Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Fun set of conflict resolutions here... For the mac80211 stuff, these were fortunately just parallel adds. Trivially resolved. In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the function phy_disable_interrupts() earlier in the file, whilst in 'net-next' the phy_error() call from this function was removed. In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the 'rt_table_id' member of rtable collided with a bug fix in 'net' that added a new struct member "rt_mtu_locked" which needs to be copied over here. The mlxsw driver conflict consisted of net-next separating the span code and definitions into separate files, whilst a 'net' bug fix made some changes to that moved code. The mlx5 infiniband conflict resolution was quite non-trivial, the RDMA tree's merge commit was used as a guide here, and here are their notes: ==================== Due to bug fixes found by the syzkaller bot and taken into the for-rc branch after development for the 4.17 merge window had already started being taken into the for-next branch, there were fairly non-trivial merge issues that would need to be resolved between the for-rc branch and the for-next branch. This merge resolves those conflicts and provides a unified base upon which ongoing development for 4.17 can be based. Conflicts: drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524 (IB/mlx5: Fix cleanup order on unload) added to for-rc and commit b5ca15ad7e61 (IB/mlx5: Add proper representors support) add as part of the devel cycle both needed to modify the init/de-init functions used by mlx5. To support the new representors, the new functions added by the cleanup patch needed to be made non-static, and the init/de-init list added by the representors patch needed to be modified to match the init/de-init list changes made by the cleanup patch. Updates: drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function prototypes added by representors patch to reflect new function names as changed by cleanup patch drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init stage list to match new order from cleanup patch ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
author: David S. Miller <davem@davemloft.net> 2018-03-23 11:24:57 -0400
committer: David S. Miller <davem@davemloft.net> 2018-03-23 11:31:58 -0400
commit: 03fe2debbb2771fb90881e4ce8109b09cf772a5c (patch)
tree: fbaf8738296b2e9dcba81c6daef2d515b6c4948c
parent: 6686c459e1449a3ee5f3fd313b0a559ace7a700e (diff)
parent: f36b7534b83357cf52e747905de6d65b4f7c2512 (diff)
636 files changed, 6274 insertions, 4191 deletions
diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
index aa4296498859..9ab0ef1dd1c7 100644
--- a/Documentation/ABI/testing/sysfs-ata
+++ b/Documentation/ABI/testing/sysfs-ata
@@ -1,110 +1,139 @@
 What:           /sys/class/ata_...
-Date:           August 2008
-Contact:        Gwendal Grignou<gwendal@google.com>
 Description:
+                Provide a place in sysfs for storing the ATA topology of the
-Provide a place in sysfs for storing the ATA topology of the system.  This allows
+                system. This allows retrieving various information about ATA
-retrieving various information about ATA objects.
+                objects.
 Files under /sys/class/ata_port
 -------------------------------
-        For each port, a directory ataX is created where X is the ata_port_id of
+For each port, a directory ataX is created where X is the ata_port_id of the
-        the port. The device parent is the ata host device.
+port. The device parent is the ata host device.
-idle_irq (read)
-        Number of IRQ received by the port while idle [some ata HBA only].
+What:           /sys/class/ata_port/ataX/nr_pmp_links
+What:           /sys/class/ata_port/ataX/idle_irq
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                nr_pmp_links:   (RO) If a SATA Port Multiplier (PM) is
+                                connected, the number of links behind it.
-nr_pmp_links (read)
+                idle_irq:       (RO) Number of IRQ received by the port while
+                                idle [some ata HBA only].
-        If a SATA Port Multiplier (PM) is connected, number of link behind it.
+What:           /sys/class/ata_port/ataX/port_no
+Date:           May, 2013
+KernelVersion:  v3.11
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                (RO) Host local port number. While registering host controller,
+                port numbers are tracked based upon number of ports available on
+                the controller. This attribute is needed by udev for composing
+                persistent links in /dev/disk/by-path.
 Files under /sys/class/ata_link
 -------------------------------
-        Behind each port, there is a ata_link. If there is a SATA PM in the
+Behind each port, there is a ata_link. If there is a SATA PM in the topology, 15
-        topology, 15 ata_link objects are created.
+ata_link objects are created.
-        If a link is behind a port, the directory name is linkX, where X is
-        ata_port_id of the port.
-        If a link is behind a PM, its name is linkX.Y where X is ata_port_id
-        of the parent port and Y the PM port.
-hw_sata_spd_limit
+If a link is behind a port, the directory name is linkX, where X is ata_port_id
+of the port. If a link is behind a PM, its name is linkX.Y where X is
+ata_port_id of the parent port and Y the PM port.
-        Maximum speed supported by the connected SATA device.
-sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/hw_sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/sata_spd
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                hw_sata_spd_limit:      (RO) Maximum speed supported by the
+                                        connected SATA device.
-        Maximum speed imposed by libata.
+                sata_spd_limit:         (RO) Maximum speed imposed by libata.
-sata_spd
+                sata_spd:               (RO) Current speed of the link
+                                        eg. 1.5, 3 Gbps etc.
-        Current speed of the link [1.5, 3Gps,...].
 Files under /sys/class/ata_device
 ---------------------------------
-        Behind each link, up to two ata device are created.
+Behind each link, up to two ata devices are created.
-        The name of the directory is devX[.Y].Z where:
+The name of the directory is devX[.Y].Z where:
-        - X is ata_port_id of the port where the device is connected,
+- X is ata_port_id of the port where the device is connected,
-        - Y the port of the PM if any, and
+- Y the port of the PM if any, and
-        - Z the device id: for PATA, there is usually 2 devices [0,1],
+- Z the device id: for PATA, there is usually 2 devices [0,1], only 1 for SATA.
-        only 1 for SATA.
-class
+What:           /sys/class/ata_device/devX[.Y].Z/spdn_cnt
-        Device class. Can be "ata" for disk, "atapi" for packet device,
+What:           /sys/class/ata_device/devX[.Y].Z/gscr
-        "pmp" for PM, or "none" if no device was found behind the link.
+What:           /sys/class/ata_device/devX[.Y].Z/ering
+What:           /sys/class/ata_device/devX[.Y].Z/id
-dma_mode
+What:           /sys/class/ata_device/devX[.Y].Z/pio_mode
+What:           /sys/class/ata_device/devX[.Y].Z/xfer_mode
+What:           /sys/class/ata_device/devX[.Y].Z/dma_mode
+What:           /sys/class/ata_device/devX[.Y].Z/class
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                spdn_cnt:       (RO) Number of times libata decided to lower the
+                                speed of link due to errors.
-        Transfer modes supported by the device when in DMA mode.
+                gscr:           (RO) Cached result of the dump of PM GSCR
-        Mostly used by PATA device.
+                                register. Valid registers are:
-pio_mode
+                                0:      SATA_PMP_GSCR_PROD_ID,
+                                1:      SATA_PMP_GSCR_REV,
+                                2:      SATA_PMP_GSCR_PORT_INFO,
+                                32:     SATA_PMP_GSCR_ERROR,
+                                33:     SATA_PMP_GSCR_ERROR_EN,
+                                64:     SATA_PMP_GSCR_FEAT,
+                                96:     SATA_PMP_GSCR_FEAT_EN,
+                                130:    SATA_PMP_GSCR_SII_GPIO
-        Transfer modes supported by the device when in PIO mode.
+                                Only valid if the device is a PM.
-        Mostly used by PATA device.
-xfer_mode
+                ering:          (RO) Formatted output of the error ring of the
+                                device.
-        Current transfer mode.
+                id:             (RO) Cached result of IDENTIFY command, as
+                                described in ATA8 7.16 and 7.17. Only valid if
+                                the device is not a PM.
-id
+                pio_mode:       (RO) Transfer modes supported by the device when
+                                in PIO mode. Mostly used by PATA device.
-        Cached result of IDENTIFY command, as described in ATA8 7.16 and 7.17.
+                xfer_mode:      (RO) Current transfer mode
-        Only valid if the device is not a PM.
-gscr
+                dma_mode:       (RO) Transfer modes supported by the device when
+                                in DMA mode. Mostly used by PATA device.
-        Cached result of the dump of PM GSCR register.
+                class:          (RO) Device class. Can be "ata" for disk,
-        Valid registers are:
+                                "atapi" for packet device, "pmp" for PM, or
-        0:      SATA_PMP_GSCR_PROD_ID,
+                                "none" if no device was found behind the link.
-        1:      SATA_PMP_GSCR_REV,
-        2:      SATA_PMP_GSCR_PORT_INFO,
-        32:     SATA_PMP_GSCR_ERROR,
-        33:     SATA_PMP_GSCR_ERROR_EN,
-        64:     SATA_PMP_GSCR_FEAT,
-        96:     SATA_PMP_GSCR_FEAT_EN,
-        130:    SATA_PMP_GSCR_SII_GPIO
-        Only valid if the device is a PM.
-trim
-        Shows the DSM TRIM mode currently used by the device. Valid
+What:           /sys/class/ata_device/devX[.Y].Z/trim
-        values are:
+Date:           May, 2015
-        unsupported:            Drive does not support DSM TRIM
+KernelVersion:  v4.10
-        unqueued:               Drive supports unqueued DSM TRIM only
+Contact:        Gwendal Grignou <gwendal@chromium.org>
-        queued:                 Drive supports queued DSM TRIM
+Description:
-        forced_unqueued:        Drive's queued DSM support is known to be
+                (RO) Shows the DSM TRIM mode currently used by the device. Valid
-                                buggy and only unqueued TRIM commands
+                values are:
-                                are sent
-spdn_cnt
+                unsupported:            Drive does not support DSM TRIM
-        Number of time libata decided to lower the speed of link due to errors.
+                unqueued:               Drive supports unqueued DSM TRIM only
-ering
+                queued:                 Drive supports queued DSM TRIM
-        Formatted output of the error ring of the device.
+                forced_unqueued:        Drive's queued DSM support is known to
+                                        be buggy and only unqueued TRIM commands
+                                        are sent
diff --git a/Documentation/ABI/testing/sysfs-block-device b/Documentation/ABI/testing/sysfs-block-device
new file mode 100644
index 000000000000..82ef6eab042d
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-block-device
@@ -0,0 +1,58 @@
+What:           /sys/block/*/device/sw_activity
+Date:           Jun, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Used by drivers which support software controlled activity
+                LEDs.
+                It has the following valid values:
+                0       OFF - the LED is not activated on activity
+                1       BLINK_ON - the LED blinks on every 10ms when activity is
+                        detected.
+                2       BLINK_OFF - the LED is on when idle, and blinks off
+                        every 10ms when activity is detected.
+                Note that the user must turn sw_activity OFF it they wish to
+                control the activity LED via the em_message file.
+What:           /sys/block/*/device/unload_heads
+Date:           Sep, 2008
+KernelVersion:  v2.6.28
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Hard disk shock protection
+                Writing an integer value to this file will take the heads of the
+                respective drive off the platter and block all I/O operations
+                for the specified number of milliseconds.
+                - If the device does not support the unload heads feature,
+                  access is denied with -EOPNOTSUPP.
+                - The maximal value accepted for a timeout is 30000
+                  milliseconds.
+                - A previously set timeout can be cancelled and disk can resume
+                  normal operation immediately by specifying a timeout of 0.
+                - Some hard drives only comply with an earlier version of the
+                  ATA standard, but support the unload feature nonetheless.
+                  There is no safe way Linux can detect these devices, so this
+                  is not enabled by default. If it is known that your device
+                  does support the unload feature, then you can tell the kernel
+                  to enable it by writing -1. It can be disabled again by
+                  writing -2.
+                - Values below -2 are rejected with -EINVAL
+                For more information, see
+                Documentation/laptops/disk-shock-protection.txt
+What:           /sys/block/*/device/ncq_prio_enable
+Date:           Oct, 2016
+KernelVersion:  v4.10
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Write to the file to turn on or off the SATA ncq (native
+                command queueing) support. By default this feature is turned
+                off.
diff --git a/Documentation/ABI/testing/sysfs-class-scsi_host b/Documentation/ABI/testing/sysfs-class-scsi_host
index 0eb255e7db12..bafc59fd7b69 100644
--- a/Documentation/ABI/testing/sysfs-class-scsi_host
+++ b/Documentation/ABI/testing/sysfs-class-scsi_host
@@ -27,3 +27,92 @@ Description:	This file contains the current status of the "SSD Smart Path"
                the direct i/o path to physical devices.  This setting is
                controller wide, affecting all configured logical drives on the
                controller.  This file is readable and writable.
+What:           /sys/class/scsi_host/hostX/link_power_management_policy
+Date:           Oct, 2007
+KernelVersion:  v2.6.24
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) This parameter allows the user to read and set the link
+                (interface) power management.
+                There are four possible options:
+                min_power: Tell the controller to try to make the link use the
+                least possible power when possible. This may sacrifice some
+                performance due to increased latency when coming out of lower
+                power states.
+                max_performance: Generally, this means no power management.
+                Tell the controller to have performance be a priority over power
+                management.
+                medium_power: Tell the controller to enter a lower power state
+                when possible, but do not enter the lowest power state, thus
+                improving latency over min_power setting.
+                med_power_with_dipm: Identical to the existing medium_power
+                setting except that it enables dipm (device initiated power
+                management) on top, which makes it match the Windows IRST (Intel
+                Rapid Storage Technology) driver settings. This setting is also
+                close to min_power, except that:
+                a) It does not use host-initiated slumber mode, but it does
+                allow device-initiated slumber
+                b) It does not enable low power device sleep mode (DevSlp).
+What:           /sys/class/scsi_host/hostX/em_message
+What:           /sys/class/scsi_host/hostX/em_message_type
+Date:           Jun, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-ide@vger.kernel.org
+Description:
+                em_message: (RW) Enclosure management support. For the LED
+                protocol, writes and reads correspond to the LED message format
+                as defined in the AHCI spec.
+                The user must turn sw_activity (under /sys/block/*/device/) OFF
+                it they wish to control the activity LED via the em_message
+                file.
+                em_message_type: (RO) Displays the current enclosure management
+                protocol that is being used by the driver (for eg. LED, SAF-TE,
+                SES-2, SGPIO etc).
+What:           /sys/class/scsi_host/hostX/ahci_port_cmd
+What:           /sys/class/scsi_host/hostX/ahci_host_caps
+What:           /sys/class/scsi_host/hostX/ahci_host_cap2
+Date:           Mar, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                [to be documented]
+What:           /sys/class/scsi_host/hostX/ahci_host_version
+Date:           Mar, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RO) Display the version of the AHCI spec implemented by the
+                host.
+What:           /sys/class/scsi_host/hostX/em_buffer
+Date:           Apr, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Allows access to AHCI EM (enclosure management) buffer
+                directly if the host supports EM.
+                For eg. the AHCI driver supports SGPIO EM messages but the
+                SATA/AHCI specs do not define the SGPIO message format of the EM
+                buffer. Different hardware(HW) vendors may have different
+                definitions. With the em_buffer attribute, this issue can be
+                solved by allowing HW vendors to provide userland drivers and
+                tools for their SGPIO initiators.
+What:           /sys/class/scsi_host/hostX/em_message_supported
+Date:           Oct, 2009
+KernelVersion:  v2.6.39
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RO) Displays supported enclosure management message types.
diff --git a/Documentation/accelerators/ocxl.rst b/Documentation/accelerators/ocxl.rst
index 4f7af841d935..ddcc58d01cfb 100644
--- a/Documentation/accelerators/ocxl.rst
+++ b/Documentation/accelerators/ocxl.rst
@@ -152,6 +152,11 @@ OCXL_IOCTL_IRQ_SET_FD:
  Associate an event fd to an AFU interrupt so that the user process
  can be notified when the AFU sends an interrupt.
+OCXL_IOCTL_GET_METADATA:
+  Obtains configuration information from the card, such at the size of
+  MMIO areas, the AFU version, and the PASID for the current context.
 mmap
 ----
diff --git a/Documentation/devicetree/bindings/display/exynos/exynos_hdmi.txt b/Documentation/devicetree/bindings/display/exynos/exynos_hdmi.txt
index 6394ea9e3b9e..58b12e25bbb1 100644
--- a/Documentation/devicetree/bindings/display/exynos/exynos_hdmi.txt
+++ b/Documentation/devicetree/bindings/display/exynos/exynos_hdmi.txt
@@ -16,6 +16,7 @@ Required properties:
 - ddc: phandle to the hdmi ddc node
 - phy: phandle to the hdmi phy node
 - samsung,syscon-phandle: phandle for system controller node for PMU.
+- #sound-dai-cells: should be 0.
 Required properties for Exynos 4210, 4212, 5420 and 5433:
 - clocks: list of clock IDs from SoC clock driver.
diff --git a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
index 217a90eaabe7..9c38bbe7e6d7 100644
--- a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
+++ b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
@@ -11,7 +11,11 @@ Required properties:
  interrupts.
 Optional properties:
- clocks: Optional reference to the clock used by the XOR engine.
+- clocks: Optional reference to the clocks used by the XOR engine.
+- clock-names: mandatory if there is a second clock, in this case the
+   name must be "core" for the first clock and "reg" for the second
+   one
 Example:
diff --git a/Documentation/devicetree/bindings/net/dsa/marvell.txt b/Documentation/devicetree/bindings/net/dsa/marvell.txt
index caf71e2fe24a..60d50a2b0323 100644
--- a/Documentation/devicetree/bindings/net/dsa/marvell.txt
+++ b/Documentation/devicetree/bindings/net/dsa/marvell.txt
@@ -59,14 +59,15 @@ Example:
                        compatible = "marvell,mv88e6085";
                        reg = <0>;
                        reset-gpios = <&gpio5 1 GPIO_ACTIVE_LOW>;
-                };
-                mdio {
+                        mdio {
-                        #address-cells = <1>;
+                                #address-cells = <1>;
-                        #size-cells = <0>;
+                                #size-cells = <0>;
-                        switch1phy0: switch1phy0@0 {
+                                switch1phy0: switch1phy0@0 {
-                                reg = <0>;
+                                        reg = <0>;
-                                interrupt-parent = <&switch0>;
+                                        interrupt-parent = <&switch0>;
-                                interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+                                        interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+                                };
                        };
                };
        };
@@ -83,23 +84,24 @@ Example:
                        compatible = "marvell,mv88e6390";
                        reg = <0>;
                        reset-gpios = <&gpio5 1 GPIO_ACTIVE_LOW>;
-                };
-                mdio {
+                        mdio {
-                        #address-cells = <1>;
+                                #address-cells = <1>;
-                        #size-cells = <0>;
+                                #size-cells = <0>;
-                        switch1phy0: switch1phy0@0 {
+                                switch1phy0: switch1phy0@0 {
-                                reg = <0>;
+                                        reg = <0>;
-                                interrupt-parent = <&switch0>;
+                                        interrupt-parent = <&switch0>;
-                                interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+                                        interrupts = <0 IRQ_TYPE_LEVEL_HIGH>;
+                                };
                        };
-                };
-                mdio1 {
+                        mdio1 {
-                        compatible = "marvell,mv88e6xxx-mdio-external";
+                                compatible = "marvell,mv88e6xxx-mdio-external";
-                        #address-cells = <1>;
+                                #address-cells = <1>;
-                        #size-cells = <0>;
+                                #size-cells = <0>;
-                        switch1phy9: switch1phy0@9 {
+                                switch1phy9: switch1phy0@9 {
-                                reg = <9>;
+                                        reg = <9>;
+                                };
                        };
                };
        };
diff --git a/Documentation/devicetree/bindings/net/renesas,ravb.txt b/Documentation/devicetree/bindings/net/renesas,ravb.txt
index 92fd4b2f17b2..b4dc455eb155 100644
--- a/Documentation/devicetree/bindings/net/renesas,ravb.txt
+++ b/Documentation/devicetree/bindings/net/renesas,ravb.txt
@@ -27,7 +27,11 @@ Required properties:
        SoC-specific version corresponding to the platform first followed by
        the generic version.
