540 files changed, 5344 insertions, 2994 deletions
diff --git a/Documentation/ABI/stable/sysfs-driver-mlxreg-io b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
index 9b642669cb16..169fe08a649b 100644
--- a/Documentation/ABI/stable/sysfs-driver-mlxreg-io
+++ b/Documentation/ABI/stable/sysfs-driver-mlxreg-io
@@ -24,7 +24,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                        cpld3_version
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show with which CPLD versions have been burned
                on LED board.
@@ -35,7 +35,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                        jtag_enable
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files enable and disable the access to the JTAG domain.
                By default access to the JTAG domain is disabled.
@@ -105,7 +105,7 @@ What:		/sys/devices/platform/mlxplat/mlxreg-io/hwmon/hwmon*/
                                                reset_voltmon_upgrade_fail
 Date:           November 2018
-KernelVersion:  4.21
+KernelVersion:  5.0
 Contact:        Vadim Pasternak <vadimpmellanox.com>
 Description:    These files show the system reset cause, as following: ComEx
                power fail, reset from ComEx, system platform reset, reset
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index 6a6d67acaf69..5d54b27c6eba 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -108,12 +108,13 @@ some, but not all of the other indices changing.
 Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
 will not need to allocate memory.  The :c:func:`xa_reserve` function
-will store a reserved entry at the indicated index.  Users of the normal
+will store a reserved entry at the indicated index.  Users of the
-API will see this entry as containing ``NULL``.  If you do not need to
+normal API will see this entry as containing ``NULL``.  If you do
-use the reserved entry, you can call :c:func:`xa_release` to remove the
+not need to use the reserved entry, you can call :c:func:`xa_release`
-unused entry.  If another user has stored to the entry in the meantime,
+to remove the unused entry.  If another user has stored to the entry
-:c:func:`xa_release` will do nothing; if instead you want the entry to
+in the meantime, :c:func:`xa_release` will do nothing; if instead you
-become ``NULL``, you should use :c:func:`xa_erase`.
+want the entry to become ``NULL``, you should use :c:func:`xa_erase`.
+Using :c:func:`xa_insert` on a reserved entry will fail.
 If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
 will return ``true``.
@@ -183,6 +184,8 @@ Takes xa_lock internally:
 * :c:func:`xa_store_bh`
 * :c:func:`xa_store_irq`
 * :c:func:`xa_insert`
+ * :c:func:`xa_insert_bh`
+ * :c:func:`xa_insert_irq`
 * :c:func:`xa_erase`
 * :c:func:`xa_erase_bh`
 * :c:func:`xa_erase_irq`
diff --git a/Documentation/devicetree/bindings/Makefile b/Documentation/devicetree/bindings/Makefile
index 6e5cef0ed6fb..50daa0b3b032 100644
--- a/Documentation/devicetree/bindings/Makefile
+++ b/Documentation/devicetree/bindings/Makefile
@@ -17,7 +17,11 @@ extra-y += $(DT_TMP_SCHEMA)
 quiet_cmd_mk_schema = SCHEMA  $@
      cmd_mk_schema = $(DT_MK_SCHEMA) $(DT_MK_SCHEMA_FLAGS) -o $@ $(filter-out FORCE, $^)
-DT_DOCS = $(shell cd $(srctree)/$(src) && find * -name '*.yaml')
+DT_DOCS = $(shell \
+        cd $(srctree)/$(src) && \
+        find * \( -name '*.yaml' ! -name $(DT_TMP_SCHEMA) \) \
+        )
 DT_SCHEMA_FILES ?= $(addprefix $(src)/,$(DT_DOCS))
 extra-y += $(patsubst $(src)/%.yaml,%.example.dts, $(DT_SCHEMA_FILES))
diff --git a/Documentation/devicetree/bindings/display/msm/gpu.txt b/Documentation/devicetree/bindings/display/msm/gpu.txt
index ac8df3b871f9..f8759145ce1a 100644
--- a/Documentation/devicetree/bindings/display/msm/gpu.txt
+++ b/Documentation/devicetree/bindings/display/msm/gpu.txt
@@ -27,7 +27,6 @@ Example:
                reg = <0x04300000 0x20000>;
                reg-names = "kgsl_3d0_reg_memory";
                interrupts = <GIC_SPI 80 0>;
-                interrupt-names = "kgsl_3d0_irq";
                clock-names =
                    "core",
                    "iface",
diff --git a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
index 36603419d6f8..0e72183f52bc 100644
--- a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
+++ b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
@@ -4,14 +4,10 @@ Required properties:
 - compatible : "olpc,ap-sp"
 - reg : base address and length of SoC's WTM registers
 - interrupts : SP-AP interrupt
- clocks : phandle + clock-specifier for the clock that drives the WTM
- clock-names:  should be "sp"
 Example:
        ap-sp@d4290000 {
                compatible = "olpc,ap-sp";
                reg = <0xd4290000 0x1000>;
                interrupts = <40>;
-                clocks = <&soc_clocks MMP2_CLK_SP>;
-                clock-names = "sp";
        }
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 819caf8ca05f..58649bd4fcfc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -56,26 +56,32 @@ of any kernel data structures.
 dentry-state:
-From linux/fs/dentry.c:
+From linux/include/linux/dcache.h:
 --------------------------------------------------------------
-struct {
+struct dentry_stat_t dentry_stat {
        int nr_dentry;
        int nr_unused;
        int age_limit;         /* age in seconds */
        int want_pages;        /* pages requested by system */
-        int dummy[2];
+        int nr_negative;       /* # of unused negative dentries */
-} dentry_stat = {0, 0, 45, 0,};
+        int dummy;             /* Reserved for future use */
-------------------------------------------------------------- 
+};
+--------------------------------------------------------------
-Dentries are dynamically allocated and deallocated, and
-nr_dentry seems to be 0 all the time. Hence it's safe to
+Dentries are dynamically allocated and deallocated.
-assume that only nr_unused, age_limit and want_pages are
-used. Nr_unused seems to be exactly what its name says.
+nr_dentry shows the total number of dentries allocated (active
+ unused). nr_unused shows the number of dentries that are not
+actively used, but are saved in the LRU list for future reuse.
 Age_limit is the age in seconds after which dcache entries
 can be reclaimed when memory is short and want_pages is
 nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
+nr_negative shows the number of unused dentries that are also
+negative dentries which do not mapped to actual files.
 ==============================================================
 dquot-max & dquot-nr:
diff --git a/Documentation/x86/resctrl_ui.txt b/Documentation/x86/resctrl_ui.txt
index e8e8d14d3c4e..c1f95b59e14d 100644
--- a/Documentation/x86/resctrl_ui.txt
+++ b/Documentation/x86/resctrl_ui.txt
@@ -9,7 +9,7 @@ Fenghua Yu <fenghua.yu@intel.com>
 Tony Luck <tony.luck@intel.com>
 Vikas Shivappa <vikas.shivappa@intel.com>
-This feature is enabled by the CONFIG_X86_RESCTRL and the x86 /proc/cpuinfo
+This feature is enabled by the CONFIG_X86_CPU_RESCTRL and the x86 /proc/cpuinfo
 flag bits:
 RDT (Resource Director Technology) Allocation - "rdt_a"
 CAT (Cache Allocation Technology) - "cat_l3", "cat_l2"
diff --git a/MAINTAINERS b/MAINTAINERS
index 51029a425dbe..8c68de3cfd80 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3052,8 +3052,8 @@ F:	include/linux/bcm963xx_nvram.h
 F:      include/linux/bcm963xx_tag.h
 BROADCOM BNX2 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
+M:      Rasesh Mody <rmody@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2.*
@@ -3072,9 +3072,9 @@ S:	Supported
 F:      drivers/scsi/bnx2i/
 BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-M:      Ariel Elior <ariel.elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
-M:      everest-linux-l2@cavium.com
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2x/
@@ -3249,9 +3249,9 @@ S:	Supported
 F:      drivers/scsi/bfa/
 BROCADE BNA 10 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
+M:      Rasesh Mody <rmody@marvell.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/brocade/bna/
@@ -3978,6 +3978,7 @@ F:	drivers/cpufreq/arm_big_little.c
 CPU POWER MONITORING SUBSYSTEM
 M:      Thomas Renninger <trenn@suse.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
 F:      tools/power/cpupower/
@@ -8258,6 +8259,7 @@ F:	include/uapi/linux/sunrpc/
 KERNEL SELFTEST FRAMEWORK
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-kselftest@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git
 Q:      https://patchwork.kernel.org/project/linux-kselftest/list/
@@ -10688,9 +10690,9 @@ S:	Maintained
 F:      drivers/net/netdevsim/*
 NETXEN (1/10) GbE SUPPORT
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Rahul Verma <rahul.verma@cavium.com>
+M:      Rahul Verma <rahulv@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/netxen/
@@ -12474,8 +12476,8 @@ S:	Supported
 F:      drivers/scsi/qedi/
 QLOGIC QL4xxx ETHERNET DRIVER
-M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
-M:      everest-linux-l2@cavium.com
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qed/
@@ -12483,8 +12485,8 @@ F:	include/linux/qed/
 F:      drivers/net/ethernet/qlogic/qede/
 QLOGIC QL4xxx RDMA DRIVER
-M:      Michal Kalderon <Michal.Kalderon@cavium.com>
+M:      Michal Kalderon <mkalderon@marvell.com>
-M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
 L:      linux-rdma@vger.kernel.org
 S:      Supported
 F:      drivers/infiniband/hw/qedr/
@@ -12504,7 +12506,7 @@ F:	Documentation/scsi/LICENSE.qla2xxx
 F:      drivers/scsi/qla2xxx/
 QLOGIC QLA3XXX NETWORK DRIVER
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      Documentation/networking/device_drivers/qlogic/LICENSE.qla3xxx
@@ -12518,16 +12520,16 @@ F:	Documentation/scsi/LICENSE.qla4xxx
 F:      drivers/scsi/qla4xxx/
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
-M:      Shahed Shaikh <Shahed.Shaikh@cavium.com>
+M:      Shahed Shaikh <shshaikh@marvell.com>
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlcnic/
 QLOGIC QLGE 10Gb ETHERNET DRIVER
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlge/
@@ -15841,6 +15843,7 @@ F:	drivers/usb/common/usb-otg-fsm.c
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/usbip_protocol.txt
@@ -16638,6 +16641,15 @@ S:	Maintained
 F:      drivers/platform/x86/
 F:      drivers/platform/olpc/
+X86 PLATFORM DRIVERS - ARCH
+R:      Darren Hart <dvhart@infradead.org>
+R:      Andy Shevchenko <andy@infradead.org>
+L:      platform-driver-x86@vger.kernel.org
+L:      x86@kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
+S:      Maintained
+F:      arch/x86/platform
 X86 VDSO
 M:      Andy Lutomirski <luto@kernel.org>
 L:      linux-kernel@vger.kernel.org
@@ -16670,6 +16682,24 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/tuner-xc2028.*
+XDP (eXpress Data Path)
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
+M:      David S. Miller <davem@davemloft.net>
+M:      Jakub Kicinski <jakub.kicinski@netronome.com>
+M:      Jesper Dangaard Brouer <hawk@kernel.org>
+M:      John Fastabend <john.fastabend@gmail.com>
+L:      netdev@vger.kernel.org
+L:      xdp-newbies@vger.kernel.org
+S:      Supported
+F:      net/core/xdp.c
+F:      include/net/xdp.h
+F:      kernel/bpf/devmap.c
+F:      kernel/bpf/cpumap.c
+F:      include/trace/events/xdp.h
+K:      xdp
+N:      xdp
 XDP SOCKETS (AF_XDP)
 M:      Björn Töpel <bjorn.topel@intel.com>
 M:      Magnus Karlsson <magnus.karlsson@intel.com>
diff --git a/Makefile b/Makefile
index f5b1d0d168e0..3142e67d03f1 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc5
 NAME = Shy Crocodile
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index feed50ce89fa..caa270261521 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -3,23 +3,19 @@ generic-y += bugs.h
 generic-y += compat.h
 generic-y += device.h
 generic-y += div64.h
-generic-y += dma-mapping.h
 generic-y += emergency-restart.h
 generic-y += extable.h
-generic-y += fb.h
 generic-y += ftrace.h
 generic-y += hardirq.h
 generic-y += hw_irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
-generic-y += kmap_types.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += msi.h
 generic-y += parport.h
-generic-y += pci.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += topology.h
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 49bfbd879caa..f1b86cef0905 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -216,6 +216,14 @@ struct bcr_fp_arcv2 {
 #endif
 };
+struct bcr_actionpoint {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int pad:21, min:1, num:2, ver:8;
+#else
+        unsigned int ver:8, num:2, min:1, pad:21;
+#endif
+};
 #include <soc/arc/timers.h>
 struct bcr_bpu_arcompact {
@@ -283,7 +291,7 @@ struct cpuinfo_arc_cache {
 };
 struct cpuinfo_arc_bpu {
-        unsigned int ver, full, num_cache, num_pred;
+        unsigned int ver, full, num_cache, num_pred, ret_stk;
 };
 struct cpuinfo_arc_ccm {
@@ -302,7 +310,7 @@ struct cpuinfo_arc {
        struct {
                unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
                             fpu_sp:1, fpu_dp:1, dual:1, dual_enb:1, pad2:4,
-                             debug:1, ap:1, smart:1, rtt:1, pad3:4,
+                             ap_num:4, ap_full:1, smart:1, rtt:1, pad3:1,
                             timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
        } extn;
        struct bcr_mpy extn_mpy;
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index ee9246184033..202b74c339f0 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)
 /*
 * __ffs: Similar to ffs, but zero based (0-31)
 */
-static inline __attribute__ ((const)) int __ffs(unsigned long word)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word)
 {
        if (!word)
                return word;
@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)
 /*
 * __ffs: Similar to ffs, but zero based (0-31)
 */
-static inline __attribute__ ((const)) int __ffs(unsigned long x)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x)
 {
-        int n;
+        unsigned long n;
        asm volatile(
        "       ffs.f   %0, %1          \n"  /* 0:31; 31(Z) if src 0 */
diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
index 9185541035cc..6958545390f0 100644
--- a/arch/arc/include/asm/perf_event.h
+++ b/arch/arc/include/asm/perf_event.h
@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = {
        /* counts condition */
        [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
-        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */
+        /* All jump instructions that are taken */
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak",
        [PERF_COUNT_ARC_BPOK]         = "bpok",   /* NP-NT, PT-T, PNT-NT */
 #ifdef CONFIG_ISA_ARCV2
        [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp",
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 8aec462d90fb..861a8aea51f9 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -1,15 +1,10 @@
-/*
+// SPDX-License-Identifier: GPL-2.0+
- * Linux performance counter support for ARC700 series
+//
- *
+// Linux performance counter support for ARC CPUs.
- * Copyright (C) 2013-2015 Synopsys, Inc. (www.synopsys.com)
+// This code is inspired by the perf support of various other architectures.
- *
+//
- * This code is inspired by the perf support of various other architectures.
+// Copyright (C) 2013-2018 Synopsys, Inc. (www.synopsys.com)
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
@@ -19,12 +14,31 @@
 #include <asm/arcregs.h>
 #include <asm/stacktrace.h>
+/* HW holds 8 symbols + one for null terminator */
+#define ARCPMU_EVENT_NAME_LEN   9
+enum arc_pmu_attr_groups {
+        ARCPMU_ATTR_GR_EVENTS,
+        ARCPMU_ATTR_GR_FORMATS,
+        ARCPMU_NR_ATTR_GR
+};
+struct arc_pmu_raw_event_entry {
+        char name[ARCPMU_EVENT_NAME_LEN];
+};
 struct arc_pmu {
        struct pmu      pmu;
        unsigned int    irq;
        int             n_counters;
+        int             n_events;
        u64             max_period;
        int             ev_hw_idx[PERF_COUNT_ARC_HW_MAX];
+        struct arc_pmu_raw_event_entry  *raw_entry;
+        struct attribute                **attrs;
+        struct perf_pmu_events_attr     *attr;
+        const struct attribute_group    *attr_groups[ARCPMU_NR_ATTR_GR + 1];
 };
 struct arc_pmu_cpu {
@@ -49,6 +63,7 @@ static int callchain_trace(unsigned int addr, void *data)
 {
        struct arc_callchain_trace *ctrl = data;
        struct perf_callchain_entry_ctx *entry = ctrl->perf_stuff;
        perf_callchain_store(entry, addr);
        if (ctrl->depth++ < 3)
@@ -57,8 +72,8 @@ static int callchain_trace(unsigned int addr, void *data)
        return -1;
 }
-void
+void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry,
-perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+                           struct pt_regs *regs)
 {
        struct arc_callchain_trace ctrl = {
                .depth = 0,
@@ -68,8 +83,8 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
        arc_unwind_core(NULL, regs, callchain_trace, &ctrl);
 }
-void
+void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
-perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+                         struct pt_regs *regs)
 {
        /*
         * User stack can't be unwound trivially with kernel dwarf unwinder
@@ -82,10 +97,10 @@ static struct arc_pmu *arc_pmu;
 static DEFINE_PER_CPU(struct arc_pmu_cpu, arc_pmu_cpu);
 /* read counter #idx; note that counter# != event# on ARC! */
-static uint64_t arc_pmu_read_counter(int idx)
+static u64 arc_pmu_read_counter(int idx)
 {
-        uint32_t tmp;
+        u32 tmp;
-        uint64_t result;
+        u64 result;
        /*
         * ARC supports making 'snapshots' of the counters, so we don't
@@ -94,7 +109,7 @@ static uint64_t arc_pmu_read_counter(int idx)
        write_aux_reg(ARC_REG_PCT_INDEX, idx);
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, tmp | ARC_REG_PCT_CONTROL_SN);
-        result = (uint64_t) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
+        result = (u64) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
        result |= read_aux_reg(ARC_REG_PCT_SNAPL);
        return result;
@@ -103,9 +118,9 @@ static uint64_t arc_pmu_read_counter(int idx)
 static void arc_perf_event_update(struct perf_event *event,
                                  struct hw_perf_event *hwc, int idx)
 {
-        uint64_t prev_raw_count = local64_read(&hwc->prev_count);
+        u64 prev_raw_count = local64_read(&hwc->prev_count);
-        uint64_t new_raw_count = arc_pmu_read_counter(idx);
+        u64 new_raw_count = arc_pmu_read_counter(idx);
-        int64_t delta = new_raw_count - prev_raw_count;
+        s64 delta = new_raw_count - prev_raw_count;
        /*
         * We aren't afraid of hwc->prev_count changing beneath our feet
@@ -155,7 +170,7 @@ static int arc_pmu_event_init(struct perf_event *event)
        int ret;
        if (!is_sampling_event(event)) {
-                hwc->sample_period  = arc_pmu->max_period;
+                hwc->sample_period = arc_pmu->max_period;
                hwc->last_period = hwc->sample_period;
                local64_set(&hwc->period_left, hwc->sample_period);
        }
@@ -192,6 +207,18 @@ static int arc_pmu_event_init(struct perf_event *event)
                pr_debug("init cache event with h/w %08x \'%s\'\n",
                         (int)hwc->config, arc_pmu_ev_hw_map[ret]);
                return 0;
+        case PERF_TYPE_RAW:
+                if (event->attr.config >= arc_pmu->n_events)
+                        return -ENOENT;
+                hwc->config |= event->attr.config;
+                pr_debug("init raw event with idx %lld \'%s\'\n",
+                         event->attr.config,
+                         arc_pmu->raw_entry[event->attr.config].name);
+                return 0;
        default:
                return -ENOENT;
        }
@@ -200,7 +227,7 @@ static int arc_pmu_event_init(struct perf_event *event)
 /* starts all counters */
 static void arc_pmu_enable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x1);
 }
@@ -208,7 +235,7 @@ static void arc_pmu_enable(struct pmu *pmu)
 /* stops all counters */
 static void arc_pmu_disable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x0);
 }
@@ -228,7 +255,7 @@ static int arc_pmu_event_set_period(struct perf_event *event)
                local64_set(&hwc->period_left, left);
                hwc->last_period = period;
                overflow = 1;
-        } else  if (unlikely(left <= 0)) {
+        } else if (unlikely(left <= 0)) {
                /* left underflowed by less than period. */
                left += period;
                local64_set(&hwc->period_left, left);
@@ -246,8 +273,8 @@ static int arc_pmu_event_set_period(struct perf_event *event)
        write_aux_reg(ARC_REG_PCT_INDEX, idx);
        /* Write value */
-        write_aux_reg(ARC_REG_PCT_COUNTL, (u32)value);
+        write_aux_reg(ARC_REG_PCT_COUNTL, lower_32_bits(value));
-        write_aux_reg(ARC_REG_PCT_COUNTH, (value >> 32));
+        write_aux_reg(ARC_REG_PCT_COUNTH, upper_32_bits(value));
        perf_event_update_userpage(event);
@@ -277,7 +304,7 @@ static void arc_pmu_start(struct perf_event *event, int flags)
        /* Enable interrupt for this counter */
        if (is_sampling_event(event))
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
        /* enable ARC pmu here */
        write_aux_reg(ARC_REG_PCT_INDEX, idx);          /* counter # */
@@ -295,9 +322,9 @@ static void arc_pmu_stop(struct perf_event *event, int flags)
                 * Reset interrupt flag by writing of 1. This is required
                 * to make sure pending interrupt was not left.
                 */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~(1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~BIT(idx));
        }
        if (!(event->hw.state & PERF_HES_STOPPED)) {
@@ -349,9 +376,10 @@ static int arc_pmu_add(struct perf_event *event, int flags)
        if (is_sampling_event(event)) {
                /* Mimic full counter overflow as other arches do */
-                write_aux_reg(ARC_REG_PCT_INT_CNTL, (u32)arc_pmu->max_period);
+                write_aux_reg(ARC_REG_PCT_INT_CNTL,
+                              lower_32_bits(arc_pmu->max_period));
                write_aux_reg(ARC_REG_PCT_INT_CNTH,
-                              (arc_pmu->max_period >> 32));
+                              upper_32_bits(arc_pmu->max_period));
        }
        write_aux_reg(ARC_REG_PCT_CONFIG, 0);
@@ -392,7 +420,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                idx = __ffs(active_ints);
                /* Reset interrupt flag by writing of 1 */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
                /*
                 * On reset of "interrupt active" bit corresponding
@@ -400,7 +428,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                 * Now we need to re-enable interrupt for the counter.
                 */
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
                event = pmu_cpu->act_counter[idx];
                hwc = &event->hw;
@@ -414,7 +442,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                                arc_pmu_stop(event, 0);
                }
-                active_ints &= ~(1U << idx);
+                active_ints &= ~BIT(idx);
        } while (active_ints);
 done:
@@ -441,19 +469,108 @@ static void arc_cpu_pmu_irq_init(void *data)
        write_aux_reg(ARC_REG_PCT_INT_ACT, 0xffffffff);
 }
+/* Event field occupies the bottom 15 bits of our config field */
+PMU_FORMAT_ATTR(event, "config:0-14");
+static struct attribute *arc_pmu_format_attrs[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+static struct attribute_group arc_pmu_format_attr_gr = {
+        .name = "format",
+        .attrs = arc_pmu_format_attrs,
+};
+static ssize_t arc_pmu_events_sysfs_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *page)
+{
+        struct perf_pmu_events_attr *pmu_attr;
+        pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
+        return sprintf(page, "event=0x%04llx\n", pmu_attr->id);
+}
+/*
+ * We don't add attrs here as we don't have pre-defined list of perf events.
+ * We will generate and add attrs dynamically in probe() after we read HW
+ * configuration.
+ */
+static struct attribute_group arc_pmu_events_attr_gr = {
+        .name = "events",
+};
+static void arc_pmu_add_raw_event_attr(int j, char *str)
+{
+        memmove(arc_pmu->raw_entry[j].name, str, ARCPMU_EVENT_NAME_LEN - 1);
+        arc_pmu->attr[j].attr.attr.name = arc_pmu->raw_entry[j].name;
+        arc_pmu->attr[j].attr.attr.mode = VERIFY_OCTAL_PERMISSIONS(0444);
+        arc_pmu->attr[j].attr.show = arc_pmu_events_sysfs_show;
+        arc_pmu->attr[j].id = j;
+        arc_pmu->attrs[j] = &(arc_pmu->attr[j].attr.attr);
+}
+static int arc_pmu_raw_alloc(struct device *dev)
+{
+        arc_pmu->attr = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attr), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attr)
+                return -ENOMEM;
+        arc_pmu->attrs = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attrs), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attrs)
+                return -ENOMEM;
+        arc_pmu->raw_entry = devm_kmalloc_array(dev, arc_pmu->n_events,
+                sizeof(*arc_pmu->raw_entry), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->raw_entry)
+                return -ENOMEM;
+        return 0;
+}
+static inline bool event_in_hw_event_map(int i, char *name)
+{
+        if (!arc_pmu_ev_hw_map[i])
+                return false;
+        if (!strlen(arc_pmu_ev_hw_map[i]))
+                return false;
+        if (strcmp(arc_pmu_ev_hw_map[i], name))
+                return false;
+        return true;
+}
+static void arc_pmu_map_hw_event(int j, char *str)
+{
+        int i;
+        /* See if HW condition has been mapped to a perf event_id */
+        for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                if (event_in_hw_event_map(i, str)) {
+                        pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
+                                 i, str, j);
+                        arc_pmu->ev_hw_idx[i] = j;
+                }
+        }
+}
 static int arc_pmu_device_probe(struct platform_device *pdev)
 {
        struct arc_reg_pct_build pct_bcr;
        struct arc_reg_cc_build cc_bcr;
-        int i, j, has_interrupts;
+        int i, has_interrupts;
        int counter_size;       /* in bits */
        union cc_name {
                struct {
-                        uint32_t word0, word1;
+                        u32 word0, word1;
                        char sentinel;
                } indiv;
-                char str[9];
+                char str[ARCPMU_EVENT_NAME_LEN];
        } cc_name;
@@ -463,15 +580,22 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                return -ENODEV;
        }
        BUILD_BUG_ON(ARC_PERF_MAX_COUNTERS > 32);
-        BUG_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS);
+        if (WARN_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS))
+                return -EINVAL;
        READ_BCR(ARC_REG_CC_BUILD, cc_bcr);
-        BUG_ON(!cc_bcr.v); /* Counters exist but No countable conditions ? */
+        if (WARN(!cc_bcr.v, "Counters exist but No countable conditions?"))
+                return -EINVAL;
        arc_pmu = devm_kzalloc(&pdev->dev, sizeof(struct arc_pmu), GFP_KERNEL);
        if (!arc_pmu)
                return -ENOMEM;
+        arc_pmu->n_events = cc_bcr.c;
+        if (arc_pmu_raw_alloc(&pdev->dev))
+                return -ENOMEM;
        has_interrupts = is_isa_arcv2() ? pct_bcr.i : 0;
        arc_pmu->n_counters = pct_bcr.c;
@@ -481,30 +605,26 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
        pr_info("ARC perf\t: %d counters (%d bits), %d conditions%s\n",
                arc_pmu->n_counters, counter_size, cc_bcr.c,
-                has_interrupts ? ", [overflow IRQ support]":"");
+                has_interrupts ? ", [overflow IRQ support]" : "");
-        cc_name.str[8] = 0;
+        cc_name.str[ARCPMU_EVENT_NAME_LEN - 1] = 0;
        for (i = 0; i < PERF_COUNT_ARC_HW_MAX; i++)
                arc_pmu->ev_hw_idx[i] = -1;
        /* loop thru all available h/w condition indexes */
-        for (j = 0; j < cc_bcr.c; j++) {
+        for (i = 0; i < cc_bcr.c; i++) {
-                write_aux_reg(ARC_REG_CC_INDEX, j);
+                write_aux_reg(ARC_REG_CC_INDEX, i);
                cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
                cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
-                /* See if it has been mapped to a perf event_id */
+                arc_pmu_map_hw_event(i, cc_name.str);
-                for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                arc_pmu_add_raw_event_attr(i, cc_name.str);
-                        if (arc_pmu_ev_hw_map[i] &&
-                            !strcmp(arc_pmu_ev_hw_map[i], cc_name.str) &&
-                            strlen(arc_pmu_ev_hw_map[i])) {
-                                pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
-                                         i, cc_name.str, j);
-                                arc_pmu->ev_hw_idx[i] = j;
-                        }
-                }
        }
+        arc_pmu_events_attr_gr.attrs = arc_pmu->attrs;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_EVENTS] = &arc_pmu_events_attr_gr;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_FORMATS] = &arc_pmu_format_attr_gr;
        arc_pmu->pmu = (struct pmu) {
                .pmu_enable     = arc_pmu_enable,
                .pmu_disable    = arc_pmu_disable,
@@ -514,6 +634,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                .start          = arc_pmu_start,
                .stop           = arc_pmu_stop,
                .read           = arc_pmu_read,
+                .attr_groups    = arc_pmu->attr_groups,
        };
        if (has_interrupts) {
@@ -535,17 +656,19 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
        } else
                arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
-        return perf_pmu_register(&arc_pmu->pmu, pdev->name, PERF_TYPE_RAW);
+        /*
+         * perf parser doesn't really like '-' symbol in events name, so let's
+         * use '_' in arc pct name as it goes to kernel PMU event prefix.
+         */
+        return perf_pmu_register(&arc_pmu->pmu, "arc_pct", PERF_TYPE_RAW);
 }
-#ifdef CONFIG_OF
 static const struct of_device_id arc_pmu_match[] = {
        { .compatible = "snps,arc700-pct" },
        { .compatible = "snps,archs-pct" },
        {},
 };
 MODULE_DEVICE_TABLE(of, arc_pmu_match);
-#endif
 static struct platform_driver arc_pmu_driver = {
        .driver = {
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 2e018b8c2e19..feb90093e6b1 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -123,6 +123,7 @@ static void read_arc_build_cfg_regs(void)
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
        const struct id_to_str *tbl;
        struct bcr_isa_arcv2 isa;
+        struct bcr_actionpoint ap;
        FIX_PTR(cpu);
@@ -195,6 +196,7 @@ static void read_arc_build_cfg_regs(void)
                cpu->bpu.full = bpu.ft;
                cpu->bpu.num_cache = 256 << bpu.bce;
                cpu->bpu.num_pred = 2048 << bpu.pte;
+                cpu->bpu.ret_stk = 4 << bpu.rse;
                if (cpu->core.family >= 0x54) {
                        unsigned int exec_ctrl;
@@ -207,8 +209,11 @@ static void read_arc_build_cfg_regs(void)
                }
        }
-        READ_BCR(ARC_REG_AP_BCR, bcr);
+        READ_BCR(ARC_REG_AP_BCR, ap);
-        cpu->extn.ap = bcr.ver ? 1 : 0;
+        if (ap.ver) {
+                cpu->extn.ap_num = 2 << ap.num;
+                cpu->extn.ap_full = !!ap.min;
+        }
        READ_BCR(ARC_REG_SMART_BCR, bcr);
        cpu->extn.smart = bcr.ver ? 1 : 0;
@@ -216,8 +221,6 @@ static void read_arc_build_cfg_regs(void)
        READ_BCR(ARC_REG_RTT_BCR, bcr);
        cpu->extn.rtt = bcr.ver ? 1 : 0;
-        cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
        READ_BCR(ARC_REG_ISA_CFG_BCR, isa);
        /* some hacks for lack of feature BCR info in old ARC700 cores */
@@ -299,10 +302,10 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
        if (cpu->bpu.ver)
                n += scnprintf(buf + n, len - n,
-                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d",
+                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d Return stk: %d",
                              IS_AVAIL1(cpu->bpu.full, "full"),
                              IS_AVAIL1(!cpu->bpu.full, "partial"),
-                              cpu->bpu.num_cache, cpu->bpu.num_pred);
+                              cpu->bpu.num_cache, cpu->bpu.num_pred, cpu->bpu.ret_stk);
        if (is_isa_arcv2()) {
                struct bcr_lpb lpb;
@@ -336,11 +339,17 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                               IS_AVAIL1(cpu->extn.fpu_sp, "SP "),
                               IS_AVAIL1(cpu->extn.fpu_dp, "DP "));
-        if (cpu->extn.debug)
+        if (cpu->extn.ap_num | cpu->extn.smart | cpu->extn.rtt) {
-                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s%s\n",
+                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s",
-                               IS_AVAIL1(cpu->extn.ap, "ActionPoint "),
                               IS_AVAIL1(cpu->extn.smart, "smaRT "),
                               IS_AVAIL1(cpu->extn.rtt, "RTT "));
+                if (cpu->extn.ap_num) {
+                        n += scnprintf(buf + n, len - n, "ActionPoint %d/%s",
+                                       cpu->extn.ap_num,
+                                       cpu->extn.ap_full ? "full":"min");
+                }
+                n += scnprintf(buf + n, len - n, "\n");
+        }
        if (cpu->dccm.sz || cpu->iccm.sz)
                n += scnprintf(buf + n, len - n, "Extn [CCM]\t: DCCM @ %x, %d KB / ICCM: @ %x, %d KB\n",
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index e8d9fb452346..215f515442e0 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -18,6 +18,8 @@
 #include <asm/arcregs.h>
 #include <asm/irqflags.h>
+#define ARC_PATH_MAX    256
 /*
 * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
 *   -Prints 3 regs per line and a CR.
@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs)
        print_reg_file(&(cregs->r13), 13);
 }
-static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+static void print_task_path_n_nm(struct task_struct *tsk)
 {
        char *path_nm = NULL;
        struct mm_struct *mm;
        struct file *exe_file;
+        char buf[ARC_PATH_MAX];
        mm = get_task_mm(tsk);
        if (!mm)
@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
        mmput(mm);
        if (exe_file) {
-                path_nm = file_path(exe_file, buf, 255);
+                path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1);
                fput(exe_file);
        }
@@ -80,10 +83,9 @@ done:
        pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?");
 }
-static void show_faulting_vma(unsigned long address, char *buf)
+static void show_faulting_vma(unsigned long address)
 {
        struct vm_area_struct *vma;
-        char *nm = buf;
        struct mm_struct *active_mm = current->active_mm;
        /* can't use print_vma_addr() yet as it doesn't check for
@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf)
         * if the container VMA is not found
         */
        if (vma && (vma->vm_start <= address)) {
+                char buf[ARC_PATH_MAX];
+                char *nm = "?";
                if (vma->vm_file) {
-                        nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
+                        nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1);
                        if (IS_ERR(nm))
                                nm = "?";
                }
@@ -173,13 +178,14 @@ void show_regs(struct pt_regs *regs)
 {
        struct task_struct *tsk = current;
        struct callee_regs *cregs;
-        char *buf;
-        buf = (char *)__get_free_page(GFP_KERNEL);
+        /*
-        if (!buf)
+         * generic code calls us with preemption disabled, but some calls
-                return;
+         * here could sleep, so re-enable to avoid lockdep splat
+         */
+        preempt_enable();
-        print_task_path_n_nm(tsk, buf);
+        print_task_path_n_nm(tsk);
        show_regs_print_info(KERN_INFO);
        show_ecr_verbose(regs);
@@ -189,7 +195,7 @@ void show_regs(struct pt_regs *regs)
                (void *)regs->blink, (void *)regs->ret);
        if (user_mode(regs))
-                show_faulting_vma(regs->ret, buf); /* faulting code, not data */
+                show_faulting_vma(regs->ret); /* faulting code, not data */
        pr_info("[STAT32]: 0x%08lx", regs->status32);
@@ -222,7 +228,7 @@ void show_regs(struct pt_regs *regs)
        if (cregs)
                show_callee_regs(cregs);
-        free_page((unsigned long)buf);
+        preempt_disable();
 }
 void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
diff --git a/arch/arc/lib/memset-archs.S b/arch/arc/lib/memset-archs.S
index 62ad4bcb841a..f230bb7092fd 100644
--- a/arch/arc/lib/memset-archs.S
+++ b/arch/arc/lib/memset-archs.S
@@ -7,11 +7,39 @@
 */
 #include <linux/linkage.h>
+#include <asm/cache.h>
-#undef PREALLOC_NOT_AVAIL
+/*
+ * The memset implementation below is optimized to use prefetchw and prealloc
+ * instruction in case of CPU with 64B L1 data cache line (L1_CACHE_SHIFT == 6)
+ * If you want to implement optimized memset for other possible L1 data cache
+ * line lengths (32B and 128B) you should rewrite code carefully checking
+ * we don't call any prefetchw/prealloc instruction for L1 cache lines which
+ * don't belongs to memset area.
+ */
+#if L1_CACHE_SHIFT == 6
+.macro PREALLOC_INSTR   reg, off
+        prealloc        [\reg, \off]
+.endm
+.macro PREFETCHW_INSTR  reg, off
+        prefetchw       [\reg, \off]
+.endm
+#else
+.macro PREALLOC_INSTR
+.endm
+.macro PREFETCHW_INSTR
+.endm
+#endif
 ENTRY_CFI(memset)
-        prefetchw [r0]          ; Prefetch the write location
+        PREFETCHW_INSTR r0, 0   ; Prefetch the first write location
        mov.f   0, r2
 ;;; if size is zero
        jz.d    [blink]
@@ -48,11 +76,8 @@ ENTRY_CFI(memset)
        lpnz    @.Lset64bytes
        ;; LOOP START
-#ifdef PREALLOC_NOT_AVAIL
+        PREALLOC_INSTR  r3, 64  ; alloc next line w/o fetching
-        prefetchw [r3, 64]      ;Prefetch the next write location
-#else
-        prealloc  [r3, 64]
-#endif
 #ifdef CONFIG_ARC_HAS_LL64
        std.ab  r4, [r3, 8]
        std.ab  r4, [r3, 8]
@@ -85,7 +110,6 @@ ENTRY_CFI(memset)
        lsr.f   lp_count, r2, 5 ;Last remaining  max 124 bytes
        lpnz    .Lset32bytes
        ;; LOOP START
-        prefetchw   [r3, 32]    ;Prefetch the next write location
 #ifdef CONFIG_ARC_HAS_LL64
        std.ab  r4, [r3, 8]
        std.ab  r4, [r3, 8]
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index a1d723197084..8df1638259f3 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -141,12 +141,17 @@ good_area:
         */
        fault = handle_mm_fault(vma, address, flags);
-        /* If Pagefault was interrupted by SIGKILL, exit page fault "early" */
        if (fatal_signal_pending(current)) {
-                if ((fault & VM_FAULT_ERROR) && !(fault & VM_FAULT_RETRY))
-                        up_read(&mm->mmap_sem);
+                /*
-                if (user_mode(regs))
+                 * if fault retry, mmap_sem already relinquished by core mm
+                 * so OK to return to user mode (with signal handled first)
+                 */
+                if (fault & VM_FAULT_RETRY) {
+                        if (!user_mode(regs))
+                                goto no_context;
                        return;
+                }
        }
        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
index 43bf4c3a1290..e1ab2d7f1d64 100644
--- a/arch/arc/mm/init.c
+++ b/arch/arc/mm/init.c
@@ -119,7 +119,8 @@ void __init setup_arch_memory(void)
         */
        memblock_add_node(low_mem_start, low_mem_sz, 0);
-        memblock_reserve(low_mem_start, __pa(_end) - low_mem_start);
+        memblock_reserve(CONFIG_LINUX_LINK_BASE,
+                         __pa(_end) - CONFIG_LINUX_LINK_BASE);
 #ifdef CONFIG_BLK_DEV_INITRD
        if (phys_initrd_size) {
diff --git a/arch/arm/include/asm/xen/page-coherent.h b/arch/arm/include/asm/xen/page-coherent.h
index b3ef061d8b74..2c403e7c782d 100644
--- a/arch/arm/include/asm/xen/page-coherent.h
+++ b/arch/arm/include/asm/xen/page-coherent.h
@@ -1 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
+#define _ASM_ARM_XEN_PAGE_COHERENT_H
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
+{
+        if (dev && dev->archdata.dev_dma_ops)
+                return dev->archdata.dev_dma_ops;
+        return get_arch_dma_ops(NULL);
+}
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
+}
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can span across
+         * multiple Xen pages, it's not possible for it to contain a
+         * mix of local and foreign Xen pages. So if the first xen_pfn
+         * == mfn the page is local otherwise it's a foreign page
+         * grant-mapped in dom0. If the page is local we can safely
+         * call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (local)
+                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->unmap_page)
+                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
+        } else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
+                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
+                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 318394ed5c7a..95a11d5b3587 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
        } else /* remote PCI bus */
                base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
-        return base + (where & 0xffc) + (devfn << 12);
+        return base + where + (devfn << 12);
 }
 static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
        u32 mask = (0x1ull << (size * 8)) - 1;
        int shift = (where % 4) * 8;
-        ret = pci_generic_config_read32(bus, devfn, where, size, val);
+        ret = pci_generic_config_read(bus, devfn, where, size, val);
        if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
            (where & 0xffc) == PCI_CLASS_REVISION)
diff --git a/arch/arm64/include/asm/device.h b/arch/arm64/include/asm/device.h
index 3dd3d664c5c5..4658c937e173 100644
--- a/arch/arm64/include/asm/device.h
+++ b/arch/arm64/include/asm/device.h
@@ -20,9 +20,6 @@ struct dev_archdata {
 #ifdef CONFIG_IOMMU_API
        void *iommu;                    /* private IOMMU data */
 #endif
-#ifdef CONFIG_XEN
-        const struct dma_map_ops *dev_dma_ops;
-#endif
 };
 struct pdev_archdata {
diff --git a/arch/arm64/include/asm/xen/page-coherent.h b/arch/arm64/include/asm/xen/page-coherent.h
index b3ef061d8b74..d88e56b90b93 100644
--- a/arch/arm64/include/asm/xen/page-coherent.h
+++ b/arch/arm64/include/asm/xen/page-coherent.h
@@ -1 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM64_XEN_PAGE_COHERENT_H
+#define _ASM_ARM64_XEN_PAGE_COHERENT_H
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return dma_direct_alloc(hwdev, size, dma_handle, flags, attrs);
+}
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        dma_direct_free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_cpu(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_device(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+        if (local)
+                dma_direct_map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn))
+                dma_direct_unmap_page(hwdev, handle, size, dir, attrs);
+        else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+#endif /* _ASM_ARM64_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 29cdc99688f3..9859e1178e6b 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -299,8 +299,10 @@ int swsusp_arch_suspend(void)
                dcache_clean_range(__idmap_text_start, __idmap_text_end);
                /* Clean kvm setup code to PoC? */
-                if (el2_reset_needed())
+                if (el2_reset_needed()) {
                        dcache_clean_range(__hyp_idmap_text_start, __hyp_idmap_text_end);
+                        dcache_clean_range(__hyp_text_start, __hyp_text_end);
+                }
                /* make the crash dump kernel image protected again */
                crash_post_resume();
diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S
index e1261fbaa374..17f325ba831e 100644
--- a/arch/arm64/kernel/hyp-stub.S
+++ b/arch/arm64/kernel/hyp-stub.S
@@ -28,6 +28,8 @@
 #include <asm/virt.h>
        .text
+        .pushsection    .hyp.text, "ax"
        .align 11
 ENTRY(__hyp_stub_vectors)
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index ba6b41790fcd..b09b6f75f759 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -88,6 +88,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
         * we end up running with module randomization disabled.
         */
        module_alloc_base = (u64)_etext - MODULES_VSIZE;
+        __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
        /*
         * Try to map the FDT early. If this fails, we simply bail,
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 2a5b338b2542..f17afb99890c 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
            addr < (unsigned long)__entry_text_end) ||
            (addr >= (unsigned long)__idmap_text_start &&
            addr < (unsigned long)__idmap_text_end) ||
+            (addr >= (unsigned long)__hyp_text_start &&
+            addr < (unsigned long)__hyp_text_end) ||
            !!search_exception_tables(addr))
                return true;
        if (!is_kernel_in_hyp_mode()) {
-                if ((addr >= (unsigned long)__hyp_text_start &&
+                if ((addr >= (unsigned long)__hyp_idmap_text_start &&
-                    addr < (unsigned long)__hyp_text_end) ||
-                    (addr >= (unsigned long)__hyp_idmap_text_start &&
                    addr < (unsigned long)__hyp_idmap_text_end))
                        return true;
        }
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index fb0908456a1f..78c0a72f822c 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -466,9 +466,7 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
        __iommu_setup_dma_ops(dev, dma_base, size, iommu);
 #ifdef CONFIG_XEN
-        if (xen_initial_domain()) {
+        if (xen_initial_domain())
-                dev->archdata.dev_dma_ops = dev->dma_ops;
                dev->dma_ops = xen_dma_ops;
-        }
 #endif
 }
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index 30695a868107..5c9073bace83 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -33,7 +33,11 @@ void sync_icache_aliases(void *kaddr, unsigned long len)
                __clean_dcache_area_pou(kaddr, len);
                __flush_icache_all();
        } else {
-                flush_icache_range(addr, addr + len);
+                /*
+                 * Don't issue kick_all_cpus_sync() after I-cache invalidation
+                 * for user mappings.
+                 */
+                __flush_icache_range(addr, addr + len);
        }
 }
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 33a2c94fed0d..63b4a1705182 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += pgalloc.h
 generic-y += preempt.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += tlbflush.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index cd400d353d18..961c1dc064e1 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -40,6 +40,7 @@ generic-y += preempt.h
 generic-y += scatterlist.h
 generic-y += sections.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += spinlock.h
 generic-y += timex.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 47c4da3d64a4..b25fd42aa0f4 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += rwsem.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/hexagon/include/uapi/asm/Kbuild b/arch/hexagon/include/uapi/asm/Kbuild
index 61d955c1747a..c1b06dcf6cf8 100644
--- a/arch/hexagon/include/uapi/asm/Kbuild
+++ b/arch/hexagon/include/uapi/asm/Kbuild
@@ -1,4 +1,3 @@
 include include/uapi/asm-generic/Kbuild.asm
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 9f1dd26903e3..95f8f631c4df 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -20,6 +20,7 @@ generic-y += mm-arch-hooks.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += sections.h
+generic-y += shmparam.h
 generic-y += spinlock.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index b8b3525271fa..960bf1e4be53 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -2,4 +2,3 @@ include include/uapi/asm-generic/Kbuild.asm
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 9c7d1d25bf3d..791cc8d54d0a 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += parport.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += syscalls.h
 generic-y += topology.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 28823e3db825..97823ec46e97 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -2,5 +2,4 @@ include include/uapi/asm-generic/Kbuild.asm
 generated-y += unistd_32.h
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index eb87cd8327c8..1f04844b6b82 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -34,6 +34,7 @@ generic-y += qrwlock_types.h
 generic-y += qrwlock.h
 generic-y += sections.h
 generic-y += segment.h
+generic-y += shmparam.h
 generic-y += string.h
 generic-y += switch_to.h
 generic-y += topology.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index feeeaa60697c..515fc3cc9687 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -103,7 +103,7 @@ choice
        prompt "Base ISA"
        default ARCH_RV64I
        help
-          This selects the base ISA that this kernel will traget and must match
+          This selects the base ISA that this kernel will target and must match
          the target platform.
 config ARCH_RV32I
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index f399659d3b8d..2fd3461e50ab 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -13,8 +13,6 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_SMP=y
-CONFIG_PCI=y
-CONFIG_PCIE_XILINX=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
@@ -28,6 +26,10 @@ CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 CONFIG_NETLINK_DIAG=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_XILINX=y
 CONFIG_DEVTMPFS=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_VIRTIO_BLK=y
@@ -63,7 +65,6 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_UAS=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_SIFIVE_PLIC=y
-CONFIG_RAS=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
@@ -77,5 +78,6 @@ CONFIG_NFS_V4_1=y
 CONFIG_NFS_V4_2=y
 CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_DEV_VIRTIO=y
 CONFIG_PRINTK_TIME=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
index 06cfbb3aacbb..2a546a52f02a 100644
--- a/arch/riscv/include/asm/page.h
+++ b/arch/riscv/include/asm/page.h
@@ -80,7 +80,7 @@ typedef struct page *pgtable_t;
 #define __pgd(x)        ((pgd_t) { (x) })
 #define __pgprot(x)     ((pgprot_t) { (x) })
-#ifdef CONFIG_64BITS
+#ifdef CONFIG_64BIT
 #define PTE_FMT "%016lx"
 #else
 #define PTE_FMT "%08lx"
diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
index 0531f49af5c3..ce70bceb8872 100644
--- a/arch/riscv/include/asm/processor.h
+++ b/arch/riscv/include/asm/processor.h
@@ -22,7 +22,7 @@
 * This decides where the kernel will search for a free chunk of vm
 * space during mmap's.
 */
-#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE >> 1)
+#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE / 3)
 #define STACK_TOP               TASK_SIZE
 #define STACK_TOP_MAX           STACK_TOP
diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
index 6a92a2fe198e..dac98348c6a3 100644
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@@ -39,6 +39,7 @@ void asm_offsets(void)
        OFFSET(TASK_STACK, task_struct, stack);
        OFFSET(TASK_TI, task_struct, thread_info);
        OFFSET(TASK_TI_FLAGS, task_struct, thread_info.flags);
+        OFFSET(TASK_TI_PREEMPT_COUNT, task_struct, thread_info.preempt_count);
        OFFSET(TASK_TI_KERNEL_SP, task_struct, thread_info.kernel_sp);
        OFFSET(TASK_TI_USER_SP, task_struct, thread_info.user_sp);
        OFFSET(TASK_TI_CPU, task_struct, thread_info.cpu);
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 355166f57205..fd9b57c8b4ce 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -144,6 +144,10 @@ _save_context:
        REG_L x2,  PT_SP(sp)
        .endm
+#if !IS_ENABLED(CONFIG_PREEMPT)
+.set resume_kernel, restore_all
+#endif
 ENTRY(handle_exception)
        SAVE_ALL
@@ -228,7 +232,7 @@ ret_from_exception:
        REG_L s0, PT_SSTATUS(sp)
        csrc sstatus, SR_SIE
        andi s0, s0, SR_SPP
-        bnez s0, restore_all
+        bnez s0, resume_kernel
 resume_userspace:
        /* Interrupts must be disabled here so flags are checked atomically */
@@ -250,6 +254,18 @@ restore_all:
        RESTORE_ALL
        sret
+#if IS_ENABLED(CONFIG_PREEMPT)
+resume_kernel:
+        REG_L s0, TASK_TI_PREEMPT_COUNT(tp)
+        bnez s0, restore_all
+need_resched:
+        REG_L s0, TASK_TI_FLAGS(tp)
+        andi s0, s0, _TIF_NEED_RESCHED
+        beqz s0, restore_all
+        call preempt_schedule_irq
+        j need_resched
+#endif
 work_pending:
        /* Enter slow path for supplementary processing */
        la ra, ret_from_exception
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 6e079e94b638..77564310235f 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -181,7 +181,7 @@ static void __init setup_bootmem(void)
        BUG_ON(mem_size == 0);
        set_max_mapnr(PFN_DOWN(mem_size));
-        max_low_pfn = memblock_end_of_DRAM();
+        max_low_pfn = PFN_DOWN(memblock_end_of_DRAM());
 #ifdef CONFIG_BLK_DEV_INITRD
        setup_initrd();
diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c
index fc185ecabb0a..18cda0e8cf94 100644
--- a/arch/riscv/kernel/smpboot.c
+++ b/arch/riscv/kernel/smpboot.c
@@ -57,15 +57,12 @@ void __init setup_smp(void)
        while ((dn = of_find_node_by_type(dn, "cpu"))) {
                hart = riscv_of_processor_hartid(dn);
-                if (hart < 0) {
+                if (hart < 0)
-                        of_node_put(dn);
                        continue;
-                }
                if (hart == cpuid_to_hartid_map(0)) {
                        BUG_ON(found_boot_cpu);
                        found_boot_cpu = 1;
-                        of_node_put(dn);
                        continue;
                }
@@ -73,7 +70,6 @@ void __init setup_smp(void)
                set_cpu_possible(cpuid, true);
                set_cpu_present(cpuid, true);
                cpuid++;
-                of_node_put(dn);
        }
        BUG_ON(!found_boot_cpu);
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 1d9bfaff60bc..658ebf645f42 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -28,7 +28,8 @@ static void __init zone_sizes_init(void)
        unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
 #ifdef CONFIG_ZONE_DMA32
-        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, max_low_pfn));
+        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G,
+                        (unsigned long) PFN_PHYS(max_low_pfn)));
 #endif
        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index ccbb53e22024..8d04e6f3f796 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -25,7 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
        atomic_set(&mm->context.flush_count, 0);
        mm->context.gmap_asce = 0;
        mm->context.flush_mm = 0;
-        mm->context.compat_mm = 0;
+        mm->context.compat_mm = test_thread_flag(TIF_31BIT);
 #ifdef CONFIG_PGSTE
        mm->context.alloc_pgste = page_table_allocate_pgste ||
                test_thread_flag(TIF_PGSTE) ||
@@ -90,8 +90,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
        int cpu = smp_processor_id();
-        if (prev == next)
-                return;
        S390_lowcore.user_asce = next->context.asce;
        cpumask_set_cpu(cpu, &next->context.cpu_attach_mask);
        /* Clear previous user-ASCE from CR1 and CR7 */
@@ -103,7 +101,8 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                __ctl_load(S390_lowcore.vdso_asce, 7, 7);
                clear_cpu_flag(CIF_ASCE_SECONDARY);
        }
-        cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
+        if (prev != next)
+                cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
 }
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index af5c2b3f7065..a8c7789b246b 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -63,10 +63,10 @@ static noinline __init void detect_machine_type(void)
        if (stsi(vmms, 3, 2, 2) || !vmms->count)
                return;
-        /* Running under KVM? If not we assume z/VM */
+        /* Detect known hypervisors */
        if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
                S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
-        else
+        else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4))
                S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
 }
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 72dd23ef771b..7ed90a759135 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -1006,6 +1006,8 @@ void __init setup_arch(char **cmdline_p)
                pr_info("Linux is running under KVM in 64-bit mode\n");
        else if (MACHINE_IS_LPAR)
                pr_info("Linux is running natively in 64-bit mode\n");
+        else
+                pr_info("Linux is running as a guest in 64-bit mode\n");
        /* Have one command line that is parsed and saved in /proc/cmdline */
        /* boot_command_line has been already set up in early.c */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index f82b3d3c36e2..b198ece2aad6 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -381,8 +381,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data)
 */
 void smp_call_ipl_cpu(void (*func)(void *), void *data)
 {
+        struct lowcore *lc = pcpu_devices->lowcore;
+        if (pcpu_devices[0].address == stap())
+                lc = &S390_lowcore;
        pcpu_delegate(&pcpu_devices[0], func, data,
-                      pcpu_devices->lowcore->nodat_stack);
+                      lc->nodat_stack);
 }
 int smp_find_processor_id(u16 address)
@@ -1166,7 +1171,11 @@ static ssize_t __ref rescan_store(struct device *dev,
 {
        int rc;
+        rc = lock_device_hotplug_sysfs();
+        if (rc)
+                return rc;
        rc = smp_rescan_cpus();
+        unlock_device_hotplug();
        return rc ? rc : count;
 }
 static DEVICE_ATTR_WO(rescan);
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index ebe748a9f472..4ff354887db4 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -224,10 +224,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
        vdso_pages = vdso64_pages;
 #ifdef CONFIG_COMPAT
-        if (is_compat_task()) {
+        mm->context.compat_mm = is_compat_task();
+        if (mm->context.compat_mm)
                vdso_pages = vdso32_pages;
-                mm->context.compat_mm = 1;
-        }
 #endif
        /*
         * vDSO has a problem and was disabled, just don't "enable" it for
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index 1372553dc0a9..1d1544b6ca74 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -28,6 +28,7 @@ generic-y += preempt.h
 generic-y += sections.h
 generic-y += segment.h
 generic-y += serial.h
+generic-y += shmparam.h
 generic-y += sizes.h
 generic-y += syscalls.h
 generic-y += topology.h
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 6c6f6301012e..0febf1a07c30 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,5 +1,4 @@
 include include/uapi/asm-generic/Kbuild.asm
 generic-y += kvm_para.h
-generic-y += shmparam.h
 generic-y += ucontext.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 4b4a7f32b68e..68261430fe6e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -198,7 +198,7 @@ config X86
        select IRQ_FORCED_THREADING
        select NEED_SG_DMA_LENGTH
        select PCI_DOMAINS                      if PCI
-        select PCI_LOCKLESS_CONFIG
+        select PCI_LOCKLESS_CONFIG              if PCI
        select PERF_EVENTS
        select RTC_LIB
        select RTC_MC146818_LIB
@@ -446,12 +446,12 @@ config RETPOLINE
          branches. Requires a compiler with -mindirect-branch=thunk-extern
          support for full protection. The kernel may run slower.
-config X86_RESCTRL
+config X86_CPU_RESCTRL
-        bool "Resource Control support"
+        bool "x86 CPU resource control support"
        depends on X86 && (CPU_SUP_INTEL || CPU_SUP_AMD)
        select KERNFS
        help
-          Enable Resource Control support.
+          Enable x86 CPU resource control support.
          Provide support for the allocation and monitoring of system resources
          usage by the CPU.
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 64037895b085..f105ae8651c9 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -600,6 +600,14 @@ ENTRY(trampoline_32bit_src)
        leal    TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax
        movl    %eax, %cr3
 3:
+        /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
+        pushl   %ecx
+        movl    $MSR_EFER, %ecx
+        rdmsr
+        btsl    $_EFER_LME, %eax
+        wrmsr
+        popl    %ecx
        /* Enable PAE and LA57 (if required) paging modes */
        movl    $X86_CR4_PAE, %eax
        cmpl    $0, %edx
diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h
index 91f75638f6e6..6ff7e81b5628 100644
--- a/arch/x86/boot/compressed/pgtable.h
+++ b/arch/x86/boot/compressed/pgtable.h
@@ -6,7 +6,7 @@
 #define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0
 #define TRAMPOLINE_32BIT_CODE_OFFSET    PAGE_SIZE
-#define TRAMPOLINE_32BIT_CODE_SIZE      0x60
+#define TRAMPOLINE_32BIT_CODE_SIZE      0x70
 #define TRAMPOLINE_32BIT_STACK_END      TRAMPOLINE_32BIT_SIZE
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 8eaf8952c408..39913770a44d 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -361,7 +361,8 @@ ENTRY(entry_INT80_compat)
        /* Need to switch before accessing the thread stack. */
        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
-        movq    %rsp, %rdi
+        /* In the Xen PV case we already run on the thread stack. */
+        ALTERNATIVE "movq %rsp, %rdi", "jmp .Lint80_keep_stack", X86_FEATURE_XENPV
        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
        pushq   6*8(%rdi)               /* regs->ss */
@@ -370,8 +371,9 @@ ENTRY(entry_INT80_compat)
        pushq   3*8(%rdi)               /* regs->cs */
        pushq   2*8(%rdi)               /* regs->ip */
        pushq   1*8(%rdi)               /* regs->orig_ax */
        pushq   (%rdi)                  /* pt_regs->di */
+.Lint80_keep_stack:
        pushq   %rsi                    /* pt_regs->si */
        xorl    %esi, %esi              /* nospec   si */
        pushq   %rdx                    /* pt_regs->dx */
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index 0dd6b0f4000e..d9a9993af882 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -6,7 +6,7 @@
 * "Big Core" Processors (Branded as Core, Xeon, etc...)
 *
 * The "_X" parts are generally the EP and EX Xeons, or the
- * "Extreme" ones, like Broadwell-E.
+ * "Extreme" ones, like Broadwell-E, or Atom microserver.
 *
 * While adding a new CPUID for a new microarchitecture, add a new
 * group to keep logically sorted out in chronological order. Within
@@ -71,6 +71,7 @@
 #define INTEL_FAM6_ATOM_GOLDMONT        0x5C /* Apollo Lake */
 #define INTEL_FAM6_ATOM_GOLDMONT_X      0x5F /* Denverton */
 #define INTEL_FAM6_ATOM_GOLDMONT_PLUS   0x7A /* Gemini Lake */
+#define INTEL_FAM6_ATOM_TREMONT_X       0x86 /* Jacobsville */
 /* Xeon Phi */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 0ca50611e8ce..19d18fae6ec6 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -178,6 +178,10 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
 void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
+/*
+ * Init a new mm.  Used on mm copies, like at fork()
+ * and on mm's that are brand-new, like at execve().
+ */
 static inline int init_new_context(struct task_struct *tsk,
                                   struct mm_struct *mm)
 {
@@ -228,8 +232,22 @@ do {						\
 } while (0)
 #endif
+static inline void arch_dup_pkeys(struct mm_struct *oldmm,
+                                  struct mm_struct *mm)
+{
+#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+        if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
+                return;
+        /* Duplicate the oldmm pkey state in mm: */
+        mm->context.pkey_allocation_map = oldmm->context.pkey_allocation_map;
+        mm->context.execute_only_pkey   = oldmm->context.execute_only_pkey;
+#endif
+}
 static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 {
+        arch_dup_pkeys(oldmm, mm);
        paravirt_arch_dup_mmap(oldmm, mm);
        return ldt_dup_context(oldmm, mm);
 }
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 8f657286d599..0ce558a8150d 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -7,7 +7,11 @@
 #endif
 #ifdef CONFIG_KASAN
+#ifdef CONFIG_KASAN_EXTRA
+#define KASAN_STACK_ORDER 2
+#else
 #define KASAN_STACK_ORDER 1
+#endif
 #else
 #define KASAN_STACK_ORDER 0
 #endif
diff --git a/arch/x86/include/asm/resctrl_sched.h b/arch/x86/include/asm/resctrl_sched.h
index 40ebddde6ac2..f6b7fe2833cc 100644
--- a/arch/x86/include/asm/resctrl_sched.h
+++ b/arch/x86/include/asm/resctrl_sched.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_X86_RESCTRL_SCHED_H
 #define _ASM_X86_RESCTRL_SCHED_H
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
 #include <linux/sched.h>
 #include <linux/jump_label.h>
@@ -88,6 +88,6 @@ static inline void resctrl_sched_in(void)
 static inline void resctrl_sched_in(void) {}
-#endif /* CONFIG_X86_RESCTRL */
+#endif /* CONFIG_X86_CPU_RESCTRL */
 #endif /* _ASM_X86_RESCTRL_SCHED_H */
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index b6fa0869f7aa..cfd24f9f7614 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -39,7 +39,7 @@ obj-$(CONFIG_CPU_SUP_UMC_32)		+= umc.o
 obj-$(CONFIG_X86_MCE)                   += mce/
 obj-$(CONFIG_MTRR)                      += mtrr/
 obj-$(CONFIG_MICROCODE)                 += microcode/
-obj-$(CONFIG_X86_RESCTRL)               += resctrl/
+obj-$(CONFIG_X86_CPU_RESCTRL)           += resctrl/
 obj-$(CONFIG_X86_LOCAL_APIC)            += perfctr-watchdog.o
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 1de0f4170178..01874d54f4fd 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -71,7 +71,7 @@ void __init check_bugs(void)
         * identify_boot_cpu() initialized SMT support information, let the
         * core code know.
         */
-        cpu_smt_check_topology_early();
+        cpu_smt_check_topology();
        if (!IS_ENABLED(CONFIG_SMP)) {
                pr_info("CPU: ");
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
        if (!p) {
                return ret;
        } else {
-                if (boot_cpu_data.microcode == p->patch_id)
+                if (boot_cpu_data.microcode >= p->patch_id)
                        return ret;
                ret = UCODE_NEW;
diff --git a/arch/x86/kernel/cpu/resctrl/Makefile b/arch/x86/kernel/cpu/resctrl/Makefile
index 1cabe6fd8e11..4a06c37b9cf1 100644
--- a/arch/x86/kernel/cpu/resctrl/Makefile
+++ b/arch/x86/kernel/cpu/resctrl/Makefile
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
-obj-$(CONFIG_X86_RESCTRL)       += core.o rdtgroup.o monitor.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += core.o rdtgroup.o monitor.o
-obj-$(CONFIG_X86_RESCTRL)       += ctrlmondata.o pseudo_lock.o
+obj-$(CONFIG_X86_CPU_RESCTRL)   += ctrlmondata.o pseudo_lock.o
 CFLAGS_pseudo_lock.o = -I$(src)
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index c8b07d8ea5a2..17ffc869cab8 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -470,6 +470,7 @@ int crash_load_segments(struct kimage *image)
        kbuf.memsz = kbuf.bufsz;
        kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
+        kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
        ret = kexec_add_buffer(&kbuf);
        if (ret) {
                vfree((void *)image->arch.elf_headers);
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b0acb22e5a46..dfd3aca82c61 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -21,10 +21,6 @@
 #define HPET_MASK                       CLOCKSOURCE_MASK(32)
-/* FSEC = 10^-15
-   NSEC = 10^-9 */
-#define FSEC_PER_NSEC                   1000000L
 #define HPET_DEV_USED_BIT               2
 #define HPET_DEV_USED                   (1 << HPET_DEV_USED_BIT)
 #define HPET_DEV_VALID                  0x8
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 278cd07228dd..53917a3ebf94 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
        struct efi_info *current_ei = &boot_params.efi_info;
        struct efi_info *ei = &params->efi_info;
+        if (!efi_enabled(EFI_RUNTIME_SERVICES))
+                return 0;
        if (!current_ei->efi_memmap_size)
                return 0;
@@ -434,6 +437,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
        kbuf.memsz = PAGE_ALIGN(header->init_size);
        kbuf.buf_align = header->kernel_alignment;
        kbuf.buf_min = MIN_KERNEL_LOAD_ADDR;
+        kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
        ret = kexec_add_buffer(&kbuf);
        if (ret)
                goto out_free_params;
@@ -448,6 +452,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
                kbuf.bufsz = kbuf.memsz = initrd_len;
                kbuf.buf_align = PAGE_SIZE;
                kbuf.buf_min = MIN_INITRD_LOAD_ADDR;
+                kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
                ret = kexec_add_buffer(&kbuf);
                if (ret)
                        goto out_free_params;
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index ba4bfb7f6a36..5c93a65ee1e5 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -457,6 +457,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
 #else
        u64 ipi_bitmap = 0;
 #endif
+        long ret;
        if (cpumask_empty(mask))
                return;
@@ -482,8 +483,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
                } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) {
                        max = apic_id < max ? max : apic_id;
                } else {
-                        kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                        ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                                (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                        WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
                        min = max = apic_id;
                        ipi_bitmap = 0;
                }
@@ -491,8 +493,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
        }
        if (ipi_bitmap) {
-                kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                        (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
        }
        local_irq_restore(flags);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index e9f777bfed40..3fae23834069 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -297,15 +297,16 @@ static int __init tsc_setup(char *str)
 __setup("tsc=", tsc_setup);
-#define MAX_RETRIES     5
+#define MAX_RETRIES             5
-#define SMI_TRESHOLD    50000
+#define TSC_DEFAULT_THRESHOLD   0x20000
 /*
- * Read TSC and the reference counters. Take care of SMI disturbance
+ * Read TSC and the reference counters. Take care of any disturbances
 */
 static u64 tsc_read_refs(u64 *p, int hpet)
 {
        u64 t1, t2;
+        u64 thresh = tsc_khz ? tsc_khz >> 5 : TSC_DEFAULT_THRESHOLD;
        int i;
        for (i = 0; i < MAX_RETRIES; i++) {
@@ -315,7 +316,7 @@ static u64 tsc_read_refs(u64 *p, int hpet)
                else
                        *p = acpi_pm_read_early();
                t2 = get_cycles();
-                if ((t2 - t1) < SMI_TRESHOLD)
+                if ((t2 - t1) < thresh)
                        return t2;
        }
        return ULLONG_MAX;
@@ -703,15 +704,15 @@ static unsigned long pit_hpet_ptimer_calibrate_cpu(void)
         * zero. In each wait loop iteration we read the TSC and check
         * the delta to the previous read. We keep track of the min
         * and max values of that delta. The delta is mostly defined
-         * by the IO time of the PIT access, so we can detect when a
+         * by the IO time of the PIT access, so we can detect when
-         * SMI/SMM disturbance happened between the two reads. If the
+         * any disturbance happened between the two reads. If the
         * maximum time is significantly larger than the minimum time,
         * then we discard the result and have another try.
         *
         * 2) Reference counter. If available we use the HPET or the
         * PMTIMER as a reference to check the sanity of that value.
         * We use separate TSC readouts and check inside of the
-         * reference read for a SMI/SMM disturbance. We dicard
+         * reference read for any possible disturbance. We dicard
         * disturbed values here as well. We do that around the PIT
         * calibration delay loop as we have to wait for a certain
         * amount of time anyway.
@@ -744,7 +745,7 @@ static unsigned long pit_hpet_ptimer_calibrate_cpu(void)
                if (ref1 == ref2)
                        continue;
-                /* Check, whether the sampling was disturbed by an SMI */
+                /* Check, whether the sampling was disturbed */
                if (tsc1 == ULLONG_MAX || tsc2 == ULLONG_MAX)
                        continue;
@@ -1268,7 +1269,7 @@ static DECLARE_DELAYED_WORK(tsc_irqwork, tsc_refine_calibration_work);
 */
 static void tsc_refine_calibration_work(struct work_struct *work)
 {
-        static u64 tsc_start = -1, ref_start;
+        static u64 tsc_start = ULLONG_MAX, ref_start;
        static int hpet;
        u64 tsc_stop, ref_stop, delta;
        unsigned long freq;
@@ -1283,14 +1284,15 @@ static void tsc_refine_calibration_work(struct work_struct *work)
         * delayed the first time we expire. So set the workqueue
         * again once we know timers are working.
         */
-        if (tsc_start == -1) {
+        if (tsc_start == ULLONG_MAX) {
+restart:
                /*
                 * Only set hpet once, to avoid mixing hardware
                 * if the hpet becomes enabled later.
                 */
                hpet = is_hpet_enabled();
-                schedule_delayed_work(&tsc_irqwork, HZ);
                tsc_start = tsc_read_refs(&ref_start, hpet);
+                schedule_delayed_work(&tsc_irqwork, HZ);
                return;
        }
@@ -1300,9 +1302,9 @@ static void tsc_refine_calibration_work(struct work_struct *work)
        if (ref_start == ref_stop)
                goto out;
-        /* Check, whether the sampling was disturbed by an SMI */
+        /* Check, whether the sampling was disturbed */
-        if (tsc_start == ULLONG_MAX || tsc_stop == ULLONG_MAX)
+        if (tsc_stop == ULLONG_MAX)
-                goto out;
+                goto restart;
        delta = tsc_stop - tsc_start;
        delta *= 1000000LL;
diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile
index 69b3a7c30013..31ecf7a76d5a 100644
--- a/arch/x86/kvm/Makefile
+++ b/arch/x86/kvm/Makefile
@@ -2,10 +2,6 @@
 ccflags-y += -Iarch/x86/kvm
-CFLAGS_x86.o := -I.
-CFLAGS_svm.o := -I.
-CFLAGS_vmx.o := -I.
