO_MAX_TURBO_RATIO);
-        test_msr_platform_info_disabled(vm);
        test_msr_platform_info_enabled(vm);
+        test_msr_platform_info_disabled(vm);
        vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO, msr_platform_info);
        kvm_vm_free(vm);
diff --git a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
index ed7218d166da..853e370e8a39 100644
--- a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
@@ -25,24 +25,17 @@
 #define VMCS12_REVISION 0x11e57ed0
 #define VCPU_ID 5
+bool have_evmcs;
 void test_nested_state(struct kvm_vm *vm, struct kvm_nested_state *state)
 {
-        volatile struct kvm_run *run;
        vcpu_nested_state_set(vm, VCPU_ID, state, false);
-        run = vcpu_state(vm, VCPU_ID);
-        vcpu_run(vm, VCPU_ID);
-        TEST_ASSERT(run->exit_reason == KVM_EXIT_SHUTDOWN,
-                "Got exit_reason other than KVM_EXIT_SHUTDOWN: %u (%s),\n",
-                run->exit_reason,
-                exit_reason_str(run->exit_reason));
 }
 void test_nested_state_expect_errno(struct kvm_vm *vm,
                                    struct kvm_nested_state *state,
                                    int expected_errno)
 {
-        volatile struct kvm_run *run;
        int rv;
        rv = vcpu_nested_state_set(vm, VCPU_ID, state, true);
@@ -50,12 +43,6 @@ void test_nested_state_expect_errno(struct kvm_vm *vm,
                "Expected %s (%d) from vcpu_nested_state_set but got rv: %i errno: %s (%d)",
                strerror(expected_errno), expected_errno, rv, strerror(errno),
                errno);
-        run = vcpu_state(vm, VCPU_ID);
-        vcpu_run(vm, VCPU_ID);
-        TEST_ASSERT(run->exit_reason == KVM_EXIT_SHUTDOWN,
-                "Got exit_reason other than KVM_EXIT_SHUTDOWN: %u (%s),\n",
-                run->exit_reason,
-                exit_reason_str(run->exit_reason));
 }
 void test_nested_state_expect_einval(struct kvm_vm *vm,
@@ -90,8 +77,9 @@ void set_default_vmx_state(struct kvm_nested_state *state, int size)
 {
        memset(state, 0, size);
        state->flags = KVM_STATE_NESTED_GUEST_MODE  |
-                        KVM_STATE_NESTED_RUN_PENDING |
+                        KVM_STATE_NESTED_RUN_PENDING;
-                        KVM_STATE_NESTED_EVMCS;
+        if (have_evmcs)
+                state->flags |= KVM_STATE_NESTED_EVMCS;
        state->format = 0;
        state->size = size;
        state->hdr.vmx.vmxon_pa = 0x1000;
@@ -141,13 +129,19 @@ void test_vmx_nested_state(struct kvm_vm *vm)
        /*
         * Setting vmxon_pa == -1ull and vmcs_pa == -1ull exits early without
         * setting the nested state but flags other than eVMCS must be clear.
+         * The eVMCS flag can be set if the enlightened VMCS capability has
+         * been enabled.