- reg: offset and length of (1) the register block and (2) the stream buffer.
+- reg: Offset and length of (1) the register block and (2) the stream buffer.
+       The region for the register block is mandatory.
+       The region for the stream buffer is optional, as it is only present on
+       R-Car Gen2 and RZ/G1 SoCs, and on R-Car H3 (R8A7795), M3-W (R8A7796),
+       and M3-N (R8A77965).
 - interrupts: A list of interrupt-specifiers, one for each entry in
              interrupt-names.
              If interrupt-names is not present, an interrupt specifier
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index e64d903bcbe8..46da5f184460 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -19,7 +19,7 @@ Required properties:
  configured in FS mode;
  - "st,stm32f4x9-hsotg": The DWC2 USB HS controller instance in STM32F4x9 SoCs
  configured in HS mode;
-  - "st,stm32f7xx-hsotg": The DWC2 USB HS controller instance in STM32F7xx SoCs
+  - "st,stm32f7-hsotg": The DWC2 USB HS controller instance in STM32F7 SoCs
    configured in HS mode;
 - reg : Should contain 1 register range (address and length)
 - interrupts : Should contain 1 interrupt
diff --git a/Documentation/devicetree/bindings/usb/renesas_usb3.txt b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
index 87a45e2f9b7f..2c071bb5801e 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usb3.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usb3.txt
@@ -4,6 +4,7 @@ Required properties:
  - compatible: Must contain one of the following:
        - "renesas,r8a7795-usb3-peri"
        - "renesas,r8a7796-usb3-peri"
+        - "renesas,r8a77965-usb3-peri"
        - "renesas,rcar-gen3-usb3-peri" for a generic R-Car Gen3 compatible
          device
diff --git a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
index d060172f1529..43960faf5a88 100644
--- a/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
+++ b/Documentation/devicetree/bindings/usb/renesas_usbhs.txt
@@ -12,6 +12,7 @@ Required properties:
        - "renesas,usbhs-r8a7794" for r8a7794 (R-Car E2) compatible device
        - "renesas,usbhs-r8a7795" for r8a7795 (R-Car H3) compatible device
        - "renesas,usbhs-r8a7796" for r8a7796 (R-Car M3-W) compatible device
+        - "renesas,usbhs-r8a77965" for r8a77965 (R-Car M3-N) compatible device
        - "renesas,usbhs-r8a77995" for r8a77995 (R-Car D3) compatible device
        - "renesas,usbhs-r7s72100" for r7s72100 (RZ/A1) compatible device
        - "renesas,rcar-gen2-usbhs" for R-Car Gen2 or RZ/G1 compatible devices
diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt
index e2ea59bbca93..1651483a7048 100644
--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt
@@ -13,6 +13,7 @@ Required properties:
    - "renesas,xhci-r8a7793" for r8a7793 SoC
    - "renesas,xhci-r8a7795" for r8a7795 SoC
    - "renesas,xhci-r8a7796" for r8a7796 SoC
+    - "renesas,xhci-r8a77965" for r8a77965 SoC
    - "renesas,rcar-gen2-xhci" for a generic R-Car Gen2 or RZ/G1 compatible
      device
    - "renesas,rcar-gen3-xhci" for a generic R-Car Gen3 compatible device
diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index d47480b61ac6..aca542ec125c 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -20,8 +20,8 @@ TCP Segmentation Offload
 TCP segmentation allows a device to segment a single frame into multiple
 frames with a data payload size specified in skb_shinfo()->gso_size.
-When TCP segmentation requested the bit for either SKB_GSO_TCP or
+When TCP segmentation requested the bit for either SKB_GSO_TCPV4 or
-SKB_GSO_TCP6 should be set in skb_shinfo()->gso_type and
+SKB_GSO_TCPV6 should be set in skb_shinfo()->gso_type and
 skb_shinfo()->gso_size should be set to a non-zero value.
 TCP segmentation is dependent on support for the use of partial checksum
@@ -153,8 +153,18 @@ To signal this, gso_size is set to the special value GSO_BY_FRAGS.
 Therefore, any code in the core networking stack must be aware of the
 possibility that gso_size will be GSO_BY_FRAGS and handle that case
-appropriately. (For size checks, the skb_gso_validate_*_len family of
+appropriately.
-helpers do this automatically.)
+There are some helpers to make this easier:
+ - skb_is_gso(skb) && skb_is_gso_sctp(skb) is the best way to see if
+   an skb is an SCTP GSO skb.
+ - For size checks, the skb_gso_validate_*_len family of helpers correctly
+   considers GSO_BY_FRAGS.
+ - For manipulating packets, skb_increase_gso_size and skb_decrease_gso_size
+   will check for GSO_BY_FRAGS and WARN if asked to manipulate these skbs.
 This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
 set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.
diff --git a/Documentation/sphinx/kerneldoc.py b/Documentation/sphinx/kerneldoc.py
index 39aa9e8697cc..fbedcc39460b 100644
--- a/Documentation/sphinx/kerneldoc.py
+++ b/Documentation/sphinx/kerneldoc.py
@@ -36,8 +36,7 @@ import glob
 from docutils import nodes, statemachine
 from docutils.statemachine import ViewList
-from docutils.parsers.rst import directives
+from docutils.parsers.rst import directives, Directive
-from sphinx.util.compat import Directive
 from sphinx.ext.autodoc import AutodocReporter
 __version__  = '1.0'
diff --git a/MAINTAINERS b/MAINTAINERS
index 214c9bca232a..b3ea844cf228 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9941,6 +9941,13 @@ F:	Documentation/ABI/stable/sysfs-bus-nvmem
 F:      include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
+NXP SGTL5000 DRIVER
+M:      Fabio Estevam <fabio.estevam@nxp.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
+F:      sound/soc/codecs/sgtl5000*
 NXP TDA998X DRM DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Supported
@@ -10343,7 +10350,7 @@ F:	drivers/oprofile/
 F:      include/linux/oprofile.h
 ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
-M:      Mark Fasheh <mfasheh@versity.com>
+M:      Mark Fasheh <mark@fasheh.com>
 M:      Joel Becker <jlbec@evilplan.org>
 L:      ocfs2-devel@oss.oracle.com (moderated for non-subscribers)
 W:      http://ocfs2.wiki.kernel.org
@@ -10853,6 +10860,7 @@ F:	drivers/platform/x86/peaq-wmi.c
 PER-CPU MEMORY ALLOCATOR
 M:      Tejun Heo <tj@kernel.org>
 M:      Christoph Lameter <cl@linux.com>
+M:      Dennis Zhou <dennisszhou@gmail.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu.git
 S:      Maintained
 F:      include/linux/percpu*.h
@@ -12123,6 +12131,7 @@ M:	Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung/
+F:      Documentation/devicetree/bindings/sound/samsung*
 SAMSUNG EXYNOS PSEUDO RANDOM NUMBER GENERATOR (RNG) DRIVER
 M:      Krzysztof Kozlowski <krzk@kernel.org>
diff --git a/Makefile b/Makefile
index c4322dea3ca2..486db374d1c1 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 # *DOCUMENTATION*
@@ -826,6 +826,15 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS   += $(call cc-option,-fno-strict-overflow)
+# clang sets -fmerge-all-constants by default as optimization, but this
+# is non-conforming behavior for C and in fact breaks the kernel, so we
+# need to disable it here generally.
+KBUILD_CFLAGS   += $(call cc-option,-fno-merge-all-constants)
+# for gcc -fno-merge-all-constants disables everything, but it is fine
+# to have actual conforming behavior enabled.
+KBUILD_CFLAGS   += $(call cc-option,-fmerge-constants)
 # Make sure -fstack-check isn't enabled (like gentoo apparently did)
 KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check,)
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 52f15cd896e1..b5a28336c077 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -178,7 +178,7 @@ static int enable_smccc_arch_workaround_1(void *data)
        case PSCI_CONDUIT_HVC:
                arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
                                  ARM_SMCCC_ARCH_WORKAROUND_1, &res);
-                if (res.a0)
+                if ((int)res.a0 < 0)
                        return 0;
                cb = call_hvc_arch_workaround_1;
                smccc_start = __smccc_workaround_1_hvc_start;
@@ -188,7 +188,7 @@ static int enable_smccc_arch_workaround_1(void *data)
        case PSCI_CONDUIT_SMC:
                arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
                                  ARM_SMCCC_ARCH_WORKAROUND_1, &res);
-                if (res.a0)
+                if ((int)res.a0 < 0)
                        return 0;
                cb = call_smc_arch_workaround_1;
                smccc_start = __smccc_workaround_1_smc_start;
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index d7e3299a7734..959e50d2588c 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -363,8 +363,6 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
 {
        int ret = 0;
-        vcpu_load(vcpu);
        trace_kvm_set_guest_debug(vcpu, dbg->control);
        if (dbg->control & ~KVM_GUESTDBG_VALID_MASK) {
@@ -386,7 +384,6 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
        }
 out:
-        vcpu_put(vcpu);
        return ret;
 }
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 84a019f55022..2dbb2c9f1ec1 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -108,7 +108,7 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         * The following mapping attributes may be updated in live
         * kernel mappings without the need for break-before-make.
         */
-        static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE;
+        static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG;
        /* creating or taking down mappings is always safe */
        if (old == 0 || new == 0)
@@ -118,9 +118,9 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
        if ((old | new) & PTE_CONT)
                return false;
-        /* Transitioning from Global to Non-Global is safe */
+        /* Transitioning from Non-Global to Global is unsafe */
-        if (((old ^ new) == PTE_NG) && (new & PTE_NG))
+        if (old & ~new & PTE_NG)
-                return true;
+                return false;
        return ((old ^ new) & ~mask) == 0;
 }
@@ -972,3 +972,13 @@ int pmd_clear_huge(pmd_t *pmdp)
        pmd_clear(pmdp);
        return 1;
 }
+int pud_free_pmd_page(pud_t *pud)
+{
+        return pud_none(*pud);
+}
+int pmd_free_pte_page(pmd_t *pmd)
+{
+        return pmd_none(*pmd);
+}
diff --git a/arch/h8300/include/asm/byteorder.h b/arch/h8300/include/asm/byteorder.h
index ecff2d1ca5a3..6eaa7ad5fc2c 100644
--- a/arch/h8300/include/asm/byteorder.h
+++ b/arch/h8300/include/asm/byteorder.h
@@ -2,7 +2,6 @@
 #ifndef __H8300_BYTEORDER_H__
 #define __H8300_BYTEORDER_H__
-#define __BIG_ENDIAN __ORDER_BIG_ENDIAN__
 #include <linux/byteorder/big_endian.h>
 #endif
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 4f798aa671dd..3817a3e2146c 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -24,6 +24,7 @@ config MICROBLAZE
        select HAVE_FTRACE_MCOUNT_RECORD
        select HAVE_FUNCTION_GRAPH_TRACER
        select HAVE_FUNCTION_TRACER
+        select NO_BOOTMEM
        select HAVE_MEMBLOCK
        select HAVE_MEMBLOCK_NODE_MAP
        select HAVE_OPROFILE
diff --git a/arch/microblaze/Kconfig.platform b/arch/microblaze/Kconfig.platform
index 6996f397c16c..f7f1739c11b9 100644
--- a/arch/microblaze/Kconfig.platform
+++ b/arch/microblaze/Kconfig.platform
@@ -8,7 +8,6 @@ menu "Platform options"
 config OPT_LIB_FUNCTION
        bool "Optimalized lib function"
-        depends on CPU_LITTLE_ENDIAN
        default y
        help
          Allows turn on optimalized library function (memcpy and memmove).
@@ -21,6 +20,7 @@ config OPT_LIB_FUNCTION
 config OPT_LIB_ASM
        bool "Optimalized lib function ASM"
        depends on OPT_LIB_FUNCTION && (XILINX_MICROBLAZE0_USE_BARREL = 1)
+        depends on CPU_BIG_ENDIAN
        default n
        help
          Allows turn on optimalized library function (memcpy and memmove).
diff --git a/arch/microblaze/include/asm/setup.h b/arch/microblaze/include/asm/setup.h
index be84a4d3917f..7c968c1d1729 100644
--- a/arch/microblaze/include/asm/setup.h
+++ b/arch/microblaze/include/asm/setup.h
@@ -44,7 +44,6 @@ void machine_shutdown(void);
 void machine_halt(void);
 void machine_power_off(void);
-extern void *alloc_maybe_bootmem(size_t size, gfp_t mask);
 extern void *zalloc_maybe_bootmem(size_t size, gfp_t mask);
 # endif /* __ASSEMBLY__ */
diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S
index 62021d7e249e..fdc48bb065d8 100644
--- a/arch/microblaze/lib/fastcopy.S
+++ b/arch/microblaze/lib/fastcopy.S
@@ -29,10 +29,6 @@
 *      between mem locations with size of xfer spec'd in bytes
 */
-#ifdef __MICROBLAZEEL__
-#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM.
-#endif
 #include <linux/linkage.h>
        .text
        .globl  memcpy
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index 434639f9a3a6..df6de7ccdc2e 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -32,9 +32,6 @@ int mem_init_done;
 #ifndef CONFIG_MMU
 unsigned int __page_offset;
 EXPORT_SYMBOL(__page_offset);
-#else
-static int init_bootmem_done;
 #endif /* CONFIG_MMU */
 char *klimit = _end;
@@ -117,7 +114,6 @@ static void __init paging_init(void)
 void __init setup_memory(void)
 {
-        unsigned long map_size;
        struct memblock_region *reg;
 #ifndef CONFIG_MMU
@@ -174,17 +170,6 @@ void __init setup_memory(void)
        pr_info("%s: max_low_pfn: %#lx\n", __func__, max_low_pfn);
        pr_info("%s: max_pfn: %#lx\n", __func__, max_pfn);
-        /*
-         * Find an area to use for the bootmem bitmap.
-         * We look for the first area which is at least
-         * 128kB in length (128kB is enough for a bitmap
-         * for 4GB of memory, using 4kB pages), plus 1 page
-         * (in case the address isn't page-aligned).