 KVM := ../../../virt/kvm
 kvm-y                   += $(KVM)/kvm_main.o $(KVM)/coalesced_mmio.o \
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index c90a5352d158..89d20ed1d2e8 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1636,7 +1636,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
                ret = kvm_hvcall_signal_event(vcpu, fast, ingpa);
                if (ret != HV_STATUS_INVALID_PORT_ID)
                        break;
-                /* maybe userspace knows this conn_id: fall through */
+                /* fall through - maybe userspace knows this conn_id. */
        case HVCALL_POST_MESSAGE:
                /* don't bother userspace if it has no way to handle it */
                if (unlikely(rep || !vcpu_to_synic(vcpu)->active)) {
@@ -1832,7 +1832,6 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                        ent->eax |= HV_X64_MSR_VP_INDEX_AVAILABLE;
                        ent->eax |= HV_X64_MSR_RESET_AVAILABLE;
                        ent->eax |= HV_MSR_REFERENCE_TSC_AVAILABLE;
-                        ent->eax |= HV_X64_MSR_GUEST_IDLE_AVAILABLE;
                        ent->eax |= HV_X64_ACCESS_FREQUENCY_MSRS;
                        ent->eax |= HV_X64_ACCESS_REENLIGHTENMENT;
@@ -1848,11 +1847,11 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                case HYPERV_CPUID_ENLIGHTMENT_INFO:
                        ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED;
                        ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED;
-                        ent->eax |= HV_X64_SYSTEM_RESET_RECOMMENDED;
                        ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
                        ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED;
                        ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED;
-                        ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
+                        if (evmcs_ver)
+                                ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
                        /*
                         * Default number of spinlock retry attempts, matches
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9f089e2e09d0..4b6c2da7265c 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1035,6 +1035,7 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
        switch (delivery_mode) {
        case APIC_DM_LOWEST:
                vcpu->arch.apic_arb_prio++;
+                /* fall through */
        case APIC_DM_FIXED:
                if (unlikely(trig_mode && !level))
                        break;
@@ -1874,6 +1875,7 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
        case APIC_LVT0:
                apic_manage_nmi_watchdog(apic, val);
+                /* fall through */
        case APIC_LVTTHMR:
        case APIC_LVTPC:
        case APIC_LVT1:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index ce770b446238..da9c42349b1f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4371,6 +4371,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
                        rsvd_bits(maxphyaddr, 51);
                rsvd_check->rsvd_bits_mask[1][4] =
                        rsvd_check->rsvd_bits_mask[0][4];
+                /* fall through */
        case PT64_ROOT_4LEVEL:
                rsvd_check->rsvd_bits_mask[0][3] = exb_bit_rsvd |
                        nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index a157ca5b6869..f13a3a24d360 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3414,6 +3414,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
        kvm_mmu_reset_context(&svm->vcpu);
        kvm_mmu_load(&svm->vcpu);
+        /*
+         * Drop what we picked up for L2 via svm_complete_interrupts() so it
+         * doesn't end up in L1.
+         */
+        svm->vcpu.arch.nmi_injected = false;
+        kvm_clear_exception_queue(&svm->vcpu);
+        kvm_clear_interrupt_queue(&svm->vcpu);
        return 0;
 }
@@ -4395,7 +4403,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
        case MSR_IA32_APICBASE:
                if (kvm_vcpu_apicv_active(vcpu))
                        avic_update_vapic_bar(to_svm(vcpu), data);
-                /* Follow through */
+                /* Fall through */
        default:
                return kvm_set_msr_common(vcpu, msr);
        }
@@ -4504,28 +4512,19 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                break;
        case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
-                int i;
-                struct kvm_vcpu *vcpu;
-                struct kvm *kvm = svm->vcpu.kvm;
                struct kvm_lapic *apic = svm->vcpu.arch.apic;
                /*
-                 * At this point, we expect that the AVIC HW has already
+                 * Update ICR high and low, then emulate sending IPI,
-                 * set the appropriate IRR bits on the valid target
+                 * which is handled when writing APIC_ICR.
-                 * vcpus. So, we just need to kick the appropriate vcpu.
                 */
-                kvm_for_each_vcpu(i, vcpu, kvm) {
+                kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
-                        bool m = kvm_apic_match_dest(vcpu, apic,
+                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
-                                                     icrl & KVM_APIC_SHORT_MASK,
-                                                     GET_APIC_DEST_FIELD(icrh),
-                                                     icrl & KVM_APIC_DEST_MASK);
-                        if (m && !avic_vcpu_is_running(vcpu))
-                                kvm_vcpu_wake_up(vcpu);
-                }
                break;
        }
        case AVIC_IPI_FAILURE_INVALID_TARGET:
+                WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n",
+                          index, svm->vcpu.vcpu_id, icrh, icrl);
                break;
        case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
                WARN_ONCE(1, "Invalid backing page\n");
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 705f40ae2532..6432d08c7de7 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -1465,7 +1465,7 @@ TRACE_EVENT(kvm_hv_send_ipi_ex,
 #endif /* _TRACE_KVM_H */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH arch/x86/kvm
+#define TRACE_INCLUDE_PATH ../../arch/x86/kvm
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
diff --git a/arch/x86/kvm/vmx/evmcs.c b/arch/x86/kvm/vmx/evmcs.c
index 95bc2247478d..5466c6d85cf3 100644
--- a/arch/x86/kvm/vmx/evmcs.c
+++ b/arch/x86/kvm/vmx/evmcs.c
@@ -332,16 +332,17 @@ int nested_enable_evmcs(struct kvm_vcpu *vcpu,
                        uint16_t *vmcs_version)
 {
        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool evmcs_already_enabled = vmx->nested.enlightened_vmcs_enabled;
+        vmx->nested.enlightened_vmcs_enabled = true;
        if (vmcs_version)
                *vmcs_version = nested_get_evmcs_version(vcpu);
        /* We don't support disabling the feature for simplicity. */
-        if (vmx->nested.enlightened_vmcs_enabled)
+        if (evmcs_already_enabled)
                return 0;
-        vmx->nested.enlightened_vmcs_enabled = true;
        vmx->nested.msrs.pinbased_ctls_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
        vmx->nested.msrs.entry_ctls_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
        vmx->nested.msrs.exit_ctls_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 2616bd2c7f2c..d8ea4ebd79e7 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -55,7 +55,7 @@ static u16 shadow_read_write_fields[] = {
 static int max_shadow_read_write_fields =
        ARRAY_SIZE(shadow_read_write_fields);
-void init_vmcs_shadow_fields(void)
+static void init_vmcs_shadow_fields(void)
 {
        int i, j;
@@ -211,6 +211,7 @@ static void free_nested(struct kvm_vcpu *vcpu)
        if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
                return;
+        hrtimer_cancel(&vmx->nested.preemption_timer);
        vmx->nested.vmxon = false;
        vmx->nested.smm.vmxon = false;
        free_vpid(vmx->nested.vpid02);
@@ -4140,11 +4141,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
        if (r < 0)
                goto out_vmcs02;
-        vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
        if (!vmx->nested.cached_vmcs12)
                goto out_cached_vmcs12;
-        vmx->nested.cached_shadow_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
        if (!vmx->nested.cached_shadow_vmcs12)
                goto out_cached_shadow_vmcs12;
@@ -5263,13 +5264,17 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
                        copy_shadow_to_vmcs12(vmx);
        }
-        if (copy_to_user(user_kvm_nested_state->data, vmcs12, sizeof(*vmcs12)))
+        /*
+         * Copy over the full allocated size of vmcs12 rather than just the size
+         * of the struct.
+         */
+        if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
                return -EFAULT;
        if (nested_cpu_has_shadow_vmcs(vmcs12) &&
            vmcs12->vmcs_link_pointer != -1ull) {
                if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
-                                 get_shadow_vmcs12(vcpu), sizeof(*vmcs12)))
+                                 get_shadow_vmcs12(vcpu), VMCS12_SIZE))
                        return -EFAULT;
        }
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index f6915f10e584..95d618045001 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -26,6 +26,7 @@
 #include <linux/mod_devicetable.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/sched/smt.h>
 #include <linux/slab.h>
 #include <linux/tboot.h>
 #include <linux/trace_events.h>
@@ -423,7 +424,7 @@ static void check_ept_pointer_match(struct kvm *kvm)
        to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
 }
-int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
+static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
                void *data)
 {
        struct kvm_tlb_range *range = data;
@@ -1773,7 +1774,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                if (!msr_info->host_initiated &&
                    !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
                        return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
        default:
                msr = find_msr_entry(vmx, msr_info->index);
                if (msr) {
@@ -2014,7 +2015,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                /* Check reserved bit, higher 32 bits should be zero */
                if ((data >> 32) != 0)
                        return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
        default:
                msr = find_msr_entry(vmx, msr_index);
                if (msr) {
@@ -2344,7 +2345,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
                case 37: /* AAT100 */
                case 44: /* BC86,AAY89,BD102 */
                case 46: /* BA97 */
-                        _vmexit_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+                        _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
                        _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
                        pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
                                        "does not work properly. Using workaround\n");
@@ -6362,72 +6363,9 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
        vmx->loaded_vmcs->hv_timer_armed = false;
 }
-static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
 {
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        unsigned long evmcs_rsp;
-        unsigned long cr3, cr4, evmcs_rsp;
-        /* Record the guest's net vcpu time for enforced NMI injections. */
-        if (unlikely(!enable_vnmi &&
-                     vmx->loaded_vmcs->soft_vnmi_blocked))
-                vmx->loaded_vmcs->entry_time = ktime_get();
-        /* Don't enter VMX if guest state is invalid, let the exit handler
-           start emulation until we arrive back to a valid state */
-        if (vmx->emulation_required)
-                return;
-        if (vmx->ple_window_dirty) {
-                vmx->ple_window_dirty = false;
-                vmcs_write32(PLE_WINDOW, vmx->ple_window);
-        }
-        if (vmx->nested.need_vmcs12_sync)
-                nested_sync_from_vmcs12(vcpu);
-        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
-        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
-        cr3 = __get_current_cr3_fast();
-        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
-                vmcs_writel(HOST_CR3, cr3);
-                vmx->loaded_vmcs->host_state.cr3 = cr3;
-        }
-        cr4 = cr4_read_shadow();
-        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
-                vmcs_writel(HOST_CR4, cr4);
-                vmx->loaded_vmcs->host_state.cr4 = cr4;
-        }
-        /* When single-stepping over STI and MOV SS, we must clear the
-         * corresponding interruptibility bits in the guest state. Otherwise
-         * vmentry fails as it then expects bit 14 (BS) in pending debug
-         * exceptions being set, but that's not correct for the guest debugging
-         * case. */
-        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
-                vmx_set_interrupt_shadow(vcpu, 0);
-        if (static_cpu_has(X86_FEATURE_PKU) &&
-            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
-            vcpu->arch.pkru != vmx->host_pkru)
-                __write_pkru(vcpu->arch.pkru);
-        pt_guest_enter(vmx);
-        atomic_switch_perf_msrs(vmx);
-        vmx_update_hv_timer(vcpu);
-        /*
-         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
-         * it's non-zero. Since vmentry is serialising on affected CPUs, there
-         * is no need to worry about the conditional branch over the wrmsr
-         * being speculatively taken.
-         */
-        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
        vmx->__launched = vmx->loaded_vmcs->launched;
@@ -6567,6 +6505,77 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
                , "eax", "ebx", "edi"
 #endif
              );
+}
+STACK_FRAME_NON_STANDARD(__vmx_vcpu_run);
+static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        unsigned long cr3, cr4;
+        /* Record the guest's net vcpu time for enforced NMI injections. */
+        if (unlikely(!enable_vnmi &&
+                     vmx->loaded_vmcs->soft_vnmi_blocked))
+                vmx->loaded_vmcs->entry_time = ktime_get();
+        /* Don't enter VMX if guest state is invalid, let the exit handler
+           start emulation until we arrive back to a valid state */
+        if (vmx->emulation_required)
+                return;
+        if (vmx->ple_window_dirty) {
+                vmx->ple_window_dirty = false;
+                vmcs_write32(PLE_WINDOW, vmx->ple_window);
+        }
+        if (vmx->nested.need_vmcs12_sync)
+                nested_sync_from_vmcs12(vcpu);
+        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
+        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+        cr3 = __get_current_cr3_fast();
+        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
+                vmcs_writel(HOST_CR3, cr3);
+                vmx->loaded_vmcs->host_state.cr3 = cr3;
+        }
+        cr4 = cr4_read_shadow();
+        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
+                vmcs_writel(HOST_CR4, cr4);
+                vmx->loaded_vmcs->host_state.cr4 = cr4;
+        }
+        /* When single-stepping over STI and MOV SS, we must clear the
+         * corresponding interruptibility bits in the guest state. Otherwise
+         * vmentry fails as it then expects bit 14 (BS) in pending debug
+         * exceptions being set, but that's not correct for the guest debugging
+         * case. */
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+                vmx_set_interrupt_shadow(vcpu, 0);
+        if (static_cpu_has(X86_FEATURE_PKU) &&
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+            vcpu->arch.pkru != vmx->host_pkru)
+                __write_pkru(vcpu->arch.pkru);
+        pt_guest_enter(vmx);
+        atomic_switch_perf_msrs(vmx);
+        vmx_update_hv_timer(vcpu);
+        /*
+         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+         * it's non-zero. Since vmentry is serialising on affected CPUs, there
+         * is no need to worry about the conditional branch over the wrmsr
+         * being speculatively taken.
+         */
+        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+        __vmx_vcpu_run(vcpu, vmx);
        /*
         * We do not use IBRS in the kernel. If this vCPU has used the
@@ -6648,7 +6657,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
        vmx_recover_nmi_blocking(vmx);
        vmx_complete_interrupts(vmx);
 }
-STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
 static struct kvm *vmx_vm_alloc(void)
 {
@@ -6816,7 +6824,7 @@ static int vmx_vm_init(struct kvm *kvm)
                         * Warn upon starting the first VM in a potentially
                         * insecure environment.
                         */
-                        if (cpu_smt_control == CPU_SMT_ENABLED)
+                        if (sched_smt_active())
                                pr_warn_once(L1TF_MSG_SMT);
                        if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
                                pr_warn_once(L1TF_MSG_L1D);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02c8e095a239..e67ecf25e690 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3834,6 +3834,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
        case KVM_CAP_HYPERV_SYNIC2:
                if (cap->args[0])
                        return -EINVAL;
+                /* fall through */
        case KVM_CAP_HYPERV_SYNIC:
                if (!irqchip_in_kernel(vcpu->kvm))
                        return -EINVAL;
@@ -5114,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
 {
        u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
+        /*
+         * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+         * is returned, but our callers are not ready for that and they blindly
+         * call kvm_inject_page_fault.  Ensure that they at least do not leak
+         * uninitialized kernel stack memory into cr2 and error code.
+         */
+        memset(exception, 0, sizeof(*exception));
        return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
                                          exception);
 }
@@ -6480,8 +6489,7 @@ restart:
                toggle_interruptibility(vcpu, ctxt->interruptibility);
                vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE &&
+                if (r == EMULATE_DONE && ctxt->tf)
-                    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
                        kvm_vcpu_do_singlestep(vcpu, &r);
                if (!ctxt->have_exception ||
                    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
@@ -7093,10 +7101,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
        case KVM_HC_CLOCK_PAIRING:
                ret = kvm_pv_clock_pairing(vcpu, a0, a1);
                break;
+#endif
        case KVM_HC_SEND_IPI:
                ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
                break;
-#endif
        default:
                ret = -KVM_ENOSYS;
                break;
@@ -7937,6 +7945,7 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
                vcpu->arch.pv.pv_unhalted = false;
                vcpu->arch.mp_state =
                        KVM_MP_STATE_RUNNABLE;
+                /* fall through */
        case KVM_MP_STATE_RUNNABLE:
                vcpu->arch.apf.halted = false;
                break;
diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
index 66894675f3c8..df50451d94ef 100644
--- a/arch/x86/lib/iomem.c
+++ b/arch/x86/lib/iomem.c
@@ -2,8 +2,11 @@
 #include <linux/module.h>
 #include <linux/io.h>
+#define movs(type,to,from) \
+        asm volatile("movs" type:"=&D" (to), "=&S" (from):"0" (to), "1" (from):"memory")
 /* Originally from i386/string.h */
-static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
+static __always_inline void rep_movs(void *to, const void *from, size_t n)
 {
        unsigned long d0, d1, d2;
        asm volatile("rep ; movsl\n\t"
@@ -21,13 +24,37 @@ static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
 void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
-        __iomem_memcpy(to, (const void *)from, n);
+        if (unlikely(!n))
+                return;
+        /* Align any unaligned source IO */
+        if (unlikely(1 & (unsigned long)from)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)from)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs(to, (const void *)from, n);
 }
 EXPORT_SYMBOL(memcpy_fromio);
 void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 {
-        __iomem_memcpy((void *)to, (const void *) from, n);
+        if (unlikely(!n))
+                return;
+        /* Align any unaligned destination IO */
+        if (unlikely(1 & (unsigned long)to)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)to)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs((void *)to, (const void *) from, n);
 }
 EXPORT_SYMBOL(memcpy_toio);
diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c
index 79778ab200e4..a53665116458 100644
--- a/arch/x86/lib/kaslr.c
+++ b/arch/x86/lib/kaslr.c
@@ -36,8 +36,8 @@ static inline u16 i8254(void)
        u16 status, timer;
        do {
-                outb(I8254_PORT_CONTROL,
+                outb(I8254_CMD_READBACK | I8254_SELECT_COUNTER0,
-                     I8254_CMD_READBACK | I8254_SELECT_COUNTER0);
+                     I8254_PORT_CONTROL);
                status = inb(I8254_PORT_COUNTER0);
                timer  = inb(I8254_PORT_COUNTER0);
                timer |= inb(I8254_PORT_COUNTER0) << 8;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2ff25ad33233..9d5c75f02295 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -595,7 +595,7 @@ static void show_ldttss(const struct desc_ptr *gdt, const char *name, u16 index)
                return;
        }
-        addr = desc.base0 | (desc.base1 << 16) | (desc.base2 << 24);
+        addr = desc.base0 | (desc.base1 << 16) | ((unsigned long)desc.base2 << 24);
 #ifdef CONFIG_X86_64
        addr |= ((u64)desc.base3 << 32);
 #endif
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index a19ef1a416ff..4aa9b1480866 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -158,8 +158,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
        pmd = pmd_offset(pud, ppd->vaddr);
        if (pmd_none(*pmd)) {
                pte = ppd->pgtable_area;
-                memset(pte, 0, sizeof(pte) * PTRS_PER_PTE);
+                memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE);
-                ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE;
+                ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE;
                set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte)));
        }
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 20a0756f27ef..ce91682770cb 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -164,7 +164,7 @@ config XTENSA_FAKE_NMI
          If unsure, say N.
 config XTENSA_UNALIGNED_USER
-        bool "Unaligned memory access in use space"
+        bool "Unaligned memory access in user space"
        help
          The Xtensa architecture currently does not handle unaligned
          memory accesses in hardware but through an exception handler.
@@ -451,7 +451,7 @@ config USE_OF
        help
          Include support for flattened device tree machine descriptions.
-config BUILTIN_DTB
+config BUILTIN_DTB_SOURCE
        string "DTB to build into the kernel image"
        depends on OF
diff --git a/arch/xtensa/boot/dts/Makefile b/arch/xtensa/boot/dts/Makefile
index f8052ba5aea8..0b8d00cdae7c 100644
--- a/arch/xtensa/boot/dts/Makefile
+++ b/arch/xtensa/boot/dts/Makefile
@@ -7,9 +7,9 @@
 #
 #
-BUILTIN_DTB := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB)).dtb.o
+BUILTIN_DTB_SOURCE := $(patsubst "%",%,$(CONFIG_BUILTIN_DTB_SOURCE)).dtb.o
-ifneq ($(CONFIG_BUILTIN_DTB),"")
+ifneq ($(CONFIG_BUILTIN_DTB_SOURCE),"")
-obj-$(CONFIG_OF) += $(BUILTIN_DTB)
+obj-$(CONFIG_OF) += $(BUILTIN_DTB_SOURCE)
 endif
 # for CONFIG_OF_ALL_DTBS test
diff --git a/arch/xtensa/configs/audio_kc705_defconfig b/arch/xtensa/configs/audio_kc705_defconfig
index 2bf964df37ba..f378e56f9ce6 100644
--- a/arch/xtensa/configs/audio_kc705_defconfig
+++ b/arch/xtensa/configs/audio_kc705_defconfig
@@ -34,7 +34,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_PM=y
diff --git a/arch/xtensa/configs/cadence_csp_defconfig b/arch/xtensa/configs/cadence_csp_defconfig
index 3221b7053fa3..62f32a902568 100644
--- a/arch/xtensa/configs/cadence_csp_defconfig
+++ b/arch/xtensa/configs/cadence_csp_defconfig
@@ -38,7 +38,7 @@ CONFIG_HIGHMEM=y
 # CONFIG_PCI is not set
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="csp"
+CONFIG_BUILTIN_DTB_SOURCE="csp"
 # CONFIG_COMPACTION is not set
 CONFIG_XTFPGA_LCD=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
diff --git a/arch/xtensa/configs/generic_kc705_defconfig b/arch/xtensa/configs/generic_kc705_defconfig
index 985fa8546e4e..8bebe07f1060 100644
--- a/arch/xtensa/configs/generic_kc705_defconfig
+++ b/arch/xtensa/configs/generic_kc705_defconfig
@@ -33,7 +33,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=0x38000000@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705"
+CONFIG_BUILTIN_DTB_SOURCE="kc705"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/configs/nommu_kc705_defconfig b/arch/xtensa/configs/nommu_kc705_defconfig
index f3fc4f970ca8..933ab2adf434 100644
--- a/arch/xtensa/configs/nommu_kc705_defconfig
+++ b/arch/xtensa/configs/nommu_kc705_defconfig
@@ -39,7 +39,7 @@ CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0x9d050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=256M@0x60000000"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="kc705_nommu"
+CONFIG_BUILTIN_DTB_SOURCE="kc705_nommu"
 CONFIG_BINFMT_FLAT=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
index 11fed6c06a7c..e29c5b179a5b 100644
--- a/arch/xtensa/configs/smp_lx200_defconfig
+++ b/arch/xtensa/configs/smp_lx200_defconfig
@@ -33,11 +33,12 @@ CONFIG_SMP=y
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
 # CONFIG_PCI is not set
+CONFIG_VECTORS_OFFSET=0x00002000
 CONFIG_XTENSA_PLATFORM_XTFPGA=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
 CONFIG_USE_OF=y
-CONFIG_BUILTIN_DTB="lx200mx"
+CONFIG_BUILTIN_DTB_SOURCE="lx200mx"
 # CONFIG_COMPACTION is not set
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_NET=y
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index da08e75100ab..7f009719304e 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -276,12 +276,13 @@ should_never_return:
        movi    a2, cpu_start_ccount
 1:
+        memw
        l32i    a3, a2, 0
        beqi    a3, 0, 1b
        movi    a3, 0
        s32i    a3, a2, 0
-        memw
 1:
+        memw
        l32i    a3, a2, 0
        beqi    a3, 0, 1b
        wsr     a3, ccount
@@ -317,11 +318,13 @@ ENTRY(cpu_restart)
        rsr     a0, prid
        neg     a2, a0
        movi    a3, cpu_start_id
+        memw
        s32i    a2, a3, 0
 #if XCHAL_DCACHE_IS_WRITEBACK
        dhwbi   a3, 0
 #endif
 1:
+        memw
        l32i    a2, a3, 0
        dhi     a3, 0
        bne     a2, a0, 1b
diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
index 932d64689bac..be1f280c322c 100644
--- a/arch/xtensa/kernel/smp.c
+++ b/arch/xtensa/kernel/smp.c
@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
        unsigned i;
-        for (i = 0; i < max_cpus; ++i)
+        for_each_possible_cpu(i)
                set_cpu_present(i, true);
 }
@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)
        pr_info("%s: Core Count = %d\n", __func__, ncpus);
        pr_info("%s: Core Id = %d\n", __func__, core_id);
+        if (ncpus > NR_CPUS) {
+                ncpus = NR_CPUS;
+                pr_info("%s: limiting core count by %d\n", __func__, ncpus);
+        }
        for (i = 0; i < ncpus; ++i)
                set_cpu_possible(i, true);
 }
@@ -195,9 +200,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
        int i;
 #ifdef CONFIG_HOTPLUG_CPU
-        cpu_start_id = cpu;
+        WRITE_ONCE(cpu_start_id, cpu);
-        system_flush_invalidate_dcache_range(
+        /* Pairs with the third memw in the cpu_restart */
-                        (unsigned long)&cpu_start_id, sizeof(cpu_start_id));
+        mb();
+        system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id,
+                                             sizeof(cpu_start_id));
 #endif
        smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1);
@@ -206,18 +213,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
                        ccount = get_ccount();
                while (!ccount);
-                cpu_start_ccount = ccount;
+                WRITE_ONCE(cpu_start_ccount, ccount);
-                while (time_before(jiffies, timeout)) {
+                do {
+                        /*
+                         * Pairs with the first two memws in the
+                         * .Lboot_secondary.
+                         */
                        mb();
-                        if (!cpu_start_ccount)
+                        ccount = READ_ONCE(cpu_start_ccount);
-                                break;
+                } while (ccount && time_before(jiffies, timeout));
-                }
-                if (cpu_start_ccount) {
+                if (ccount) {
                        smp_call_function_single(0, mx_cpu_stop,
-                                        (void *)cpu, 1);
+                                                 (void *)cpu, 1);
-                        cpu_start_ccount = 0;
+                        WRITE_ONCE(cpu_start_ccount, 0);
                        return -EIO;
                }
        }
@@ -237,6 +247,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
        pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n",
                        __func__, cpu, idle, start_info.stack);
+        init_completion(&cpu_running);
        ret = boot_secondary(cpu, idle);
        if (ret == 0) {
                wait_for_completion_timeout(&cpu_running,
@@ -298,8 +309,10 @@ void __cpu_die(unsigned int cpu)
        unsigned long timeout = jiffies + msecs_to_jiffies(1000);
        while (time_before(jiffies, timeout)) {
                system_invalidate_dcache_range((unsigned long)&cpu_start_id,
-                                sizeof(cpu_start_id));
+                                               sizeof(cpu_start_id));
-                if (cpu_start_id == -cpu) {
+                /* Pairs with the second memw in the cpu_restart */
+                mb();
+                if (READ_ONCE(cpu_start_id) == -cpu) {
                        platform_cpu_kill(cpu);
                        return;
                }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index fd524a54d2ab..378186b5eb40 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt)
                container_of(evt, struct ccount_timer, evt);
        if (timer->irq_enabled) {
-                disable_irq(evt->irq);
+                disable_irq_nosync(evt->irq);
                timer->irq_enabled = 0;
        }
        return 0;
diff --git a/block/blk-core.c b/block/blk-core.c
index 3c5f61ceeb67..6b78ec56a4f2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -462,6 +462,10 @@ static void blk_rq_timed_out_timer(struct timer_list *t)
        kblockd_schedule_work(&q->timeout_work);
 }
+static void blk_timeout_work(struct work_struct *work)
+{
+}
 /**
 * blk_alloc_queue_node - allocate a request queue
 * @gfp_mask: memory allocation flags
@@ -505,7 +509,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
        timer_setup(&q->backing_dev_info->laptop_mode_wb_timer,
                    laptop_mode_timer_fn, 0);
        timer_setup(&q->timeout, blk_rq_timed_out_timer, 0);
-        INIT_WORK(&q->timeout_work, NULL);
+        INIT_WORK(&q->timeout_work, blk_timeout_work);
        INIT_LIST_HEAD(&q->icq_list);
 #ifdef CONFIG_BLK_CGROUP
        INIT_LIST_HEAD(&q->blkg_list);
diff --git a/block/blk-flush.c b/block/blk-flush.c
index a3fc7191c694..6e0f2d97fc6d 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -335,7 +335,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error)
        blk_flush_complete_seq(rq, fq, REQ_FSEQ_DATA, error);
        spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
-        blk_mq_run_hw_queue(hctx, true);
+        blk_mq_sched_restart(hctx);
 }
 /**
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 90d68760af08..f8120832ca7b 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -308,8 +308,9 @@ static const char *const cmd_flag_name[] = {
        CMD_FLAG_NAME(PREFLUSH),
        CMD_FLAG_NAME(RAHEAD),
        CMD_FLAG_NAME(BACKGROUND),
-        CMD_FLAG_NAME(NOUNMAP),
        CMD_FLAG_NAME(NOWAIT),
+        CMD_FLAG_NAME(NOUNMAP),
+        CMD_FLAG_NAME(HIPRI),
 };
 #undef CMD_FLAG_NAME
diff --git a/block/blk-wbt.c b/block/blk-wbt.c
index f0c56649775f..fd166fbb0f65 100644
--- a/block/blk-wbt.c
+++ b/block/blk-wbt.c
@@ -597,7 +597,7 @@ static void wbt_track(struct rq_qos *rqos, struct request *rq, struct bio *bio)
        rq->wbt_flags |= bio_to_wbt_flags(rwb, bio);
 }
-void wbt_issue(struct rq_qos *rqos, struct request *rq)
+static void wbt_issue(struct rq_qos *rqos, struct request *rq)
 {
        struct rq_wb *rwb = RQWB(rqos);
@@ -617,7 +617,7 @@ void wbt_issue(struct rq_qos *rqos, struct request *rq)
        }
 }
-void wbt_requeue(struct rq_qos *rqos, struct request *rq)
+static void wbt_requeue(struct rq_qos *rqos, struct request *rq)
 {
        struct rq_wb *rwb = RQWB(rqos);
        if (!rwb_enabled(rwb))
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 5143e11e3b0f..e18ade5d74e9 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -409,6 +409,32 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
        return true;
 }
+static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+                struct nd_cmd_pkg *call_pkg)
+{
+        if (call_pkg) {
+                int i;
+                if (nfit_mem->family != call_pkg->nd_family)
+                        return -ENOTTY;
+                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+                        if (call_pkg->nd_reserved2[i])
+                                return -EINVAL;
+                return call_pkg->nd_command;
+        }
+        /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+        if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+                return cmd;
+        /*
+         * Force function number validation to fail since 0 is never
+         * published as a valid function in dsm_mask.
+         */
+        return 0;
+}
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
@@ -422,30 +448,23 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
        unsigned long cmd_mask, dsm_mask;
        u32 offset, fw_status = 0;
        acpi_handle handle;
-        unsigned int func;
        const guid_t *guid;
-        int rc, i;
+        int func, rc, i;
        if (cmd_rc)
                *cmd_rc = -EINVAL;
-        func = cmd;
-        if (cmd == ND_CMD_CALL) {
-                call_pkg = buf;
-                func = call_pkg->nd_command;
-                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
-                        if (call_pkg->nd_reserved2[i])
-                                return -EINVAL;
-        }
        if (nvdimm) {
                struct acpi_device *adev = nfit_mem->adev;
                if (!adev)
                        return -ENOTTY;
-                if (call_pkg && nfit_mem->family != call_pkg->nd_family)
-                        return -ENOTTY;
+                if (cmd == ND_CMD_CALL)
+                        call_pkg = buf;
+                func = cmd_to_func(nfit_mem, cmd, call_pkg);
+                if (func < 0)
+                        return func;
                dimm_name = nvdimm_name(nvdimm);
                cmd_name = nvdimm_cmd_name(cmd);
                cmd_mask = nvdimm_cmd_mask(nvdimm);
@@ -456,6 +475,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
        } else {
                struct acpi_device *adev = to_acpi_dev(acpi_desc);
+                func = cmd;
                cmd_name = nvdimm_bus_cmd_name(cmd);
                cmd_mask = nd_desc->cmd_mask;
                dsm_mask = cmd_mask;
@@ -470,7 +490,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
        if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
                return -ENOTTY;
-        if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
+        /*
+         * Check for a valid command.  For ND_CMD_CALL, we also have to
+         * make sure that the DSM function is supported.
+         */
+        if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask))
+                return -ENOTTY;
+        else if (!test_bit(cmd, &cmd_mask))
                return -ENOTTY;
        in_obj.type = ACPI_TYPE_PACKAGE;
@@ -1867,6 +1893,13 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                return 0;
        }
+        /*
+         * Function 0 is the command interrogation function, don't
+         * export it to potential userspace use, and enable it to be
+         * used as an error value in acpi_nfit_ctl().
+         */
+        dsm_mask &= ~1UL;
        guid = to_nfit_uuid(nfit_mem->family);
        for_each_set_bit(i, &dsm_mask, BITS_PER_LONG)
                if (acpi_check_dsm(adev_dimm->handle, guid,
@@ -2042,11 +2075,6 @@ static int acpi_nfit_register_dimms(struct acpi_nfit_desc *acpi_desc)
                if (!nvdimm)
                        continue;
-                rc = nvdimm_security_setup_events(nvdimm);
-                if (rc < 0)
-                        dev_warn(acpi_desc->dev,
-                                "security event setup failed: %d\n", rc);
                nfit_kernfs = sysfs_get_dirent(nvdimm_kobj(nvdimm)->sd, "nfit");
                if (nfit_kernfs)
                        nfit_mem->flags_attr = sysfs_get_dirent(nfit_kernfs,
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 7496b10532aa..6a2185eb66c5 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -11,6 +11,7 @@
 #include <linux/kdev_t.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/namei.h>
 #include <linux/magic.h>
 #include <linux/major.h>
 #include <linux/miscdevice.h>
@@ -20,6 +21,7 @@
 #include <linux/parser.h>
 #include <linux/radix-tree.h>
 #include <linux/sched.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/spinlock_types.h>
 #include <linux/stddef.h>
@@ -30,7 +32,7 @@
 #include <linux/xarray.h>
 #include <uapi/asm-generic/errno-base.h>
 #include <uapi/linux/android/binder.h>
-#include <uapi/linux/android/binder_ctl.h>
+#include <uapi/linux/android/binderfs.h>
 #include "binder_internal.h"
@@ -39,14 +41,32 @@
 #define INODE_OFFSET 3
 #define INTSTRLEN 21
 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
+/* Ensure that the initial ipc namespace always has devices available. */
-static struct vfsmount *binderfs_mnt;
+#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 static dev_t binderfs_dev;
 static DEFINE_MUTEX(binderfs_minors_mutex);
 static DEFINE_IDA(binderfs_minors);
 /**
+ * binderfs_mount_opts - mount options for binderfs
+ * @max: maximum number of allocatable binderfs binder devices
+ */
+struct binderfs_mount_opts {
+        int max;
+};
+enum {
+        Opt_max,
+        Opt_err
+};
+static const match_table_t tokens = {
+        { Opt_max, "max=%d" },
+        { Opt_err, NULL     }
+};
+/**
 * binderfs_info - information about a binderfs mount
 * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
 * @control_dentry: This records the dentry of this binderfs mount
@@ -55,13 +75,16 @@ static DEFINE_IDA(binderfs_minors);
 *                  created.
 * @root_gid:       gid that needs to be used when a new binder device is
 *                  created.
+ * @mount_opts:     The mount options in use.
+ * @device_count:   The current number of allocated binder devices.
 */
 struct binderfs_info {
        struct ipc_namespace *ipc_ns;
        struct dentry *control_dentry;
        kuid_t root_uid;
        kgid_t root_gid;
+        struct binderfs_mount_opts mount_opts;
+        int device_count;
 };
 static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
@@ -84,7 +107,7 @@ bool is_binderfs_device(const struct inode *inode)
 * @userp:     buffer to copy information about new device for userspace to
 * @req:       struct binderfs_device as copied from userspace
 *
- * This function allocated a new binder_device and reserves a new minor
+ * This function allocates a new binder_device and reserves a new minor
 * number for it.
 * Minor numbers are limited and tracked globally in binderfs_minors. The
 * function will stash a struct binder_device for the specific binder
@@ -100,20 +123,34 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
                                         struct binderfs_device *req)
 {
        int minor, ret;
-        struct dentry *dentry, *dup, *root;
+        struct dentry *dentry, *root;
        struct binder_device *device;
-        size_t name_len = BINDERFS_MAX_NAME + 1;
        char *name = NULL;
+        size_t name_len;
        struct inode *inode = NULL;
        struct super_block *sb = ref_inode->i_sb;
        struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
        /* Reserve new minor number for the new device. */
        mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        if (++info->device_count <= info->mount_opts.max)
-        mutex_unlock(&binderfs_minors_mutex);
+                minor = ida_alloc_max(&binderfs_minors,
-        if (minor < 0)
+                                      use_reserve ? BINDERFS_MAX_MINOR :
+                                                    BINDERFS_MAX_MINOR_CAPPED,
+                                      GFP_KERNEL);
+        else
+                minor = -ENOSPC;
+        if (minor < 0) {
+                --info->device_count;
+                mutex_unlock(&binderfs_minors_mutex);
                return minor;
+        }
+        mutex_unlock(&binderfs_minors_mutex);
        ret = -ENOMEM;
        device = kzalloc(sizeof(*device), GFP_KERNEL);
@@ -132,12 +169,13 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
        inode->i_uid = info->root_uid;
        inode->i_gid = info->root_gid;
-        name = kmalloc(name_len, GFP_KERNEL);
+        req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
+        name_len = strlen(req->name);
+        /* Make sure to include terminating NUL byte */
+        name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
        if (!name)
                goto err;
-        strscpy(name, req->name, name_len);
        device->binderfs_inode = inode;
        device->context.binder_context_mgr_uid = INVALID_UID;
        device->context.name = name;
@@ -156,28 +194,25 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
        root = sb->s_root;
        inode_lock(d_inode(root));
-        dentry = d_alloc_name(root, name);
-        if (!dentry) {
+        /* look it up */
+        dentry = lookup_one_len(name, root, name_len);
+        if (IS_ERR(dentry)) {
                inode_unlock(d_inode(root));
-                ret = -ENOMEM;
+                ret = PTR_ERR(dentry);
                goto err;
        }
-        /* Verify that the name userspace gave us is not already in use. */
+        if (d_really_is_positive(dentry)) {
-        dup = d_lookup(root, &dentry->d_name);
+                /* already exists */
-        if (dup) {
+                dput(dentry);
-                if (d_really_is_positive(dup)) {
+                inode_unlock(d_inode(root));
-                        dput(dup);
+                ret = -EEXIST;
-                        dput(dentry);
+                goto err;
-                        inode_unlock(d_inode(root));
-                        ret = -EEXIST;
-                        goto err;
-                }
-                dput(dup);
        }
        inode->i_private = device;
-        d_add(dentry, inode);
+        d_instantiate(dentry, inode);
        fsnotify_create(root->d_inode, dentry);
        inode_unlock(d_inode(root));
@@ -187,6 +222,7 @@ err:
        kfree(name);
        kfree(device);
        mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
        ida_free(&binderfs_minors, minor);
        mutex_unlock(&binderfs_minors_mutex);
        iput(inode);
@@ -232,6 +268,7 @@ static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
 static void binderfs_evict_inode(struct inode *inode)
 {
        struct binder_device *device = inode->i_private;
+        struct binderfs_info *info = BINDERFS_I(inode);
        clear_inode(inode);
@@ -239,6 +276,7 @@ static void binderfs_evict_inode(struct inode *inode)
                return;
        mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
        ida_free(&binderfs_minors, device->miscdev.minor);
        mutex_unlock(&binderfs_minors_mutex);
@@ -246,43 +284,87 @@ static void binderfs_evict_inode(struct inode *inode)
        kfree(device);
 }
+/**
+ * binderfs_parse_mount_opts - parse binderfs mount options
+ * @data: options to set (can be NULL in which case defaults are used)
+ */
+static int binderfs_parse_mount_opts(char *data,
+                                     struct binderfs_mount_opts *opts)
+{
+        char *p;
+        opts->max = BINDERFS_MAX_MINOR;
+        while ((p = strsep(&data, ",")) != NULL) {
+                substring_t args[MAX_OPT_ARGS];
+                int token;
+                int max_devices;
+                if (!*p)
+                        continue;
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_max:
+                        if (match_int(&args[0], &max_devices) ||
+                            (max_devices < 0 ||
+                             (max_devices > BINDERFS_MAX_MINOR)))
+                                return -EINVAL;
+                        opts->max = max_devices;
+                        break;
+                default:
+                        pr_err("Invalid mount options\n");
+                        return -EINVAL;
+                }
+        }
+        return 0;
+}
+static int binderfs_remount(struct super_block *sb, int *flags, char *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+        return binderfs_parse_mount_opts(data, &info->mount_opts);
+}
+static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
+{
+        struct binderfs_info *info;
+        info = root->d_sb->s_fs_info;
+        if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
+                seq_printf(seq, ",max=%d", info->mount_opts.max);
+        return 0;
+}
 static const struct super_operations binderfs_super_ops = {
-        .statfs = simple_statfs,
+        .evict_inode    = binderfs_evict_inode,
-        .evict_inode = binderfs_evict_inode,
+        .remount_fs     = binderfs_remount,
+        .show_options   = binderfs_show_mount_opts,
+        .statfs         = simple_statfs,
 };
+static inline bool is_binderfs_control_device(const struct dentry *dentry)
+{
+        struct binderfs_info *info = dentry->d_sb->s_fs_info;
+        return info->control_dentry == dentry;
+}
 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                           struct inode *new_dir, struct dentry *new_dentry,
                           unsigned int flags)
 {
-        struct inode *inode = d_inode(old_dentry);
+        if (is_binderfs_control_device(old_dentry) ||
+            is_binderfs_control_device(new_dentry))
-        /* binderfs doesn't support directories. */
-        if (d_is_dir(old_dentry))
                return -EPERM;
-        if (flags & ~RENAME_NOREPLACE)
+        return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
-                return -EINVAL;
-        if (!simple_empty(new_dentry))
-                return -ENOTEMPTY;
-        if (d_really_is_positive(new_dentry))
-                simple_unlink(new_dir, new_dentry);
-        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
-                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
-        return 0;
 }
 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        /*
+        if (is_binderfs_control_device(dentry))
-         * The control dentry is only ever touched during mount so checking it
-         * here should not require us to take lock.
-         */
-        if (BINDERFS_I(dir)->control_dentry == dentry)
                return -EPERM;
        return simple_unlink(dir, dentry);
@@ -318,8 +400,6 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
        if (!device)
                return -ENOMEM;
-        inode_lock(d_inode(root));
        /* If we have already created a binder-control node, return. */
        if (info->control_dentry) {
                ret = 0;
@@ -358,12 +438,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
        inode->i_private = device;
        info->control_dentry = dentry;
        d_add(dentry, inode);
-        inode_unlock(d_inode(root));
        return 0;
 out:
-        inode_unlock(d_inode(root));
        kfree(device);
        iput(inode);
@@ -378,12 +456,9 @@ static const struct inode_operations binderfs_dir_inode_operations = {
 static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 {
+        int ret;
        struct binderfs_info *info;
-        int ret = -ENOMEM;
        struct inode *inode = NULL;
-        struct ipc_namespace *ipc_ns = sb->s_fs_info;
-        get_ipc_ns(ipc_ns);
        sb->s_blocksize = PAGE_SIZE;
        sb->s_blocksize_bits = PAGE_SHIFT;
@@ -405,11 +480,17 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_op = &binderfs_super_ops;
        sb->s_time_gran = 1;
-        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
-        if (!info)
+        if (!sb->s_fs_info)
-                goto err_without_dentry;
+                return -ENOMEM;
+        info = sb->s_fs_info;
+        info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
+        ret = binderfs_parse_mount_opts(data, &info->mount_opts);
+        if (ret)
+                return ret;
-        info->ipc_ns = ipc_ns;
        info->root_gid = make_kgid(sb->s_user_ns, 0);
        if (!gid_valid(info->root_gid))
                info->root_gid = GLOBAL_ROOT_GID;
@@ -417,11 +498,9 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        if (!uid_valid(info->root_uid))
                info->root_uid = GLOBAL_ROOT_UID;
-        sb->s_fs_info = info;
        inode = new_inode(sb);
        if (!inode)
-                goto err_without_dentry;
+                return -ENOMEM;
        inode->i_ino = FIRST_INODE;
        inode->i_fop = &simple_dir_operations;
@@ -432,79 +511,28 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_root = d_make_root(inode);
        if (!sb->s_root)
-                goto err_without_dentry;
+                return -ENOMEM;
-        ret = binderfs_binder_ctl_create(sb);
-        if (ret)
-                goto err_with_dentry;
-        return 0;
-err_with_dentry:
-        dput(sb->s_root);
-        sb->s_root = NULL;
-err_without_dentry:
-        put_ipc_ns(ipc_ns);
-        iput(inode);
-        kfree(info);
-        return ret;
-}
-static int binderfs_test_super(struct super_block *sb, void *data)
-{
-        struct binderfs_info *info = sb->s_fs_info;
-        if (info)
-                return info->ipc_ns == data;
-        return 0;
-}
-static int binderfs_set_super(struct super_block *sb, void *data)
+        return binderfs_binder_ctl_create(sb);
-{
-        sb->s_fs_info = data;
-        return set_anon_super(sb, NULL);
 }
 static struct dentry *binderfs_mount(struct file_system_type *fs_type,
                                     int flags, const char *dev_name,
                                     void *data)
 {
-        struct super_block *sb;
+        return mount_nodev(fs_type, flags, data, binderfs_fill_super);
-        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
-        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
-                return ERR_PTR(-EPERM);
-        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
-                         flags, ipc_ns->user_ns, ipc_ns);
-        if (IS_ERR(sb))
-                return ERR_CAST(sb);
-        if (!sb->s_root) {
-                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
-                if (ret) {
-                        deactivate_locked_super(sb);
-                        return ERR_PTR(ret);
-                }
-                sb->s_flags |= SB_ACTIVE;
-        }
-        return dget(sb->s_root);
 }
 static void binderfs_kill_super(struct super_block *sb)
 {
        struct binderfs_info *info = sb->s_fs_info;
+        kill_litter_super(sb);
        if (info && info->ipc_ns)
                put_ipc_ns(info->ipc_ns);
        kfree(info);
-        kill_litter_super(sb);
 }
 static struct file_system_type binder_fs_type = {
@@ -530,14 +558,6 @@ static int __init init_binderfs(void)
                return ret;
        }
-        binderfs_mnt = kern_mount(&binder_fs_type);
-        if (IS_ERR(binderfs_mnt)) {
-                ret = PTR_ERR(binderfs_mnt);
-                binderfs_mnt = NULL;
-                unregister_filesystem(&binder_fs_type);
-                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
-        }
        return ret;
 }
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
index 8cc9c429ad95..9e7fc302430f 100644
--- a/drivers/ata/pata_macio.c
+++ b/drivers/ata/pata_macio.c
@@ -915,6 +915,10 @@ static struct scsi_host_template pata_macio_sht = {
        .sg_tablesize           = MAX_DCMDS,
        /* We may not need that strict one */
        .dma_boundary           = ATA_DMA_BOUNDARY,
+        /* Not sure what the real max is but we know it's less than 64K, let's
+         * use 64K minus 256
+         */
+        .max_segment_size       = MAX_DBDMA_SEG,
        .slave_configure        = pata_macio_slave_config,
 };
@@ -1044,11 +1048,6 @@ static int pata_macio_common_init(struct pata_macio_priv *priv,
        /* Make sure we have sane initial timings in the cache */
        pata_macio_default_timings(priv);
-        /* Not sure what the real max is but we know it's less than 64K, let's
-         * use 64K minus 256
-         */
-        dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG);
        /* Allocate libata host for 1 port */
        memset(&pinfo, 0, sizeof(struct ata_port_info));
        pmac_macio_calc_timing_masks(priv, &pinfo);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e0bcf9b2dab0..174e84ce4379 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -245,8 +245,15 @@ struct inic_port_priv {
 static struct scsi_host_template inic_sht = {
        ATA_BASE_SHT(DRV_NAME),
-        .sg_tablesize   = LIBATA_MAX_PRD,       /* maybe it can be larger? */
+        .sg_tablesize           = LIBATA_MAX_PRD, /* maybe it can be larger? */
-        .dma_boundary   = INIC_DMA_BOUNDARY,
+        /*
+         * This controller is braindamaged.  dma_boundary is 0xffff like others
+         * but it will lock up the whole machine HARD if 65536 byte PRD entry
+         * is fed.  Reduce maximum segment size.
+         */
+        .dma_boundary           = INIC_DMA_BOUNDARY,
+        .max_segment_size       = 65536 - 512,
 };
 static const int scr_map[] = {
@@ -868,17 +875,6 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                return rc;
        }
-        /*
-         * This controller is braindamaged.  dma_boundary is 0xffff
-         * like others but it will lock up the whole machine HARD if
-         * 65536 byte PRD entry is fed. Reduce maximum segment size.
-         */
-        rc = dma_set_max_seg_size(&pdev->dev, 65536 - 512);
-        if (rc) {
-                dev_err(&pdev->dev, "failed to set the maximum segment size\n");
-                return rc;
-        }
        rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
        if (rc) {
                dev_err(&pdev->dev, "failed to initialize controller\n");
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 457be03b744d..0ea2139c50d8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -130,7 +130,7 @@ u64 pm_runtime_autosuspend_expiration(struct device *dev)
 {
        int autosuspend_delay;
        u64 last_busy, expires = 0;
-        u64 now = ktime_to_ns(ktime_get());
+        u64 now = ktime_get_mono_fast_ns();
        if (!dev->power.use_autosuspend)
                goto out;
@@ -909,7 +909,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
         * If 'expires' is after the current time, we've been called
         * too early.
         */
-        if (expires > 0 && expires < ktime_to_ns(ktime_get())) {
+        if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
                dev->power.timer_expires = 0;
                rpm_suspend(dev, dev->power.timer_autosuspends ?
                    (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
@@ -928,7 +928,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
 int pm_schedule_suspend(struct device *dev, unsigned int delay)
 {
        unsigned long flags;
-        ktime_t expires;
+        u64 expires;
        int retval;
        spin_lock_irqsave(&dev->power.lock, flags);
@@ -945,8 +945,8 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
        /* Other scheduled or pending requests need to be canceled. */
        pm_runtime_cancel_pending(dev);
-        expires = ktime_add(ktime_get(), ms_to_ktime(delay));
+        expires = ktime_get_mono_fast_ns() + (u64)delay * NSEC_PER_MSEC;
-        dev->power.timer_expires = ktime_to_ns(expires);
+        dev->power.timer_expires = expires;
        dev->power.timer_autosuspends = 0;
        hrtimer_start(&dev->power.suspend_timer, expires, HRTIMER_MODE_ABS);
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index a74ce885b541..c518659b4d9f 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -32,6 +32,7 @@
 #include <linux/moduleparam.h>
 #include <linux/workqueue.h>
 #include <linux/uuid.h>
+#include <linux/nospec.h>
 #define IPMI_DRIVER_VERSION "39.2"
@@ -62,7 +63,8 @@ static void ipmi_debug_msg(const char *title, unsigned char *data,
 { }
 #endif
-static int initialized;
+static bool initialized;
+static bool drvregistered;
 enum ipmi_panic_event_op {
        IPMI_SEND_PANIC_EVENT_NONE,
@@ -612,7 +614,7 @@ static DEFINE_MUTEX(ipmidriver_mutex);
 static LIST_HEAD(ipmi_interfaces);
 static DEFINE_MUTEX(ipmi_interfaces_mutex);
-DEFINE_STATIC_SRCU(ipmi_interfaces_srcu);
+struct srcu_struct ipmi_interfaces_srcu;
 /*
 * List of watchers that want to know when smi's are added and deleted.
@@ -720,7 +722,15 @@ struct watcher_entry {
 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 {
        struct ipmi_smi *intf;
-        int index;
+        int index, rv;
+        /*
+         * Make sure the driver is actually initialized, this handles
+         * problems with initialization order.
+         */
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
        mutex_lock(&smi_watchers_mutex);
@@ -884,7 +894,7 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
                if (user) {
                        user->handler->ipmi_recv_hndl(msg, user->handler_data);
-                        release_ipmi_user(msg->user, index);
+                        release_ipmi_user(user, index);
                } else {
                        /* User went away, give up. */
                        ipmi_free_recv_msg(msg);
@@ -1076,7 +1086,7 @@ int ipmi_create_user(unsigned int          if_num,
 {
        unsigned long flags;
        struct ipmi_user *new_user;
-        int           rv = 0, index;
+        int           rv, index;
        struct ipmi_smi *intf;
        /*
@@ -1094,18 +1104,9 @@ int ipmi_create_user(unsigned int          if_num,
         * Make sure the driver is actually initialized, this handles
         * problems with initialization order.
         */
-        if (!initialized) {
+        rv = ipmi_init_msghandler();
-                rv = ipmi_init_msghandler();
+        if (rv)
-                if (rv)
+                return rv;
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
        new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
        if (!new_user)
@@ -1183,6 +1184,7 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
        struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+        cleanup_srcu_struct(&user->release_barrier);
        kfree(user);
 }
@@ -1259,7 +1261,6 @@ int ipmi_destroy_user(struct ipmi_user *user)
 {
        _ipmi_destroy_user(user);
-        cleanup_srcu_struct(&user->release_barrier);
        kref_put(&user->refcount, free_user);
        return 0;
@@ -1298,10 +1299,12 @@ int ipmi_set_my_address(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                user->intf->addrinfo[channel].address = address;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1318,10 +1321,12 @@ int ipmi_get_my_address(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                *address = user->intf->addrinfo[channel].address;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1338,10 +1343,12 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                user->intf->addrinfo[channel].lun = LUN & 0x3;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1358,10 +1365,12 @@ int ipmi_get_my_LUN(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                *address = user->intf->addrinfo[channel].lun;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -2184,6 +2193,7 @@ static int check_addr(struct ipmi_smi  *intf,
 {
        if (addr->channel >= IPMI_MAX_CHANNELS)
                return -EINVAL;
+        addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
        *lun = intf->addrinfo[addr->channel].lun;
        *saddr = intf->addrinfo[addr->channel].address;
        return 0;
@@ -3291,17 +3301,9 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
         * Make sure the driver is actually initialized, this handles
         * problems with initialization order.
         */
-        if (!initialized) {
+        rv = ipmi_init_msghandler();
-                rv = ipmi_init_msghandler();
+        if (rv)
-                if (rv)
+                return rv;
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
        intf = kzalloc(sizeof(*intf), GFP_KERNEL);
        if (!intf)
@@ -5017,6 +5019,22 @@ static int panic_event(struct notifier_block *this,
        return NOTIFY_DONE;
 }
+/* Must be called with ipmi_interfaces_mutex held. */
+static int ipmi_register_driver(void)
+{
+        int rv;
+        if (drvregistered)
+                return 0;
+        rv = driver_register(&ipmidriver.driver);
+        if (rv)
+                pr_err("Could not register IPMI driver\n");
+        else
+                drvregistered = true;
+        return rv;
+}
 static struct notifier_block panic_block = {
        .notifier_call  = panic_event,
        .next           = NULL,
@@ -5027,66 +5045,75 @@ static int ipmi_init_msghandler(void)
 {
        int rv;
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        if (rv)
+                goto out;
        if (initialized)
-                return 0;
+                goto out;
-        rv = driver_register(&ipmidriver.driver);
-        if (rv) {
-                pr_err("Could not register IPMI driver\n");
-                return rv;
-        }
-        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        init_srcu_struct(&ipmi_interfaces_srcu);
        timer_setup(&ipmi_timer, ipmi_timeout, 0);
        mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
        atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
-        initialized = 1;
+        initialized = true;
-        return 0;
+out:
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 static int __init ipmi_init_msghandler_mod(void)
 {
-        ipmi_init_msghandler();
+        int rv;
-        return 0;
+        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 static void __exit cleanup_ipmi(void)
 {
        int count;
-        if (!initialized)
+        if (initialized) {
-                return;
+                atomic_notifier_chain_unregister(&panic_notifier_list,
+                                                 &panic_block);
-        atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
-        /*
+                /*
-         * This can't be called if any interfaces exist, so no worry
+                 * This can't be called if any interfaces exist, so no worry
-         * about shutting down the interfaces.
+                 * about shutting down the interfaces.
-         */
+                 */
-        /*
+                /*
-         * Tell the timer to stop, then wait for it to stop.  This
+                 * Tell the timer to stop, then wait for it to stop.  This
-         * avoids problems with race conditions removing the timer
+                 * avoids problems with race conditions removing the timer
-         * here.
+                 * here.
-         */
+                 */
-        atomic_inc(&stop_operation);
+                atomic_inc(&stop_operation);
-        del_timer_sync(&ipmi_timer);
+                del_timer_sync(&ipmi_timer);
-        driver_unregister(&ipmidriver.driver);
+                initialized = false;
-        initialized = 0;
+                /* Check for buffer leaks. */
+                count = atomic_read(&smi_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("SMI message count %d at exit\n", count);
+                count = atomic_read(&recv_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("recv message count %d at exit\n", count);
-        /* Check for buffer leaks. */
+                cleanup_srcu_struct(&ipmi_interfaces_srcu);
-        count = atomic_read(&smi_msg_inuse_count);
+        }
-        if (count != 0)
+        if (drvregistered)
-                pr_warn("SMI message count %d at exit\n", count);
+                driver_unregister(&ipmidriver.driver);
-        count = atomic_read(&recv_msg_inuse_count);
-        if (count != 0)
-                pr_warn("recv message count %d at exit\n", count);
 }
 module_exit(cleanup_ipmi);
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index ca9528c4f183..b7a1ae2afaea 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -632,8 +632,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                /* Remove the multi-part read marker. */
                len -= 2;
+                data += 2;
                for (i = 0; i < len; i++)
-                        ssif_info->data[i] = data[i+2];
+                        ssif_info->data[i] = data[i];
                ssif_info->multi_len = len;
                ssif_info->multi_pos = 1;
@@ -661,8 +662,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                }
                blocknum = data[0];
+                len--;
+                data++;
+                if (blocknum != 0xff && len != 31) {
+                    /* All blocks but the last must have 31 data bytes. */
+                        result = -EIO;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Received middle message <31\n");
-                if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) {
+                        goto continue_op;
+                }
+                if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) {
                        /* Received message too big, abort the operation. */
                        result = -E2BIG;
                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
@@ -671,16 +683,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                        goto continue_op;
                }
-                /* Remove the blocknum from the data. */
-                len--;
                for (i = 0; i < len; i++)
-                        ssif_info->data[i + ssif_info->multi_len] = data[i + 1];
+                        ssif_info->data[i + ssif_info->multi_len] = data[i];
                ssif_info->multi_len += len;
                if (blocknum == 0xff) {
                        /* End of read */
                        len = ssif_info->multi_len;
                        data = ssif_info->data;
-                } else if (blocknum + 1 != ssif_info->multi_pos) {
+                } else if (blocknum != ssif_info->multi_pos) {
                        /*
                         * Out of sequence block, just abort.  Block
                         * numbers start at zero for the second block,
@@ -707,6 +717,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                }
        }
+ continue_op:
        if (result < 0) {
                ssif_inc_stat(ssif_info, receive_errors);
        } else {
@@ -714,8 +725,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                ssif_inc_stat(ssif_info, received_message_parts);
        }
- continue_op:
        if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
                pr_info("DONE 1: state = %d, result=%d\n",
                        ssif_info->ssif_state, result);
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index b5e3103c1175..e43c876a9223 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -59,6 +59,7 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/serial_8250.h>
+#include <linux/nospec.h>
 #include "smapi.h"
 #include "mwavedd.h"
 #include "3780i.h"
@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        PRINTK_3(TRACE_MWAVE,
                                "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
                                " ipcnum %x entry usIntCount %x\n",
@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                " Invalid ipcnum %x\n", ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        PRINTK_3(TRACE_MWAVE,
                                "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC"
                                " ipcnum %x, usIntCount %x\n",
@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        mutex_lock(&mwave_mutex);
                        if (pDrvData->IPCs[ipcnum].bIsEnabled == true) {
                                pDrvData->IPCs[ipcnum].bIsEnabled = false;
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index e5b2fe80eab4..d2f0bb5ba47e 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -293,7 +293,6 @@ config COMMON_CLK_BD718XX
 source "drivers/clk/actions/Kconfig"
 source "drivers/clk/bcm/Kconfig"
 source "drivers/clk/hisilicon/Kconfig"
-source "drivers/clk/imx/Kconfig"
 source "drivers/clk/imgtec/Kconfig"
 source "drivers/clk/imx/Kconfig"
 source "drivers/clk/ingenic/Kconfig"
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 5b393e711e94..7d16ab0784ec 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
                if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
                        src = VC5_PRIM_SRC_SHDN_EN_XTAL;
-                if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+                else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
                        src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
+                else /* Invalid; should have been caught by vc5_probe() */
+                        return -EINVAL;
        }
        return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 75d13c0eff12..d2477a5058ac 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1513,9 +1513,19 @@ static int clk_fetch_parent_index(struct clk_core *core,
        if (!parent)
                return -EINVAL;
-        for (i = 0; i < core->num_parents; i++)
+        for (i = 0; i < core->num_parents; i++) {
-                if (clk_core_get_parent_by_index(core, i) == parent)
+                if (core->parents[i] == parent)
+                        return i;
+                if (core->parents[i])
+                        continue;
+                /* Fallback to comparing globally unique names */
+                if (!strcmp(parent->name, core->parent_names[i])) {
+                        core->parents[i] = parent;
                        return i;
+                }
+        }
        return -EINVAL;
 }
@@ -2779,7 +2789,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
        seq_printf(s, "\"protect_count\": %d,", c->protect_count);
        seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
        seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
-        seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
+        seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
        seq_printf(s, "\"duty_cycle\": %u",
                   clk_core_get_scaled_duty_cycle(c, 100000));
 }
diff --git a/drivers/clk/imx/clk-frac-pll.c b/drivers/clk/imx/clk-frac-pll.c
index 0026c3969b1e..76b9eb15604e 100644
--- a/drivers/clk/imx/clk-frac-pll.c
+++ b/drivers/clk/imx/clk-frac-pll.c
@@ -155,13 +155,14 @@ static int clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 {
        struct clk_frac_pll *pll = to_clk_frac_pll(hw);
        u32 val, divfi, divff;
-        u64 temp64 = parent_rate;
+        u64 temp64;
        int ret;
        parent_rate *= 8;
        rate *= 2;
        divfi = rate / parent_rate;
-        temp64 *= rate - divfi;
+        temp64 = parent_rate * divfi;
+        temp64 = rate - temp64;
        temp64 *= PLL_FRAC_DENOM;
        do_div(temp64, parent_rate);
        divff = temp64;
diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
index 99c2508de8e5..fb6edf1b8aa2 100644
--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
+++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
@@ -169,6 +169,8 @@ static int imx8qxp_lpcg_clk_probe(struct platform_device *pdev)
                return -ENODEV;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
        base = devm_ioremap(dev, res->start, resource_size(res));
        if (!base)
                return -ENOMEM;
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 61fefc046ec5..d083b860f083 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,7 +53,6 @@
 #define APMU_DISP1      0x110
 #define APMU_CCIC0      0x50
 #define APMU_CCIC1      0xf4
-#define APMU_SP         0x68
 #define MPMU_UART_PLL   0x14
 struct mmp2_clk_unit {
@@ -210,8 +209,6 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
        .reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
 };
-static DEFINE_SPINLOCK(sp_lock);
 static struct mmp_param_mux_clk apmu_mux_clks[] = {
        {MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
        {MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -242,7 +239,6 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
        {MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
        {MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
        {MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
-        {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
 };
 static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index 1b1ba54e33dd..1c04575c118f 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -215,6 +215,7 @@ config MSM_MMCC_8996
 config MSM_GCC_8998
        tristate "MSM8998 Global Clock Controller"
+        select QCOM_GDSC
        help
          Support for the global clock controller on msm8998 devices.
          Say Y if you want to use peripheral devices such as UART, SPI,
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index c782e62dd98b..58fa5c247af1 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -115,8 +115,8 @@ static const char * const gcc_parent_names_6[] = {
        "core_bi_pll_test_se",
 };
-static const char * const gcc_parent_names_7[] = {
+static const char * const gcc_parent_names_7_ao[] = {
-        "bi_tcxo",
+        "bi_tcxo_ao",
        "gpll0",
        "gpll0_out_even",
        "core_bi_pll_test_se",
@@ -128,6 +128,12 @@ static const char * const gcc_parent_names_8[] = {
        "core_bi_pll_test_se",
 };
+static const char * const gcc_parent_names_8_ao[] = {
+        "bi_tcxo_ao",
+        "gpll0",
+        "core_bi_pll_test_se",
+};
 static const struct parent_map gcc_parent_map_10[] = {
        { P_BI_TCXO, 0 },
        { P_GPLL0_OUT_MAIN, 1 },
@@ -210,7 +216,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
        .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
        .clkr.hw.init = &(struct clk_init_data){
                .name = "gcc_cpuss_ahb_clk_src",
-                .parent_names = gcc_parent_names_7,
+                .parent_names = gcc_parent_names_7_ao,
                .num_parents = 4,
                .ops = &clk_rcg2_ops,
        },
@@ -229,7 +235,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
        .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
        .clkr.hw.init = &(struct clk_init_data){
                .name = "gcc_cpuss_rbcpr_clk_src",
-                .parent_names = gcc_parent_names_8,
+                .parent_names = gcc_parent_names_8_ao,
                .num_parents = 3,
                .ops = &clk_rcg2_ops,
        },
diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
index 2d5d8b43727e..c4d0b6f6abf2 100644
--- a/drivers/clk/socfpga/clk-pll-s10.c
+++ b/drivers/clk/socfpga/clk-pll-s10.c
@@ -43,7 +43,7 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
        /* Read mdiv and fdiv from the fdbck register */
        reg = readl(socfpgaclk->hw.reg + 0x4);
        mdiv = (reg & SOCFPGA_PLL_MDIV_MASK) >> SOCFPGA_PLL_MDIV_SHIFT;
-        vco_freq = (unsigned long long)parent_rate * (mdiv + 6);
+        vco_freq = (unsigned long long)vco_freq * (mdiv + 6);
        return (unsigned long)vco_freq;
 }
diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
index 5b238fc314ac..8281dfbf38c2 100644
--- a/drivers/clk/socfpga/clk-s10.c
+++ b/drivers/clk/socfpga/clk-s10.c
@@ -12,17 +12,17 @@
 #include "stratix10-clk.h"
-static const char * const pll_mux[] = { "osc1", "cb_intosc_hs_div2_clk",
+static const char * const pll_mux[] = { "osc1", "cb-intosc-hs-div2-clk",
-                                        "f2s_free_clk",};
+                                        "f2s-free-clk",};
 static const char * const cntr_mux[] = { "main_pll", "periph_pll",
-                                         "osc1", "cb_intosc_hs_div2_clk",
+                                         "osc1", "cb-intosc-hs-div2-clk",
-                                         "f2s_free_clk"};
+                                         "f2s-free-clk"};
-static const char * const boot_mux[] = { "osc1", "cb_intosc_hs_div2_clk",};
+static const char * const boot_mux[] = { "osc1", "cb-intosc-hs-div2-clk",};
 static const char * const noc_free_mux[] = {"main_noc_base_clk",
                                            "peri_noc_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
+                                            "osc1", "cb-intosc-hs-div2-clk",
-                                            "f2s_free_clk"};
+                                            "f2s-free-clk"};
 static const char * const emaca_free_mux[] = {"peri_emaca_clk", "boot_clk"};
 static const char * const emacb_free_mux[] = {"peri_emacb_clk", "boot_clk"};
@@ -33,14 +33,14 @@ static const char * const s2f_usr1_free_mux[] = {"peri_s2f_usr1_clk", "boot_clk"
 static const char * const psi_ref_free_mux[] = {"peri_psi_ref_clk", "boot_clk"};
 static const char * const mpu_mux[] = { "mpu_free_clk", "boot_clk",};
-static const char * const s2f_usr0_mux[] = {"f2s_free_clk", "boot_clk"};
+static const char * const s2f_usr0_mux[] = {"f2s-free-clk", "boot_clk"};
 static const char * const emac_mux[] = {"emaca_free_clk", "emacb_free_clk"};
 static const char * const noc_mux[] = {"noc_free_clk", "boot_clk"};
 static const char * const mpu_free_mux[] = {"main_mpu_base_clk",
                                            "peri_mpu_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
+                                            "osc1", "cb-intosc-hs-div2-clk",
-                                            "f2s_free_clk"};
+                                            "f2s-free-clk"};
 /* clocks in AO (always on) controller */
 static const struct stratix10_pll_clock s10_pll_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
index 269d3595758b..edc31bb56674 100644
--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
        struct tegra_dfll_soc_data *soc;
        soc = tegra_dfll_unregister(pdev);
-        if (IS_ERR(soc))
+        if (IS_ERR(soc)) {
                dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
                        PTR_ERR(soc));
+                return PTR_ERR(soc);
+        }
        tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 8d77090ad94a..0241450f3eb3 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -403,8 +403,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
        num_dividers = i;
        tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                *table = ERR_PTR(-ENOMEM);
                return -ENOMEM;
+        }
        valid_div = 0;
        *width = 0;
@@ -439,6 +441,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
 {
        struct clk_omap_divider *div;
        struct clk_omap_reg *reg;
+        int ret;
        if (!setup)
                return NULL;
@@ -458,6 +461,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
                div->flags |= CLK_DIVIDER_POWER_OF_TWO;
        div->table = _get_div_table_from_setup(setup, &div->width);
+        if (IS_ERR(div->table)) {
+                ret = PTR_ERR(div->table);
+                kfree(div);
+                return ERR_PTR(ret);
+        }
        div->shift = setup->bit_shift;
        div->latch = -EINVAL;
diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c
index f65cc0ff76ab..b0908ec62f73 100644
--- a/drivers/clk/zynqmp/clkc.c
+++ b/drivers/clk/zynqmp/clkc.c
@@ -669,8 +669,8 @@ static int zynqmp_clk_setup(struct device_node *np)
        if (ret)
                return ret;
-        zynqmp_data = kzalloc(sizeof(*zynqmp_data) + sizeof(*zynqmp_data) *
+        zynqmp_data = kzalloc(struct_size(zynqmp_data, hws, clock_max_idx),
-                                                clock_max_idx, GFP_KERNEL);
+                              GFP_KERNEL);
        if (!zynqmp_data)
                return -ENOMEM;
diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
index b17d153e724f..23a1b27579a5 100644
--- a/drivers/cpuidle/poll_state.c
+++ b/drivers/cpuidle/poll_state.c
@@ -21,7 +21,7 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
        local_irq_enable();
        if (!current_set_polling_and_test()) {
                unsigned int loop_count = 0;
-                u64 limit = TICK_USEC;
+                u64 limit = TICK_NSEC;
                int i;
                for (i = 1; i < drv->state_count; i++) {
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index fe070d75c842..4c97478d44bd 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -537,6 +537,8 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
        struct nitrox_device *ndev = cmdq->ndev;
        struct nitrox_softreq *sr;
        int req_completed = 0, err = 0, budget;
+        completion_t callback;
+        void *cb_arg;
        /* check all pending requests */
        budget = atomic_read(&cmdq->pending_count);
@@ -564,13 +566,13 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                smp_mb__after_atomic();
                /* remove from response list */
                response_list_del(sr, cmdq);
                /* ORH error code */
                err = READ_ONCE(*sr->resp.orh) & 0xff;
+                callback = sr->callback;
-                if (sr->callback)
+                cb_arg = sr->cb_arg;
-                        sr->callback(sr->cb_arg, err);
                softreq_destroy(sr);
+                if (callback)
+                        callback(cb_arg, err);
                req_completed++;
        }
diff --git a/drivers/edac/altera_edac.h b/drivers/edac/altera_edac.h
index 4213cb0bb2a7..f8664bac9fa8 100644
--- a/drivers/edac/altera_edac.h
+++ b/drivers/edac/altera_edac.h
@@ -295,8 +295,8 @@ struct altr_sdram_mc_data {
 #define S10_SYSMGR_ECC_INTSTAT_DERR_OFST  0xA0
 /* Sticky registers for Uncorrected Errors */
-#define S10_SYSMGR_UE_VAL_OFST            0x120
+#define S10_SYSMGR_UE_VAL_OFST            0x220
-#define S10_SYSMGR_UE_ADDR_OFST           0x124
+#define S10_SYSMGR_UE_ADDR_OFST           0x224
 #define S10_DDR0_IRQ_MASK                 BIT(16)
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 09b845e90114..a785ffd5af89 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1144,10 +1144,6 @@ static int sbp2_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
        if (device->is_local)
                return -ENODEV;
-        if (dma_get_max_seg_size(device->card->device) > SBP2_MAX_SEG_SIZE)
-                WARN_ON(dma_set_max_seg_size(device->card->device,
-                                             SBP2_MAX_SEG_SIZE));
        shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
        if (shost == NULL)
                return -ENOMEM;
@@ -1610,6 +1606,7 @@ static struct scsi_host_template scsi_driver_template = {
        .eh_abort_handler       = sbp2_scsi_abort,
        .this_id                = -1,
        .sg_tablesize           = SG_ALL,
+        .max_segment_size       = SBP2_MAX_SEG_SIZE,
        .can_queue              = 1,
        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
 };
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 23ea1ed409d1..352bd2473162 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -37,8 +37,9 @@ extern u64 efi_system_table;
 static struct ptdump_info efi_ptdump_info = {
        .mm             = &efi_mm,
        .markers        = (struct addr_marker[]){
-                { 0,            "UEFI runtime start" },
+                { 0,                            "UEFI runtime start" },
-                { DEFAULT_MAP_WINDOW_64, "UEFI runtime end" }
+                { DEFAULT_MAP_WINDOW_64,        "UEFI runtime end" },
+                { -1,                           NULL }
        },
        .base_addr      = 0,
 };
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 6b11f1314248..7f9e0304b510 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
 static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
                                            unsigned int nr, int value)
 {
-        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
+        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
+                altr_a10sr_gpio_set(gc, nr, value);
                return 0;
+        }
        return -EINVAL;
 }
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index e0d6a0a7bc69..e41223c05f6e 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
 static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
 {
-        return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
+        switch (sprd_eic->type) {
+        case SPRD_EIC_DEBOUNCE:
+                return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        case SPRD_EIC_ASYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
+        case SPRD_EIC_SYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
+        default:
+                return -ENOTSUPP;
+        }
 }
 static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                        irq_set_handler_locked(data, handle_edge_irq);
                        break;
                case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
                        irq_set_handler_locked(data, handle_edge_irq);
                        break;
diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index adf72dda25a2..68a35b65925a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
 */
 struct pcf857x {
        struct gpio_chip        chip;
+        struct irq_chip         irqchip;
        struct i2c_client       *client;
        struct mutex            lock;           /* protect 'out' */
        unsigned                out;            /* software latch */
@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
        mutex_unlock(&gpio->lock);
 }
-static struct irq_chip pcf857x_irq_chip = {
-        .name           = "pcf857x",
-        .irq_enable     = pcf857x_irq_enable,
-        .irq_disable    = pcf857x_irq_disable,
-        .irq_ack        = noop,
-        .irq_mask       = noop,
-        .irq_unmask     = noop,
-        .irq_set_wake   = pcf857x_irq_set_wake,
-        .irq_bus_lock           = pcf857x_irq_bus_lock,
-        .irq_bus_sync_unlock    = pcf857x_irq_bus_sync_unlock,
-};
 /*-------------------------------------------------------------------------*/
 static int pcf857x_probe(struct i2c_client *client,
@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
        /* Enable irqchip if we have an interrupt */
        if (client->irq) {
+                gpio->irqchip.name = "pcf857x",
+                gpio->irqchip.irq_enable = pcf857x_irq_enable,
+                gpio->irqchip.irq_disable = pcf857x_irq_disable,
+                gpio->irqchip.irq_ack = noop,
+                gpio->irqchip.irq_mask = noop,
+                gpio->irqchip.irq_unmask = noop,
+                gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
+                gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
+                gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
                status = gpiochip_irqchip_add_nested(&gpio->chip,
-                                                     &pcf857x_irq_chip,
+                                                     &gpio->irqchip,
                                                     0, handle_level_irq,
                                                     IRQ_TYPE_NONE);
                if (status) {
@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
                if (status)
                        goto fail;
-                gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
+                gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
                                            client->irq);
                gpio->irq_parent = client->irq;
        }
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 1b79ebcfce3e..541fa6ac399d 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -253,6 +253,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
        struct vf610_gpio_port *port;
        struct resource *iores;
        struct gpio_chip *gc;
+        int i;
        int ret;
        port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
@@ -319,6 +320,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
        if (ret < 0)
                return ret;
+        /* Mask all GPIO interrupts */
+        for (i = 0; i < gc->ngpio; i++)
+                vf610_gpio_writel(0, port->base + PORT_PCR(i));
        /* Clear the interrupt status register for all GPIO's */
        vf610_gpio_writel(~0, port->base + PORT_ISFR);
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
        /* Do not leak kernel stack to userspace */
        memset(&ge, 0, sizeof(ge));
-        ge.timestamp = le->timestamp;
+        /*
+         * We may be running from a nested threaded interrupt in which case
+         * we didn't get the timestamp from lineevent_irq_handler().