         */
        set_default_vmx_state(state, state_sz);
        state->hdr.vmx.vmxon_pa = -1ull;
        state->hdr.vmx.vmcs12_pa = -1ull;
        test_nested_state_expect_einval(vm, state);
-        state->flags = KVM_STATE_NESTED_EVMCS;
+        state->flags &= KVM_STATE_NESTED_EVMCS;
+        if (have_evmcs) {
+                test_nested_state_expect_einval(vm, state);
+                vcpu_enable_evmcs(vm, VCPU_ID);
+        }
        test_nested_state(vm, state);
        /* It is invalid to have vmxon_pa == -1ull and SMM flags non-zero. */
@@ -232,6 +226,8 @@ int main(int argc, char *argv[])
        struct kvm_nested_state state;
        struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
+        have_evmcs = kvm_check_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS);
        if (!kvm_check_cap(KVM_CAP_NESTED_STATE)) {
                printf("KVM_CAP_NESTED_STATE not available, skipping test\n");
                exit(KSFT_SKIP);
diff --git a/tools/testing/selftests/net/tcp_fastopen_backup_key.sh b/tools/testing/selftests/net/tcp_fastopen_backup_key.sh
index 41476399e184..f6e65674b83c 100755
--- a/tools/testing/selftests/net/tcp_fastopen_backup_key.sh
+++ b/tools/testing/selftests/net/tcp_fastopen_backup_key.sh
@@ -30,7 +30,7 @@ do_test() {
        ip netns exec "${NETNS}" ./tcp_fastopen_backup_key "$1"
        val=$(ip netns exec "${NETNS}" nstat -az | \
                grep TcpExtTCPFastOpenPassiveFail | awk '{print $2}')
-        if [ $val -ne 0 ]; then
+        if [ "$val" != 0 ]; then
                echo "FAIL: TcpExtTCPFastOpenPassiveFail non-zero"
                return 1
        fi
diff --git a/tools/testing/selftests/netfilter/nft_flowtable.sh b/tools/testing/selftests/netfilter/nft_flowtable.sh
index fe52488a6f72..16571ac1dab4 100755
--- a/tools/testing/selftests/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/netfilter/nft_flowtable.sh
@@ -321,4 +321,52 @@ else
        ip netns exec nsr1 nft list ruleset
 fi
+KEY_SHA="0x"$(ps -xaf | sha1sum | cut -d " " -f 1)
+KEY_AES="0x"$(ps -xaf | md5sum | cut -d " " -f 1)
+SPI1=$RANDOM
+SPI2=$RANDOM
+if [ $SPI1 -eq $SPI2 ]; then
+        SPI2=$((SPI2+1))
+fi
+do_esp() {
+    local ns=$1
+    local me=$2
+    local remote=$3
+    local lnet=$4
+    local rnet=$5
+    local spi_out=$6
+    local spi_in=$7
+    ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA mode tunnel sel src $rnet dst $lnet
+    ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
+    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 1 action allow
+    # to fwd decrypted packets after esp processing:
+    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 1 action allow
+}
+do_esp nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2
+do_esp nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1
+ip netns exec nsr1 nft delete table ip nat
+# restore default routes
+ip -net ns2 route del 192.168.10.1 via 10.0.2.1
+ip -net ns2 route add default via 10.0.2.1
+ip -net ns2 route add default via dead:2::1
+test_tcp_forwarding ns1 ns2
+if [ $? -eq 0 ] ;then
+        echo "PASS: ipsec tunnel mode for ns1/ns2"
+else
+        echo "FAIL: ipsec tunnel mode for ns1/ns2"
+        ip netns exec nsr1 nft list ruleset 1>&2
+        ip netns exec nsr1 cat /proc/net/xfrm_stat 1>&2
+fi
 exit $ret
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json b/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
index bf5ebf59c2d4..9cdd2e31ac2c 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/skbedit.json
@@ -670,5 +670,52 @@
        "teardown": [
            "$TC actions flush action skbedit"
        ]
+    },
+    {
+        "id": "630c",
+        "name": "Add batch of 32 skbedit actions with all parameters and cookie",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action skbedit queue_mapping 2 priority 10 mark 7/0xaabbccdd ptype host inheritdsfield index \\$i cookie aabbccddeeff112233445566778800a1 \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action skbedit",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "32",
+        "teardown": [
+            "$TC actions flush action skbedit"
+        ]
+    },
+    {
+        "id": "706d",
+        "name": "Delete batch of 32 skbedit actions with all parameters",
+        "category": [
+            "actions",
+            "skbedit"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action skbedit",
+                0,
+                1,
+                255
+            ],
+            "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action skbedit queue_mapping 2 priority 10 mark 7/0xaabbccdd ptype host inheritdsfield index \\$i \\\"; args=\\\"\\$args\\$cmd\\\"; done && $TC actions add \\$args\""
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action skbedit index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions del \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action skbedit",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "0",
+        "teardown": []
    }
 ]
diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
index a8a6a0c883f1..6af5c91337f2 100644
--- a/virt/kvm/arm/mmio.c
+++ b/virt/kvm/arm/mmio.c
@@ -86,6 +86,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
        unsigned int len;
        int mask;
+        /* Detect an already handled MMIO return */
+        if (unlikely(!vcpu->mmio_needed))
+                return 0;
+        vcpu->mmio_needed = 0;
        if (!run->mmio.is_write) {
                len = run->mmio.len;
                if (len > sizeof(unsigned long))
@@ -188,6 +194,7 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
        run->mmio.is_write      = is_write;
        run->mmio.phys_addr     = fault_ipa;
        run->mmio.len           = len;
+        vcpu->mmio_needed       = 1;
        if (!ret) {
                /* We handled the access successfully in the kernel. */
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index bdbc297d06fb..e621b5d45b27 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -8,6 +8,7 @@
 #include <linux/cpu.h>
 #include <linux/kvm_host.h>
 #include <kvm/arm_vgic.h>
+#include <asm/kvm_emulate.h>