-         */
-        map_size = init_bootmem_node(NODE_DATA(0),
-                PFN_UP(TOPHYS((u32)klimit)), min_low_pfn, max_low_pfn);
-        memblock_reserve(PFN_UP(TOPHYS((u32)klimit)) << PAGE_SHIFT, map_size);
        /* Add active regions with valid PFNs */
        for_each_memblock(memory, reg) {
                unsigned long start_pfn, end_pfn;
@@ -196,32 +181,9 @@ void __init setup_memory(void)
                                  &memblock.memory, 0);
        }
-        /* free bootmem is whole main memory */
-        free_bootmem_with_active_regions(0, max_low_pfn);
-        /* reserve allocate blocks */
-        for_each_memblock(reserved, reg) {
-                unsigned long top = reg->base + reg->size - 1;
-                pr_debug("reserved - 0x%08x-0x%08x, %lx, %lx\n",
-                         (u32) reg->base, (u32) reg->size, top,
-                                                memory_start + lowmem_size - 1);
-                if (top <= (memory_start + lowmem_size - 1)) {
-                        reserve_bootmem(reg->base, reg->size, BOOTMEM_DEFAULT);
-                } else if (reg->base < (memory_start + lowmem_size - 1)) {
-                        unsigned long trunc_size = memory_start + lowmem_size -
-                                                                reg->base;
-                        reserve_bootmem(reg->base, trunc_size, BOOTMEM_DEFAULT);
-                }
-        }
        /* XXX need to clip this if using highmem? */
        sparse_memory_present_with_active_regions(0);
-#ifdef CONFIG_MMU
-        init_bootmem_done = 1;
-#endif
        paging_init();
 }
@@ -398,30 +360,16 @@ asmlinkage void __init mmu_init(void)
 /* This is only called until mem_init is done. */
 void __init *early_get_page(void)
 {
-        void *p;
+        /*
-        if (init_bootmem_done) {
+         * Mem start + kernel_tlb -> here is limit
-                p = alloc_bootmem_pages(PAGE_SIZE);
+         * because of mem mapping from head.S
-        } else {
+         */
-                /*
+        return __va(memblock_alloc_base(PAGE_SIZE, PAGE_SIZE,
-                 * Mem start + kernel_tlb -> here is limit
+                                memory_start + kernel_tlb));
-                 * because of mem mapping from head.S
-                 */
-                p = __va(memblock_alloc_base(PAGE_SIZE, PAGE_SIZE,
-                                        memory_start + kernel_tlb));
-        }
-        return p;
 }
 #endif /* CONFIG_MMU */
-void * __ref alloc_maybe_bootmem(size_t size, gfp_t mask)
-{
-        if (mem_init_done)
-                return kmalloc(size, mask);
-        else
-                return alloc_bootmem(size);
-}
 void * __ref zalloc_maybe_bootmem(size_t size, gfp_t mask)
 {
        void *p;
diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c
index 9ab48ff80c1c..6d11ae581ea7 100644
--- a/arch/mips/ath25/board.c
+++ b/arch/mips/ath25/board.c
@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t base, unsigned long size)
        }
        board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
+        if (!board_data)
+                goto error;
        ath25_board.config = (struct ath25_boarddata *)board_data;
        memcpy_fromio(board_data, bcfg, 0x100);
        if (broken_boarddata) {
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 5b3a3f6a9ad3..d99f5242169e 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
        }
        host_data = kzalloc(sizeof(*host_data), GFP_KERNEL);
+        if (!host_data)
+                return -ENOMEM;
        raw_spin_lock_init(&host_data->lock);
        addr = of_get_address(ciu_node, 0, NULL, NULL);
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 9d41732a9146..159e83add4bb 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned int max_cpus)
                return;
        }
-        if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
+        if (request_irq(IPI0_IRQ, bmips_ipi_interrupt,
-                        "smp_ipi0", NULL))
+                        IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL))
                panic("Can't request IPI0 interrupt");
-        if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
+        if (request_irq(IPI1_IRQ, bmips_ipi_interrupt,
-                        "smp_ipi1", NULL))
+                        IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL))
                panic("Can't request IPI1 interrupt");
 }
diff --git a/arch/mips/loongson64/Kconfig b/arch/mips/loongson64/Kconfig
index bc2fdbfa8223..72af0c183969 100644
--- a/arch/mips/loongson64/Kconfig
+++ b/arch/mips/loongson64/Kconfig
@@ -7,6 +7,8 @@ choice
 config LEMOTE_FULOONG2E
        bool "Lemote Fuloong(2e) mini-PC"
        select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
        select CEVT_R4K
        select CSRC_R4K
        select SYS_HAS_CPU_LOONGSON2E
@@ -33,6 +35,8 @@ config LEMOTE_FULOONG2E
 config LEMOTE_MACH2F
        bool "Lemote Loongson 2F family machines"
        select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
        select BOARD_SCACHE
        select BOOT_ELF32
        select CEVT_R4K if ! MIPS_EXTERNAL_TIMER
@@ -62,6 +66,8 @@ config LEMOTE_MACH2F
 config LOONGSON_MACH3X
        bool "Generic Loongson 3 family machines"
        select ARCH_SPARSEMEM_ENABLE
+        select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_MIGHT_HAVE_PC_SERIO
        select GENERIC_ISA_DMA_SUPPORT_BROKEN
        select BOOT_ELF32
        select BOARD_SCACHE
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 79089778725b..e3b45546d589 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -543,7 +543,8 @@ void flush_cache_mm(struct mm_struct *mm)
           rp3440, etc.  So, avoid it if the mm isn't too big.  */
        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
            mm_total_size(mm) >= parisc_cache_flush_threshold) {
-                flush_tlb_all();
+                if (mm->context)
+                        flush_tlb_all();
                flush_cache_all();
                return;
        }
@@ -571,6 +572,8 @@ void flush_cache_mm(struct mm_struct *mm)
                        pfn = pte_pfn(*ptep);
                        if (!pfn_valid(pfn))
                                continue;
+                        if (unlikely(mm->context))
+                                flush_tlb_page(vma, addr);
                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
                }
        }
@@ -579,26 +582,46 @@ void flush_cache_mm(struct mm_struct *mm)
 void flush_cache_range(struct vm_area_struct *vma,
                unsigned long start, unsigned long end)
 {
+        pgd_t *pgd;
+        unsigned long addr;
        if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) &&
            end - start >= parisc_cache_flush_threshold) {
-                flush_tlb_range(vma, start, end);
+                if (vma->vm_mm->context)
+                        flush_tlb_range(vma, start, end);
                flush_cache_all();
                return;
        }
-        flush_user_dcache_range_asm(start, end);
+        if (vma->vm_mm->context == mfsp(3)) {
-        if (vma->vm_flags & VM_EXEC)
+                flush_user_dcache_range_asm(start, end);
-                flush_user_icache_range_asm(start, end);
+                if (vma->vm_flags & VM_EXEC)
-        flush_tlb_range(vma, start, end);
+                        flush_user_icache_range_asm(start, end);
+                flush_tlb_range(vma, start, end);
+                return;
+        }
+        pgd = vma->vm_mm->pgd;
+        for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
+                unsigned long pfn;
+                pte_t *ptep = get_ptep(pgd, addr);
+                if (!ptep)
+                        continue;
+                pfn = pte_pfn(*ptep);
+                if (pfn_valid(pfn)) {
+                        if (unlikely(vma->vm_mm->context))
+                                flush_tlb_page(vma, addr);
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+                }
+        }
 }
 void
 flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long pfn)
 {
-        BUG_ON(!vma->vm_mm->context);
        if (pfn_valid(pfn)) {
-                flush_tlb_page(vma, vmaddr);
+                if (likely(vma->vm_mm->context))
+                        flush_tlb_page(vma, vmaddr);
                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
        }
 }
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index ef6549e57157..26d5d2a5b8e9 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -101,7 +101,8 @@ $(addprefix $(obj)/,$(zlib-y)): \
 libfdt       := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
 libfdtheader := fdt.h libfdt.h libfdt_internal.h
-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o): \
+$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o \
+        treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
        $(addprefix $(obj)/,$(libfdtheader))
 src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index d22c41c26bb3..acf4b2e0530c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -874,7 +874,6 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
                .mmu = 0,
                .hash_ext = 0,
                .radix_ext = 0,
-                .byte22 = 0,
        },
        /* option vector 6: IBM PAPR hints */
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 0c854816e653..5cb4e4687107 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -195,6 +195,12 @@ static void kvmppc_pte_free(pte_t *ptep)
        kmem_cache_free(kvm_pte_cache, ptep);
 }
+/* Like pmd_huge() and pmd_large(), but works regardless of config options */
+static inline int pmd_is_leaf(pmd_t pmd)
+{
+        return !!(pmd_val(pmd) & _PAGE_PTE);
+}
 static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
                             unsigned int level, unsigned long mmu_seq)
 {
@@ -219,7 +225,7 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
        else
                new_pmd = pmd_alloc_one(kvm->mm, gpa);
-        if (level == 0 && !(pmd && pmd_present(*pmd)))
+        if (level == 0 && !(pmd && pmd_present(*pmd) && !pmd_is_leaf(*pmd)))
                new_ptep = kvmppc_pte_alloc();
        /* Check if we might have been invalidated; let the guest retry if so */
@@ -244,12 +250,30 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa,
                new_pmd = NULL;
        }
        pmd = pmd_offset(pud, gpa);
-        if (pmd_large(*pmd)) {
+        if (pmd_is_leaf(*pmd)) {
-                /* Someone else has instantiated a large page here; retry */
+                unsigned long lgpa = gpa & PMD_MASK;
-                ret = -EAGAIN;
-                goto out_unlock;
+                /*
-        }
+                 * If we raced with another CPU which has just put
-        if (level == 1 && !pmd_none(*pmd)) {
+                 * a 2MB pte in after we saw a pte page, try again.
+                 */
+                if (level == 0 && !new_ptep) {
+                        ret = -EAGAIN;
+                        goto out_unlock;
+                }
+                /* Valid 2MB page here already, remove it */
+                old = kvmppc_radix_update_pte(kvm, pmdp_ptep(pmd),
+                                              ~0UL, 0, lgpa, PMD_SHIFT);
+                kvmppc_radix_tlbie_page(kvm, lgpa, PMD_SHIFT);
+                if (old & _PAGE_DIRTY) {
+                        unsigned long gfn = lgpa >> PAGE_SHIFT;
+                        struct kvm_memory_slot *memslot;
+                        memslot = gfn_to_memslot(kvm, gfn);
+                        if (memslot && memslot->dirty_bitmap)
+                                kvmppc_update_dirty_map(memslot,
+                                                        gfn, PMD_SIZE);
+                }
+        } else if (level == 1 && !pmd_none(*pmd)) {
                /*
                 * There's a page table page here, but we wanted
                 * to install a large page.  Tell the caller and let
@@ -412,28 +436,24 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
        } else {
                page = pages[0];
                pfn = page_to_pfn(page);
-                if (PageHuge(page)) {
+                if (PageCompound(page)) {
-                        page = compound_head(page);
+                        pte_size <<= compound_order(compound_head(page));
-                        pte_size <<= compound_order(page);
                        /* See if we can insert a 2MB large-page PTE here */
                        if (pte_size >= PMD_SIZE &&
-                            (gpa & PMD_MASK & PAGE_MASK) ==
+                            (gpa & (PMD_SIZE - PAGE_SIZE)) ==
-                            (hva & PMD_MASK & PAGE_MASK)) {
+                            (hva & (PMD_SIZE - PAGE_SIZE))) {
                                level = 1;
                                pfn &= ~((PMD_SIZE >> PAGE_SHIFT) - 1);
                        }
                }
                /* See if we can provide write access */
                if (writing) {
-                        /*
-                         * We assume gup_fast has set dirty on the host PTE.
-                         */
                        pgflags |= _PAGE_WRITE;
                } else {
                        local_irq_save(flags);
                        ptep = find_current_mm_pte(current->mm->pgd,
                                                   hva, NULL, NULL);
-                        if (ptep && pte_write(*ptep) && pte_dirty(*ptep))
+                        if (ptep && pte_write(*ptep))
                                pgflags |= _PAGE_WRITE;
                        local_irq_restore(flags);
                }
@@ -459,18 +479,15 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                pte = pfn_pte(pfn, __pgprot(pgflags));
                ret = kvmppc_create_pte(kvm, pte, gpa, level, mmu_seq);
        }
-        if (ret == 0 || ret == -EAGAIN)
-                ret = RESUME_GUEST;
        if (page) {
-                /*
+                if (!ret && (pgflags & _PAGE_WRITE))
-                 * We drop pages[0] here, not page because page might
+                        set_page_dirty_lock(page);
-                 * have been set to the head page of a compound, but
+                put_page(page);
-                 * we have to drop the reference on the correct tail
-                 * page to match the get inside gup()
-                 */
-                put_page(pages[0]);
        }
+        if (ret == 0 || ret == -EAGAIN)
+                ret = RESUME_GUEST;
        return ret;
 }
@@ -644,7 +661,7 @@ void kvmppc_free_radix(struct kvm *kvm)
                                continue;
                        pmd = pmd_offset(pud, 0);
                        for (im = 0; im < PTRS_PER_PMD; ++im, ++pmd) {
-                                if (pmd_huge(*pmd)) {
+                                if (pmd_is_leaf(*pmd)) {
                                        pmd_clear(pmd);
                                        continue;
                                }
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 89707354c2ef..9cb9448163c4 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2885,7 +2885,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
         */
        trace_hardirqs_on();
-        guest_enter();
+        guest_enter_irqoff();
        srcu_idx = srcu_read_lock(&vc->kvm->srcu);
@@ -2893,8 +2893,6 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
        srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
-        guest_exit();
        trace_hardirqs_off();
        set_irq_happened(trap);
@@ -2937,6 +2935,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
        kvmppc_set_host_core(pcpu);
        local_irq_enable();
+        guest_exit();
        /* Let secondaries go back to the offline loop */
        for (i = 0; i < controlled_threads; ++i) {
@@ -3656,15 +3655,17 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
                goto up_out;
        psize = vma_kernel_pagesize(vma);
-        porder = __ilog2(psize);
        up_read(&current->mm->mmap_sem);
        /* We can handle 4k, 64k or 16M pages in the VRMA */
-        err = -EINVAL;
+        if (psize >= 0x1000000)
-        if (!(psize == 0x1000 || psize == 0x10000 ||
+                psize = 0x1000000;
-              psize == 0x1000000))
+        else if (psize >= 0x10000)
-                goto out_srcu;
+                psize = 0x10000;
+        else
+                psize = 0x1000;
+        porder = __ilog2(psize);
        senc = slb_pgsize_encoding(psize);
        kvm->arch.vrma_slb_v = senc | SLB_VSID_B_1T |
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index f31f357b8c5a..d33264697a31 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -320,7 +320,6 @@ kvm_novcpu_exit:
        stw     r12, STACK_SLOT_TRAP(r1)
        bl      kvmhv_commence_exit
        nop
-        lwz     r12, STACK_SLOT_TRAP(r1)
        b       kvmhv_switch_to_host
 /*
@@ -1220,6 +1219,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 secondary_too_late:
        li      r12, 0
+        stw     r12, STACK_SLOT_TRAP(r1)
        cmpdi   r4, 0
        beq     11f
        stw     r12, VCPU_TRAP(r4)
@@ -1558,12 +1558,12 @@ mc_cont:
 3:      stw     r5,VCPU_SLB_MAX(r9)
 guest_bypass:
+        stw     r12, STACK_SLOT_TRAP(r1)
        mr      r3, r12
        /* Increment exit count, poke other threads to exit */
        bl      kvmhv_commence_exit
        nop
        ld      r9, HSTATE_KVM_VCPU(r13)
-        lwz     r12, VCPU_TRAP(r9)
        /* Stop others sending VCPU interrupts to this physical CPU */
        li      r0, -1
@@ -1898,6 +1898,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_POWER9_DD1)
         * POWER7/POWER8 guest -> host partition switch code.
         * We don't have to lock against tlbies but we do
         * have to coordinate the hardware threads.
+         * Here STACK_SLOT_TRAP(r1) contains the trap number.
         */
 kvmhv_switch_to_host:
        /* Secondary threads wait for primary to do partition switch */
@@ -1950,12 +1951,12 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
        /* If HMI, call kvmppc_realmode_hmi_handler() */
+        lwz     r12, STACK_SLOT_TRAP(r1)
        cmpwi   r12, BOOK3S_INTERRUPT_HMI
        bne     27f
        bl      kvmppc_realmode_hmi_handler
        nop
        cmpdi   r3, 0
-        li      r12, BOOK3S_INTERRUPT_HMI
        /*
         * At this point kvmppc_realmode_hmi_handler may have resync-ed
         * the TB, and if it has, we must not subtract the guest timebase
@@ -2008,10 +2009,8 @@ BEGIN_FTR_SECTION
        lwz     r8, KVM_SPLIT_DO_RESTORE(r3)
        cmpwi   r8, 0
        beq     47f
-        stw     r12, STACK_SLOT_TRAP(r1)
        bl      kvmhv_p9_restore_lpcr
        nop
-        lwz     r12, STACK_SLOT_TRAP(r1)
        b       48f
 47:
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
@@ -2049,6 +2048,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
        li      r0, KVM_GUEST_MODE_NONE
        stb     r0, HSTATE_IN_GUEST(r13)
+        lwz     r12, STACK_SLOT_TRAP(r1)        /* return trap # in r12 */
        ld      r0, SFS+PPC_LR_STKOFF(r1)
        addi    r1, r1, SFS
        mtlr    r0
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 403e642c78f5..52c205373986 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -1345,7 +1345,7 @@ static int kvmppc_emulate_mmio_vsx_loadstore(struct kvm_vcpu *vcpu,
 int kvmppc_handle_load128_by2x64(struct kvm_run *run, struct kvm_vcpu *vcpu,
                unsigned int rt, int is_default_endian)
 {
-        enum emulation_result emulated;
+        enum emulation_result emulated = EMULATE_DONE;
        while (vcpu->arch.mmio_vmx_copy_nums) {
                emulated = __kvmppc_handle_load(run, vcpu, rt, 8,
@@ -1608,7 +1608,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
        kvm_sigset_deactivate(vcpu);
+#ifdef CONFIG_ALTIVEC
 out:
+#endif
        vcpu_put(vcpu);
        return r;
 }
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 65154eaa3714..6c8ce15cde7b 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -63,6 +63,7 @@ static inline int init_new_context(struct task_struct *tsk,
                                   _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
                /* pgd_alloc() did not account this pmd */
                mm_inc_nr_pmds(mm);
+                mm_inc_nr_puds(mm);
        }
        crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
        return 0;
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 13a133a6015c..a5621ea6d123 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -14,6 +14,7 @@
 #include <asm/processor.h>
 #include <asm/cache.h>
 #include <asm/ctl_reg.h>
+#include <asm/dwarf.h>
 #include <asm/errno.h>
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
@@ -230,7 +231,7 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
        .hidden \name
        .type \name,@function
 \name:
-        .cfi_startproc
+        CFI_STARTPROC
 #ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
        exrl    0,0f
 #else
@@ -239,7 +240,7 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
 #endif
        j       .
 0:      br      \reg
-        .cfi_endproc
+        CFI_ENDPROC
        .endm
        GEN_BR_THUNK __s390x_indirect_jump_r1use_r9,%r9,%r1
@@ -426,13 +427,13 @@ ENTRY(system_call)
        UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER
        BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
        stmg    %r0,%r7,__PT_R0(%r11)
-        # clear user controlled register to prevent speculative use
-        xgr     %r0,%r0
        mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
        mvc     __PT_PSW(16,%r11),__LC_SVC_OLD_PSW
        mvc     __PT_INT_CODE(4,%r11),__LC_SVC_ILC
        stg     %r14,__PT_FLAGS(%r11)
 .Lsysc_do_svc:
+        # clear user controlled register to prevent speculative use
+        xgr     %r0,%r0
        # load address of system call table
        lg      %r10,__THREAD_sysc_table(%r13,%r12)
        llgh    %r8,__PT_INT_CODE+2(%r11)
@@ -1439,6 +1440,7 @@ cleanup_critical:
        stg     %r15,__LC_SYSTEM_TIMER
 0:      # update accounting time stamp
        mvc     __LC_LAST_UPDATE_TIMER(8),__LC_SYNC_ENTER_TIMER
+        BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
        # set up saved register r11
        lg      %r15,__LC_KERNEL_STACK
        la      %r9,STACK_FRAME_OVERHEAD(%r15)
diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
index 69d7fcf48158..9aff72d3abda 100644
--- a/arch/s390/kernel/nospec-branch.c
+++ b/arch/s390/kernel/nospec-branch.c
@@ -2,8 +2,8 @@
 #include <linux/module.h>
 #include <asm/nospec-branch.h>
-int nospec_call_disable = IS_ENABLED(EXPOLINE_OFF);
+int nospec_call_disable = IS_ENABLED(CONFIG_EXPOLINE_OFF);
-int nospec_return_disable = !IS_ENABLED(EXPOLINE_FULL);
+int nospec_return_disable = !IS_ENABLED(CONFIG_EXPOLINE_FULL);
 static int __init nospectre_v2_setup_early(char *str)
 {
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 77d7818130db..339ac0964590 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -86,6 +86,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
        { "deliver_prefix_signal", VCPU_STAT(deliver_prefix_signal) },
        { "deliver_restart_signal", VCPU_STAT(deliver_restart_signal) },
        { "deliver_program_interruption", VCPU_STAT(deliver_program_int) },
+        { "deliver_io_interrupt", VCPU_STAT(deliver_io_int) },
        { "exit_wait_state", VCPU_STAT(exit_wait_state) },
        { "instruction_epsw", VCPU_STAT(instruction_epsw) },
        { "instruction_gs", VCPU_STAT(instruction_gs) },
@@ -2146,6 +2147,7 @@ static void sca_add_vcpu(struct kvm_vcpu *vcpu)
                /* we still need the basic sca for the ipte control */
                vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32);
                vcpu->arch.sie_block->scaol = (__u32)(__u64)sca;
+                return;
        }
        read_lock(&vcpu->kvm->arch.sca_lock);
        if (vcpu->kvm->arch.use_esca) {
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 847ddffbf38a..b5cfab711651 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
        pte_unmap(pte);
 }
-void set_pmd_at(struct mm_struct *mm, unsigned long addr,
-                pmd_t *pmdp, pmd_t pmd)
-{
-        pmd_t orig = *pmdp;
-        *pmdp = pmd;
+static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr,
+                           pmd_t orig, pmd_t pmd)
+{
        if (mm == &init_mm)
                return;
@@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
        }
 }
+void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+                pmd_t *pmdp, pmd_t pmd)
+{
+        pmd_t orig = *pmdp;
+        *pmdp = pmd;
+        __set_pmd_acct(mm, addr, orig, pmd);
+}
 static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
                unsigned long address, pmd_t *pmdp, pmd_t pmd)
 {
@@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
        do {
                old = *pmdp;
        } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd);
+        __set_pmd_acct(vma->vm_mm, address, old, pmd);
        return old;
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index eb7f43f23521..0fa71a78ec99 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2307,7 +2307,7 @@ choice
          it can be used to assist security vulnerability exploitation.