+         */
+        if (!le->timestamp)
+                ge.timestamp = ktime_get_real_ns();
+        else
+                ge.timestamp = le->timestamp;
        if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
            && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index a028661d9e20..92b11de19581 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -576,6 +576,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
        { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0, 0, 0, 0, 0 },
 };
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
index b8747a5c9204..99d596dc0e89 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
@@ -32,6 +32,7 @@
 #include "vega10_pptable.h"
 #define NUM_DSPCLK_LEVELS 8
+#define VEGA10_ENGINECLOCK_HARDMAX 198000
 static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
                enum phm_platform_caps cap)
@@ -258,7 +259,26 @@ static int init_over_drive_limits(
                struct pp_hwmgr *hwmgr,
                const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
-        hwmgr->platform_descriptor.overdriveLimit.engineClock =
+        const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
+                        (const ATOM_Vega10_GFXCLK_Dependency_Table *)
+                        (((unsigned long) powerplay_table) +
+                        le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
+        bool is_acg_enabled = false;
+        ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
+        if (gfxclk_dep_table->ucRevId == 1) {
+                patom_record_v2 =
+                        (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
+                is_acg_enabled =
+                        (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
+        }
+        if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
+                !is_acg_enabled)
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
+                        VEGA10_ENGINECLOCK_HARDMAX;
+        else
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
                        le32_to_cpu(powerplay_table->ulMaxODEngineClock);
        hwmgr->platform_descriptor.overdriveLimit.memoryClock =
                        le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 5567ddc7760f..55bb7885e228 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -332,6 +332,9 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
        i915_gem_object_unpin_map(wa_ctx->indirect_ctx.obj);
        i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+        wa_ctx->indirect_ctx.obj = NULL;
+        wa_ctx->indirect_ctx.shadow_va = NULL;
 }
 static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
@@ -911,11 +914,6 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
        list_del_init(&workload->list);
-        if (!workload->status) {
-                release_shadow_batch_buffer(workload);
-                release_shadow_wa_ctx(&workload->wa_ctx);
-        }
        if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
                /* if workload->status is not successful means HW GPU
                 * has occurred GPU hang or something wrong with i915/GVT,
@@ -1283,6 +1281,9 @@ void intel_vgpu_destroy_workload(struct intel_vgpu_workload *workload)
 {
        struct intel_vgpu_submission *s = &workload->vgpu->submission;
+        release_shadow_batch_buffer(workload);
+        release_shadow_wa_ctx(&workload->wa_ctx);
        if (workload->shadow_mm)
                intel_vgpu_mm_put(workload->shadow_mm);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 4796f40a6d4f..eab9341a5152 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -303,6 +303,7 @@ static void __unwind_incomplete_requests(struct intel_engine_cs *engine)
         */
        if (!(prio & I915_PRIORITY_NEWCLIENT)) {
                prio |= I915_PRIORITY_NEWCLIENT;
+                active->sched.attr.priority = prio;
                list_move_tail(&active->sched.link,
                               i915_sched_lookup_priolist(engine, prio));
        }
@@ -645,6 +646,9 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
                int i;
                priolist_for_each_request_consume(rq, rn, p, i) {
+                        GEM_BUG_ON(last &&
+                                   need_preempt(engine, last, rq_prio(rq)));
                        /*
                         * Can we combine this request with the current port?
                         * It has to be the same context/ringbuffer and not
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 5beb83d1cf87..ce1b3cc4bf6d 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -944,7 +944,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
        np = dev_pm_opp_get_of_node(opp);
        if (np) {
-                of_property_read_u32(np, "qcom,level", &val);
+                of_property_read_u32(np, "opp-level", &val);
                of_node_put(np);
        }
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 2e4372ef17a3..2cfee1a4fe0b 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -765,7 +765,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
        adreno_gpu->rev = config->rev;
        adreno_gpu_config.ioname = "kgsl_3d0_reg_memory";
-        adreno_gpu_config.irqname = "kgsl_3d0_irq";
        adreno_gpu_config.va_start = SZ_16M;
        adreno_gpu_config.va_end = 0xffffffff;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index fd75870eb17f..6aefcd6db46b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -365,19 +365,6 @@ static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane,
                        &pdpu->pipe_qos_cfg);
 }
-static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
-{
-        struct dpu_plane *pdpu = to_dpu_plane(plane);
-        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
-        if (!pdpu->is_rt_pipe)
-                return;
-        pm_runtime_get_sync(&dpu_kms->pdev->dev);
-        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
-        pm_runtime_put_sync(&dpu_kms->pdev->dev);
-}
 /**
 * _dpu_plane_set_ot_limit - set OT limit for the given plane
 * @plane:              Pointer to drm plane
@@ -1248,6 +1235,19 @@ static void dpu_plane_reset(struct drm_plane *plane)
 }
 #ifdef CONFIG_DEBUG_FS
+static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
+{
+        struct dpu_plane *pdpu = to_dpu_plane(plane);
+        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+        if (!pdpu->is_rt_pipe)
+                return;
+        pm_runtime_get_sync(&dpu_kms->pdev->dev);
+        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
+        pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
 static ssize_t _dpu_plane_danger_read(struct file *file,
                        char __user *buff, size_t count, loff_t *ppos)
 {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 9cd6a96c6bf2..927e5d86f7c1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -250,7 +250,8 @@ void msm_gem_purge_vma(struct msm_gem_address_space *aspace,
 void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                struct msm_gem_vma *vma);
 int msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages);
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages);
 void msm_gem_close_vma(struct msm_gem_address_space *aspace,
                struct msm_gem_vma *vma);
@@ -333,6 +334,7 @@ void msm_gem_kernel_put(struct drm_gem_object *bo,
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
                struct dma_buf *dmabuf, struct sg_table *sgt);
+__printf(2, 3)
 void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
 int msm_framebuffer_prepare(struct drm_framebuffer *fb,
@@ -396,12 +398,14 @@ void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m);
 int msm_debugfs_late_init(struct drm_device *dev);
 int msm_rd_debugfs_init(struct drm_minor *minor);
 void msm_rd_debugfs_cleanup(struct msm_drm_private *priv);
+__printf(3, 4)
 void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                const char *fmt, ...);
 int msm_perf_debugfs_init(struct drm_minor *minor);
 void msm_perf_debugfs_cleanup(struct msm_drm_private *priv);
 #else
 static inline int msm_debugfs_late_init(struct drm_device *dev) { return 0; }
+__printf(3, 4)
 static inline void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                const char *fmt, ...) {}
 static inline void msm_rd_debugfs_cleanup(struct msm_drm_private *priv) {}
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 51a95da694d8..c8886d3071fa 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -391,6 +391,10 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
        struct msm_gem_vma *vma;
        struct page **pages;
+        int prot = IOMMU_READ;
+        if (!(msm_obj->flags & MSM_BO_GPU_READONLY))
+                prot |= IOMMU_WRITE;
        WARN_ON(!mutex_is_locked(&msm_obj->lock));
@@ -405,8 +409,8 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
        if (IS_ERR(pages))
                return PTR_ERR(pages);
-        return msm_gem_map_vma(aspace, vma, msm_obj->sgt,
+        return msm_gem_map_vma(aspace, vma, prot,
-                        obj->size >> PAGE_SHIFT);
+                        msm_obj->sgt, obj->size >> PAGE_SHIFT);
 }
 /* get iova and pin it. Should have a matching put */
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 557360788084..49c04829cf34 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -68,7 +68,8 @@ void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
 int
 msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages)
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages)
 {
        unsigned size = npages << PAGE_SHIFT;
        int ret = 0;
@@ -86,7 +87,7 @@ msm_gem_map_vma(struct msm_gem_address_space *aspace,
        if (aspace->mmu)
                ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt,
-                                size, IOMMU_READ | IOMMU_WRITE);
+                                size, prot);
        if (ret)
                vma->mapped = false;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 5f3eff304355..10babd18e286 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -900,7 +900,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
        }
        /* Get Interrupt: */
-        gpu->irq = platform_get_irq_byname(pdev, config->irqname);
+        gpu->irq = platform_get_irq(pdev, 0);
        if (gpu->irq < 0) {
                ret = gpu->irq;
                DRM_DEV_ERROR(drm->dev, "failed to get irq: %d\n", ret);
diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
index efb49bb64191..ca17086f72c9 100644
--- a/drivers/gpu/drm/msm/msm_gpu.h
+++ b/drivers/gpu/drm/msm/msm_gpu.h
@@ -31,7 +31,6 @@ struct msm_gpu_state;
 struct msm_gpu_config {
        const char *ioname;
-        const char *irqname;
        uint64_t va_start;
        uint64_t va_end;
        unsigned int nr_rings;
@@ -63,7 +62,7 @@ struct msm_gpu_funcs {
        struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
        void (*recover)(struct msm_gpu *gpu);
        void (*destroy)(struct msm_gpu *gpu);
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
        /* show GPU status in debugfs: */
        void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
                        struct drm_printer *p);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 90e9d0a48dc0..d21172933d92 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
                char *fptr = &fifo->buf[fifo->head];
                int n;
-                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
+                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
+                if (!rd->open)
+                        return;
                /* Note that smp_load_acquire() is not strictly required
                 * as CIRC_SPACE_TO_END() does not access the tail more
@@ -213,7 +215,10 @@ out:
 static int rd_release(struct inode *inode, struct file *file)
 {
        struct msm_rd_state *rd = inode->i_private;
        rd->open = false;
+        wake_up_all(&rd->fifo_event);
        return 0;
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 061d2e0d9011..416da5376701 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
        val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
        val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
        writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+        clk_disable_unprepare(hdmi->tmds_clk);
 }
 static void sun4i_hdmi_enable(struct drm_encoder *encoder)
@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
        DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
+        clk_prepare_enable(hdmi->tmds_clk);
        sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
        val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
        val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f41d5fe51abe..9993b692598f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -125,6 +125,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 {
        struct hid_collection *collection;
        unsigned usage;
+        int collection_index;
        usage = parser->local.usage[0];
@@ -167,13 +168,13 @@ static int open_collection(struct hid_parser *parser, unsigned type)
        parser->collection_stack[parser->collection_stack_ptr++] =
                parser->device->maxcollection;
-        collection = parser->device->collection +
+        collection_index = parser->device->maxcollection++;
-                parser->device->maxcollection++;
+        collection = parser->device->collection + collection_index;
        collection->type = type;
        collection->usage = usage;
        collection->level = parser->collection_stack_ptr - 1;
-        collection->parent = parser->active_collection;
+        collection->parent_idx = (collection->level == 0) ? -1 :
-        parser->active_collection = collection;
+                parser->collection_stack[collection->level - 1];
        if (type == HID_COLLECTION_APPLICATION)
                parser->device->maxapplication++;
@@ -192,8 +193,6 @@ static int close_collection(struct hid_parser *parser)
                return -EINVAL;
        }
        parser->collection_stack_ptr--;
-        if (parser->active_collection)
-                parser->active_collection = parser->active_collection->parent;
        return 0;
 }
@@ -1006,10 +1005,12 @@ static void hid_apply_multiplier_to_field(struct hid_device *hid,
                usage = &field->usage[i];
                collection = &hid->collection[usage->collection_index];
-                while (collection && collection != multiplier_collection)
+                while (collection->parent_idx != -1 &&
-                        collection = collection->parent;
+                       collection != multiplier_collection)
+                        collection = &hid->collection[collection->parent_idx];
-                if (collection || multiplier_collection == NULL)
+                if (collection->parent_idx != -1 ||
+                    multiplier_collection == NULL)
                        usage->resolution_multiplier = effective_multiplier;
        }
@@ -1044,9 +1045,9 @@ static void hid_apply_multiplier(struct hid_device *hid,
         * applicable fields later.
         */
        multiplier_collection = &hid->collection[multiplier->usage->collection_index];
-        while (multiplier_collection &&
+        while (multiplier_collection->parent_idx != -1 &&
               multiplier_collection->type != HID_COLLECTION_LOGICAL)
-                multiplier_collection = multiplier_collection->parent;
+                multiplier_collection = &hid->collection[multiplier_collection->parent_idx];
        effective_multiplier = hid_calculate_multiplier(hid, multiplier);
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c530476edba6..ac9fda1b5a72 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -30,6 +30,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/kfifo.h>
 #include <linux/sched/signal.h>
 #include <linux/export.h>
 #include <linux/slab.h>
@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
 /* enqueue string to 'events' ring buffer */
 void hid_debug_event(struct hid_device *hdev, char *buf)
 {
-        unsigned i;
        struct hid_debug_list *list;
        unsigned long flags;
        spin_lock_irqsave(&hdev->debug_list_lock, flags);
-        list_for_each_entry(list, &hdev->debug_list, node) {
+        list_for_each_entry(list, &hdev->debug_list, node)
-                for (i = 0; buf[i]; i++)
+                kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
-                        list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
-                                buf[i];
-                list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
-        }
        spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
        wake_up_interruptible(&hdev->debug_wait);
@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
        hid_debug_event(hdev, buf);
        kfree(buf);
-        wake_up_interruptible(&hdev->debug_wait);
+        wake_up_interruptible(&hdev->debug_wait);
 }
 EXPORT_SYMBOL_GPL(hid_dump_input);
@@ -1083,8 +1078,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
                goto out;
        }
-        if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
+        err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
-                err = -ENOMEM;
+        if (err) {
                kfree(list);
                goto out;
        }
@@ -1104,77 +1099,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
                size_t count, loff_t *ppos)
 {
        struct hid_debug_list *list = file->private_data;
-        int ret = 0, len;
+        int ret = 0, copied;
        DECLARE_WAITQUEUE(wait, current);
        mutex_lock(&list->read_mutex);
-        while (ret == 0) {
+        if (kfifo_is_empty(&list->hid_debug_fifo)) {
-                if (list->head == list->tail) {
+                add_wait_queue(&list->hdev->debug_wait, &wait);
-                        add_wait_queue(&list->hdev->debug_wait, &wait);
+                set_current_state(TASK_INTERRUPTIBLE);
-                        set_current_state(TASK_INTERRUPTIBLE);
+                while (kfifo_is_empty(&list->hid_debug_fifo)) {
-                        while (list->head == list->tail) {
+                        if (file->f_flags & O_NONBLOCK) {
-                                if (file->f_flags & O_NONBLOCK) {
+                                ret = -EAGAIN;
-                                        ret = -EAGAIN;
+                                break;
-                                        break;
+                        }
-                                }
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
-                                if (!list->hdev || !list->hdev->debug) {
+                        if (signal_pending(current)) {
-                                        ret = -EIO;
+                                ret = -ERESTARTSYS;
-                                        set_current_state(TASK_RUNNING);
+                                break;
-                                        goto out;
+                        }
-                                }
-                                /* allow O_NONBLOCK from other threads */
+                        /* if list->hdev is NULL we cannot remove_wait_queue().
-                                mutex_unlock(&list->read_mutex);
+                         * if list->hdev->debug is 0 then hid_debug_unregister()
-                                schedule();
+                         * was already called and list->hdev is being destroyed.
-                                mutex_lock(&list->read_mutex);
+                         * if we add remove_wait_queue() here we can hit a race.
-                                set_current_state(TASK_INTERRUPTIBLE);
+                         */
+                        if (!list->hdev || !list->hdev->debug) {
+                                ret = -EIO;
+                                set_current_state(TASK_RUNNING);
+                                goto out;
                        }
-                        set_current_state(TASK_RUNNING);
+                        /* allow O_NONBLOCK from other threads */
-                        remove_wait_queue(&list->hdev->debug_wait, &wait);
+                        mutex_unlock(&list->read_mutex);
+                        schedule();
+                        mutex_lock(&list->read_mutex);
+                        set_current_state(TASK_INTERRUPTIBLE);
                }
-                if (ret)
+                __set_current_state(TASK_RUNNING);
-                        goto out;
+                remove_wait_queue(&list->hdev->debug_wait, &wait);
-                /* pass the ringbuffer contents to userspace */
+                if (ret)
-copy_rest:
-                if (list->tail == list->head)
                        goto out;
-                if (list->tail > list->head) {
-                        len = list->tail - list->head;
-                        if (len > count)
-                                len = count;
-                        if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        ret += len;
-                        list->head += len;
-                } else {
-                        len = HID_DEBUG_BUFSIZE - list->head;
-                        if (len > count)
-                                len = count;
-                        if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        list->head = 0;
-                        ret += len;
-                        count -= len;
-                        if (count > 0)
-                                goto copy_rest;
-                }
        }
+        /* pass the fifo content to userspace, locking is not needed with only
+         * one concurrent reader and one concurrent writer
+         */
+        ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
+        if (ret)
+                goto out;
+        ret = copied;
 out:
        mutex_unlock(&list->read_mutex);
        return ret;
@@ -1185,7 +1160,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
        struct hid_debug_list *list = file->private_data;
        poll_wait(file, &list->hdev->debug_wait, wait);
-        if (list->head != list->tail)
+        if (!kfifo_is_empty(&list->hid_debug_fifo))
                return EPOLLIN | EPOLLRDNORM;
        if (!list->hdev->debug)
                return EPOLLERR | EPOLLHUP;
@@ -1200,7 +1175,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
        spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
        list_del(&list->node);
        spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
-        kfree(list->hid_debug_buf);
+        kfifo_free(&list->hid_debug_fifo);
        kfree(list);
        return 0;
@@ -1246,4 +1221,3 @@ void hid_debug_exit(void)
 {
        debugfs_remove_recursive(hid_debug_root);
 }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 518fa76414f5..24f846d67478 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -461,6 +461,9 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+#define I2C_VENDOR_ID_GOODIX            0x27c6
+#define I2C_DEVICE_ID_GOODIX_01F0       0x01f0
 #define USB_VENDOR_ID_GOODTOUCH         0x1aad
 #define USB_DEVICE_ID_GOODTOUCH_000f    0x000f
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 8555ce7e737b..c5edfa966343 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks {
                I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
                I2C_HID_QUIRK_NO_RUNTIME_PM },
+        { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
        { 0, 0 }
 };
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index ce0ba2062723..bea4c9850247 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -701,19 +701,12 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
 int vmbus_disconnect_ring(struct vmbus_channel *channel)
 {
        struct vmbus_channel *cur_channel, *tmp;
-        unsigned long flags;
-        LIST_HEAD(list);
        int ret;
        if (channel->primary_channel != NULL)
                return -EINVAL;
-        /* Snapshot the list of subchannels */
+        list_for_each_entry_safe(cur_channel, tmp, &channel->sc_list, sc_list) {
-        spin_lock_irqsave(&channel->lock, flags);
-        list_splice_init(&channel->sc_list, &list);
-        spin_unlock_irqrestore(&channel->lock, flags);
-        list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
                if (cur_channel->rescind)
                        wait_for_completion(&cur_channel->rescind_event);
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index 5301fef16c31..7c6349a50ef1 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -888,12 +888,14 @@ static unsigned long handle_pg_range(unsigned long pg_start,
                        pfn_cnt -= pgs_ol;
                        /*
                         * Check if the corresponding memory block is already
-                         * online by checking its last previously backed page.
+                         * online. It is possible to observe struct pages still
-                         * In case it is we need to bring rest (which was not
+                         * being uninitialized here so check section instead.
-                         * backed previously) online too.
+                         * In case the section is online we need to bring the
+                         * rest of pfns (which were not backed previously)
+                         * online too.
                         */
                        if (start_pfn > has->start_pfn &&
-                            !PageReserved(pfn_to_page(start_pfn - 1)))
+                            online_section_nr(pfn_to_section_nr(start_pfn)))
                                hv_bring_pgs_online(has, start_pfn, pgs_ol);
                }
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 64d0c85d5161..1f1a55e07733 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -164,26 +164,25 @@ hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
 }
 /* Get various debug metrics for the specified ring buffer. */
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                                 struct hv_ring_buffer_debug_info *debug_info)
+                                struct hv_ring_buffer_debug_info *debug_info)
 {
        u32 bytes_avail_towrite;
        u32 bytes_avail_toread;
-        if (ring_info->ring_buffer) {
+        if (!ring_info->ring_buffer)
-                hv_get_ringbuffer_availbytes(ring_info,
+                return -EINVAL;
-                                        &bytes_avail_toread,
-                                        &bytes_avail_towrite);
+        hv_get_ringbuffer_availbytes(ring_info,
+                                     &bytes_avail_toread,
-                debug_info->bytes_avail_toread = bytes_avail_toread;
+                                     &bytes_avail_towrite);
-                debug_info->bytes_avail_towrite = bytes_avail_towrite;
+        debug_info->bytes_avail_toread = bytes_avail_toread;
-                debug_info->current_read_index =
+        debug_info->bytes_avail_towrite = bytes_avail_towrite;
-                        ring_info->ring_buffer->read_index;
+        debug_info->current_read_index = ring_info->ring_buffer->read_index;
-                debug_info->current_write_index =
+        debug_info->current_write_index = ring_info->ring_buffer->write_index;
-                        ring_info->ring_buffer->write_index;
+        debug_info->current_interrupt_mask
-                debug_info->current_interrupt_mask =
+                = ring_info->ring_buffer->interrupt_mask;
-                        ring_info->ring_buffer->interrupt_mask;
+        return 0;
-        }
 }
 EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo);
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index d0ff65675292..403fee01572c 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -313,12 +313,16 @@ static ssize_t out_intr_mask_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(out_intr_mask);
@@ -328,12 +332,15 @@ static ssize_t out_read_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_read_index);
 }
 static DEVICE_ATTR_RO(out_read_index);
@@ -344,12 +351,15 @@ static ssize_t out_write_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_write_index);
 }
 static DEVICE_ATTR_RO(out_write_index);
@@ -360,12 +370,15 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(out_read_bytes_avail);
@@ -376,12 +389,15 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(out_write_bytes_avail);
@@ -391,12 +407,15 @@ static ssize_t in_intr_mask_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(in_intr_mask);
@@ -406,12 +425,15 @@ static ssize_t in_read_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_read_index);
 }
 static DEVICE_ATTR_RO(in_read_index);
@@ -421,12 +443,15 @@ static ssize_t in_write_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_write_index);
 }
 static DEVICE_ATTR_RO(in_write_index);
@@ -437,12 +462,15 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(in_read_bytes_avail);
@@ -453,12 +481,15 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(in_write_bytes_avail);
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c39f89d2deba..2dc628d4f1ae 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1828,7 +1828,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
        ret = i3c_master_retrieve_dev_info(newdev);
        if (ret)
-                goto err_free_dev;
+                goto err_detach_dev;
        olddev = i3c_master_search_i3c_dev_duplicate(newdev);
        if (olddev) {
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index f8c00b94817f..bb03079fbade 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -419,12 +419,9 @@ static void dw_i3c_master_enqueue_xfer(struct dw_i3c_master *master,
        spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
-static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+static void dw_i3c_master_dequeue_xfer_locked(struct dw_i3c_master *master,
-                                       struct dw_i3c_xfer *xfer)
+                                              struct dw_i3c_xfer *xfer)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&master->xferqueue.lock, flags);
        if (master->xferqueue.cur == xfer) {
                u32 status;
@@ -439,6 +436,15 @@ static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
        } else {
                list_del_init(&xfer->node);
        }
+}
+static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+                                       struct dw_i3c_xfer *xfer)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&master->xferqueue.lock, flags);
+        dw_i3c_master_dequeue_xfer_locked(master, xfer);
        spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
@@ -494,7 +500,7 @@ static void dw_i3c_master_end_xfer_locked(struct dw_i3c_master *master, u32 isr)
        complete(&xfer->comp);
        if (ret < 0) {
-                dw_i3c_master_dequeue_xfer(master, xfer);
+                dw_i3c_master_dequeue_xfer_locked(master, xfer);
                writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_RESUME,
                       master->regs + DEVICE_CTRL);
        }
diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
index da58020a144e..33a28cde126c 100644
--- a/drivers/ide/ide-atapi.c
+++ b/drivers/ide/ide-atapi.c
@@ -235,21 +235,28 @@ EXPORT_SYMBOL_GPL(ide_prep_sense);
 int ide_queue_sense_rq(ide_drive_t *drive, void *special)
 {
-        struct request *sense_rq = drive->sense_rq;
+        ide_hwif_t *hwif = drive->hwif;
+        struct request *sense_rq;
+        unsigned long flags;
+        spin_lock_irqsave(&hwif->lock, flags);
        /* deferred failure from ide_prep_sense() */
        if (!drive->sense_rq_armed) {
                printk(KERN_WARNING PFX "%s: error queuing a sense request\n",
                       drive->name);
+                spin_unlock_irqrestore(&hwif->lock, flags);
                return -ENOMEM;
        }
+        sense_rq = drive->sense_rq;
        ide_req(sense_rq)->special = special;
        drive->sense_rq_armed = false;
        drive->hwif->rq = NULL;
        ide_insert_request_head(drive, sense_rq);
+        spin_unlock_irqrestore(&hwif->lock, flags);
        return 0;
 }
 EXPORT_SYMBOL_GPL(ide_queue_sense_rq);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 8445b484ae69..b137f27a34d5 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -68,8 +68,10 @@ int ide_end_rq(ide_drive_t *drive, struct request *rq, blk_status_t error,
        }
        if (!blk_update_request(rq, error, nr_bytes)) {
-                if (rq == drive->sense_rq)
+                if (rq == drive->sense_rq) {
                        drive->sense_rq = NULL;
+                        drive->sense_rq_active = false;
+                }
                __blk_mq_end_request(rq, error);
                return 0;
@@ -451,16 +453,11 @@ void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq)
                blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3);
 }
-/*
+blk_status_t ide_issue_rq(ide_drive_t *drive, struct request *rq,
- * Issue a new request to a device.
+                          bool local_requeue)
- */
-blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
-                          const struct blk_mq_queue_data *bd)
 {
-        ide_drive_t     *drive = hctx->queue->queuedata;
+        ide_hwif_t *hwif = drive->hwif;
-        ide_hwif_t      *hwif = drive->hwif;
        struct ide_host *host = hwif->host;
-        struct request  *rq = bd->rq;
        ide_startstop_t startstop;
        if (!blk_rq_is_passthrough(rq) && !(rq->rq_flags & RQF_DONTPREP)) {
@@ -474,8 +471,6 @@ blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
        if (ide_lock_host(host, hwif))
                return BLK_STS_DEV_RESOURCE;
-        blk_mq_start_request(rq);
        spin_lock_irq(&hwif->lock);
        if (!ide_lock_port(hwif)) {
@@ -511,18 +506,6 @@ repeat:
                drive->dev_flags &= ~(IDE_DFLAG_SLEEPING | IDE_DFLAG_PARKED);
                /*
-                 * we know that the queue isn't empty, but this can happen
-                 * if ->prep_rq() decides to kill a request
-                 */
-                if (!rq) {
-                        rq = bd->rq;
-                        if (!rq) {
-                                ide_unlock_port(hwif);
-                                goto out;
-                        }
-                }
-                /*
                 * Sanity: don't accept a request that isn't a PM request
                 * if we are currently power managed. This is very important as
                 * blk_stop_queue() doesn't prevent the blk_fetch_request()
@@ -560,9 +543,12 @@ repeat:
                }
        } else {
 plug_device:
+                if (local_requeue)
+                        list_add(&rq->queuelist, &drive->rq_list);
                spin_unlock_irq(&hwif->lock);
                ide_unlock_host(host);
-                ide_requeue_and_plug(drive, rq);
+                if (!local_requeue)
+                        ide_requeue_and_plug(drive, rq);
                return BLK_STS_OK;
        }
@@ -573,6 +559,26 @@ out:
        return BLK_STS_OK;
 }
+/*
+ * Issue a new request to a device.
+ */
+blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *hctx,
+                          const struct blk_mq_queue_data *bd)
+{
+        ide_drive_t *drive = hctx->queue->queuedata;
+        ide_hwif_t *hwif = drive->hwif;
+        spin_lock_irq(&hwif->lock);
+        if (drive->sense_rq_active) {
+                spin_unlock_irq(&hwif->lock);
+                return BLK_STS_DEV_RESOURCE;
+        }
+        spin_unlock_irq(&hwif->lock);
+        blk_mq_start_request(bd->rq);
+        return ide_issue_rq(drive, bd->rq, false);
+}
 static int drive_is_ready(ide_drive_t *drive)
 {
        ide_hwif_t *hwif = drive->hwif;
@@ -893,13 +899,8 @@ EXPORT_SYMBOL_GPL(ide_pad_transfer);
 void ide_insert_request_head(ide_drive_t *drive, struct request *rq)
 {
-        ide_hwif_t *hwif = drive->hwif;
+        drive->sense_rq_active = true;
-        unsigned long flags;
-        spin_lock_irqsave(&hwif->lock, flags);
        list_add_tail(&rq->queuelist, &drive->rq_list);
-        spin_unlock_irqrestore(&hwif->lock, flags);
        kblockd_schedule_work(&drive->rq_work);
 }
 EXPORT_SYMBOL_GPL(ide_insert_request_head);
diff --git a/drivers/ide/ide-park.c b/drivers/ide/ide-park.c
index 102aa3bc3e7f..8af7af6001eb 100644
--- a/drivers/ide/ide-park.c
+++ b/drivers/ide/ide-park.c
@@ -54,7 +54,9 @@ static void issue_park_cmd(ide_drive_t *drive, unsigned long timeout)
        scsi_req(rq)->cmd[0] = REQ_UNPARK_HEADS;
        scsi_req(rq)->cmd_len = 1;
        ide_req(rq)->type = ATA_PRIV_MISC;
+        spin_lock_irq(&hwif->lock);
        ide_insert_request_head(drive, rq);
+        spin_unlock_irq(&hwif->lock);
 out:
        return;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 63627be0811a..5aeaca24a28f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1159,18 +1159,27 @@ static void drive_rq_insert_work(struct work_struct *work)
        ide_drive_t *drive = container_of(work, ide_drive_t, rq_work);
        ide_hwif_t *hwif = drive->hwif;
        struct request *rq;
+        blk_status_t ret;
        LIST_HEAD(list);
-        spin_lock_irq(&hwif->lock);
+        blk_mq_quiesce_queue(drive->queue);
-        if (!list_empty(&drive->rq_list))
-                list_splice_init(&drive->rq_list, &list);
-        spin_unlock_irq(&hwif->lock);
-        while (!list_empty(&list)) {
+        ret = BLK_STS_OK;
-                rq = list_first_entry(&list, struct request, queuelist);
+        spin_lock_irq(&hwif->lock);
+        while (!list_empty(&drive->rq_list)) {
+                rq = list_first_entry(&drive->rq_list, struct request, queuelist);
                list_del_init(&rq->queuelist);
-                blk_execute_rq_nowait(drive->queue, rq->rq_disk, rq, true, NULL);
+                spin_unlock_irq(&hwif->lock);
+                ret = ide_issue_rq(drive, rq, true);
+                spin_lock_irq(&hwif->lock);
        }
+        spin_unlock_irq(&hwif->lock);
+        blk_mq_unquiesce_queue(drive->queue);
+        if (ret != BLK_STS_OK)
+                kblockd_schedule_work(&drive->rq_work);
 }
 static const u8 ide_hwif_to_major[] =
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 4c8c7a620d08..a5dc13576394 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -544,7 +544,7 @@ void ide_proc_port_register_devices(ide_hwif_t *hwif)
                drive->proc = proc_mkdir(drive->name, parent);
                if (drive->proc) {
                        ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
-                        proc_create_data("setting", S_IFREG|S_IRUSR|S_IWUSR,
+                        proc_create_data("settings", S_IFREG|S_IRUSR|S_IWUSR,
                                        drive->proc, &ide_settings_proc_fops,
                                        drive);
                }
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
        down_read(&lists_rwsem);
        device = __ib_device_get_by_index(index);
        if (device) {
-                /* Do not return a device if unregistration has started. */
+                if (!ib_device_try_get(device))
-                if (!refcount_inc_not_zero(&device->refcount))
                        device = NULL;
        }
        up_read(&lists_rwsem);
        return device;
 }
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
        if (refcount_dec_and_test(&device->refcount))
                complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
        rwlock_init(&device->client_data_lock);
        INIT_LIST_HEAD(&device->client_data_list);
        INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
        init_completion(&device->unreg_completion);
        return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                goto cg_cleanup;
        }
+        refcount_set(&device->refcount, 1);
        device->reg_state = IB_DEV_REGISTERED;
        list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
        umem->writable   = 1;
        umem->is_odp = 1;
        odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
        mutex_init(&odp_data->umem_mutex);
        init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
        vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
        kfree(odp_data);
        return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 2890a77339e1..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
        if (atomic_dec_and_test(&file->device->refcount))
                ib_uverbs_comp_dev(file->device);
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
        put_device(&file->device->dev);
        kfree(file);
 }
@@ -964,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
                /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
+                while (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
+                        int ret;
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
+                        priv = list_first_entry(&ufile->umaps,
-                        mmget(mm);
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                }
                mutex_unlock(&ufile->umap_lock);
                if (!mm)
@@ -1096,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
        list_del_init(&file->list);
        mutex_unlock(&file->device->lists_mutex);
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
        kref_put(&file->ref, ib_uverbs_release_file);
        return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
        struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
        struct ib_port_attr attr = {};
        struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
        int ret;
        u8 port_num;
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
        /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
        if (!ib_dev->ops.query_port)
                return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                vmf = 1;
                break;
        case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                        ret = -EPERM;
                        goto done;
                }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
            opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
        } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                wc.ex.imm_data = 0;
                wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                   struct ib_udata *udata)
 {
        struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
        struct hns_roce_srq *srq;
        int srq_desc_size;
        int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
        srq->event = hns_roce_ib_srq_event;
        srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
        if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                        ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                }
        }
        return &srq->ibsrq;
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
 err_wrid:
        kvfree(srq->wrid);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
        sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
        if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
        sqp->tx_ring[wire_tx_ix].ah = ah;
        ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                   sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                if (wc.status == IB_WC_SUCCESS) {
                        switch (wc.opcode) {
                        case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                              (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                        = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                 " status = %d, wrid = 0x%llx\n",
                                 ctx->slave, wc.status, wc.wr_id);
                        if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                              (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                        = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
        UAPI_DEF_CHAIN_OBJ_TREE(
                UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
+                &mlx5_ib_fs),
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
        UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                &mlx5_ib_flow_actions),
        {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
        struct prefetch_mr_work *w =
                container_of(work, struct prefetch_mr_work, work);
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                         w->num_sge);
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
        kfree(w);
 }
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                num_sge);
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
        work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
        if (!work)
                return -ENOMEM;
        memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
+        get_device(&dev->ib_dev.dev);
        work->dev = dev;
        work->pf_flags = pf_flags;
        work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                }
                if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                      MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_TYPE_DCT |
+                                      MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
                        return -EINVAL;
                err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
            opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                wc.ex.imm_data = ohdr->u.ud.imm_data;
                wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
        } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                wc.ex.imm_data = 0;
                wc.wc_flags = 0;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                        goto op_err;
                if (!ret)
                        goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                break;
        case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
        goto err;
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
        wc.status = IB_WC_LOC_QP_OP_ERR;
        goto err;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
        struct list_head     list;
        struct net_device   *dev;
        struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
        struct ipoib_tx_buf *tx_ring;
        unsigned int         tx_head;
        unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
        neigh->cm = tx;
        tx->neigh = neigh;
-        tx->path = path;
        tx->dev = dev;
        list_add(&tx->list, &priv->cm.start_list);
        set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                        goto free_neigh;
                }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
                spin_unlock_irqrestore(&priv->lock, flags);
                netif_tx_unlock_bh(dev);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index cfc8b94527b9..aa4e431cbcd3 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,8 @@ static const struct xpad_device {
        { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
        { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
        { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+        { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+        { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
        { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
        { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -428,6 +430,7 @@ static const struct usb_device_id xpad_table[] = {
        XPAD_XBOXONE_VENDOR(0x0e6f),            /* 0x0e6f X-Box One controllers */
        XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
        XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
        XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
        XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
        XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 8ec483e8688b..26ec603fe220 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -39,6 +39,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/overflow.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                                   const struct input_absinfo *abs)
 {
-        int min, max;
+        int min, max, range;
        min = abs->minimum;
        max = abs->maximum;
@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                return -EINVAL;
        }
-        if (abs->flat > max - min) {
+        if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
                printk(KERN_DEBUG
                       "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
                       UINPUT_NAME, code, abs->flat, min, max);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index b36084710f69..a7cfab3db9ee 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/clk.h>
 /*
 * The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -75,7 +74,6 @@ struct olpc_apsp {
        struct serio *kbio;
        struct serio *padio;
        void __iomem *base;
-        struct clk *clk;
        int open_count;
        int irq;
 };
@@ -148,17 +146,11 @@ static int olpc_apsp_open(struct serio *port)
        struct olpc_apsp *priv = port->port_data;
        unsigned int tmp;
        unsigned long l;
-        int error;
        if (priv->open_count++ == 0) {
-                error = clk_prepare_enable(priv->clk);
-                if (error)
-                        return error;
                l = readl(priv->base + COMMAND_FIFO_STATUS);
                if (!(l & CMD_STS_MASK)) {
                        dev_err(priv->dev, "SP cannot accept commands.\n");
-                        clk_disable_unprepare(priv->clk);
                        return -EIO;
                }
@@ -179,8 +171,6 @@ static void olpc_apsp_close(struct serio *port)
                /* Disable interrupt 0 */
                tmp = readl(priv->base + PJ_INTERRUPT_MASK);
                writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
-                clk_disable_unprepare(priv->clk);
        }
 }
@@ -195,6 +185,8 @@ static int olpc_apsp_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
+        priv->dev = &pdev->dev;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        priv->base = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(priv->base)) {
@@ -206,10 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
        if (priv->irq < 0)
                return priv->irq;
-        priv->clk = devm_clk_get(&pdev->dev, "sp");
-        if (IS_ERR(priv->clk))
-                return PTR_ERR(priv->clk);
        /* KEYBOARD */
        kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
        if (!kb_serio)
@@ -248,7 +236,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
                goto err_irq;
        }
-        priv->dev = &pdev->dev;
        device_init_wakeup(priv->dev, 1);
        platform_set_drvdata(pdev, priv);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index af6027cc7bbf..068dbbc610fc 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -698,7 +698,7 @@ config TOUCHSCREEN_EDT_FT5X06
 config TOUCHSCREEN_RASPBERRYPI_FW
        tristate "Raspberry Pi's firmware base touch screen support"
-        depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
+        depends on RASPBERRYPI_FIRMWARE || (RASPBERRYPI_FIRMWARE=n && COMPILE_TEST)
        help
          Say Y here if you have the official Raspberry Pi 7 inch screen on
          your system.
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 87ba23a75b38..2a7b78bb98b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1991,16 +1991,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
 static void do_detach(struct iommu_dev_data *dev_data)
 {
+        struct protection_domain *domain = dev_data->domain;
        struct amd_iommu *iommu;
        u16 alias;
        iommu = amd_iommu_rlookup_table[dev_data->devid];
        alias = dev_data->alias;
-        /* decrease reference counters */
-        dev_data->domain->dev_iommu[iommu->index] -= 1;
-        dev_data->domain->dev_cnt                 -= 1;
        /* Update data structures */
        dev_data->domain = NULL;
        list_del(&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
        /* Flush the DTE entry */
        device_flush_dte(dev_data);
+        /* Flush IOTLB */
+        domain_flush_tlb_pde(domain);
+        /* Wait for the flushes to finish */
+        domain_flush_complete(domain);
+        /* decrease reference counters - needs to happen after the flushes */
+        domain->dev_iommu[iommu->index] -= 1;
+        domain->dev_cnt                 -= 1;
 }
 /*
@@ -2617,13 +2624,13 @@ out_unmap:
                        bus_addr  = address + s->dma_address + (j << PAGE_SHIFT);
                        iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
-                        if (--mapped_pages)
+                        if (--mapped_pages == 0)
                                goto out_free_iova;
                }
        }
 out_free_iova:
-        free_iova_fast(&dma_dom->iovad, address, npages);
+        free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
 out_err:
        return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2bd9ac285c0d..1457f931218e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -5294,7 +5294,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
        struct iommu_resv_region *entry, *next;
        list_for_each_entry_safe(entry, next, head, list) {
-                if (entry->type == IOMMU_RESV_RESERVED)
+                if (entry->type == IOMMU_RESV_MSI)
                        kfree(entry);
        }
 }
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 730f7dabcf37..7e0df67bd3e9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -441,6 +441,10 @@ static int mtk_iommu_add_device(struct device *dev)
                iommu_spec.args_count = count;
                mtk_iommu_create_mapping(dev, &iommu_spec);
+                /* dev->iommu_fwspec might have changed */
+                fwspec = dev_iommu_fwspec_get(dev);
                of_node_put(iommu_spec.np);
        }
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index d8947b28db2d..f04a6df65eb8 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -224,7 +224,7 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
         * If we have reason to believe the IOMMU driver missed the initial
         * probe for dev, replay it to get things in order.
         */
-        if (dev->bus && !device_iommu_mapped(dev))
+        if (!err && dev->bus && !device_iommu_mapped(dev))
                err = iommu_probe_device(dev);
        /* Ignore all other errors apart from EPROBE_DEFER */
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index fb7157188294..666f5986b0ce 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2405,13 +2405,14 @@ static void its_free_device(struct its_device *its_dev)
        kfree(its_dev);
 }
-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
 {
        int idx;
-        idx = find_first_zero_bit(dev->event_map.lpi_map,
+        idx = bitmap_find_free_region(dev->event_map.lpi_map,
-                                  dev->event_map.nr_lpis);
+                                      dev->event_map.nr_lpis,
-        if (idx == dev->event_map.nr_lpis)
+                                      get_count_order(nvecs));
+        if (idx < 0)
                return -ENOSPC;
        *hwirq = dev->event_map.lpi_base + idx;
@@ -2507,21 +2508,21 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        int err;
        int i;
-        for (i = 0; i < nr_irqs; i++) {
+        err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
-                err = its_alloc_device_irq(its_dev, &hwirq);
+        if (err)
-                if (err)
+                return err;
-                        return err;
-                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
+        for (i = 0; i < nr_irqs; i++) {
+                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
                if (err)
                        return err;
                irq_domain_set_hwirq_and_chip(domain, virq + i,
-                                              hwirq, &its_irq_chip, its_dev);
+                                              hwirq + i, &its_irq_chip, its_dev);
                irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
                pr_debug("ID:%d pID:%d vID:%d\n",
-                         (int)(hwirq - its_dev->event_map.lpi_base),
+                         (int)(hwirq + i - its_dev->event_map.lpi_base),
-                         (int) hwirq, virq + i);
+                         (int)(hwirq + i), virq + i);
        }
        return 0;
diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
index ad70e7c416e3..fbfa7ff6deb1 100644
--- a/drivers/irqchip/irq-gic-v3-mbi.c
+++ b/drivers/irqchip/irq-gic-v3-mbi.c
@@ -24,7 +24,7 @@ struct mbi_range {
        unsigned long           *bm;
 };
-static struct mutex             mbi_lock;
+static DEFINE_MUTEX(mbi_lock);
 static phys_addr_t              mbi_phys_base;
 static struct mbi_range         *mbi_ranges;
 static unsigned int             mbi_range_nr;
diff --git a/drivers/irqchip/irq-madera.c b/drivers/irqchip/irq-madera.c
index e9256dee1a45..8b81271c823c 100644
--- a/drivers/irqchip/irq-madera.c
+++ b/drivers/irqchip/irq-madera.c
@@ -7,7 +7,6 @@
 */
 #include <linux/module.h>
-#include <linux/gpio.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/irqdomain.h>
@@ -16,7 +15,6 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/irqchip/irq-madera.h>
 #include <linux/mfd/madera/core.h>
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 6edfd4bfa169..a93296b9b45d 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -822,6 +822,7 @@ out_unmap:
 static const struct irq_domain_ops stm32_exti_h_domain_ops = {
        .alloc  = stm32_exti_h_domain_alloc,
        .free   = irq_domain_free_irqs_common,
+        .xlate = irq_domain_xlate_twocell,
 };
 static int
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index 5385f5768345..27933338f7b3 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -71,14 +71,17 @@ static void xtensa_mx_irq_mask(struct irq_data *d)
        unsigned int mask = 1u << d->hwirq;
        if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
-                                        HW_IRQ_MX_BASE), MIENG);
-        } else {
+                if (ext_irq >= HW_IRQ_MX_BASE) {
-                mask = __this_cpu_read(cached_irq_mask) & ~mask;
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENG);
-                __this_cpu_write(cached_irq_mask, mask);
+                        return;
-                xtensa_set_sr(mask, intenable);
+                }
        }
+        mask = __this_cpu_read(cached_irq_mask) & ~mask;
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 static void xtensa_mx_irq_unmask(struct irq_data *d)
@@ -86,14 +89,17 @@ static void xtensa_mx_irq_unmask(struct irq_data *d)
        unsigned int mask = 1u << d->hwirq;
        if (mask & (XCHAL_INTTYPE_MASK_EXTERN_EDGE |
-                                XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
+                    XCHAL_INTTYPE_MASK_EXTERN_LEVEL)) {
-                set_er(1u << (xtensa_get_ext_irq_no(d->hwirq) -
+                unsigned int ext_irq = xtensa_get_ext_irq_no(d->hwirq);
-                                        HW_IRQ_MX_BASE), MIENGSET);
-        } else {
+                if (ext_irq >= HW_IRQ_MX_BASE) {
-                mask |= __this_cpu_read(cached_irq_mask);
+                        set_er(1u << (ext_irq - HW_IRQ_MX_BASE), MIENGSET);
-                __this_cpu_write(cached_irq_mask, mask);
+                        return;
-                xtensa_set_sr(mask, intenable);
+                }
        }
+        mask |= __this_cpu_read(cached_irq_mask);
+        __this_cpu_write(cached_irq_mask, mask);
+        xtensa_set_sr(mask, intenable);
 }
 static void xtensa_mx_irq_enable(struct irq_data *d)
@@ -113,7 +119,11 @@ static void xtensa_mx_irq_ack(struct irq_data *d)
 static int xtensa_mx_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
        return 1;
 }
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index c200234dd2c9..ab12328be5ee 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -70,7 +70,11 @@ static void xtensa_irq_ack(struct irq_data *d)
 static int xtensa_irq_retrigger(struct irq_data *d)
 {
-        xtensa_set_sr(1 << d->hwirq, intset);
+        unsigned int mask = 1u << d->hwirq;
+        if (WARN_ON(mask & ~XCHAL_INTTYPE_MASK_SOFTWARE))
+                return 0;
+        xtensa_set_sr(mask, intset);
        return 1;
 }
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 0ff22159a0ca..47d4e0d30bf0 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2414,9 +2414,21 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
         * capi:cipher_api_spec-iv:ivopts
         */
        tmp = &cipher_in[strlen("capi:")];
-        cipher_api = strsep(&tmp, "-");
-        *ivmode = strsep(&tmp, ":");
+        /* Separate IV options if present, it can contain another '-' in hash name */
-        *ivopts = tmp;
+        *ivopts = strrchr(tmp, ':');
+        if (*ivopts) {
+                **ivopts = '\0';
+                (*ivopts)++;
+        }
+        /* Parse IV mode */
+        *ivmode = strrchr(tmp, '-');
+        if (*ivmode) {
+                **ivmode = '\0';
+                (*ivmode)++;
+        }
+        /* The rest is crypto API spec */
+        cipher_api = tmp;
        if (*ivmode && !strcmp(*ivmode, "lmk"))
                cc->tfms_count = 64;
@@ -2486,11 +2498,8 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                goto bad_mem;
        chainmode = strsep(&tmp, "-");
-        *ivopts = strsep(&tmp, "-");
+        *ivmode = strsep(&tmp, ":");
-        *ivmode = strsep(&*ivopts, ":");
+        *ivopts = tmp;
-        if (tmp)
-                DMWARN("Ignoring unexpected additional cipher options");
        /*
         * For compatibility with the original dm-crypt mapping format, if
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 4eb5f8c56535..a20531e5f3b4 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -131,7 +131,7 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
 static void rq_completed(struct mapped_device *md)
 {
        /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                wake_up(&md->wait);
        /*
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 20b0776e39ef..ed3caceaed07 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1678,7 +1678,7 @@ int dm_thin_remove_range(struct dm_thin_device *td,
        return r;
 }
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
 {
        int r;
        uint32_t ref_count;
@@ -1686,7 +1686,7 @@ int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *resu
        down_read(&pmd->root_lock);
        r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
        if (!r)
-                *result = (ref_count != 0);
+                *result = (ref_count > 1);
        up_read(&pmd->root_lock);
        return r;
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 35e954ea20a9..f6be0d733c20 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -195,7 +195,7 @@ int dm_pool_get_metadata_dev_size(struct dm_pool_metadata *pmd,
 int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
 int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
 int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index dadd9696340c..ca8af21bf644 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1048,7 +1048,7 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
         * passdown we have to check that these blocks are now unused.
         */
        int r = 0;
-        bool used = true;
+        bool shared = true;
        struct thin_c *tc = m->tc;
        struct pool *pool = tc->pool;
        dm_block_t b = m->data_block, e, end = m->data_block + m->virt_end - m->virt_begin;
@@ -1058,11 +1058,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
        while (b != end) {
                /* find start of unmapped run */
                for (; b < end; b++) {
-                        r = dm_pool_block_is_used(pool->pmd, b, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, b, &shared);
                        if (r)
                                goto out;
-                        if (!used)
+                        if (!shared)
                                break;
                }
@@ -1071,11 +1071,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
                /* find end of run */
                for (e = b + 1; e != end; e++) {
-                        r = dm_pool_block_is_used(pool->pmd, e, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, e, &shared);
                        if (r)
                                goto out;
-                        if (used)
+                        if (shared)
                                break;
                }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d67c95ef8d7e..515e6af9bed2 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -699,7 +699,7 @@ static void end_io_acct(struct dm_io *io)
                                    true, duration, &io->stats_aux);
        /* nudge anyone waiting on suspend queue */
-        if (unlikely(waitqueue_active(&md->wait)))
+        if (unlikely(wq_has_sleeper(&md->wait)))
                wake_up(&md->wait);
 }
@@ -1320,7 +1320,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
        __bio_clone_fast(clone, bio);
-        if (unlikely(bio_integrity(bio) != NULL)) {
+        if (bio_integrity(bio)) {
                int r;
                if (unlikely(!dm_target_has_integrity(tio->ti->type) &&
@@ -1339,7 +1339,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
        bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
        clone->bi_iter.bi_size = to_bytes(len);
-        if (unlikely(bio_integrity(bio) != NULL))
+        if (bio_integrity(bio))
                bio_integrity_trim(clone);
        return 0;
@@ -1588,6 +1588,9 @@ static void init_clone_info(struct clone_info *ci, struct mapped_device *md,
        ci->sector = bio->bi_iter.bi_sector;
 }
+#define __dm_part_stat_sub(part, field, subnd)  \
+        (part_stat_get(part, field) -= (subnd))
 /*
 * Entry point to split a bio into clones and submit them to the targets.
 */
@@ -1642,7 +1645,21 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                                struct bio *b = bio_split(bio, bio_sectors(bio) - ci.sector_count,
                                                          GFP_NOIO, &md->queue->bio_split);
                                ci.io->orig_bio = b;
+                                /*
+                                 * Adjust IO stats for each split, otherwise upon queue
+                                 * reentry there will be redundant IO accounting.
+                                 * NOTE: this is a stop-gap fix, a proper fix involves
+                                 * significant refactoring of DM core's bio splitting
+                                 * (by eliminating DM's splitting and just using bio_split)
+                                 */
+                                part_stat_lock();
+                                __dm_part_stat_sub(&dm_disk(md)->part0,
+                                                   sectors[op_stat_group(bio_op(bio))], ci.sector_count);
+                                part_stat_unlock();
                                bio_chain(b, bio);
+                                trace_block_split(md->queue, b, bio->bi_iter.bi_sector);
                                ret = generic_make_request(bio);
                                break;
                        }
@@ -1713,6 +1730,15 @@ out:
        return ret;
 }
+static blk_qc_t dm_process_bio(struct mapped_device *md,
+                               struct dm_table *map, struct bio *bio)
+{
+        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+                return __process_bio(md, map, bio);
+        else
+                return __split_and_process_bio(md, map, bio);
+}
 static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
 {
        struct mapped_device *md = q->queuedata;
@@ -1733,10 +1759,7 @@ static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
                return ret;
        }
-        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+        ret = dm_process_bio(md, map, bio);
-                ret = __process_bio(md, map, bio);
-        else
-                ret = __split_and_process_bio(md, map, bio);
        dm_put_live_table(md, srcu_idx);
        return ret;
@@ -2415,9 +2438,9 @@ static void dm_wq_work(struct work_struct *work)
                        break;
                if (dm_request_based(md))
-                        generic_make_request(c);
+                        (void) generic_make_request(c);
                else
-                        __split_and_process_bio(md, map, c);
+                        (void) dm_process_bio(md, map, c);
        }
        dm_put_live_table(md, srcu_idx);
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index ec3a5ef7fee0..cbbe6b6535be 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1935,12 +1935,14 @@ out:
 }
 static struct stripe_head *
-r5c_recovery_alloc_stripe(struct r5conf *conf,
+r5c_recovery_alloc_stripe(
-                          sector_t stripe_sect)
+                struct r5conf *conf,
+                sector_t stripe_sect,
+                int noblock)
 {
        struct stripe_head *sh;
-        sh = raid5_get_active_stripe(conf, stripe_sect, 0, 1, 0);
+        sh = raid5_get_active_stripe(conf, stripe_sect, 0, noblock, 0);
        if (!sh)
                return NULL;  /* no more stripe available */
@@ -2150,7 +2152,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                                stripe_sect);
                if (!sh) {
-                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect);
+                        sh = r5c_recovery_alloc_stripe(conf, stripe_sect, 1);
                        /*
                         * cannot get stripe from raid5_get_active_stripe
                         * try replay some stripes
@@ -2159,20 +2161,29 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
                                r5c_recovery_replay_stripes(
                                        cached_stripe_list, ctx);
                                sh = r5c_recovery_alloc_stripe(
-                                        conf, stripe_sect);
+                                        conf, stripe_sect, 1);
                        }
                        if (!sh) {
+                                int new_size = conf->min_nr_stripes * 2;
                                pr_debug("md/raid:%s: Increasing stripe cache size to %d to recovery data on journal.\n",
                                        mdname(mddev),
-                                        conf->min_nr_stripes * 2);
+                                        new_size);
-                                raid5_set_cache_size(mddev,
+                                ret = raid5_set_cache_size(mddev, new_size);
-                                                     conf->min_nr_stripes * 2);
+                                if (conf->min_nr_stripes <= new_size / 2) {
-                                sh = r5c_recovery_alloc_stripe(conf,
+                                        pr_err("md/raid:%s: Cannot increase cache size, ret=%d, new_size=%d, min_nr_stripes=%d, max_nr_stripes=%d\n",
-                                                               stripe_sect);
+                                                mdname(mddev),
+                                                ret,
+                                                new_size,
+                                                conf->min_nr_stripes,
+                                                conf->max_nr_stripes);
+                                        return -ENOMEM;
+                                }
+                                sh = r5c_recovery_alloc_stripe(
+                                        conf, stripe_sect, 0);
                        }
                        if (!sh) {
                                pr_err("md/raid:%s: Cannot get enough stripes due to memory pressure. Recovery failed.\n",
-                                       mdname(mddev));
+                                        mdname(mddev));
                                return -ENOMEM;
                        }
                        list_add_tail(&sh->lru, cached_stripe_list);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4990f0319f6c..cecea901ab8c 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6369,6 +6369,7 @@ raid5_show_stripe_cache_size(struct mddev *mddev, char *page)
 int
 raid5_set_cache_size(struct mddev *mddev, int size)
 {
+        int result = 0;
        struct r5conf *conf = mddev->private;
        if (size <= 16 || size > 32768)
@@ -6385,11 +6386,14 @@ raid5_set_cache_size(struct mddev *mddev, int size)
        mutex_lock(&conf->cache_size_mutex);
        while (size > conf->max_nr_stripes)
-                if (!grow_one_stripe(conf, GFP_KERNEL))
+                if (!grow_one_stripe(conf, GFP_KERNEL)) {
+                        conf->min_nr_stripes = conf->max_nr_stripes;
+                        result = -ENOMEM;
                        break;
+                }
        mutex_unlock(&conf->cache_size_mutex);
-        return 0;
+        return result;
 }
 EXPORT_SYMBOL(raid5_set_cache_size);
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index f461460a2aeb..76f9909cf396 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1419,7 +1419,7 @@ config MFD_TPS65217
 config MFD_TPS68470
        bool "TI TPS68470 Power Management / LED chips"
-        depends on ACPI && I2C=y
+        depends on ACPI && PCI && I2C=y
        select MFD_CORE
        select REGMAP_I2C
        select I2C_DESIGNWARE_PLATFORM
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index b8aaa684c397..2ed23c99f59f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -820,21 +820,24 @@ static int ibmvmc_send_msg(struct crq_server_adapter *adapter,
 *
 * Return:
 *      0 - Success
+ *      Non-zero - Failure
 */
 static int ibmvmc_open(struct inode *inode, struct file *file)
 {
        struct ibmvmc_file_session *session;
-        int rc = 0;
        pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__,
                 (unsigned long)inode, (unsigned long)file,
                 ibmvmc.state);
        session = kzalloc(sizeof(*session), GFP_KERNEL);
+        if (!session)
+                return -ENOMEM;
        session->file = file;
        file->private_data = session;
-        return rc;
+        return 0;
 }
 /**
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
                if (dma_setup_res->status) {
-                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                        u8 status = dma_setup_res->status;
-                                 dma_setup_res->status,
-                                 mei_hbm_status_str(dma_setup_res->status));
+                        if (status == MEI_HBMS_NOT_ALLOWED) {
+                                dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+                        } else {
+                                dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                         status,
+                                         mei_hbm_status_str(status));
+                        }
                        dev->hbm_f_dr_supported = 0;
                        mei_dmam_ring_free(dev);
                }
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..23739a60517f 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
+#define MEI_DEV_ID_DNV_IE     0x19E5  /* Denverton IE */
 #define MEI_DEV_ID_GLK        0x319A  /* Gemini Lake */
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..e89497f858ae 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,11 +88,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
index 595ac065b401..95ff7c5a1dfb 100644
--- a/drivers/misc/pvpanic.c
+++ b/drivers/misc/pvpanic.c
@@ -70,8 +70,12 @@ pvpanic_walk_resources(struct acpi_resource *res, void *context)
        struct resource r;
        if (acpi_dev_resource_io(res, &r)) {
+#ifdef CONFIG_HAS_IOPORT_MAP
                base = ioport_map(r.start, resource_size(&r));
                return AE_OK;
+#else
+                return AE_ERROR;
+#endif
        } else if (acpi_dev_resource_memory(res, &r)) {
                base = ioremap(r.start, resource_size(&r));
                return AE_OK;
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index e26b8145efb3..a44ec8bb5418 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -116,7 +116,7 @@ config MMC_RICOH_MMC
 config MMC_SDHCI_ACPI
        tristate "SDHCI support for ACPI enumerated SDHCI controllers"
-        depends on MMC_SDHCI && ACPI
+        depends on MMC_SDHCI && ACPI && PCI
        select IOSF_MBI if X86
        help
          This selects support for ACPI enumerated SDHCI controllers,
@@ -978,7 +978,7 @@ config MMC_SDHCI_OMAP
        tristate "TI SDHCI Controller Support"
        depends on MMC_SDHCI_PLTFM && OF
        select THERMAL
-        select TI_SOC_THERMAL
+        imply TI_SOC_THERMAL
        help
          This selects the Secure Digital Host Controller Interface (SDHCI)
          support present in TI's DRA7 SOCs. The controller supports
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 50293529d6de..c9e7aa50bb0a 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1431,6 +1431,8 @@ static int bcm2835_probe(struct platform_device *pdev)
 err:
        dev_dbg(dev, "%s -> err %d\n", __func__, ret);
+        if (host->dma_chan_rxtx)
+                dma_release_channel(host->dma_chan_rxtx);
        mmc_free_host(mmc);
        return ret;
diff --git a/drivers/mmc/host/dw_mmc-bluefield.c b/drivers/mmc/host/dw_mmc-bluefield.c
index ed8f2254b66a..aa38b1a8017e 100644
--- a/drivers/mmc/host/dw_mmc-bluefield.c
+++ b/drivers/mmc/host/dw_mmc-bluefield.c
@@ -1,11 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
 * Copyright (C) 2018 Mellanox Technologies.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
 */
 #include <linux/bitfield.h>
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c2690c1a50ff..f19ec60bcbdc 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -179,6 +179,8 @@ struct meson_host {
        struct sd_emmc_desc *descs;
        dma_addr_t descs_dma_addr;
+        int irq;
        bool vqmmc_enabled;
 };
@@ -738,6 +740,11 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
        struct meson_host *host = mmc_priv(mmc);
+        int adj = 0;
+        /* enable signal resampling w/o delay */
+        adj = ADJUST_ADJ_EN;
+        writel(adj, host->regs + host->data->adjust);
        return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -768,6 +775,9 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                if (!IS_ERR(mmc->supply.vmmc))
                        mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+                /* disable signal resampling */
+                writel(0, host->regs + host->data->adjust);
                /* Reset rx phase */
                clk_set_phase(host->rx_clk, 0);
@@ -1166,7 +1176,7 @@ static int meson_mmc_get_cd(struct mmc_host *mmc)
 static void meson_mmc_cfg_init(struct meson_host *host)
 {
-        u32 cfg = 0, adj = 0;
+        u32 cfg = 0;
        cfg |= FIELD_PREP(CFG_RESP_TIMEOUT_MASK,
                          ilog2(SD_EMMC_CFG_RESP_TIMEOUT));
@@ -1177,10 +1187,6 @@ static void meson_mmc_cfg_init(struct meson_host *host)
        cfg |= CFG_ERR_ABORT;
        writel(cfg, host->regs + SD_EMMC_CFG);
-        /* enable signal resampling w/o delay */
-        adj = ADJUST_ADJ_EN;
-        writel(adj, host->regs + host->data->adjust);
 }
 static int meson_mmc_card_busy(struct mmc_host *mmc)
@@ -1231,7 +1237,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
        struct resource *res;
        struct meson_host *host;
        struct mmc_host *mmc;
-        int ret, irq;
+        int ret;
        mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev);
        if (!mmc)
@@ -1276,8 +1282,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                goto free_host;
        }
-        irq = platform_get_irq(pdev, 0);
+        host->irq = platform_get_irq(pdev, 0);
-        if (irq <= 0) {
+        if (host->irq <= 0) {
                dev_err(&pdev->dev, "failed to get interrupt resource.\n");
                ret = -EINVAL;
                goto free_host;
@@ -1331,9 +1337,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
        writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN,
               host->regs + SD_EMMC_IRQ_EN);
-        ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq,
+        ret = request_threaded_irq(host->irq, meson_mmc_irq,
-                                        meson_mmc_irq_thread, IRQF_SHARED,
+                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
-                                        NULL, host);
        if (ret)
                goto err_init_clk;
@@ -1351,7 +1356,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
        if (host->bounce_buf == NULL) {
                dev_err(host->dev, "Unable to map allocate DMA bounce buffer.\n");
                ret = -ENOMEM;
-                goto err_init_clk;
+                goto err_free_irq;
        }
        host->descs = dma_alloc_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
@@ -1370,6 +1375,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
 err_bounce_buf:
        dma_free_coherent(host->dev, host->bounce_buf_size,
                          host->bounce_buf, host->bounce_dma_addr);
+err_free_irq:
+        free_irq(host->irq, host);
 err_init_clk:
        clk_disable_unprepare(host->mmc_clk);
 err_core_clk:
@@ -1387,6 +1394,7 @@ static int meson_mmc_remove(struct platform_device *pdev)
        /* disable interrupts */
        writel(0, host->regs + SD_EMMC_IRQ_EN);
+        free_irq(host->irq, host);
        dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
                          host->descs, host->descs_dma_addr);
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8afeaf81ae66..833ef0590af8 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -846,7 +846,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
        if (timing == MMC_TIMING_MMC_HS400 &&
            host->dev_comp->hs400_tune)
-                sdr_set_field(host->base + PAD_CMD_TUNE,
+                sdr_set_field(host->base + tune_reg,
                              MSDC_PAD_TUNE_CMDRRDLY,
                              host->hs400_cmd_int_delay);
        dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0db99057c44f..9d12c06c7fd6 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -296,7 +296,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
        iproc_host->data = iproc_data;
-        mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                goto err;
        sdhci_get_property(pdev);
        host->mmc->caps |= iproc_host->data->mmc_caps;
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index a0f954f36c09..44e6c7b1b222 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -257,10 +257,7 @@ static int handle_tx(struct ser_device *ser)
                if (skb->len == 0) {
                        struct sk_buff *tmp = skb_dequeue(&ser->head);
                        WARN_ON(tmp != skb);
-                        if (in_interrupt())
+                        dev_consume_skb_any(skb);
-                                dev_kfree_skb_irq(skb);
-                        else
-                                kfree_skb(skb);
                }
        }
        /* Send flow off if queue is empty */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3b3f88ffab53..c05e4d50d43d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
 struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
 {
        struct can_priv *priv = netdev_priv(dev);
-        struct sk_buff *skb = priv->echo_skb[idx];
-        struct canfd_frame *cf;
        if (idx >= priv->echo_skb_max) {
                netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
                return NULL;
        }
-        if (!skb) {
+        if (priv->echo_skb[idx]) {
-                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+                /* Using "struct canfd_frame::len" for the frame
-                           __func__, idx);
+                 * length is supported on both CAN and CANFD frames.