 #include <asm/kvm_mmu.h>
 #include "vgic.h"
@@ -164,12 +165,18 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
                irq->vcpu = NULL;
                irq->target_vcpu = vcpu0;
                kref_init(&irq->refcount);
-                if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                switch (dist->vgic_model) {
+                case KVM_DEV_TYPE_ARM_VGIC_V2:
                        irq->targets = 0;
                        irq->group = 0;
-                } else {
+                        break;
+                case KVM_DEV_TYPE_ARM_VGIC_V3:
                        irq->mpidr = 0;
                        irq->group = 1;
+                        break;
+                default:
+                        kfree(dist->spis);
+                        return -EINVAL;
                }
        }
        return 0;
@@ -209,7 +216,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
                irq->intid = i;
                irq->vcpu = NULL;
                irq->target_vcpu = vcpu;
-                irq->targets = 1U << vcpu->vcpu_id;
                kref_init(&irq->refcount);
                if (vgic_irq_is_sgi(i)) {
                        /* SGIs */
@@ -219,11 +225,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
                        /* PPIs */
                        irq->config = VGIC_CONFIG_LEVEL;
                }
-                if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
-                        irq->group = 1;
-                else
-                        irq->group = 0;
        }
        if (!irqchip_in_kernel(vcpu->kvm))
@@ -286,10 +287,19 @@ int vgic_init(struct kvm *kvm)
                for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
                        struct vgic_irq *irq = &vgic_cpu->private_irqs[i];
-                        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+                        switch (dist->vgic_model) {
+                        case KVM_DEV_TYPE_ARM_VGIC_V3:
                                irq->group = 1;
-                        else
+                                irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
+                                break;
+                        case KVM_DEV_TYPE_ARM_VGIC_V2:
                                irq->group = 0;
+                                irq->targets = 1U << idx;
+                                break;
+                        default:
+                                ret = -EINVAL;
+                                goto out;
+                        }
                }
        }
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 44efc2ff863f..0d090482720d 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -211,6 +211,12 @@ static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
        vgic_irq_set_phys_active(irq, true);
 }
+static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+{
+        return (vgic_irq_is_sgi(irq->intid) &&
+                vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2);
+}
 void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
                              gpa_t addr, unsigned int len,
                              unsigned long val)
@@ -223,6 +229,12 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
        for_each_set_bit(i, &val, len * 8) {
                struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+                /* GICD_ISPENDR0 SGI bits are WI */
+                if (is_vgic_v2_sgi(vcpu, irq)) {
+                        vgic_put_irq(vcpu->kvm, irq);
+                        continue;
+                }
                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                if (irq->hw)
                        vgic_hw_irq_spending(vcpu, irq, is_uaccess);
@@ -270,6 +282,12 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
        for_each_set_bit(i, &val, len * 8) {
                struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+                /* GICD_ICPENDR0 SGI bits are WI */
+                if (is_vgic_v2_sgi(vcpu, irq)) {
+                        vgic_put_irq(vcpu->kvm, irq);
+                        continue;
+                }
                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                if (irq->hw)
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 96aab77d0471..b00aa304c260 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -184,7 +184,10 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                if (vgic_irq_is_sgi(irq->intid)) {
                        u32 src = ffs(irq->source);
-                        BUG_ON(!src);
+                        if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+                                           irq->intid))
+                                return;
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
                        if (irq->source) {
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 0c653a1e5215..a4ad431c92a9 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -167,7 +167,10 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
                    model == KVM_DEV_TYPE_ARM_VGIC_V2) {
                        u32 src = ffs(irq->source);
-                        BUG_ON(!src);
+                        if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
+                                           irq->intid))
+                                return;
                        val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
                        irq->source &= ~(1 << (src - 1));
                        if (irq->source) {
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 13d4b38a94ec..e7bde65ba67c 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
        bool penda, pendb;
        int ret;
+        /*
+         * list_sort may call this function with the same element when
+         * the list is fairly long.
+         */
+        if (unlikely(irqa == irqb))
+                return 0;
        raw_spin_lock(&irqa->irq_lock);
        raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);