          This setting can be changed at boot time via the kernel command
-          line parameter vsyscall=[native|emulate|none].
+          line parameter vsyscall=[emulate|none].
          On a system with recent enough glibc (2.14 or newer) and no
          static binaries, you can say None without a performance penalty
@@ -2315,15 +2315,6 @@ choice
          If unsure, select "Emulate".
-        config LEGACY_VSYSCALL_NATIVE
-                bool "Native"
-                help
-                  Actual executable code is located in the fixed vsyscall
-                  address mapping, implementing time() efficiently. Since
-                  this makes the mapping executable, it can be used during
-                  security vulnerability exploitation (traditionally as
-                  ROP gadgets). This configuration is not recommended.
        config LEGACY_VSYSCALL_EMULATE
                bool "Emulate"
                help
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index e811dd9c5e99..08425c42f8b7 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -363,9 +363,7 @@ ENTRY(entry_INT80_compat)
        pushq   2*8(%rdi)               /* regs->ip */
        pushq   1*8(%rdi)               /* regs->orig_ax */
-        movq    (%rdi), %rdi            /* restore %rdi */
+        pushq   (%rdi)                  /* pt_regs->di */
-        pushq   %rdi                    /* pt_regs->di */
        pushq   %rsi                    /* pt_regs->si */
        pushq   %rdx                    /* pt_regs->dx */
        pushq   %rcx                    /* pt_regs->cx */
@@ -406,15 +404,3 @@ ENTRY(entry_INT80_compat)
        TRACE_IRQS_ON
        jmp     swapgs_restore_regs_and_return_to_usermode
 END(entry_INT80_compat)
-ENTRY(stub32_clone)
-        /*
-         * The 32-bit clone ABI is: clone(..., int tls_val, int *child_tidptr).
-         * The 64-bit clone ABI is: clone(..., int *child_tidptr, int tls_val).
-         *
-         * The native 64-bit kernel's sys_clone() implements the latter,
-         * so we need to swap arguments here before calling it:
-         */
-        xchg    %r8, %rcx
-        jmp     sys_clone
-ENDPROC(stub32_clone)
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index 448ac2161112..2a5e99cff859 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -8,12 +8,12 @@
 #
 0       i386    restart_syscall         sys_restart_syscall
 1       i386    exit                    sys_exit
-2       i386    fork                    sys_fork                        sys_fork
+2       i386    fork                    sys_fork
 3       i386    read                    sys_read
 4       i386    write                   sys_write
 5       i386    open                    sys_open                        compat_sys_open
 6       i386    close                   sys_close
-7       i386    waitpid                 sys_waitpid                     sys32_waitpid
+7       i386    waitpid                 sys_waitpid                     compat_sys_x86_waitpid
 8       i386    creat                   sys_creat
 9       i386    link                    sys_link
 10      i386    unlink                  sys_unlink
@@ -78,7 +78,7 @@
 69      i386    ssetmask                sys_ssetmask
 70      i386    setreuid                sys_setreuid16
 71      i386    setregid                sys_setregid16
-72      i386    sigsuspend              sys_sigsuspend                  sys_sigsuspend
+72      i386    sigsuspend              sys_sigsuspend
 73      i386    sigpending              sys_sigpending                  compat_sys_sigpending
 74      i386    sethostname             sys_sethostname
 75      i386    setrlimit               sys_setrlimit                   compat_sys_setrlimit
@@ -96,7 +96,7 @@
 87      i386    swapon                  sys_swapon
 88      i386    reboot                  sys_reboot
 89      i386    readdir                 sys_old_readdir                 compat_sys_old_readdir
-90      i386    mmap                    sys_old_mmap                    sys32_mmap
+90      i386    mmap                    sys_old_mmap                    compat_sys_x86_mmap
 91      i386    munmap                  sys_munmap
 92      i386    truncate                sys_truncate                    compat_sys_truncate
 93      i386    ftruncate               sys_ftruncate                   compat_sys_ftruncate
@@ -126,7 +126,7 @@
 117     i386    ipc                     sys_ipc                         compat_sys_ipc
 118     i386    fsync                   sys_fsync
 119     i386    sigreturn               sys_sigreturn                   sys32_sigreturn
-120     i386    clone                   sys_clone                       stub32_clone
+120     i386    clone                   sys_clone                       compat_sys_x86_clone
 121     i386    setdomainname           sys_setdomainname
 122     i386    uname                   sys_newuname
 123     i386    modify_ldt              sys_modify_ldt
@@ -186,8 +186,8 @@
 177     i386    rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
 178     i386    rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
 179     i386    rt_sigsuspend           sys_rt_sigsuspend
-180     i386    pread64                 sys_pread64                     sys32_pread
+180     i386    pread64                 sys_pread64                     compat_sys_x86_pread
-181     i386    pwrite64                sys_pwrite64                    sys32_pwrite
+181     i386    pwrite64                sys_pwrite64                    compat_sys_x86_pwrite
 182     i386    chown                   sys_chown16
 183     i386    getcwd                  sys_getcwd
 184     i386    capget                  sys_capget
@@ -196,14 +196,14 @@
 187     i386    sendfile                sys_sendfile                    compat_sys_sendfile
 188     i386    getpmsg
 189     i386    putpmsg
-190     i386    vfork                   sys_vfork                       sys_vfork
+190     i386    vfork                   sys_vfork
 191     i386    ugetrlimit              sys_getrlimit                   compat_sys_getrlimit
 192     i386    mmap2                   sys_mmap_pgoff
-193     i386    truncate64              sys_truncate64                  sys32_truncate64
+193     i386    truncate64              sys_truncate64                  compat_sys_x86_truncate64
-194     i386    ftruncate64             sys_ftruncate64                 sys32_ftruncate64
+194     i386    ftruncate64             sys_ftruncate64                 compat_sys_x86_ftruncate64
-195     i386    stat64                  sys_stat64                      sys32_stat64
+195     i386    stat64                  sys_stat64                      compat_sys_x86_stat64
-196     i386    lstat64                 sys_lstat64                     sys32_lstat64
+196     i386    lstat64                 sys_lstat64                     compat_sys_x86_lstat64
-197     i386    fstat64                 sys_fstat64                     sys32_fstat64
+197     i386    fstat64                 sys_fstat64                     compat_sys_x86_fstat64
 198     i386    lchown32                sys_lchown
 199     i386    getuid32                sys_getuid
 200     i386    getgid32                sys_getgid
@@ -231,7 +231,7 @@
 # 222 is unused
 # 223 is unused
 224     i386    gettid                  sys_gettid
-225     i386    readahead               sys_readahead                   sys32_readahead
+225     i386    readahead               sys_readahead                   compat_sys_x86_readahead
 226     i386    setxattr                sys_setxattr
 227     i386    lsetxattr               sys_lsetxattr
 228     i386    fsetxattr               sys_fsetxattr
@@ -256,7 +256,7 @@
 247     i386    io_getevents            sys_io_getevents                compat_sys_io_getevents
 248     i386    io_submit               sys_io_submit                   compat_sys_io_submit
 249     i386    io_cancel               sys_io_cancel
-250     i386    fadvise64               sys_fadvise64                   sys32_fadvise64
+250     i386    fadvise64               sys_fadvise64                   compat_sys_x86_fadvise64
 # 251 is available for reuse (was briefly sys_set_zone_reclaim)
 252     i386    exit_group              sys_exit_group
 253     i386    lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
@@ -278,7 +278,7 @@
 269     i386    fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
 270     i386    tgkill                  sys_tgkill
 271     i386    utimes                  sys_utimes                      compat_sys_utimes
-272     i386    fadvise64_64            sys_fadvise64_64                sys32_fadvise64_64
+272     i386    fadvise64_64            sys_fadvise64_64                compat_sys_x86_fadvise64_64
 273     i386    vserver
 274     i386    mbind                   sys_mbind
 275     i386    get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
@@ -306,7 +306,7 @@
 297     i386    mknodat                 sys_mknodat
 298     i386    fchownat                sys_fchownat
 299     i386    futimesat               sys_futimesat                   compat_sys_futimesat
-300     i386    fstatat64               sys_fstatat64                   sys32_fstatat
+300     i386    fstatat64               sys_fstatat64                   compat_sys_x86_fstatat
 301     i386    unlinkat                sys_unlinkat
 302     i386    renameat                sys_renameat
 303     i386    linkat                  sys_linkat
@@ -320,7 +320,7 @@
 311     i386    set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
 312     i386    get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
 313     i386    splice                  sys_splice
-314     i386    sync_file_range         sys_sync_file_range             sys32_sync_file_range
+314     i386    sync_file_range         sys_sync_file_range             compat_sys_x86_sync_file_range
 315     i386    tee                     sys_tee
 316     i386    vmsplice                sys_vmsplice                    compat_sys_vmsplice
 317     i386    move_pages              sys_move_pages                  compat_sys_move_pages
@@ -330,7 +330,7 @@
 321     i386    signalfd                sys_signalfd                    compat_sys_signalfd
 322     i386    timerfd_create          sys_timerfd_create
 323     i386    eventfd                 sys_eventfd
-324     i386    fallocate               sys_fallocate                   sys32_fallocate
+324     i386    fallocate               sys_fallocate                   compat_sys_x86_fallocate
 325     i386    timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
 326     i386    timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
 327     i386    signalfd4               sys_signalfd4                   compat_sys_signalfd4
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index 577fa8adb785..8560ef68a9d6 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -42,10 +42,8 @@
 #define CREATE_TRACE_POINTS
 #include "vsyscall_trace.h"
-static enum { EMULATE, NATIVE, NONE } vsyscall_mode =
+static enum { EMULATE, NONE } vsyscall_mode =
-#if defined(CONFIG_LEGACY_VSYSCALL_NATIVE)
+#ifdef CONFIG_LEGACY_VSYSCALL_NONE
-        NATIVE;
-#elif defined(CONFIG_LEGACY_VSYSCALL_NONE)
        NONE;
 #else
        EMULATE;
@@ -56,8 +54,6 @@ static int __init vsyscall_setup(char *str)
        if (str) {
                if (!strcmp("emulate", str))
                        vsyscall_mode = EMULATE;
-                else if (!strcmp("native", str))
-                        vsyscall_mode = NATIVE;
                else if (!strcmp("none", str))
                        vsyscall_mode = NONE;
                else
@@ -139,10 +135,6 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
        WARN_ON_ONCE(address != regs->ip);
-        /* This should be unreachable in NATIVE mode. */
-        if (WARN_ON(vsyscall_mode == NATIVE))
-                return false;
        if (vsyscall_mode == NONE) {
                warn_bad_vsyscall(KERN_INFO, regs,
                                  "vsyscall attempted with vsyscall=none");
@@ -370,9 +362,7 @@ void __init map_vsyscall(void)
        if (vsyscall_mode != NONE) {
                __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
-                             vsyscall_mode == NATIVE
+                             PAGE_KERNEL_VVAR);
-                             ? PAGE_KERNEL_VSYSCALL
-                             : PAGE_KERNEL_VVAR);
                set_vsyscall_pgtable_user_bits(swapper_pg_dir);
        }
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 6d8044ab1060..22ec65bc033a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3606,7 +3606,7 @@ static struct intel_uncore_type skx_uncore_imc = {
 };
 static struct attribute *skx_upi_uncore_formats_attr[] = {
-        &format_attr_event_ext.attr,
+        &format_attr_event.attr,
        &format_attr_umask_ext.attr,
        &format_attr_edge.attr,
        &format_attr_inv.attr,
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index 96cd33bbfc85..6512498bbef6 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -51,15 +51,14 @@
 #define AA(__x)         ((unsigned long)(__x))
-asmlinkage long sys32_truncate64(const char __user *filename,
+COMPAT_SYSCALL_DEFINE3(x86_truncate64, const char __user *, filename,
-                                 unsigned long offset_low,
+                       unsigned long, offset_low, unsigned long, offset_high)
-                                 unsigned long offset_high)
 {
       return sys_truncate(filename, ((loff_t) offset_high << 32) | offset_low);
 }
-asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
+COMPAT_SYSCALL_DEFINE3(x86_ftruncate64, unsigned int, fd,
-                                  unsigned long offset_high)
+                       unsigned long, offset_low, unsigned long, offset_high)
 {
       return sys_ftruncate(fd, ((loff_t) offset_high << 32) | offset_low);
 }
@@ -96,8 +95,8 @@ static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
        return 0;
 }
-asmlinkage long sys32_stat64(const char __user *filename,
+COMPAT_SYSCALL_DEFINE2(x86_stat64, const char __user *, filename,
-                             struct stat64 __user *statbuf)
+                       struct stat64 __user *, statbuf)
 {
        struct kstat stat;
        int ret = vfs_stat(filename, &stat);
@@ -107,8 +106,8 @@ asmlinkage long sys32_stat64(const char __user *filename,
        return ret;
 }
-asmlinkage long sys32_lstat64(const char __user *filename,
+COMPAT_SYSCALL_DEFINE2(x86_lstat64, const char __user *, filename,
-                              struct stat64 __user *statbuf)
+                       struct stat64 __user *, statbuf)
 {
        struct kstat stat;
        int ret = vfs_lstat(filename, &stat);
@@ -117,7 +116,8 @@ asmlinkage long sys32_lstat64(const char __user *filename,
        return ret;
 }
-asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
+COMPAT_SYSCALL_DEFINE2(x86_fstat64, unsigned int, fd,
+                       struct stat64 __user *, statbuf)
 {
        struct kstat stat;
        int ret = vfs_fstat(fd, &stat);
@@ -126,8 +126,9 @@ asmlinkage long sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
        return ret;
 }
-asmlinkage long sys32_fstatat(unsigned int dfd, const char __user *filename,
+COMPAT_SYSCALL_DEFINE4(x86_fstatat, unsigned int, dfd,
-                              struct stat64 __user *statbuf, int flag)
+                       const char __user *, filename,
+                       struct stat64 __user *, statbuf, int, flag)
 {
        struct kstat stat;
        int error;
@@ -153,7 +154,7 @@ struct mmap_arg_struct32 {
        unsigned int offset;
 };
-asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *arg)
+COMPAT_SYSCALL_DEFINE1(x86_mmap, struct mmap_arg_struct32 __user *, arg)
 {
        struct mmap_arg_struct32 a;
@@ -167,22 +168,22 @@ asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *arg)
                               a.offset>>PAGE_SHIFT);
 }
-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
+COMPAT_SYSCALL_DEFINE3(x86_waitpid, compat_pid_t, pid, unsigned int __user *,
-                              int options)
+                       stat_addr, int, options)
 {
        return compat_sys_wait4(pid, stat_addr, options, NULL);
 }
 /* warning: next two assume little endian */
-asmlinkage long sys32_pread(unsigned int fd, char __user *ubuf, u32 count,
+COMPAT_SYSCALL_DEFINE5(x86_pread, unsigned int, fd, char __user *, ubuf,
-                            u32 poslo, u32 poshi)
+                       u32, count, u32, poslo, u32, poshi)
 {
        return sys_pread64(fd, ubuf, count,
                         ((loff_t)AA(poshi) << 32) | AA(poslo));
 }
-asmlinkage long sys32_pwrite(unsigned int fd, const char __user *ubuf,
+COMPAT_SYSCALL_DEFINE5(x86_pwrite, unsigned int, fd, const char __user *, ubuf,
-                             u32 count, u32 poslo, u32 poshi)
+                       u32, count, u32, poslo, u32, poshi)
 {
        return sys_pwrite64(fd, ubuf, count,
                          ((loff_t)AA(poshi) << 32) | AA(poslo));
@@ -193,8 +194,9 @@ asmlinkage long sys32_pwrite(unsigned int fd, const char __user *ubuf,
 * Some system calls that need sign extended arguments. This could be
 * done by a generic wrapper.
 */
-long sys32_fadvise64_64(int fd, __u32 offset_low, __u32 offset_high,
+COMPAT_SYSCALL_DEFINE6(x86_fadvise64_64, int, fd, __u32, offset_low,
-                        __u32 len_low, __u32 len_high, int advice)
+                       __u32, offset_high, __u32, len_low, __u32, len_high,
+                       int, advice)
 {
        return sys_fadvise64_64(fd,
                               (((u64)offset_high)<<32) | offset_low,
@@ -202,31 +204,43 @@ long sys32_fadvise64_64(int fd, __u32 offset_low, __u32 offset_high,
                                advice);
 }
-asmlinkage ssize_t sys32_readahead(int fd, unsigned off_lo, unsigned off_hi,
+COMPAT_SYSCALL_DEFINE4(x86_readahead, int, fd, unsigned int, off_lo,
-                                   size_t count)
+                       unsigned int, off_hi, size_t, count)
 {
        return sys_readahead(fd, ((u64)off_hi << 32) | off_lo, count);
 }
-asmlinkage long sys32_sync_file_range(int fd, unsigned off_low, unsigned off_hi,
+COMPAT_SYSCALL_DEFINE6(x86_sync_file_range, int, fd, unsigned int, off_low,
-                                      unsigned n_low, unsigned n_hi,  int flags)
+                       unsigned int, off_hi, unsigned int, n_low,
+                       unsigned int, n_hi, int, flags)
 {
        return sys_sync_file_range(fd,
                                   ((u64)off_hi << 32) | off_low,
                                   ((u64)n_hi << 32) | n_low, flags);
 }
-asmlinkage long sys32_fadvise64(int fd, unsigned offset_lo, unsigned offset_hi,
+COMPAT_SYSCALL_DEFINE5(x86_fadvise64, int, fd, unsigned int, offset_lo,
-                                size_t len, int advice)
+                       unsigned int, offset_hi, size_t, len, int, advice)
 {
        return sys_fadvise64_64(fd, ((u64)offset_hi << 32) | offset_lo,
                                len, advice);
 }
-asmlinkage long sys32_fallocate(int fd, int mode, unsigned offset_lo,
+COMPAT_SYSCALL_DEFINE6(x86_fallocate, int, fd, int, mode,
-                                unsigned offset_hi, unsigned len_lo,
+                       unsigned int, offset_lo, unsigned int, offset_hi,
-                                unsigned len_hi)
+                       unsigned int, len_lo, unsigned int, len_hi)
 {
        return sys_fallocate(fd, mode, ((u64)offset_hi << 32) | offset_lo,
                             ((u64)len_hi << 32) | len_lo);
 }
+/*
+ * The 32-bit clone ABI is CONFIG_CLONE_BACKWARDS
+ */
+COMPAT_SYSCALL_DEFINE5(x86_clone, unsigned long, clone_flags,
+                       unsigned long, newsp, int __user *, parent_tidptr,
+                       unsigned long, tls_val, int __user *, child_tidptr)
+{
+        return sys_clone(clone_flags, newsp, parent_tidptr, child_tidptr,
+                        tls_val);
+}
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index f41079da38c5..d554c11e01ff 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -316,6 +316,7 @@
 #define X86_FEATURE_VPCLMULQDQ          (16*32+10) /* Carry-Less Multiplication Double Quadword */
 #define X86_FEATURE_AVX512_VNNI         (16*32+11) /* Vector Neural Network Instructions */
 #define X86_FEATURE_AVX512_BITALG       (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */
+#define X86_FEATURE_TME                 (16*32+13) /* Intel Total Memory Encryption */
 #define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
@@ -328,6 +329,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW       (18*32+ 2) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS       (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_PCONFIG             (18*32+18) /* Intel PCONFIG */
 #define X86_FEATURE_SPEC_CTRL           (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
 #define X86_FEATURE_INTEL_STIBP         (18*32+27) /* "" Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ARCH_CAPABILITIES   (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index 7fb1047d61c7..6cf0e4cb7b97 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -39,6 +39,7 @@ struct device;
 enum ucode_state {
        UCODE_OK        = 0,
+        UCODE_NEW,
        UCODE_UPDATED,
        UCODE_NFOUND,
        UCODE_ERROR,
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index d0dabeae0505..f928ad9b143f 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -183,7 +183,10 @@
 * otherwise we'll run out of registers. We don't care about CET
 * here, anyway.