-                return NULL;
+                 */
-        }
+                struct sk_buff *skb = priv->echo_skb[idx];
+                struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+                u8 len = cf->len;
-        /* Using "struct canfd_frame::len" for the frame
+                *len_ptr = len;
-         * length is supported on both CAN and CANFD frames.
+                priv->echo_skb[idx] = NULL;
-         */
-        cf = (struct canfd_frame *)skb->data;
-        *len_ptr = cf->len;
-        priv->echo_skb[idx] = NULL;
-        return skb;
+                return skb;
+        }
+        return NULL;
 }
 /*
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 0f36eafe3ac1..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev)
                }
        } else {
                /* clear and invalidate unused mailboxes first */
-                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
                        mb = flexcan_get_mb(priv, i);
                        priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
                                    &mb->can_ctrl);
@@ -1432,7 +1432,7 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
        gpr_np = of_find_node_by_phandle(phandle);
        if (!gpr_np) {
                dev_dbg(&pdev->dev, "could not find gpr node by phandle\n");
-                return PTR_ERR(gpr_np);
+                return -ENODEV;
        }
        priv = netdev_priv(dev);
diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
index 2caa8c8b4b55..1bfc5ff8d81d 100644
--- a/drivers/net/dsa/mv88e6xxx/serdes.c
+++ b/drivers/net/dsa/mv88e6xxx/serdes.c
@@ -664,7 +664,7 @@ int mv88e6390_serdes_irq_setup(struct mv88e6xxx_chip *chip, int port)
        if (port < 9)
                return 0;
-        return mv88e6390_serdes_irq_setup(chip, port);
+        return mv88e6390x_serdes_irq_setup(chip, port);
 }
 void mv88e6390x_serdes_irq_free(struct mv88e6xxx_chip *chip, int port)
diff --git a/drivers/net/ethernet/alteon/acenic.c b/drivers/net/ethernet/alteon/acenic.c
index 4f11f98347ed..1827ef1f6d55 100644
--- a/drivers/net/ethernet/alteon/acenic.c
+++ b/drivers/net/ethernet/alteon/acenic.c
@@ -2059,7 +2059,7 @@ static inline void ace_tx_int(struct net_device *dev,
                if (skb) {
                        dev->stats.tx_packets++;
                        dev->stats.tx_bytes += skb->len;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                        info->skb = NULL;
                }
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 0fb986ba3290..0ae723f75341 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
                        & 0xffff;
        if (inuse) { /* Tx FIFO is not empty */
-                ready = priv->tx_prod - priv->tx_cons - inuse - 1;
+                ready = max_t(int,
+                              priv->tx_prod - priv->tx_cons - inuse - 1, 0);
        } else {
                /* Check for buffered last packet */
                status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 02921d877c08..aa1d1f5339d2 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
                phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
                                     priv->phy_iface);
-                if (IS_ERR(phydev))
+                if (IS_ERR(phydev)) {
                        netdev_err(dev, "Could not attach to PHY\n");
+                        phydev = NULL;
+                }
        } else {
                int ret;
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index a90080f12e67..e548c0ae2e00 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -666,7 +666,7 @@ static int amd8111e_tx(struct net_device *dev)
                        pci_unmap_single(lp->pci_dev, lp->tx_dma_addr[tx_index],
                                        lp->tx_skbuff[tx_index]->len,
                                        PCI_DMA_TODEVICE);
-                        dev_kfree_skb_irq (lp->tx_skbuff[tx_index]);
+                        dev_consume_skb_irq(lp->tx_skbuff[tx_index]);
                        lp->tx_skbuff[tx_index] = NULL;
                        lp->tx_dma_addr[tx_index] = 0;
                }
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 6a8e2567f2bd..4d3855ceb500 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -777,7 +777,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id)
                if (bp->tx_bufs[bp->tx_empty]) {
                        ++dev->stats.tx_packets;
-                        dev_kfree_skb_irq(bp->tx_bufs[bp->tx_empty]);
+                        dev_consume_skb_irq(bp->tx_bufs[bp->tx_empty]);
                }
                bp->tx_bufs[bp->tx_empty] = NULL;
                bp->tx_fullup = 0;
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f44808959ff3..97ab0dd25552 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -638,7 +638,7 @@ static void b44_tx(struct b44 *bp)
                bytes_compl += skb->len;
                pkts_compl++;
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
        }
        netdev_completed_queue(bp->dev, pkts_compl, bytes_compl);
@@ -1012,7 +1012,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
                skb_copy_from_linear_data(skb, skb_put(bounce_skb, len), len);
-                dev_kfree_skb_any(skb);
+                dev_consume_skb_any(skb);
                skb = bounce_skb;
        }
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 3d45f4c92cf6..9bbaad9f3d63 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -643,6 +643,7 @@
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
 #define MACB_CAPS_BD_RD_PREFETCH                0x00000080
+#define MACB_CAPS_NEEDS_RSTONUBR                0x00000100
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1214,6 +1215,8 @@ struct macb {
        int     rx_bd_rd_prefetch;
        int     tx_bd_rd_prefetch;
+        u32     rx_intr_mask;
 };
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 66cc7927061a..2b2882615e8b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -56,8 +56,7 @@
 /* level of occupied TX descriptors under which we wake up TX process */
 #define MACB_TX_WAKEUP_THRESH(bp)       (3 * (bp)->tx_ring_size / 4)
-#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(RXUBR)      \
+#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))
-                                 | MACB_BIT(ISR_ROVR))
 #define MACB_TX_ERR_FLAGS       (MACB_BIT(ISR_TUND)                     \
                                        | MACB_BIT(ISR_RLE)             \
                                        | MACB_BIT(TXERR))
@@ -1270,7 +1269,7 @@ static int macb_poll(struct napi_struct *napi, int budget)
                                queue_writel(queue, ISR, MACB_BIT(RCOMP));
                        napi_reschedule(napi);
                } else {
-                        queue_writel(queue, IER, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IER, bp->rx_intr_mask);
                }
        }
@@ -1288,7 +1287,7 @@ static void macb_hresp_error_task(unsigned long data)
        u32 ctrl;
        for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, IDR, MACB_RX_INT_FLAGS |
+                queue_writel(queue, IDR, bp->rx_intr_mask |
                                         MACB_TX_INT_FLAGS |
                                         MACB_BIT(HRESP));
        }
@@ -1318,7 +1317,7 @@ static void macb_hresp_error_task(unsigned long data)
                /* Enable interrupts */
                queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                             MACB_TX_INT_FLAGS |
                             MACB_BIT(HRESP));
        }
@@ -1372,14 +1371,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                            (unsigned int)(queue - bp->queues),
                            (unsigned long)status);
-                if (status & MACB_RX_INT_FLAGS) {
+                if (status & bp->rx_intr_mask) {
                        /* There's no point taking any more interrupts
                         * until we have processed the buffers. The
                         * scheduling call may fail if the poll routine
                         * is already scheduled, so disable interrupts
                         * now.
                         */
-                        queue_writel(queue, IDR, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IDR, bp->rx_intr_mask);
                        if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
                                queue_writel(queue, ISR, MACB_BIT(RCOMP));
@@ -1412,8 +1411,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                /* There is a hardware issue under heavy load where DMA can
                 * stop, this causes endless "used buffer descriptor read"
                 * interrupts but it can be cleared by re-enabling RX. See
-                 * the at91 manual, section 41.3.1 or the Zynq manual
+                 * the at91rm9200 manual, section 41.3.1 or the Zynq manual
-                 * section 16.7.4 for details.
+                 * section 16.7.4 for details. RXUBR is only enabled for
+                 * these two versions.
                 */
                if (status & MACB_BIT(RXUBR)) {
                        ctrl = macb_readl(bp, NCR);
@@ -2259,7 +2259,7 @@ static void macb_init_hw(struct macb *bp)
                /* Enable interrupts */
                queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                             MACB_TX_INT_FLAGS |
                             MACB_BIT(HRESP));
        }
@@ -3907,6 +3907,7 @@ static const struct macb_config sama5d4_config = {
 };
 static const struct macb_config emac_config = {
+        .caps = MACB_CAPS_NEEDS_RSTONUBR,
        .clk_init = at91ether_clk_init,
        .init = at91ether_init,
 };
@@ -3928,7 +3929,8 @@ static const struct macb_config zynqmp_config = {
 };
 static const struct macb_config zynq_config = {
-        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF,
+        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF |
+                MACB_CAPS_NEEDS_RSTONUBR,
        .dma_burst_length = 16,
        .clk_init = macb_clk_init,
        .init = macb_init,
@@ -4083,6 +4085,10 @@ static int macb_probe(struct platform_device *pdev)
                                                macb_dma_desc_get_size(bp);
        }
+        bp->rx_intr_mask = MACB_RX_INT_FLAGS;
+        if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR)
+                bp->rx_intr_mask |= MACB_BIT(RXUBR);
        mac = of_get_mac_address(np);
        if (mac) {
                ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig
index 809a155eb193..f6d244c663fd 100644
--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig
+++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig
@@ -9,8 +9,9 @@ config FSL_DPAA2_ETH
 config FSL_DPAA2_PTP_CLOCK
        tristate "Freescale DPAA2 PTP Clock"
-        depends on FSL_DPAA2_ETH && POSIX_TIMERS
+        depends on FSL_DPAA2_ETH
-        select PTP_1588_CLOCK
+        imply PTP_1588_CLOCK
+        default y
        help
          This driver adds support for using the DPAA2 1588 timer module
          as a PTP clock.
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ae0f88bce9aa..2370dc204202 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3467,7 +3467,7 @@ fec_probe(struct platform_device *pdev)
        if (ret)
                goto failed_clk_ipg;
-        fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
+        fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
        if (!IS_ERR(fep->reg_phy)) {
                ret = regulator_enable(fep->reg_phy);
                if (ret) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 5b33238c6680..60e7d7ae3787 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2418,6 +2418,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
 out_notify_fail:
        (void)cancel_work_sync(&priv->service_task);
 out_read_prop_fail:
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
        free_netdev(ndev);
        return ret;
 }
@@ -2447,6 +2449,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)
        set_bit(NIC_STATE_REMOVING, &priv->state);
        (void)cancel_work_sync(&priv->service_task);
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
        free_netdev(ndev);
        return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 8e9b95871d30..ce15d2350db9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)
 */
 static int hns_nic_nway_reset(struct net_device *netdev)
 {
-        int ret = 0;
        struct phy_device *phy = netdev->phydev;
-        if (netif_running(netdev)) {
+        if (!netif_running(netdev))
-                /* if autoneg is disabled, don't restart auto-negotiation */
+                return 0;
-                if (phy && phy->autoneg == AUTONEG_ENABLE)
-                        ret = genphy_restart_aneg(phy);
-        }
-        return ret;
+        if (!phy)
+                return -EOPNOTSUPP;
+        if (phy->autoneg != AUTONEG_ENABLE)
+                return -EINVAL;
+        return genphy_restart_aneg(phy);
 }
 static u32
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index 017e08452d8c..baf5cc251f32 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
                }
                hns_mdio_cmd_write(mdio_dev, is_c45,
-                                   MDIO_C45_WRITE_ADDR, phy_id, devad);
+                                   MDIO_C45_READ, phy_id, devad);
        }
        /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index d719668a6684..92929750f832 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -1310,7 +1310,7 @@ static irqreturn_t i596_interrupt(int irq, void *dev_id)
                                                dev->stats.tx_aborted_errors++;
                                }
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
                                tx_cmd->cmd.command = 0; /* Mark free */
                                break;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 098d8764c0ea..dd71d5db7274 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1313,7 +1313,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
        unsigned long lpar_rc;
        u16 mss = 0;
-restart_poll:
        while (frames_processed < budget) {
                if (!ibmveth_rxq_pending_buffer(adapter))
                        break;
@@ -1401,7 +1400,6 @@ restart_poll:
                    napi_reschedule(napi)) {
                        lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                               VIO_IRQ_DISABLE);
-                        goto restart_poll;
                }
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index db909b6069b5..65f8a4b6ed0c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -306,14 +306,16 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size)
        if (entries_per_copy < entries) {
                for (i = 0; i < entries / entries_per_copy; i++) {
-                        err = copy_to_user(buf, init_ents, PAGE_SIZE);
+                        err = copy_to_user((void __user *)buf, init_ents, PAGE_SIZE) ?
+                                -EFAULT : 0;
                        if (err)
                                goto out;
                        buf += PAGE_SIZE;
                }
        } else {
-                err = copy_to_user(buf, init_ents, entries * cqe_size);
+                err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ?
+                        -EFAULT : 0;
        }
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 7df728f1e5b5..6e501af0e532 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2067,9 +2067,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 {
        struct mlx4_cmd_mailbox *mailbox;
        __be32 *outbox;
+        u64 qword_field;
        u32 dword_field;
-        int err;
+        u16 word_field;
        u8 byte_field;
+        int err;
        static const u8 a0_dmfs_query_hw_steering[] =  {
                [0] = MLX4_STEERING_DMFS_A0_DEFAULT,
                [1] = MLX4_STEERING_DMFS_A0_DYNAMIC,
@@ -2097,19 +2099,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* QPC/EEC/CQC/EQC/RDMARC attributes */
-        MLX4_GET(param->qpc_base,      outbox, INIT_HCA_QPC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET);
-        MLX4_GET(param->log_num_qps,   outbox, INIT_HCA_LOG_QP_OFFSET);
+        param->qpc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->srqc_base,     outbox, INIT_HCA_SRQC_BASE_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET);
-        MLX4_GET(param->log_num_srqs,  outbox, INIT_HCA_LOG_SRQ_OFFSET);
+        param->log_num_qps = byte_field & 0x1f;
-        MLX4_GET(param->cqc_base,      outbox, INIT_HCA_CQC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_cqs,   outbox, INIT_HCA_LOG_CQ_OFFSET);
+        param->srqc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->altc_base,     outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET);
-        MLX4_GET(param->auxc_base,     outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->log_num_srqs = byte_field & 0x1f;
-        MLX4_GET(param->eqc_base,      outbox, INIT_HCA_EQC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_eqs,   outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->cqc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->num_sys_eqs,   outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET);
-        MLX4_GET(param->rdmarc_base,   outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->log_num_cqs = byte_field & 0x1f;
-        MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        param->altc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->auxc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET);
+        param->eqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->log_num_eqs = byte_field & 0x1f;
+        MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        param->num_sys_eqs = word_field & 0xfff;
+        MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->rdmarc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET);
+        param->log_rd_per_qp = byte_field & 0x7;
        MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET);
        if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) {
@@ -2128,22 +2143,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* steering attributes */
        if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
                MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
-                         INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_table_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
-                         INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
-                MLX4_GET(byte_field, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET);
-                         INIT_HCA_FS_A0_OFFSET);
                param->dmfs_high_steer_mode =
                        a0_dmfs_query_hw_steering[(byte_field >> 6) & 3];
        } else {
                MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_hash_sz,  outbox,
+                MLX4_GET(byte_field,  outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
+                param->log_mc_hash_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_table_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
        }
        /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */
@@ -2167,15 +2181,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* TPT attributes */
        MLX4_GET(param->dmpt_base,  outbox, INIT_HCA_DMPT_BASE_OFFSET);
-        MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET);
-        MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->mw_enabled = byte_field >> 7;
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->log_mpt_sz = byte_field & 0x3f;
        MLX4_GET(param->mtt_base,   outbox, INIT_HCA_MTT_BASE_OFFSET);
        MLX4_GET(param->cmpt_base,  outbox, INIT_HCA_CMPT_BASE_OFFSET);
        /* UAR attributes */
        MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET);
-        MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        param->log_uar_sz = byte_field & 0xf;
        /* phv_check enable */
        MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8cfd2ec7c0a2..01819e5c9975 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -950,7 +950,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
        if (params->rx_dim_enabled)
                __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
-        if (params->pflags & MLX5E_PFLAG_RX_NO_CSUM_COMPLETE)
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
                __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
        return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 04736212a21c..f2573c2d2b5c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -1126,9 +1126,17 @@ static int mlx5e_rep_get_phys_port_name(struct net_device *dev,
        struct mlx5e_priv *priv = netdev_priv(dev);
        struct mlx5e_rep_priv *rpriv = priv->ppriv;
        struct mlx5_eswitch_rep *rep = rpriv->rep;
-        int ret;
+        int ret, pf_num;
+        ret = mlx5_lag_get_pf_num(priv->mdev, &pf_num);
+        if (ret)
+                return ret;
+        if (rep->vport == FDB_UPLINK_VPORT)
+                ret = snprintf(buf, len, "p%d", pf_num);
+        else
+                ret = snprintf(buf, len, "pf%dvf%d", pf_num, rep->vport - 1);
-        ret = snprintf(buf, len, "%d", rep->vport - 1);
        if (ret >= len)
                return -EOPNOTSUPP;
@@ -1285,6 +1293,18 @@ static int mlx5e_uplink_rep_set_mac(struct net_device *netdev, void *addr)
        return 0;
 }
+static int mlx5e_uplink_rep_set_vf_vlan(struct net_device *dev, int vf, u16 vlan, u8 qos,
+                                        __be16 vlan_proto)
+{
+        netdev_warn_once(dev, "legacy vf vlan setting isn't supported in switchdev mode\n");
+        if (vlan != 0)
+                return -EOPNOTSUPP;
+        /* allow setting 0-vid for compatibility with libvirt */
+        return 0;
+}
 static const struct switchdev_ops mlx5e_rep_switchdev_ops = {
        .switchdev_port_attr_get        = mlx5e_attr_get,
 };
@@ -1319,6 +1339,7 @@ static const struct net_device_ops mlx5e_netdev_ops_uplink_rep = {
        .ndo_set_vf_rate         = mlx5e_set_vf_rate,
        .ndo_get_vf_config       = mlx5e_get_vf_config,
        .ndo_get_vf_stats        = mlx5e_get_vf_stats,
+        .ndo_set_vf_vlan         = mlx5e_uplink_rep_set_vf_vlan,
 };
 bool mlx5e_eswitch_rep(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index a44ea7b85614..5b492b67f4e1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1134,13 +1134,6 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
        int err = 0;
        u8 *smac_v;
-        if (vport->info.spoofchk && !is_valid_ether_addr(vport->info.mac)) {
-                mlx5_core_warn(esw->dev,
-                               "vport[%d] configure ingress rules failed, illegal mac with spoofchk\n",
-                               vport->vport);
-                return -EPERM;
-        }
        esw_vport_cleanup_ingress_rules(esw, vport);
        if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
@@ -1728,7 +1721,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
        int vport_num;
        int err;
-        if (!MLX5_ESWITCH_MANAGER(dev))
+        if (!MLX5_VPORT_MANAGER(dev))
                return 0;
        esw_info(dev,
@@ -1797,7 +1790,7 @@ abort:
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
+        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
                return;
        esw_info(esw->dev, "cleanup\n");
@@ -1827,13 +1820,10 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
        mutex_lock(&esw->state_lock);
        evport = &esw->vports[vport];
-        if (evport->info.spoofchk && !is_valid_ether_addr(mac)) {
+        if (evport->info.spoofchk && !is_valid_ether_addr(mac))
                mlx5_core_warn(esw->dev,
-                               "MAC invalidation is not allowed when spoofchk is on, vport(%d)\n",
+                               "Set invalid MAC while spoofchk is on, vport(%d)\n",
                               vport);
-                err = -EPERM;
-                goto unlock;
-        }
        err = mlx5_modify_nic_vport_mac_address(esw->dev, vport, mac);
        if (err) {
@@ -1979,6 +1969,10 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
        evport = &esw->vports[vport];
        pschk = evport->info.spoofchk;
        evport->info.spoofchk = spoofchk;
+        if (pschk && !is_valid_ether_addr(evport->info.mac))
+                mlx5_core_warn(esw->dev,
+                               "Spoofchk in set while MAC is invalid, vport(%d)\n",
+                               evport->vport);
        if (evport->enabled && esw->mode == SRIOV_LEGACY)
                err = esw_vport_ingress_config(esw, evport);
        if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 3a6baed722d8..2d223385dc81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -616,6 +616,27 @@ void mlx5_lag_add(struct mlx5_core_dev *dev, struct net_device *netdev)
        }
 }
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num)
+{
+        struct mlx5_lag *ldev;
+        int n;
+        ldev = mlx5_lag_dev_get(dev);
+        if (!ldev) {
+                mlx5_core_warn(dev, "no lag device, can't get pf num\n");
+                return -EINVAL;
+        }
+        for (n = 0; n < MLX5_MAX_PORTS; n++)
+                if (ldev->pf[n].dev == dev) {
+                        *pf_num = n;
+                        return 0;
+                }
+        mlx5_core_warn(dev, "wasn't able to locate pf in the lag device\n");
+        return -EINVAL;
+}
 /* Must be called with intf_mutex held */
 void mlx5_lag_remove(struct mlx5_core_dev *dev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index c68dcea5985b..5300b0b6d836 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -187,6 +187,8 @@ static inline int mlx5_lag_is_lacp_owner(struct mlx5_core_dev *dev)
                    MLX5_CAP_GEN(dev, lag_master);
 }
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num);
 void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol);
 void mlx5_lag_update(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 388f205a497f..370ca94b6775 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *
 mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)
 {
        struct mlx5_core_rsc_common *common;
+        unsigned long flags;
-        spin_lock(&table->lock);
+        spin_lock_irqsave(&table->lock, flags);
        common = radix_tree_lookup(&table->tree, rsn);
        if (common)
                atomic_inc(&common->refcount);
-        spin_unlock(&table->lock);
+        spin_unlock_irqrestore(&table->lock, flags);
        return common;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 8f6551421945..2ecaaaa4469a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -795,19 +795,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,
 /* get pq index according to PQ_FLAGS */
 static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
-                                           u32 pq_flags)
+                                           unsigned long pq_flags)
 {
        struct qed_qm_info *qm_info = &p_hwfn->qm_info;
        /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags,
+        if (bitmap_weight(&pq_flags,
                          sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
-                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
                goto err;
        }
        if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
-                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+                DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
                goto err;
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 67c02ea93906..e68ca83ae915 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                          (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
                           !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
+                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
+                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
+                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
                SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
                          !!(accept_filter & QED_ACCEPT_BCAST));
@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
                return rc;
        }
+        if (p_params->update_ctl_frame_check) {
+                p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
+                p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
+        }
        /* Update mcast bins for VFs, PF doesn't use this functionality */
        qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
@@ -2688,7 +2697,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,
        if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
                accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
                                                 QED_ACCEPT_MCAST_UNMATCHED;
-                accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+                accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+                                                 QED_ACCEPT_MCAST_UNMATCHED;
        } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
                accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
                accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 8d80f1095d17..7127d5aaac42 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
        struct qed_rss_params           *rss_params;
        struct qed_filter_accept_flags  accept_flags;
        struct qed_sge_tpa_params       *sge_tpa_params;
+        u8                              update_ctl_frame_check;
+        u8                              mac_chk_en;
+        u8                              ethtype_chk_en;
 };
 int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index d9237c65a838..b5f419b71287 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2451,19 +2451,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
 {
        struct qed_ll2_tx_pkt_info pkt;
        const skb_frag_t *frag;
+        u8 flags = 0, nr_frags;
        int rc = -EINVAL, i;
        dma_addr_t mapping;
        u16 vlan = 0;
-        u8 flags = 0;
        if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
                DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                return -EINVAL;
        }
-        if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+        /* Cache number of fragments from SKB since SKB may be freed by
+         * the completion routine after calling qed_ll2_prepare_tx_packet()
+         */
+        nr_frags = skb_shinfo(skb)->nr_frags;
+        if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
                DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
-                       1 + skb_shinfo(skb)->nr_frags);
+                       1 + nr_frags);
                return -EINVAL;
        }
@@ -2485,7 +2490,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
        }
        memset(&pkt, 0, sizeof(pkt));
-        pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
+        pkt.num_of_bds = 1 + nr_frags;
        pkt.vlan = vlan;
        pkt.bd_flags = flags;
        pkt.tx_dest = QED_LL2_TX_DEST_NW;
@@ -2496,12 +2501,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
            test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
                pkt.remove_stag = true;
+        /* qed_ll2_prepare_tx_packet() may actually send the packet if
+         * there are no fragments in the skb and subsequently the completion
+         * routine may run and free the SKB, so no dereferencing the SKB
+         * beyond this point unless skb has any fragments.
+         */
        rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
                                       &pkt, 1);
        if (rc)
                goto err;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        for (i = 0; i < nr_frags; i++) {
                frag = &skb_shinfo(skb)->frags[i];
                mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index ca6290fa0f30..71a7af134dd8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn,
        params.vport_id = vf->vport_id;
        params.max_buffers_per_cqe = start->max_buffers_per_cqe;
        params.mtu = vf->mtu;
-        params.check_mac = true;
+        /* Non trusted VFs should enable control frame filtering */
+        params.check_mac = !vf->p_vf_info.is_trusted_configured;
        rc = qed_sp_eth_vport_start(p_hwfn, &params);
        if (rc) {
@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                params.opaque_fid = vf->opaque_fid;
                params.vport_id = vf->vport_id;
+                params.update_ctl_frame_check = 1;
+                params.mac_chk_en = !vf_info->is_trusted_configured;
                if (vf_info->rx_accept_mode & mask) {
                        flags->update_rx_mode_config = 1;
                        flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                }
                if (flags->update_rx_mode_config ||
-                    flags->update_tx_mode_config)
+                    flags->update_tx_mode_config ||
+                    params.update_ctl_frame_check)
                        qed_sp_vport_update(hwfn, &params,
                                            QED_SPQ_MODE_EBLOCK, NULL);
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index b6cccf44bf40..5dda547772c1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
        struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
        struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
        struct vf_pf_resc_request *p_resc;
+        u8 retry_cnt = VF_ACQUIRE_THRESH;
        bool resources_acquired = false;
        struct vfpf_acquire_tlv *req;
        int rc = 0, attempts = 0;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
                /* send acquire request */
                rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
+                /* Re-try acquire in case of vf-pf hw channel timeout */
+                if (retry_cnt && rc == -EBUSY) {
+                        DP_VERBOSE(p_hwfn, QED_MSG_IOV,
+                                   "VF retrying to acquire due to VPC timeout\n");
+                        retry_cnt--;
+                        continue;
+                }
                if (rc)
                        goto exit;
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 44f6e4873aad..4f910c4f67b0 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -691,7 +691,7 @@ static void cp_tx (struct cp_private *cp)
                        }
                        bytes_compl += skb->len;
                        pkts_compl++;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                }
                cp->tx_skb[tx_tail] = NULL;
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ffc1ada4e6da..d28c8f9ca55b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -343,7 +343,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
        int i;
        priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
-                ETH_HLEN + VLAN_HLEN;
+                ETH_HLEN + VLAN_HLEN + sizeof(__sum16);
        /* Allocate RX and TX skb rings */
        priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -524,13 +524,15 @@ static void ravb_rx_csum(struct sk_buff *skb)
 {
        u8 *hw_csum;
-        /* The hardware checksum is 2 bytes appended to packet data */
+        /* The hardware checksum is contained in sizeof(__sum16) (2) bytes
-        if (unlikely(skb->len < 2))
+         * appended to packet data
+         */
+        if (unlikely(skb->len < sizeof(__sum16)))
                return;
-        hw_csum = skb_tail_pointer(skb) - 2;
+        hw_csum = skb_tail_pointer(skb) - sizeof(__sum16);
        skb->csum = csum_unfold((__force __sum16)get_unaligned_le16(hw_csum));
        skb->ip_summed = CHECKSUM_COMPLETE;
-        skb_trim(skb, skb->len - 2);
+        skb_trim(skb, skb->len - sizeof(__sum16));
 }
 /* Packet receive function for Ethernet AVB */
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index b6a50058bb8d..2f2bda68d861 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6046,22 +6046,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
        { NVRAM_PARTITION_TYPE_EXPANSION_UEFI,     0,    0, "sfc_uefi" },
        { NVRAM_PARTITION_TYPE_STATUS,             0,    0, "sfc_status" }
 };
+#define EF10_NVRAM_PARTITION_COUNT      ARRAY_SIZE(efx_ef10_nvram_types)
 static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
                                        struct efx_mcdi_mtd_partition *part,
-                                        unsigned int type)
+                                        unsigned int type,
+                                        unsigned long *found)
 {
        MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
        MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
        const struct efx_ef10_nvram_type_info *info;
        size_t size, erase_size, outlen;
+        int type_idx = 0;
        bool protected;
        int rc;
-        for (info = efx_ef10_nvram_types; ; info++) {
+        for (type_idx = 0; ; type_idx++) {
-                if (info ==
+                if (type_idx == EF10_NVRAM_PARTITION_COUNT)
-                    efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
                        return -ENODEV;
+                info = efx_ef10_nvram_types + type_idx;
                if ((type & ~info->type_mask) == info->type)
                        break;
        }
@@ -6074,6 +6077,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
        if (protected)
                return -ENODEV; /* hide it */
+        /* If we've already exposed a partition of this type, hide this
+         * duplicate.  All operations on MTDs are keyed by the type anyway,
+         * so we can't act on the duplicate.
+         */
+        if (__test_and_set_bit(type_idx, found))
+                return -EEXIST;
        part->nvram_type = type;
        MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
@@ -6105,6 +6115,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
        MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
        struct efx_mcdi_mtd_partition *parts;
        size_t outlen, n_parts_total, i, n_parts;
        unsigned int type;
@@ -6133,11 +6144,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
        for (i = 0; i < n_parts_total; i++) {
                type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
                                        i);
-                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
-                if (rc == 0)
+                                                  found);
-                        n_parts++;
+                if (rc == -EEXIST || rc == -ENODEV)
-                else if (rc != -ENODEV)
+                        continue;
+                if (rc)
                        goto fail;
+                n_parts++;
        }
        rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 7b923362ee55..3b174eae77c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
        }
        ret = phy_power_on(bsp_priv, true);
-        if (ret)
+        if (ret) {
+                gmac_clk_enable(bsp_priv, false);
                return ret;
+        }
        pm_runtime_enable(dev);
        pm_runtime_get_sync(dev);
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 9020b084b953..7ec4eb74fe21 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1,22 +1,9 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
 *
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
 * This driver uses the sungem driver (c) David Miller
 * (davem@redhat.com) as its basis.
 *
diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
index 13f3860496a8..ae5f05f03f88 100644
--- a/drivers/net/ethernet/sun/cassini.h
+++ b/drivers/net/ethernet/sun/cassini.h
@@ -1,23 +1,10 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0+ */
 /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
 * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
 *
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
 * vendor id: 0x108E (Sun Microsystems, Inc.)
 * device id: 0xabba (Cassini)
 * revision ids: 0x01 = Cassini
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 810dfc7de1f9..e2d47b24a869 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -608,7 +608,7 @@ static void cpmac_end_xmit(struct net_device *dev, int queue)
                        netdev_dbg(dev, "sent 0x%p, len=%d\n",
                                   desc->skb, desc->skb->len);
-                dev_kfree_skb_irq(desc->skb);
+                dev_consume_skb_irq(desc->skb);
                desc->skb = NULL;
                if (__netif_subqueue_stopped(dev, queue))
                        netif_wake_subqueue(dev, queue);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index ef6f766f6389..e859ae2e42d5 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
        u32 total_data_buflen;
 };
+#define NETVSC_HASH_KEYLEN 40
 struct netvsc_device_info {
        unsigned char mac_adr[ETH_ALEN];
        u32  num_chn;
@@ -151,6 +153,8 @@ struct netvsc_device_info {
        u32  recv_sections;
        u32  send_section_size;
        u32  recv_section_size;
+        u8 rss_key[NETVSC_HASH_KEYLEN];
 };
 enum rndis_device_state {
@@ -160,8 +164,6 @@ enum rndis_device_state {
        RNDIS_DEV_DATAINITIALIZED,
 };
-#define NETVSC_HASH_KEYLEN 40
 struct rndis_device {
        struct net_device *ndev;
@@ -209,7 +211,9 @@ int netvsc_recv_callback(struct net_device *net,
 void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
@@ -1177,7 +1181,7 @@ enum ndis_per_pkt_info_type {
 enum rndis_per_pkt_info_interal_type {
        RNDIS_PKTINFO_ID = 1,
-        /* Add more memebers here */
+        /* Add more members here */
        RNDIS_PKTINFO_MAX
 };
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 922054c1d544..813d195bbd57 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
        rdev = nvdev->extension;
        if (rdev) {
-                ret = rndis_set_subchannel(rdev->ndev, nvdev);
+                ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
                if (ret == 0) {
                        netif_device_attach(rdev->ndev);
                } else {
@@ -1331,7 +1331,7 @@ void netvsc_channel_cb(void *context)
        prefetch(hv_get_ring_buffer(rbi) + rbi->priv_read_index);
        if (napi_schedule_prep(&nvchan->napi)) {
-                /* disable interupts from host */
+                /* disable interrupts from host */
                hv_begin_read(rbi);
                __napi_schedule_irqoff(&nvchan->napi);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 91ed15ea5883..256adbd044f5 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -370,7 +370,7 @@ static u32 fill_pg_buf(struct page *page, u32 offset, u32 len,
 {
        int j = 0;
-        /* Deal with compund pages by ignoring unused part
+        /* Deal with compound pages by ignoring unused part
         * of the page.
         */
        page += (offset >> PAGE_SHIFT);
@@ -858,6 +858,39 @@ static void netvsc_get_channels(struct net_device *net,
        }
 }
+/* Alloc struct netvsc_device_info, and initialize it from either existing
+ * struct netvsc_device, or from default values.
+ */
+static struct netvsc_device_info *netvsc_devinfo_get
+                        (struct netvsc_device *nvdev)
+{
+        struct netvsc_device_info *dev_info;
+        dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
+        if (!dev_info)
+                return NULL;
+        if (nvdev) {
+                dev_info->num_chn = nvdev->num_chn;
+                dev_info->send_sections = nvdev->send_section_cnt;
+                dev_info->send_section_size = nvdev->send_section_size;
+                dev_info->recv_sections = nvdev->recv_section_cnt;
+                dev_info->recv_section_size = nvdev->recv_section_size;
+                memcpy(dev_info->rss_key, nvdev->extension->rss_key,
+                       NETVSC_HASH_KEYLEN);
+        } else {
+                dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
+                dev_info->send_sections = NETVSC_DEFAULT_TX;
+                dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
+                dev_info->recv_sections = NETVSC_DEFAULT_RX;
+                dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
+        return dev_info;
+}
 static int netvsc_detach(struct net_device *ndev,
                         struct netvsc_device *nvdev)
 {
@@ -909,7 +942,7 @@ static int netvsc_attach(struct net_device *ndev,
                return PTR_ERR(nvdev);
        if (nvdev->num_chn > 1) {
-                ret = rndis_set_subchannel(ndev, nvdev);
+                ret = rndis_set_subchannel(ndev, nvdev, dev_info);
                /* if unavailable, just proceed with one queue */
                if (ret) {
@@ -943,7 +976,7 @@ static int netvsc_set_channels(struct net_device *net,
        struct net_device_context *net_device_ctx = netdev_priv(net);
        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
        unsigned int orig, count = channels->combined_count;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        int ret;
        /* We do not support separate count for rx, tx, or other */
@@ -962,24 +995,26 @@ static int netvsc_set_channels(struct net_device *net,
        orig = nvdev->num_chn;
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(nvdev);
-        device_info.num_chn = count;
-        device_info.send_sections = nvdev->send_section_cnt;
+        if (!device_info)
-        device_info.send_section_size = nvdev->send_section_size;
+                return -ENOMEM;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info->num_chn = count;
        ret = netvsc_detach(net, nvdev);
        if (ret)
-                return ret;
+                goto out;
-        ret = netvsc_attach(net, &device_info);
+        ret = netvsc_attach(net, device_info);
        if (ret) {
-                device_info.num_chn = orig;
+                device_info->num_chn = orig;
-                if (netvsc_attach(net, &device_info))
+                if (netvsc_attach(net, device_info))
                        netdev_err(net, "restoring channel setting failed\n");
        }
+out:
+        kfree(device_info);
        return ret;
 }
@@ -1048,48 +1083,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
        struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
        int orig_mtu = ndev->mtu;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        int ret = 0;
        if (!nvdev || nvdev->destroy)
                return -ENODEV;
+        device_info = netvsc_devinfo_get(nvdev);
+        if (!device_info)
+                return -ENOMEM;
        /* Change MTU of underlying VF netdev first. */
        if (vf_netdev) {
                ret = dev_set_mtu(vf_netdev, mtu);
                if (ret)
-                        return ret;
+                        goto out;
        }
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
        ret = netvsc_detach(ndev, nvdev);
        if (ret)
                goto rollback_vf;
        ndev->mtu = mtu;
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
-        if (ret)
+        if (!ret)
-                goto rollback;
+                goto out;
-        return 0;
-rollback:
        /* Attempt rollback to original MTU */
        ndev->mtu = orig_mtu;
-        if (netvsc_attach(ndev, &device_info))
+        if (netvsc_attach(ndev, device_info))
                netdev_err(ndev, "restoring mtu failed\n");
 rollback_vf:
        if (vf_netdev)
                dev_set_mtu(vf_netdev, orig_mtu);
+out:
+        kfree(device_info);
        return ret;
 }
@@ -1674,7 +1706,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
        struct net_device_context *ndevctx = netdev_priv(ndev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        struct ethtool_ringparam orig;
        u32 new_tx, new_rx;
        int ret = 0;
@@ -1694,26 +1726,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
            new_rx == orig.rx_pending)
                return 0;        /* no change */
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(nvdev);
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = new_tx;
+        if (!device_info)
-        device_info.send_section_size = nvdev->send_section_size;
+                return -ENOMEM;
-        device_info.recv_sections = new_rx;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info->send_sections = new_tx;
+        device_info->recv_sections = new_rx;
        ret = netvsc_detach(ndev, nvdev);
        if (ret)
-                return ret;
+                goto out;
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
        if (ret) {
-                device_info.send_sections = orig.tx_pending;
+                device_info->send_sections = orig.tx_pending;
-                device_info.recv_sections = orig.rx_pending;
+                device_info->recv_sections = orig.rx_pending;
-                if (netvsc_attach(ndev, &device_info))
+                if (netvsc_attach(ndev, device_info))
                        netdev_err(ndev, "restoring ringparam failed");
        }
+out:
+        kfree(device_info);
        return ret;
 }
@@ -2088,7 +2123,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
        if (!netvsc_dev || rtnl_dereference(net_device_ctx->vf_netdev))
                return NOTIFY_DONE;
-        /* if syntihetic interface is a different namespace,
+        /* if synthetic interface is a different namespace,
         * then move the VF to that namespace; join will be
         * done again in that context.
         */
@@ -2167,7 +2202,7 @@ static int netvsc_probe(struct hv_device *dev,
 {
        struct net_device *net = NULL;
        struct net_device_context *net_device_ctx;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info = NULL;
        struct netvsc_device *nvdev;
        int ret = -ENOMEM;
@@ -2214,21 +2249,21 @@ static int netvsc_probe(struct hv_device *dev,
        netif_set_real_num_rx_queues(net, 1);
        /* Notify the netvsc driver of the new device */
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(NULL);
-        device_info.num_chn = VRSS_CHANNEL_DEFAULT;
-        device_info.send_sections = NETVSC_DEFAULT_TX;
+        if (!device_info) {
-        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
+                ret = -ENOMEM;
-        device_info.recv_sections = NETVSC_DEFAULT_RX;
+                goto devinfo_failed;
-        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
-        nvdev = rndis_filter_device_add(dev, &device_info);
+        nvdev = rndis_filter_device_add(dev, device_info);
        if (IS_ERR(nvdev)) {
                ret = PTR_ERR(nvdev);
                netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
                goto rndis_failed;
        }
-        memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
+        memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
        /* We must get rtnl lock before scheduling nvdev->subchan_work,
         * otherwise netvsc_subchan_work() can get rtnl lock first and wait
@@ -2236,7 +2271,7 @@ static int netvsc_probe(struct hv_device *dev,
         * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
         * -> ... -> device_add() -> ... -> __device_attach() can't get
         * the device lock, so all the subchannels can't be processed --
-         * finally netvsc_subchan_work() hangs for ever.
+         * finally netvsc_subchan_work() hangs forever.
         */
        rtnl_lock();
@@ -2266,12 +2301,16 @@ static int netvsc_probe(struct hv_device *dev,
        list_add(&net_device_ctx->list, &netvsc_dev_list);
        rtnl_unlock();
+        kfree(device_info);
        return 0;
 register_failed:
        rtnl_unlock();
        rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
+        kfree(device_info);
+devinfo_failed:
        free_percpu(net_device_ctx->vf_stats);
 no_stats:
        hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 8b537a049c1e..73b60592de06 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -774,8 +774,8 @@ cleanup:
        return ret;
 }
-int rndis_filter_set_rss_param(struct rndis_device *rdev,
+static int rndis_set_rss_param_msg(struct rndis_device *rdev,
-                               const u8 *rss_key)
+                                   const u8 *rss_key, u16 flag)
 {
        struct net_device *ndev = rdev->ndev;
        struct rndis_request *request;
@@ -804,7 +804,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
        rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
        rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
        rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
-        rssp->flag = 0;
+        rssp->flag = flag;
        rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
                         NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
                         NDIS_HASH_TCP_IPV6;
@@ -829,9 +829,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
        wait_for_completion(&request->wait_event);
        set_complete = &request->response_msg.msg.set_complete;
-        if (set_complete->status == RNDIS_STATUS_SUCCESS)
+        if (set_complete->status == RNDIS_STATUS_SUCCESS) {
-                memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+                if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
-        else {
+                    !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
+                        memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+        } else {
                netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
                           set_complete->status);
                ret = -EINVAL;
@@ -842,6 +845,16 @@ cleanup:
        return ret;
 }
+int rndis_filter_set_rss_param(struct rndis_device *rdev,
+                               const u8 *rss_key)
+{
+        /* Disable RSS before change */
+        rndis_set_rss_param_msg(rdev, rss_key,
+                                NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
+        return rndis_set_rss_param_msg(rdev, rss_key, 0);
+}
 static int rndis_filter_query_device_link_status(struct rndis_device *dev,
                                                 struct netvsc_device *net_device)
 {
@@ -1121,7 +1134,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
 * This breaks overlap of processing the host message for the
 * new primary channel with the initialization of sub-channels.
 */
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info)
 {
        struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
        struct net_device_context *ndev_ctx = netdev_priv(ndev);
@@ -1161,8 +1176,11 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
        wait_event(nvdev->subchan_open,
                   atomic_read(&nvdev->open_chn) == nvdev->num_chn);
-        /* ignore failues from setting rss parameters, still have channels */
+        /* ignore failures from setting rss parameters, still have channels */
-        rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+        if (dev_info)
+                rndis_filter_set_rss_param(rdev, dev_info->rss_key);
+        else
+                rndis_filter_set_rss_param(rdev, netvsc_hash_key);
        netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
        netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
diff --git a/drivers/net/phy/asix.c b/drivers/net/phy/asix.c
index 8ebe7f5484ae..f14ba5366b91 100644
--- a/drivers/net/phy/asix.c
+++ b/drivers/net/phy/asix.c
@@ -1,13 +1,7 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* Driver for Asix PHYs
 *
 * Author: Michael Schmitz <schmitzmic@gmail.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- *
 */
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/drivers/net/phy/mdio-hisi-femac.c b/drivers/net/phy/mdio-hisi-femac.c
index b03fedd6c1d8..287f3ccf1da1 100644
--- a/drivers/net/phy/mdio-hisi-femac.c
+++ b/drivers/net/phy/mdio-hisi-femac.c
@@ -1,20 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
 * Hisilicon Fast Ethernet MDIO Bus Driver
 *
 * Copyright (c) 2016 HiSilicon Technologies Co., Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
 #include <linux/clk.h>
@@ -163,4 +151,4 @@ module_platform_driver(hisi_femac_mdio_driver);
 MODULE_DESCRIPTION("Hisilicon Fast Ethernet MAC MDIO interface driver");
 MODULE_AUTHOR("Dongpo Li <lidongpo@hisilicon.com>");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/rockchip.c b/drivers/net/phy/rockchip.c
index f1da70b9b55f..95abf7072f32 100644
--- a/drivers/net/phy/rockchip.c
+++ b/drivers/net/phy/rockchip.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /**
 * drivers/net/phy/rockchip.c
 *
@@ -6,12 +7,6 @@
 * Copyright (c) 2017, Fuzhou Rockchip Electronics Co., Ltd
 *
 * David Wu <david.wu@rock-chips.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
 */
 #include <linux/ethtool.h>
@@ -229,4 +224,4 @@ MODULE_DEVICE_TABLE(mdio, rockchip_phy_tbl);
 MODULE_AUTHOR("David Wu <david.wu@rock-chips.com>");
 MODULE_DESCRIPTION("Rockchip Ethernet PHY driver");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index b654f05b2ccd..3d93993e74da 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
        asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
        chipcode &= AX_CHIPCODE_MASK;
-        (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+        ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
-                                            ax88772a_hw_reset(dev, 0);
+                                                  ax88772a_hw_reset(dev, 0);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
+                return ret;
+        }
        /* Read PHYID register *AFTER* the PHY was reset properly */
        phyid = asix_get_phyid(dev);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3a4b8786f7ea..320edcac4699 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                        BIT(NL80211_CHAN_WIDTH_160);
        }
+        if (!n_limits) {
+                err = -EINVAL;
+                goto failed_hw;
+        }
        data->if_combination.n_limits = n_limits;
        data->if_combination.max_interfaces = 2048;
        data->if_combination.limits = data->if_limits;
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index 64b218699656..3a93e4d9828b 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -530,8 +530,10 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
        SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
        dev->ieee80211_ptr = kzalloc(sizeof(*dev->ieee80211_ptr), GFP_KERNEL);
-        if (!dev->ieee80211_ptr)
+        if (!dev->ieee80211_ptr) {
+                err = -ENOMEM;
                goto remove_handler;
+        }
        dev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
        dev->ieee80211_ptr->wiphy = common_wiphy;
diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
index 0cf58cabc9ed..3cf50274fadb 100644
--- a/drivers/nvdimm/dimm.c
+++ b/drivers/nvdimm/dimm.c
@@ -26,6 +26,12 @@ static int nvdimm_probe(struct device *dev)
        struct nvdimm_drvdata *ndd;
        int rc;
+        rc = nvdimm_security_setup_events(dev);
+        if (rc < 0) {
+                dev_err(dev, "security event setup failed: %d\n", rc);
+                return rc;
+        }
        rc = nvdimm_check_config_data(dev);
        if (rc) {
                /* not required for non-aliased nvdimm, ex. NVDIMM-N */
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 4890310df874..efe412a6b5b9 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -578,13 +578,25 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus,
 }
 EXPORT_SYMBOL_GPL(__nvdimm_create);
-int nvdimm_security_setup_events(struct nvdimm *nvdimm)
+static void shutdown_security_notify(void *data)
 {
-        nvdimm->sec.overwrite_state = sysfs_get_dirent(nvdimm->dev.kobj.sd,
+        struct nvdimm *nvdimm = data;
-                        "security");
+        sysfs_put(nvdimm->sec.overwrite_state);
+}
+int nvdimm_security_setup_events(struct device *dev)
+{
+        struct nvdimm *nvdimm = to_nvdimm(dev);
+        if (nvdimm->sec.state < 0 || !nvdimm->sec.ops
+                        || !nvdimm->sec.ops->overwrite)
+                return 0;
+        nvdimm->sec.overwrite_state = sysfs_get_dirent(dev->kobj.sd, "security");
        if (!nvdimm->sec.overwrite_state)
-                return -ENODEV;
+                return -ENOMEM;
-        return 0;
+        return devm_add_action_or_reset(dev, shutdown_security_notify, nvdimm);
 }
 EXPORT_SYMBOL_GPL(nvdimm_security_setup_events);
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index cfde992684e7..379bf4305e61 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -250,6 +250,7 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
 void nvdimm_set_aliasing(struct device *dev);
 void nvdimm_set_locked(struct device *dev);
 void nvdimm_clear_locked(struct device *dev);
+int nvdimm_security_setup_events(struct device *dev);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
 int nvdimm_security_unlock(struct device *dev);
 #else
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index df4b3a6db51b..b9fff3b8ed1b 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -545,8 +545,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
        timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
        ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
                ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
-        if (!(ctrl->anacap & (1 << 6)))
+        ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
-                ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
        if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
                dev_err(ctrl->device,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9bc585415d9b..a0fdd5fb4e7a 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2041,53 +2041,52 @@ static int nvme_setup_host_mem(struct nvme_dev *dev)
        return ret;
 }
-/* irq_queues covers admin queue */
+/*
-static void nvme_calc_io_queues(struct nvme_dev *dev, unsigned int irq_queues)
+ * nirqs is the number of interrupts available for write and read
+ * queues. The core already reserved an interrupt for the admin queue.
+ */
+static void nvme_calc_irq_sets(struct irq_affinity *affd, unsigned int nrirqs)
 {
-        unsigned int this_w_queues = write_queues;
+        struct nvme_dev *dev = affd->priv;
+        unsigned int nr_read_queues;
-        WARN_ON(!irq_queues);
-        /*
-         * Setup read/write queue split, assign admin queue one independent
-         * irq vector if irq_queues is > 1.
-         */
-        if (irq_queues <= 2) {
-                dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
-                dev->io_queues[HCTX_TYPE_READ] = 0;
-                return;
-        }
-        /*
-         * If 'write_queues' is set, ensure it leaves room for at least
-         * one read queue and one admin queue
-         */
-        if (this_w_queues >= irq_queues)
-                this_w_queues = irq_queues - 2;
        /*
-         * If 'write_queues' is set to zero, reads and writes will share
+         * If there is no interupt available for queues, ensure that
-         * a queue set.
+         * the default queue is set to 1. The affinity set size is
+         * also set to one, but the irq core ignores it for this case.
+         *
+         * If only one interrupt is available or 'write_queue' == 0, combine
+         * write and read queues.
+         *
+         * If 'write_queues' > 0, ensure it leaves room for at least one read
+         * queue.
         */
-        if (!this_w_queues) {
+        if (!nrirqs) {
-                dev->io_queues[HCTX_TYPE_DEFAULT] = irq_queues - 1;
+                nrirqs = 1;
-                dev->io_queues[HCTX_TYPE_READ] = 0;
+                nr_read_queues = 0;
+        } else if (nrirqs == 1 || !write_queues) {
+                nr_read_queues = 0;
+        } else if (write_queues >= nrirqs) {
+                nr_read_queues = 1;
        } else {
-                dev->io_queues[HCTX_TYPE_DEFAULT] = this_w_queues;
+                nr_read_queues = nrirqs - write_queues;
-                dev->io_queues[HCTX_TYPE_READ] = irq_queues - this_w_queues - 1;
        }
+        dev->io_queues[HCTX_TYPE_DEFAULT] = nrirqs - nr_read_queues;
+        affd->set_size[HCTX_TYPE_DEFAULT] = nrirqs - nr_read_queues;
+        dev->io_queues[HCTX_TYPE_READ] = nr_read_queues;
+        affd->set_size[HCTX_TYPE_READ] = nr_read_queues;
+        affd->nr_sets = nr_read_queues ? 2 : 1;
 }
 static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
 {
        struct pci_dev *pdev = to_pci_dev(dev->dev);
-        int irq_sets[2];
        struct irq_affinity affd = {
-                .pre_vectors = 1,
+                .pre_vectors    = 1,
-                .nr_sets = ARRAY_SIZE(irq_sets),
+                .calc_sets      = nvme_calc_irq_sets,
-                .sets = irq_sets,
+                .priv           = dev,
        };
-        int result = 0;
        unsigned int irq_queues, this_p_queues;
        /*
@@ -2103,51 +2102,12 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
        }
        dev->io_queues[HCTX_TYPE_POLL] = this_p_queues;
-        /*
+        /* Initialize for the single interrupt case */
-         * For irq sets, we have to ask for minvec == maxvec. This passes
+        dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
-         * any reduction back to us, so we can adjust our queue counts and
+        dev->io_queues[HCTX_TYPE_READ] = 0;
-         * IRQ vector needs.
-         */
-        do {
-                nvme_calc_io_queues(dev, irq_queues);
-                irq_sets[0] = dev->io_queues[HCTX_TYPE_DEFAULT];
-                irq_sets[1] = dev->io_queues[HCTX_TYPE_READ];
-                if (!irq_sets[1])
-                        affd.nr_sets = 1;
-                /*
-                 * If we got a failure and we're down to asking for just
-                 * 1 + 1 queues, just ask for a single vector. We'll share
-                 * that between the single IO queue and the admin queue.
-                 * Otherwise, we assign one independent vector to admin queue.
-                 */
-                if (irq_queues > 1)
-                        irq_queues = irq_sets[0] + irq_sets[1] + 1;
-                result = pci_alloc_irq_vectors_affinity(pdev, irq_queues,
+        return pci_alloc_irq_vectors_affinity(pdev, 1, irq_queues,
-                                irq_queues,
+                              PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY, &affd);
-                                PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY, &affd);
-                /*
-                 * Need to reduce our vec counts. If we get ENOSPC, the
-                 * platform should support mulitple vecs, we just need
-                 * to decrease our ask. If we get EINVAL, the platform
-                 * likely does not. Back down to ask for just one vector.
-                 */
-                if (result == -ENOSPC) {
-                        irq_queues--;
-                        if (!irq_queues)
-                                return result;
-                        continue;
-                } else if (result == -EINVAL) {
-                        irq_queues = 1;
-                        continue;
-                } else if (result <= 0)
-                        return -EIO;
-                break;
-        } while (1);
-        return result;
 }
 static void nvme_disable_io_queues(struct nvme_dev *dev)
@@ -3020,6 +2980,7 @@ static struct pci_driver nvme_driver = {
 static int __init nvme_init(void)
 {
+        BUILD_BUG_ON(IRQ_AFFINITY_MAX_SETS < 2);
        return pci_register_driver(&nvme_driver);
 }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 0a2fd2949ad7..52abc3a6de12 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -119,6 +119,7 @@ struct nvme_rdma_ctrl {
        struct nvme_ctrl        ctrl;
        bool                    use_inline_data;
+        u32                     io_queues[HCTX_MAX_TYPES];
 };
 static inline struct nvme_rdma_ctrl *to_rdma_ctrl(struct nvme_ctrl *ctrl)
@@ -165,8 +166,8 @@ static inline int nvme_rdma_queue_idx(struct nvme_rdma_queue *queue)
 static bool nvme_rdma_poll_queue(struct nvme_rdma_queue *queue)
 {
        return nvme_rdma_queue_idx(queue) >
-                queue->ctrl->ctrl.opts->nr_io_queues +
+                queue->ctrl->io_queues[HCTX_TYPE_DEFAULT] +
-                queue->ctrl->ctrl.opts->nr_write_queues;
+                queue->ctrl->io_queues[HCTX_TYPE_READ];
 }
 static inline size_t nvme_rdma_inline_data_size(struct nvme_rdma_queue *queue)
@@ -661,8 +662,21 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
        nr_io_queues = min_t(unsigned int, nr_io_queues,
                                ibdev->num_comp_vectors);
-        nr_io_queues += min(opts->nr_write_queues, num_online_cpus());
+        if (opts->nr_write_queues) {
-        nr_io_queues += min(opts->nr_poll_queues, num_online_cpus());
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] =
+                                min(opts->nr_write_queues, nr_io_queues);
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        } else {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] = nr_io_queues;
+        }
+        ctrl->io_queues[HCTX_TYPE_READ] = nr_io_queues;
+        if (opts->nr_poll_queues) {
+                ctrl->io_queues[HCTX_TYPE_POLL] =
+                        min(opts->nr_poll_queues, num_online_cpus());
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_POLL];
+        }
        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
        if (ret)
@@ -1689,18 +1703,28 @@ static enum blk_eh_timer_return
 nvme_rdma_timeout(struct request *rq, bool reserved)
 {
        struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
+        struct nvme_rdma_queue *queue = req->queue;
+        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        dev_warn(req->queue->ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
-                 "I/O %d QID %d timeout, reset controller\n",
+                 rq->tag, nvme_rdma_queue_idx(queue));
-                 rq->tag, nvme_rdma_queue_idx(req->queue));
-        /* queue error recovery */
+        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-        nvme_rdma_error_recovery(req->queue->ctrl);
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_rdma_teardown_io_queues(ctrl, false);
+                nvme_rdma_teardown_admin_queue(ctrl, false);
+                return BLK_EH_DONE;
+        }
-        /* fail with DNR on cmd timeout */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
-        nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
+        nvme_rdma_error_recovery(ctrl);
-        return BLK_EH_DONE;
+        return BLK_EH_RESET_TIMER;
 }
 static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1779,17 +1803,15 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
        struct nvme_rdma_ctrl *ctrl = set->driver_data;
        set->map[HCTX_TYPE_DEFAULT].queue_offset = 0;
-        set->map[HCTX_TYPE_READ].nr_queues = ctrl->ctrl.opts->nr_io_queues;
+        set->map[HCTX_TYPE_DEFAULT].nr_queues =
+                        ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        set->map[HCTX_TYPE_READ].nr_queues = ctrl->io_queues[HCTX_TYPE_READ];
        if (ctrl->ctrl.opts->nr_write_queues) {
                /* separate read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_write_queues;
                set->map[HCTX_TYPE_READ].queue_offset =
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
        } else {
                /* mixed read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_io_queues;
                set->map[HCTX_TYPE_READ].queue_offset = 0;
        }
        blk_mq_rdma_map_queues(&set->map[HCTX_TYPE_DEFAULT],
@@ -1799,12 +1821,12 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
        if (ctrl->ctrl.opts->nr_poll_queues) {
                set->map[HCTX_TYPE_POLL].nr_queues =
-                                ctrl->ctrl.opts->nr_poll_queues;
+                                ctrl->io_queues[HCTX_TYPE_POLL];
                set->map[HCTX_TYPE_POLL].queue_offset =
-                                ctrl->ctrl.opts->nr_io_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
                if (ctrl->ctrl.opts->nr_write_queues)
                        set->map[HCTX_TYPE_POLL].queue_offset +=
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_READ];
                blk_mq_map_queues(&set->map[HCTX_TYPE_POLL]);
        }
        return 0;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 265a0543b381..5f0a00425242 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1948,20 +1948,23 @@ nvme_tcp_timeout(struct request *rq, bool reserved)
        struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
        struct nvme_tcp_cmd_pdu *pdu = req->pdu;
-        dev_dbg(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                "queue %d: timeout request %#x type %d\n",
-                nvme_tcp_queue_id(req->queue), rq->tag,
+                nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
-                pdu->hdr.type);
        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-                union nvme_result res = {};
+                /*
+                 * Teardown immediately if controller times out while starting
-                nvme_req(rq)->flags |= NVME_REQ_CANCELLED;
+                 * or we are already started error recovery. all outstanding
-                nvme_end_request(rq, cpu_to_le16(NVME_SC_ABORT_REQ), res);
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+                nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
                return BLK_EH_DONE;
        }
-        /* queue error recovery */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
        nvme_tcp_error_recovery(&ctrl->ctrl);
        return BLK_EH_RESET_TIMER;
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index a8d23eb80192..a884e3a0e8af 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -139,6 +139,10 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
 static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
+static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
+static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
 static const struct nvmet_fabrics_ops nvmet_rdma_ops;
@@ -182,9 +186,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
        spin_unlock_irqrestore(&queue->rsps_lock, flags);
        if (unlikely(!rsp)) {
-                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                int ret;
+                rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
                if (unlikely(!rsp))
                        return NULL;
+                ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
+                if (unlikely(ret)) {
+                        kfree(rsp);
+                        return NULL;
+                }
                rsp->allocated = true;
        }
@@ -197,6 +209,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
        unsigned long flags;
        if (unlikely(rsp->allocated)) {
+                nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
                kfree(rsp);
                return;
        }
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 52e47dac028f..80f843030e36 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -310,6 +310,9 @@ static int imx6_pcie_attach_pd(struct device *dev)
        imx6_pcie->pd_pcie = dev_pm_domain_attach_by_name(dev, "pcie");
        if (IS_ERR(imx6_pcie->pd_pcie))
                return PTR_ERR(imx6_pcie->pd_pcie);
+        /* Do nothing when power domain missing */
+        if (!imx6_pcie->pd_pcie)
+                return 0;
        link = device_link_add(dev, imx6_pcie->pd_pcie,
                        DL_FLAG_STATELESS |
                        DL_FLAG_PM_RUNTIME |
@@ -323,13 +326,13 @@ static int imx6_pcie_attach_pd(struct device *dev)
        if (IS_ERR(imx6_pcie->pd_pcie_phy))
                return PTR_ERR(imx6_pcie->pd_pcie_phy);
-        device_link_add(dev, imx6_pcie->pd_pcie_phy,
+        link = device_link_add(dev, imx6_pcie->pd_pcie_phy,
                        DL_FLAG_STATELESS |
                        DL_FLAG_PM_RUNTIME |
                        DL_FLAG_RPM_ACTIVE);
-        if (IS_ERR(link)) {
+        if (!link) {
-                dev_err(dev, "Failed to add device_link to pcie_phy pd: %ld\n", PTR_ERR(link));
+                dev_err(dev, "Failed to add device_link to pcie_phy pd.\n");
-                return PTR_ERR(link);
+                return -EINVAL;
        }
        return 0;
diff --git a/drivers/pci/controller/dwc/pcie-armada8k.c b/drivers/pci/controller/dwc/pcie-armada8k.c
index b171b6bc15c8..0c389a30ef5d 100644
--- a/drivers/pci/controller/dwc/pcie-armada8k.c
+++ b/drivers/pci/controller/dwc/pcie-armada8k.c
@@ -22,7 +22,6 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
-#include <linux/gpio/consumer.h>
 #include "pcie-designware.h"
@@ -30,7 +29,6 @@ struct armada8k_pcie {
        struct dw_pcie *pci;
        struct clk *clk;
        struct clk *clk_reg;
-        struct gpio_desc *reset_gpio;
 };
 #define PCIE_VENDOR_REGS_OFFSET         0x8000
@@ -139,12 +137,6 @@ static int armada8k_pcie_host_init(struct pcie_port *pp)
        struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
        struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
-        if (pcie->reset_gpio) {
-                /* assert and then deassert the reset signal */
-                gpiod_set_value_cansleep(pcie->reset_gpio, 1);
-                msleep(100);
-                gpiod_set_value_cansleep(pcie->reset_gpio, 0);
-        }
        dw_pcie_setup_rc(pp);
        armada8k_pcie_establish_link(pcie);
@@ -257,14 +249,6 @@ static int armada8k_pcie_probe(struct platform_device *pdev)
                goto fail_clkreg;
        }
-        /* Get reset gpio signal and hold asserted (logically high) */
-        pcie->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-                                                   GPIOD_OUT_HIGH);
-        if (IS_ERR(pcie->reset_gpio)) {
-                ret = PTR_ERR(pcie->reset_gpio);
-                goto fail_clkreg;
-        }
        platform_set_drvdata(pdev, pcie);
        ret = armada8k_add_pcie_port(pcie, pdev);
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 4c0b47867258..73986825d221 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -532,7 +532,7 @@ error_attrs:
 }
 static struct msi_desc *
-msi_setup_entry(struct pci_dev *dev, int nvec, const struct irq_affinity *affd)
+msi_setup_entry(struct pci_dev *dev, int nvec, struct irq_affinity *affd)
 {
        struct irq_affinity_desc *masks = NULL;
        struct msi_desc *entry;
@@ -597,7 +597,7 @@ static int msi_verify_entries(struct pci_dev *dev)
 * which could have been allocated.
 */
 static int msi_capability_init(struct pci_dev *dev, int nvec,
-                               const struct irq_affinity *affd)
+                               struct irq_affinity *affd)
 {
        struct msi_desc *entry;
        int ret;
@@ -669,7 +669,7 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries)
 static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
                              struct msix_entry *entries, int nvec,
-                              const struct irq_affinity *affd)
+                              struct irq_affinity *affd)
 {
        struct irq_affinity_desc *curmsk, *masks = NULL;
        struct msi_desc *entry;
@@ -736,7 +736,7 @@ static void msix_program_entries(struct pci_dev *dev,
 * requested MSI-X entries with allocated irqs or non-zero for otherwise.
 **/
 static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
-                                int nvec, const struct irq_affinity *affd)
+                                int nvec, struct irq_affinity *affd)
 {
        int ret;
        u16 control;
@@ -932,7 +932,7 @@ int pci_msix_vec_count(struct pci_dev *dev)
 EXPORT_SYMBOL(pci_msix_vec_count);
 static int __pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries,
-                             int nvec, const struct irq_affinity *affd)
+                             int nvec, struct irq_affinity *affd)
 {
        int nr_entries;
        int i, j;
@@ -1018,7 +1018,7 @@ int pci_msi_enabled(void)
 EXPORT_SYMBOL(pci_msi_enabled);
 static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
-                                  const struct irq_affinity *affd)
+                                  struct irq_affinity *affd)
 {
        int nvec;
        int rc;
@@ -1035,13 +1035,6 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
        if (maxvec < minvec)
                return -ERANGE;
-        /*
-         * If the caller is passing in sets, we can't support a range of
-         * vectors. The caller needs to handle that.
-         */
-        if (affd && affd->nr_sets && minvec != maxvec)
-                return -EINVAL;
        if (WARN_ON_ONCE(dev->msi_enabled))
                return -EINVAL;
@@ -1086,20 +1079,13 @@ EXPORT_SYMBOL(pci_enable_msi);
 static int __pci_enable_msix_range(struct pci_dev *dev,
                                   struct msix_entry *entries, int minvec,
-                                   int maxvec, const struct irq_affinity *affd)
+                                   int maxvec, struct irq_affinity *affd)
 {
        int rc, nvec = maxvec;
        if (maxvec < minvec)
                return -ERANGE;
-        /*
-         * If the caller is passing in sets, we can't support a range of
-         * supported vectors. The caller needs to handle that.
-         */
-        if (affd && affd->nr_sets && minvec != maxvec)
-                return -EINVAL;
        if (WARN_ON_ONCE(dev->msix_enabled))
                return -EINVAL;
@@ -1165,9 +1151,9 @@ EXPORT_SYMBOL(pci_enable_msix_range);
 */
 int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                   unsigned int max_vecs, unsigned int flags,
-                                   const struct irq_affinity *affd)
+                                   struct irq_affinity *affd)
 {
-        static const struct irq_affinity msi_default_affd;
+        struct irq_affinity msi_default_affd = {0};
        int msix_vecs = -ENOSPC;
        int msi_vecs = -ENOSPC;
@@ -1196,6 +1182,13 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
        /* use legacy irq if allowed */
        if (flags & PCI_IRQ_LEGACY) {
                if (min_vecs == 1 && dev->irq) {
+                        /*
+                         * Invoke the affinity spreading logic to ensure that
+                         * the device driver can adjust queue configuration
+                         * for the single interrupt case.