 */
-# define CALL_NOSPEC ALTERNATIVE("call *%[thunk_target]\n",     \
+# define CALL_NOSPEC                                            \
+        ALTERNATIVE(                                            \
+        ANNOTATE_RETPOLINE_SAFE                                 \
+        "call *%[thunk_target]\n",                              \
        "       jmp    904f;\n"                                 \
        "       .align 16\n"                                    \
        "901:   call   903f;\n"                                 \
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 246f15b4e64c..acfe755562a6 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -174,7 +174,6 @@ enum page_cache_mode {
 #define __PAGE_KERNEL_RO                (__PAGE_KERNEL & ~_PAGE_RW)
 #define __PAGE_KERNEL_RX                (__PAGE_KERNEL_EXEC & ~_PAGE_RW)
 #define __PAGE_KERNEL_NOCACHE           (__PAGE_KERNEL | _PAGE_NOCACHE)
-#define __PAGE_KERNEL_VSYSCALL          (__PAGE_KERNEL_RX | _PAGE_USER)
 #define __PAGE_KERNEL_VVAR              (__PAGE_KERNEL_RO | _PAGE_USER)
 #define __PAGE_KERNEL_LARGE             (__PAGE_KERNEL | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
@@ -206,7 +205,6 @@ enum page_cache_mode {
 #define PAGE_KERNEL_NOCACHE     __pgprot(__PAGE_KERNEL_NOCACHE | _PAGE_ENC)
 #define PAGE_KERNEL_LARGE       __pgprot(__PAGE_KERNEL_LARGE | _PAGE_ENC)
 #define PAGE_KERNEL_LARGE_EXEC  __pgprot(__PAGE_KERNEL_LARGE_EXEC | _PAGE_ENC)
-#define PAGE_KERNEL_VSYSCALL    __pgprot(__PAGE_KERNEL_VSYSCALL | _PAGE_ENC)
 #define PAGE_KERNEL_VVAR        __pgprot(__PAGE_KERNEL_VVAR | _PAGE_ENC)
 #define PAGE_KERNEL_IO          __pgprot(__PAGE_KERNEL_IO)
diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h
index d6baf23782bc..5c019d23d06b 100644
--- a/arch/x86/include/asm/sections.h
+++ b/arch/x86/include/asm/sections.h
@@ -10,6 +10,7 @@ extern struct exception_table_entry __stop___ex_table[];
 #if defined(CONFIG_X86_64)
 extern char __end_rodata_hpage_align[];
+extern char __entry_trampoline_start[], __entry_trampoline_end[];
 #endif
 #endif  /* _ASM_X86_SECTIONS_H */
diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
index 82c34ee25a65..906794aa034e 100644
--- a/arch/x86/include/asm/sys_ia32.h
+++ b/arch/x86/include/asm/sys_ia32.h
@@ -20,31 +20,43 @@
 #include <asm/ia32.h>
 /* ia32/sys_ia32.c */
-asmlinkage long sys32_truncate64(const char __user *, unsigned long, unsigned long);
+asmlinkage long compat_sys_x86_truncate64(const char __user *, unsigned long,
-asmlinkage long sys32_ftruncate64(unsigned int, unsigned long, unsigned long);
+                                          unsigned long);
+asmlinkage long compat_sys_x86_ftruncate64(unsigned int, unsigned long,
+                                           unsigned long);
-asmlinkage long sys32_stat64(const char __user *, struct stat64 __user *);
+asmlinkage long compat_sys_x86_stat64(const char __user *,
-asmlinkage long sys32_lstat64(const char __user *, struct stat64 __user *);
+                                      struct stat64 __user *);
-asmlinkage long sys32_fstat64(unsigned int, struct stat64 __user *);
+asmlinkage long compat_sys_x86_lstat64(const char __user *,
-asmlinkage long sys32_fstatat(unsigned int, const char __user *,
+                                       struct stat64 __user *);
+asmlinkage long compat_sys_x86_fstat64(unsigned int, struct stat64 __user *);
+asmlinkage long compat_sys_x86_fstatat(unsigned int, const char __user *,
                              struct stat64 __user *, int);
 struct mmap_arg_struct32;
-asmlinkage long sys32_mmap(struct mmap_arg_struct32 __user *);
+asmlinkage long compat_sys_x86_mmap(struct mmap_arg_struct32 __user *);
-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
+asmlinkage long compat_sys_x86_waitpid(compat_pid_t, unsigned int __user *,
+                                       int);
-asmlinkage long sys32_pread(unsigned int, char __user *, u32, u32, u32);
+asmlinkage long compat_sys_x86_pread(unsigned int, char __user *, u32, u32,
-asmlinkage long sys32_pwrite(unsigned int, const char __user *, u32, u32, u32);
+                                     u32);
+asmlinkage long compat_sys_x86_pwrite(unsigned int, const char __user *, u32,
+                                      u32, u32);
-long sys32_fadvise64_64(int, __u32, __u32, __u32, __u32, int);
+asmlinkage long compat_sys_x86_fadvise64_64(int, __u32, __u32, __u32, __u32,
-long sys32_vm86_warning(void);
+                                            int);
-asmlinkage ssize_t sys32_readahead(int, unsigned, unsigned, size_t);
+asmlinkage ssize_t compat_sys_x86_readahead(int, unsigned int, unsigned int,
-asmlinkage long sys32_sync_file_range(int, unsigned, unsigned,
+                                            size_t);
-                                      unsigned, unsigned, int);
+asmlinkage long compat_sys_x86_sync_file_range(int, unsigned int, unsigned int,
-asmlinkage long sys32_fadvise64(int, unsigned, unsigned, size_t, int);
+                                               unsigned int, unsigned int,
-asmlinkage long sys32_fallocate(int, int, unsigned,
+                                               int);
-                                unsigned, unsigned, unsigned);
+asmlinkage long compat_sys_x86_fadvise64(int, unsigned int, unsigned int,
+                                         size_t, int);
+asmlinkage long compat_sys_x86_fallocate(int, int, unsigned int, unsigned int,
+                                         unsigned int, unsigned int);
+asmlinkage long compat_sys_x86_clone(unsigned long, unsigned long, int __user *,
+                                     unsigned long, int __user *);
 /* ia32/ia32_signal.c */
 asmlinkage long sys32_sigreturn(void);
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index 8b6780751132..5db8b0b10766 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -352,6 +352,7 @@ enum vmcs_field {
 #define INTR_TYPE_NMI_INTR              (2 << 8) /* NMI */
 #define INTR_TYPE_HARD_EXCEPTION        (3 << 8) /* processor exception */
 #define INTR_TYPE_SOFT_INTR             (4 << 8) /* software interrupt */
+#define INTR_TYPE_PRIV_SW_EXCEPTION     (5 << 8) /* ICE breakpoint - undocumented */
 #define INTR_TYPE_SOFT_EXCEPTION        (6 << 8) /* software exception */
 /* GUEST_INTERRUPTIBILITY_INFO flags. */
diff --git a/arch/x86/include/uapi/asm/mce.h b/arch/x86/include/uapi/asm/mce.h
index 91723461dc1f..435db58a7bad 100644
--- a/arch/x86/include/uapi/asm/mce.h
+++ b/arch/x86/include/uapi/asm/mce.h
@@ -30,6 +30,7 @@ struct mce {
        __u64 synd;     /* MCA_SYND MSR: only valid on SMCA systems */
        __u64 ipid;     /* MCA_IPID MSR: only valid on SMCA systems */
        __u64 ppin;     /* Protected Processor Inventory Number */
+        __u32 microcode;/* Microcode revision */
 };
 #define MCE_GET_RECORD_LEN   _IOR('M', 1, int)
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index d19e903214b4..c3af167d0a70 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -105,7 +105,7 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c)
 /*
 * Early microcode releases for the Spectre v2 mitigation were broken.
 * Information taken from;
- * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/microcode-update-guidance.pdf
+ * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf
 * - https://kb.vmware.com/s/article/52345
 * - Microcode revisions observed in the wild
 * - Release note from 20180108 microcode release
@@ -123,7 +123,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x80 },
        { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
        { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
-        { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
        { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
        { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
        { INTEL_FAM6_BROADWELL_XEON_D,  0x02,   0x14 },
@@ -144,6 +143,13 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
 {
        int i;
+        /*
+         * We know that the hypervisor lie to us on the microcode version so
+         * we may as well hope that it is running the correct version.
+         */
+        if (cpu_has(c, X86_FEATURE_HYPERVISOR))
+                return false;
        for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                if (c->x86_model == spectre_bad_microcodes[i].model &&
                    c->x86_stepping == spectre_bad_microcodes[i].stepping)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8ff94d1e2dce..466f47301334 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -56,6 +56,9 @@
 static DEFINE_MUTEX(mce_log_mutex);
+/* sysfs synchronization */
+static DEFINE_MUTEX(mce_sysfs_mutex);
 #define CREATE_TRACE_POINTS
 #include <trace/events/mce.h>
@@ -130,6 +133,8 @@ void mce_setup(struct mce *m)
        if (this_cpu_has(X86_FEATURE_INTEL_PPIN))
                rdmsrl(MSR_PPIN, m->ppin);
+        m->microcode = boot_cpu_data.microcode;
 }
 DEFINE_PER_CPU(struct mce, injectm);
@@ -262,7 +267,7 @@ static void __print_mce(struct mce *m)
         */
        pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n",
                m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid,
-                cpu_data(m->extcpu).microcode);
+                m->microcode);
 }
 static void print_mce(struct mce *m)
@@ -2086,6 +2091,7 @@ static ssize_t set_ignore_ce(struct device *s,
        if (kstrtou64(buf, 0, &new) < 0)
                return -EINVAL;
+        mutex_lock(&mce_sysfs_mutex);
        if (mca_cfg.ignore_ce ^ !!new) {
                if (new) {
                        /* disable ce features */
@@ -2098,6 +2104,8 @@ static ssize_t set_ignore_ce(struct device *s,
                        on_each_cpu(mce_enable_ce, (void *)1, 1);
                }
        }
+        mutex_unlock(&mce_sysfs_mutex);
        return size;
 }
@@ -2110,6 +2118,7 @@ static ssize_t set_cmci_disabled(struct device *s,
        if (kstrtou64(buf, 0, &new) < 0)
                return -EINVAL;
+        mutex_lock(&mce_sysfs_mutex);
        if (mca_cfg.cmci_disabled ^ !!new) {
                if (new) {
                        /* disable cmci */
@@ -2121,6 +2130,8 @@ static ssize_t set_cmci_disabled(struct device *s,
                        on_each_cpu(mce_enable_ce, NULL, 1);
                }
        }
+        mutex_unlock(&mce_sysfs_mutex);
        return size;
 }
@@ -2128,8 +2139,19 @@ static ssize_t store_int_with_restart(struct device *s,
                                      struct device_attribute *attr,
                                      const char *buf, size_t size)
 {
-        ssize_t ret = device_store_int(s, attr, buf, size);
+        unsigned long old_check_interval = check_interval;
+        ssize_t ret = device_store_ulong(s, attr, buf, size);
+        if (check_interval == old_check_interval)
+                return ret;
+        if (check_interval < 1)
+                check_interval = 1;
+        mutex_lock(&mce_sysfs_mutex);
        mce_restart();
+        mutex_unlock(&mce_sysfs_mutex);
        return ret;
 }
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index a998e1a7d46f..48179928ff38 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -339,7 +339,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
                return -EINVAL;
        ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
-        if (ret != UCODE_OK)
+        if (ret > UCODE_UPDATED)
                return -EINVAL;
        return 0;
@@ -683,27 +683,35 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
 static enum ucode_state
 load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 {
+        struct ucode_patch *p;
        enum ucode_state ret;
        /* free old equiv table */
        free_equiv_cpu_table();
        ret = __load_microcode_amd(family, data, size);
+        if (ret != UCODE_OK) {
-        if (ret != UCODE_OK)
                cleanup();
+                return ret;
+        }
-#ifdef CONFIG_X86_32
+        p = find_patch(0);
-        /* save BSP's matching patch for early load */
+        if (!p) {
-        if (save) {
+                return ret;
-                struct ucode_patch *p = find_patch(0);
+        } else {
-                if (p) {
+                if (boot_cpu_data.microcode == p->patch_id)
-                        memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
+                        return ret;
-                        memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
-                                                               PATCH_MAX_SIZE));
+                ret = UCODE_NEW;
-                }
        }
-#endif
+        /* save BSP's matching patch for early load */
+        if (!save)
+                return ret;
+        memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
+        memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
        return ret;
 }
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index aa1b9a422f2b..10c4fc2c91f8 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -22,13 +22,16 @@
 #define pr_fmt(fmt) "microcode: " fmt
 #include <linux/platform_device.h>
+#include <linux/stop_machine.h>
 #include <linux/syscore_ops.h>
 #include <linux/miscdevice.h>
 #include <linux/capability.h>
 #include <linux/firmware.h>
 #include <linux/kernel.h>
+#include <linux/delay.h>
 #include <linux/mutex.h>
 #include <linux/cpu.h>
+#include <linux/nmi.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
@@ -64,6 +67,11 @@ LIST_HEAD(microcode_cache);
 */
 static DEFINE_MUTEX(microcode_mutex);
+/*
+ * Serialize late loading so that CPUs get updated one-by-one.
+ */
+static DEFINE_SPINLOCK(update_lock);
 struct ucode_cpu_info           ucode_cpu_info[NR_CPUS];
 struct cpu_info_ctx {
@@ -373,26 +381,23 @@ static int collect_cpu_info(int cpu)
        return ret;
 }
-struct apply_microcode_ctx {
-        enum ucode_state err;
-};
 static void apply_microcode_local(void *arg)
 {
-        struct apply_microcode_ctx *ctx = arg;
+        enum ucode_state *err = arg;
-        ctx->err = microcode_ops->apply_microcode(smp_processor_id());
+        *err = microcode_ops->apply_microcode(smp_processor_id());
 }
 static int apply_microcode_on_target(int cpu)
 {
-        struct apply_microcode_ctx ctx = { .err = 0 };
+        enum ucode_state err;
        int ret;
-        ret = smp_call_function_single(cpu, apply_microcode_local, &ctx, 1);
+        ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1);
-        if (!ret)
+        if (!ret) {
-                ret = ctx.err;
+                if (err == UCODE_ERROR)
+                        ret = 1;
+        }
        return ret;
 }
@@ -489,19 +494,114 @@ static void __exit microcode_dev_exit(void)
 /* fake device for request_firmware */
 static struct platform_device   *microcode_pdev;
-static enum ucode_state reload_for_cpu(int cpu)
+/*
+ * Late loading dance. Why the heavy-handed stomp_machine effort?
+ *
+ * - HT siblings must be idle and not execute other code while the other sibling
+ *   is loading microcode in order to avoid any negative interactions caused by
+ *   the loading.
+ *
+ * - In addition, microcode update on the cores must be serialized until this
+ *   requirement can be relaxed in the future. Right now, this is conservative
+ *   and good.
+ */
+#define SPINUNIT 100 /* 100 nsec */
+static int check_online_cpus(void)
 {
-        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+        if (num_online_cpus() == num_present_cpus())
-        enum ucode_state ustate;
+                return 0;
-        if (!uci->valid)
+        pr_err("Not all CPUs online, aborting microcode update.\n");
-                return UCODE_OK;
+        return -EINVAL;
+}
+static atomic_t late_cpus_in;
+static atomic_t late_cpus_out;
+static int __wait_for_cpus(atomic_t *t, long long timeout)
+{
+        int all_cpus = num_online_cpus();
+        atomic_inc(t);
-        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev, true);
+        while (atomic_read(t) < all_cpus) {
-        if (ustate != UCODE_OK)
+                if (timeout < SPINUNIT) {
-                return ustate;
+                        pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n",
+                                all_cpus - atomic_read(t));
+                        return 1;
+                }
-        return apply_microcode_on_target(cpu);
+                ndelay(SPINUNIT);
+                timeout -= SPINUNIT;
+                touch_nmi_watchdog();
+        }
+        return 0;
+}
+/*
+ * Returns:
+ * < 0 - on error
+ *   0 - no update done
+ *   1 - microcode was updated
+ */
+static int __reload_late(void *info)
+{
+        int cpu = smp_processor_id();
+        enum ucode_state err;
+        int ret = 0;
+        /*
+         * Wait for all CPUs to arrive. A load will not be attempted unless all
+         * CPUs show up.
+         * */
+        if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC))
+                return -1;
+        spin_lock(&update_lock);
+        apply_microcode_local(&err);
+        spin_unlock(&update_lock);
+        if (err > UCODE_NFOUND) {
+                pr_warn("Error reloading microcode on CPU %d\n", cpu);
+                return -1;
+        /* siblings return UCODE_OK because their engine got updated already */
+        } else if (err == UCODE_UPDATED || err == UCODE_OK) {
+                ret = 1;
+        } else {
+                return ret;
+        }
+        /*
+         * Increase the wait timeout to a safe value here since we're
+         * serializing the microcode update and that could take a while on a
+         * large number of CPUs. And that is fine as the *actual* timeout will
+         * be determined by the last CPU finished updating and thus cut short.
+         */
+        if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC * num_online_cpus()))
+                panic("Timeout during microcode update!\n");
+        return ret;
+}
+/*
+ * Reload microcode late on all CPUs. Wait for a sec until they
+ * all gather together.