+                         */
+                        if (affd)
+                                irq_create_affinity_masks(1, affd);
                        pci_intx(dev, 1);
                        return 1;
                }
diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
index 6fd6e07ab345..09a77e556ece 100644
--- a/drivers/phy/qualcomm/phy-ath79-usb.c
+++ b/drivers/phy/qualcomm/phy-ath79-usb.c
@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
        err = reset_control_deassert(priv->reset);
        if (err && priv->no_suspend_override)
-                reset_control_assert(priv->no_suspend_override);
+                reset_control_deassert(priv->no_suspend_override);
        return err;
 }
@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
+        priv->reset = devm_reset_control_get(&pdev->dev, "phy");
        if (IS_ERR(priv->reset))
                return PTR_ERR(priv->reset);
diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
index 77fdaa551977..a52c5bb35033 100644
--- a/drivers/phy/ti/phy-gmii-sel.c
+++ b/drivers/phy/ti/phy-gmii-sel.c
@@ -204,11 +204,11 @@ static struct phy *phy_gmii_sel_of_xlate(struct device *dev,
        if (args->args_count < 1)
                return ERR_PTR(-EINVAL);
+        if (!priv || !priv->if_phys)
+                return ERR_PTR(-ENODEV);
        if (priv->soc_data->features & BIT(PHY_GMII_SEL_RMII_IO_CLK_EN) &&
            args->args_count < 2)
                return ERR_PTR(-EINVAL);
-        if (!priv || !priv->if_phys)
-                return ERR_PTR(-ENODEV);
        if (phy_id > priv->soc_data->num_ports)
                return ERR_PTR(-EINVAL);
        if (phy_id != priv->if_phys[phy_id - 1].id)
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 05044e323ea5..03ec7a5d9d0b 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1513,7 +1513,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                },
        },
        {
@@ -1521,7 +1521,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "HP"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                },
        },
        {
@@ -1529,7 +1529,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                },
        },
        {
@@ -1537,7 +1537,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
-                        DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
                },
        },
        {}
diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig
index 1817786ab6aa..a005cbccb4f7 100644
--- a/drivers/pinctrl/mediatek/Kconfig
+++ b/drivers/pinctrl/mediatek/Kconfig
@@ -45,12 +45,14 @@ config PINCTRL_MT2701
 config PINCTRL_MT7623
        bool "Mediatek MT7623 pin control with generic binding"
        depends on MACH_MT7623 || COMPILE_TEST
+        depends on OF
        default MACH_MT7623
        select PINCTRL_MTK_MOORE
 config PINCTRL_MT7629
        bool "Mediatek MT7629 pin control"
        depends on MACH_MT7629 || COMPILE_TEST
+        depends on OF
        default MACH_MT7629
        select PINCTRL_MTK_MOORE
@@ -92,6 +94,7 @@ config PINCTRL_MT6797
 config PINCTRL_MT7622
        bool "MediaTek MT7622 pin control"
+        depends on OF
        depends on ARM64 || COMPILE_TEST
        default ARM64 && ARCH_MEDIATEK
        select PINCTRL_MTK_MOORE
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index b03481ef99a1..98905d4a79ca 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                break;
        case MCP_TYPE_S18:
+                one_regmap_config =
+                        devm_kmemdup(dev, &mcp23x17_regmap,
+                                sizeof(struct regmap_config), GFP_KERNEL);
+                if (!one_regmap_config)
+                        return -ENOMEM;
                mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp,
-                                               &mcp23x17_regmap);
+                                               one_regmap_config);
                mcp->reg_shift = 1;
                mcp->chip.ngpio = 16;
                mcp->chip.label = "mcp23s18";
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
index aa8b58125568..ef4268cc6227 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
@@ -588,7 +588,7 @@ static const unsigned int h6_irq_bank_map[] = { 1, 5, 6, 7 };
 static const struct sunxi_pinctrl_desc h6_pinctrl_data = {
        .pins = h6_pins,
        .npins = ARRAY_SIZE(h6_pins),
-        .irq_banks = 3,
+        .irq_banks = 4,
        .irq_bank_map = h6_irq_bank_map,
        .irq_read_needs_mux = true,
 };
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 5d9184d18c16..0e7fa69e93df 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -698,26 +698,24 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
        unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
-        struct regulator *reg;
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
+        struct regulator *reg = s_reg->regulator;
+        char supply[16];
        int ret;
-        reg = s_reg->regulator;
+        if (reg) {
-        if (!reg) {
-                char supply[16];
-                snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
-                reg = regulator_get(pctl->dev, supply);
-                if (IS_ERR(reg)) {
-                        dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
-                                'A' + bank);
-                        return PTR_ERR(reg);
-                }
-                s_reg->regulator = reg;
-                refcount_set(&s_reg->refcount, 1);
-        } else {
                refcount_inc(&s_reg->refcount);
+                return 0;
+        }
+        snprintf(supply, sizeof(supply), "vcc-p%c", 'a' + bank);
+        reg = regulator_get(pctl->dev, supply);
+        if (IS_ERR(reg)) {
+                dev_err(pctl->dev, "Couldn't get bank P%c regulator\n",
+                        'A' + bank);
+                return PTR_ERR(reg);
        }
        ret = regulator_enable(reg);
@@ -727,13 +725,13 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
                goto out;
        }
+        s_reg->regulator = reg;
+        refcount_set(&s_reg->refcount, 1);
        return 0;
 out:
-        if (refcount_dec_and_test(&s_reg->refcount)) {
+        regulator_put(s_reg->regulator);
-                regulator_put(s_reg->regulator);
-                s_reg->regulator = NULL;
-        }
        return ret;
 }
@@ -742,7 +740,9 @@ static int sunxi_pmx_free(struct pinctrl_dev *pctldev, unsigned offset)
 {
        struct sunxi_pinctrl *pctl = pinctrl_dev_get_drvdata(pctldev);
        unsigned short bank = offset / PINS_PER_BANK;
-        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank];
+        unsigned short bank_offset = bank - pctl->desc->pin_base /
+                                            PINS_PER_BANK;
+        struct sunxi_pinctrl_regulator *s_reg = &pctl->regulators[bank_offset];
        if (!refcount_dec_and_test(&s_reg->refcount))
                return 0;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index e340d2a24b44..034c0317c8d6 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -136,7 +136,7 @@ struct sunxi_pinctrl {
        struct gpio_chip                *chip;
        const struct sunxi_pinctrl_desc *desc;
        struct device                   *dev;
-        struct sunxi_pinctrl_regulator  regulators[12];
+        struct sunxi_pinctrl_regulator  regulators[9];
        struct irq_domain               *domain;
        struct sunxi_pinctrl_function   *functions;
        unsigned                        nfunctions;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 5e2109c54c7c..b5e9db85e881 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -905,6 +905,7 @@ config TOSHIBA_WMI
 config ACPI_CMPC
        tristate "CMPC Laptop Extras"
        depends on ACPI && INPUT
+        depends on BACKLIGHT_LCD_SUPPORT
        depends on RFKILL || RFKILL=n
        select BACKLIGHT_CLASS_DEVICE
        help
@@ -1128,6 +1129,7 @@ config INTEL_OAKTRAIL
 config SAMSUNG_Q10
        tristate "Samsung Q10 Extras"
        depends on ACPI
+        depends on BACKLIGHT_LCD_SUPPORT
        select BACKLIGHT_CLASS_DEVICE
        ---help---
          This driver provides support for backlight control on Samsung Q10
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
index 194ffd5c8580..039b2074db7e 100644
--- a/drivers/s390/char/sclp_config.c
+++ b/drivers/s390/char/sclp_config.c
@@ -60,7 +60,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
 static void __ref sclp_cpu_change_notify(struct work_struct *work)
 {
+        lock_device_hotplug();
        smp_rescan_cpus();
+        unlock_device_hotplug();
 }
 static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 9cf30d124b9e..e390f8c6d5f3 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -403,7 +403,6 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
                goto failed;
        /* report size limit per scatter-gather segment */
-        adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
        adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
        adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 00acc7144bbc..f4f6a07c5222 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -428,6 +428,8 @@ static struct scsi_host_template zfcp_scsi_host_template = {
        .max_sectors             = (((QDIO_MAX_ELEMENTS_PER_BUFFER - 1)
                                     * ZFCP_QDIO_MAX_SBALS_PER_REQ) - 2) * 8,
                                   /* GCD, adjusted later */
+        /* report size limit per scatter-gather segment */
+        .max_segment_size        = ZFCP_QDIO_SBALE_LEN,
        .dma_boundary            = ZFCP_QDIO_SBALE_LEN - 1,
        .shost_attrs             = zfcp_sysfs_shost_attrs,
        .sdev_attrs              = zfcp_sysfs_sdev_attrs,
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 128d658d472a..16957d7ac414 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
        if(tpnt->sdev_attrs == NULL)
                tpnt->sdev_attrs = NCR_700_dev_attrs;
-        memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript,
+        memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript,
                                 GFP_KERNEL, DMA_ATTR_NON_CONSISTENT);
        if(memory == NULL) {
                printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n");
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 634ddb90e7aa..7e56a11836c1 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1747,11 +1747,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                shost->max_sectors = (shost->sg_tablesize * 8) + 112;
        }
-        error = dma_set_max_seg_size(&pdev->dev,
+        if (aac->adapter_info.options & AAC_OPT_NEW_COMM)
-                (aac->adapter_info.options & AAC_OPT_NEW_COMM) ?
+                shost->max_segment_size = shost->max_sectors << 9;
-                        (shost->max_sectors << 9) : 65536);
+        else
-        if (error)
+                shost->max_segment_size = 65536;
-                goto out_deinit;
        /*
         * Firmware printf works only with older firmware.
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 74e260027c7d..76e49d902609 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -3566,7 +3566,7 @@ static void be2iscsi_enable_msix(struct beiscsi_hba *phba)
        /* if eqid_count == 1 fall back to INTX */
        if (enable_msix && nvec > 1) {
-                const struct irq_affinity desc = { .post_vectors = 1 };
+                struct irq_affinity desc = { .post_vectors = 1 };
                if (pci_alloc_irq_vectors_affinity(phba->pcidev, 2, nvec,
                                PCI_IRQ_MSIX | PCI_IRQ_AFFINITY, &desc) < 0) {
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 350257c13a5b..bc9f2a2365f4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                return NULL;
        }
+        cmgr->hba = hba;
        cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
                                  GFP_KERNEL);
        if (!cmgr->free_list) {
@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
                goto mem_err;
        }
-        cmgr->hba = hba;
        cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1);
        for (i = 0; i < arr_sz; i++)  {
@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
        /* Allocate pool of io_bdts - one for each bnx2fc_cmd */
        mem_size = num_ios * sizeof(struct io_bdt *);
-        cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL);
+        cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL);
        if (!cmgr->io_bdt_pool) {
                printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n");
                goto mem_err;
diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
index 8a004036e3d7..9bd2bd8dc2be 100644
--- a/drivers/scsi/csiostor/csio_attr.c
+++ b/drivers/scsi/csiostor/csio_attr.c
@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
        }
        fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
+        ln->fc_vport = fc_vport;
        if (csio_fcoe_alloc_vnp(hw, ln))
                goto error;
        *(struct csio_lnode **)fc_vport->dd_data = ln;
-        ln->fc_vport = fc_vport;
        if (!fc_vport->node_name)
                fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
        if (!fc_vport->port_name)
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index be83590ed955..ff943f477d6f 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
            fc_frame_payload_op(fp) != ELS_LS_ACC) {
                FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n");
                fc_lport_error(lport, fp);
-                goto err;
+                goto out;
        }
        flp = fc_frame_payload_get(fp, sizeof(*flp));
        if (!flp) {
                FC_LPORT_DBG(lport, "FLOGI bad response\n");
                fc_lport_error(lport, fp);
-                goto err;
+                goto out;
        }
        mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
                FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                             "lport->mfs:%hu\n", mfs, lport->mfs);
                fc_lport_error(lport, fp);
-                goto err;
+                goto out;
        }
        if (mfs <= lport->mfs) {
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 4c66b19e6199..8c9f79042228 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
                         lport);
        /* release any threads waiting for the unreg to complete */
-        complete(&lport->lport_unreg_done);
+        if (lport->vport->localport)
+                complete(lport->lport_unreg_cmp);
 }
 /* lpfc_nvme_remoteport_delete
@@ -2545,7 +2546,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
 */
 void
 lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
-                           struct lpfc_nvme_lport *lport)
+                           struct lpfc_nvme_lport *lport,
+                           struct completion *lport_unreg_cmp)
 {
 #if (IS_ENABLED(CONFIG_NVME_FC))
        u32 wait_tmo;
@@ -2557,8 +2559,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
         */
        wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
        while (true) {
-                ret = wait_for_completion_timeout(&lport->lport_unreg_done,
+                ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
-                                                  wait_tmo);
                if (unlikely(!ret)) {
                        lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
                                         "6176 Lport %p Localport %p wait "
@@ -2592,12 +2593,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
        struct lpfc_nvme_lport *lport;
        struct lpfc_nvme_ctrl_stat *cstat;
        int ret;
+        DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
        if (vport->nvmei_support == 0)
                return;
        localport = vport->localport;
-        vport->localport = NULL;
        lport = (struct lpfc_nvme_lport *)localport->private;
        cstat = lport->cstat;
@@ -2608,13 +2609,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
        /* lport's rport list is clear.  Unregister
         * lport and release resources.
         */
-        init_completion(&lport->lport_unreg_done);
+        lport->lport_unreg_cmp = &lport_unreg_cmp;
        ret = nvme_fc_unregister_localport(localport);
        /* Wait for completion.  This either blocks
         * indefinitely or succeeds
         */
-        lpfc_nvme_lport_unreg_wait(vport, lport);
+        lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
+        vport->localport = NULL;
        kfree(cstat);
        /* Regardless of the unregister upcall response, clear
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index cfd4719be25c..b234d0298994 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
 /* Declare nvme-based local and remote port definitions. */
 struct lpfc_nvme_lport {
        struct lpfc_vport *vport;
-        struct completion lport_unreg_done;
+        struct completion *lport_unreg_cmp;
        /* Add stats counters here */
        struct lpfc_nvme_ctrl_stat *cstat;
        atomic_t fc4NvmeLsRequests;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 6245f442d784..95fee83090eb 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
        struct lpfc_nvmet_tgtport *tport = targetport->private;
        /* release any threads waiting for the unreg to complete */
-        complete(&tport->tport_unreg_done);
+        if (tport->phba->targetport)
+                complete(tport->tport_unreg_cmp);
 }
 static void
@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
        struct lpfc_nvmet_tgtport *tgtp;
        struct lpfc_queue *wq;
        uint32_t qidx;
+        DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
        if (phba->nvmet_support == 0)
                return;
@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                        wq = phba->sli4_hba.nvme_wq[qidx];
                        lpfc_nvmet_wqfull_flush(phba, wq, NULL);
                }
-                init_completion(&tgtp->tport_unreg_done);
+                tgtp->tport_unreg_cmp = &tport_unreg_cmp;
                nvmet_fc_unregister_targetport(phba->targetport);
-                wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                wait_for_completion_timeout(&tport_unreg_cmp, 5);
                lpfc_nvmet_cleanup_io_context(phba);
        }
        phba->targetport = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 1aaff63f1f41..0ec1082ce7ef 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -34,7 +34,7 @@
 /* Used for NVME Target */
 struct lpfc_nvmet_tgtport {
        struct lpfc_hba *phba;
-        struct completion tport_unreg_done;
+        struct completion *tport_unreg_cmp;
        /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
        atomic_t rcv_ls_req_in;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 661512bec3ac..e27f4df24021 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -62,7 +62,7 @@
 /* make sure inq_product_rev string corresponds to this version */
 #define SDEBUG_VERSION "0188"   /* format to fit INQUIRY revision field */
-static const char *sdebug_version_date = "20180128";
+static const char *sdebug_version_date = "20190125";
 #define MY_NAME "scsi_debug"
@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void)
                (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10);
 }
-static void *fake_store(unsigned long long lba)
+static void *lba2fake_store(unsigned long long lba)
 {
        lba = do_div(lba, sdebug_store_sectors);
@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
        return ret;
 }
-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of
+/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of
- * arr into fake_store(lba,num) and return true. If comparison fails then
+ * arr into lba2fake_store(lba,num) and return true. If comparison fails then
 * return false. */
 static bool comp_write_worker(u64 lba, u32 num, const u8 *arr)
 {
@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
                if (sdt->app_tag == cpu_to_be16(0xffff))
                        continue;
-                ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
+                ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba);
                if (ret) {
                        dif_errors++;
                        return ret;
@@ -3261,10 +3261,12 @@ err_out:
 static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                           u32 ei_lba, bool unmap, bool ndob)
 {
+        int ret;
        unsigned long iflags;
        unsigned long long i;
-        int ret;
+        u32 lb_size = sdebug_sector_size;
-        u64 lba_off;
+        u64 block, lbaa;
+        u8 *fs1p;
        ret = check_device_access_params(scp, lba, num);
        if (ret)
@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
                unmap_region(lba, num);
                goto out;
        }
+        lbaa = lba;
-        lba_off = lba * sdebug_sector_size;
+        block = do_div(lbaa, sdebug_store_sectors);
        /* if ndob then zero 1 logical block, else fetch 1 logical block */
+        fs1p = fake_storep + (block * lb_size);
        if (ndob) {
-                memset(fake_storep + lba_off, 0, sdebug_sector_size);
+                memset(fs1p, 0, lb_size);
                ret = 0;
        } else
-                ret = fetch_to_dev_buffer(scp, fake_storep + lba_off,
+                ret = fetch_to_dev_buffer(scp, fs1p, lb_size);
-                                          sdebug_sector_size);
        if (-1 == ret) {
                write_unlock_irqrestore(&atomic_rw, iflags);
                return DID_ERROR << 16;
-        } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size))
+        } else if (sdebug_verbose && !ndob && (ret < lb_size))
                sdev_printk(KERN_INFO, scp->device,
                            "%s: %s: lb size=%u, IO sent=%d bytes\n",
-                            my_name, "write same",
+                            my_name, "write same", lb_size, ret);
-                            sdebug_sector_size, ret);
        /* Copy first sector to remaining blocks */
-        for (i = 1 ; i < num ; i++)
+        for (i = 1 ; i < num ; i++) {
-                memcpy(fake_storep + ((lba + i) * sdebug_sector_size),
+                lbaa = lba + i;
-                       fake_storep + lba_off,
+                block = do_div(lbaa, sdebug_store_sectors);
-                       sdebug_sector_size);
+                memmove(fake_storep + (block * lb_size), fs1p, lb_size);
+        }
        if (scsi_debug_lbp())
                map_region(lba, num);
 out:
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b13cc9288ba0..6d65ac584eba 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1842,8 +1842,8 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
        blk_queue_segment_boundary(q, shost->dma_boundary);
        dma_set_seg_boundary(dev, shost->dma_boundary);
-        blk_queue_max_segment_size(q,
+        blk_queue_max_segment_size(q, shost->max_segment_size);
-                min(shost->max_segment_size, dma_get_max_seg_size(dev)));
+        dma_set_max_seg_size(dev, shost->max_segment_size);
        /*
         * Set a reasonable default alignment:  The larger of 32-byte (dword),
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 71334aaf1447..2ddf24466a62 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -108,13 +108,19 @@
 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
                     const char *prefix)
 {
-        u8 *regs;
+        u32 *regs;
+        size_t pos;
+        if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */
+                return -EINVAL;
        regs = kzalloc(len, GFP_KERNEL);
        if (!regs)
                return -ENOMEM;
-        memcpy_fromio(regs, hba->mmio_base + offset, len);
+        for (pos = 0; pos < len; pos += 4)
+                regs[pos / 4] = ufshcd_readl(hba, offset + pos);
        ufshcd_hex_dump(prefix, regs, len);
        kfree(regs);
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a0802de8c3a1..6f5afab7c1a1 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -248,10 +248,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
        struct ion_dma_buf_attachment *a = attachment->priv;
        struct ion_buffer *buffer = dmabuf->priv;
-        free_duped_table(a->table);
        mutex_lock(&buffer->lock);
        list_del(&a->list);
        mutex_unlock(&buffer->lock);
+        free_duped_table(a->table);
        kfree(a);
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 28cbd6b3d26c..dfee6985efa6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
        {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
        {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+        {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
        {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
        {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
        {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
index bcc8dfa8e672..9efb4dcb9d3a 100644
--- a/drivers/staging/rtl8723bs/include/ieee80211.h
+++ b/drivers/staging/rtl8723bs/include/ieee80211.h
@@ -850,18 +850,18 @@ enum ieee80211_state {
 #define IP_FMT "%pI4"
 #define IP_ARG(x) (x)
-extern __inline int is_multicast_mac_addr(const u8 *addr)
+static inline int is_multicast_mac_addr(const u8 *addr)
 {
        return ((addr[0] != 0xff) && (0x01 & addr[0]));
 }
-extern __inline int is_broadcast_mac_addr(const u8 *addr)
+static inline int is_broadcast_mac_addr(const u8 *addr)
 {
        return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
                (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
 }
-extern __inline int is_zero_mac_addr(const u8 *addr)
+static inline int is_zero_mac_addr(const u8 *addr)
 {
        return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
                (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
index 9e17ec651bde..53f5a1cb4636 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -446,6 +446,7 @@ remote_event_wait(wait_queue_head_t *wq, struct remote_event *event)
 static inline void
 remote_event_signal_local(wait_queue_head_t *wq, struct remote_event *event)
 {
+        event->fired = 1;
        event->armed = 0;
        wake_up_all(wq);
 }
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 70c854d939ce..3d0badc34825 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -36,7 +36,7 @@ struct wilc_op_mode {
 struct wilc_reg_frame {
        bool reg;
        u8 reg_id;
-        __le32 frame_type;
+        __le16 frame_type;
 } __packed;
 struct wilc_drv_handler {
@@ -1744,7 +1744,6 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                result = wilc_send_config_pkt(vif, WILC_SET_CFG, wid_list,
                                              ARRAY_SIZE(wid_list),
                                              wilc_get_vif_idx(vif));
-                kfree(gtk_key);
        } else if (mode == WILC_STATION_MODE) {
                struct wid wid;
@@ -1754,9 +1753,9 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                wid.val = (u8 *)gtk_key;
                result = wilc_send_config_pkt(vif, WILC_SET_CFG, &wid, 1,
                                              wilc_get_vif_idx(vif));
-                kfree(gtk_key);
        }
+        kfree(gtk_key);
        return result;
 }
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 3c5e9e030cad..489e5a5038f8 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1252,21 +1252,22 @@ static u32 init_chip(struct net_device *dev)
                ret = wilc->hif_func->hif_read_reg(wilc, 0x1118, &reg);
                if (!ret) {
                        netdev_err(dev, "fail read reg 0x1118\n");
-                        return ret;
+                        goto release;
                }
                reg |= BIT(0);
                ret = wilc->hif_func->hif_write_reg(wilc, 0x1118, reg);
                if (!ret) {
                        netdev_err(dev, "fail write reg 0x1118\n");
-                        return ret;
+                        goto release;
                }
                ret = wilc->hif_func->hif_write_reg(wilc, 0xc0000, 0x71);
                if (!ret) {
                        netdev_err(dev, "fail write reg 0xc0000\n");
-                        return ret;
+                        goto release;
                }
        }
+release:
        release_bus(wilc, WILC_BUS_RELEASE_ONLY);
        return ret;
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c34c88ef3319..5831e0eecea1 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1317,12 +1317,13 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                 * target_complete_cmd will translate this to LUN COMM FAILURE
                 */
                scsi_status = SAM_STAT_CHECK_CONDITION;
+                list_del_init(&cmd->queue_entry);
        } else {
+                list_del_init(&cmd->queue_entry);
                idr_remove(&udev->commands, id);
                tcmu_free_cmd(cmd);
                scsi_status = SAM_STAT_TASK_SET_FULL;
        }
-        list_del_init(&cmd->queue_entry);
        pr_debug("Timing out cmd %u on dev %s that is %s.\n",
                 id, udev->name, is_running ? "inflight" : "queued");
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 284cf2c5a8fd..8e1cf4d789be 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
        struct pci_dev *pci_dev; \
        struct platform_device *pdev; \
        struct proc_thermal_device *proc_dev; \
-\
+        \
+        if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
+                dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
+                return 0; \
+        } \
+        \
        if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
                pdev = to_platform_device(dev); \
                proc_dev = platform_get_drvdata(pdev); \
@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
        *priv = proc_priv;
        ret = proc_thermal_read_ppcc(proc_priv);
-        if (!ret) {
-                ret = sysfs_create_group(&dev->kobj,
-                                         &power_limit_attribute_group);
-        }
        if (ret)
                return ret;
@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
        proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
        if (IS_ERR(proc_priv->int340x_zone)) {
-                ret = PTR_ERR(proc_priv->int340x_zone);
+                return PTR_ERR(proc_priv->int340x_zone);
-                goto remove_group;
        } else
                ret = 0;
@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
 remove_zone:
        int340x_thermal_zone_remove(proc_priv->int340x_zone);
-remove_group:
-        sysfs_remove_group(&proc_priv->dev->kobj,
-                           &power_limit_attribute_group);
        return ret;
 }
@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
        platform_set_drvdata(pdev, proc_priv);
        proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 static int int3401_remove(struct platform_device *pdev)
@@ -423,7 +422,7 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                proc_priv->soc_dts = intel_soc_dts_iosf_init(
                                        INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
-                if (proc_priv->soc_dts && pdev->irq) {
+                if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
                        ret = pci_enable_msi(pdev);
                        if (!ret) {
                                ret = request_threaded_irq(pdev->irq, NULL,
@@ -441,7 +440,10 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                        dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
        }
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 static void  proc_thermal_pci_remove(struct pci_dev *pdev)
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 4164414d4c64..8bdf42bc8fc8 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -597,6 +597,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                                /* too large for caller's buffer */
                                ret = -EOVERFLOW;
                        } else {
+                                __set_current_state(TASK_RUNNING);
                                if (copy_to_user(buf, rbuf->buf, rbuf->count))
                                        ret = -EFAULT;
                                else
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 189ab1212d9a..e441221e04b9 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1070,15 +1070,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                        ret = 0;
                }
-        }
-        /* Initialise interrupt backoff work if required */
+                /* Initialise interrupt backoff work if required */
-        if (up->overrun_backoff_time_ms > 0) {
+                if (up->overrun_backoff_time_ms > 0) {
-                uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
+                        uart->overrun_backoff_time_ms =
-                INIT_DELAYED_WORK(&uart->overrun_backoff,
+                                up->overrun_backoff_time_ms;
-                                  serial_8250_overrun_backoff_work);
+                        INIT_DELAYED_WORK(&uart->overrun_backoff,
-        } else {
+                                        serial_8250_overrun_backoff_work);
-                uart->overrun_backoff_time_ms = 0;
+                } else {
+                        uart->overrun_backoff_time_ms = 0;
+                }
        }
        mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/earlycon-riscv-sbi.c b/drivers/tty/serial/earlycon-riscv-sbi.c
index e1a551aae336..ce81523c3113 100644
--- a/drivers/tty/serial/earlycon-riscv-sbi.c
+++ b/drivers/tty/serial/earlycon-riscv-sbi.c
@@ -10,13 +10,16 @@
 #include <linux/serial_core.h>
 #include <asm/sbi.h>
-static void sbi_console_write(struct console *con,
+static void sbi_putc(struct uart_port *port, int c)
-                              const char *s, unsigned int n)
 {
-        int i;
+        sbi_console_putchar(c);
+}
-        for (i = 0; i < n; ++i)
+static void sbi_console_write(struct console *con,
-                sbi_console_putchar(s[i]);
+                              const char *s, unsigned n)
+{
+        struct earlycon_device *dev = con->data;
+        uart_console_write(&dev->port, s, n, sbi_putc);
 }
 static int __init early_sbi_setup(struct earlycon_device *device,
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 241a48e5052c..debdd1b9e01a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
        }
        /* ask the core to calculate the divisor */
-        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
        spin_lock_irqsave(&sport->port.lock, flags);
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index a72d6d9fb983..38016609c7fa 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -225,7 +225,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
        unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
        u32 geni_ios;
-        if (uart_console(uport) || !uart_cts_enabled(uport)) {
+        if (uart_console(uport)) {
                mctrl |= TIOCM_CTS;
        } else {
                geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
@@ -241,7 +241,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
 {
        u32 uart_manual_rfr = 0;
-        if (uart_console(uport) || !uart_cts_enabled(uport))
+        if (uart_console(uport))
                return;
        if (!(mctrl & TIOCM_RTS))
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index d4cca5bdaf1c..5c01bb6d1c24 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -550,10 +550,12 @@ static int uart_put_char(struct tty_struct *tty, unsigned char c)
        int ret = 0;
        circ = &state->xmit;
-        if (!circ->buf)
+        port = uart_port_lock(state, flags);
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                return 0;
+        }
-        port = uart_port_lock(state, flags);
        if (port && uart_circ_chars_free(circ) != 0) {
                circ->buf[circ->head] = c;
                circ->head = (circ->head + 1) & (UART_XMIT_SIZE - 1);
@@ -586,11 +588,13 @@ static int uart_write(struct tty_struct *tty,
                return -EL3HLT;
        }
+        port = uart_port_lock(state, flags);
        circ = &state->xmit;
-        if (!circ->buf)
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                return 0;
+        }
-        port = uart_port_lock(state, flags);
        while (port) {
                c = CIRC_SPACE_TO_END(circ->head, circ->tail, UART_XMIT_SIZE);
                if (count < c)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 23c6fd238422..21ffcce16927 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2189,7 +2189,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return -EIO;
-        ld->ops->receive_buf(tty, &ch, &mbz, 1);
+        if (ld->ops->receive_buf)
+                ld->ops->receive_buf(tty, &ch, &mbz, 1);
        tty_ldisc_deref(ld);
        return 0;
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 41ec8e5010f3..bba75560d11e 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1272,6 +1272,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
        if (con_is_visible(vc))
                update_screen(vc);
        vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
+        notify_update(vc);
        return err;
 }
@@ -2764,8 +2765,8 @@ rescan_last_byte:
        con_flush(vc, draw_from, draw_to, &draw_x);
        vc_uniscr_debug_check(vc);
        console_conditional_schedule();
-        console_unlock();
        notify_update(vc);
+        console_unlock();
        return n;
 }
@@ -2884,8 +2885,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
        unsigned char c;
        static DEFINE_SPINLOCK(printing_lock);
        const ushort *start;
-        ushort cnt = 0;
+        ushort start_x, cnt;
-        ushort myx;
        int kmsg_console;
        /* console busy or not yet initialized */
@@ -2898,10 +2898,6 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
        if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
                vc = vc_cons[kmsg_console - 1].d;
-        /* read `x' only after setting currcons properly (otherwise
-           the `x' macro will read the x of the foreground console). */
-        myx = vc->vc_x;
        if (!vc_cons_allocated(fg_console)) {
                /* impossible */
                /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
@@ -2916,53 +2912,41 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
                hide_cursor(vc);
        start = (ushort *)vc->vc_pos;
+        start_x = vc->vc_x;
-        /* Contrived structure to try to emulate original need_wrap behaviour
+        cnt = 0;
-         * Problems caused when we have need_wrap set on '\n' character */
        while (count--) {
                c = *b++;
                if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) {
-                        if (cnt > 0) {
+                        if (cnt && con_is_visible(vc))
-                                if (con_is_visible(vc))
+                                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
-                                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
+                        cnt = 0;
-                                vc->vc_x += cnt;
-                                if (vc->vc_need_wrap)
-                                        vc->vc_x--;
-                                cnt = 0;
-                        }
                        if (c == 8) {           /* backspace */
                                bs(vc);
                                start = (ushort *)vc->vc_pos;
-                                myx = vc->vc_x;
+                                start_x = vc->vc_x;
                                continue;
                        }
                        if (c != 13)
                                lf(vc);
                        cr(vc);
                        start = (ushort *)vc->vc_pos;
-                        myx = vc->vc_x;
+                        start_x = vc->vc_x;
                        if (c == 10 || c == 13)
                                continue;
                }
+                vc_uniscr_putc(vc, c);
                scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
                notify_write(vc, c);
                cnt++;
-                if (myx == vc->vc_cols - 1) {
+                if (vc->vc_x == vc->vc_cols - 1) {
-                        vc->vc_need_wrap = 1;
-                        continue;
-                }
-                vc->vc_pos += 2;
-                myx++;
-        }
-        if (cnt > 0) {
-                if (con_is_visible(vc))
-                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                vc->vc_x += cnt;
-                if (vc->vc_x == vc->vc_cols) {
-                        vc->vc_x--;
                        vc->vc_need_wrap = 1;
+                } else {
+                        vc->vc_pos += 2;
+                        vc->vc_x++;
                }
        }
+        if (cnt && con_is_visible(vc))
+                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
        set_cursor(vc);
        notify_update(vc);
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index e81de9ca8729..9b45aa422e69 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -316,7 +316,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
        if (IS_ERR(data->usbmisc_data))
                return PTR_ERR(data->usbmisc_data);
-        if (of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC) {
+        if ((of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC)
+                && data->usbmisc_data) {
                pdata.flags |= CI_HDRC_IMX_IS_HSIC;
                data->usbmisc_data->hsic = 1;
                data->pinctrl = devm_pinctrl_get(dev);
diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c
index dc7f7fd71684..c12ac56606c3 100644
--- a/drivers/usb/core/ledtrig-usbport.c
+++ b/drivers/usb/core/ledtrig-usbport.c
@@ -119,11 +119,6 @@ static const struct attribute_group ports_group = {
        .attrs = ports_attrs,
 };
-static const struct attribute_group *ports_groups[] = {
-        &ports_group,
-        NULL
-};
 /***************************************
 * Adding & removing ports
 ***************************************/
@@ -307,6 +302,7 @@ static int usbport_trig_notify(struct notifier_block *nb, unsigned long action,
 static int usbport_trig_activate(struct led_classdev *led_cdev)
 {
        struct usbport_trig_data *usbport_data;
+        int err;
        usbport_data = kzalloc(sizeof(*usbport_data), GFP_KERNEL);
        if (!usbport_data)
@@ -315,6 +311,9 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
        /* List of ports */
        INIT_LIST_HEAD(&usbport_data->ports);
+        err = sysfs_create_group(&led_cdev->dev->kobj, &ports_group);
+        if (err)
+                goto err_free;
        usb_for_each_dev(usbport_data, usbport_trig_add_usb_dev_ports);
        usbport_trig_update_count(usbport_data);
@@ -322,8 +321,11 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
        usbport_data->nb.notifier_call = usbport_trig_notify;
        led_set_trigger_data(led_cdev, usbport_data);
        usb_register_notify(&usbport_data->nb);
        return 0;
+err_free:
+        kfree(usbport_data);
+        return err;
 }
 static void usbport_trig_deactivate(struct led_classdev *led_cdev)
@@ -335,6 +337,8 @@ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
                usbport_trig_remove_port(usbport_data, port);
        }
+        sysfs_remove_group(&led_cdev->dev->kobj, &ports_group);
        usb_unregister_notify(&usbport_data->nb);
        kfree(usbport_data);
@@ -344,7 +348,6 @@ static struct led_trigger usbport_led_trigger = {
        .name     = "usbport",
        .activate = usbport_trig_activate,
        .deactivate = usbport_trig_deactivate,
-        .groups = ports_groups,
 };
 static int __init usbport_trig_init(void)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 68ad75a7460d..55ef3cc2701b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -261,7 +261,7 @@ static void dwc2_gadget_wkup_alert_handler(struct dwc2_hsotg *hsotg)
        if (gintsts2 & GINTSTS2_WKUP_ALERT_INT) {
                dev_dbg(hsotg->dev, "%s: Wkup_Alert_Int\n", __func__);
-                dwc2_clear_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
+                dwc2_set_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
                dwc2_set_bit(hsotg, DCTL, DCTL_RMTWKUPSIG);
        }
 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07bd31bb2f8a..bed2ff42780b 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
        req->started = false;
        list_del(&req->list);
        req->remaining = 0;
+        req->needs_extra_trb = false;
        if (req->request.status == -EINPROGRESS)
                req->request.status = status;
@@ -1984,6 +1985,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
        /* begin to receive SETUP packets */
        dwc->ep0state = EP0_SETUP_PHASE;
+        dwc->link_state = DWC3_LINK_STATE_SS_DIS;
        dwc3_ep0_out_start(dwc);
        dwc3_gadget_enable_irq(dwc);
@@ -3379,6 +3381,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
        dwc3_disconnect_gadget(dwc);
        __dwc3_gadget_stop(dwc);
+        synchronize_irq(dwc->irq_gadget);
        return 0;
 }
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index 9cdef108fb1b..ed68a4860b7d 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
        ss = kzalloc(sizeof(*ss), GFP_KERNEL);
        if (!ss)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        ss_opts =  container_of(fi, struct f_ss_opts, func_inst);
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f26109eafdbf..66ec1fdf9fe7 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -302,3 +302,4 @@ MODULE_AUTHOR("Chao Xie <chao.xie@marvell.com>");
 MODULE_AUTHOR("Neil Zhang <zhangwm@marvell.com>");
 MODULE_ALIAS("mv-ehci");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ehci_mv_dt_ids);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ab2a6191013..77ef4c481f3c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1783,6 +1783,10 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
        int result;
        u16 val;
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
        val = (mode << 8) | (priv->gpio_output << 4) | priv->gpio_value;
        result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
@@ -1795,6 +1799,8 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
                        val, result);
        }
+        usb_autopm_put_interface(serial->interface);
        return result;
 }
@@ -1846,9 +1852,15 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
        unsigned char *buf;
        int result;
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
        buf = kmalloc(1, GFP_KERNEL);
-        if (!buf)
+        if (!buf) {
+                usb_autopm_put_interface(serial->interface);
                return -ENOMEM;
+        }
        result = usb_control_msg(serial->dev,
                                 usb_rcvctrlpipe(serial->dev, 0),
@@ -1863,6 +1875,7 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
        }
        kfree(buf);
+        usb_autopm_put_interface(serial->interface);
        return result;
 }
diff --git a/drivers/usb/serial/keyspan_usa26msg.h b/drivers/usb/serial/keyspan_usa26msg.h
index 09e21e84fc4e..a68f1fb25b8a 100644
--- a/drivers/usb/serial/keyspan_usa26msg.h
+++ b/drivers/usb/serial/keyspan_usa26msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa26msg.h
diff --git a/drivers/usb/serial/keyspan_usa28msg.h b/drivers/usb/serial/keyspan_usa28msg.h
index dee454c4609a..a19f3fe5d98d 100644
--- a/drivers/usb/serial/keyspan_usa28msg.h
+++ b/drivers/usb/serial/keyspan_usa28msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa28msg.h
diff --git a/drivers/usb/serial/keyspan_usa49msg.h b/drivers/usb/serial/keyspan_usa49msg.h
index 163b2dea2ec5..8c3970fdd868 100644
--- a/drivers/usb/serial/keyspan_usa49msg.h
+++ b/drivers/usb/serial/keyspan_usa49msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa49msg.h
diff --git a/drivers/usb/serial/keyspan_usa67msg.h b/drivers/usb/serial/keyspan_usa67msg.h
index 20fa3e2f7187..dcf502fdbb44 100644
--- a/drivers/usb/serial/keyspan_usa67msg.h
+++ b/drivers/usb/serial/keyspan_usa67msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa67msg.h
diff --git a/drivers/usb/serial/keyspan_usa90msg.h b/drivers/usb/serial/keyspan_usa90msg.h
index 86708ecd8735..c4ca0f631d20 100644
--- a/drivers/usb/serial/keyspan_usa90msg.h
+++ b/drivers/usb/serial/keyspan_usa90msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa90msg.h
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 98e7a5df0f6d..bb3f9aa4a909 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -46,6 +46,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 4e2554d55362..559941ca884d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -8,6 +8,7 @@
 #define PL2303_VENDOR_ID        0x067b
 #define PL2303_PRODUCT_ID       0x2303
+#define PL2303_PRODUCT_ID_TB            0x2304
 #define PL2303_PRODUCT_ID_RSAQ2         0x04bb
 #define PL2303_PRODUCT_ID_DCU11         0x1234
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
@@ -20,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 #define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4d0273508043..edbbb13d6de6 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -85,7 +85,8 @@ DEVICE(moto_modem, MOTO_IDS);
 /* Motorola Tetra driver */
 #define MOTOROLA_TETRA_IDS()                    \
        { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
-        { USB_DEVICE(0x0cad, 0x9012) }  /* MTP6550 */
+        { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
+        { USB_DEVICE(0x0cad, 0x9016) }  /* TPG2200 */
 DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
 /* Novatel Wireless GPS driver */
diff --git a/drivers/usb/usbip/README b/drivers/usb/usbip/README
deleted file mode 100644
index 41a2cf2e77a6..000000000000
--- a/drivers/usb/usbip/README
+++ /dev/null
@@ -1,7 +0,0 @@
-TODO:
-        - more discussion about the protocol
-        - testing
-        - review of the userspace interface
-        - document the protocol
-Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/vfio/pci/trace.h b/drivers/vfio/pci/trace.h
index 4d13e510590e..b2aa986ab9ed 100644
--- a/drivers/vfio/pci/trace.h
+++ b/drivers/vfio/pci/trace.h
@@ -1,13 +1,9 @@
-/* SPDX-License-Identifier: GPL-2.0+ */
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
 * VFIO PCI mmap/mmap_fault tracepoints
 *
 * Copyright (C) 2018 IBM Corp.  All rights reserved.
 *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #undef TRACE_SYSTEM
diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
index 054a2cf9dd8e..32f695ffe128 100644
--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -1,14 +1,10 @@
-// SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0-only
 /*
 * VFIO PCI NVIDIA Whitherspoon GPU support a.k.a. NVLink2.
 *
 * Copyright (C) 2018 IBM Corp.  All rights reserved.
 *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
 * Register an on-GPU RAM region for cacheable access.
 *
 * Derived from original vfio_pci_igd.c:
@@ -178,11 +174,11 @@ static int vfio_pci_nvgpu_add_capability(struct vfio_pci_device *vdev,
                struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
        struct vfio_pci_nvgpu_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt cap = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt cap = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
-        cap.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
+                .header.version = 1,
-        cap.header.version = 1;
+                .tgt = data->gpu_tgt
-        cap.tgt = data->gpu_tgt;
+        };
        return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
 }
@@ -365,18 +361,18 @@ static int vfio_pci_npu2_add_capability(struct vfio_pci_device *vdev,
                struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
        struct vfio_pci_npu2_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt captgt = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt captgt = {
-        struct vfio_region_info_cap_nvlink2_lnkspd capspd = { 0 };
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
+        struct vfio_region_info_cap_nvlink2_lnkspd capspd = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD,
+                .header.version = 1,
+                .link_speed = data->link_speed
+        };
        int ret;
-        captgt.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        captgt.header.version = 1;
-        captgt.tgt = data->gpu_tgt;
-        capspd.header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD;
-        capspd.header.version = 1;
-        capspd.link_speed = data->link_speed;
        ret = vfio_info_add_capability(caps, &captgt.header, sizeof(captgt));
        if (ret)
                return ret;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index bca86bf7189f..df51a35cf537 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                n->vqs[i].rx_ring = NULL;
                vhost_net_buf_init(&n->vqs[i].rxq);
        }
-        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+                       UIO_MAXIOV + VHOST_NET_BATCH);
        vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
        vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 344684f3e2e4..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                vqs[i] = &vs->vqs[i].vq;
                vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
        }
-        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
        vhost_scsi_init_inflight(vs, NULL);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 15a216cdd507..24a129fcdd61 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
                vq->indirect = kmalloc_array(UIO_MAXIOV,
                                             sizeof(*vq->indirect),
                                             GFP_KERNEL);
-                vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+                vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
                                        GFP_KERNEL);
-                vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+                vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
                                          GFP_KERNEL);
                if (!vq->indirect || !vq->log || !vq->heads)
                        goto err_nomem;
@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
 }
 void vhost_dev_init(struct vhost_dev *dev,
-                    struct vhost_virtqueue **vqs, int nvqs)
+                    struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
 {
        struct vhost_virtqueue *vq;
        int i;
@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
        dev->iotlb = NULL;
        dev->mm = NULL;
        dev->worker = NULL;
+        dev->iov_limit = iov_limit;
        init_llist_head(&dev->work_list);
        init_waitqueue_head(&dev->wait);
        INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 1b675dad5e05..9490e7ddb340 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -170,9 +170,11 @@ struct vhost_dev {
        struct list_head read_list;
        struct list_head pending_list;
        wait_queue_head_t wait;
+        int iov_limit;
 };
-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+                    int nvqs, int iov_limit);
 long vhost_dev_set_owner(struct vhost_dev *dev);
 bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 3fbc068eaa9b..bb5fc0e9fbc2 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
        vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
        vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
-        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
+        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
        file->private_data = vsock;
        spin_lock_init(&vsock->send_pkt_list_lock);
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 09731b2f6815..c6b3bdbbdbc9 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -271,6 +271,7 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 static void vgacon_restore_screen(struct vc_data *c)
 {
+        c->vc_origin = c->vc_visible_origin;
        vgacon_scrollback_cur->save = 0;
        if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
@@ -287,8 +288,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
        int start, end, count, soff;
        if (!lines) {
-                c->vc_visible_origin = c->vc_origin;
+                vgacon_restore_screen(c);
-                vga_set_mem_top(c);
                return;
        }
@@ -298,6 +298,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
        if (!vgacon_scrollback_cur->save) {
                vgacon_cursor(c, CM_ERASE);
                vgacon_save_screen(c);
+                c->vc_origin = (unsigned long)c->vc_screenbuf;
                vgacon_scrollback_cur->save = 1;
        }
@@ -335,7 +336,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
                int copysize;
                int diff = c->vc_rows - count;
-                void *d = (void *) c->vc_origin;
+                void *d = (void *) c->vc_visible_origin;
                void *s = (void *) c->vc_screenbuf;
                count *= c->vc_size_row;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index cd7e755484e3..a0b07c331255 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -152,7 +152,12 @@ struct vring_virtqueue {
                /* Available for packed ring */
                struct {
                        /* Actual memory layout for this queue. */
-                        struct vring_packed vring;
+                        struct {
+                                unsigned int num;
+                                struct vring_packed_desc *desc;
+                                struct vring_packed_desc_event *driver;
+                                struct vring_packed_desc_event *device;
+                        } vring;
                        /* Driver ring wrap counter. */
                        bool avail_wrap_counter;
@@ -1609,6 +1614,9 @@ static struct virtqueue *vring_create_virtqueue_packed(
                !context;
        vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
        vq->packed.ring_dma_addr = ring_dma_addr;
        vq->packed.driver_event_dma_addr = driver_event_dma_addr;
        vq->packed.device_event_dma_addr = device_event_dma_addr;
@@ -2079,6 +2087,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index,
                !context;
        vq->event = virtio_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
+        if (virtio_has_feature(vdev, VIRTIO_F_ORDER_PLATFORM))
+                vq->weak_barriers = false;
        vq->split.queue_dma_addr = 0;
        vq->split.queue_size_in_bytes = 0;
@@ -2213,6 +2224,8 @@ void vring_transport_features(struct virtio_device *vdev)
                        break;
                case VIRTIO_F_RING_PACKED:
                        break;
+                case VIRTIO_F_ORDER_PLATFORM:
+                        break;
                default:
                        /* We don't understand this bit. */
                        __virtio_clear_bit(vdev, i);
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 989cf872b98c..bb7888429be6 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -645,7 +645,7 @@ xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
                     unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
        if (xen_get_dma_ops(dev)->mmap)
                return xen_get_dma_ops(dev)->mmap(dev, vma, cpu_addr,
                                                    dma_addr, size, attrs);
@@ -662,7 +662,7 @@ xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
                        void *cpu_addr, dma_addr_t handle, size_t size,
                        unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
        if (xen_get_dma_ops(dev)->get_sgtable) {
 #if 0
        /*
diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
index d441244b79df..28d9c2b1b3bb 100644
--- a/fs/autofs/expire.c
+++ b/fs/autofs/expire.c
@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb,
        pkt.len = dentry->d_name.len;
        memcpy(pkt.name, dentry->d_name.name, pkt.len);
        pkt.name[pkt.len] = '\0';
-        dput(dentry);
        if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
                ret = -EFAULT;
@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb,
        complete_all(&ino->expire_complete);
        spin_unlock(&sbi->fs_lock);
+        dput(dentry);
        return ret;
 }
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 0e8ea2d9a2bb..078992eee299 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -266,8 +266,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
        }
        root_inode = autofs_get_inode(s, S_IFDIR | 0755);
        root = d_make_root(root_inode);
-        if (!root)
+        if (!root) {
+                ret = -ENOMEM;
                goto fail_ino;
+        }
        pipe = NULL;
        root->d_fsdata = ino;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index f64aad613727..5a6c39b44c84 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -968,6 +968,48 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
        return 0;
 }
+static struct extent_buffer *alloc_tree_block_no_bg_flush(
+                                          struct btrfs_trans_handle *trans,
+                                          struct btrfs_root *root,
+                                          u64 parent_start,
+                                          const struct btrfs_disk_key *disk_key,
+                                          int level,
+                                          u64 hint,
+                                          u64 empty_size)
+{
+        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct extent_buffer *ret;
+        /*
+         * If we are COWing a node/leaf from the extent, chunk, device or free
+         * space trees, make sure that we do not finish block group creation of
+         * pending block groups. We do this to avoid a deadlock.
+         * COWing can result in allocation of a new chunk, and flushing pending
+         * block groups (btrfs_create_pending_block_groups()) can be triggered
+         * when finishing allocation of a new chunk. Creation of a pending block
+         * group modifies the extent, chunk, device and free space trees,
+         * therefore we could deadlock with ourselves since we are holding a
+         * lock on an extent buffer that btrfs_create_pending_block_groups() may
+         * try to COW later.
+         * For similar reasons, we also need to delay flushing pending block
+         * groups when splitting a leaf or node, from one of those trees, since
+         * we are holding a write lock on it and its parent or when inserting a
+         * new root node for one of those trees.
+         */
+        if (root == fs_info->extent_root ||
+            root == fs_info->chunk_root ||
+            root == fs_info->dev_root ||
+            root == fs_info->free_space_root)
+                trans->can_flush_pending_bgs = false;
+        ret = btrfs_alloc_tree_block(trans, root, parent_start,
+                                     root->root_key.objectid, disk_key, level,
+                                     hint, empty_size);
+        trans->can_flush_pending_bgs = true;
+        return ret;
+}
 /*
 * does the dirty work in cow of a single block.  The parent block (if
 * supplied) is updated to point to the new cow copy.  The new buffer is marked
@@ -1015,28 +1057,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
        if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
                parent_start = parent->start;
-        /*
+        cow = alloc_tree_block_no_bg_flush(trans, root, parent_start, &disk_key,
-         * If we are COWing a node/leaf from the extent, chunk, device or free
+                                           level, search_start, empty_size);
-         * space trees, make sure that we do not finish block group creation of
-         * pending block groups. We do this to avoid a deadlock.
-         * COWing can result in allocation of a new chunk, and flushing pending
-         * block groups (btrfs_create_pending_block_groups()) can be triggered
-         * when finishing allocation of a new chunk. Creation of a pending block
-         * group modifies the extent, chunk, device and free space trees,
-         * therefore we could deadlock with ourselves since we are holding a
-         * lock on an extent buffer that btrfs_create_pending_block_groups() may
-         * try to COW later.
-         */
-        if (root == fs_info->extent_root ||
-            root == fs_info->chunk_root ||
-            root == fs_info->dev_root ||
-            root == fs_info->free_space_root)
-                trans->can_flush_pending_bgs = false;
-        cow = btrfs_alloc_tree_block(trans, root, parent_start,
-                        root->root_key.objectid, &disk_key, level,
-                        search_start, empty_size);
-        trans->can_flush_pending_bgs = true;
        if (IS_ERR(cow))
                return PTR_ERR(cow);
@@ -3345,8 +3367,8 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
        else
                btrfs_node_key(lower, &lower_key, 0);
-        c = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+        c = alloc_tree_block_no_bg_flush(trans, root, 0, &lower_key, level,
-                                   &lower_key, level, root->node->start, 0);
+                                         root->node->start, 0);
        if (IS_ERR(c))
                return PTR_ERR(c);
@@ -3475,8 +3497,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
        mid = (c_nritems + 1) / 2;
        btrfs_node_key(c, &disk_key, mid);
-        split = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+        split = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, level,
-                        &disk_key, level, c->start, 0);
+                                             c->start, 0);
        if (IS_ERR(split))
                return PTR_ERR(split);
@@ -4260,8 +4282,8 @@ again:
        else
                btrfs_item_key(l, &disk_key, mid);
-        right = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+        right = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, 0,
-                        &disk_key, 0, l->start, 0);
+                                             l->start, 0);
        if (IS_ERR(right))
                return PTR_ERR(right);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index c5586ffd1426..0a3f122dd61f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1621,6 +1621,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                                flags | SB_RDONLY, device_name, data);
                        if (IS_ERR(mnt_root)) {
                                root = ERR_CAST(mnt_root);
+                                kfree(subvol_name);
                                goto out;
                        }
@@ -1630,12 +1631,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                        if (error < 0) {
                                root = ERR_PTR(error);
                                mntput(mnt_root);
+                                kfree(subvol_name);
                                goto out;
                        }
                }
        }
        if (IS_ERR(mnt_root)) {
                root = ERR_CAST(mnt_root);
+                kfree(subvol_name);
                goto out;
        }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 127fa1535f58..4ec2b660d014 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -850,14 +850,6 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
        btrfs_trans_release_chunk_metadata(trans);
-        if (lock && should_end_transaction(trans) &&
-            READ_ONCE(cur_trans->state) == TRANS_STATE_RUNNING) {
-                spin_lock(&info->trans_lock);
-                if (cur_trans->state == TRANS_STATE_RUNNING)
-                        cur_trans->state = TRANS_STATE_BLOCKED;
-                spin_unlock(&info->trans_lock);
-        }
        if (lock && READ_ONCE(cur_trans->state) == TRANS_STATE_BLOCKED) {
                if (throttle)
                        return btrfs_commit_transaction(trans);
@@ -1879,6 +1871,21 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans, int err)
        kmem_cache_free(btrfs_trans_handle_cachep, trans);
 }
+/*
+ * Release reserved delayed ref space of all pending block groups of the
+ * transaction and remove them from the list
+ */
+static void btrfs_cleanup_pending_block_groups(struct btrfs_trans_handle *trans)
+{
+       struct btrfs_fs_info *fs_info = trans->fs_info;
+       struct btrfs_block_group_cache *block_group, *tmp;
+       list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
+               btrfs_delayed_refs_rsv_release(fs_info, 1);
+               list_del_init(&block_group->bg_list);
+       }
+}
 static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
 {
        /*
@@ -2270,6 +2277,7 @@ scrub_continue:
        btrfs_scrub_continue(fs_info);
 cleanup_transaction:
        btrfs_trans_release_metadata(trans);
+        btrfs_cleanup_pending_block_groups(trans);
        btrfs_trans_release_chunk_metadata(trans);
        trans->block_rsv = NULL;
        btrfs_warn(fs_info, "Skipping commit of aborted transaction.");
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3e4f8f88353e..15561926ab32 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -957,11 +957,11 @@ static noinline struct btrfs_device *device_list_add(const char *path,
                else
                        fs_devices = alloc_fs_devices(disk_super->fsid, NULL);
-                fs_devices->fsid_change = fsid_change_in_progress;
                if (IS_ERR(fs_devices))
                        return ERR_CAST(fs_devices);
+                fs_devices->fsid_change = fsid_change_in_progress;
                mutex_lock(&fs_devices->device_list_mutex);
                list_add(&fs_devices->fs_list, &fs_uuids);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 94c026bba2c2..bba28a5034ba 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1035,6 +1035,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
        list_del_init(&ci->i_snap_realm_item);
        ci->i_snap_realm_counter++;
        ci->i_snap_realm = NULL;
+        if (realm->ino == ci->i_vino.ino)
+                realm->inode = NULL;
        spin_unlock(&realm->inodes_with_caps_lock);
        ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
                            realm);
diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
index 03f4d24db8fe..9455d3aef0c3 100644
--- a/fs/ceph/quota.c
+++ b/fs/ceph/quota.c
@@ -3,19 +3,6 @@
 * quota.c - CephFS quota
 *
 * Copyright (C) 2017-2018 SUSE
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
 #include <linux/statfs.h>
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 593fb422d0f3..e92a2fee3c57 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -252,6 +252,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
        seq_printf(m, ",ACL");
 #endif
        seq_putc(m, '\n');
+        seq_printf(m, "CIFSMaxBufSize: %d\n", CIFSMaxBufSize);
        seq_printf(m, "Active VFS Requests: %d\n", GlobalTotalActiveXid);
        seq_printf(m, "Servers:");
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index d1f9c2f3f575..7652551a1fc4 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -150,5 +150,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "2.16"
+#define CIFS_VERSION   "2.17"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index e18915415e13..bb54ccf8481c 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1549,18 +1549,26 @@ cifs_discard_remaining_data(struct TCP_Server_Info *server)
 }
 static int
-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+__cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+                     bool malformed)
 {
        int length;
-        struct cifs_readdata *rdata = mid->callback_data;
        length = cifs_discard_remaining_data(server);
-        dequeue_mid(mid, rdata->result);
+        dequeue_mid(mid, malformed);
        mid->resp_buf = server->smallbuf;
        server->smallbuf = NULL;
        return length;
 }
+static int
+cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+{
+        struct cifs_readdata *rdata = mid->callback_data;
+        return  __cifs_readv_discard(server, mid, rdata->result);
+}
 int
 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 {
@@ -1602,12 +1610,23 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                return -1;
        }
+        /* set up first two iov for signature check and to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len = server->total_read - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
        /* Was the SMB read successful? */
        rdata->result = server->ops->map_error(buf, false);
        if (rdata->result != 0) {
                cifs_dbg(FYI, "%s: server returned error %d\n",
                         __func__, rdata->result);
-                return cifs_readv_discard(server, mid);
+                /* normal error on read response */
+                return __cifs_readv_discard(server, mid, false);
        }
        /* Is there enough to get to the rest of the READ_RSP header? */
@@ -1651,14 +1670,6 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                server->total_read += length;
        }
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->total_read - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%u\n",
-                 rdata->iov[0].iov_base, server->total_read);
        /* how much data is in the response? */
 #ifdef CONFIG_CIFS_SMB_DIRECT
        use_rdma_mr = rdata->mr;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 683310f26171..8463c940e0e5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -720,6 +720,21 @@ server_unresponsive(struct TCP_Server_Info *server)
        return false;
 }
+static inline bool
+zero_credits(struct TCP_Server_Info *server)
+{
+        int val;
+        spin_lock(&server->req_lock);
+        val = server->credits + server->echo_credits + server->oplock_credits;
+        if (server->in_flight == 0 && val == 0) {
+                spin_unlock(&server->req_lock);
+                return true;
+        }
+        spin_unlock(&server->req_lock);
+        return false;
+}
 static int
 cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 {
@@ -732,6 +747,12 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
        for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
                try_to_freeze();
+                /* reconnect if no credits and no requests in flight */
+                if (zero_credits(server)) {
+                        cifs_reconnect(server);
+                        return -ECONNABORTED;
+                }
                if (server_unresponsive(server))
                        return -ECONNABORTED;
                if (cifs_rdma_enabled(server) && server->smbd_conn)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 2c7689f3998d..659ce1b92c44 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2696,6 +2696,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                        rc = cifs_write_allocate_pages(wdata->pages, nr_pages);
                        if (rc) {
+                                kvfree(wdata->pages);
                                kfree(wdata);
                                add_credits_and_wake_if(server, credits, 0);
                                break;
@@ -2707,6 +2708,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                        if (rc) {
                                for (i = 0; i < nr_pages; i++)
                                        put_page(wdata->pages[i]);
+                                kvfree(wdata->pages);
                                kfree(wdata);
                                add_credits_and_wake_if(server, credits, 0);
                                break;
@@ -3386,8 +3388,12 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                        }
                        rc = cifs_read_allocate_pages(rdata, npages);
-                        if (rc)
+                        if (rc) {
-                                goto error;
+                                kvfree(rdata->pages);
+                                kfree(rdata);
+                                add_credits_and_wake_if(server, credits, 0);
+                                break;
+                        }
                        rdata->tailsz = PAGE_SIZE;
                }
@@ -3407,7 +3413,6 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                if (!rdata->cfile->invalidHandle ||
                    !(rc = cifs_reopen_file(rdata->cfile, true)))
                        rc = server->ops->async_readv(rdata);
-error:
                if (rc) {
                        add_credits_and_wake_if(server, rdata->credits, 0);
                        kref_put(&rdata->refcount,
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index f14533da3a93..01a76bccdb8d 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -293,6 +293,8 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
        int rc;
        struct smb2_file_all_info *smb2_data;
        __u32 create_options = 0;
+        struct cifs_fid fid;
+        bool no_cached_open = tcon->nohandlecache;
        *adjust_tz = false;
        *symlink = false;
@@ -301,6 +303,21 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
                            GFP_KERNEL);
        if (smb2_data == NULL)
                return -ENOMEM;
+        /* If it is a root and its handle is cached then use it */
+        if (!strlen(full_path) && !no_cached_open) {
+                rc = open_shroot(xid, tcon, &fid);
+                if (rc)
+                        goto out;
+                rc = SMB2_query_info(xid, tcon, fid.persistent_fid,
+                                     fid.volatile_fid, smb2_data);
+                close_shroot(&tcon->crfid);
+                if (rc)
+                        goto out;
+                move_smb2_info_to_cifs(data, smb2_data);
+                goto out;
+        }
        if (backup_cred(cifs_sb))
                create_options |= CREATE_OPEN_BACKUP_INTENT;
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 6a9c47541c53..7b8b58fb4d3f 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -648,6 +648,13 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
        if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
                return false;
+        if (rsp->sync_hdr.CreditRequest) {
+                spin_lock(&server->req_lock);
+                server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                spin_unlock(&server->req_lock);
+                wake_up(&server->request_q);
+        }
        if (rsp->StructureSize !=
                                smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
                if (le16_to_cpu(rsp->StructureSize) == 44)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index cf7eb891804f..6f96e2292856 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -34,6 +34,7 @@
 #include "cifs_ioctl.h"
 #include "smbdirect.h"
+/* Change credits for different ops and return the total number of credits */
 static int
 change_conf(struct TCP_Server_Info *server)
 {
@@ -41,17 +42,15 @@ change_conf(struct TCP_Server_Info *server)
        server->oplock_credits = server->echo_credits = 0;
        switch (server->credits) {
        case 0:
-                return -1;
+                return 0;
        case 1:
                server->echoes = false;
                server->oplocks = false;
-                cifs_dbg(VFS, "disabling echoes and oplocks\n");
                break;
        case 2:
                server->echoes = true;
                server->oplocks = false;
                server->echo_credits = 1;
-                cifs_dbg(FYI, "disabling oplocks\n");
                break;
        default:
                server->echoes = true;
@@ -64,14 +63,15 @@ change_conf(struct TCP_Server_Info *server)
                server->echo_credits = 1;
        }
        server->credits -= server->echo_credits + server->oplock_credits;
-        return 0;
+        return server->credits + server->echo_credits + server->oplock_credits;
 }
 static void
 smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
                 const int optype)
 {
-        int *val, rc = 0;
+        int *val, rc = -1;
        spin_lock(&server->req_lock);
        val = server->ops->get_credits_field(server, optype);
@@ -101,8 +101,26 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
        }
        spin_unlock(&server->req_lock);
        wake_up(&server->request_q);
-        if (rc)
-                cifs_reconnect(server);
+        if (server->tcpStatus == CifsNeedReconnect)
+                return;
+        switch (rc) {
+        case -1:
+                /* change_conf hasn't been executed */
+                break;
+        case 0:
+                cifs_dbg(VFS, "Possible client or server bug - zero credits\n");
+                break;
+        case 1:
+                cifs_dbg(VFS, "disabling echoes and oplocks\n");
+                break;
+        case 2:
+                cifs_dbg(FYI, "disabling oplocks\n");
+                break;
+        default:
+                cifs_dbg(FYI, "add %u credits total=%d\n", add, rc);
+        }
 }
 static void
@@ -136,7 +154,11 @@ smb2_get_credits(struct mid_q_entry *mid)
 {
        struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)mid->resp_buf;
-        return le16_to_cpu(shdr->CreditRequest);
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
+                return le16_to_cpu(shdr->CreditRequest);
+        return 0;
 }
 static int
@@ -165,14 +187,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
                        scredits = server->credits;
                        /* can deadlock with reopen */
-                        if (scredits == 1) {
+                        if (scredits <= 8) {
                                *num = SMB2_MAX_BUFFER_SIZE;
                                *credits = 0;
                                break;
                        }
-                        /* leave one credit for a possible reopen */
+                        /* leave some credits for reopen and other ops */
-                        scredits--;
+                        scredits -= 8;
                        *num = min_t(unsigned int, size,
                                     scredits * SMB2_MAX_BUFFER_SIZE);
@@ -844,7 +866,9 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
                                      FILE_READ_EA,
                                      FILE_FULL_EA_INFORMATION,
                                      SMB2_O_INFO_FILE,
-                                      SMB2_MAX_EA_BUF,
+                                      CIFSMaxBufSize -
+                                      MAX_SMB2_CREATE_RESPONSE_SIZE -
+                                      MAX_SMB2_CLOSE_RESPONSE_SIZE,
                                      &rsp_iov, &buftype, cifs_sb);
        if (rc) {
                /*
@@ -3189,11 +3213,23 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                        server->ops->is_status_pending(buf, server, 0))
                return -1;
-        rdata->result = server->ops->map_error(buf, false);
+        /* set up first two iov to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len =
+                min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
+        rdata->result = server->ops->map_error(buf, true);
        if (rdata->result != 0) {
                cifs_dbg(FYI, "%s: server returned error %d\n",
                         __func__, rdata->result);
-                dequeue_mid(mid, rdata->result);
+                /* normal error on read response */
+                dequeue_mid(mid, false);
                return 0;
        }
@@ -3266,14 +3302,6 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                return 0;
        }
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->vals->read_rsp_size - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
-                 rdata->iov[0].iov_base, server->vals->read_rsp_size);
        length = rdata->copy_into_pages(server, rdata, &iter);
        kfree(bvec);
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 50811a7dc0e0..77b3aaa39b35 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2816,6 +2816,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
        int resp_buftype = CIFS_NO_BUFFER;
        struct cifs_ses *ses = tcon->ses;
        int flags = 0;
+        bool allocated = false;
        cifs_dbg(FYI, "Query Info\n");
@@ -2855,14 +2856,21 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
                                        "Error %d allocating memory for acl\n",
                                        rc);
                                *dlen = 0;
+                                rc = -ENOMEM;
                                goto qinf_exit;
                        }
+                        allocated = true;
                }
        }
        rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
                                        le32_to_cpu(rsp->OutputBufferLength),
                                        &rsp_iov, min_len, *data);
+        if (rc && allocated) {
+                kfree(*data);
+                *data = NULL;
+                *dlen = 0;
+        }
 qinf_exit:
        SMB2_query_info_free(&rqst);
@@ -2916,9 +2924,10 @@ smb2_echo_callback(struct mid_q_entry *mid)
 {
        struct TCP_Server_Info *server = mid->callback_data;
        struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
-        if (mid->mid_state == MID_RESPONSE_RECEIVED)
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
                credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
        DeleteMidQEntry(mid);
@@ -3175,7 +3184,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
        struct TCP_Server_Info *server = tcon->ses->server;
        struct smb2_sync_hdr *shdr =
                                (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
        struct smb_rqst rqst = { .rq_iov = rdata->iov,
                                 .rq_nvec = 2,
                                 .rq_pages = rdata->pages,
@@ -3214,6 +3223,9 @@ smb2_readv_callback(struct mid_q_entry *mid)
                task_io_account_read(rdata->got_bytes);
                cifs_stats_bytes_read(tcon, rdata->got_bytes);
                break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(shdr->CreditRequest);
+                /* fall through */
        default:
                if (rdata->result != -ENODATA)
                        rdata->result = -EIO;
@@ -3229,8 +3241,17 @@ smb2_readv_callback(struct mid_q_entry *mid)
                rdata->mr = NULL;
        }
 #endif
-        if (rdata->result)
+        if (rdata->result && rdata->result != -ENODATA) {
                cifs_stats_fail_inc(tcon, SMB2_READ_HE);
+                trace_smb3_read_err(0 /* xid */,
+                                    rdata->cfile->fid.persistent_fid,
+                                    tcon->tid, tcon->ses->Suid, rdata->offset,
+                                    rdata->bytes, rdata->result);
+        } else
+                trace_smb3_read_done(0 /* xid */,
+                                     rdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid,
+                                     rdata->offset, rdata->got_bytes);
        queue_work(cifsiod_wq, &rdata->work);
        DeleteMidQEntry(mid);
@@ -3305,13 +3326,11 @@ smb2_async_readv(struct cifs_readdata *rdata)
        if (rc) {
                kref_put(&rdata->refcount, cifs_readdata_release);
                cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
-                trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,
+                trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
+                                    io_parms.tcon->tid,
-                                   io_parms.offset, io_parms.length);
+                                    io_parms.tcon->ses->Suid,
-        } else
+                                    io_parms.offset, io_parms.length, rc);
-                trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,
+        }
-                                   io_parms.tcon->tid, io_parms.tcon->ses->Suid,
-                                   io_parms.offset, io_parms.length);
        cifs_small_buf_release(buf);
        return rc;
@@ -3355,10 +3374,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
                if (rc != -ENODATA) {
                        cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
                        cifs_dbg(VFS, "Send error in read = %d\n", rc);
+                        trace_smb3_read_err(xid, req->PersistentFileId,
+                                            io_parms->tcon->tid, ses->Suid,
+                                            io_parms->offset, io_parms->length,
+                                            rc);
                }
-                trace_smb3_read_err(rc, xid, req->PersistentFileId,
-                                    io_parms->tcon->tid, ses->Suid,
-                                    io_parms->offset, io_parms->length);
                free_rsp_buf(resp_buftype, rsp_iov.iov_base);
                return rc == -ENODATA ? 0 : rc;
        } else
@@ -3399,7 +3419,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
        struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
        unsigned int written;
        struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
        switch (mid->mid_state) {
        case MID_RESPONSE_RECEIVED:
@@ -3427,6 +3447,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
        case MID_RETRY_NEEDED:
                wdata->result = -EAGAIN;
                break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                /* fall through */
        default:
                wdata->result = -EIO;
                break;
@@ -3444,8 +3467,17 @@ smb2_writev_callback(struct mid_q_entry *mid)
                wdata->mr = NULL;
        }
 #endif
-        if (wdata->result)
+        if (wdata->result) {
                cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
+                trace_smb3_write_err(0 /* no xid */,
+                                     wdata->cfile->fid.persistent_fid,
+                                     tcon->tid, tcon->ses->Suid, wdata->offset,
+                                     wdata->bytes, wdata->result);
+        } else
+                trace_smb3_write_done(0 /* no xid */,
+                                      wdata->cfile->fid.persistent_fid,
+                                      tcon->tid, tcon->ses->Suid,
+                                      wdata->offset, wdata->bytes);
        queue_work(cifsiod_wq, &wdata->work);
        DeleteMidQEntry(mid);
@@ -3587,10 +3619,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
                                     wdata->bytes, rc);
                kref_put(&wdata->refcount, release);
                cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
-        } else
+        }
-                trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,
-                                     tcon->tid, tcon->ses->Suid, wdata->offset,
-                                     wdata->bytes);
 async_writev_out:
        cifs_small_buf_release(req);
@@ -3816,8 +3845,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
                    rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
                        srch_inf->endOfSearch = true;
                        rc = 0;
-                }
+                } else
-                cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
+                        cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
                goto qdir_exit;
        }
@@ -4412,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
        rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
        cifs_small_buf_release(req);
-        please_key_low = (__u64 *)req->LeaseKey;
+        please_key_low = (__u64 *)lease_key;
-        please_key_high = (__u64 *)(req->LeaseKey+8);
+        please_key_high = (__u64 *)(lease_key+8);
        if (rc) {
                cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
                trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 7a2d0a2255e6..538e2299805f 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -84,8 +84,9 @@
 #define NUMBER_OF_SMB2_COMMANDS 0x0013
-/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */
+/* 52 transform hdr + 64 hdr + 88 create rsp */
-#define MAX_SMB2_HDR_SIZE 0x00b0
+#define SMB2_TRANSFORM_HEADER_SIZE 52
+#define MAX_SMB2_HDR_SIZE 204
 #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
 #define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
@@ -648,6 +649,13 @@ struct smb2_create_req {
        __u8   Buffer[0];
 } __packed;
+/*
+ * Maximum size of a SMB2_CREATE response is 64 (smb2 header) +
+ * 88 (fixed part of create response) + 520 (path) + 150 (contexts) +
+ * 2 bytes of padding.
+ */
+#define MAX_SMB2_CREATE_RESPONSE_SIZE 824
 struct smb2_create_rsp {
        struct smb2_sync_hdr sync_hdr;
        __le16 StructureSize;   /* Must be 89 */
@@ -996,6 +1004,11 @@ struct smb2_close_req {
        __u64  VolatileFileId; /* opaque endianness */
 } __packed;
+/*
+ * Maximum size of a SMB2_CLOSE response is 64 (smb2 header) + 60 (data)
+ */
+#define MAX_SMB2_CLOSE_RESPONSE_SIZE 124
 struct smb2_close_rsp {
        struct smb2_sync_hdr sync_hdr;
        __le16 StructureSize; /* 60 */
@@ -1398,8 +1411,6 @@ struct smb2_file_link_info { /* encoding of request for level 11 */
        char   FileName[0];     /* Name to be assigned to new link */
 } __packed; /* level 11 Set */
-#define SMB2_MAX_EA_BUF 65536
 struct smb2_file_full_ea_info { /* encoding of response for level 15 */
        __le32 next_entry_offset;
        __u8   flags;
diff --git a/fs/cifs/trace.c b/fs/cifs/trace.c
index bd4a546feec1..465483787193 100644
--- a/fs/cifs/trace.c
+++ b/fs/cifs/trace.c
@@ -3,16 +3,6 @@
 *   Copyright (C) 2018, Microsoft Corporation.
 *
 *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
 */
 #define CREATE_TRACE_POINTS
 #include "trace.h"
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index fb049809555f..59be48206932 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -3,16 +3,6 @@
 *   Copyright (C) 2018, Microsoft Corporation.
 *
 *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
 */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM cifs
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 202e0e84efdd..53532bd3f50d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -786,17 +786,8 @@ static void
 cifs_compound_callback(struct mid_q_entry *mid)
 {
        struct TCP_Server_Info *server = mid->server;
-        unsigned int optype = mid->optype;
-        unsigned int credits_received = 0;
-        if (mid->mid_state == MID_RESPONSE_RECEIVED) {
+        add_credits(server, server->ops->get_credits(mid), mid->optype);
-                if (mid->resp_buf)
-                        credits_received = server->ops->get_credits(mid);
-                else
-                        cifs_dbg(FYI, "Bad state for cancelled MID\n");
-        }
-        add_credits(server, credits_received, optype);
 }
 static void
diff --git a/fs/dcache.c b/fs/dcache.c
index 2593153471cf..aac41adf4743 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -119,6 +119,7 @@ struct dentry_stat_t dentry_stat = {
 static DEFINE_PER_CPU(long, nr_dentry);
 static DEFINE_PER_CPU(long, nr_dentry_unused);
+static DEFINE_PER_CPU(long, nr_dentry_negative);
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
@@ -152,11 +153,22 @@ static long get_nr_dentry_unused(void)
        return sum < 0 ? 0 : sum;
 }
+static long get_nr_dentry_negative(void)
+{
+        int i;
+        long sum = 0;
+        for_each_possible_cpu(i)
+                sum += per_cpu(nr_dentry_negative, i);
+        return sum < 0 ? 0 : sum;
+}
 int proc_nr_dentry(struct ctl_table *table, int write, void __user *buffer,
                   size_t *lenp, loff_t *ppos)
 {
        dentry_stat.nr_dentry = get_nr_dentry();
        dentry_stat.nr_unused = get_nr_dentry_unused();
+        dentry_stat.nr_negative = get_nr_dentry_negative();
        return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
 }
 #endif
@@ -317,6 +329,8 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry)
        flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
        WRITE_ONCE(dentry->d_flags, flags);
        dentry->d_inode = NULL;
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_inc(nr_dentry_negative);
 }
 static void dentry_free(struct dentry *dentry)
@@ -371,6 +385,11 @@ static void dentry_unlink_inode(struct dentry * dentry)
 * The per-cpu "nr_dentry_unused" counters are updated with
 * the DCACHE_LRU_LIST bit.
 *
+ * The per-cpu "nr_dentry_negative" counters are only updated
+ * when deleted from or added to the per-superblock LRU list, not
+ * from/to the shrink list. That is to avoid an unneeded dec/inc
+ * pair when moving from LRU to shrink list in select_collect().
+ *
 * These helper functions make sure we always follow the
 * rules. d_lock must be held by the caller.
 */
@@ -380,6 +399,8 @@ static void d_lru_add(struct dentry *dentry)
        D_FLAG_VERIFY(dentry, 0);
        dentry->d_flags |= DCACHE_LRU_LIST;
        this_cpu_inc(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_inc(nr_dentry_negative);
        WARN_ON_ONCE(!list_lru_add(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
@@ -388,6 +409,8 @@ static void d_lru_del(struct dentry *dentry)
        D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
        dentry->d_flags &= ~DCACHE_LRU_LIST;
        this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
        WARN_ON_ONCE(!list_lru_del(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
@@ -418,6 +441,8 @@ static void d_lru_isolate(struct list_lru_one *lru, struct dentry *dentry)
        D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
        dentry->d_flags &= ~DCACHE_LRU_LIST;
        this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
        list_lru_isolate(lru, &dentry->d_lru);
 }
@@ -426,6 +451,8 @@ static void d_lru_shrink_move(struct list_lru_one *lru, struct dentry *dentry,
 {
        D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
        dentry->d_flags |= DCACHE_SHRINK_LIST;
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
        list_lru_isolate_move(lru, &dentry->d_lru, list);
 }
@@ -1188,15 +1215,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
 */
 void shrink_dcache_sb(struct super_block *sb)
 {
-        long freed;
        do {
                LIST_HEAD(dispose);
-                freed = list_lru_walk(&sb->s_dentry_lru,
+                list_lru_walk(&sb->s_dentry_lru,
                        dentry_lru_isolate_shrink, &dispose, 1024);
-                this_cpu_sub(nr_dentry_unused, freed);
                shrink_dentry_list(&dispose);
        } while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
@@ -1820,6 +1843,11 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
        WARN_ON(d_in_lookup(dentry));
        spin_lock(&dentry->d_lock);
+        /*
+         * Decrement negative dentry count if it was in the LRU list.
+         */
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_dec(nr_dentry_negative);
        hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
        raw_write_seqcount_begin(&dentry->d_seq);
        __d_set_inode_and_type(dentry, inode, add_flags);
diff --git a/fs/direct-io.c b/fs/direct-io.c
index dbc1a1f080ce..ec2fb6fe6d37 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
        unsigned long fs_count; /* Number of filesystem-sized blocks */
        int create;
        unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor;
+        loff_t i_size;
        /*
         * If there was a memory error and we've overwritten all the
@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
                 */
                create = dio->op == REQ_OP_WRITE;
                if (dio->flags & DIO_SKIP_HOLES) {
-                        if (fs_startblk <= ((i_size_read(dio->inode) - 1) >>
+                        i_size = i_size_read(dio->inode);
-                                                        i_blkbits))
+                        if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits)
                                create = 0;
                }
diff --git a/fs/drop_caches.c b/fs/drop_caches.c
index 82377017130f..d31b6c72b476 100644
--- a/fs/drop_caches.c
+++ b/fs/drop_caches.c
@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
        spin_lock(&sb->s_inode_list_lock);
        list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                spin_lock(&inode->i_lock);
+                /*
+                 * We must skip inodes in unusual state. We may also skip
+                 * inodes without pages but we deliberately won't in case
+                 * we need to reschedule to avoid softlockups.
+                 */
                if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
-                    (inode->i_mapping->nrpages == 0)) {
+                    (inode->i_mapping->nrpages == 0 && !need_resched())) {
                        spin_unlock(&inode->i_lock);
                        continue;
                }
@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
                spin_unlock(&inode->i_lock);
                spin_unlock(&sb->s_inode_list_lock);
+                cond_resched();
                invalidate_mapping_pages(inode->i_mapping, 0, -1);
                iput(toput_inode);
                toput_inode = inode;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b40168fcc94a..36855c1f8daf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -331,11 +331,22 @@ struct inode_switch_wbs_context {
        struct work_struct      work;
 };
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        down_write(&bdi->wb_switch_rwsem);
+}
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        up_write(&bdi->wb_switch_rwsem);
+}
 static void inode_switch_wbs_work_fn(struct work_struct *work)
 {
        struct inode_switch_wbs_context *isw =
                container_of(work, struct inode_switch_wbs_context, work);
        struct inode *inode = isw->inode;
+        struct backing_dev_info *bdi = inode_to_bdi(inode);
        struct address_space *mapping = inode->i_mapping;
        struct bdi_writeback *old_wb = inode->i_wb;
        struct bdi_writeback *new_wb = isw->new_wb;
@@ -344,6 +355,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
        bool switched = false;
        /*
+         * If @inode switches cgwb membership while sync_inodes_sb() is
+         * being issued, sync_inodes_sb() might miss it.  Synchronize.
+         */
+        down_read(&bdi->wb_switch_rwsem);
+        /*
         * By the time control reaches here, RCU grace period has passed
         * since I_WB_SWITCH assertion and all wb stat update transactions
         * between unlocked_inode_to_wb_begin/end() are guaranteed to be
@@ -428,6 +445,8 @@ skip_switch:
        spin_unlock(&new_wb->list_lock);
        spin_unlock(&old_wb->list_lock);
+        up_read(&bdi->wb_switch_rwsem);
        if (switched) {
                wb_wakeup(new_wb);
                wb_put(old_wb);
@@ -468,9 +487,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
        if (inode->i_state & I_WB_SWITCH)
                return;
+        /*
+         * Avoid starting new switches while sync_inodes_sb() is in
+         * progress.  Otherwise, if the down_write protected issue path
+         * blocks heavily, we might end up starting a large number of
+         * switches which will block on the rwsem.
+         */
+        if (!down_read_trylock(&bdi->wb_switch_rwsem))
+                return;
        isw = kzalloc(sizeof(*isw), GFP_ATOMIC);
        if (!isw)
-                return;
+                goto out_unlock;
        /* find and pin the new wb */
        rcu_read_lock();
@@ -504,12 +532,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
         * Let's continue after I_WB_SWITCH is guaranteed to be visible.
         */
        call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
-        return;
+        goto out_unlock;
 out_free:
        if (isw->new_wb)
                wb_put(isw->new_wb);
        kfree(isw);
+out_unlock:
+        up_read(&bdi->wb_switch_rwsem);
 }
 /**
@@ -887,6 +917,9 @@ fs_initcall(cgroup_writeback_init);
 #else   /* CONFIG_CGROUP_WRITEBACK */
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
 static struct bdi_writeback *
 locked_inode_to_wb_and_lock_list(struct inode *inode)
        __releases(&inode->i_lock)
@@ -2413,8 +2446,11 @@ void sync_inodes_sb(struct super_block *sb)
                return;
        WARN_ON(!rwsem_is_locked(&sb->s_umount));
+        /* protect against inode wb switch, see inode_switch_wbs_work_fn() */
+        bdi_down_write_wb_switch_rwsem(bdi);
        bdi_split_work_to_wbs(bdi, &work, false);
        wb_wait_for_completion(bdi, &done);
+        bdi_up_write_wb_switch_rwsem(bdi);
        wait_sb_inodes(sb);
 }
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index a5e516a40e7a..809c0f2f9942 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1742,7 +1742,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
        req->in.h.nodeid = outarg->nodeid;
        req->in.numargs = 2;
        req->in.argpages = 1;
-        req->page_descs[0].offset = offset;
        req->end = fuse_retrieve_end;
        index = outarg->offset >> PAGE_SHIFT;
@@ -1757,6 +1756,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
                this_num = min_t(unsigned, num, PAGE_SIZE - offset);
                req->pages[req->num_pages] = page;
+                req->page_descs[req->num_pages].offset = offset;
                req->page_descs[req->num_pages].length = this_num;
                req->num_pages++;
@@ -2077,8 +2077,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
        ret = fuse_dev_do_write(fud, &cs, len);
+        pipe_lock(pipe);
        for (idx = 0; idx < nbuf; idx++)
                pipe_buf_release(pipe, &bufs[idx]);
+        pipe_unlock(pipe);
 out:
        kvfree(bufs);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index ffaffe18352a..a59c16bd90ac 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1782,7 +1782,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req,
                spin_unlock(&fc->lock);
                dec_wb_stat(&bdi->wb, WB_WRITEBACK);
-                dec_node_page_state(page, NR_WRITEBACK_TEMP);
+                dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
                wb_writeout_inc(&bdi->wb);
                fuse_writepage_free(fc, new_req);
                fuse_request_free(new_req);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 76baaa6be393..c2d4099429be 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -628,6 +628,7 @@ void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns)
        get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
        fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
        fc->user_ns = get_user_ns(user_ns);
+        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
 }
 EXPORT_SYMBOL_GPL(fuse_conn_init);
@@ -1162,7 +1163,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
        fc->user_id = d.user_id;
        fc->group_id = d.group_id;
        fc->max_read = max_t(unsigned, 4096, d.max_read);
-        fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
        /* Used by get_root_inode() */
        sb->s_fs_info = fc;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 831d7cb5a49c..17a8d3b43990 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1780,9 +1780,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
                        goto next_iter;
                }
                if (ret == -E2BIG) {
-                        n += rbm->bii - initial_bii;
                        rbm->bii = 0;
                        rbm->offset = 0;
+                        n += (rbm->bii - initial_bii);
                        goto res_covered_end_of_rgrp;
                }
                return ret;
diff --git a/fs/iomap.c b/fs/iomap.c
index a3088fae567b..897c60215dd1 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,6 +116,12 @@ iomap_page_create(struct inode *inode, struct page *page)
        atomic_set(&iop->read_count, 0);
        atomic_set(&iop->write_count, 0);
        bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+        /*
+         * migrate_page_move_mapping() assumes that pages with private data have
+         * their count elevated by 1.
+         */
+        get_page(page);
        set_page_private(page, (unsigned long)iop);
        SetPagePrivate(page);
        return iop;
@@ -132,6 +138,7 @@ iomap_page_release(struct page *page)
        WARN_ON_ONCE(atomic_read(&iop->write_count));
        ClearPagePrivate(page);
        set_page_private(page, 0);
+        put_page(page);
        kfree(iop);
 }
@@ -569,8 +576,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,
        if (page_has_private(page)) {
                ClearPagePrivate(page);
+                get_page(newpage);
                set_page_private(newpage, page_private(page));
                set_page_private(page, 0);
+                put_page(page);
                SetPagePrivate(newpage);
        }
@@ -1804,6 +1813,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
        loff_t pos = iocb->ki_pos, start = pos;
        loff_t end = iocb->ki_pos + count - 1, ret = 0;
        unsigned int flags = IOMAP_DIRECT;
+        bool wait_for_completion = is_sync_kiocb(iocb);
        struct blk_plug plug;
        struct iomap_dio *dio;
@@ -1823,7 +1833,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
        dio->end_io = end_io;
        dio->error = 0;
        dio->flags = 0;
-        dio->wait_for_completion = is_sync_kiocb(iocb);
        dio->submit.iter = iter;
        dio->submit.waiter = current;
@@ -1878,7 +1887,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                dio_warn_stale_pagecache(iocb->ki_filp);
        ret = 0;
-        if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
+        if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&
            !inode->i_sb->s_dio_done_wq) {
                ret = sb_init_dio_done_wq(inode->i_sb);
                if (ret < 0)
@@ -1894,7 +1903,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                if (ret <= 0) {
                        /* magic error code to fall back to buffered I/O */
                        if (ret == -ENOTBLK) {
-                                dio->wait_for_completion = true;
+                                wait_for_completion = true;
                                ret = 0;
                        }
                        break;
@@ -1916,8 +1925,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
        if (dio->flags & IOMAP_DIO_WRITE_FUA)
                dio->flags &= ~IOMAP_DIO_NEED_SYNC;
+        /*
+         * We are about to drop our additional submission reference, which
+         * might be the last reference to the dio.  There are three three
+         * different ways we can progress here:
+         *
+         *  (a) If this is the last reference we will always complete and free
+         *      the dio ourselves.
+         *  (b) If this is not the last reference, and we serve an asynchronous
+         *      iocb, we must never touch the dio after the decrement, the
+         *      I/O completion handler will complete and free it.
+         *  (c) If this is not the last reference, but we serve a synchronous
+         *      iocb, the I/O completion handler will wake us up on the drop
+         *      of the final reference, and we will complete and free it here
+         *      after we got woken by the I/O completion handler.
+         */
+        dio->wait_for_completion = wait_for_completion;
        if (!atomic_dec_and_test(&dio->ref)) {
-                if (!dio->wait_for_completion)
+                if (!wait_for_completion)
                        return -EIOCBQUEUED;
                for (;;) {
@@ -1934,9 +1959,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                __set_current_state(TASK_RUNNING);
        }
-        ret = iomap_dio_complete(dio);
+        return iomap_dio_complete(dio);
-        return ret;
 out_free_dio:
        kfree(dio);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 22ce3c8a2f46..0570391eaa16 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1895,6 +1895,11 @@ static int nfs_parse_devname(const char *dev_name,
        size_t len;
        char *end;
+        if (unlikely(!dev_name || !*dev_name)) {
+                dfprintk(MOUNT, "NFS: device name not specified\n");
+                return -EINVAL;
+        }
        /* Is the host name protected with square brakcets? */
        if (*dev_name == '[') {
                end = strchr(++dev_name, ']');
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5a0bbf917a32..f12cb31a41e5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -621,11 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
        nfs_set_page_writeback(page);
        WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
-        ret = 0;
+        ret = req->wb_context->error;
        /* If there is a fatal error that covers this write, just exit */
-        if (nfs_error_is_fatal_on_server(req->wb_context->error))
+        if (nfs_error_is_fatal_on_server(ret))
                goto out_launder;
+        ret = 0;
        if (!nfs_pageio_add_request(pgio, req)) {
                ret = pgio->pg_error;
                /*
@@ -635,9 +636,9 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                        nfs_context_set_write_error(req->wb_context, ret);
                        if (nfs_error_is_fatal_on_server(ret))
                                goto out_launder;
-                }
+                } else
+                        ret = -EAGAIN;
                nfs_redirty_request(req);
-                ret = -EAGAIN;
        } else
                nfs_add_stats(page_file_mapping(page)->host,
                                NFSIOS_WRITEPAGES, 1);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 9824e32b2f23..7dc98e14655d 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -557,9 +557,11 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst,
        loff_t cloned;
        cloned = vfs_clone_file_range(src, src_pos, dst, dst_pos, count, 0);
+        if (cloned < 0)
+                return nfserrno(cloned);
        if (count && cloned != count)
-                cloned = -EINVAL;
+                return nfserrno(-EINVAL);
-        return nfserrno(cloned < 0 ? cloned : 0);
+        return 0;
 }
 ssize_t nfsd_copy_file_range(struct file *src, u64 src_pos, struct file *dst,
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 105576daca4a..798f1253141a 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -724,8 +724,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
                return -EBADF;
        /* IN_MASK_ADD and IN_MASK_CREATE don't make sense together */
-        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE)))
+        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE))) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto fput_and_out;
+        }
        /* verify that this is indeed an inotify instance */
        if (unlikely(f.file->f_op != &inotify_fops)) {
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 8ae109429a88..e39bac94dead 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
                inode = proc_get_inode(dir->i_sb, de);
                if (!inode)
                        return ERR_PTR(-ENOMEM);
-                d_set_d_op(dentry, &proc_misc_dentry_ops);
+                d_set_d_op(dentry, de->proc_dops);
                return d_splice_alias(inode, dentry);
        }
        read_unlock(&proc_subdir_lock);
@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
        INIT_LIST_HEAD(&ent->pde_openers);
        proc_set_user(ent, (*parent)->uid, (*parent)->gid);
+        ent->proc_dops = &proc_misc_dentry_ops;
 out:
        return ent;
 }
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 5185d7f6a51e..95b14196f284 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -44,6 +44,7 @@ struct proc_dir_entry {
        struct completion *pde_unload_completion;
        const struct inode_operations *proc_iops;
        const struct file_operations *proc_fops;
+        const struct dentry_operations *proc_dops;
        union {
                const struct seq_operations *seq_ops;
                int (*single_show)(struct seq_file *, void *);
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index d5e0fcb3439e..a7b12435519e 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode)
        return maybe_get_net(PDE_NET(PDE(inode)));
 }
+static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+{
+        return 0;
+}
+static const struct dentry_operations proc_net_dentry_ops = {
+        .d_revalidate   = proc_net_d_revalidate,
+        .d_delete       = always_delete_dentry,
+};
+static void pde_force_lookup(struct proc_dir_entry *pde)
+{
+        /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+        pde->proc_dops = &proc_net_dentry_ops;
+}
 static int seq_open_net(struct inode *inode, struct file *file)
 {
        unsigned int state_size = PDE(inode)->state_size;
@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode,
        p = proc_create_reg(name, mode, &parent, data);
        if (!p)
                return NULL;
+        pde_force_lookup(p);
        p->proc_fops = &proc_net_seq_fops;
        p->seq_ops = ops;
        p->state_size = state_size;
@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode
        p = proc_create_reg(name, mode, &parent, data);
        if (!p)
                return NULL;
+        pde_force_lookup(p);
        p->proc_fops = &proc_net_seq_fops;
        p->seq_ops = ops;
        p->state_size = state_size;
@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode,
        p = proc_create_reg(name, mode, &parent, data);
        if (!p)
                return NULL;
+        pde_force_lookup(p);
        p->proc_fops = &proc_net_single_fops;
        p->single_show = show;
        return proc_register(parent, p);
@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo
        p = proc_create_reg(name, mode, &parent, data);
        if (!p)
                return NULL;
+        pde_force_lookup(p);
        p->proc_fops = &proc_net_single_fops;
        p->single_show = show;
        p->write = write;
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 535eda7857cf..76175211b304 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -79,6 +79,31 @@ static u64 get_iowait_time(int cpu)
 #endif
+static void show_irq_gap(struct seq_file *p, unsigned int gap)
+{
+        static const char zeros[] = " 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0";
+        while (gap > 0) {
+                unsigned int inc;
+                inc = min_t(unsigned int, gap, ARRAY_SIZE(zeros) / 2);
+                seq_write(p, zeros, 2 * inc);
+                gap -= inc;
+        }
+}
+static void show_all_irqs(struct seq_file *p)
+{
+        unsigned int i, next = 0;
+        for_each_active_irq(i) {
+                show_irq_gap(p, i - next);
+                seq_put_decimal_ull(p, " ", kstat_irqs_usr(i));
+                next = i + 1;
+        }
+        show_irq_gap(p, nr_irqs - next);
+}
 static int show_stat(struct seq_file *p, void *v)
 {
        int i, j;
@@ -156,9 +181,7 @@ static int show_stat(struct seq_file *p, void *v)
        }
        seq_put_decimal_ull(p, "intr ", (unsigned long long)sum);
-        /* sum again ? it could be updated? */
+        show_all_irqs(p);
-        for_each_irq_nr(j)
-                seq_put_decimal_ull(p, " ", kstat_irqs_usr(j));
        seq_printf(p,
                "\nctxt %llu\n"
diff --git a/include/dt-bindings/clock/marvell,mmp2.h b/include/dt-bindings/clock/marvell,mmp2.h
index 7b24fc791146..228a5e234af0 100644
--- a/include/dt-bindings/clock/marvell,mmp2.h
+++ b/include/dt-bindings/clock/marvell,mmp2.h
@@ -71,7 +71,6 @@
 #define MMP2_CLK_CCIC1_MIX              117
 #define MMP2_CLK_CCIC1_PHY              118
 #define MMP2_CLK_CCIC1_SPHY             119
-#define MMP2_CLK_SP                     120
 #define MMP2_NR_CLKS                    200
 #endif
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index c31157135598..07e02d6df5ad 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -190,6 +190,7 @@ struct backing_dev_info {
        struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
        struct rb_root cgwb_congested_tree; /* their congested states */
        struct mutex cgwb_release_mutex;  /* protect shutdown of wb structs */
+        struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */
 #else
        struct bdi_writeback_congested *wb_congested;
 #endif
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 5c7e7f859a24..d66bf5f32610 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -287,7 +287,7 @@ enum req_opf {
        REQ_OP_DISCARD          = 3,
        /* securely erase sectors */
        REQ_OP_SECURE_ERASE     = 5,
-        /* seset a zone write pointer */
+        /* reset a zone write pointer */
        REQ_OP_ZONE_RESET       = 6,
        /* write the same sector many times */
        REQ_OP_WRITE_SAME       = 7,
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 218df7f4d3e1..5041357d0297 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
 #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
 extern enum cpuhp_smt_control cpu_smt_control;
 extern void cpu_smt_disable(bool force);
-extern void cpu_smt_check_topology_early(void);
 extern void cpu_smt_check_topology(void);
 #else
 # define cpu_smt_control                (CPU_SMT_ENABLED)
 static inline void cpu_smt_disable(bool force) { }
-static inline void cpu_smt_check_topology_early(void) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index ef4b70f64f33..60996e64c579 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -62,9 +62,10 @@ extern const struct qstr slash_name;
 struct dentry_stat_t {
        long nr_dentry;
        long nr_unused;
-        long age_limit;          /* age in seconds */
+        long age_limit;         /* age in seconds */
-        long want_pages;         /* pages requested by system */
+        long want_pages;        /* pages requested by system */
-        long dummy[2];
+        long nr_negative;       /* # of unused negative dentries */
+        long dummy;             /* Reserved for future use */
 };
 extern struct dentry_stat_t dentry_stat;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 811c77743dad..29d8e2cfed0e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1479,11 +1479,12 @@ struct super_block {
        struct user_namespace *s_user_ns;
        /*
-         * Keep the lru lists last in the structure so they always sit on their
+         * The list_lru structure is essentially just a pointer to a table
-         * own individual cachelines.
+         * of per-node lru lists, each of which has its own spinlock.
+         * There is no need to put them into separate cachelines.
         */
-        struct list_lru         s_dentry_lru ____cacheline_aligned_in_smp;
+        struct list_lru         s_dentry_lru;
-        struct list_lru         s_inode_lru ____cacheline_aligned_in_smp;
+        struct list_lru         s_inode_lru;
        struct rcu_head         rcu;
        struct work_struct      destroy_work;
diff --git a/include/linux/hid-debug.h b/include/linux/hid-debug.h
index 8663f216c563..2d6100edf204 100644
--- a/include/linux/hid-debug.h
+++ b/include/linux/hid-debug.h
@@ -24,7 +24,10 @@
 #ifdef CONFIG_DEBUG_FS
+#include <linux/kfifo.h>
 #define HID_DEBUG_BUFSIZE 512
+#define HID_DEBUG_FIFOSIZE 512
 void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
 void hid_dump_report(struct hid_device *, int , u8 *, int);
@@ -37,11 +40,8 @@ void hid_debug_init(void);
 void hid_debug_exit(void);
 void hid_debug_event(struct hid_device *, char *);
 struct hid_debug_list {
-        char *hid_debug_buf;
+        DECLARE_KFIFO_PTR(hid_debug_fifo, char);
-        int head;
-        int tail;
        struct fasync_struct *fasync;
        struct hid_device *hdev;
        struct list_head node;
@@ -64,4 +64,3 @@ struct hid_debug_list {
 #endif
 #endif
diff --git a/include/linux/hid.h b/include/linux/hid.h
index d99287327ef2..f9707d1dcb58 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -430,7 +430,7 @@ struct hid_local {
 */
 struct hid_collection {
-        struct hid_collection *parent;
+        int parent_idx; /* device->collection */
        unsigned type;
        unsigned usage;
        unsigned level;
@@ -658,7 +658,6 @@ struct hid_parser {
        unsigned int         *collection_stack;
        unsigned int          collection_stack_ptr;
        unsigned int          collection_stack_size;
-        struct hid_collection *active_collection;
        struct hid_device    *device;
        unsigned int          scan_flags;
 };
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index f0885cc01db6..dcb6977afce9 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1159,8 +1159,9 @@ struct hv_ring_buffer_debug_info {
        u32 bytes_avail_towrite;
 };
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                            struct hv_ring_buffer_debug_info *debug_info);
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+                                struct hv_ring_buffer_debug_info *debug_info);
 /* Vmbus interface */
 #define vmbus_driver_register(driver)   \
diff --git a/include/linux/ide.h b/include/linux/ide.h
index e7d29ae633cd..971cf76a78a0 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -615,6 +615,7 @@ struct ide_drive_s {
        /* current sense rq and buffer */
        bool sense_rq_armed;
+        bool sense_rq_active;
        struct request *sense_rq;
        struct request_sense sense_data;
@@ -1219,6 +1220,7 @@ extern void ide_stall_queue(ide_drive_t *drive, unsigned long timeout);
 extern void ide_timer_expiry(struct timer_list *t);
 extern irqreturn_t ide_intr(int irq, void *dev_id);
 extern blk_status_t ide_queue_rq(struct blk_mq_hw_ctx *, const struct blk_mq_queue_data *);
+extern blk_status_t ide_issue_rq(ide_drive_t *, struct request *, bool);
 extern void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq);
 void ide_init_disk(struct gendisk *, ide_drive_t *);
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 6756fea18b69..e44746de95cd 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
        case ARPHRD_IPGRE:
        case ARPHRD_VOID:
        case ARPHRD_NONE:
+        case ARPHRD_RAWIP:
                return false;
        default:
                return true;
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 831ddcdc5597..690b238a44d5 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -259,25 +259,35 @@ struct irq_affinity_notify {
        void (*release)(struct kref *ref);
 };
+#define IRQ_AFFINITY_MAX_SETS  4
 /**
 * struct irq_affinity - Description for automatic irq affinity assignements
 * @pre_vectors:        Don't apply affinity to @pre_vectors at beginning of
 *                      the MSI(-X) vector space
 * @post_vectors:       Don't apply affinity to @post_vectors at end of
 *                      the MSI(-X) vector space
- * @nr_sets:            Length of passed in *sets array
+ * @nr_sets:            The number of interrupt sets for which affinity
- * @sets:               Number of affinitized sets
+ *                      spreading is required
+ * @set_size:           Array holding the size of each interrupt set
+ * @calc_sets:          Callback for calculating the number and size
+ *                      of interrupt sets
+ * @priv:               Private data for usage by @calc_sets, usually a
+ *                      pointer to driver/device specific data.
 */
 struct irq_affinity {
-        int     pre_vectors;
+        unsigned int    pre_vectors;
-        int     post_vectors;
+        unsigned int    post_vectors;
-        int     nr_sets;
+        unsigned int    nr_sets;
-        int     *sets;
+        unsigned int    set_size[IRQ_AFFINITY_MAX_SETS];
+        void            (*calc_sets)(struct irq_affinity *, unsigned int nvecs);
+        void            *priv;
 };
 /**
 * struct irq_affinity_desc - Interrupt affinity descriptor
 * @mask:       cpumask to hold the affinity assignment
+ * @is_managed: 1 if the interrupt is managed internally
 */
 struct irq_affinity_desc {
        struct cpumask  mask;
@@ -331,9 +341,10 @@ extern int
 irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify);
 struct irq_affinity_desc *
-irq_create_affinity_masks(int nvec, const struct irq_affinity *affd);
+irq_create_affinity_masks(unsigned int nvec, struct irq_affinity *affd);
-int irq_calc_affinity_vectors(int minvec, int maxvec, const struct irq_affinity *affd);
+unsigned int irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,
+                                       const struct irq_affinity *affd);
 #else /* CONFIG_SMP */
@@ -367,13 +378,14 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
 }
 static inline struct irq_affinity_desc *
-irq_create_affinity_masks(int nvec, const struct irq_affinity *affd)
+irq_create_affinity_masks(unsigned int nvec, struct irq_affinity *affd)
 {
        return NULL;
 }
-static inline int
+static inline unsigned int
-irq_calc_affinity_vectors(int minvec, int maxvec, const struct irq_affinity *affd)
+irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,
+                          const struct irq_affinity *affd)
 {
        return maxvec;
 }
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index ba05b0d6401a..d6e2ab538ef2 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -28,6 +28,7 @@ struct pt_regs;
 * @core_internal_state__do_not_mess_with_it: core internal status information
 * @depth:              disable-depth, for nested irq_disable() calls
 * @wake_depth:         enable depth, for multiple irq_set_irq_wake() callers
+ * @tot_count:          stats field for non-percpu irqs
 * @irq_count:          stats field to detect stalled irqs
 * @last_unhandled:     aging timer for unhandled count
 * @irqs_unhandled:     stats field for spurious unhandled interrupts
@@ -65,6 +66,7 @@ struct irq_desc {
        unsigned int            core_internal_state__do_not_mess_with_it;
        unsigned int            depth;          /* nested irq disables */
        unsigned int            wake_depth;     /* nested wake enables */
+        unsigned int            tot_count;
        unsigned int            irq_count;      /* For detecting broken IRQs */
        unsigned long           last_unhandled; /* Aging timer for unhandled count */
        unsigned int            irqs_unhandled;
diff --git a/include/linux/kthread.h b/include/linux/kthread.h
index c1961761311d..1577a2d56e9d 100644
--- a/include/linux/kthread.h
+++ b/include/linux/kthread.h
@@ -56,6 +56,7 @@ void kthread_bind_mask(struct task_struct *k, const struct cpumask *mask);
 int kthread_stop(struct task_struct *k);
 bool kthread_should_stop(void);
 bool kthread_should_park(void);
+bool __kthread_should_park(struct task_struct *k);
 bool kthread_freezable_should_stop(bool *was_frozen);
 void *kthread_data(struct task_struct *k);
 void *kthread_probe_data(struct task_struct *k);
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 7315977b64da..ad609617aeb8 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -235,7 +235,6 @@ static inline struct nvdimm *nvdimm_create(struct nvdimm_bus *nvdimm_bus,
                        cmd_mask, num_flush, flush_wpq, NULL, NULL);
 }
-int nvdimm_security_setup_events(struct nvdimm *nvdimm);
 const struct nd_cmd_desc *nd_cmd_dimm_desc(int cmd);
 const struct nd_cmd_desc *nd_cmd_bus_desc(int cmd);
 u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 07da5c6c5ba0..368267c1b71b 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -21,14 +21,16 @@ struct vmem_altmap;
 * walkers which rely on the fully initialized page->flags and others
 * should use this rather than pfn_valid && pfn_to_page
 */
-#define pfn_to_online_page(pfn)                         \
+#define pfn_to_online_page(pfn)                                    \
-({                                                      \
+({                                                                 \
-        struct page *___page = NULL;                    \
+        struct page *___page = NULL;                               \
-        unsigned long ___nr = pfn_to_section_nr(pfn);   \
+        unsigned long ___pfn = pfn;                                \
-                                                        \
+        unsigned long ___nr = pfn_to_section_nr(___pfn);           \
-        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
+                                                                   \
-                ___page = pfn_to_page(pfn);             \
+        if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
-        ___page;                                        \
+            pfn_valid_within(___pfn))                              \
+                ___page = pfn_to_page(___pfn);                     \
+        ___page;                                                   \
 })
 /*
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 65f1d8c2f082..e7c51b00cdfe 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1393,7 +1393,7 @@ static inline int pci_enable_msix_exact(struct pci_dev *dev,
 }
 int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                   unsigned int max_vecs, unsigned int flags,
-                                   const struct irq_affinity *affd);
+                                   struct irq_affinity *affd);
 void pci_free_irq_vectors(struct pci_dev *dev);
 int pci_irq_vector(struct pci_dev *dev, unsigned int nr);
@@ -1419,7 +1419,7 @@ static inline int pci_enable_msix_exact(struct pci_dev *dev,
 static inline int
 pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                               unsigned int max_vecs, unsigned int flags,
-                               const struct irq_affinity *aff_desc)
+                               struct irq_affinity *aff_desc)
 {
        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1 && dev->irq)
                return 1;
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index 54af4eef169f..fed5be706bc9 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -105,7 +105,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
 static inline void pm_runtime_mark_last_busy(struct device *dev)
 {
-        WRITE_ONCE(dev->power.last_busy, ktime_to_ns(ktime_get()));
+        WRITE_ONCE(dev->power.last_busy, ktime_get_mono_fast_ns());
 }
 static inline bool pm_runtime_is_irq_safe(struct device *dev)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d2f90fa92468..bba3afb4e9bf 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -995,7 +995,7 @@ struct task_struct {
        /* cg_list protected by css_set_lock and tsk->alloc_lock: */
        struct list_head                cg_list;
 #endif
-#ifdef CONFIG_X86_RESCTRL
+#ifdef CONFIG_X86_CPU_RESCTRL
        u32                             closid;
        u32                             rmid;
 #endif
diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
index ec912d01126f..ecdc6542070f 100644
--- a/include/linux/sched/coredump.h
+++ b/include/linux/sched/coredump.h
@@ -71,6 +71,7 @@ static inline int get_dumpable(struct mm_struct *mm)
 #define MMF_HUGE_ZERO_PAGE      23      /* mm has ever used the global huge zero page */
 #define MMF_DISABLE_THP         24      /* disable THP for all VMAs */
 #define MMF_OOM_VICTIM          25      /* mm is the oom victim */
+#define MMF_OOM_REAP_QUEUED     26      /* mm was queued for oom_reaper */
 #define MMF_DISABLE_THP_MASK    (1 << MMF_DISABLE_THP)
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
diff --git a/include/linux/sched/wake_q.h b/include/linux/sched/wake_q.h
index 10b19a192b2d..545f37138057 100644
--- a/include/linux/sched/wake_q.h
+++ b/include/linux/sched/wake_q.h
@@ -24,9 +24,13 @@
 * called near the end of a function. Otherwise, the list can be
 * re-initialized for later re-use by wake_q_init().
 *
- * Note that this can cause spurious wakeups. schedule() callers
+ * NOTE that this can cause spurious wakeups. schedule() callers
 * must ensure the call is done inside a loop, confirming that the
 * wakeup condition has in fact occurred.
+ *
+ * NOTE that there is no guarantee the wakeup will happen any later than the
+ * wake_q_add() location. Therefore task must be ready to be woken at the
+ * location of the wake_q_add().
 */
 #include <linux/sched.h>
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index f492e21c4aa2..5d9d318bcf7a 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -176,7 +176,8 @@ static inline bool xa_is_internal(const void *entry)
 */
 static inline bool xa_is_err(const void *entry)
 {
-        return unlikely(xa_is_internal(entry));
+        return unlikely(xa_is_internal(entry) &&
+                        entry >= xa_mk_internal(-MAX_ERRNO));
 }
 /**
@@ -286,7 +287,6 @@ struct xarray {
 */
 #define DEFINE_XARRAY_ALLOC(name) DEFINE_XARRAY_FLAGS(name, XA_FLAGS_ALLOC)
-void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *xa_erase(struct xarray *, unsigned long index);
@@ -304,6 +304,24 @@ unsigned int xa_extract(struct xarray *, void **dst, unsigned long start,
 void xa_destroy(struct xarray *);
 /**
+ * xa_init_flags() - Initialise an empty XArray with flags.
+ * @xa: XArray.
+ * @flags: XA_FLAG values.
+ *
+ * If you need to initialise an XArray with special flags (eg you need
+ * to take the lock from interrupt context), use this function instead
+ * of xa_init().
+ *
+ * Context: Any context.
+ */
+static inline void xa_init_flags(struct xarray *xa, gfp_t flags)
+{
+        spin_lock_init(&xa->xa_lock);
+        xa->xa_flags = flags;
+        xa->xa_head = NULL;
+}
+/**
 * xa_init() - Initialise an empty XArray.
 * @xa: XArray.
 *
@@ -342,20 +360,45 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 /**
- * xa_for_each() - Iterate over a portion of an XArray.
+ * xa_for_each_start() - Iterate over a portion of an XArray.
 * @xa: XArray.
+ * @index: Index of @entry.
 * @entry: Entry retrieved from array.
+ * @start: First index to retrieve from array.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  You may modify @index during the iteration if you
+ * want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set
+ * to NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_start() is O(n.log(n)) while xas_for_each() is O(n).  You have
+ * to handle your own locking with xas_for_each(), and if you have to unlock
+ * after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_start() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each() iterator instead.
+ * The xas_for_each() iterator will expand into more inline code than
+ * xa_for_each_start().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_start(xa, index, entry, start)                      \
+        for (index = start,                                             \
+             entry = xa_find(xa, &index, ULONG_MAX, XA_PRESENT);        \
+             entry;                                                     \
+             entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT))
+/**
+ * xa_for_each() - Iterate over present entries in an XArray.
+ * @xa: XArray.
 * @index: Index of @entry.
- * @max: Maximum index to retrieve from array.
+ * @entry: Entry retrieved from array.
- * @filter: Selection criterion.
 *
- * Initialise @index to the lowest index you want to retrieve from the
+ * During the iteration, @entry will have the value of the entry stored
- * array.  During the iteration, @entry will have the value of the entry
+ * in @xa at @index.  You may modify @index during the iteration if you want
- * stored in @xa at @index.  The iteration will skip all entries in the
+ * to skip or reprocess indices.  It is safe to modify the array during the
- * array which do not match @filter.  You may modify @index during the
+ * iteration.  At the end of the iteration, @entry will be set to NULL and
- * iteration if you want to skip or reprocess indices.  It is safe to modify
+ * @index will have a value less than or equal to max.
- * the array during the iteration.  At the end of the iteration, @entry will
- * be set to NULL and @index will have a value less than or equal to max.
 *
 * xa_for_each() is O(n.log(n)) while xas_for_each() is O(n).  You have
 * to handle your own locking with xas_for_each(), and if you have to unlock
@@ -366,9 +409,36 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 *
 * Context: Any context.  Takes and releases the RCU lock.
 */
-#define xa_for_each(xa, entry, index, max, filter) \
+#define xa_for_each(xa, index, entry) \
-        for (entry = xa_find(xa, &index, max, filter); entry; \
+        xa_for_each_start(xa, index, entry, 0)
-             entry = xa_find_after(xa, &index, max, filter))
+/**
+ * xa_for_each_marked() - Iterate over marked entries in an XArray.
+ * @xa: XArray.
+ * @index: Index of @entry.
+ * @entry: Entry retrieved from array.
+ * @filter: Selection criterion.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  The iteration will skip all entries in the array
+ * which do not match @filter.  You may modify @index during the iteration
+ * if you want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set to
+ * NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_marked() is O(n.log(n)) while xas_for_each_marked() is O(n).
+ * You have to handle your own locking with xas_for_each(), and if you have
+ * to unlock after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_marked() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each_marked() iterator
+ * instead.  The xas_for_each_marked() iterator will expand into more inline
+ * code than xa_for_each_marked().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_marked(xa, index, entry, filter) \
+        for (index = 0, entry = xa_find(xa, &index, ULONG_MAX, filter); \
+             entry; entry = xa_find_after(xa, &index, ULONG_MAX, filter))
 #define xa_trylock(xa)          spin_trylock(&(xa)->xa_lock)
 #define xa_lock(xa)             spin_lock(&(xa)->xa_lock)
@@ -393,40 +463,13 @@ void *__xa_erase(struct xarray *, unsigned long index);
 void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                void *entry, gfp_t);
+int __xa_insert(struct xarray *, unsigned long index, void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
 int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 /**
- * __xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use __xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Any context.  Expects xa_lock to be held on entry.  May
- *          release and reacquire xa_lock if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int __xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = __xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-/**
 * xa_store_bh() - Store this entry in the XArray.
 * @xa: XArray.
 * @index: Index into array.
@@ -453,7 +496,7 @@ static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
 }
 /**
- * xa_store_irq() - Erase this entry from the XArray.
+ * xa_store_irq() - Store this entry in the XArray.
 * @xa: XArray.
 * @index: Index into array.
 * @entry: New entry.
@@ -615,24 +658,83 @@ static inline void *xa_cmpxchg_irq(struct xarray *xa, unsigned long index,
 * @entry: New entry.
 * @gfp: Memory allocation flags.
 *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
- * This function is for users who don't care what the entry is, only that
+ * if no entry is present.  Inserting will fail if a reserved entry is
- * one is present.
+ * present, even though loading from this index will return NULL.
 *
- * Context: Process context.  Takes and releases the xa_lock.
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep if
- *          May sleep if the @gfp flags permit.
+ * the @gfp flags permit.
 * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
 * -ENOMEM if memory could not be allocated.
 */
 static inline int xa_insert(struct xarray *xa, unsigned long index,
                void *entry, gfp_t gfp)
 {
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
+        int err;
-        if (!curr)
-                return 0;
+        xa_lock(xa);
-        if (xa_is_err(curr))
+        err = __xa_insert(xa, index, entry, gfp);
-                return xa_err(curr);
+        xa_unlock(xa);
-        return -EEXIST;
+        return err;
+}
+/**
+ * xa_insert_bh() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+        xa_lock_bh(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+        return err;
+}
+/**
+ * xa_insert_irq() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+        xa_lock_irq(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+        return err;
 }
 /**
@@ -970,8 +1072,8 @@ static inline bool xa_is_sibling(const void *entry)
                (entry < xa_mk_sibling(XA_CHUNK_SIZE - 1));
 }
-#define XA_ZERO_ENTRY           xa_mk_internal(256)
+#define XA_RETRY_ENTRY          xa_mk_internal(256)
-#define XA_RETRY_ENTRY          xa_mk_internal(257)
+#define XA_ZERO_ENTRY           xa_mk_internal(257)
 /**
 * xa_is_zero() - Is the entry a zero entry?
@@ -996,6 +1098,17 @@ static inline bool xa_is_retry(const void *entry)
 }
 /**
+ * xa_is_advanced() - Is the entry only permitted for the advanced API?
+ * @entry: Entry to be stored in the XArray.
+ *
+ * Return: %true if the entry cannot be stored by the normal API.
+ */
+static inline bool xa_is_advanced(const void *entry)
+{
+        return xa_is_internal(entry) && (entry <= XA_RETRY_ENTRY);
+}
+/**
 * typedef xa_update_node_t - A callback function from the XArray.
 * @node: The node which is being processed
 *
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 3f9aea8087e3..8b7eb46ad72d 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -201,6 +201,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt)
 void __ax25_put_route(ax25_route *ax25_rt);
+extern rwlock_t ax25_route_lock;
+static inline void ax25_route_lock_use(void)
+{
+        read_lock(&ax25_route_lock);
+}
+static inline void ax25_route_lock_unuse(void)
+{
+        read_unlock(&ax25_route_lock);
+}
 static inline void ax25_put_route(ax25_route *ax25_rt)
 {
        if (refcount_dec_and_test(&ax25_rt->refcount))
diff --git a/include/net/tls.h b/include/net/tls.h
index 2a6ac8d642af..1486b60c4de8 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -120,6 +120,8 @@ struct tls_rec {
        struct scatterlist sg_aead_out[2];
        char aad_space[TLS_AAD_SPACE_SIZE];
+        u8 iv_data[TLS_CIPHER_AES_GCM_128_IV_SIZE +
+                   TLS_CIPHER_AES_GCM_128_SALT_SIZE];
        struct aead_request aead_req;
        u8 aead_req_ctx[];
 };
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a3ceed3a040a..80debf5982ac 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2579,9 +2579,10 @@ struct ib_device {
        const struct uapi_definition   *driver_def;
        enum rdma_driver_id             driver_id;
        /*
-         * Provides synchronization between device unregistration and netlink
+         * Positive refcount indicates that the device is currently
-         * commands on a device. To be used only by core.
+         * registered and cannot be unregistered.
         */
        refcount_t refcount;
        struct completion unreg_completion;
@@ -3926,6 +3927,25 @@ static inline bool ib_access_writable(int access_flags)
 int ib_check_mr_status(struct ib_mr *mr, u32 check_mask,
                       struct ib_mr_status *mr_status);
+/**
+ * ib_device_try_get: Hold a registration lock
+ * device: The device to lock
+ *
+ * A device under an active registration lock cannot become unregistered. It
+ * is only possible to obtain a registration lock on a device that is fully
+ * registered, otherwise this function returns false.
+ *
+ * The registration lock is only necessary for actions which require the
+ * device to still be registered. Uses that only require the device pointer to
+ * be valid should use get_device(&ibdev->dev) to hold the memory.
+ *
+ */
+static inline bool ib_device_try_get(struct ib_device *dev)
+{
+        return refcount_inc_not_zero(&dev->refcount);
+}
+void ib_device_put(struct ib_device *device);
 struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u8 port,
                                            u16 pkey, const union ib_gid *gid,
                                            const struct sockaddr *addr);
diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
index 0cdc3999ecfa..c5188ff724d1 100644
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -173,7 +173,11 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
        if (snd_BUG_ON(!stream))
                return;
-        stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        if (stream->direction == SND_COMPRESS_PLAYBACK)
+                stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+        else
+                stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
        wake_up(&stream->runtime->sleep);
 }
diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
index 7fa48b100936..cc7c8d42d4fd 100644
--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -68,6 +68,7 @@ struct hda_bus {
        unsigned int response_reset:1;  /* controller was reset */
        unsigned int in_reset:1;        /* during reset operation */
        unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
+        unsigned int bus_probing :1;    /* during probing process */
        int primary_dig_out_type;       /* primary digital out PCM type */
        unsigned int mixer_assigned;    /* codec addr for mixer name */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 8ec1de856ee7..e665f111b0d2 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -985,6 +985,12 @@ struct snd_soc_dai_link {
        /* Do not create a PCM for this DAI link (Backend link) */
        unsigned int ignore:1;
+        /*
+         * This driver uses legacy platform naming. Set by the core, machine
+         * drivers should not modify this value.
+         */
+        unsigned int legacy_platform:1;
        struct list_head list; /* DAI link list of the soc card */
        struct snd_soc_dobj dobj; /* For topology */
 };
diff --git a/include/uapi/linux/android/binder_ctl.h b/include/uapi/linux/android/binderfs.h
index 65b2efd1a0a5..87410477aea9 100644
--- a/include/uapi/linux/android/binder_ctl.h
+++ b/include/uapi/linux/android/binderfs.h
@@ -4,8 +4,8 @@
 *
 */
-#ifndef _UAPI_LINUX_BINDER_CTL_H
+#ifndef _UAPI_LINUX_BINDERFS_H
-#define _UAPI_LINUX_BINDER_CTL_H
+#define _UAPI_LINUX_BINDERFS_H
 #include <linux/android/binder.h>
 #include <linux/types.h>
@@ -22,8 +22,8 @@
 */
 struct binderfs_device {
        char name[BINDERFS_MAX_NAME + 1];
-        __u8 major;
+        __u32 major;
-        __u8 minor;
+        __u32 minor;
 };
 /**
@@ -31,5 +31,5 @@ struct binderfs_device {
 */
 #define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device)
-#endif /* _UAPI_LINUX_BINDER_CTL_H */
+#endif /* _UAPI_LINUX_BINDERFS_H */
diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h
index 6fa38d001d84..498eec813494 100644
--- a/include/uapi/linux/blkzoned.h
+++ b/include/uapi/linux/blkzoned.h
@@ -138,6 +138,7 @@ struct blk_zone_range {
 * @BLKRESETZONE: Reset the write pointer of the zones in the specified
 *                sector range. The sector range must be zone aligned.
 * @BLKGETZONESZ: Get the device zone size in number of 512 B sectors.
+ * @BLKGETNRZONES: Get the total number of zones of the device.
 */
 #define BLKREPORTZONE   _IOWR(0x12, 130, struct blk_zone_report)
 #define BLKRESETZONE    _IOW(0x12, 131, struct blk_zone_range)
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index fb78f6f500f3..f056b2a00d5c 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -26,13 +26,17 @@
 */
 struct input_event {
-#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL)
+#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL__)
        struct timeval time;
 #define input_event_sec time.tv_sec
 #define input_event_usec time.tv_usec
 #else
        __kernel_ulong_t __sec;
+#if defined(__sparc__) && defined(__arch64__)
+        unsigned int __usec;
+#else
        __kernel_ulong_t __usec;
+#endif
 #define input_event_sec  __sec
 #define input_event_usec __usec
 #endif
diff --git a/include/uapi/linux/virtio_config.h b/include/uapi/linux/virtio_config.h
index 1196e1c1d4f6..ff8e7dc9d4dd 100644
--- a/include/uapi/linux/virtio_config.h
+++ b/include/uapi/linux/virtio_config.h
@@ -79,6 +79,12 @@
 #define VIRTIO_F_RING_PACKED            34
 /*
+ * This feature indicates that memory accesses by the driver and the
+ * device are ordered in a way described by the platform.
+ */
+#define VIRTIO_F_ORDER_PLATFORM         36
+/*
 * Does the device support Single Root I/O Virtualization?
 */
 #define VIRTIO_F_SR_IOV                 37
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 2414f8af26b3..4c4e24c291a5 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -213,14 +213,4 @@ struct vring_packed_desc {
        __le16 flags;
 };
-struct vring_packed {
-        unsigned int num;
-        struct vring_packed_desc *desc;
-        struct vring_packed_desc_event *driver;
-        struct vring_packed_desc_event *device;
-};
 #endif /* _UAPI_LINUX_VIRTIO_RING_H */
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index ef3c7ec793a7..eb76b38a00d4 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -52,6 +52,11 @@ struct hns_roce_ib_create_srq {
        __aligned_u64 que_addr;
 };
+struct hns_roce_ib_create_srq_resp {
+        __u32   srqn;
+        __u32   reserved;
+};
 struct hns_roce_ib_create_qp {
        __aligned_u64 buf_addr;
        __aligned_u64 db_addr;
diff --git a/include/xen/arm/page-coherent.h b/include/xen/arm/page-coherent.h
index 59a260712a56..2ca9164a79bf 100644
--- a/include/xen/arm/page-coherent.h
+++ b/include/xen/arm/page-coherent.h
@@ -1,17 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
+#ifndef _XEN_ARM_PAGE_COHERENT_H
-#define _ASM_ARM_XEN_PAGE_COHERENT_H
+#define _XEN_ARM_PAGE_COHERENT_H
-#include <asm/page.h>
-#include <asm/dma-mapping.h>
-#include <linux/dma-mapping.h>
-static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
-{
-        if (dev && dev->archdata.dev_dma_ops)
-                return dev->archdata.dev_dma_ops;
-        return get_arch_dma_ops(NULL);
-}
 void __xen_dma_map_page(struct device *hwdev, struct page *page,
             dma_addr_t dev_addr, unsigned long offset, size_t size,
@@ -21,87 +10,7 @@ void __xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                unsigned long attrs);
 void __xen_dma_sync_single_for_cpu(struct device *hwdev,
                dma_addr_t handle, size_t size, enum dma_data_direction dir);
 void __xen_dma_sync_single_for_device(struct device *hwdev,
                dma_addr_t handle, size_t size, enum dma_data_direction dir);
-static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+#endif /* _XEN_ARM_PAGE_COHERENT_H */
-                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
-{
-        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
-}
-static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
-                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
-{
-        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
-}
-static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             dma_addr_t dev_addr, unsigned long offset, size_t size,
-             enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long page_pfn = page_to_xen_pfn(page);
-        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
-        unsigned long compound_pages =
-                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
-        bool local = (page_pfn <= dev_pfn) &&
-                (dev_pfn - page_pfn < compound_pages);
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can span across
-         * multiple Xen pages, it's not possible for it to contain a
-         * mix of local and foreign Xen pages. So if the first xen_pfn
-         * == mfn the page is local otherwise it's a foreign page
-         * grant-mapped in dom0. If the page is local we can safely
-         * call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (local)
-                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
-        else
-                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
-}
-static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
-         * multiple Xen page, it's not possible to have a mix of local and
-         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
-         * foreign mfn will always return false. If the page is local we can
-         * safely call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->unmap_page)
-                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
-        } else
-                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
-}
-static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
-                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
-}
-static inline void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
-                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
-}
-#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/init/Kconfig b/init/Kconfig
index 513fa544a134..c9386a365eea 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -512,6 +512,17 @@ config PSI_DEFAULT_DISABLED
          per default but can be enabled through passing psi=1 on the
          kernel commandline during boot.
+          This feature adds some code to the task wakeup and sleep
+          paths of the scheduler. The overhead is too low to affect
+          common scheduling-intense workloads in practice (such as
+          webservers, memcache), but it does show up in artificial
+          scheduler stress tests, such as hackbench.
+          If you are paranoid and not sure what the kernel will be
+          used for, say Y.
+          Say N if unsure.
 endmenu # "CPU/Task time and stats accounting"
 config CPU_ISOLATION
@@ -825,7 +836,7 @@ config CGROUP_PIDS
          PIDs controller is designed to stop this from happening.
          It should be noted that organisational operations (such as attaching
-          to a cgroup hierarchy will *not* be blocked by the PIDs controller),
+          to a cgroup hierarchy) will *not* be blocked by the PIDs controller,
          since the PIDs limit only affects a process's ability to fork, not to
          attach to a cgroup.
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 91d5c38eb7e5..d1c6d152da89 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -376,9 +376,6 @@ void __weak arch_smt_update(void) { }
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-EXPORT_SYMBOL_GPL(cpu_smt_control);
-static bool cpu_smt_available __read_mostly;
 void __init cpu_smt_disable(bool force)
 {
@@ -397,25 +394,11 @@ void __init cpu_smt_disable(bool force)
 /*
 * The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code before non boot CPUs
+ * CPU identification. Called from architecture code.
- * are brought up.
- */
-void __init cpu_smt_check_topology_early(void)
-{
-        if (!topology_smt_supported())
-                cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-}
-/*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
- * brought online. This ensures the smt/l1tf sysfs entries are consistent
- * with reality. cpu_smt_available is set to true during the bringup of non
- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
- * cpu_smt_control's previous setting.
 */
 void __init cpu_smt_check_topology(void)
 {
-        if (!cpu_smt_available)
+        if (!topology_smt_supported())
                cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
 }
@@ -428,18 +411,10 @@ early_param("nosmt", smt_cmdline_disable);
 static inline bool cpu_smt_allowed(unsigned int cpu)
 {
-        if (topology_is_primary_thread(cpu))
+        if (cpu_smt_control == CPU_SMT_ENABLED)
                return true;
-        /*
+        if (topology_is_primary_thread(cpu))
-         * If the CPU is not a 'primary' thread and the booted_once bit is
-         * set then the processor has SMT support. Store this information
-         * for the late check of SMT support in cpu_smt_check_topology().
-         */
-        if (per_cpu(cpuhp_state, cpu).booted_once)
-                cpu_smt_available = true;
-        if (cpu_smt_control == CPU_SMT_ENABLED)
                return true;
        /*
@@ -2090,10 +2065,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
                 */
                cpuhp_offline_cpu_device(cpu);
        }
-        if (!ret) {
+        if (!ret)
                cpu_smt_control = ctrlval;
-                arch_smt_update();
-        }
        cpu_maps_update_done();
        return ret;
 }
@@ -2104,7 +2077,6 @@ static int cpuhp_smt_enable(void)
        cpu_maps_update_begin();
        cpu_smt_control = CPU_SMT_ENABLED;
-        arch_smt_update();
        for_each_present_cpu(cpu) {
                /* Skip online CPUs and CPUs on offline nodes */
                if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3cd13a30f732..e5ede6918050 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
                void __user *buffer, size_t *lenp,
                loff_t *ppos)
 {
-        int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        int ret;
+        int perf_cpu = sysctl_perf_cpu_time_max_percent;
-        if (ret || !write)
-                return ret;
        /*
         * If throttling is disabled don't allow the write:
         */
-        if (sysctl_perf_cpu_time_max_percent == 100 ||
+        if (write && (perf_cpu == 100 || perf_cpu == 0))
-            sysctl_perf_cpu_time_max_percent == 0)
                return -EINVAL;
+        ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (ret || !write)
+                return ret;
        max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ);
        perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate;
        update_perf_cpu_limits();
diff --git a/kernel/exit.c b/kernel/exit.c
index 284f2fe9a293..2639a30a8aa5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
         *        MB (A)              MB (B)
         *    [L] cond            [L] tsk
         */
-        smp_rmb(); /* (B) */
+        smp_mb(); /* (B) */
        /*
         * Avoid using task_rcu_dereference() magic as long as we are careful,
@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
        return NULL;
 }
-static struct task_struct *find_child_reaper(struct task_struct *father)
+static struct task_struct *find_child_reaper(struct task_struct *father,
+                                                struct list_head *dead)
        __releases(&tasklist_lock)
        __acquires(&tasklist_lock)
 {
        struct pid_namespace *pid_ns = task_active_pid_ns(father);
        struct task_struct *reaper = pid_ns->child_reaper;
+        struct task_struct *p, *n;
        if (likely(reaper != father))
                return reaper;
@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
                panic("Attempted to kill init! exitcode=0x%08x\n",
                        father->signal->group_exit_code ?: father->exit_code);
        }
+        list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+                list_del_init(&p->ptrace_entry);
+                release_task(p);
+        }
        zap_pid_ns_processes(pid_ns);
        write_lock_irq(&tasklist_lock);
@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
                exit_ptrace(father, dead);
        /* Can drop and reacquire tasklist_lock */
-        reaper = find_child_reaper(father);
+        reaper = find_child_reaper(father, dead);
        if (list_empty(&father->children))
                return;
diff --git a/kernel/futex.c b/kernel/futex.c
index be3bff2315ff..fdd312da0992 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1452,11 +1452,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
        if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
                return;
-        /*
+        get_task_struct(p);
-         * Queue the task for later wakeup for after we've released
-         * the hb->lock. wake_q_add() grabs reference to p.
-         */
-        wake_q_add(wake_q, p);
        __unqueue_futex(q);
        /*
         * The waiting task can free the futex_q as soon as q->lock_ptr = NULL
@@ -1466,6 +1462,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
         * plist_del in __unqueue_futex().
         */
        smp_store_release(&q->lock_ptr, NULL);
+        /*
+         * Queue the task for later wakeup for after we've released
+         * the hb->lock. wake_q_add() grabs reference to p.
+         */
+        wake_q_add(wake_q, p);
+        put_task_struct(p);
 }
 /*
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index 45b68b4ea48b..f18cd5aa33e8 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -9,7 +9,7 @@
 #include <linux/cpu.h>
 static void irq_spread_init_one(struct cpumask *irqmsk, struct cpumask *nmsk,
-                                int cpus_per_vec)
+                                unsigned int cpus_per_vec)
 {
        const struct cpumask *siblmsk;
        int cpu, sibl;
@@ -95,15 +95,17 @@ static int get_nodes_in_cpumask(cpumask_var_t *node_to_cpumask,
 }
 static int __irq_build_affinity_masks(const struct irq_affinity *affd,
-                                      int startvec, int numvecs, int firstvec,
+                                      unsigned int startvec,
+                                      unsigned int numvecs,
+                                      unsigned int firstvec,
                                      cpumask_var_t *node_to_cpumask,
                                      const struct cpumask *cpu_mask,
                                      struct cpumask *nmsk,
                                      struct irq_affinity_desc *masks)
 {
-        int n, nodes, cpus_per_vec, extra_vecs, done = 0;
+        unsigned int n, nodes, cpus_per_vec, extra_vecs, done = 0;
-        int last_affv = firstvec + numvecs;
+        unsigned int last_affv = firstvec + numvecs;
-        int curvec = startvec;
+        unsigned int curvec = startvec;
        nodemask_t nodemsk = NODE_MASK_NONE;
        if (!cpumask_weight(cpu_mask))
@@ -117,18 +119,16 @@ static int __irq_build_affinity_masks(const struct irq_affinity *affd,
         */
        if (numvecs <= nodes) {
                for_each_node_mask(n, nodemsk) {
-                        cpumask_or(&masks[curvec].mask,
+                        cpumask_or(&masks[curvec].mask, &masks[curvec].mask,
-                                        &masks[curvec].mask,
+                                   node_to_cpumask[n]);
-                                        node_to_cpumask[n]);
                        if (++curvec == last_affv)
                                curvec = firstvec;
                }
-                done = numvecs;
+                return numvecs;
-                goto out;
        }
        for_each_node_mask(n, nodemsk) {
-                int ncpus, v, vecs_to_assign, vecs_per_node;
+                unsigned int ncpus, v, vecs_to_assign, vecs_per_node;
                /* Spread the vectors per node */
                vecs_per_node = (numvecs - (curvec - firstvec)) / nodes;
@@ -163,8 +163,6 @@ static int __irq_build_affinity_masks(const struct irq_affinity *affd,
                        curvec = firstvec;
                --nodes;
        }
-out:
        return done;
 }
@@ -174,19 +172,24 @@ out:
 *      2) spread other possible CPUs on these vectors
 */
 static int irq_build_affinity_masks(const struct irq_affinity *affd,
-                                    int startvec, int numvecs, int firstvec,
+                                    unsigned int startvec, unsigned int numvecs,
-                                    cpumask_var_t *node_to_cpumask,
+                                    unsigned int firstvec,
                                    struct irq_affinity_desc *masks)
 {
-        int curvec = startvec, nr_present, nr_others;
+        unsigned int curvec = startvec, nr_present, nr_others;
-        int ret = -ENOMEM;
+        cpumask_var_t *node_to_cpumask;
        cpumask_var_t nmsk, npresmsk;
+        int ret = -ENOMEM;
        if (!zalloc_cpumask_var(&nmsk, GFP_KERNEL))
                return ret;
        if (!zalloc_cpumask_var(&npresmsk, GFP_KERNEL))
-                goto fail;
+                goto fail_nmsk;
+        node_to_cpumask = alloc_node_to_cpumask();
+        if (!node_to_cpumask)
+                goto fail_npresmsk;
        ret = 0;
        /* Stabilize the cpumasks */
@@ -217,13 +220,22 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
        if (nr_present < numvecs)
                WARN_ON(nr_present + nr_others < numvecs);
+        free_node_to_cpumask(node_to_cpumask);
+ fail_npresmsk:
        free_cpumask_var(npresmsk);
- fail:
+ fail_nmsk:
        free_cpumask_var(nmsk);
        return ret;
 }
+static void default_calc_sets(struct irq_affinity *affd, unsigned int affvecs)
+{
+        affd->nr_sets = 1;
+        affd->set_size[0] = affvecs;
+}
 /**
 * irq_create_affinity_masks - Create affinity masks for multiqueue spreading
 * @nvecs:      The total number of vectors
@@ -232,50 +244,62 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
 * Returns the irq_affinity_desc pointer or NULL if allocation failed.
 */
 struct irq_affinity_desc *
-irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
+irq_create_affinity_masks(unsigned int nvecs, struct irq_affinity *affd)
 {
-        int affvecs = nvecs - affd->pre_vectors - affd->post_vectors;
+        unsigned int affvecs, curvec, usedvecs, i;
-        int curvec, usedvecs;
-        cpumask_var_t *node_to_cpumask;
        struct irq_affinity_desc *masks = NULL;
-        int i, nr_sets;
        /*
-         * If there aren't any vectors left after applying the pre/post
+         * Determine the number of vectors which need interrupt affinities
-         * vectors don't bother with assigning affinity.
+         * assigned. If the pre/post request exhausts the available vectors
+         * then nothing to do here except for invoking the calc_sets()
+         * callback so the device driver can adjust to the situation. If there
+         * is only a single vector, then managing the queue is pointless as
+         * well.
         */
-        if (nvecs == affd->pre_vectors + affd->post_vectors)
+        if (nvecs > 1 && nvecs > affd->pre_vectors + affd->post_vectors)
+                affvecs = nvecs - affd->pre_vectors - affd->post_vectors;
+        else
+                affvecs = 0;
+        /*
+         * Simple invocations do not provide a calc_sets() callback. Install
+         * the generic one.
+         */
+        if (!affd->calc_sets)
+                affd->calc_sets = default_calc_sets;
+        /* Recalculate the sets */
+        affd->calc_sets(affd, affvecs);
+        if (WARN_ON_ONCE(affd->nr_sets > IRQ_AFFINITY_MAX_SETS))
                return NULL;
-        node_to_cpumask = alloc_node_to_cpumask();
+        /* Nothing to assign? */
-        if (!node_to_cpumask)
+        if (!affvecs)
                return NULL;
        masks = kcalloc(nvecs, sizeof(*masks), GFP_KERNEL);
        if (!masks)
-                goto outnodemsk;
+                return NULL;
        /* Fill out vectors at the beginning that don't need affinity */
        for (curvec = 0; curvec < affd->pre_vectors; curvec++)
                cpumask_copy(&masks[curvec].mask, irq_default_affinity);
        /*
         * Spread on present CPUs starting from affd->pre_vectors. If we
         * have multiple sets, build each sets affinity mask separately.
         */
-        nr_sets = affd->nr_sets;
+        for (i = 0, usedvecs = 0; i < affd->nr_sets; i++) {
-        if (!nr_sets)
+                unsigned int this_vecs = affd->set_size[i];
-                nr_sets = 1;
-        for (i = 0, usedvecs = 0; i < nr_sets; i++) {
-                int this_vecs = affd->sets ? affd->sets[i] : affvecs;
                int ret;
                ret = irq_build_affinity_masks(affd, curvec, this_vecs,
-                                                curvec, node_to_cpumask, masks);
+                                               curvec, masks);
                if (ret) {
                        kfree(masks);
-                        masks = NULL;
+                        return NULL;
-                        goto outnodemsk;
                }
                curvec += this_vecs;
                usedvecs += this_vecs;
@@ -293,8 +317,6 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
        for (i = affd->pre_vectors; i < nvecs - affd->post_vectors; i++)
                masks[i].is_managed = 1;
-outnodemsk:
-        free_node_to_cpumask(node_to_cpumask);
        return masks;
 }
@@ -304,25 +326,22 @@ outnodemsk:
 * @maxvec:     The maximum number of vectors available
 * @affd:       Description of the affinity requirements
 */
-int irq_calc_affinity_vectors(int minvec, int maxvec, const struct irq_affinity *affd)
+unsigned int irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,
+                                       const struct irq_affinity *affd)
 {
-        int resv = affd->pre_vectors + affd->post_vectors;
+        unsigned int resv = affd->pre_vectors + affd->post_vectors;
-        int vecs = maxvec - resv;
+        unsigned int set_vecs;
-        int set_vecs;
        if (resv > minvec)
                return 0;
-        if (affd->nr_sets) {
+        if (affd->calc_sets) {
-                int i;
+                set_vecs = maxvec - resv;
-                for (i = 0, set_vecs = 0;  i < affd->nr_sets; i++)
-                        set_vecs += affd->sets[i];
        } else {
                get_online_cpus();
                set_vecs = cpumask_weight(cpu_possible_mask);
                put_online_cpus();
        }
-        return resv + min(set_vecs, vecs);
+        return resv + min(set_vecs, maxvec - resv);
 }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index c32d5f386f68..99b7dd6982a4 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -886,7 +886,11 @@ void handle_percpu_irq(struct irq_desc *desc)
 {
        struct irq_chip *chip = irq_desc_get_chip(desc);
-        kstat_incr_irqs_this_cpu(desc);
+        /*
+         * PER CPU interrupts are not serialized. Do not touch
+         * desc->tot_count.
+         */
+        __kstat_incr_irqs_this_cpu(desc);
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
@@ -915,7 +919,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc)
        unsigned int irq = irq_desc_get_irq(desc);
        irqreturn_t res;
-        kstat_incr_irqs_this_cpu(desc);
+        /*
+         * PER CPU interrupts are not serialized. Do not touch
+         * desc->tot_count.
+         */
+        __kstat_incr_irqs_this_cpu(desc);
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c
index 59a04d2a66df..516c00a5e867 100644
--- a/kernel/irq/debugfs.c
+++ b/kernel/irq/debugfs.c
@@ -258,8 +258,6 @@ static int __init irq_debugfs_init(void)
        int irq;
        root_dir = debugfs_create_dir("irq", NULL);
-        if (!root_dir)
-                return -ENOMEM;
        irq_domain_debugfs_init(root_dir);
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 38554bc35375..6df5ddfdb0f8 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -166,7 +166,7 @@ irqreturn_t __handle_irq_event_percpu(struct irq_desc *desc, unsigned int *flags
                        __irq_wake_thread(desc, action);
-                        /* Fall through to add to randomness */
+                        /* Fall through - to add to randomness */
                case IRQ_HANDLED:
                        *flags |= action->flags;
                        break;
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 2a77cdd27ca9..70c3053bc1f6 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -244,12 +244,18 @@ static inline void irq_state_set_masked(struct irq_desc *desc)
 #undef __irqd_to_state
-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc)
 {
        __this_cpu_inc(*desc->kstat_irqs);
        __this_cpu_inc(kstat.irqs_sum);
 }
+static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+{
+        __kstat_incr_irqs_this_cpu(desc);
+        desc->tot_count++;
+}
 static inline int irq_desc_get_node(struct irq_desc *desc)
 {
        return irq_common_data_get_node(&desc->irq_common_data);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index a1d7a7d484e0..13539e12cd80 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
        desc->depth = 1;
        desc->irq_count = 0;
        desc->irqs_unhandled = 0;
+        desc->tot_count = 0;
        desc->name = NULL;
        desc->owner = owner;
        for_each_possible_cpu(cpu)
@@ -457,7 +458,7 @@ static int alloc_descs(unsigned int start, unsigned int cnt, int node,
        /* Validate affinity mask(s) */
        if (affinity) {
-                for (i = 0; i < cnt; i++, i++) {
+                for (i = 0; i < cnt; i++) {
                        if (cpumask_empty(&affinity[i].mask))
                                return -EINVAL;
                }
@@ -954,11 +955,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 unsigned int kstat_irqs(unsigned int irq)
 {
        struct irq_desc *desc = irq_to_desc(irq);
-        int cpu;
        unsigned int sum = 0;
+        int cpu;
        if (!desc || !desc->kstat_irqs)
                return 0;
+        if (!irq_settings_is_per_cpu_devid(desc) &&
+            !irq_settings_is_per_cpu(desc))
+            return desc->tot_count;
        for_each_possible_cpu(cpu)
                sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
        return sum;
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 80818764643d..3bf9793d8825 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1763,8 +1763,6 @@ void __init irq_domain_debugfs_init(struct dentry *root)
        struct irq_domain *d;
        domain_dir = debugfs_create_dir("domains", root);
-        if (!domain_dir)
-                return;
        debugfs_create_file("default", 0444, domain_dir, NULL,
                            &irq_domain_debug_fops);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 5b570050b9b6..9ec34a2a6638 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc)
        }
        cpumask_and(&mask, cpu_online_mask, set);
+        if (cpumask_empty(&mask))
+                cpumask_copy(&mask, cpu_online_mask);
        if (node != NUMA_NO_NODE) {
                const struct cpumask *nodemask = cpumask_of_node(node);
@@ -760,6 +763,7 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned long flags)
        case IRQ_SET_MASK_OK_DONE:
                irqd_clear(&desc->irq_data, IRQD_TRIGGER_MASK);
                irqd_set(&desc->irq_data, flags);
+                /* fall through */
        case IRQ_SET_MASK_OK_NOCOPY:
                flags = irqd_get_trigger_type(&desc->irq_data);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 087d18d771b5..65234c89d85b 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -101,6 +101,12 @@ bool kthread_should_stop(void)
 }
 EXPORT_SYMBOL(kthread_should_stop);
+bool __kthread_should_park(struct task_struct *k)
+{
+        return test_bit(KTHREAD_SHOULD_PARK, &to_kthread(k)->flags);
+}
+EXPORT_SYMBOL_GPL(__kthread_should_park);
 /**
 * kthread_should_park - should this kthread park now?