+ */
+static int microcode_reload_late(void)
+{
+        int ret;
+        atomic_set(&late_cpus_in,  0);
+        atomic_set(&late_cpus_out, 0);
+        ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
+        if (ret > 0)
+                microcode_check();
+        return ret;
 }
 static ssize_t reload_store(struct device *dev,
@@ -509,10 +609,9 @@ static ssize_t reload_store(struct device *dev,
                            const char *buf, size_t size)
 {
        enum ucode_state tmp_ret = UCODE_OK;
-        bool do_callback = false;
+        int bsp = boot_cpu_data.cpu_index;
        unsigned long val;
        ssize_t ret = 0;
-        int cpu;
        ret = kstrtoul(buf, 0, &val);
        if (ret)
@@ -521,29 +620,24 @@ static ssize_t reload_store(struct device *dev,
        if (val != 1)
                return size;
-        get_online_cpus();
+        tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev, true);
-        mutex_lock(&microcode_mutex);
+        if (tmp_ret != UCODE_NEW)
-        for_each_online_cpu(cpu) {
+                return size;
-                tmp_ret = reload_for_cpu(cpu);
-                if (tmp_ret > UCODE_NFOUND) {
-                        pr_warn("Error reloading microcode on CPU %d\n", cpu);
-                        /* set retval for the first encountered reload error */
-                        if (!ret)
-                                ret = -EINVAL;
-                }
-                if (tmp_ret == UCODE_UPDATED)
+        get_online_cpus();
-                        do_callback = true;
-        }
-        if (!ret && do_callback)
+        ret = check_online_cpus();
-                microcode_check();
+        if (ret)
+                goto put;
+        mutex_lock(&microcode_mutex);
+        ret = microcode_reload_late();
        mutex_unlock(&microcode_mutex);
+put:
        put_online_cpus();
-        if (!ret)
+        if (ret >= 0)
                ret = size;
        return ret;
@@ -611,10 +705,8 @@ static enum ucode_state microcode_init_cpu(int cpu, bool refresh_fw)
        if (system_state != SYSTEM_RUNNING)
                return UCODE_NFOUND;
-        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev,
+        ustate = microcode_ops->request_microcode_fw(cpu, &microcode_pdev->dev, refresh_fw);
-                                                     refresh_fw);
+        if (ustate == UCODE_NEW) {
-        if (ustate == UCODE_OK) {
                pr_debug("CPU%d updated upon init\n", cpu);
                apply_microcode_on_target(cpu);
        }
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 923054a6b760..32b8e5724f96 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -589,6 +589,23 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
        if (!mc)
                return 0;
+        /*
+         * Save us the MSR write below - which is a particular expensive
+         * operation - when the other hyperthread has updated the microcode
+         * already.
+         */
+        rev = intel_get_microcode_revision();
+        if (rev >= mc->hdr.rev) {
+                uci->cpu_sig.rev = rev;
+                return UCODE_OK;
+        }
+        /*
+         * Writeback and invalidate caches before updating microcode to avoid
+         * internal issues depending on what the microcode is updating.
+         */
+        native_wbinvd();
        /* write microcode via MSR 0x79 */
        native_wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits);
@@ -774,9 +791,9 @@ static int collect_cpu_info(int cpu_num, struct cpu_signature *csig)
 static enum ucode_state apply_microcode_intel(int cpu)
 {
+        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
        struct microcode_intel *mc;
-        struct ucode_cpu_info *uci;
-        struct cpuinfo_x86 *c;
        static int prev_rev;
        u32 rev;
@@ -784,15 +801,32 @@ static enum ucode_state apply_microcode_intel(int cpu)
        if (WARN_ON(raw_smp_processor_id() != cpu))
                return UCODE_ERROR;
-        uci = ucode_cpu_info + cpu;
+        /* Look for a newer patch in our cache: */
-        mc = uci->mc;
+        mc = find_patch(uci);
        if (!mc) {
-                /* Look for a newer patch in our cache: */
+                mc = uci->mc;
-                mc = find_patch(uci);
                if (!mc)
                        return UCODE_NFOUND;
        }
+        /*
+         * Save us the MSR write below - which is a particular expensive
+         * operation - when the other hyperthread has updated the microcode
+         * already.
+         */
+        rev = intel_get_microcode_revision();
+        if (rev >= mc->hdr.rev) {
+                uci->cpu_sig.rev = rev;
+                c->microcode = rev;
+                return UCODE_OK;
+        }
+        /*
+         * Writeback and invalidate caches before updating microcode to avoid
+         * internal issues depending on what the microcode is updating.
+         */
+        native_wbinvd();
        /* write microcode via MSR 0x79 */
        wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits);
@@ -813,8 +847,6 @@ static enum ucode_state apply_microcode_intel(int cpu)
                prev_rev = rev;
        }
-        c = &cpu_data(cpu);
        uci->cpu_sig.rev = rev;
        c->microcode = rev;
@@ -830,6 +862,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
        unsigned int leftover = size;
        unsigned int curr_mc_size = 0, new_mc_size = 0;
        unsigned int csig, cpf;
+        enum ucode_state ret = UCODE_OK;
        while (leftover) {
                struct microcode_header_intel mc_header;
@@ -871,6 +904,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
                        new_mc  = mc;
                        new_mc_size = mc_size;
                        mc = NULL;      /* trigger new vmalloc */
+                        ret = UCODE_NEW;
                }
                ucode_ptr += mc_size;
@@ -900,7 +934,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
        pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
                 cpu, new_rev, uci->cpu_sig.rev);
-        return UCODE_OK;
+        return ret;
 }
 static int get_ucode_fw(void *to, const void *from, size_t n)
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index 2f723301eb58..38deafebb21b 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -23,7 +23,7 @@
 /*
 * this changes the io permissions bitmap in the current task.
 */
-asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
+SYSCALL_DEFINE3(ioperm, unsigned long, from, unsigned long, num, int, turn_on)
 {
        struct thread_struct *t = &current->thread;
        struct tss_struct *tss;
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index bd36f3c33cd0..0715f827607c 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1168,10 +1168,18 @@ NOKPROBE_SYMBOL(longjmp_break_handler);
 bool arch_within_kprobe_blacklist(unsigned long addr)
 {
+        bool is_in_entry_trampoline_section = false;
+#ifdef CONFIG_X86_64
+        is_in_entry_trampoline_section =
+                (addr >= (unsigned long)__entry_trampoline_start &&
+                 addr < (unsigned long)__entry_trampoline_end);
+#endif
        return  (addr >= (unsigned long)__kprobes_text_start &&
                 addr < (unsigned long)__kprobes_text_end) ||
                (addr >= (unsigned long)__entry_text_start &&
-                 addr < (unsigned long)__entry_text_end);
+                 addr < (unsigned long)__entry_text_end) ||
+                is_in_entry_trampoline_section;
 }
 int __init arch_init_kprobes(void)
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index ac057f9b0763..0d930d8987cc 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -43,6 +43,13 @@ static inline void signal_compat_build_tests(void)
        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields) != 3 * sizeof(int));
 #define CHECK_CSI_OFFSET(name)    BUILD_BUG_ON(_sifields_offset != offsetof(compat_siginfo_t, _sifields.name))
+        BUILD_BUG_ON(offsetof(siginfo_t, si_signo) != 0);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_errno) != 4);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_code)  != 8);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_signo) != 0);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_errno) != 4);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_code)  != 8);
         /*
         * Ensure that the size of each si_field never changes.
         * If it does, it is a sign that the
@@ -63,36 +70,94 @@ static inline void signal_compat_build_tests(void)
        CHECK_CSI_SIZE  (_kill, 2*sizeof(int));
        CHECK_SI_SIZE   (_kill, 2*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid) != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid) != 0xC);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid) != 0x10);
        CHECK_CSI_OFFSET(_timer);
        CHECK_CSI_SIZE  (_timer, 3*sizeof(int));
        CHECK_SI_SIZE   (_timer, 6*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_tid)     != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_overrun) != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_value)   != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_tid)     != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_overrun) != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_value)   != 0x14);
        CHECK_CSI_OFFSET(_rt);
        CHECK_CSI_SIZE  (_rt, 3*sizeof(int));
        CHECK_SI_SIZE   (_rt, 4*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid)   != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid)   != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_value) != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid)   != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid)   != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_value) != 0x14);
        CHECK_CSI_OFFSET(_sigchld);
        CHECK_CSI_SIZE  (_sigchld, 5*sizeof(int));
        CHECK_SI_SIZE   (_sigchld, 8*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pid)    != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_uid)    != 0x14);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_status) != 0x18);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_utime)  != 0x20);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_stime)  != 0x28);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pid)    != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_uid)    != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_status) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_utime)  != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_stime)  != 0x1C);
 #ifdef CONFIG_X86_X32_ABI
        CHECK_CSI_OFFSET(_sigchld_x32);
        CHECK_CSI_SIZE  (_sigchld_x32, 7*sizeof(int));
        /* no _sigchld_x32 in the generic siginfo_t */
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields._sigchld_x32._utime)  != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, _sifields._sigchld_x32._stime)  != 0x20);
 #endif
        CHECK_CSI_OFFSET(_sigfault);
        CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
        CHECK_SI_SIZE   (_sigfault, 8*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_addr) != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr) != 0x0C);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_addr_lsb) != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_addr_lsb) != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_lower) != 0x20);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_upper) != 0x28);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_lower) != 0x14);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_upper) != 0x18);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_pkey) != 0x20);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_pkey) != 0x14);
        CHECK_CSI_OFFSET(_sigpoll);
        CHECK_CSI_SIZE  (_sigpoll, 2*sizeof(int));
        CHECK_SI_SIZE   (_sigpoll, 4*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_band)   != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_fd)     != 0x18);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_band) != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_fd)   != 0x10);
        CHECK_CSI_OFFSET(_sigsys);
        CHECK_CSI_SIZE  (_sigsys, 3*sizeof(int));
        CHECK_SI_SIZE   (_sigsys, 4*sizeof(int));
+        BUILD_BUG_ON(offsetof(siginfo_t, si_call_addr) != 0x10);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_syscall)   != 0x18);
+        BUILD_BUG_ON(offsetof(siginfo_t, si_arch)      != 0x1C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_call_addr) != 0x0C);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_syscall)   != 0x10);
+        BUILD_BUG_ON(offsetof(compat_siginfo_t, si_arch)      != 0x14);
        /* any new si_fields should be added here */
 }
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 5edb27f1a2c4..9d0b5af7db91 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -727,7 +727,8 @@ void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code)
        return;
 check_vip:
-        if (VEFLAGS & X86_EFLAGS_VIP) {
+        if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) ==
+            (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) {
                save_v86_state(regs, VM86_STI);
                return;
        }
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 9b138a06c1a4..b854ebf5851b 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -118,9 +118,11 @@ SECTIONS
 #ifdef CONFIG_X86_64
                . = ALIGN(PAGE_SIZE);
+                VMLINUX_SYMBOL(__entry_trampoline_start) = .;
                _entry_trampoline = .;
                *(.entry_trampoline)
                . = ALIGN(PAGE_SIZE);
+                VMLINUX_SYMBOL(__entry_trampoline_end) = .;
                ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big");
 #endif
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f551962ac294..763bb3bade63 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2770,8 +2770,10 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
        else
                pte_access &= ~ACC_WRITE_MASK;
+        if (!kvm_is_mmio_pfn(pfn))
+                spte |= shadow_me_mask;
        spte |= (u64)pfn << PAGE_SHIFT;
-        spte |= shadow_me_mask;
        if (pte_access & ACC_WRITE_MASK) {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 051dab74e4e9..2d87603f9179 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1045,6 +1045,13 @@ static inline bool is_machine_check(u32 intr_info)
                (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
 }
+/* Undocumented: icebp/int1 */
+static inline bool is_icebp(u32 intr_info)
+{
+        return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+                == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK);
+}
 static inline bool cpu_has_vmx_msr_bitmap(void)
 {
        return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS;
@@ -6179,7 +6186,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
                      (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
                        vcpu->arch.dr6 &= ~15;
                        vcpu->arch.dr6 |= dr6 | DR6_RTM;
-                        if (!(dr6 & ~DR6_RESERVED)) /* icebp */
+                        if (is_icebp(intr_info))
                                skip_emulated_instruction(vcpu);
                        kvm_queue_exception(vcpu, DB_VECTOR);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index c88573d90f3e..25a30b5d6582 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -330,7 +330,7 @@ static noinline int vmalloc_fault(unsigned long address)
        if (!pmd_k)
                return -1;
-        if (pmd_huge(*pmd_k))
+        if (pmd_large(*pmd_k))
                return 0;
        pte_k = pte_offset_kernel(pmd_k, address);
@@ -475,7 +475,7 @@ static noinline int vmalloc_fault(unsigned long address)
        if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref))
                BUG();
-        if (pud_huge(*pud))
+        if (pud_large(*pud))
                return 0;
        pmd = pmd_offset(pud, address);
@@ -486,7 +486,7 @@ static noinline int vmalloc_fault(unsigned long address)
        if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref))
                BUG();
-        if (pmd_huge(*pmd))
+        if (pmd_large(*pmd))
                return 0;
        pte_ref = pte_offset_kernel(pmd_ref, address);
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 8b72923f1d35..af11a2890235 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -800,17 +800,11 @@ int arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
 #define PAGE_INUSE 0xFD
-static void __meminit free_pagetable(struct page *page, int order,
+static void __meminit free_pagetable(struct page *page, int order)
-                struct vmem_altmap *altmap)
 {
        unsigned long magic;
        unsigned int nr_pages = 1 << order;
-        if (altmap) {
-                vmem_altmap_free(altmap, nr_pages);
-                return;
-        }
        /* bootmem page has reserved flag */
        if (PageReserved(page)) {
                __ClearPageReserved(page);
@@ -826,9 +820,17 @@ static void __meminit free_pagetable(struct page *page, int order,
                free_pages((unsigned long)page_address(page), order);
 }
-static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd,
+static void __meminit free_hugepage_table(struct page *page,
                struct vmem_altmap *altmap)
 {
+        if (altmap)
+                vmem_altmap_free(altmap, PMD_SIZE / PAGE_SIZE);
+        else
+                free_pagetable(page, get_order(PMD_SIZE));
+}
+static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)
+{
        pte_t *pte;
        int i;
@@ -839,14 +841,13 @@ static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd,
        }
        /* free a pte talbe */
-        free_pagetable(pmd_page(*pmd), 0, altmap);
+        free_pagetable(pmd_page(*pmd), 0);
        spin_lock(&init_mm.page_table_lock);
        pmd_clear(pmd);
        spin_unlock(&init_mm.page_table_lock);
 }
-static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud,
+static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud)
-                struct vmem_altmap *altmap)
 {
        pmd_t *pmd;
        int i;
@@ -858,14 +859,13 @@ static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud,
        }
        /* free a pmd talbe */
-        free_pagetable(pud_page(*pud), 0, altmap);
+        free_pagetable(pud_page(*pud), 0);
        spin_lock(&init_mm.page_table_lock);
        pud_clear(pud);
        spin_unlock(&init_mm.page_table_lock);
 }
-static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d,
+static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d)
-                struct vmem_altmap *altmap)
 {
        pud_t *pud;
        int i;
@@ -877,7 +877,7 @@ static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d,
        }
        /* free a pud talbe */
-        free_pagetable(p4d_page(*p4d), 0, altmap);
+        free_pagetable(p4d_page(*p4d), 0);
        spin_lock(&init_mm.page_table_lock);
        p4d_clear(p4d);
        spin_unlock(&init_mm.page_table_lock);
@@ -885,7 +885,7 @@ static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d,
 static void __meminit
 remove_pte_table(pte_t *pte_start, unsigned long addr, unsigned long end,
-                 struct vmem_altmap *altmap, bool direct)
+                 bool direct)
 {
        unsigned long next, pages = 0;
        pte_t *pte;
@@ -916,7 +916,7 @@ remove_pte_table(pte_t *pte_start, unsigned long addr, unsigned long end,
                         * freed when offlining, or simplely not in use.
                         */
                        if (!direct)
-                                free_pagetable(pte_page(*pte), 0, altmap);
+                                free_pagetable(pte_page(*pte), 0);
                        spin_lock(&init_mm.page_table_lock);
                        pte_clear(&init_mm, addr, pte);
@@ -939,7 +939,7 @@ remove_pte_table(pte_t *pte_start, unsigned long addr, unsigned long end,
                        page_addr = page_address(pte_page(*pte));
                        if (!memchr_inv(page_addr, PAGE_INUSE, PAGE_SIZE)) {
-                                free_pagetable(pte_page(*pte), 0, altmap);
+                                free_pagetable(pte_page(*pte), 0);
                                spin_lock(&init_mm.page_table_lock);
                                pte_clear(&init_mm, addr, pte);
@@ -974,9 +974,8 @@ remove_pmd_table(pmd_t *pmd_start, unsigned long addr, unsigned long end,
                        if (IS_ALIGNED(addr, PMD_SIZE) &&
                            IS_ALIGNED(next, PMD_SIZE)) {
                                if (!direct)
-                                        free_pagetable(pmd_page(*pmd),
+                                        free_hugepage_table(pmd_page(*pmd),
-                                                       get_order(PMD_SIZE),
+                                                            altmap);
-                                                       altmap);
                                spin_lock(&init_mm.page_table_lock);
                                pmd_clear(pmd);
@@ -989,9 +988,8 @@ remove_pmd_table(pmd_t *pmd_start, unsigned long addr, unsigned long end,
                                page_addr = page_address(pmd_page(*pmd));
                                if (!memchr_inv(page_addr, PAGE_INUSE,
                                                PMD_SIZE)) {
-                                        free_pagetable(pmd_page(*pmd),
+                                        free_hugepage_table(pmd_page(*pmd),
-                                                       get_order(PMD_SIZE),
+                                                            altmap);
-                                                       altmap);
                                        spin_lock(&init_mm.page_table_lock);
                                        pmd_clear(pmd);
@@ -1003,8 +1001,8 @@ remove_pmd_table(pmd_t *pmd_start, unsigned long addr, unsigned long end,
                }
                pte_base = (pte_t *)pmd_page_vaddr(*pmd);
-                remove_pte_table(pte_base, addr, next, altmap, direct);
+                remove_pte_table(pte_base, addr, next, direct);
-                free_pte_table(pte_base, pmd, altmap);
+                free_pte_table(pte_base, pmd);
        }
        /* Call free_pmd_table() in remove_pud_table(). */
@@ -1033,8 +1031,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,
                            IS_ALIGNED(next, PUD_SIZE)) {
                                if (!direct)
                                        free_pagetable(pud_page(*pud),
-                                                       get_order(PUD_SIZE),
+                                                       get_order(PUD_SIZE));
-                                                       altmap);
                                spin_lock(&init_mm.page_table_lock);
                                pud_clear(pud);
@@ -1048,8 +1045,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,
                                if (!memchr_inv(page_addr, PAGE_INUSE,
                                                PUD_SIZE)) {
                                        free_pagetable(pud_page(*pud),
-                                                       get_order(PUD_SIZE),
+                                                       get_order(PUD_SIZE));
-                                                       altmap);
                                        spin_lock(&init_mm.page_table_lock);
                                        pud_clear(pud);
@@ -1062,7 +1058,7 @@ remove_pud_table(pud_t *pud_start, unsigned long addr, unsigned long end,
                pmd_base = pmd_offset(pud, 0);
                remove_pmd_table(pmd_base, addr, next, direct, altmap);
-                free_pmd_table(pmd_base, pud, altmap);
+                free_pmd_table(pmd_base, pud);
        }
        if (direct)
@@ -1094,7 +1090,7 @@ remove_p4d_table(p4d_t *p4d_start, unsigned long addr, unsigned long end,
                 * to adapt for boot-time switching between 4 and 5 level page tables.
                 */
                if (CONFIG_PGTABLE_LEVELS == 5)
-                        free_pud_table(pud_base, p4d, altmap);
+                        free_pud_table(pud_base, p4d);
        }
        if (direct)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 004abf9ebf12..34cda7e0551b 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -702,4 +702,52 @@ int pmd_clear_huge(pmd_t *pmd)
        return 0;
 }
+/**
+ * pud_free_pmd_page - Clear pud entry and free pmd page.
+ * @pud: Pointer to a PUD.
+ *
+ * Context: The pud range has been unmaped and TLB purged.
+ * Return: 1 if clearing the entry succeeded. 0 otherwise.
+ */
+int pud_free_pmd_page(pud_t *pud)
+{
+        pmd_t *pmd;
+        int i;
+        if (pud_none(*pud))
+                return 1;
+        pmd = (pmd_t *)pud_page_vaddr(*pud);
+        for (i = 0; i < PTRS_PER_PMD; i++)
+                if (!pmd_free_pte_page(&pmd[i]))
+                        return 0;
+        pud_clear(pud);
+        free_page((unsigned long)pmd);
+        return 1;
+}
+/**
+ * pmd_free_pte_page - Clear pmd entry and free pte page.
+ * @pmd: Pointer to a PMD.
+ *
+ * Context: The pmd range has been unmaped and TLB purged.
+ * Return: 1 if clearing the entry succeeded. 0 otherwise.
+ */
+int pmd_free_pte_page(pmd_t *pmd)
+{
+        pte_t *pte;
+        if (pmd_none(*pmd))
+                return 1;
+        pte = (pte_t *)pmd_page_vaddr(*pmd);
+        pmd_clear(pmd);
+        free_page((unsigned long)pte);
+        return 1;
+}
 #endif  /* CONFIG_HAVE_ARCH_HUGE_VMAP */
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index ce38f165489b..631507f0c198 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -332,7 +332,7 @@ static void __init pti_clone_user_shared(void)
 }
 /*
- * Clone the ESPFIX P4D into the user space visinble page table
+ * Clone the ESPFIX P4D into the user space visible page table
 */
 static void __init pti_setup_espfix64(void)
 {
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index eb661fff94d7..b725154182cc 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1223,7 +1223,7 @@ skip_init_addrs:
         * may converge on the last pass. In such case do one more
         * pass to emit the final image
         */
-        for (pass = 0; pass < 10 || image; pass++) {
+        for (pass = 0; pass < 20 || image; pass++) {
                proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
                if (proglen <= 0) {
                        image = NULL;
@@ -1250,6 +1250,7 @@ skip_init_addrs:
                        }
                }
                oldproglen = proglen;
+                cond_resched();
        }
        if (bpf_jit_enable > 1)
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index 11b113f8e367..ebb626ffb5fa 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -74,10 +74,10 @@ void __init acpi_watchdog_init(void)
                res.start = gas->address;
                if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
                        res.flags = IORESOURCE_MEM;
-                        res.end = res.start + ALIGN(gas->access_width, 4);
+                        res.end = res.start + ALIGN(gas->access_width, 4) - 1;
                } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
                        res.flags = IORESOURCE_IO;
-                        res.end = res.start + gas->access_width;
+                        res.end = res.start + gas->access_width - 1;
                } else {
                        pr_warn("Unsupported address space: %u\n",
                                gas->space_id);
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 7128488a3a72..f2eb6c37ea0a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -70,7 +70,6 @@ static async_cookie_t async_cookie;
 static bool battery_driver_registered;
 static int battery_bix_broken_package;
 static int battery_notification_delay_ms;
-static int battery_full_discharging;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -215,12 +214,9 @@ static int acpi_battery_get_property(struct power_supply *psy,
                return -ENODEV;
        switch (psp) {
        case POWER_SUPPLY_PROP_STATUS:
-                if (battery->state & ACPI_BATTERY_STATE_DISCHARGING) {
+                if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
-                        if (battery_full_discharging && battery->rate_now == 0)
+                        val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
-                                val->intval = POWER_SUPPLY_STATUS_FULL;
+                else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
-                        else
-                                val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
-                } else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
                        val->intval = POWER_SUPPLY_STATUS_CHARGING;
                else if (acpi_battery_is_charged(battery))
                        val->intval = POWER_SUPPLY_STATUS_FULL;
@@ -1170,12 +1166,6 @@ battery_notification_delay_quirk(const struct dmi_system_id *d)
        return 0;
 }
-static int __init battery_full_discharging_quirk(const struct dmi_system_id *d)
-{
-        battery_full_discharging = 1;
-        return 0;
-}
 static const struct dmi_system_id bat_dmi_table[] __initconst = {
        {
                .callback = battery_bix_broken_package_quirk,
@@ -1193,38 +1183,6 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-573G"),
                },
        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS GL502VSK",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "GL502VSK"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX305LA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX305LA"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX360UA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX360UA"),
-                },
-        },
-        {
-                .callback = battery_full_discharging_quirk,
-                .ident = "ASUS UX410UAK",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "UX410UAK"),
-                },
-        },
        {},
 };
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index bbe48ad20886..eb09ef55c38a 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2675,10 +2675,14 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
        else
                ndr_desc->numa_node = NUMA_NO_NODE;
-        if(acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_CACHE_FLUSH)
+        /*
+         * Persistence domain bits are hierarchical, if
+         * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then
+         * ACPI_NFIT_CAPABILITY_MEM_FLUSH is implied.
+         */
+        if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_CACHE_FLUSH)
                set_bit(ND_REGION_PERSIST_CACHE, &ndr_desc->flags);
+        else if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_MEM_FLUSH)
-        if (acpi_desc->platform_cap & ACPI_NFIT_CAPABILITY_MEM_FLUSH)
                set_bit(ND_REGION_PERSIST_MEMCTRL, &ndr_desc->flags);
        list_for_each_entry(nfit_memdev, &acpi_desc->memdevs, list) {
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 8ccaae3550d2..85167603b9c9 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm)
 */
 int acpi_map_pxm_to_online_node(int pxm)
 {
-        int node, n, dist, min_dist;
+        int node, min_node;
        node = acpi_map_pxm_to_node(pxm);
        if (node == NUMA_NO_NODE)
                node = 0;
+        min_node = node;
        if (!node_online(node)) {
-                min_dist = INT_MAX;
+                int min_dist = INT_MAX, dist, n;
                for_each_online_node(n) {
                        dist = node_distance(node, n);
                        if (dist < min_dist) {
                                min_dist = dist;
-                                node = n;
+                                min_node = n;
                        }
                }
        }
-        return node;
+        return min_node;
 }
 EXPORT_SYMBOL(acpi_map_pxm_to_online_node);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 355a95a83a34..1ff17799769d 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -550,7 +550,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
          .driver_data = board_ahci_yes_fbs },
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
          .driver_data = board_ahci_yes_fbs },
-        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642),
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */
+          .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */
          .driver_data = board_ahci_yes_fbs },
        /* Promise */
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index a0de7a38430c..7adcf3caabd0 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -665,6 +665,16 @@ int ahci_stop_engine(struct ata_port *ap)
        if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0)
                return 0;
+        /*
+         * Don't try to issue commands but return with ENODEV if the
+         * AHCI controller not available anymore (e.g. due to PCIe hot
+         * unplugging). Otherwise a 500ms delay for each port is added.
+         */
+        if (tmp == 0xffffffff) {
+                dev_err(ap->host->dev, "AHCI controller unavailable!\n");
+                return -ENODEV;
+        }
        /* setting HBA to idle */
        tmp &= ~PORT_CMD_START;
        writel(tmp, port_mmio + PORT_CMD);
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 341d0ef82cbd..30cc8f1a31e1 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -340,7 +340,7 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port,
 * 2) regulator for controlling the targets power (optional)
 * 3) 0 - AHCI_MAX_CLKS clocks, as specified in the devs devicetree node,
 *    or for non devicetree enabled platforms a single clock
- *      4) phys (optional)
+ * 4) phys (optional)
 *
 * RETURNS:
 * The allocated ahci_host_priv on success, otherwise an ERR_PTR value
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3c09122bf038..7431ccd03316 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4530,6 +4530,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
+        /* Crucial BX100 SSD 500GB has broken LPM support */
+        { "CT500BX100SSD1",             NULL,   ATA_HORKAGE_NOLPM },
+        /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */
+        { "Crucial_CT512MX100*",        "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        /* 512GB MX100 with newer firmware has only LPM issues */
+        { "Crucial_CT512MX100*",        NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */
+        { "Crucial_CT480M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        { "Crucial_CT960M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
        /* devices that don't properly handle queued TRIM commands */
        { "Micron_M500_*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4541,7 +4560,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "Crucial_CT*MX100*",          "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Samsung SSD 8*",             NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Samsung SSD 840*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung SSD 850*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "FCCT*M500*",                 NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -5401,8 +5422,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
         * We guarantee to LLDs that they will have at least one
         * non-zero sg if the command is a data command.
         */
-        if (WARN_ON_ONCE(ata_is_data(prot) &&
+        if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes))
-                         (!qc->sg || !qc->n_elem || !qc->nbytes)))
                goto sys_err;
        if (ata_is_dma(prot) || (ata_is_pio(prot) &&
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 11c3137d7b0a..c016829a38fd 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -815,7 +815,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
        if (ap->pflags & ATA_PFLAG_LOADING)
                ap->pflags &= ~ATA_PFLAG_LOADING;
-        else if (ap->pflags & ATA_PFLAG_SCSI_HOTPLUG)
+        else if ((ap->pflags & ATA_PFLAG_SCSI_HOTPLUG) &&
+                !(ap->flags & ATA_FLAG_SAS_HOST))
                schedule_delayed_work(&ap->hotplug_task, 0);
        if (ap->pflags & ATA_PFLAG_RECOVERED)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 66be961c93a4..89a9d4a2efc8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3316,6 +3316,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
                goto invalid_fld;
        }
+        /* We may not issue NCQ commands to devices not supporting NCQ */
+        if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) {
+                fp = 1;
+                goto invalid_fld;
+        }
        /* sanity check for pio multi commands */
        if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
                fp = 1;
@@ -4282,7 +4288,7 @@ static inline void ata_scsi_dump_cdb(struct ata_port *ap,
 #ifdef ATA_DEBUG
        struct scsi_device *scsidev = cmd->device;
-        DPRINTK("CDB (%u:%d,%d,%d) %9ph\n",
+        DPRINTK("CDB (%u:%d,%d,%lld) %9ph\n",
                ap->print_id,
                scsidev->channel, scsidev->id, scsidev->lun,
                cmd->cmnd);
@@ -4309,7 +4315,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
                if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
                        /* relay SCSI command to ATAPI device */
                        int len = COMMAND_SIZE(scsi_op);
-                        if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
+                        if (unlikely(len > scmd->cmd_len ||
+                                     len > dev->cdb_len ||
+                                     scmd->cmd_len > ATAPI_CDB_LEN))
                                goto bad_cdb_len;
                        xlat_func = atapi_xlat;
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 80ee2f2a50d0..6456e07db72a 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
        RCAR_GEN1_SATA,
        RCAR_GEN2_SATA,
+        RCAR_GEN3_SATA,
        RCAR_R8A7790_ES1_SATA,
 };
@@ -784,26 +785,11 @@ static void sata_rcar_setup_port(struct ata_host *host)
        ioaddr->command_addr    = ioaddr->cmd_addr + (ATA_REG_CMD << 2);
 }
-static void sata_rcar_init_controller(struct ata_host *host)
+static void sata_rcar_init_module(struct sata_rcar_priv *priv)
 {
-        struct sata_rcar_priv *priv = host->private_data;
        void __iomem *base = priv->base;
        u32 val;
-        /* reset and setup phy */
-        switch (priv->type) {
-        case RCAR_GEN1_SATA:
-                sata_rcar_gen1_phy_init(priv);
-                break;
-        case RCAR_GEN2_SATA:
-        case RCAR_R8A7790_ES1_SATA:
-                sata_rcar_gen2_phy_init(priv);
-                break;
-        default:
-                dev_warn(host->dev, "SATA phy is not initialized\n");
-                break;
-        }
        /* SATA-IP reset state */
        val = ioread32(base + ATAPI_CONTROL1_REG);
        val |= ATAPI_CONTROL1_RESET;
@@ -824,10 +810,33 @@ static void sata_rcar_init_controller(struct ata_host *host)
        /* ack and mask */
        iowrite32(0, base + SATAINTSTAT_REG);
        iowrite32(0x7ff, base + SATAINTMASK_REG);
        /* enable interrupts */
        iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
 }
+static void sata_rcar_init_controller(struct ata_host *host)
+{
+        struct sata_rcar_priv *priv = host->private_data;
+        /* reset and setup phy */
+        switch (priv->type) {
+        case RCAR_GEN1_SATA:
+                sata_rcar_gen1_phy_init(priv);
+                break;
+        case RCAR_GEN2_SATA:
+        case RCAR_GEN3_SATA:
+        case RCAR_R8A7790_ES1_SATA:
+                sata_rcar_gen2_phy_init(priv);
+                break;
+        default:
+                dev_warn(host->dev, "SATA phy is not initialized\n");
+                break;
+        }
+        sata_rcar_init_module(priv);
+}
 static const struct of_device_id sata_rcar_match[] = {
        {
                /* Deprecated by "renesas,sata-r8a7779" */
@@ -856,7 +865,7 @@ static const struct of_device_id sata_rcar_match[] = {
        },
        {
                .compatible = "renesas,sata-r8a7795",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
        },
        {
                .compatible = "renesas,rcar-gen2-sata",
@@ -864,7 +873,7 @@ static const struct of_device_id sata_rcar_match[] = {
        },
        {
                .compatible = "renesas,rcar-gen3-sata",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
        },
        { },
 };
@@ -982,11 +991,18 @@ static int sata_rcar_resume(struct device *dev)
        if (ret)
                return ret;
-        /* ack and mask */
+        if (priv->type == RCAR_GEN3_SATA) {
-        iowrite32(0, base + SATAINTSTAT_REG);
+                sata_rcar_gen2_phy_init(priv);
-        iowrite32(0x7ff, base + SATAINTMASK_REG);
+                sata_rcar_init_module(priv);
-        /* enable interrupts */
+        } else {
-        iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
+                /* ack and mask */
+                iowrite32(0, base + SATAINTSTAT_REG);
+                iowrite32(0x7ff, base + SATAINTMASK_REG);
+                /* enable interrupts */
+                iowrite32(ATAPI_INT_ENABLE_SATAINT,
+                          base + ATAPI_INT_ENABLE_REG);
+        }
        ata_host_resume(host);
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 9180b9bd5821..834509506ef6 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -97,7 +97,7 @@ static struct img_ascii_lcd_config boston_config = {
 static void malta_update(struct img_ascii_lcd_ctx *ctx)
 {
        unsigned int i;
-        int err;
+        int err = 0;
        for (i = 0; i < ctx->cfg->num_chars; i++) {
                err = regmap_write(ctx->regmap,
@@ -180,7 +180,7 @@ static int sead3_wait_lcd_idle(struct img_ascii_lcd_ctx *ctx)
 static void sead3_update(struct img_ascii_lcd_ctx *ctx)
 {
        unsigned int i;
-        int err;
+        int err = 0;
        for (i = 0; i < ctx->cfg->num_chars; i++) {
                err = sead3_wait_lcd_idle(ctx);
@@ -224,7 +224,7 @@ MODULE_DEVICE_TABLE(of, img_ascii_lcd_matches);
 /**
 * img_ascii_lcd_scroll() - scroll the display by a character
- * @arg: really a pointer to the private data structure
+ * @t: really a pointer to the private data structure
 *
 * Scroll the current message along the LCD by one character, rearming the
 * timer if required.