 *
@@ -114,7 +120,7 @@ EXPORT_SYMBOL(kthread_should_stop);
 */
 bool kthread_should_park(void)
 {
-        return test_bit(KTHREAD_SHOULD_PARK, &to_kthread(current)->flags);
+        return __kthread_should_park(current);
 }
 EXPORT_SYMBOL_GPL(kthread_should_park);
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 09b180063ee1..50d9af615dc4 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
                woken++;
                tsk = waiter->task;
-                wake_q_add(wake_q, tsk);
+                get_task_struct(tsk);
                list_del(&waiter->list);
                /*
-                 * Ensure that the last operation is setting the reader
+                 * Ensure calling get_task_struct() before setting the reader
                 * waiter to nil such that rwsem_down_read_failed() cannot
                 * race with do_exit() by always holding a reference count
                 * to the task to wakeup.
                 */
                smp_store_release(&waiter->task, NULL);
+                /*
+                 * Ensure issuing the wakeup (either by us or someone else)
+                 * after setting the reader waiter to nil.
+                 */
+                wake_q_add(wake_q, tsk);
+                /* wake_q_add() already take the task ref */
+                put_task_struct(tsk);
        }
        adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index a674c7db2f29..d8d76a65cfdd 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -396,6 +396,18 @@ static bool set_nr_if_polling(struct task_struct *p)
 #endif
 #endif
+/**
+ * wake_q_add() - queue a wakeup for 'later' waking.
+ * @head: the wake_q_head to add @task to
+ * @task: the task to queue for 'later' wakeup
+ *
+ * Queue a task for later wakeup, most likely by the wake_up_q() call in the
+ * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
+ * instantly.
+ *
+ * This function must be used as-if it were wake_up_process(); IOW the task
+ * must be ready to be woken at this location.
+ */
 void wake_q_add(struct wake_q_head *head, struct task_struct *task)
 {
        struct wake_q_node *node = &task->wake_q;
@@ -405,10 +417,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
         * its already queued (either by us or someone else) and will get the
         * wakeup due to that.
         *
-         * This cmpxchg() executes a full barrier, which pairs with the full
+         * In order to ensure that a pending wakeup will observe our pending
-         * barrier executed by the wakeup in wake_up_q().
+         * state, even in the failed case, an explicit smp_mb() must be used.
         */
-        if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
+        smp_mb__before_atomic();
+        if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
                return;
        get_task_struct(task);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 50aa2aba69bd..310d0637fe4b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5980,6 +5980,7 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
 #ifdef CONFIG_SCHED_SMT
 DEFINE_STATIC_KEY_FALSE(sched_smt_present);
+EXPORT_SYMBOL_GPL(sched_smt_present);
 static inline void set_idle_cores(int cpu, int val)
 {
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index fe24de3fbc93..c3484785b179 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -124,6 +124,7 @@
 * sampling of the aggregate task states would be.
 */
+#include "../workqueue_internal.h"
 #include <linux/sched/loadavg.h>
 #include <linux/seq_file.h>
 #include <linux/proc_fs.h>
@@ -480,9 +481,6 @@ static void psi_group_change(struct psi_group *group, int cpu,
                        groupc->tasks[t]++;
        write_seqcount_end(&groupc->seq);
-        if (!delayed_work_pending(&group->clock_work))
-                schedule_delayed_work(&group->clock_work, PSI_FREQ);
 }
 static struct psi_group *iterate_groups(struct task_struct *task, void **iter)
@@ -513,6 +511,7 @@ void psi_task_change(struct task_struct *task, int clear, int set)
 {
        int cpu = task_cpu(task);
        struct psi_group *group;
+        bool wake_clock = true;
        void *iter = NULL;
        if (!task->pid)
@@ -530,8 +529,22 @@ void psi_task_change(struct task_struct *task, int clear, int set)
        task->psi_flags &= ~clear;
        task->psi_flags |= set;
-        while ((group = iterate_groups(task, &iter)))
+        /*
+         * Periodic aggregation shuts off if there is a period of no
+         * task changes, so we wake it back up if necessary. However,
+         * don't do this if the task change is the aggregation worker
+         * itself going to sleep, or we'll ping-pong forever.
+         */
+        if (unlikely((clear & TSK_RUNNING) &&
+                     (task->flags & PF_WQ_WORKER) &&
+                     wq_worker_last_func(task) == psi_update_work))
+                wake_clock = false;
+        while ((group = iterate_groups(task, &iter))) {
                psi_group_change(group, cpu, clear, set);
+                if (wake_clock && !delayed_work_pending(&group->clock_work))
+                        schedule_delayed_work(&group->clock_work, PSI_FREQ);
+        }
 }
 void psi_memstall_tick(struct task_struct *task, int cpu)
diff --git a/kernel/smp.c b/kernel/smp.c
index 163c451af42e..f4cf1b0bb3b8 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -584,8 +584,6 @@ void __init smp_init(void)
                num_nodes, (num_nodes > 1 ? "s" : ""),
                num_cpus,  (num_cpus  > 1 ? "s" : ""));
-        /* Final decision about SMT support */
-        cpu_smt_check_topology();
        /* Any cleanup work */
        smp_cpus_done(setup_max_cpus);
 }
diff --git a/kernel/softirq.c b/kernel/softirq.c
index d28813306b2c..10277429ed84 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -89,7 +89,8 @@ static bool ksoftirqd_running(unsigned long pending)
        if (pending & SOFTIRQ_NOW_MASK)
                return false;
-        return tsk && (tsk->state == TASK_RUNNING);
+        return tsk && (tsk->state == TASK_RUNNING) &&
+                !__kthread_should_park(tsk);
 }
 /*
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 8f0644af40be..80f955210861 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -685,6 +685,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
         * set up the signal and overrun bookkeeping.
         */
        timer->it.cpu.incr = timespec64_to_ns(&new->it_interval);
+        timer->it_interval = ns_to_ktime(timer->it.cpu.incr);
        /*
         * This acts as a modification timestamp for the timer,
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index e335576b9411..9bde07c06362 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -5,7 +5,7 @@
 * Copyright (C) IBM Corporation, 2010-2012
 * Author:      Srikar Dronamraju <srikar@linux.vnet.ibm.com>
 */
-#define pr_fmt(fmt)     "trace_kprobe: " fmt
+#define pr_fmt(fmt)     "trace_uprobe: " fmt
 #include <linux/ctype.h>
 #include <linux/module.h>
@@ -160,6 +160,13 @@ fetch_store_string(unsigned long addr, void *dest, void *base)
        if (ret >= 0) {
                if (ret == maxlen)
                        dst[ret - 1] = '\0';
+                else
+                        /*
+                         * Include the terminating null byte. In this case it
+                         * was copied by strncpy_from_user but not accounted
+                         * for in ret.
+                         */
+                        ret++;
                *(u32 *)dest = make_data_loc(ret, (void *)dst - base);
        }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 392be4b252f6..fc5d23d752a5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -910,6 +910,26 @@ struct task_struct *wq_worker_sleeping(struct task_struct *task)
 }
 /**
+ * wq_worker_last_func - retrieve worker's last work function
+ *
+ * Determine the last function a worker executed. This is called from
+ * the scheduler to get a worker's last known identity.
+ *
+ * CONTEXT:
+ * spin_lock_irq(rq->lock)
+ *
+ * Return:
+ * The last work function %current executed as a worker, NULL if it
+ * hasn't executed any work yet.
+ */
+work_func_t wq_worker_last_func(struct task_struct *task)
+{
+        struct worker *worker = kthread_data(task);
+        return worker->last_func;
+}
+/**
 * worker_set_flags - set worker flags and adjust nr_running accordingly
 * @worker: self
 * @flags: flags to set
@@ -2184,6 +2204,9 @@ __acquires(&pool->lock)
        if (unlikely(cpu_intensive))
                worker_clr_flags(worker, WORKER_CPU_INTENSIVE);
+        /* tag the worker for identification in schedule() */
+        worker->last_func = worker->current_func;
        /* we're done with it, release */
        hash_del(&worker->hentry);
        worker->current_work = NULL;
diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h
index 66fbb5a9e633..cb68b03ca89a 100644
--- a/kernel/workqueue_internal.h
+++ b/kernel/workqueue_internal.h
@@ -53,6 +53,9 @@ struct worker {
        /* used only by rescuers to point to the target workqueue */
        struct workqueue_struct *rescue_wq;     /* I: the workqueue to rescue */
+        /* used by the scheduler to determine a worker's last known identity */
+        work_func_t             last_func;
 };
 /**
@@ -67,9 +70,10 @@ static inline struct worker *current_wq_worker(void)
 /*
 * Scheduler hooks for concurrency managed workqueue.  Only to be used from
- * sched/core.c and workqueue.c.
+ * sched/ and workqueue.c.
 */
 void wq_worker_waking_up(struct task_struct *task, int cpu);
 struct task_struct *wq_worker_sleeping(struct task_struct *task);
+work_func_t wq_worker_last_func(struct task_struct *task);
 #endif /* _KERNEL_WORKQUEUE_INTERNAL_H */
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index d82d022111e0..9cf77628fc91 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)
        config->test_driver = NULL;
        kfree_const(config->test_fs);
-        config->test_driver = NULL;
+        config->test_fs = NULL;
 }
 static void kmod_config_free(struct kmod_test_device *test_dev)
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 4676c0a1eeca..c596a957f764 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -199,7 +199,7 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                XA_BUG_ON(xa, xa_store_index(xa, index + 1, GFP_KERNEL));
                xa_set_mark(xa, index + 1, XA_MARK_0);
                XA_BUG_ON(xa, xa_store_index(xa, index + 2, GFP_KERNEL));
-                xa_set_mark(xa, index + 2, XA_MARK_1);
+                xa_set_mark(xa, index + 2, XA_MARK_2);
                XA_BUG_ON(xa, xa_store_index(xa, next, GFP_KERNEL));
                xa_store_order(xa, index, order, xa_mk_index(index),
                                GFP_KERNEL);
@@ -209,8 +209,8 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                        void *entry;
                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_0));
-                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_1));
+                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_1));
-                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
+                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_2));
                        /* We should see two elements in the array */
                        rcu_read_lock();
@@ -357,7 +357,7 @@ static noinline void check_cmpxchg(struct xarray *xa)
 static noinline void check_reserve(struct xarray *xa)
 {
        void *entry;
-        unsigned long index = 0;
+        unsigned long index;
        /* An array with a reserved entry is not empty */
        XA_BUG_ON(xa, !xa_empty(xa));
@@ -382,10 +382,12 @@ static noinline void check_reserve(struct xarray *xa)
        xa_erase_index(xa, 12345678);
        XA_BUG_ON(xa, !xa_empty(xa));
-        /* And so does xa_insert */
+        /* But xa_insert does not */
        xa_reserve(xa, 12345678, GFP_KERNEL);
-        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) !=
-        xa_erase_index(xa, 12345678);
+                        -EEXIST);
+        XA_BUG_ON(xa, xa_empty(xa));
+        XA_BUG_ON(xa, xa_erase(xa, 12345678) != NULL);
        XA_BUG_ON(xa, !xa_empty(xa));
        /* Can iterate through a reserved entry */
@@ -393,7 +395,7 @@ static noinline void check_reserve(struct xarray *xa)
        xa_reserve(xa, 6, GFP_KERNEL);
        xa_store_index(xa, 7, GFP_KERNEL);
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                XA_BUG_ON(xa, index != 5 && index != 7);
        }
        xa_destroy(xa);
@@ -812,17 +814,16 @@ static noinline void check_find_1(struct xarray *xa)
 static noinline void check_find_2(struct xarray *xa)
 {
        void *entry;
-        unsigned long i, j, index = 0;
+        unsigned long i, j, index;
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                XA_BUG_ON(xa, true);
        }
        for (i = 0; i < 1024; i++) {
                xa_store_index(xa, index, GFP_KERNEL);
                j = 0;
-                index = 0;
+                xa_for_each(xa, index, entry) {
-                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
                        XA_BUG_ON(xa, xa_mk_index(index) != entry);
                        XA_BUG_ON(xa, index != j++);
                }
@@ -839,6 +840,7 @@ static noinline void check_find_3(struct xarray *xa)
        for (i = 0; i < 100; i++) {
                for (j = 0; j < 100; j++) {
+                        rcu_read_lock();
                        for (k = 0; k < 100; k++) {
                                xas_set(&xas, j);
                                xas_for_each_marked(&xas, entry, k, XA_MARK_0)
@@ -847,6 +849,7 @@ static noinline void check_find_3(struct xarray *xa)
                                        XA_BUG_ON(xa,
                                                xas.xa_node != XAS_RESTART);
                        }
+                        rcu_read_unlock();
                }
                xa_store_index(xa, i, GFP_KERNEL);
                xa_set_mark(xa, i, XA_MARK_0);
@@ -1183,6 +1186,35 @@ static noinline void check_store_range(struct xarray *xa)
        }
 }
+static void check_align_1(struct xarray *xa, char *name)
+{
+        int i;
+        unsigned int id;
+        unsigned long index;
+        void *entry;
+        for (i = 0; i < 8; i++) {
+                id = 0;
+                XA_BUG_ON(xa, xa_alloc(xa, &id, UINT_MAX, name + i, GFP_KERNEL)
+                                != 0);
+                XA_BUG_ON(xa, id != i);
+        }
+        xa_for_each(xa, index, entry)
+                XA_BUG_ON(xa, xa_is_err(entry));
+        xa_destroy(xa);
+}
+static noinline void check_align(struct xarray *xa)
+{
+        char name[] = "Motorola 68000";
+        check_align_1(xa, name);
+        check_align_1(xa, name + 1);
+        check_align_1(xa, name + 2);
+        check_align_1(xa, name + 3);
+//      check_align_2(xa, name);
+}
 static LIST_HEAD(shadow_nodes);
 static void test_update_node(struct xa_node *node)
@@ -1332,6 +1364,7 @@ static int xarray_checks(void)
        check_create_range(&array);
        check_store_range(&array);
        check_store_iter(&array);
+        check_align(&xa0);
        check_workingset(&array, 0);
        check_workingset(&array, 64);
diff --git a/lib/xarray.c b/lib/xarray.c
index 5f3f9311de89..81c3171ddde9 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -232,6 +232,8 @@ void *xas_load(struct xa_state *xas)
                if (xas->xa_shift > node->shift)
                        break;
                entry = xas_descend(xas, node);
+                if (node->shift == 0)
+                        break;
        }
        return entry;
 }
@@ -506,7 +508,7 @@ static void xas_free_nodes(struct xa_state *xas, struct xa_node *top)
        for (;;) {
                void *entry = xa_entry_locked(xas->xa, node, offset);
-                if (xa_is_node(entry)) {
+                if (node->shift && xa_is_node(entry)) {
                        node = xa_to_node(entry);
                        offset = 0;
                        continue;
@@ -604,6 +606,7 @@ static int xas_expand(struct xa_state *xas, void *head)
 /*
 * xas_create() - Create a slot to store an entry in.
 * @xas: XArray operation state.
+ * @allow_root: %true if we can store the entry in the root directly
 *
 * Most users will not need to call this function directly, as it is called
 * by xas_store().  It is useful for doing conditional store operations
@@ -613,7 +616,7 @@ static int xas_expand(struct xa_state *xas, void *head)
 * If the slot was newly created, returns %NULL.  If it failed to create the
 * slot, returns %NULL and indicates the error in @xas.
 */
-static void *xas_create(struct xa_state *xas)
+static void *xas_create(struct xa_state *xas, bool allow_root)
 {
        struct xarray *xa = xas->xa;
        void *entry;
@@ -628,6 +631,8 @@ static void *xas_create(struct xa_state *xas)
                shift = xas_expand(xas, entry);
                if (shift < 0)
                        return NULL;
+                if (!shift && !allow_root)
+                        shift = XA_CHUNK_SHIFT;
                entry = xa_head_locked(xa);
                slot = &xa->xa_head;
        } else if (xas_error(xas)) {
@@ -687,7 +692,7 @@ void xas_create_range(struct xa_state *xas)
        xas->xa_sibs = 0;
        for (;;) {
-                xas_create(xas);
+                xas_create(xas, true);
                if (xas_error(xas))
                        goto restore;
                if (xas->xa_index <= (index | XA_CHUNK_MASK))
@@ -754,7 +759,7 @@ void *xas_store(struct xa_state *xas, void *entry)
        bool value = xa_is_value(entry);
        if (entry)
-                first = xas_create(xas);
+                first = xas_create(xas, !xa_is_node(entry));
        else
                first = xas_load(xas);
@@ -1251,35 +1256,6 @@ void *xas_find_conflict(struct xa_state *xas)
 EXPORT_SYMBOL_GPL(xas_find_conflict);
 /**
- * xa_init_flags() - Initialise an empty XArray with flags.
- * @xa: XArray.
- * @flags: XA_FLAG values.
- *
- * If you need to initialise an XArray with special flags (eg you need
- * to take the lock from interrupt context), use this function instead
- * of xa_init().
- *
- * Context: Any context.
- */
-void xa_init_flags(struct xarray *xa, gfp_t flags)
-{
-        unsigned int lock_type;
-        static struct lock_class_key xa_lock_irq;
-        static struct lock_class_key xa_lock_bh;
-        spin_lock_init(&xa->xa_lock);
-        xa->xa_flags = flags;
-        xa->xa_head = NULL;
-        lock_type = xa_lock_type(xa);
-        if (lock_type == XA_LOCK_IRQ)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_irq);
-        else if (lock_type == XA_LOCK_BH)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_bh);
-}
-EXPORT_SYMBOL(xa_init_flags);
-/**
 * xa_load() - Load an entry from an XArray.
 * @xa: XArray.
 * @index: index into array.
@@ -1308,7 +1284,6 @@ static void *xas_result(struct xa_state *xas, void *curr)
 {
        if (xa_is_zero(curr))
                return NULL;
-        XA_NODE_BUG_ON(xas->xa_node, xa_is_internal(curr));
        if (xas_error(xas))
                curr = xas->xa_node;
        return curr;
@@ -1378,7 +1353,7 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
        XA_STATE(xas, xa, index);
        void *curr;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return XA_ERROR(-EINVAL);
        if (xa_track_free(xa) && !entry)
                entry = XA_ZERO_ENTRY;
@@ -1444,7 +1419,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
        XA_STATE(xas, xa, index);
        void *curr;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return XA_ERROR(-EINVAL);
        if (xa_track_free(xa) && !entry)
                entry = XA_ZERO_ENTRY;
@@ -1465,6 +1440,47 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 /**
+ * __xa_insert() - Store this entry in the XArray if no entry is present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Expects xa_lock to be held on entry.  May
+ * release and reacquire xa_lock if @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+int __xa_insert(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+{
+        XA_STATE(xas, xa, index);
+        void *curr;
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
+                return -EINVAL;
+        if (!entry)
+                entry = XA_ZERO_ENTRY;
+        do {
+                curr = xas_load(&xas);
+                if (!curr) {
+                        xas_store(&xas, entry);
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                } else {
+                        xas_set_err(&xas, -EEXIST);
+                }
+        } while (__xas_nomem(&xas, gfp));
+        return xas_error(&xas);
+}
+EXPORT_SYMBOL(__xa_insert);
+/**
 * __xa_reserve() - Reserve this index in the XArray.
 * @xa: XArray.
 * @index: Index into array.
@@ -1567,7 +1583,7 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
                        if (last + 1)
                                order = __ffs(last + 1);
                        xas_set_order(&xas, last, order);
-                        xas_create(&xas);
+                        xas_create(&xas, true);
                        if (xas_error(&xas))
                                goto unlock;
                }
@@ -1609,7 +1625,7 @@ int __xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry, gfp_t gfp)
        XA_STATE(xas, xa, 0);
        int err;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return -EINVAL;
        if (WARN_ON_ONCE(!xa_track_free(xa)))
                return -EINVAL;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 8a8bb8796c6c..72e6d0c55cfa 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
        INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
        bdi->cgwb_congested_tree = RB_ROOT;
        mutex_init(&bdi->cgwb_release_mutex);
+        init_rwsem(&bdi->wb_switch_rwsem);
        ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
        if (!ret) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index df2e7dd5ff17..afef61656c1e 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4268,7 +4268,8 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                break;
                        }
                        if (ret & VM_FAULT_RETRY) {
-                                if (nonblocking)
+                                if (nonblocking &&
+                                    !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
                                        *nonblocking = 0;
                                *nr_pages = 0;
                                /*
diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
index 0a14fcff70ed..e2bb06c1b45e 100644
--- a/mm/kasan/Makefile
+++ b/mm/kasan/Makefile
@@ -5,6 +5,7 @@ UBSAN_SANITIZE_generic.o := n
 UBSAN_SANITIZE_tags.o := n
 KCOV_INSTRUMENT := n
+CFLAGS_REMOVE_common.o = -pg
 CFLAGS_REMOVE_generic.o = -pg
 # Function splitter causes unnecessary splits in __asan_load1/__asan_store1
 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 7c72f2a95785..831be5ff5f4d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -372,7 +372,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
                        if (fail || tk->addr_valid == 0) {
                                pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
                                       pfn, tk->tsk->comm, tk->tsk->pid);
-                                force_sig(SIGKILL, tk->tsk);
+                                do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
+                                                 tk->tsk, PIDTYPE_PID);
                        }
                        /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b9a667d36c55..124e794867c5 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1233,7 +1233,8 @@ static bool is_pageblock_removable_nolock(struct page *page)
 bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 {
        struct page *page = pfn_to_page(start_pfn);
-        struct page *end_page = page + nr_pages;
+        unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page)));
+        struct page *end_page = pfn_to_page(end_pfn);
        /* Check the starting page of each pageblock within the range */
        for (; page < end_page; page = next_active_pageblock(page)) {
@@ -1273,6 +1274,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
                                i++;
                        if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)
                                continue;
+                        /* Check if we got outside of the zone */
+                        if (zone && !zone_spans_pfn(zone, pfn + i))
+                                return 0;
                        page = pfn_to_page(pfn + i);
                        if (zone && page_zone(page) != zone)
                                return 0;
@@ -1301,23 +1305,27 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
 static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
 {
        unsigned long pfn;
-        struct page *page;
        for (pfn = start; pfn < end; pfn++) {
-                if (pfn_valid(pfn)) {
+                struct page *page, *head;
-                        page = pfn_to_page(pfn);
+                unsigned long skip;
-                        if (PageLRU(page))
-                                return pfn;
+                if (!pfn_valid(pfn))
-                        if (__PageMovable(page))
+                        continue;
-                                return pfn;
+                page = pfn_to_page(pfn);
-                        if (PageHuge(page)) {
+                if (PageLRU(page))
-                                if (hugepage_migration_supported(page_hstate(page)) &&
+                        return pfn;
-                                    page_huge_active(page))
+                if (__PageMovable(page))
-                                        return pfn;
+                        return pfn;
-                                else
-                                        pfn = round_up(pfn + 1,
+                if (!PageHuge(page))
-                                                1 << compound_order(page)) - 1;
+                        continue;
-                        }
+                head = compound_head(page);
-                }
+                if (hugepage_migration_supported(page_hstate(head)) &&
+                    page_huge_active(head))
+                        return pfn;
+                skip = (1 << compound_order(head)) - (page - head);
+                pfn += skip - 1;
        }
        return 0;
 }
@@ -1344,7 +1352,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 {
        unsigned long pfn;
        struct page *page;
-        int not_managed = 0;
        int ret = 0;
        LIST_HEAD(source);
@@ -1392,7 +1399,6 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                else
                        ret = isolate_movable_page(page, ISOLATE_UNEVICTABLE);
                if (!ret) { /* Success */
-                        put_page(page);
                        list_add_tail(&page->lru, &source);
                        if (!__PageMovable(page))
                                inc_node_page_state(page, NR_ISOLATED_ANON +
@@ -1401,22 +1407,10 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                } else {
                        pr_warn("failed to isolate pfn %lx\n", pfn);
                        dump_page(page, "isolation failed");
-                        put_page(page);
-                        /* Because we don't have big zone->lock. we should
-                           check this again here. */
-                        if (page_count(page)) {
-                                not_managed++;
-                                ret = -EBUSY;
-                                break;
-                        }
                }
+                put_page(page);
        }
        if (!list_empty(&source)) {
-                if (not_managed) {
-                        putback_movable_pages(&source);
-                        goto out;
-                }
                /* Allocate a new page from the nearest neighbor node */
                ret = migrate_pages(&source, new_node_page, NULL, 0,
                                        MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
@@ -1429,7 +1423,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
                        putback_movable_pages(&source);
                }
        }
-out:
        return ret;
 }
@@ -1576,7 +1570,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
           we assume this for now. .*/
        if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start,
                                  &valid_end)) {
-                mem_hotplug_done();
                ret = -EINVAL;
                reason = "multizone range";
                goto failed_removal;
@@ -1591,7 +1584,6 @@ static int __ref __offline_pages(unsigned long start_pfn,
                                       MIGRATE_MOVABLE,
                                       SKIP_HWPOISON | REPORT_FAILURE);
        if (ret) {
-                mem_hotplug_done();
                reason = "failure to isolate range";
                goto failed_removal;
        }
diff --git a/mm/migrate.c b/mm/migrate.c
index a16b15090df3..d4fd680be3b0 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -709,7 +709,6 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
        /* Simple case, sync compaction */
        if (mode != MIGRATE_ASYNC) {
                do {
-                        get_bh(bh);
                        lock_buffer(bh);
                        bh = bh->b_this_page;
@@ -720,18 +719,15 @@ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
        /* async case, we cannot block on lock_buffer so use trylock_buffer */
        do {
-                get_bh(bh);
                if (!trylock_buffer(bh)) {
                        /*
                         * We failed to lock the buffer and cannot stall in
                         * async migration. Release the taken locks
                         */
                        struct buffer_head *failed_bh = bh;
-                        put_bh(failed_bh);
                        bh = head;
                        while (bh != failed_bh) {
                                unlock_buffer(bh);
-                                put_bh(bh);
                                bh = bh->b_this_page;
                        }
                        return false;
@@ -818,7 +814,6 @@ unlock_buffers:
        bh = head;
        do {
                unlock_buffer(bh);
-                put_bh(bh);
                bh = bh->b_this_page;
        } while (bh != head);
@@ -1135,10 +1130,13 @@ out:
         * If migration is successful, decrease refcount of the newpage
         * which will not free the page because new page owner increased
         * refcounter. As well, if it is LRU page, add the page to LRU
-         * list in here.
+         * list in here. Use the old state of the isolated source page to
+         * determine if we migrated a LRU page. newpage was already unlocked
+         * and possibly modified by its owner - don't rely on the page
+         * state.
         */
        if (rc == MIGRATEPAGE_SUCCESS) {
-                if (unlikely(__PageMovable(newpage)))
+                if (unlikely(!is_lru))
                        put_page(newpage);
                else
                        putback_lru_page(newpage);
diff --git a/mm/mincore.c b/mm/mincore.c
index f0f91461a9f4..218099b5ed31 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -42,14 +42,72 @@ static int mincore_hugetlb(pte_t *pte, unsigned long hmask, unsigned long addr,
        return 0;
 }
-static int mincore_unmapped_range(unsigned long addr, unsigned long end,
+/*
-                                   struct mm_walk *walk)
+ * Later we can get more picky about what "in core" means precisely.
+ * For now, simply check to see if the page is in the page cache,
+ * and is up to date; i.e. that no page-in operation would be required
+ * at this time if an application were to map and access this page.
+ */
+static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
+{
+        unsigned char present = 0;
+        struct page *page;
+        /*
+         * When tmpfs swaps out a page from a file, any process mapping that
+         * file will not get a swp_entry_t in its pte, but rather it is like
+         * any other file mapping (ie. marked !present and faulted in with
+         * tmpfs's .fault). So swapped out tmpfs mappings are tested here.
+         */
+#ifdef CONFIG_SWAP
+        if (shmem_mapping(mapping)) {
+                page = find_get_entry(mapping, pgoff);
+                /*
+                 * shmem/tmpfs may return swap: account for swapcache
+                 * page too.
+                 */
+                if (xa_is_value(page)) {
+                        swp_entry_t swp = radix_to_swp_entry(page);
+                        page = find_get_page(swap_address_space(swp),
+                                             swp_offset(swp));
+                }
+        } else
+                page = find_get_page(mapping, pgoff);
+#else
+        page = find_get_page(mapping, pgoff);
+#endif
+        if (page) {
+                present = PageUptodate(page);
+                put_page(page);
+        }
+        return present;
+}
+static int __mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                struct vm_area_struct *vma, unsigned char *vec)
 {
-        unsigned char *vec = walk->private;
        unsigned long nr = (end - addr) >> PAGE_SHIFT;
+        int i;
-        memset(vec, 0, nr);
+        if (vma->vm_file) {
-        walk->private += nr;
+                pgoff_t pgoff;
+                pgoff = linear_page_index(vma, addr);
+                for (i = 0; i < nr; i++, pgoff++)
+                        vec[i] = mincore_page(vma->vm_file->f_mapping, pgoff);
+        } else {
+                for (i = 0; i < nr; i++)
+                        vec[i] = 0;
+        }
+        return nr;
+}
+static int mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                   struct mm_walk *walk)
+{
+        walk->private += __mincore_unmapped_range(addr, end,
+                                                  walk->vma, walk->private);
        return 0;
 }
@@ -69,9 +127,8 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                goto out;
        }
-        /* We'll consider a THP page under construction to be there */
        if (pmd_trans_unstable(pmd)) {
-                memset(vec, 1, nr);
+                __mincore_unmapped_range(addr, end, vma, vec);
                goto out;
        }
@@ -80,17 +137,28 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                pte_t pte = *ptep;
                if (pte_none(pte))
-                        *vec = 0;
+                        __mincore_unmapped_range(addr, addr + PAGE_SIZE,
+                                                 vma, vec);
                else if (pte_present(pte))
                        *vec = 1;
                else { /* pte is a swap entry */
                        swp_entry_t entry = pte_to_swp_entry(pte);
-                        /*
+                        if (non_swap_entry(entry)) {
-                         * migration or hwpoison entries are always
+                                /*
-                         * uptodate
+                                 * migration or hwpoison entries are always
-                         */
+                                 * uptodate
-                        *vec = !!non_swap_entry(entry);
+                                 */
+                                *vec = 1;
+                        } else {
+#ifdef CONFIG_SWAP
+                                *vec = mincore_page(swap_address_space(entry),
+                                                    swp_offset(entry));
+#else
+                                WARN_ON(1);
+                                *vec = 1;
+#endif
+                        }
                }
                vec++;
        }
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index f0e8cd9edb1a..26ea8636758f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -647,8 +647,8 @@ static int oom_reaper(void *unused)
 static void wake_oom_reaper(struct task_struct *tsk)
 {
-        /* tsk is already queued? */
+        /* mm is already queued? */
-        if (tsk == oom_reaper_list || tsk->oom_reaper_list)
+        if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags))
                return;
        get_task_struct(tsk);
@@ -975,6 +975,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
         * still freeing memory.
         */
        read_lock(&tasklist_lock);
+        /*
+         * The task 'p' might have already exited before reaching here. The
+         * put_task_struct() will free task_struct 'p' while the loop still try
+         * to access the field of 'p', so, get an extra reference.
+         */
+        get_task_struct(p);
        for_each_thread(p, t) {
                list_for_each_entry(child, &t->children, sibling) {
                        unsigned int child_points;
@@ -994,6 +1001,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
                        }
                }
        }
+        put_task_struct(p);
        read_unlock(&tasklist_lock);
        /*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d295c9bc01a8..35fdde041f5c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5701,18 +5701,6 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
                        cond_resched();
                }
        }
-#ifdef CONFIG_SPARSEMEM
-        /*
-         * If the zone does not span the rest of the section then
-         * we should at least initialize those pages. Otherwise we
-         * could blow up on a poisoned page in some paths which depend
-         * on full sections being initialized (e.g. memory hotplug).
-         */
-        while (end_pfn % PAGES_PER_SECTION) {
-                __init_single_page(pfn_to_page(end_pfn), end_pfn, zone, nid);
-                end_pfn++;
-        }
-#endif
 }
 #ifdef CONFIG_ZONE_DEVICE
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index 70417e9b932d..314bbc8010fb 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
        dst = (ax25_address *)(bp + 1);
        src = (ax25_address *)(bp + 8);
+        ax25_route_lock_use();
        route = ax25_get_route(dst, NULL);
        if (route) {
                digipeat = route->digipeat;
@@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
        ax25_queue_xmit(skb, dev);
 put:
-        if (route)
-                ax25_put_route(route);
+        ax25_route_lock_unuse();
        return NETDEV_TX_OK;
 }
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index a0eff323af12..66f74c85cf6b 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -40,7 +40,7 @@
 #include <linux/export.h>
 static ax25_route *ax25_route_list;
-static DEFINE_RWLOCK(ax25_route_lock);
+DEFINE_RWLOCK(ax25_route_lock);
 void ax25_rt_device_down(struct net_device *dev)
 {
@@ -335,6 +335,7 @@ const struct seq_operations ax25_rt_seqops = {
 *      Find AX.25 route
 *
 *      Only routes with a reference count of zero can be destroyed.
+ *      Must be called with ax25_route_lock read locked.
 */
 ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
 {
@@ -342,7 +343,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
        ax25_route *ax25_def_rt = NULL;
        ax25_route *ax25_rt;
-        read_lock(&ax25_route_lock);
        /*
         *      Bind to the physical interface we heard them on, or the default
         *      route if none is found;
@@ -365,11 +365,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
        if (ax25_spe_rt != NULL)
                ax25_rt = ax25_spe_rt;
-        if (ax25_rt != NULL)
-                ax25_hold_route(ax25_rt);
-        read_unlock(&ax25_route_lock);
        return ax25_rt;
 }
@@ -400,9 +395,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
        ax25_route *ax25_rt;
        int err = 0;
-        if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
+        ax25_route_lock_use();
+        ax25_rt = ax25_get_route(addr, NULL);
+        if (!ax25_rt) {
+                ax25_route_lock_unuse();
                return -EHOSTUNREACH;
+        }
        if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
                err = -EHOSTUNREACH;
                goto put;
@@ -437,8 +435,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
        }
 put:
-        ax25_put_route(ax25_rt);
+        ax25_route_lock_unuse();
        return err;
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5e55cef0cec3..6693e209efe8 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
        xt_compat_lock(NFPROTO_BRIDGE);
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+        if (tmp.nentries) {
-        if (ret < 0)
+                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-                goto out_unlock;
+                if (ret < 0)
+                        goto out_unlock;
+        }
        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
        if (ret < 0)
                goto out_unlock;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..79bb8afa9c0c 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
 */
 #define MAX_NFRAMES 256
+/* limit timers to 400 days for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
 /* use of last_frames[index].flags */
 #define RX_RECV    0x40 /* received data for this element */
 #define RX_THR     0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
        return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
 }
+/* check limitations for timeval provided by user */
+static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+        if ((msg_head->ival1.tv_sec < 0) ||
+            (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival1.tv_usec < 0) ||
+            (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+            (msg_head->ival2.tv_sec < 0) ||
+            (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival2.tv_usec < 0) ||
+            (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+                return true;
+        return false;
+}
 #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
 #define OPSIZ sizeof(struct bcm_op)
 #define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
        if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
                return -EINVAL;
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
        /* check the given can_id */
        op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
        if (op) {
@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
             (!(msg_head->can_id & CAN_RTR_FLAG))))
                return -EINVAL;
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
        /* check the given can_id */
        op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
        if (op) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index d5718284db57..3661cdd927f1 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3206,9 +3206,10 @@ void ceph_con_keepalive(struct ceph_connection *con)
        dout("con_keepalive %p\n", con);
        mutex_lock(&con->mutex);
        clear_standby(con);
+        con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
        mutex_unlock(&con->mutex);
-        if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
-            con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+        if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
                queue_con(con);
 }
 EXPORT_SYMBOL(ceph_con_keepalive);
diff --git a/net/core/dev.c b/net/core/dev.c
index 82f20022259d..8e276e0192a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8712,6 +8712,9 @@ int init_dummy_netdev(struct net_device *dev)
        set_bit(__LINK_STATE_PRESENT, &dev->state);
        set_bit(__LINK_STATE_START, &dev->state);
+        /* napi_busy_loop stats accounting wants this */
+        dev_net_set(dev, &init_net);
        /* Note : We dont allocate pcpu_refcnt for dummy devices,
         * because users of this 'device' dont need to change
         * its refcount.
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index d0b3e69c6b39..0962f9201baa 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -56,7 +56,7 @@
 #include <net/dn_neigh.h>
 #include <net/dn_fib.h>
-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
+#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
 static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
 static char dn_rt_all_rt_mcast[ETH_ALEN]  = {0xAB,0x00,0x00,0x03,0x00,0x00};
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index a4bf22ee3aed..7c4a41dc04bb 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -25,6 +25,7 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 #include <net/gre.h>
+#include <net/erspan.h>
 #include <net/icmp.h>
 #include <net/route.h>
@@ -119,6 +120,22 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                        hdr_len += 4;
        }
        tpi->hdr_len = hdr_len;
+        /* ERSPAN ver 1 and 2 protocol sets GRE key field
+         * to 0 and sets the configured key in the
+         * inner erspan header field
+         */
+        if (greh->protocol == htons(ETH_P_ERSPAN) ||
+            greh->protocol == htons(ETH_P_ERSPAN2)) {
+                struct erspan_base_hdr *ershdr;
+                if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
+                        return -EINVAL;
+                ershdr = (struct erspan_base_hdr *)options;
+                tpi->key = cpu_to_be32(get_session_id(ershdr));
+        }
        return hdr_len;
 }
 EXPORT_SYMBOL(gre_parse_header);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b1a74d80d868..20a64fe6254b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -268,20 +268,11 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
        int len;
        itn = net_generic(net, erspan_net_id);
-        len = gre_hdr_len + sizeof(*ershdr);
-        /* Check based hdr len */
-        if (unlikely(!pskb_may_pull(skb, len)))
-                return PACKET_REJECT;
        iph = ip_hdr(skb);
        ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
        ver = ershdr->ver;
-        /* The original GRE header does not have key field,
-         * Use ERSPAN 10-bit session ID as key.
-         */
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                  tpi->flags | TUNNEL_KEY,
                                  iph->saddr, iph->daddr, tpi->key);
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index c4f5602308ed..054d01c16dc6 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -644,13 +644,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        dst = tnl_params->daddr;
        if (dst == 0) {
                /* NBMA tunnel */
+                struct ip_tunnel_info *tun_info;
                if (!skb_dst(skb)) {
                        dev->stats.tx_fifo_errors++;
                        goto tx_error;
                }
-                if (skb->protocol == htons(ETH_P_IP)) {
+                tun_info = skb_tunnel_info(skb);
+                if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
+                    ip_tunnel_info_af(tun_info) == AF_INET &&
+                    tun_info->key.u.ipv4.dst)
+                        dst = tun_info->key.u.ipv4.dst;
+                else if (skb->protocol == htons(ETH_P_IP)) {
                        rt = skb_rtable(skb);
                        dst = rt_nexthop(rt, inner_iph->daddr);
                }
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index d7b43e700023..68a21bf75dd0 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -74,6 +74,33 @@ drop:
        return 0;
 }
+static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
+                     int encap_type)
+{
+        struct ip_tunnel *tunnel;
+        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                                  iph->saddr, iph->daddr, 0);
+        if (tunnel) {
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+                skb->dev = tunnel->dev;
+                return xfrm_input(skb, nexthdr, spi, encap_type);
+        }
+        return -EINVAL;
+drop:
+        kfree_skb(skb);
+        return 0;
+}
 static int vti_rcv(struct sk_buff *skb)
 {
        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)
        return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
 }
+static int vti_rcv_ipip(struct sk_buff *skb)
+{
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+        return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
+}
 static int vti_rcv_cb(struct sk_buff *skb, int err)
 {
        unsigned short family;
@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
        .priority       =       100,
 };
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+        .handler        =       vti_rcv_ipip,
+        .err_handler    =       vti4_err,
+        .priority       =       0,
+};
 static int __net_init vti_init_net(struct net *net)
 {
        int err;
@@ -603,6 +644,13 @@ static int __init vti_init(void)
        if (err < 0)
                goto xfrm_proto_comp_failed;
+        msg = "ipip tunnel";
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                pr_info("%s: cant't register tunnel\n",__func__);
+                goto xfrm_tunnel_failed;
+        }
        msg = "netlink interface";
        err = rtnl_link_register(&vti_link_ops);
        if (err < 0)
@@ -612,6 +660,8 @@ static int __init vti_init(void)
 rtnl_link_failed:
        xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+xfrm_tunnel_failed:
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 xfrm_proto_comp_failed:
        xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
 xfrm_proto_ah_failed:
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index b61977db9b7f..2a909e5f9ba0 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -846,9 +846,9 @@ static int clusterip_net_init(struct net *net)
 static void clusterip_net_exit(struct net *net)
 {
+#ifdef CONFIG_PROC_FS
        struct clusterip_net *cn = clusterip_pernet(net);
-#ifdef CONFIG_PROC_FS
        mutex_lock(&cn->mutex);
        proc_remove(cn->procdir);
        cn->procdir = NULL;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 93d5ad2b1a69..84c358804355 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3495,8 +3495,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        if (!addrconf_link_ready(dev)) {
                                /* device is not ready yet. */
-                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+                                pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
-                                        dev->name);
+                                         dev->name);
                                break;
                        }
@@ -5120,6 +5120,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                        if (idev) {
                                err = in6_dump_addrs(idev, skb, cb, s_ip_idx,
                                                     &fillargs);
+                                if (err > 0)
+                                        err = 0;
                        }
                        goto put_tgt_net;
                }
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b1be67ca6768..4416368dbd49 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -534,13 +534,9 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
        struct ip6_tnl *tunnel;
        u8 ver;
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
-                return PACKET_REJECT;
        ipv6h = ipv6_hdr(skb);
        ershdr = (struct erspan_base_hdr *)skb->data;
        ver = ershdr->ver;
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
        tunnel = ip6gre_tunnel_lookup(skb->dev,
                                      &ipv6h->saddr, &ipv6h->daddr, tpi->key,
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 30337b38274b..cc01aa3f2b5e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1516,6 +1516,9 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                        continue;
                rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
                list_del_rcu(&c->list);
+                call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
+                                               FIB_EVENT_ENTRY_DEL,
+                                               (struct mfc6_cache *)c, mrt->id);
                mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
                mr_cache_put(c);
        }
@@ -1524,10 +1527,6 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                spin_lock_bh(&mfc_unres_lock);
                list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
                        list_del(&c->list);
-                        call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
-                                                       FIB_EVENT_ENTRY_DEL,
-                                                       (struct mfc6_cache *)c,
-                                                       mrt->id);
                        mr6_netlink_event(mrt, (struct mfc6_cache *)c,
                                          RTM_DELROUTE);
                        ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index de65fe3ed9cc..2493c74c2d37 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1490,6 +1490,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                sta->sta.tdls = true;
+        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
        err = sta_apply_parameters(local, sta, params);
        if (err) {
                sta_info_free(local, sta);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 45aad3d3108c..bb4d71efb6fb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -231,7 +231,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
                struct ieee80211_hdr_3addr hdr;
                u8 category;
                u8 action_code;
-        } __packed action;
+        } __packed __aligned(2) action;
        if (!sdata)
                return;
@@ -2723,7 +2723,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        skb_set_queue_mapping(skb, q);
        if (!--mesh_hdr->ttl) {
-                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+                if (!is_multicast_ether_addr(hdr->addr1))
+                        IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+                                                     dropped_frames_ttl);
                goto out;
        }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 432141f04af3..7d6318664eb2 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2221,6 +2221,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user
                  u->udp_timeout);
 #ifdef CONFIG_IP_VS_PROTO_TCP
+        if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
+            u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
+                return -EINVAL;
+        }
+#endif
+#ifdef CONFIG_IP_VS_PROTO_UDP
+        if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
+                return -EINVAL;
+#endif
+#ifdef CONFIG_IP_VS_PROTO_TCP
        if (u->tcp_timeout) {
                pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
                pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 6f41dd74729d..1f1d90c1716b 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -66,6 +66,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                             int ttl_check,
                             struct nf_osf_hdr_ctx *ctx)
 {
+        const __u8 *optpinit = ctx->optp;
        unsigned int check_WSS = 0;
        int fmatch = FMATCH_WRONG;
        int foptsize, optnum;
@@ -155,6 +156,9 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                }
        }
+        if (fmatch != FMATCH_OK)
+                ctx->optp = optpinit;
        return fmatch == FMATCH_OK;
 }
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 7334e0b80a5e..5eb269428832 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -22,11 +22,15 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_arp/arp_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netns/generic.h>
 struct nft_xt {
        struct list_head        head;
        struct nft_expr_ops     ops;
-        unsigned int            refcnt;
+        refcount_t              refcnt;
+        /* used only when transaction mutex is locked */
+        unsigned int            listcnt;
        /* Unlike other expressions, ops doesn't have static storage duration.
         * nft core assumes they do.  We use kfree_rcu so that nft core can
@@ -43,10 +47,24 @@ struct nft_xt_match_priv {
        void *info;
 };
+struct nft_compat_net {
+        struct list_head nft_target_list;
+        struct list_head nft_match_list;
+};
+static unsigned int nft_compat_net_id __read_mostly;
+static struct nft_expr_type nft_match_type;
+static struct nft_expr_type nft_target_type;
+static struct nft_compat_net *nft_compat_pernet(struct net *net)
+{
+        return net_generic(net, nft_compat_net_id);
+}
 static bool nft_xt_put(struct nft_xt *xt)
 {
-        if (--xt->refcnt == 0) {
+        if (refcount_dec_and_test(&xt->refcnt)) {
-                list_del(&xt->head);
+                WARN_ON_ONCE(!list_empty(&xt->head));
                kfree_rcu(xt, rcu_head);
                return true;
        }
@@ -273,7 +291,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                return -EINVAL;
        nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        refcount_inc(&nft_xt->refcnt);
        return 0;
 }
@@ -486,7 +504,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                return ret;
        nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        refcount_inc(&nft_xt->refcnt);
        return 0;
 }
@@ -540,6 +558,43 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
        __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
 }
+static void nft_compat_activate(const struct nft_ctx *ctx,
+                                const struct nft_expr *expr,
+                                struct list_head *h)
+{
+        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
+        if (xt->listcnt == 0)
+                list_add(&xt->head, h);
+        xt->listcnt++;
+}
+static void nft_compat_activate_mt(const struct nft_ctx *ctx,
+                                   const struct nft_expr *expr)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
+        nft_compat_activate(ctx, expr, &cn->nft_match_list);
+}
+static void nft_compat_activate_tg(const struct nft_ctx *ctx,
+                                   const struct nft_expr *expr)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
+        nft_compat_activate(ctx, expr, &cn->nft_target_list);
+}
+static void nft_compat_deactivate(const struct nft_ctx *ctx,
+                                  const struct nft_expr *expr)
+{
+        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
+        if (--xt->listcnt == 0)
+                list_del_init(&xt->head);
+}
 static void
 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -734,10 +789,6 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
        .cb             = nfnl_nft_compat_cb,
 };
-static LIST_HEAD(nft_match_list);
-static struct nft_expr_type nft_match_type;
 static bool nft_match_cmp(const struct xt_match *match,
                          const char *name, u32 rev, u32 family)
 {
@@ -749,6 +800,7 @@ static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
                     const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
        struct nft_xt *nft_match;
        struct xt_match *match;
        unsigned int matchsize;
@@ -765,8 +817,10 @@ nft_match_select_ops(const struct nft_ctx *ctx,
        rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
        family = ctx->family;
+        cn = nft_compat_pernet(ctx->net);
        /* Re-use the existing match if it's already loaded. */
-        list_for_each_entry(nft_match, &nft_match_list, head) {
+        list_for_each_entry(nft_match, &cn->nft_match_list, head) {
                struct xt_match *match = nft_match->ops.data;
                if (nft_match_cmp(match, mt_name, rev, family))
@@ -789,11 +843,13 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                goto err;
        }
-        nft_match->refcnt = 0;
+        refcount_set(&nft_match->refcnt, 0);
        nft_match->ops.type = &nft_match_type;
        nft_match->ops.eval = nft_match_eval;
        nft_match->ops.init = nft_match_init;
        nft_match->ops.destroy = nft_match_destroy;
+        nft_match->ops.activate = nft_compat_activate_mt;
+        nft_match->ops.deactivate = nft_compat_deactivate;
        nft_match->ops.dump = nft_match_dump;
        nft_match->ops.validate = nft_match_validate;
        nft_match->ops.data = match;
@@ -810,7 +866,8 @@ nft_match_select_ops(const struct nft_ctx *ctx,
        nft_match->ops.size = matchsize;
-        list_add(&nft_match->head, &nft_match_list);
+        nft_match->listcnt = 1;
+        list_add(&nft_match->head, &cn->nft_match_list);
        return &nft_match->ops;
 err:
@@ -826,10 +883,6 @@ static struct nft_expr_type nft_match_type __read_mostly = {
        .owner          = THIS_MODULE,
 };
-static LIST_HEAD(nft_target_list);
-static struct nft_expr_type nft_target_type;
 static bool nft_target_cmp(const struct xt_target *tg,
                           const char *name, u32 rev, u32 family)
 {
@@ -841,6 +894,7 @@ static const struct nft_expr_ops *
 nft_target_select_ops(const struct nft_ctx *ctx,
                      const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
        struct nft_xt *nft_target;
        struct xt_target *target;
        char *tg_name;
@@ -861,8 +915,9 @@ nft_target_select_ops(const struct nft_ctx *ctx,
            strcmp(tg_name, "standard") == 0)
                return ERR_PTR(-EINVAL);
+        cn = nft_compat_pernet(ctx->net);
        /* Re-use the existing target if it's already loaded. */
-        list_for_each_entry(nft_target, &nft_target_list, head) {
+        list_for_each_entry(nft_target, &cn->nft_target_list, head) {
                struct xt_target *target = nft_target->ops.data;
                if (!target->target)
@@ -893,11 +948,13 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                goto err;
        }
-        nft_target->refcnt = 0;
+        refcount_set(&nft_target->refcnt, 0);
        nft_target->ops.type = &nft_target_type;
        nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
        nft_target->ops.init = nft_target_init;
        nft_target->ops.destroy = nft_target_destroy;
+        nft_target->ops.activate = nft_compat_activate_tg;
+        nft_target->ops.deactivate = nft_compat_deactivate;
        nft_target->ops.dump = nft_target_dump;
        nft_target->ops.validate = nft_target_validate;
        nft_target->ops.data = target;
@@ -907,7 +964,8 @@ nft_target_select_ops(const struct nft_ctx *ctx,
        else
                nft_target->ops.eval = nft_target_eval_xt;
-        list_add(&nft_target->head, &nft_target_list);
+        nft_target->listcnt = 1;
+        list_add(&nft_target->head, &cn->nft_target_list);
        return &nft_target->ops;
 err:
@@ -923,13 +981,74 @@ static struct nft_expr_type nft_target_type __read_mostly = {
        .owner          = THIS_MODULE,
 };
+static int __net_init nft_compat_init_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+        INIT_LIST_HEAD(&cn->nft_target_list);
+        INIT_LIST_HEAD(&cn->nft_match_list);
+        return 0;
+}
+static void __net_exit nft_compat_exit_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+        struct nft_xt *xt, *next;
+        if (list_empty(&cn->nft_match_list) &&
+            list_empty(&cn->nft_target_list))
+                return;
+        /* If there was an error that caused nft_xt expr to not be initialized
+         * fully and noone else requested the same expression later, the lists
+         * contain 0-refcount entries that still hold module reference.
+         *
+         * Clean them here.
+         */
+        mutex_lock(&net->nft.commit_mutex);
+        list_for_each_entry_safe(xt, next, &cn->nft_target_list, head) {
+                struct xt_target *target = xt->ops.data;
+                list_del_init(&xt->head);
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(target->me);
+                kfree(xt);
+        }
+        list_for_each_entry_safe(xt, next, &cn->nft_match_list, head) {
+                struct xt_match *match = xt->ops.data;
+                list_del_init(&xt->head);
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(match->me);
+                kfree(xt);
+        }
+        mutex_unlock(&net->nft.commit_mutex);
+}
+static struct pernet_operations nft_compat_net_ops = {
+        .init   = nft_compat_init_net,
+        .exit   = nft_compat_exit_net,
+        .id     = &nft_compat_net_id,
+        .size   = sizeof(struct nft_compat_net),
+};
 static int __init nft_compat_module_init(void)
 {
        int ret;
+        ret = register_pernet_subsys(&nft_compat_net_ops);
+        if (ret < 0)
+                goto err_target;
        ret = nft_register_expr(&nft_match_type);
        if (ret < 0)
-                return ret;
+                goto err_pernet;
        ret = nft_register_expr(&nft_target_type);
        if (ret < 0)
@@ -942,45 +1061,21 @@ static int __init nft_compat_module_init(void)
        }
        return ret;
 err_target:
        nft_unregister_expr(&nft_target_type);
 err_match:
        nft_unregister_expr(&nft_match_type);
+err_pernet:
+        unregister_pernet_subsys(&nft_compat_net_ops);
        return ret;
 }
 static void __exit nft_compat_module_exit(void)
 {
-        struct nft_xt *xt, *next;
-        /* list should be empty here, it can be non-empty only in case there
-         * was an error that caused nft_xt expr to not be initialized fully
-         * and noone else requested the same expression later.
-         *
-         * In this case, the lists contain 0-refcount entries that still
-         * hold module reference.
-         */
-        list_for_each_entry_safe(xt, next, &nft_target_list, head) {
-                struct xt_target *target = xt->ops.data;
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(target->me);
-                kfree(xt);
-        }
-        list_for_each_entry_safe(xt, next, &nft_match_list, head) {
-                struct xt_match *match = xt->ops.data;
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(match->me);
-                kfree(xt);
-        }
        nfnetlink_subsys_unregister(&nfnl_compat_subsys);
        nft_unregister_expr(&nft_target_type);
        nft_unregister_expr(&nft_match_type);
+        unregister_pernet_subsys(&nft_compat_net_ops);
 }
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index cbd51ed5a2d7..908e53ab47a4 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
 {
        struct nr_sock *nr = nr_sk(sk);
-        mod_timer(&nr->t1timer, jiffies + nr->t1);
+        sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
 }
 void nr_start_t2timer(struct sock *sk)
 {
        struct nr_sock *nr = nr_sk(sk);
-        mod_timer(&nr->t2timer, jiffies + nr->t2);
+        sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
 }
 void nr_start_t4timer(struct sock *sk)
 {
        struct nr_sock *nr = nr_sk(sk);
-        mod_timer(&nr->t4timer, jiffies + nr->t4);
+        sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
 }
 void nr_start_idletimer(struct sock *sk)
@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
        struct nr_sock *nr = nr_sk(sk);
        if (nr->idle > 0)
-                mod_timer(&nr->idletimer, jiffies + nr->idle);
+                sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
 }
 void nr_start_heartbeat(struct sock *sk)
 {
-        mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
 }
 void nr_stop_t1timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t1timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t1timer);
 }
 void nr_stop_t2timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t2timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t2timer);
 }
 void nr_stop_t4timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t4timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t4timer);
 }
 void nr_stop_idletimer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->idletimer);
+        sk_stop_timer(sk, &nr_sk(sk)->idletimer);
 }
 void nr_stop_heartbeat(struct sock *sk)
 {
-        del_timer(&sk->sk_timer);
+        sk_stop_timer(sk, &sk->sk_timer);
 }
 int nr_t1timer_running(struct sock *sk)
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 77e9f85a2c92..f2ff21d7df08 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -850,6 +850,7 @@ void rose_link_device_down(struct net_device *dev)
 /*
 *      Route a frame to an appropriate AX.25 connection.
+ *      A NULL ax25_cb indicates an internally generated frame.
 */
 int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 {
@@ -867,6 +868,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
        if (skb->len < ROSE_MIN_LEN)
                return res;
+        if (!ax25)
+                return rose_loopback_queue(skb, NULL);
        frametype = skb->data[2];
        lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
        if (frametype == ROSE_CALL_REQUEST &&
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index ed8e006dae85..6200cd2b4b99 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -280,7 +280,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        if (saddr) {
                fl6->saddr = saddr->v6.sin6_addr;
-                fl6->fl6_sport = saddr->v6.sin6_port;
+                if (!fl6->fl6_sport)
+                        fl6->fl6_sport = saddr->v6.sin6_port;
                pr_debug("src=%pI6 - ", &fl6->saddr);
        }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 4e0eeb113ef5..6abc8b274270 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -440,7 +440,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        }
        if (saddr) {
                fl4->saddr = saddr->v4.sin_addr.s_addr;
-                fl4->fl4_sport = saddr->v4.sin_port;
+                if (!fl4->fl4_sport)
+                        fl4->fl4_sport = saddr->v4.sin_port;
        }
        pr_debug("%s: dst:%pI4, src:%pI4 - ", __func__, &fl4->daddr,
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f4ac6c592e13..d05c57664e36 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -495,7 +495,10 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         *
         * [INIT ACK back to where the INIT came from.]
         */
-        retval->transport = chunk->transport;
+        if (chunk->transport)
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
        retval->subh.init_hdr =
                sctp_addto_chunk(retval, sizeof(initack), &initack);
@@ -642,8 +645,10 @@ struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
         *
         * [COOKIE ACK back to where the COOKIE ECHO came from.]
         */
-        if (retval && chunk)
+        if (retval && chunk && chunk->transport)
-                retval->transport = chunk->transport;
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
        return retval;
 }
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 3892e7630f3a..80e0ae5534ec 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -585,9 +585,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
        struct sctp_strreset_outreq *outreq = param.v;
        struct sctp_stream *stream = &asoc->stream;
        __u32 result = SCTP_STRRESET_DENIED;
-        __u16 i, nums, flags = 0;
        __be16 *str_p = NULL;
        __u32 request_seq;
+        __u16 i, nums;
        request_seq = ntohl(outreq->request_seq);
@@ -615,6 +615,15 @@ struct sctp_chunk *sctp_process_strreset_outreq(
        if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_STREAM_REQ))
                goto out;
+        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        str_p = outreq->list_of_streams;
+        for (i = 0; i < nums; i++) {
+                if (ntohs(str_p[i]) >= stream->incnt) {
+                        result = SCTP_STRRESET_ERR_WRONG_SSN;
+                        goto out;
+                }
+        }
        if (asoc->strreset_chunk) {
                if (!sctp_chunk_lookup_strreset_param(
                                asoc, outreq->response_seq,
@@ -637,32 +646,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
                        sctp_chunk_put(asoc->strreset_chunk);
                        asoc->strreset_chunk = NULL;
                }
-                flags = SCTP_STREAM_RESET_INCOMING_SSN;
        }
-        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        if (nums)
-        if (nums) {
-                str_p = outreq->list_of_streams;
-                for (i = 0; i < nums; i++) {
-                        if (ntohs(str_p[i]) >= stream->incnt) {
-                                result = SCTP_STRRESET_ERR_WRONG_SSN;
-                                goto out;
-                        }
-                }
                for (i = 0; i < nums; i++)
                        SCTP_SI(stream, ntohs(str_p[i]))->mid = 0;
-        } else {
+        else
                for (i = 0; i < stream->incnt; i++)
                        SCTP_SI(stream, i)->mid = 0;
-        }
        result = SCTP_STRRESET_PERFORMED;
        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                flags | SCTP_STREAM_RESET_OUTGOING_SSN, nums, str_p,
+                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
-                GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
@@ -738,9 +734,6 @@ struct sctp_chunk *sctp_process_strreset_inreq(
        result = SCTP_STRRESET_PERFORMED;
-        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
 err:
@@ -873,6 +866,14 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
        if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
                goto out;
+        in = ntohs(addstrm->number_of_streams);
+        incnt = stream->incnt + in;
+        if (!in || incnt > SCTP_MAX_STREAM)
+                goto out;
+        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
+                goto out;
        if (asoc->strreset_chunk) {
                if (!sctp_chunk_lookup_strreset_param(
                        asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
@@ -896,14 +897,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
                }
        }
-        in = ntohs(addstrm->number_of_streams);
-        incnt = stream->incnt + in;
-        if (!in || incnt > SCTP_MAX_STREAM)
-                goto out;
-        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
-                goto out;
        stream->incnt = incnt;
        result = SCTP_STRRESET_PERFORMED;
@@ -973,9 +966,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
        result = SCTP_STRRESET_PERFORMED;
-        *evp = sctp_ulpevent_make_stream_change_event(asoc,
-                0, 0, ntohs(addstrm->number_of_streams), GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
 err:
@@ -1036,10 +1026,10 @@ struct sctp_chunk *sctp_process_strreset_resp(
                                        sout->mid_uo = 0;
                                }
                        }
-                        flags = SCTP_STREAM_RESET_OUTGOING_SSN;
                }
+                flags |= SCTP_STREAM_RESET_OUTGOING_SSN;
                for (i = 0; i < stream->outcnt; i++)
                        SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
@@ -1058,6 +1048,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
                nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
                       sizeof(__u16);
+                flags |= SCTP_STREAM_RESET_INCOMING_SSN;
                *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
                        nums, str_p, GFP_ATOMIC);
        } else if (req->type == SCTP_PARAM_RESET_TSN_REQUEST) {
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index cf51b8f9b15f..1f200119268c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -537,6 +537,99 @@ void svc_rdma_sync_reply_hdr(struct svcxprt_rdma *rdma,
                                      DMA_TO_DEVICE);
 }
+/* If the xdr_buf has more elements than the device can
+ * transmit in a single RDMA Send, then the reply will
+ * have to be copied into a bounce buffer.
+ */
+static bool svc_rdma_pull_up_needed(struct svcxprt_rdma *rdma,
+                                    struct xdr_buf *xdr,
+                                    __be32 *wr_lst)
+{
+        int elements;
+        /* xdr->head */
+        elements = 1;
+        /* xdr->pages */
+        if (!wr_lst) {
+                unsigned int remaining;
+                unsigned long pageoff;
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        ++elements;
+                        remaining -= min_t(u32, PAGE_SIZE - pageoff,
+                                           remaining);
+                        pageoff = 0;
+                }
+        }
+        /* xdr->tail */
+        if (xdr->tail[0].iov_len)
+                ++elements;
+        /* assume 1 SGE is needed for the transport header */
+        return elements >= rdma->sc_max_send_sges;
+}
+/* The device is not capable of sending the reply directly.
+ * Assemble the elements of @xdr into the transport header
+ * buffer.
+ */
+static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
+                                      struct svc_rdma_send_ctxt *ctxt,
+                                      struct xdr_buf *xdr, __be32 *wr_lst)
+{
+        unsigned char *dst, *tailbase;
+        unsigned int taillen;
+        dst = ctxt->sc_xprt_buf;
+        dst += ctxt->sc_sges[0].length;
+        memcpy(dst, xdr->head[0].iov_base, xdr->head[0].iov_len);
+        dst += xdr->head[0].iov_len;
+        tailbase = xdr->tail[0].iov_base;
+        taillen = xdr->tail[0].iov_len;
+        if (wr_lst) {
+                u32 xdrpad;
+                xdrpad = xdr_padsize(xdr->page_len);
+                if (taillen && xdrpad) {
+                        tailbase += xdrpad;
+                        taillen -= xdrpad;
+                }
+        } else {
+                unsigned int len, remaining;
+                unsigned long pageoff;
+                struct page **ppages;
+                ppages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
+                pageoff = xdr->page_base & ~PAGE_MASK;
+                remaining = xdr->page_len;
+                while (remaining) {
+                        len = min_t(u32, PAGE_SIZE - pageoff, remaining);
+                        memcpy(dst, page_address(*ppages), len);
+                        remaining -= len;
+                        dst += len;
+                        pageoff = 0;
+                }
+        }
+        if (taillen)
+                memcpy(dst, tailbase, taillen);
+        ctxt->sc_sges[0].length += xdr->len;
+        ib_dma_sync_single_for_device(rdma->sc_pd->device,
+                                      ctxt->sc_sges[0].addr,
+                                      ctxt->sc_sges[0].length,
+                                      DMA_TO_DEVICE);
+        return 0;
+}
 /* svc_rdma_map_reply_msg - Map the buffer holding RPC message
 * @rdma: controlling transport
 * @ctxt: send_ctxt for the Send WR
@@ -559,8 +652,10 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
        u32 xdr_pad;
        int ret;
-        if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+        if (svc_rdma_pull_up_needed(rdma, xdr, wr_lst))
-                return -EIO;
+                return svc_rdma_pull_up_reply_msg(rdma, ctxt, xdr, wr_lst);
+        ++ctxt->sc_cur_sge_no;
        ret = svc_rdma_dma_map_buf(rdma, ctxt,
                                   xdr->head[0].iov_base,
                                   xdr->head[0].iov_len);
@@ -591,8 +686,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
        while (remaining) {
                len = min_t(u32, PAGE_SIZE - page_off, remaining);
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+                ++ctxt->sc_cur_sge_no;
-                        return -EIO;
                ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
                                            page_off, len);
                if (ret < 0)
@@ -606,8 +700,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
        len = xdr->tail[0].iov_len;
 tail:
        if (len) {
-                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+                ++ctxt->sc_cur_sge_no;
-                        return -EIO;
                ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
                if (ret < 0)
                        return ret;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 924c17d46903..57f86c63a463 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -419,12 +419,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        /* Transport header, head iovec, tail iovec */
        newxprt->sc_max_send_sges = 3;
        /* Add one SGE per page list entry */
-        newxprt->sc_max_send_sges += svcrdma_max_req_size / PAGE_SIZE;
+        newxprt->sc_max_send_sges += (svcrdma_max_req_size / PAGE_SIZE) + 1;
-        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge) {
+        if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge)
-                pr_err("svcrdma: too few Send SGEs available (%d needed)\n",
+                newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
-                       newxprt->sc_max_send_sges);
-                goto errout;
-        }
        newxprt->sc_max_req_size = svcrdma_max_req_size;
        newxprt->sc_max_requests = svcrdma_max_requests;
        newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 11cdc8f7db63..bf5b54b513bc 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -439,6 +439,8 @@ static int tls_do_encryption(struct sock *sk,
        struct scatterlist *sge = sk_msg_elem(msg_en, start);
        int rc;
+        memcpy(rec->iv_data, tls_ctx->tx.iv, sizeof(rec->iv_data));
        sge->offset += tls_ctx->tx.prepend_size;
        sge->length -= tls_ctx->tx.prepend_size;
@@ -448,7 +450,7 @@ static int tls_do_encryption(struct sock *sk,
        aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
        aead_request_set_crypt(aead_req, rec->sg_aead_in,
                               rec->sg_aead_out,
-                               data_len, tls_ctx->tx.iv);
+                               data_len, rec->iv_data);
        aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                  tls_encrypt_done, sk);
@@ -1792,7 +1794,9 @@ void tls_sw_free_resources_tx(struct sock *sk)
        if (atomic_read(&ctx->encrypt_pending))
                crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
+        release_sock(sk);
        cancel_delayed_work_sync(&ctx->tx_work.work);
+        lock_sock(sk);
        /* Tx whatever records we can transmit and abandon the rest */
        tls_tx_records(sk, -1);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5e49492d5911..74150ad95823 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -555,7 +555,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        },
        [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
        [NL80211_ATTR_PEER_MEASUREMENTS] =
-                NLA_POLICY_NESTED(NL80211_PMSR_FTM_REQ_ATTR_MAX,
+                NLA_POLICY_NESTED(NL80211_PMSR_ATTR_MAX,
                                  nl80211_pmsr_attr_policy),
 };
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ecfb1a06dbb2..dd58b9909ac9 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1024,8 +1024,13 @@ static void regdb_fw_cb(const struct firmware *fw, void *context)
        }
        rtnl_lock();
-        if (WARN_ON(regdb && !IS_ERR(regdb))) {
+        if (regdb && !IS_ERR(regdb)) {
-                /* just restore and free new db */
+                /* negative case - a bug
+                 * positive case - can happen due to race in case of multiple cb's in
+                 * queue, due to usage of asynchronous callback
+                 *
+                 * Either case, just restore and free new db.
+                 */
        } else if (set_error) {
                regdb = ERR_PTR(set_error);
        } else if (fw) {
@@ -1255,7 +1260,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
 * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
 * however it is safe for now to assume that a frequency rule should not be
 * part of a frequency's band if the start freq or end freq are off by more
- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the
+ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
 * 60 GHz band.
 * This resolution can be lowered and should be considered as we add
 * regulatory rule support for other "bands".
@@ -1270,7 +1275,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
         * with the Channel starting frequency above 45 GHz.
         */
        u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
-                        10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
+                        20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
        if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
                return true;
        if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 934492bad8e0..ba0a4048c846 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -680,16 +680,6 @@ static void xfrm_hash_resize(struct work_struct *work)
        mutex_unlock(&hash_resize_mutex);
 }
-static void xfrm_hash_reset_inexact_table(struct net *net)
-{
-        struct xfrm_pol_inexact_bin *b;
-        lockdep_assert_held(&net->xfrm.xfrm_policy_lock);
-        list_for_each_entry(b, &net->xfrm.inexact_bins, inexact_bins)
-                INIT_HLIST_HEAD(&b->hhead);
-}
 /* Make sure *pol can be inserted into fastbin.
 * Useful to check that later insert requests will be sucessful
 * (provided xfrm_policy_lock is held throughout).
@@ -833,13 +823,13 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
                                              u16 family)
 {
        unsigned int matched_s, matched_d;
-        struct hlist_node *newpos = NULL;
        struct xfrm_policy *policy, *p;
        matched_s = 0;
        matched_d = 0;
        list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                struct hlist_node *newpos = NULL;
                bool matches_s, matches_d;
                if (!policy->bydst_reinsert)
@@ -849,16 +839,19 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
                policy->bydst_reinsert = false;
                hlist_for_each_entry(p, &n->hhead, bydst) {
-                        if (policy->priority >= p->priority)
+                        if (policy->priority > p->priority)
+                                newpos = &p->bydst;
+                        else if (policy->priority == p->priority &&
+                                 policy->pos > p->pos)
                                newpos = &p->bydst;
                        else
                                break;
                }
                if (newpos)
-                        hlist_add_behind(&policy->bydst, newpos);
+                        hlist_add_behind_rcu(&policy->bydst, newpos);
                else
-                        hlist_add_head(&policy->bydst, &n->hhead);
+                        hlist_add_head_rcu(&policy->bydst, &n->hhead);
                /* paranoia checks follow.
                 * Check that the reinserted policy matches at least
@@ -893,12 +886,13 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                                              struct rb_root *new,
                                              u16 family)
 {
-        struct rb_node **p, *parent = NULL;
        struct xfrm_pol_inexact_node *node;
+        struct rb_node **p, *parent;
        /* we should not have another subtree here */
        WARN_ON_ONCE(!RB_EMPTY_ROOT(&n->root));
+restart:
+        parent = NULL;
        p = &new->rb_node;
        while (*p) {
                u8 prefixlen;
@@ -918,12 +912,11 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                } else {
                        struct xfrm_policy *tmp;
-                        hlist_for_each_entry(tmp, &node->hhead, bydst)
+                        hlist_for_each_entry(tmp, &n->hhead, bydst) {
-                                tmp->bydst_reinsert = true;
-                        hlist_for_each_entry(tmp, &n->hhead, bydst)
                                tmp->bydst_reinsert = true;
+                                hlist_del_rcu(&tmp->bydst);
+                        }
-                        INIT_HLIST_HEAD(&node->hhead);
                        xfrm_policy_inexact_list_reinsert(net, node, family);
                        if (node->prefixlen == n->prefixlen) {
@@ -935,8 +928,7 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                        kfree_rcu(n, rcu);
                        n = node;
                        n->prefixlen = prefixlen;
-                        *p = new->rb_node;
+                        goto restart;
-                        parent = NULL;
                }
        }
@@ -965,12 +957,11 @@ static void xfrm_policy_inexact_node_merge(struct net *net,
                                                  family);
        }
-        hlist_for_each_entry(tmp, &v->hhead, bydst)
+        hlist_for_each_entry(tmp, &v->hhead, bydst) {
-                tmp->bydst_reinsert = true;
-        hlist_for_each_entry(tmp, &n->hhead, bydst)
                tmp->bydst_reinsert = true;
+                hlist_del_rcu(&tmp->bydst);
+        }
-        INIT_HLIST_HEAD(&n->hhead);
        xfrm_policy_inexact_list_reinsert(net, n, family);
 }
@@ -1235,6 +1226,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
        } while (read_seqretry(&net->xfrm.policy_hthresh.lock, seq));
        spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+        write_seqcount_begin(&xfrm_policy_hash_generation);
        /* make sure that we can insert the indirect policies again before
         * we start with destructive action.
@@ -1278,10 +1270,14 @@ static void xfrm_hash_rebuild(struct work_struct *work)
        }
        /* reset the bydst and inexact table in all directions */
-        xfrm_hash_reset_inexact_table(net);
        for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
-                INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
+                struct hlist_node *n;
+                hlist_for_each_entry_safe(policy, n,
+                                          &net->xfrm.policy_inexact[dir],
+                                          bydst_inexact_list)
+                        hlist_del_init(&policy->bydst_inexact_list);
                hmask = net->xfrm.policy_bydst[dir].hmask;
                odst = net->xfrm.policy_bydst[dir].table;
                for (i = hmask; i >= 0; i--)
@@ -1313,6 +1309,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)
                newpos = NULL;
                chain = policy_hash_bysel(net, &policy->selector,
                                          policy->family, dir);
+                hlist_del_rcu(&policy->bydst);
                if (!chain) {
                        void *p = xfrm_policy_inexact_insert(policy, dir, 0);
@@ -1334,6 +1333,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 out_unlock:
        __xfrm_policy_inexact_flush(net);
+        write_seqcount_end(&xfrm_policy_hash_generation);
        spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
        mutex_unlock(&hash_resize_mutex);
@@ -2600,7 +2600,10 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                dst_copy_metrics(dst1, dst);
                if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
-                        __u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
+                        __u32 mark = 0;
+                        if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
+                                mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
                        family = xfrm[i]->props.family;
                        dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 277c1c46fe94..c6d26afcf89d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1488,10 +1488,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                if (!ut[i].family)
                        ut[i].family = family;
-                if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
+                switch (ut[i].mode) {
-                    (ut[i].family != prev_family))
+                case XFRM_MODE_TUNNEL:
-                        return -EINVAL;
+                case XFRM_MODE_BEET:
+                        break;
+                default:
+                        if (ut[i].family != prev_family)
+                                return -EINVAL;
+                        break;
+                }
                if (ut[i].mode >= XFRM_MODE_MAX)
                        return -EINVAL;
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..11975ec8d566 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1444,7 +1444,10 @@ check:
                        new = aa_label_merge(label, target, GFP_KERNEL);
                if (IS_ERR_OR_NULL(new)) {
                        info = "failed to build target label";
-                        error = PTR_ERR(new);
+                        if (!new)
+                                error = -ENOMEM;
+                        else
+                                error = PTR_ERR(new);
                        new = NULL;
                        perms.allow = 0;
                        goto audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 2c010874329f..8db1731d046a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1599,12 +1599,14 @@ static unsigned int apparmor_ipv4_postroute(void *priv,
        return apparmor_ip_postroute(priv, skb, state);
 }
+#if IS_ENABLED(CONFIG_IPV6)
 static unsigned int apparmor_ipv6_postroute(void *priv,
                                            struct sk_buff *skb,
                                            const struct nf_hook_state *state)
 {
        return apparmor_ip_postroute(priv, skb, state);
 }
+#endif
 static const struct nf_hook_ops apparmor_nf_ops[] = {
        {
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index a5b09e75e787..f7d2b373da0a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -541,7 +541,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
        /* first let's check the buffer parameter's */
        if (params->buffer.fragment_size == 0 ||
-            params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
+            params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+            params->buffer.fragments == 0)
                return -EINVAL;
        /* now codec parameters */
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 40013b26f671..6c99fa8ac5fa 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2112,6 +2112,13 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
        return 0;
 }
+/* allow waiting for a capture stream that hasn't been started */
+#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+#define wait_capture_start(substream)   ((substream)->oss.oss)
+#else
+#define wait_capture_start(substream)   false
+#endif
 /* the common loop for read/write data */
 snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                                     void *data, bool interleaved,
@@ -2182,7 +2189,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                        err = snd_pcm_start(substream);
                        if (err < 0)
                                goto _end_unlock;
-                } else {
+                } else if (!wait_capture_start(substream)) {
                        /* nothing to do */
                        err = 0;
                        goto _end_unlock;
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 9174f1b3a987..1ec706ced75c 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -115,7 +115,8 @@ static int hda_codec_driver_probe(struct device *dev)
        err = snd_hda_codec_build_controls(codec);
        if (err < 0)
                goto error_module;
-        if (codec->card->registered) {
+        /* only register after the bus probe finished; otherwise it's racy */
+        if (!codec->bus->bus_probing && codec->card->registered) {
                err = snd_card_register(codec->card);
                if (err < 0)
                        goto error_module;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e784130ea4e0..e5c49003e75f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2185,6 +2185,7 @@ static int azx_probe_continue(struct azx *chip)
        int dev = chip->dev_index;
        int err;
+        to_hda_bus(bus)->bus_probing = 1;
        hda->probe_continued = 1;
        /* bind with i915 if needed */
@@ -2269,6 +2270,7 @@ out_free:
        if (err < 0)
                hda->init_failed = 1;
        complete_all(&hda->probe_wait);
+        to_hda_bus(bus)->bus_probing = 0;
        return err;
 }
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index e5bdbc245682..29882bda7632 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -8451,8 +8451,10 @@ static void ca0132_free(struct hda_codec *codec)
        ca0132_exit_chip(codec);
        snd_hda_power_down(codec);
-        if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
+#ifdef CONFIG_PCI
+        if (spec->mem_base)
                pci_iounmap(codec->bus->pci, spec->mem_base);
+#endif
        kfree(spec->spec_init_verbs);
        kfree(codec->spec);
 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 51cc6589443f..152f54137082 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -931,6 +931,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+        SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0b3e7a18ca78..6df758adff84 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -117,6 +117,7 @@ struct alc_spec {
        int codec_variant;      /* flag for other variants */
        unsigned int has_alc5505_dsp:1;
        unsigned int no_depop_delay:1;
+        unsigned int done_hp_init:1;
        /* for PLL fix */
        hda_nid_t pll_nid;
@@ -514,6 +515,15 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
        }
 }
+/* get a primary headphone pin if available */
+static hda_nid_t alc_get_hp_pin(struct alc_spec *spec)
+{
+        if (spec->gen.autocfg.hp_pins[0])
+                return spec->gen.autocfg.hp_pins[0];
+        if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+                return spec->gen.autocfg.line_out_pins[0];
+        return 0;
+}
 /*
 * Realtek SSID verification
@@ -724,9 +734,7 @@ do_sku:
         * 15   : 1 --> enable the function "Mute internal speaker
         *              when the external headphone out jack is plugged"
         */
-        if (!spec->gen.autocfg.hp_pins[0] &&
+        if (!alc_get_hp_pin(spec)) {
-            !(spec->gen.autocfg.line_out_pins[0] &&
-              spec->gen.autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
                hda_nid_t nid;
                tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                nid = ports[tmp];
@@ -2958,7 +2966,7 @@ static void alc282_restore_default_value(struct hda_codec *codec)
 static void alc282_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        int coef78;
@@ -2995,7 +3003,7 @@ static void alc282_init(struct hda_codec *codec)
 static void alc282_shutup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        int coef78;
@@ -3073,14 +3081,9 @@ static void alc283_restore_default_value(struct hda_codec *codec)
 static void alc283_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
        alc283_restore_default_value(codec);
        if (!hp_pin)
@@ -3114,14 +3117,9 @@ static void alc283_init(struct hda_codec *codec)
 static void alc283_shutup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
-        if (!spec->gen.autocfg.hp_outs) {
-                if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
-                        hp_pin = spec->gen.autocfg.line_out_pins[0];
-        }
        if (!hp_pin) {
                alc269_shutup(codec);
                return;
@@ -3155,7 +3153,7 @@ static void alc283_shutup(struct hda_codec *codec)
 static void alc256_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        if (!hp_pin)
@@ -3191,7 +3189,7 @@ static void alc256_init(struct hda_codec *codec)
 static void alc256_shutup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        if (!hp_pin) {
@@ -3227,7 +3225,7 @@ static void alc256_shutup(struct hda_codec *codec)
 static void alc225_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp1_pin_sense, hp2_pin_sense;
        if (!hp_pin)
@@ -3270,7 +3268,7 @@ static void alc225_init(struct hda_codec *codec)
 static void alc225_shutup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp1_pin_sense, hp2_pin_sense;
        if (!hp_pin) {
@@ -3314,7 +3312,7 @@ static void alc225_shutup(struct hda_codec *codec)
 static void alc_default_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        if (!hp_pin)
@@ -3343,7 +3341,7 @@ static void alc_default_init(struct hda_codec *codec)
 static void alc_default_shutup(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        bool hp_pin_sense;
        if (!hp_pin) {
@@ -3372,6 +3370,48 @@ static void alc_default_shutup(struct hda_codec *codec)
        snd_hda_shutup_pins(codec);
 }
+static void alc294_hp_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
+        int i, val;
+        if (!hp_pin)
+                return;
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+        msleep(100);
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+        /* Wait for depop procedure finish  */
+        val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        for (i = 0; i < 20 && val & 0x0080; i++) {
+                msleep(50);
+                val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        }
+        /* Set HP depop to auto mode */
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+        msleep(50);
+}
+static void alc294_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        if (!spec->done_hp_init) {
+                alc294_hp_init(codec);
+                spec->done_hp_init = true;
+        }
+        alc_default_init(codec);
+}
 static void alc5505_coef_set(struct hda_codec *codec, unsigned int index_reg,
                             unsigned int val)
 {
@@ -4737,7 +4777,7 @@ static void alc_update_headset_mode(struct hda_codec *codec)
        struct alc_spec *spec = codec->spec;
        hda_nid_t mux_pin = spec->gen.imux_pins[spec->gen.cur_mux[0]];
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        hda_nid_t hp_pin = alc_get_hp_pin(spec);
        int new_headset_mode;
@@ -5016,7 +5056,7 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        int hp_pin = spec->gen.autocfg.hp_pins[0];
+        int hp_pin = alc_get_hp_pin(spec);
        /* Prevent pop noises when headphones are plugged in */
        snd_hda_codec_write(codec, hp_pin, 0,
@@ -5109,7 +5149,7 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
        if (action == HDA_FIXUP_ACT_PROBE) {
                int mic_pin = find_ext_mic_pin(codec);
-                int hp_pin = spec->gen.autocfg.hp_pins[0];
+                int hp_pin = alc_get_hp_pin(spec);
                if (snd_BUG_ON(!mic_pin || !hp_pin))
                        return;
@@ -5591,6 +5631,7 @@ enum {
        ALC294_FIXUP_ASUS_HEADSET_MIC,
        ALC294_FIXUP_ASUS_SPK,
        ALC225_FIXUP_HEADSET_JACK,
+        ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 };
 static const struct hda_fixup alc269_fixups[] = {
@@ -6537,6 +6578,15 @@ static const struct hda_fixup alc269_fixups[] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc_fixup_headset_jack,
        },
+        [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
 };
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6715,6 +6765,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
        SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
        SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
        SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
        SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
@@ -6926,7 +6977,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
        {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
        {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
-        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc255-dell1"},
+        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
        {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
        {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
        {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
@@ -7373,37 +7424,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
        alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
-static void alc294_hp_init(struct hda_codec *codec)
-{
-        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
-        int i, val;
-        if (!hp_pin)
-                return;
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-        msleep(100);
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
-        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
-        /* Wait for depop procedure finish  */
-        val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        for (i = 0; i < 20 && val & 0x0080; i++) {
-                msleep(50);
-                val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        }
-        /* Set HP depop to auto mode */
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
-        msleep(50);
-}
 /*
 */
 static int patch_alc269(struct hda_codec *codec)
@@ -7529,7 +7549,7 @@ static int patch_alc269(struct hda_codec *codec)
                spec->codec_variant = ALC269_TYPE_ALC294;
                spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                break;
        case 0x10ec0300:
                spec->codec_variant = ALC269_TYPE_ALC300;
@@ -7541,7 +7561,7 @@ static int patch_alc269(struct hda_codec *codec)
                spec->codec_variant = ALC269_TYPE_ALC700;
                spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
                alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                break;
        }
diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
index 022a8912c8a2..3d58338fa3cf 100644
--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
+++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
@@ -611,14 +611,16 @@ static int acp3x_audio_probe(struct platform_device *pdev)
        }
        irqflags = *((unsigned int *)(pdev->dev.platform_data));
-        adata = devm_kzalloc(&pdev->dev, sizeof(struct i2s_dev_data),
-                             GFP_KERNEL);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                dev_err(&pdev->dev, "IORESOURCE_IRQ FAILED\n");
                        return -ENODEV;
        }
+        adata = devm_kzalloc(&pdev->dev, sizeof(*adata), GFP_KERNEL);
+        if (!adata)
+                return -ENOMEM;
        adata->acp3x_base = devm_ioremap(&pdev->dev, res->start,
                                         resource_size(res));
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 3ab2949c1dfa..b19d7a3e7a2c 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1890,51 +1890,31 @@ static void hdmi_codec_remove(struct snd_soc_component *component)
        pm_runtime_disable(&hdev->dev);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int hdmi_codec_prepare(struct device *dev)
+static int hdmi_codec_resume(struct device *dev)
-{
-        struct hdac_device *hdev = dev_to_hdac_dev(dev);
-        pm_runtime_get_sync(&hdev->dev);
-        /*
-         * Power down afg.
-         * codec_read is preferred over codec_write to set the power state.
-         * This way verb is send to set the power state and response
-         * is received. So setting power state is ensured without using loop
-         * to read the state.
-         */
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
-                                                        AC_PWRST_D3);
-        return 0;
-}
-static void hdmi_codec_complete(struct device *dev)
 {
        struct hdac_device *hdev = dev_to_hdac_dev(dev);
        struct hdac_hdmi_priv *hdmi = hdev_to_hdmi_priv(hdev);
+        int ret;
-        /* Power up afg */
+        ret = pm_runtime_force_resume(dev);
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
+        if (ret < 0)
-                                                        AC_PWRST_D0);
+                return ret;
-        hdac_hdmi_skl_enable_all_pins(hdev);
-        hdac_hdmi_skl_enable_dp12(hdev);
        /*
         * As the ELD notify callback request is not entertained while the
         * device is in suspend state. Need to manually check detection of
         * all pins here. pin capablity change is not support, so use the
         * already set pin caps.
+         *
+         * NOTE: this is safe to call even if the codec doesn't actually resume.
+         * The pin check involves only with DRM audio component hooks, so it
+         * works even if the HD-audio side is still dreaming peacefully.
         */
        hdac_hdmi_present_sense_all_pins(hdev, hdmi, false);
+        return 0;
-        pm_runtime_put_sync(&hdev->dev);
 }
 #else
-#define hdmi_codec_prepare NULL
+#define hdmi_codec_resume NULL
-#define hdmi_codec_complete NULL
 #endif
 static const struct snd_soc_component_driver hdmi_hda_codec = {
@@ -2135,75 +2115,6 @@ static int hdac_hdmi_dev_remove(struct hdac_device *hdev)
 }
 #ifdef CONFIG_PM
-/*
- * Power management sequences
- * ==========================
- *
- * The following explains the PM handling of HDAC HDMI with its parent
- * device SKL and display power usage
- *
- * Probe
- * -----
- * In SKL probe,
- * 1. skl_probe_work() powers up the display (refcount++ -> 1)
- * 2. enumerates the codecs on the link
- * 3. powers down the display  (refcount-- -> 0)
- *
- * In HDAC HDMI probe,
- * 1. hdac_hdmi_dev_probe() powers up the display (refcount++ -> 1)
- * 2. probe the codec
- * 3. put the HDAC HDMI device to runtime suspend
- * 4. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- *
- * Once children are runtime suspended, SKL device also goes to runtime
- * suspend
- *
- * HDMI Playback
- * -------------
- * Open HDMI device,
- * 1. skl_runtime_resume() invoked
- * 2. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- *
- * Close HDMI device,
- * 1. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 2. skl_runtime_suspend() invoked
- *
- * S0/S3 Cycle with playback in progress
- * -------------------------------------
- * When the device is opened for playback, the device is runtime active
- * already and the display refcount is 1 as explained above.
- *
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec which just
- *    increments the PM runtime usage count of the codec since the device
- *    is in use already
- * 2. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec which just
- *    decrements the PM runtime usage count of the codec since the device
- *    is in use already
- *
- * Once playback is stopped, the display refcount is set to 0 as explained
- * above in the HDMI playback sequence. The PM handlings are designed in
- * such way that to balance the refcount of display power when the codec
- * device put to S3 while playback is going on.
- *
- * S0/S3 Cycle without playback in progress
- * ----------------------------------------
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec
- * 2. skl_runtime_resume() invoked
- * 3. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- * 4. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec
- * 3. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 4. skl_runtime_suspend() invoked
- */
 static int hdac_hdmi_runtime_suspend(struct device *dev)
 {
        struct hdac_device *hdev = dev_to_hdac_dev(dev);
@@ -2277,8 +2188,7 @@ static int hdac_hdmi_runtime_resume(struct device *dev)
 static const struct dev_pm_ops hdac_hdmi_pm = {
        SET_RUNTIME_PM_OPS(hdac_hdmi_runtime_suspend, hdac_hdmi_runtime_resume, NULL)
-        .prepare = hdmi_codec_prepare,
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, hdmi_codec_resume)
-        .complete = hdmi_codec_complete,
 };
 static const struct hda_device_id hdmi_list[] = {
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 6cb1653be804..4cc24a5d5c31 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1400,24 +1400,20 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                if (ret != 0) {
                        dev_err(component->dev,
                                "Failed to set digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
+                        goto unlock;
-                        return ret;
                }
                regmap_read_poll_timeout(pcm512x->regmap,
                                         PCM512x_ANALOG_MUTE_DET,
                                         mute_det, (mute_det & 0x3) == 0,
                                         200, 10000);
-                mutex_unlock(&pcm512x->mutex);
        } else {
                pcm512x->mute &= ~0x1;
                ret = pcm512x_update_mute(pcm512x);
                if (ret != 0) {
                        dev_err(component->dev,
                                "Failed to update digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
+                        goto unlock;
-                        return ret;
                }
                regmap_read_poll_timeout(pcm512x->regmap,
@@ -1428,9 +1424,10 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                                         200, 10000);
        }
+unlock:
        mutex_unlock(&pcm512x->mutex);
-        return 0;
+        return ret;
 }
 static const struct snd_soc_dai_ops pcm512x_dai_ops = {
diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
index 0ef966d56bac..e2855ab9a2c6 100644
--- a/sound/soc/codecs/rt274.c
+++ b/sound/soc/codecs/rt274.c
@@ -1128,8 +1128,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c,
                return ret;
        }
-        regmap_read(rt274->regmap,
+        ret = regmap_read(rt274->regmap,
                RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
+        if (ret)
+                return ret;
        if (val != RT274_VENDOR_ID) {
                dev_err(&i2c->dev,
                        "Device with ID register %#x is not rt274\n", val);
diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
index 4d46f4567c3a..bec2eefa8b0f 100644
--- a/sound/soc/codecs/rt5514-spi.c
+++ b/sound/soc/codecs/rt5514-spi.c
@@ -280,6 +280,8 @@ static int rt5514_spi_pcm_probe(struct snd_soc_component *component)
        rt5514_dsp = devm_kzalloc(component->dev, sizeof(*rt5514_dsp),
                        GFP_KERNEL);
+        if (!rt5514_dsp)
+                return -ENOMEM;
        rt5514_dsp->dev = &rt5514_spi->dev;
        mutex_init(&rt5514_dsp->dma_lock);
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 34cfaf8f6f34..89c43b26c379 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -2512,6 +2512,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682)
        regmap_write(rt5682->regmap, RT5682_PWR_DIG_1, 0x0000);
        regmap_write(rt5682->regmap, RT5682_CHOP_DAC, 0x2000);
        regmap_write(rt5682->regmap, RT5682_CALIB_ADC_CTRL, 0x2005);
+        regmap_write(rt5682->regmap, RT5682_STO1_ADC_MIXER, 0xc0c4);
        mutex_unlock(&rt5682->calibrate_mutex);
diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h
index d82a8301fd74..96944cff0ed7 100644
--- a/sound/soc/codecs/rt5682.h
+++ b/sound/soc/codecs/rt5682.h
@@ -849,18 +849,18 @@
 #define RT5682_SCLK_SRC_PLL2                    (0x2 << 13)
 #define RT5682_SCLK_SRC_SDW                     (0x3 << 13)
 #define RT5682_SCLK_SRC_RCCLK                   (0x4 << 13)
-#define RT5682_PLL1_SRC_MASK                    (0x3 << 10)
+#define RT5682_PLL2_SRC_MASK                    (0x3 << 10)
-#define RT5682_PLL1_SRC_SFT                     10
+#define RT5682_PLL2_SRC_SFT                     10
-#define RT5682_PLL1_SRC_MCLK                    (0x0 << 10)
+#define RT5682_PLL2_SRC_MCLK                    (0x0 << 10)
-#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 10)
+#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 10)
-#define RT5682_PLL1_SRC_SDW                     (0x2 << 10)
+#define RT5682_PLL2_SRC_SDW                     (0x2 << 10)
-#define RT5682_PLL1_SRC_RC                      (0x3 << 10)
+#define RT5682_PLL2_SRC_RC                      (0x3 << 10)
-#define RT5682_PLL2_SRC_MASK                    (0x3 << 8)
+#define RT5682_PLL1_SRC_MASK                    (0x3 << 8)
-#define RT5682_PLL2_SRC_SFT                     8
+#define RT5682_PLL1_SRC_SFT                     8
-#define RT5682_PLL2_SRC_MCLK                    (0x0 << 8)
+#define RT5682_PLL1_SRC_MCLK                    (0x0 << 8)
-#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 8)
+#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 8)
-#define RT5682_PLL2_SRC_SDW                     (0x2 << 8)
+#define RT5682_PLL1_SRC_SDW                     (0x2 << 8)
-#define RT5682_PLL2_SRC_RC                      (0x3 << 8)
+#define RT5682_PLL1_SRC_RC                      (0x3 << 8)
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index e2b5a11b16d1..f03195d2ab2e 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -822,6 +822,10 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
        case SND_SOC_BIAS_PREPARE:
                break;
        case SND_SOC_BIAS_STANDBY:
+                /* Initial cold start */
+                if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
+                        break;
                /* Switch off BCLK_N Divider */
                snd_soc_component_update_bits(component, AIC32X4_BCLKN,
                                    AIC32X4_BCLKEN, 0);
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index 392d5eef356d..99e07b01a2ce 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
-        ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+        ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
                       pdcr, ptcr);
        if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxFS output from %s, ",
                                audmux_port_string((ptcr >> 27) & 0x7));
        else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxFS input, ");
        if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxClk output from %s",
                                audmux_port_string((ptcr >> 22) & 0x7));
        else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxClk input");
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
        if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) {
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "Port is symmetric");
        } else {
                if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxFS output from %s, ",
                                        audmux_port_string((ptcr >> 17) & 0x7));
                else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxFS input, ");
                if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxClk output from %s",
                                        audmux_port_string((ptcr >> 12) & 0x7));
                else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxClk input");
        }
-        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                        "\nData received from %s\n",
                        audmux_port_string((pdcr >> 13) & 0x7));
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 99a62ba409df..bd9fd2035c55 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -91,7 +91,7 @@ config SND_SST_ATOM_HIFI2_PLATFORM_PCI
 config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
        tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms"
        default ACPI
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select SND_SST_IPC_ACPI
        select SND_SST_ATOM_HIFI2_PLATFORM
        select SND_SOC_ACPI_INTEL_MATCH
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index afc559866095..91a2436ce952 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -399,7 +399,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *params,
                                struct snd_soc_dai *dai)
 {
-        snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
+        int ret;
+        ret =
+                snd_pcm_lib_malloc_pages(substream,
+                                params_buffer_bytes(params));
+        if (ret)
+                return ret;
        memset(substream->runtime->dma_area, 0, params_buffer_bytes(params));
        return 0;
 }
diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
index 68e6543e6cb0..99f2a0156ae8 100644
--- a/sound/soc/intel/boards/broadwell.c
+++ b/sound/soc/intel/boards/broadwell.c
@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = {
                .stream_name = "Loopback",
                .cpu_dai_name = "Loopback Pin",
                .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                .codec_name = "snd-soc-dummy",
                .codec_dai_name = "snd-soc-dummy-dai",
                .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c
index c74c4f17316f..8f83b182c4f9 100644
--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c
+++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c
@@ -55,39 +55,6 @@ enum {
        GLK_DPCM_AUDIO_HDMI3_PB,
 };
-static int platform_clock_control(struct snd_soc_dapm_widget *w,
-                                        struct snd_kcontrol *k, int  event)
-{
-        struct snd_soc_dapm_context *dapm = w->dapm;
-        struct snd_soc_card *card = dapm->card;
-        struct snd_soc_dai *codec_dai;
-        int ret = 0;
-        codec_dai = snd_soc_card_get_codec_dai(card, GLK_REALTEK_CODEC_DAI);
-        if (!codec_dai) {
-                dev_err(card->dev, "Codec dai not found; Unable to set/unset codec pll\n");
-                return -EIO;
-        }
-        if (SND_SOC_DAPM_EVENT_OFF(event)) {
-                ret = snd_soc_dai_set_sysclk(codec_dai, 0, 0, 0);
-                if (ret)
-                        dev_err(card->dev, "failed to stop sysclk: %d\n", ret);
-        } else if (SND_SOC_DAPM_EVENT_ON(event)) {
-                ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
-                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
-                if (ret < 0) {
-                        dev_err(card->dev, "can't set codec pll: %d\n", ret);
-                        return ret;
-                }
-        }
-        if (ret)
-                dev_err(card->dev, "failed to start internal clk: %d\n", ret);
-        return ret;
-}
 static const struct snd_kcontrol_new geminilake_controls[] = {
        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
        SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -102,14 +69,10 @@ static const struct snd_soc_dapm_widget geminilake_widgets[] = {
        SND_SOC_DAPM_SPK("HDMI1", NULL),
        SND_SOC_DAPM_SPK("HDMI2", NULL),
        SND_SOC_DAPM_SPK("HDMI3", NULL),
-        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
-                        platform_clock_control, SND_SOC_DAPM_PRE_PMU |
-                        SND_SOC_DAPM_POST_PMD),
 };
 static const struct snd_soc_dapm_route geminilake_map[] = {
        /* HP jack connectors - unknown if we have jack detection */
-        { "Headphone Jack", NULL, "Platform Clock" },
        { "Headphone Jack", NULL, "HPOL" },
        { "Headphone Jack", NULL, "HPOR" },
@@ -117,7 +80,6 @@ static const struct snd_soc_dapm_route geminilake_map[] = {
        { "Spk", NULL, "Speaker" },
        /* other jacks */
-        { "Headset Mic", NULL, "Platform Clock" },
        { "IN1P", NULL, "Headset Mic" },
        /* digital mics */
@@ -177,6 +139,13 @@ static int geminilake_rt5682_codec_init(struct snd_soc_pcm_runtime *rtd)
        struct snd_soc_jack *jack;
        int ret;
+        ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
+                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set codec pll: %d\n", ret);
+                return ret;
+        }
        /* Configure sysclk for codec */
        ret = snd_soc_dai_set_sysclk(codec_dai, RT5682_SCLK_S_PLL1,
                                        RT5682_PLL_FREQ, SND_SOC_CLOCK_IN);
diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
index eab1f439dd3f..a4022983a7ce 100644
--- a/sound/soc/intel/boards/haswell.c
+++ b/sound/soc/intel/boards/haswell.c
@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = {
                .stream_name = "Loopback",
                .cpu_dai_name = "Loopback Pin",
                .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                .codec_name = "snd-soc-dummy",
                .codec_dai_name = "snd-soc-dummy-dai",
                .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 60c94836bf5b..4ed5b7e17d44 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -336,9 +336,6 @@ static int skl_suspend(struct device *dev)
                skl->skl_sst->fw_loaded = false;
        }
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
        return 0;
 }
@@ -350,10 +347,6 @@ static int skl_resume(struct device *dev)
        struct hdac_ext_link *hlink = NULL;
        int ret;
-        /* Turned OFF in HDMI codec driver after codec reconfiguration */
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, true);
        /*
         * resume only when we are not in suspend active, otherwise need to
         * restore the device
@@ -446,8 +439,10 @@ static int skl_free(struct hdac_bus *bus)
        snd_hdac_ext_bus_exit(bus);
        cancel_work_sync(&skl->probe_work);
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
                snd_hdac_i915_exit(bus);
+        }
        return 0;
 }
@@ -814,7 +809,7 @@ static void skl_probe_work(struct work_struct *work)
        err = skl_platform_register(bus->dev);
        if (err < 0) {
                dev_err(bus->dev, "platform register failed: %d\n", err);
-                return;
+                goto out_err;
        }
        err = skl_machine_device_register(skl);
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index 5b986b74dd36..548eb4fa2da6 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -570,10 +570,10 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
        prtd->audio_client = q6asm_audio_client_alloc(dev,
                                        (q6asm_cb)compress_event_handler,
                                        prtd, stream_id, LEGACY_PCM_MODE);
-        if (!prtd->audio_client) {
+        if (IS_ERR(prtd->audio_client)) {
                dev_err(dev, "Could not allocate memory\n");
-                kfree(prtd);
+                ret = PTR_ERR(prtd->audio_client);
-                return -ENOMEM;
+                goto free_prtd;
        }
        size = COMPR_PLAYBACK_MAX_FRAGMENT_SIZE *
@@ -582,7 +582,7 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
                                  &prtd->dma_buffer);
        if (ret) {
                dev_err(dev, "Cannot allocate buffer(s)\n");
-                return ret;
+                goto free_client;
        }
        if (pdata->sid < 0)
@@ -595,6 +595,13 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
        runtime->private_data = prtd;
        return 0;
+free_client:
+        q6asm_audio_client_free(prtd->audio_client);
+free_prtd:
+        kfree(prtd);
+        return ret;
 }
 static int q6asm_dai_compr_free(struct snd_compr_stream *stream)
@@ -874,7 +881,7 @@ static int of_q6asm_parse_dai_data(struct device *dev,
        for_each_child_of_node(dev->of_node, node) {
                ret = of_property_read_u32(node, "reg", &id);
-                if (ret || id > MAX_SESSIONS || id < 0) {
+                if (ret || id >= MAX_SESSIONS || id < 0) {
                        dev_err(dev, "valid dai id not found:%d\n", ret);
                        continue;
                }
diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
index 1db8ef668223..6f66a58e23ca 100644
--- a/sound/soc/qcom/sdm845.c
+++ b/sound/soc/qcom/sdm845.c
@@ -158,17 +158,24 @@ static int sdm845_snd_hw_params(struct snd_pcm_substream *substream,
        return ret;
 }
+static void sdm845_jack_free(struct snd_jack *jack)
+{
+        struct snd_soc_component *component = jack->private_data;
+        snd_soc_component_set_jack(component, NULL, NULL);
+}
 static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
        struct snd_soc_component *component;
-        struct snd_soc_dai_link *dai_link = rtd->dai_link;
        struct snd_soc_card *card = rtd->card;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
        struct sdm845_snd_data *pdata = snd_soc_card_get_drvdata(card);
-        int i, rval;
+        struct snd_jack *jack;
+        int rval;
        if (!pdata->jack_setup) {
-                struct snd_jack *jack;
                rval = snd_soc_card_jack_new(card, "Headset Jack",
                                SND_JACK_HEADSET |
                                SND_JACK_HEADPHONE |
@@ -190,16 +197,22 @@ static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
                pdata->jack_setup = true;
        }
-        for (i = 0 ; i < dai_link->num_codecs; i++) {
+        switch (cpu_dai->id) {
-                struct snd_soc_dai *dai = rtd->codec_dais[i];
+        case PRIMARY_MI2S_RX:
+                jack  = pdata->jack.jack;
+                component = codec_dai->component;
-                component = dai->component;
+                jack->private_data = component;
-                rval = snd_soc_component_set_jack(
+                jack->private_free = sdm845_jack_free;
-                                component, &pdata->jack, NULL);
+                rval = snd_soc_component_set_jack(component,
+                                                  &pdata->jack, NULL);
                if (rval != 0 && rval != -ENOTSUPP) {
                        dev_warn(card->dev, "Failed to set jack: %d\n", rval);
                        return rval;
                }
+                break;
+        default:
+                break;
        }
        return 0;
diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
index 922fb6aa3ed1..5aee11c94f2a 100644
--- a/sound/soc/sh/dma-sh7760.c
+++ b/sound/soc/sh/dma-sh7760.c
@@ -202,7 +202,7 @@ static int camelot_prepare(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct camelot_pcm *cam = &cam_pcm_data[rtd->cpu_dai->id];
-        pr_debug("PCM data: addr 0x%08ulx len %d\n",
+        pr_debug("PCM data: addr 0x%08lx len %d\n",
                 (u32)runtime->dma_addr, runtime->dma_bytes);
 
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 0462b3ec977a..aae450ba4f08 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -742,7 +742,7 @@ static struct snd_soc_component *soc_find_component(
                if (of_node) {
                        if (component->dev->of_node == of_node)
                                return component;
-                } else if (strcmp(component->name, name) == 0) {
+                } else if (name && strcmp(component->name, name) == 0) {
                        return component;
                }
        }
@@ -1034,17 +1034,18 @@ static int snd_soc_init_platform(struct snd_soc_card *card,
         * this function should be removed in the future
         */
        /* convert Legacy platform link */
-        if (!platform) {
+        if (!platform || dai_link->legacy_platform) {
                platform = devm_kzalloc(card->dev,
                                sizeof(struct snd_soc_dai_link_component),
                                GFP_KERNEL);
                if (!platform)
                        return -ENOMEM;
-                dai_link->platform      = platform;
+                dai_link->platform        = platform;
-                platform->name          = dai_link->platform_name;
+                dai_link->legacy_platform = 1;
-                platform->of_node       = dai_link->platform_of_node;
+                platform->name            = dai_link->platform_name;
-                platform->dai_name      = NULL;
+                platform->of_node         = dai_link->platform_of_node;
+                platform->dai_name        = NULL;
        }
        /* if there's no platform we match on the empty platform */
@@ -1129,6 +1130,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                        link->name);
                return -EINVAL;
        }
+        /*
+         * Defer card registartion if platform dai component is not added to
+         * component list.
+         */
+        if ((link->platform->of_node || link->platform->name) &&
+            !soc_find_component(link->platform->of_node, link->platform->name))
+                return -EPROBE_DEFER;
        /*
         * CPU device may be specified by either name or OF node, but
         * can be left unspecified, and will be matched based on DAI
@@ -1140,6 +1150,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                        link->name);
                return -EINVAL;
        }
+        /*
+         * Defer card registartion if cpu dai component is not added to
+         * component list.
+         */
+        if ((link->cpu_of_node || link->cpu_name) &&
+            !soc_find_component(link->cpu_of_node, link->cpu_name))
+                return -EPROBE_DEFER;
        /*
         * At least one of CPU DAI name or CPU device name/node must be
         * specified
@@ -2739,15 +2758,18 @@ int snd_soc_register_card(struct snd_soc_card *card)
        if (!card->name || !card->dev)
                return -EINVAL;
+        mutex_lock(&client_mutex);
        for_each_card_prelinks(card, i, link) {
                ret = soc_init_dai_link(card, link);
                if (ret) {
                        dev_err(card->dev, "ASoC: failed to init link %s\n",
                                link->name);
+                        mutex_unlock(&client_mutex);
                        return ret;
                }
        }
+        mutex_unlock(&client_mutex);
        dev_set_drvdata(card->dev, card);
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index a5178845065b..2c4c13419539 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2019,19 +2019,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                out = is_connected_output_ep(w, NULL, NULL);
        }
-        ret = snprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
+        ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
                       w->name, w->power ? "On" : "Off",
                       w->force ? " (forced)" : "", in, out);
        if (w->reg >= 0)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                " - R%d(0x%x) mask 0x%x",
                                w->reg, w->reg, w->mask << w->shift);
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
        if (w->sname)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
                                w->sname,
                                w->active ? "active" : "inactive");
@@ -2044,7 +2044,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                        if (!p->connect)
                                continue;
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        " %s  \"%s\" \"%s\"\n",
                                        (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out",
                                        p->name ? p->name : "static",
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index eeda6d5565bc..a10fcb5963c6 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -108,7 +108,7 @@ struct davinci_mcasp {
        /* Used for comstraint setting on the second stream */
        u32     channels;
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        struct davinci_mcasp_context context;
 #endif
@@ -1486,74 +1486,6 @@ static int davinci_mcasp_dai_probe(struct snd_soc_dai *dai)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
-static int davinci_mcasp_suspend(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-        context->pm_state = pm_runtime_active(mcasp->dev);
-        if (!context->pm_state)
-                pm_runtime_get_sync(mcasp->dev);
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
-        }
-        for (i = 0; i < mcasp->num_serializer; i++)
-                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
-                                                DAVINCI_MCASP_XRSRCTL_REG(i));
-        pm_runtime_put_sync(mcasp->dev);
-        return 0;
-}
-static int davinci_mcasp_resume(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-        pm_runtime_get_sync(mcasp->dev);
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
-        }
-        for (i = 0; i < mcasp->num_serializer; i++)
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
-                              context->xrsr_regs[i]);
-        if (!context->pm_state)
-                pm_runtime_put_sync(mcasp->dev);
-        return 0;
-}
-#else
-#define davinci_mcasp_suspend NULL
-#define davinci_mcasp_resume NULL
-#endif
 #define DAVINCI_MCASP_RATES     SNDRV_PCM_RATE_8000_192000
 #define DAVINCI_MCASP_PCM_FMTS (SNDRV_PCM_FMTBIT_S8 | \
@@ -1571,8 +1503,6 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
        {
                .name           = "davinci-mcasp.0",
                .probe          = davinci_mcasp_dai_probe,
-                .suspend        = davinci_mcasp_suspend,
-                .resume         = davinci_mcasp_resume,
                .playback       = {
                        .channels_min   = 1,
                        .channels_max   = 32 * 16,
@@ -1976,7 +1906,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
        }
        mcasp->num_serializer = pdata->num_serializer;
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        mcasp->context.xrsr_regs = devm_kcalloc(&pdev->dev,
                                        mcasp->num_serializer, sizeof(u32),
                                        GFP_KERNEL);
@@ -2196,11 +2126,73 @@ static int davinci_mcasp_remove(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM
+static int davinci_mcasp_runtime_suspend(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
+        }
+        for (i = 0; i < mcasp->num_serializer; i++)
+                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
+                                                DAVINCI_MCASP_XRSRCTL_REG(i));
+        return 0;
+}
+static int davinci_mcasp_runtime_resume(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
+        }
+        for (i = 0; i < mcasp->num_serializer; i++)
+                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
+                              context->xrsr_regs[i]);
+        return 0;
+}
+#endif
+static const struct dev_pm_ops davinci_mcasp_pm_ops = {
+        SET_RUNTIME_PM_OPS(davinci_mcasp_runtime_suspend,
+                           davinci_mcasp_runtime_resume,
+                           NULL)
+};
 static struct platform_driver davinci_mcasp_driver = {
        .probe          = davinci_mcasp_probe,
        .remove         = davinci_mcasp_remove,
        .driver         = {
                .name   = "davinci-mcasp",
+                .pm     = &davinci_mcasp_pm_ops,
                .of_match_table = mcasp_dt_ids,
        },
 };
diff --git a/sound/soc/xilinx/Kconfig b/sound/soc/xilinx/Kconfig
index 25e287feb58c..723a583a8d57 100644
--- a/sound/soc/xilinx/Kconfig
+++ b/sound/soc/xilinx/Kconfig
@@ -1,5 +1,5 @@
 config SND_SOC_XILINX_I2S
-        tristate "Audio support for the the Xilinx I2S"
+        tristate "Audio support for the Xilinx I2S"
        help
          Select this option to enable Xilinx I2S Audio. This enables
          I2S playback and capture using xilinx soft IP. In transmitter
diff --git a/sound/soc/xilinx/xlnx_i2s.c b/sound/soc/xilinx/xlnx_i2s.c
index d4ae9eff41ce..8b353166ad44 100644
--- a/sound/soc/xilinx/xlnx_i2s.c
+++ b/sound/soc/xilinx/xlnx_i2s.c
@@ -1,12 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0
-/*
+//
- * Xilinx ASoC I2S audio support
+// Xilinx ASoC I2S audio support
- *
+//
- * Copyright (C) 2018 Xilinx, Inc.
+// Copyright (C) 2018 Xilinx, Inc.
- *
+//
- * Author: Praveen Vuppala <praveenv@xilinx.com>
+// Author: Praveen Vuppala <praveenv@xilinx.com>
- * Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
+// Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
- */
 #include <linux/io.h>
 #include <linux/module.h>
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ebbadb3a7094..7e65fe853ee3 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1492,6 +1492,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                break;
+        case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
        case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
        case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
        case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
@@ -1566,6 +1567,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
        case 0x20b1:  /* XMOS based devices */
        case 0x152a:  /* Thesycon devices */
        case 0x25ce:  /* Mytek devices */
+        case 0x2ab6:  /* T+A devices */
                if (fp->dsd_raw)
                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                break;
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d079f36d342d..ac221f137ed2 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -1681,13 +1681,8 @@ static void perf_sample__fprint_metric(struct perf_script *script,
                .force_header = false,
        };
        struct perf_evsel *ev2;
-        static bool init;
        u64 val;
-        if (!init) {
-                perf_stat__init_shadow_stats();
-                init = true;
-        }
        if (!evsel->stats)
                perf_evlist__alloc_stats(script->session->evlist, false);
        if (evsel_script(evsel->leader)->gnum++ == 0)
@@ -1794,7 +1789,7 @@ static void process_event(struct perf_script *script,
                return;
        }
-        if (PRINT_FIELD(TRACE)) {
+        if (PRINT_FIELD(TRACE) && sample->raw_data) {
                event_format__fprintf(evsel->tp_format, sample->cpu,
                                      sample->raw_data, sample->raw_size, fp);
        }
@@ -2359,6 +2354,8 @@ static int __cmd_script(struct perf_script *script)
        signal(SIGINT, sig_handler);
+        perf_stat__init_shadow_stats();
        /* override event processing functions */
        if (script->show_task_events) {
                script->tool.comm = process_comm_event;
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 1d00e5ec7906..82e16bf84466 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -224,20 +224,24 @@ static unsigned int annotate_browser__refresh(struct ui_browser *browser)
        return ret;
 }
-static int disasm__cmp(struct annotation_line *a, struct annotation_line *b)
+static double disasm__cmp(struct annotation_line *a, struct annotation_line *b,
+                                                  int percent_type)
 {
        int i;
        for (i = 0; i < a->data_nr; i++) {
-                if (a->data[i].percent == b->data[i].percent)
+                if (a->data[i].percent[percent_type] == b->data[i].percent[percent_type])
                        continue;
-                return a->data[i].percent < b->data[i].percent;
+                return a->data[i].percent[percent_type] -
+                           b->data[i].percent[percent_type];
        }
        return 0;
 }
-static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line *al)
+static void disasm_rb_tree__insert(struct annotate_browser *browser,
+                                struct annotation_line *al)
 {
+        struct rb_root *root = &browser->entries;
        struct rb_node **p = &root->rb_node;
        struct rb_node *parent = NULL;
        struct annotation_line *l;
@@ -246,7 +250,7 @@ static void disasm_rb_tree__insert(struct rb_root *root, struct annotation_line
                parent = *p;
                l = rb_entry(parent, struct annotation_line, rb_node);
-                if (disasm__cmp(al, l))
+                if (disasm__cmp(al, l, browser->opts->percent_type) < 0)
                        p = &(*p)->rb_left;
                else
                        p = &(*p)->rb_right;
@@ -329,7 +333,7 @@ static void annotate_browser__calc_percent(struct annotate_browser *browser,
                        RB_CLEAR_NODE(&pos->al.rb_node);
                        continue;
                }
-                disasm_rb_tree__insert(&browser->entries, &pos->al);
+                disasm_rb_tree__insert(browser, &pos->al);
        }
        pthread_mutex_unlock(&notes->lock);
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 1ccbd3342069..383674f448fc 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
        if (!cpu_list)
                return cpu_map__read_all_cpu_map();
-        if (!isdigit(*cpu_list))
+        /*
+         * must handle the case of empty cpumap to cover
+         * TOPOLOGY header for NUMA nodes with no CPU
+         * ( e.g., because of CPU hotplug)
+         */
+        if (!isdigit(*cpu_list) && *cpu_list != '\0')
                goto out;
        while (isdigit(*cpu_list)) {
@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
        if (nr_cpus > 0)
                cpus = cpu_map__trim_new(nr_cpus, tmp_cpus);
-        else
+        else if (*cpu_list != '\0')
                cpus = cpu_map__default_new();
+        else
+                cpus = cpu_map__dummy_new();
 invalid:
        free(tmp_cpus);
 out:
diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
index 897589507d97..ea523d3b248f 100644
--- a/tools/perf/util/ordered-events.c
+++ b/tools/perf/util/ordered-events.c
@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)
         * Current buffer might not have all the events allocated
         * yet, we need to free only allocated ones ...
         */
-        list_del(&oe->buffer->list);
+        if (oe->buffer) {
-        ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+                list_del(&oe->buffer->list);
+                ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
+        }
        /* ... and continue with the rest */
        list_for_each_entry_safe(buffer, tmp, &oe->to_free, list) {
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index 63f758c655d5..64d1f36dee99 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -17,6 +17,8 @@ if cc == "clang":
            vars[var] = sub("-mcet", "", vars[var])
        if not clang_has_option("-fcf-protection"):
            vars[var] = sub("-fcf-protection", "", vars[var])
+        if not clang_has_option("-fstack-clash-protection"):
+            vars[var] = sub("-fstack-clash-protection", "", vars[var])
 from distutils.core import setup, Extension
diff --git a/tools/testing/nvdimm/dimm_devs.c b/tools/testing/nvdimm/dimm_devs.c
index e75238404555..2d4baf57822f 100644
--- a/tools/testing/nvdimm/dimm_devs.c
+++ b/tools/testing/nvdimm/dimm_devs.c
@@ -18,8 +18,8 @@ ssize_t security_show(struct device *dev,
         * For the test version we need to poll the "hardware" in order
         * to get the updated status for unlock testing.
         */
-        nvdimm->sec.state = nvdimm_security_state(nvdimm, false);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
-        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, true);
+        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, NVDIMM_MASTER);
        switch (nvdimm->sec.state) {
        case NVDIMM_SECURITY_DISABLED:
diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index bab13dd025a6..0d26b5e3f966 100755
--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
@@ -37,6 +37,10 @@ prerequisite()
                exit $ksft_skip
        fi
+        present_cpus=`cat $SYSFS/devices/system/cpu/present`
+        present_max=${present_cpus##*-}
+        echo "present_cpus = $present_cpus present_max = $present_max"
        echo -e "\t Cpus in online state: $online_cpus"
        offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0
 online_max=0
 offline_cpus=0
 offline_max=0
+present_cpus=0
+present_max=0
 while getopts e:ahp: opt; do
        case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
        online_cpu_expect_success $online_max
        if [[ $offline_cpus -gt 0 ]]; then
-                echo -e "\t offline to online to offline: cpu $offline_max"
+                echo -e "\t offline to online to offline: cpu $present_max"
-                online_cpu_expect_success $offline_max
+                online_cpu_expect_success $present_max
-                offline_cpu_expect_success $offline_max
+                offline_cpu_expect_success $present_max
+                online_cpu $present_max
        fi
        exit 0
 else
diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
index f8d468f54e98..aaa1e9f083c3 100644
--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
        struct libmnt_table *tb;
        struct libmnt_iter *itr = NULL;
        struct libmnt_fs *fs;
-        int found = 0;
+        int found = 0, ret;
        cxt = mnt_new_context();
        if (!cxt)
@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
                        break;
                }
        }
-        if (found)
+        if (found) {
-                asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                if (ret < 0)
+                        err(EXIT_FAILURE, "failed to format string");
+        }
        mnt_free_iter(itr);
        mnt_free_context(cxt);
diff --git a/tools/testing/selftests/ir/Makefile b/tools/testing/selftests/ir/Makefile
index f4ba8eb84b95..ad06489c22a5 100644
--- a/tools/testing/selftests/ir/Makefile
+++ b/tools/testing/selftests/ir/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 TEST_PROGS := ir_loopback.sh
 TEST_GEN_PROGS_EXTENDED := ir_loopback
+APIDIR := ../../../include/uapi
+CFLAGS += -Wall -O2 -I$(APIDIR)
 include ../lib.mk
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 23022e9d32eb..b52cfdefecbf 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -571,7 +571,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
         * already exist.
         */
        region = (struct userspace_mem_region *) userspace_mem_region_find(
-                vm, guest_paddr, guest_paddr + npages * vm->page_size);
+                vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
        if (region != NULL)
                TEST_ASSERT(false, "overlapping userspace_mem_region already "
                        "exists\n"
@@ -587,15 +587,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
                region = region->next) {
                if (region->region.slot == slot)
                        break;
-                if ((guest_paddr <= (region->region.guest_phys_addr
-                                + region->region.memory_size))
-                        && ((guest_paddr + npages * vm->page_size)
-                                >= region->region.guest_phys_addr))
-                        break;
        }
        if (region != NULL)
                TEST_ASSERT(false, "A mem region with the requested slot "
-                        "or overlapping physical memory range already exists.\n"
+                        "already exists.\n"
                        "  requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
                        "  existing slot: %u paddr: 0x%lx size: 0x%lx",
                        slot, guest_paddr, npages,
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index ea3c73e8f4f6..c49c2a28b0eb 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -103,6 +103,12 @@ int main(int argc, char *argv[])
        vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
+        /* KVM should return supported EVMCS version range */
+        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
+                    (evmcs_ver & 0xff) > 0,
+                    "Incorrect EVMCS version range: %x:%x\n",
+                    evmcs_ver & 0xff, evmcs_ver >> 8);
        run = vcpu_state(vm, VCPU_ID);
        vcpu_regs_get(vm, VCPU_ID, &regs1);
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index f8f3e90700c0..1e6d14d2825c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -21,6 +21,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
 KSFT_KHDR_INSTALL := 1
 include ../lib.mk
-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
 $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8db35b99457c..71d7fdc513c1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -28,6 +28,19 @@ KEY_AES=0x0123456789abcdef0123456789012345
 SPI1=0x1
 SPI2=0x2
+do_esp_policy() {
+    local ns=$1
+    local me=$2
+    local remote=$3
+    local lnet=$4
+    local rnet=$5
+    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+    # to fwd decrypted packets after esp processing:
+    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+}
 do_esp() {
    local ns=$1
    local me=$2
@@ -40,10 +53,59 @@ do_esp() {
    ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA  mode tunnel sel src $rnet dst $lnet
    ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
-    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    do_esp_policy $ns $me $remote $lnet $rnet
-    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+}
-    # to fwd decrypted packets after esp processing:
-    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+# add policies with different netmasks, to make sure kernel carries
+# the policies contained within new netmask over when search tree is
+# re-built.
+# peer netns that are supposed to be encapsulated via esp have addresses
+# in the 10.0.1.0/24 and 10.0.2.0/24 subnets, respectively.
+#
+# Adding a policy for '10.0.1.0/23' will make it necessary to
+# alter the prefix of 10.0.1.0 subnet.
+# In case new prefix overlaps with existing node, the node and all
+# policies it carries need to be merged with the existing one(s).
+#
+# Do that here.
+do_overlap()
+{
+    local ns=$1
+    # adds new nodes to tree (neither network exists yet in policy database).
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+    # adds a new node in the 10.0.0.0/24 tree (dst node exists).
+    ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+    # adds a 10.2.0.0/23 node, but for different dst.
+    ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
+    # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
+    # kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
+    # But 10.0.0.0/23 also includes existing 10.0.1.0/24, so that node
+    # also has to be merged too, including source-sorted subtrees.
+    # old:
+    # 10.0.0.0/24 (node 1 in dst tree of the bin)
+    #    10.1.0.0/24 (node in src tree of dst node 1)
+    #    10.2.0.0/24 (node in src tree of dst node 1)
+    # 10.0.1.0/24 (node 2 in dst tree of the bin)
+    #    10.0.2.0/24 (node in src tree of dst node 2)
+    #    10.2.0.0/24 (node in src tree of dst node 2)
+    #
+    # The next 'policy add' adds dst '10.0.0.0/23', which means
+    # that dst node 1 and dst node 2 have to be merged including
+    # the sub-tree.  As no duplicates are allowed, policies in
+    # the two '10.0.2.0/24' are also merged.
+    #
+    # after the 'add', internal search tree should look like this:
+    # 10.0.0.0/23 (node in dst tree of bin)
+    #     10.0.2.0/24 (node in src tree of dst node)
+    #     10.1.0.0/24 (node in src tree of dst node)
+    #     10.2.0.0/24 (node in src tree of dst node)
+    #
+    # 10.0.0.0/24 and 10.0.1.0/24 nodes have been merged as 10.0.0.0/23.
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
 }
 do_esp_policy_get_check() {
@@ -160,6 +222,41 @@ check_xfrm() {
        return $lret
 }
+check_exceptions()
+{
+        logpostfix="$1"
+        local lret=0
+        # ping to .254 should be excluded from the tunnel (exception is in place).
+        check_xfrm 0 254
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .254 to fail ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
+        fi
+        # ping to .253 should use use ipsec due to direct policy exception.
+        check_xfrm 1 253
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: direct policy matches ($logpostfix)"
+        fi
+        # ping to .2 should use ipsec.
+        check_xfrm 1 2
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .2 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: policy matches ($logpostfix)"
+        fi
+        return $lret
+}
 #check for needed privileges
 if [ "$(id -u)" -ne 0 ];then
        echo "SKIP: Need root privileges"
@@ -270,33 +367,45 @@ do_exception ns4 10.0.3.10 10.0.3.1 10.0.1.253 10.0.1.240/28
 do_exception ns3 dead:3::1 dead:3::10 dead:2::fd  dead:2:f0::/96
 do_exception ns4 dead:3::10 dead:3::1 dead:1::fd  dead:1:f0::/96
-# ping to .254 should now be excluded from the tunnel
+check_exceptions "exceptions"
-check_xfrm 0 254
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .254 to fail"
        ret=1
-else
-        echo "PASS: ping to .254 bypassed ipsec tunnel"
 fi
-# ping to .253 should use use ipsec due to direct policy exception.
+# insert block policies with adjacent/overlapping netmasks
-check_xfrm 1 253
+do_overlap ns3
-if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .253 to use ipsec tunnel"
-        ret=1
-else
-        echo "PASS: direct policy matches"
-fi
-# ping to .2 should use ipsec.
+check_exceptions "exceptions and block policies"
-check_xfrm 1 2
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .2 to use ipsec tunnel"
        ret=1
-else
-        echo "PASS: policy matches"
 fi
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
+        sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh changes"
+# full flush of policy db, check everything gets freed incl. internal meta data
+ip -net ns3 xfrm policy flush
+do_esp_policy ns3 10.0.3.1 10.0.3.10 10.0.1.0/24 10.0.2.0/24
+do_exception ns3 10.0.3.1 10.0.3.10 10.0.2.253 10.0.2.240/28
+# move inexact policies to hash table
+ip -net ns3 xfrm policy set hthresh4 16 16
+sleep $((RANDOM%5))
+check_exceptions "exceptions and block policies after hthresh change in ns3"
+# restore original hthresh settings -- move policies back to tables
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
+        sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh change to normal"
 for i in 1 2 3 4;do ip netns del ns$i;done
 exit $ret
diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
index 82121a81681f..29bac5ef9a93 100644
--- a/tools/testing/selftests/proc/.gitignore
+++ b/tools/testing/selftests/proc/.gitignore
@@ -10,4 +10,5 @@
 /proc-uptime-002
 /read
 /self
+/setns-dcache
 /thread-self
diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
index 1c12c34cf85d..434d033ee067 100644
--- a/tools/testing/selftests/proc/Makefile
+++ b/tools/testing/selftests/proc/Makefile
@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001
 TEST_GEN_PROGS += proc-uptime-002
 TEST_GEN_PROGS += read
 TEST_GEN_PROGS += self
+TEST_GEN_PROGS += setns-dcache
 TEST_GEN_PROGS += thread-self
 include ../lib.mk
diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c
new file mode 100644
index 000000000000..60ab197a73fc
--- /dev/null
+++ b/tools/testing/selftests/proc/setns-dcache.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright © 2019 Alexey Dobriyan <adobriyan@gmail.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+/*
+ * Test that setns(CLONE_NEWNET) points to new /proc/net content even
+ * if old one is in dcache.
+ *
+ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled.
+ */
+#undef NDEBUG
+#include <assert.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+static pid_t pid = -1;
+static void f(void)
+{
+        if (pid > 0) {
+                kill(pid, SIGTERM);
+        }
+}
+int main(void)
+{
+        int fd[2];
+        char _ = 0;
+        int nsfd;
+        atexit(f);
+        /* Check for priviledges and syscall availability straight away. */
+        if (unshare(CLONE_NEWNET) == -1) {
+                if (errno == ENOSYS || errno == EPERM) {
+                        return 4;
+                }
+                return 1;
+        }
+        /* Distinguisher between two otherwise empty net namespaces. */
+        if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) {
+                return 1;
+        }
+        if (pipe(fd) == -1) {
+                return 1;
+        }
+        pid = fork();
+        if (pid == -1) {
+                return 1;
+        }
+        if (pid == 0) {
+                if (unshare(CLONE_NEWNET) == -1) {
+                        return 1;
+                }
+                if (write(fd[1], &_, 1) != 1) {
+                        return 1;
+                }
+                pause();
+                return 0;
+        }
+        if (read(fd[0], &_, 1) != 1) {
+                return 1;
+        }
+        {
+                char buf[64];
+                snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid);
+                nsfd = open(buf, O_RDONLY);
+                if (nsfd == -1) {
+                        return 1;
+                }
+        }
+        /* Reliably pin dentry into dcache. */
+        (void)open("/proc/net/unix", O_RDONLY);
+        if (setns(nsfd, CLONE_NEWNET) == -1) {
+                return 1;
+        }
+        kill(pid, SIGTERM);
+        pid = 0;
+        {
+                char buf[4096];
+                ssize_t rv;
+                int fd;
+                fd = open("/proc/net/unix", O_RDONLY);
+                if (fd == -1) {
+                        return 1;
+                }
+#define S "Num       RefCount Protocol Flags    Type St Inode Path\n"
+                rv = read(fd, buf, sizeof(buf));
+                assert(rv == strlen(S));
+                assert(memcmp(buf, S, strlen(S)) == 0);
+        }
+        return 0;
+}
diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
index e20b017e7073..b2065536d407 100644
--- a/tools/testing/selftests/rtc/rtctest.c
+++ b/tools/testing/selftests/rtc/rtctest.c
@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
        ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
        /* Disable alarm interrupts */
        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
        ASSERT_NE(-1, rc);
-        if (rc == 0)
-                return;
        rc = read(self->fd, &data, sizeof(unsigned long));
        ASSERT_NE(-1, rc);
        TH_LOG("data: %lx", data);
@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) {
        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
        ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+TEST_F(rtc, alarm_alm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        unsigned long data;
+        struct rtc_time tm;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
+        gmtime_r(&secs, (struct tm *)&tm);
+        rc = ioctl(self->fd, RTC_ALM_SET, &tm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+        rc = ioctl(self->fd, RTC_ALM_READ, &tm);
+        ASSERT_NE(-1, rc);
+        TH_LOG("Alarm time now set to %02d:%02d:%02d.",
+               tm.tm_hour, tm.tm_min, tm.tm_sec);
+        /* Enable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_ON, 0);
+        ASSERT_NE(-1, rc);
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
+        /* Disable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+        ASSERT_NE(-1, rc);
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        TH_LOG("data: %lx", data);
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+TEST_F(rtc, alarm_wkalm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        struct rtc_wkalrm alarm = { 0 };
+        struct rtc_time tm;
+        unsigned long data;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+        rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
+        ASSERT_NE(-1, rc);
+        secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
+        gmtime_r(&secs, (struct tm *)&alarm.time);
+        alarm.enabled = 1;
+        rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+        rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
+        ASSERT_NE(-1, rc);
+        TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
+               alarm.time.tm_mday, alarm.time.tm_mon + 1,
+               alarm.time.tm_year + 1900, alarm.time.tm_hour,
+               alarm.time.tm_min, alarm.time.tm_sec);
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
        rc = read(self->fd, &data, sizeof(unsigned long));
        ASSERT_NE(-1, rc);
diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index fce7f4ce0692..1760b3e39730 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
 CFLAGS += -Wl,-no-as-needed -Wall
 seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
-        $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+        $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
 TEST_PROGS += $(BINARIES)
 EXTRA_CLEAN := $(BINARIES)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 067cb4607d6c..7e632b465ab4 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 #ifdef SYSCALL_NUM_RET_SHARE_REG
 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
 #else
-# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+# define EXPECT_SYSCALL_RETURN(val, action)             \
+        do {                                            \
+                errno = 0;                              \
+                if (val < 0) {                          \
+                        EXPECT_EQ(-1, action);          \
+                        EXPECT_EQ(-(val), errno);       \
+                } else {                                \
+                        EXPECT_EQ(val, action);         \
+                }                                       \
+        } while (0)
 #endif
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
 /* Architecture-specific syscall changing routine. */
 void change_syscall(struct __test_metadata *_metadata,
-                    pid_t tracee, int syscall)
+                    pid_t tracee, int syscall, int result)
 {
        int ret;
        ARCH_REGS regs;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = EPERM;
+                regs.SYSCALL_RET = result;
 #endif
 #ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
        case 0x1002:
                /* change getpid to getppid. */
                EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
                break;
        case 0x1003:
-                /* skip gettid. */
+                /* skip gettid with valid return code. */
                EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, 45000);
                break;
        case 0x1004:
+                /* skip openat with error. */
+                EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
+                change_syscall(_metadata, tracee, -1, -ESRCH);
+                break;
+        case 0x1005:
                /* do nothing (allow getppid) */
                EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                break;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
        nr = get_syscall(_metadata, tracee);
        if (nr == __NR_getpid)
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
+        if (nr == __NR_gettid)
+                change_syscall(_metadata, tracee, -1, 45000);
        if (nr == __NR_openat)
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, -ESRCH);
 }
 FIXTURE_DATA(TRACE_syscall) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
        };
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
        EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+TEST_F(TRACE_syscall, ptrace_syscall_errno)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+        /* Tracer should skip the open syscall, resulting in ESRCH. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+TEST_F(TRACE_syscall, ptrace_syscall_faked)
 {
        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
        teardown_trace_fixture(_metadata, self->tracer);
        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
                                           true);
-        /* Tracer should skip the open syscall, resulting in EPERM. */
+        /* Tracer should skip the gettid syscall, resulting fake pid. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 TEST_F(TRACE_syscall, syscall_allowed)
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
        EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
-TEST_F(TRACE_syscall, syscall_dropped)
+TEST_F(TRACE_syscall, syscall_errno)
+{
+        long ret;
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
+        ASSERT_EQ(0, ret);
+        /* openat has been skipped and an errno return. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+TEST_F(TRACE_syscall, syscall_faked)
 {
        long ret;
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
        ASSERT_EQ(0, ret);
        /* gettid has been skipped and an altered return value stored. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
-        EXPECT_NE(self->mytid, syscall(__NR_gettid));
 }
 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
@@ -3044,7 +3086,7 @@ TEST(user_notification_basic)
        /* Check that the basic notification machinery works */
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /* Installing a second listener in the chain should EBUSY */
        EXPECT_EQ(user_trap_syscall(__NR_getpid,
@@ -3103,7 +3145,7 @@ TEST(user_notification_kill_in_middle)
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /*
         * Check that nothing bad happens when we kill the task in the middle
@@ -3152,7 +3194,7 @@ TEST(user_notification_signal)
        listener = user_trap_syscall(__NR_gettid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        pid = fork();
        ASSERT_GE(pid, 0);
@@ -3215,7 +3257,7 @@ TEST(user_notification_closed_listener)
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /*
         * Check that we get an ENOSYS when the listener is closed.
@@ -3376,7 +3418,7 @@ TEST(seccomp_get_notif_sizes)
 {
        struct seccomp_notif_sizes sizes;
-        EXPECT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
+        ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
        EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
        EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
 }
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index c02683cfb6c9..7656c7ce79d9 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS += -O3 -Wl,-no-as-needed -Wall
-LDFLAGS += -lrt -lpthread -lm
+LDLIBS += -lrt -lpthread -lm
 # these are all "safe" tests that don't modify
 # system time or require escalated privileges
diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index 880b96fc80d4..c0534e298b51 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -25,6 +25,7 @@ struct gup_benchmark {
        __u64 size;
        __u32 nr_pages_per_call;
        __u32 flags;
+        __u64 expansion[10];    /* For future use */
 };
 int main(int argc, char **argv)
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index 50f7e9272481..bf1bb15b6fbe 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -1503,7 +1503,7 @@ exit:
                exit(20);
        }
        if (successes != total_nr_tests) {
-                eprintf("ERROR: succeded fewer than number of tries (%d != %d)\n",
+                eprintf("ERROR: succeeded fewer than number of tries (%d != %d)\n",
                                successes, total_nr_tests);
                exit(21);
        }
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index 460b4bdf4c1e..5d546dcdbc80 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -1133,6 +1133,21 @@ void test_pkey_syscalls_bad_args(int *ptr, u16 pkey)
        pkey_assert(err);
 }
+void become_child(void)
+{
+        pid_t forkret;
+        forkret = fork();
+        pkey_assert(forkret >= 0);
+        dprintf3("[%d] fork() ret: %d\n", getpid(), forkret);
+        if (!forkret) {
+                /* in the child */
+                return;
+        }
+        exit(0);
+}
 /* Assumes that all pkeys other than 'pkey' are unallocated */
 void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
 {
@@ -1141,7 +1156,7 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
        int nr_allocated_pkeys = 0;
        int i;
-        for (i = 0; i < NR_PKEYS*2; i++) {
+        for (i = 0; i < NR_PKEYS*3; i++) {
                int new_pkey;
                dprintf1("%s() alloc loop: %d\n", __func__, i);
                new_pkey = alloc_pkey();
@@ -1152,21 +1167,27 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
                if ((new_pkey == -1) && (errno == ENOSPC)) {
                        dprintf2("%s() failed to allocate pkey after %d tries\n",
                                __func__, nr_allocated_pkeys);
-                        break;
+                } else {
+                        /*
+                         * Ensure the number of successes never
+                         * exceeds the number of keys supported
+                         * in the hardware.
+                         */
+                        pkey_assert(nr_allocated_pkeys < NR_PKEYS);
+                        allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
                }
-                pkey_assert(nr_allocated_pkeys < NR_PKEYS);
-                allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
+                /*
+                 * Make sure that allocation state is properly
+                 * preserved across fork().
+                 */
+                if (i == NR_PKEYS*2)
+                        become_child();
        }
        dprintf3("%s()::%d\n", __func__, __LINE__);
        /*
-         * ensure it did not reach the end of the loop without
-         * failure:
-         */
-        pkey_assert(i < NR_PKEYS*2);
-        /*
         * There are 16 pkeys supported in hardware.  Three are
         * allocated by the time we get here:
         *   1. The default key (0)
diff --git a/tools/testing/selftests/x86/unwind_vdso.c b/tools/testing/selftests/x86/unwind_vdso.c
index 00a26a82fa98..97311333700e 100644
--- a/tools/testing/selftests/x86/unwind_vdso.c
+++ b/tools/testing/selftests/x86/unwind_vdso.c
@@ -44,7 +44,6 @@ int main()
 #include <stdbool.h>
 #include <sys/ptrace.h>
 #include <sys/user.h>
-#include <sys/ucontext.h>
 #include <link.h>
 #include <sys/auxv.h>
 #include <dlfcn.h>
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 5ecea812cb6a..585845203db8 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3000,8 +3000,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
        if (ops->init)
                ops->init(dev);
+        kvm_get_kvm(kvm);
        ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
        if (ret < 0) {
+                kvm_put_kvm(kvm);
                mutex_lock(&kvm->lock);
                list_del(&dev->vm_node);
                mutex_unlock(&kvm->lock);
@@ -3009,7 +3011,6 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
                return ret;
        }
-        kvm_get_kvm(kvm);
        cd->fd = ret;
        return 0;
 }