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index ea7869c0d7f9..ec5e8800f8ad 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1372,7 +1372,7 @@ static void panel_process_inputs(void)
                                break;
                        input->rise_timer = 0;
                        input->state = INPUT_ST_RISING;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_RISING:
                        if ((phys_curr & input->mask) != input->value) {
                                input->state = INPUT_ST_LOW;
@@ -1385,11 +1385,11 @@ static void panel_process_inputs(void)
                        }
                        input->high_timer = 0;
                        input->state = INPUT_ST_HIGH;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_HIGH:
                        if (input_state_high(input))
                                break;
-                        /* no break here, fall through */
+                        /* fall through */
                case INPUT_ST_FALLING:
                        input_state_falling(input);
                }
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 87855b5123a6..ee62d2d517bf 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos)
        struct iov_iter i;
        ssize_t bw;
-        iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
+        iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len);
        file_start_write(file);
        bw = vfs_iter_write(file, &i, ppos, 0);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index e126e4cac2ca..92ec1bbece51 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -262,6 +262,7 @@ static DEFINE_SPINLOCK(minor_lock);
 static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo);
 static void blkfront_gather_backend_features(struct blkfront_info *info);
+static int negotiate_mq(struct blkfront_info *info);
 static int get_id_from_freelist(struct blkfront_ring_info *rinfo)
 {
@@ -1774,11 +1775,18 @@ static int talk_to_blkback(struct xenbus_device *dev,
        unsigned int i, max_page_order;
        unsigned int ring_page_order;
+        if (!info)
+                return -ENODEV;
        max_page_order = xenbus_read_unsigned(info->xbdev->otherend,
                                              "max-ring-page-order", 0);
        ring_page_order = min(xen_blkif_max_ring_order, max_page_order);
        info->nr_ring_pages = 1 << ring_page_order;
+        err = negotiate_mq(info);
+        if (err)
+                goto destroy_blkring;
        for (i = 0; i < info->nr_rings; i++) {
                struct blkfront_ring_info *rinfo = &info->rinfo[i];
@@ -1978,11 +1986,6 @@ static int blkfront_probe(struct xenbus_device *dev,
        }
        info->xbdev = dev;
-        err = negotiate_mq(info);
-        if (err) {
-                kfree(info);
-                return err;
-        }
        mutex_init(&info->mutex);
        info->vdevice = vdevice;
@@ -2099,10 +2102,6 @@ static int blkfront_resume(struct xenbus_device *dev)
        blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
-        err = negotiate_mq(info);
-        if (err)
-                return err;
        err = talk_to_blkback(dev, info);
        if (!err)
                blk_mq_update_nr_hw_queues(&info->tag_set, info->nr_rings);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fa4ce83893bb..5cd868ea28ed 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -231,7 +231,6 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
-        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
@@ -264,6 +263,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
        /* QCA ROME chipset */
+        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
        { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
@@ -390,10 +390,10 @@ static const struct usb_device_id blacklist_table[] = {
 */
 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
        {
-                /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
+                /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
                },
        },
        {}
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 6314dfb02969..40b9fb247010 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -244,7 +244,9 @@ static irqreturn_t bcm_host_wake(int irq, void *data)
        bt_dev_dbg(bdev, "Host wake IRQ");
-        pm_request_resume(bdev->dev);
+        pm_runtime_get(bdev->dev);
+        pm_runtime_mark_last_busy(bdev->dev);
+        pm_runtime_put_autosuspend(bdev->dev);
        return IRQ_HANDLED;
 }
@@ -301,7 +303,7 @@ static const struct bcm_set_sleep_mode default_sleep_params = {
        .usb_auto_sleep = 0,
        .usb_resume_timeout = 0,
        .break_to_host = 0,
-        .pulsed_host_wake = 0,
+        .pulsed_host_wake = 1,
 };
 static int bcm_setup_sleep(struct hci_uart *hu)
@@ -586,8 +588,11 @@ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
        } else if (!bcm->rx_skb) {
                /* Delay auto-suspend when receiving completed packet */
                mutex_lock(&bcm_device_lock);
-                if (bcm->dev && bcm_device_exists(bcm->dev))
+                if (bcm->dev && bcm_device_exists(bcm->dev)) {
-                        pm_request_resume(bcm->dev->dev);
+                        pm_runtime_get(bcm->dev->dev);
+                        pm_runtime_mark_last_busy(bcm->dev->dev);
+                        pm_runtime_put_autosuspend(bcm->dev->dev);
+                }
                mutex_unlock(&bcm_device_lock);
        }
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 44301a3d9963..a07f6451694a 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -449,17 +449,17 @@ struct bcm2835_pll_ana_bits {
 static const struct bcm2835_pll_ana_bits bcm2835_ana_default = {
        .mask0 = 0,
        .set0 = 0,
-        .mask1 = (u32)~(A2W_PLL_KI_MASK | A2W_PLL_KP_MASK),
+        .mask1 = A2W_PLL_KI_MASK | A2W_PLL_KP_MASK,
        .set1 = (2 << A2W_PLL_KI_SHIFT) | (8 << A2W_PLL_KP_SHIFT),
-        .mask3 = (u32)~A2W_PLL_KA_MASK,
+        .mask3 = A2W_PLL_KA_MASK,
        .set3 = (2 << A2W_PLL_KA_SHIFT),
        .fb_prediv_mask = BIT(14),
 };
 static const struct bcm2835_pll_ana_bits bcm2835_ana_pllh = {
-        .mask0 = (u32)~(A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK),
+        .mask0 = A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK,
        .set0 = (2 << A2W_PLLH_KA_SHIFT) | (2 << A2W_PLLH_KI_LOW_SHIFT),
-        .mask1 = (u32)~(A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK),
+        .mask1 = A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK,
        .set1 = (6 << A2W_PLLH_KP_SHIFT),
        .mask3 = 0,
        .set3 = 0,
@@ -623,8 +623,10 @@ static int bcm2835_pll_on(struct clk_hw *hw)
                     ~A2W_PLL_CTRL_PWRDN);
        /* Take the PLL out of reset. */
+        spin_lock(&cprman->regs_lock);
        cprman_write(cprman, data->cm_ctrl_reg,
                     cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST);
+        spin_unlock(&cprman->regs_lock);
        /* Wait for the PLL to lock. */
        timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS);
@@ -701,9 +703,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
        }
        /* Unmask the reference clock from the oscillator. */
+        spin_lock(&cprman->regs_lock);
        cprman_write(cprman, A2W_XOSC_CTRL,
                     cprman_read(cprman, A2W_XOSC_CTRL) |
                     data->reference_enable_mask);
+        spin_unlock(&cprman->regs_lock);
        if (do_ana_setup_first)
                bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana);
diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c
index 9f7f931d6b2f..5eb50c31e455 100644
--- a/drivers/clk/clk-aspeed.c
+++ b/drivers/clk/clk-aspeed.c
@@ -205,6 +205,18 @@ static const struct aspeed_clk_soc_data ast2400_data = {
        .calc_pll = aspeed_ast2400_calc_pll,
 };
+static int aspeed_clk_is_enabled(struct clk_hw *hw)
+{
+        struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
+        u32 clk = BIT(gate->clock_idx);
+        u32 enval = (gate->flags & CLK_GATE_SET_TO_DISABLE) ? 0 : clk;
+        u32 reg;
+        regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
+        return ((reg & clk) == enval) ? 1 : 0;
+}
 static int aspeed_clk_enable(struct clk_hw *hw)
 {
        struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
@@ -215,6 +227,11 @@ static int aspeed_clk_enable(struct clk_hw *hw)
        spin_lock_irqsave(gate->lock, flags);
+        if (aspeed_clk_is_enabled(hw)) {
+                spin_unlock_irqrestore(gate->lock, flags);
+                return 0;
+        }
        if (gate->reset_idx >= 0) {
                /* Put IP in reset */
                regmap_update_bits(gate->map, ASPEED_RESET_CTRL, rst, rst);
@@ -255,17 +272,6 @@ static void aspeed_clk_disable(struct clk_hw *hw)
        spin_unlock_irqrestore(gate->lock, flags);
 }
-static int aspeed_clk_is_enabled(struct clk_hw *hw)
-{
-        struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
-        u32 clk = BIT(gate->clock_idx);
-        u32 reg;
-        regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
-        return (reg & clk) ? 0 : 1;
-}
 static const struct clk_ops aspeed_clk_gate_ops = {
        .enable = aspeed_clk_enable,
        .disable = aspeed_clk_disable,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 0f686a9dac3e..076d4244d672 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1125,8 +1125,10 @@ static int clk_core_round_rate_nolock(struct clk_core *core,
 {
        lockdep_assert_held(&prepare_lock);
-        if (!core)
+        if (!core) {
+                req->rate = 0;
                return 0;
+        }
        clk_core_init_rate_req(core, req);
@@ -2309,8 +2311,11 @@ static int clk_core_set_phase_nolock(struct clk_core *core, int degrees)
        trace_clk_set_phase(core, degrees);
-        if (core->ops->set_phase)
+        if (core->ops->set_phase) {
                ret = core->ops->set_phase(core->hw, degrees);
+                if (!ret)
+                        core->phase = degrees;
+        }
        trace_clk_set_phase_complete(core, degrees);
@@ -2968,22 +2973,37 @@ static int __clk_core_init(struct clk_core *core)
        core->rate = core->req_rate = rate;
        /*
+         * Enable CLK_IS_CRITICAL clocks so newly added critical clocks
+         * don't get accidentally disabled when walking the orphan tree and
+         * reparenting clocks
+         */
+        if (core->flags & CLK_IS_CRITICAL) {
+                unsigned long flags;
+                clk_core_prepare(core);
+                flags = clk_enable_lock();
+                clk_core_enable(core);
+                clk_enable_unlock(flags);
+        }
+        /*
         * walk the list of orphan clocks and reparent any that newly finds a
         * parent.
         */
        hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
                struct clk_core *parent = __clk_init_parent(orphan);
-                unsigned long flags;
                /*
-                 * we could call __clk_set_parent, but that would result in a
+                 * We need to use __clk_set_parent_before() and _after() to
-                 * redundant call to the .set_rate op, if it exists
+                 * to properly migrate any prepare/enable count of the orphan
+                 * clock. This is important for CLK_IS_CRITICAL clocks, which
+                 * are enabled during init but might not have a parent yet.
                 */
                if (parent) {
                        /* update the clk tree topology */
-                        flags = clk_enable_lock();
+                        __clk_set_parent_before(orphan, parent);
-                        clk_reparent(orphan, parent);
+                        __clk_set_parent_after(orphan, parent, NULL);
-                        clk_enable_unlock(flags);
                        __clk_recalc_accuracies(orphan);
                        __clk_recalc_rates(orphan, 0);
                }
@@ -3000,16 +3020,6 @@ static int __clk_core_init(struct clk_core *core)
        if (core->ops->init)
                core->ops->init(core->hw);
-        if (core->flags & CLK_IS_CRITICAL) {
-                unsigned long flags;
-                clk_core_prepare(core);
-                flags = clk_enable_lock();
-                clk_core_enable(core);
-                clk_enable_unlock(flags);
-        }
        kref_init(&core->ref);
 out:
        clk_pm_runtime_put(core);
diff --git a/drivers/clk/hisilicon/clk-hi3660-stub.c b/drivers/clk/hisilicon/clk-hi3660-stub.c
index 9b6c72bbddf9..e8b2c43b1bb8 100644
--- a/drivers/clk/hisilicon/clk-hi3660-stub.c
+++ b/drivers/clk/hisilicon/clk-hi3660-stub.c
@@ -149,6 +149,8 @@ static int hi3660_stub_clk_probe(struct platform_device *pdev)
                return PTR_ERR(stub_clk_chan.mbox);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
        freq_reg = devm_ioremap(dev, res->start, resource_size(res));
        if (!freq_reg)
                return -ENOMEM;
diff --git a/drivers/clk/imx/clk-imx51-imx53.c b/drivers/clk/imx/clk-imx51-imx53.c
index c864992e6983..caa8bd40692c 100644
--- a/drivers/clk/imx/clk-imx51-imx53.c
+++ b/drivers/clk/imx/clk-imx51-imx53.c
@@ -131,7 +131,17 @@ static const char *ieee1588_sels[] = { "pll3_sw", "pll4_sw", "dummy" /* usbphy2_
 static struct clk *clk[IMX5_CLK_END];
 static struct clk_onecell_data clk_data;
-static struct clk ** const uart_clks[] __initconst = {
+static struct clk ** const uart_clks_mx51[] __initconst = {
+        &clk[IMX5_CLK_UART1_IPG_GATE],
+        &clk[IMX5_CLK_UART1_PER_GATE],
+        &clk[IMX5_CLK_UART2_IPG_GATE],
+        &clk[IMX5_CLK_UART2_PER_GATE],
+        &clk[IMX5_CLK_UART3_IPG_GATE],
+        &clk[IMX5_CLK_UART3_PER_GATE],
+        NULL
+};
+static struct clk ** const uart_clks_mx50_mx53[] __initconst = {
        &clk[IMX5_CLK_UART1_IPG_GATE],
        &clk[IMX5_CLK_UART1_PER_GATE],
        &clk[IMX5_CLK_UART2_IPG_GATE],
@@ -321,8 +331,6 @@ static void __init mx5_clocks_common_init(void __iomem *ccm_base)
        clk_prepare_enable(clk[IMX5_CLK_TMAX1]);
        clk_prepare_enable(clk[IMX5_CLK_TMAX2]); /* esdhc2, fec */
        clk_prepare_enable(clk[IMX5_CLK_TMAX3]); /* esdhc1, esdhc4 */
-        imx_register_uart_clocks(uart_clks);
 }
 static void __init mx50_clocks_init(struct device_node *np)
@@ -388,6 +396,8 @@ static void __init mx50_clocks_init(struct device_node *np)
        r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
        clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+        imx_register_uart_clocks(uart_clks_mx50_mx53);
 }
 CLK_OF_DECLARE(imx50_ccm, "fsl,imx50-ccm", mx50_clocks_init);
@@ -477,6 +487,8 @@ static void __init mx51_clocks_init(struct device_node *np)
        val = readl(MXC_CCM_CLPCR);
        val |= 1 << 23;
        writel(val, MXC_CCM_CLPCR);
+        imx_register_uart_clocks(uart_clks_mx51);
 }
 CLK_OF_DECLARE(imx51_ccm, "fsl,imx51-ccm", mx51_clocks_init);
@@ -606,5 +618,7 @@ static void __init mx53_clocks_init(struct device_node *np)
        r = clk_round_rate(clk[IMX5_CLK_USBOH3_PER_GATE], 54000000);
        clk_set_rate(clk[IMX5_CLK_USBOH3_PER_GATE], r);
+        imx_register_uart_clocks(uart_clks_mx50_mx53);
 }
 CLK_OF_DECLARE(imx53_ccm, "fsl,imx53-ccm", mx53_clocks_init);
diff --git a/drivers/clk/qcom/apcs-msm8916.c b/drivers/clk/qcom/apcs-msm8916.c
index 246957f1a413..b1cc8dbcd327 100644
--- a/drivers/clk/qcom/apcs-msm8916.c
+++ b/drivers/clk/qcom/apcs-msm8916.c
@@ -49,11 +49,10 @@ static int qcom_apcs_msm8916_clk_probe(struct platform_device *pdev)
        struct clk_regmap_mux_div *a53cc;
        struct regmap *regmap;
        struct clk_init_data init = { };
-        int ret;
+        int ret = -ENODEV;
        regmap = dev_get_regmap(parent, NULL);
-        if (IS_ERR(regmap)) {
+        if (!regmap) {
-                ret = PTR_ERR(regmap);
                dev_err(dev, "failed to get regmap: %d\n", ret);
                return ret;
        }
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 72b16ed1012b..3b97f60540ad 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -762,7 +762,7 @@ static struct ccu_mp out_a_clk = {
                .features       = CCU_FEATURE_FIXED_PREDIV,
                .hw.init        = CLK_HW_INIT_PARENTS("out-a",
                                                      clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                      0),
        },
 };
@@ -783,7 +783,7 @@ static struct ccu_mp out_b_clk = {
                .features       = CCU_FEATURE_FIXED_PREDIV,
                .hw.init        = CLK_HW_INIT_PARENTS("out-b",
                                                      clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                      0),
        },
 };
@@ -804,7 +804,7 @@ static struct ccu_mp out_c_clk = {
                .features       = CCU_FEATURE_FIXED_PREDIV,
                .hw.init        = CLK_HW_INIT_PARENTS("out-c",
                                                      clk_out_parents,
-                                                      &ccu_div_ops,
+                                                      &ccu_mp_ops,
                                                      0),
        },
 };
diff --git a/drivers/clk/ti/clk-33xx.c b/drivers/clk/ti/clk-33xx.c
index 612491a26070..12e0a2d19911 100644
--- a/drivers/clk/ti/clk-33xx.c
+++ b/drivers/clk/ti/clk-33xx.c
@@ -45,7 +45,7 @@ static const struct omap_clkctrl_bit_data am3_gpio4_bit_data[] __initconst = {
 static const struct omap_clkctrl_reg_data am3_l4_per_clkctrl_regs[] __initconst = {
        { AM3_CPGMAC0_CLKCTRL, NULL, CLKF_SW_SUP, "cpsw_125mhz_gclk", "cpsw_125mhz_clkdm" },
-        { AM3_LCDC_CLKCTRL, NULL, CLKF_SW_SUP, "lcd_gclk", "lcdc_clkdm" },
+        { AM3_LCDC_CLKCTRL, NULL, CLKF_SW_SUP | CLKF_SET_RATE_PARENT, "lcd_gclk", "lcdc_clkdm" },
        { AM3_USB_OTG_HS_CLKCTRL, NULL, CLKF_SW_SUP, "usbotg_fck", "l3s_clkdm" },
        { AM3_TPTC0_CLKCTRL, NULL, CLKF_SW_SUP, "l3_gclk", "l3_clkdm" },
        { AM3_EMIF_CLKCTRL, NULL, CLKF_SW_SUP, "dpll_ddr_m2_div2_ck", "l3_clkdm" },
diff --git a/drivers/clk/ti/clk-43xx.c b/drivers/clk/ti/clk-43xx.c
index 2b7c2e017665..63c5ddb50187 100644
--- a/drivers/clk/ti/clk-43xx.c
+++ b/drivers/clk/ti/clk-43xx.c
@@ -187,7 +187,7 @@ static const struct omap_clkctrl_reg_data am4_l4_per_clkctrl_regs[] __initconst
        { AM4_OCP2SCP0_CLKCTRL, NULL, CLKF_SW_SUP, "l4ls_gclk" },
        { AM4_OCP2SCP1_CLKCTRL, NULL, CLKF_SW_SUP, "l4ls_gclk" },
        { AM4_EMIF_CLKCTRL, NULL, CLKF_SW_SUP, "dpll_ddr_m2_ck", "emif_clkdm" },
-        { AM4_DSS_CORE_CLKCTRL, NULL, CLKF_SW_SUP, "disp_clk", "dss_clkdm" },
+        { AM4_DSS_CORE_CLKCTRL, NULL, CLKF_SW_SUP | CLKF_SET_RATE_PARENT, "disp_clk", "dss_clkdm" },
        { AM4_CPGMAC0_CLKCTRL, NULL, CLKF_SW_SUP, "cpsw_125mhz_gclk", "cpsw_125mhz_clkdm" },
        { 0 },
 };
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index afa0d6bfc5c1..421b05392220 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -537,6 +537,8 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
                init.parent_names = &reg_data->parent;
                init.num_parents = 1;
                init.flags = 0;
+                if (reg_data->flags & CLKF_SET_RATE_PARENT)
+                        init.flags |= CLK_SET_RATE_PARENT;
                init.name = kasprintf(GFP_KERNEL, "%s:%s:%04x:%d",
                                      node->parent->name, node->name,
                                      reg_data->offset, 0);
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index b3b4ed9b6874..d2e5382821a4 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -386,6 +386,7 @@ config ATMEL_PIT
 config ATMEL_ST
        bool "Atmel ST timer support" if COMPILE_TEST
+        depends on HAS_IOMEM
        select TIMER_OF
        select MFD_SYSCON
        help
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index f652a0e0f5a2..3548caa9e933 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -163,6 +163,7 @@ struct mv_xor_v2_device {
        void __iomem *dma_base;
        void __iomem *glob_base;
        struct clk *clk;
+        struct clk *reg_clk;
        struct tasklet_struct irq_tasklet;
        struct list_head free_sw_desc;
        struct dma_device dmadev;
@@ -749,13 +750,26 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
        if (ret)
                return ret;
+        xor_dev->reg_clk = devm_clk_get(&pdev->dev, "reg");
+        if (PTR_ERR(xor_dev->reg_clk) != -ENOENT) {
+                if (!IS_ERR(xor_dev->reg_clk)) {
+                        ret = clk_prepare_enable(xor_dev->reg_clk);
+                        if (ret)
+                                return ret;
+                } else {
+                        return PTR_ERR(xor_dev->reg_clk);
+                }
+        }
        xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
+        if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
-                return -EPROBE_DEFER;
+                ret = EPROBE_DEFER;
+                goto disable_reg_clk;
+        }
        if (!IS_ERR(xor_dev->clk)) {
                ret = clk_prepare_enable(xor_dev->clk);
                if (ret)
-                        return ret;
+                        goto disable_reg_clk;
        }
        ret = platform_msi_domain_alloc_irqs(&pdev->dev, 1,
@@ -866,8 +880,9 @@ free_hw_desq:
 free_msi_irqs:
        platform_msi_domain_free_irqs(&pdev->dev);
 disable_clk:
-        if (!IS_ERR(xor_dev->clk))
+        clk_disable_unprepare(xor_dev->clk);
-                clk_disable_unprepare(xor_dev->clk);
+disable_reg_clk:
+        clk_disable_unprepare(xor_dev->reg_clk);
        return ret;
 }
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index e3ff162c03fc..d0cacdb0713e 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -917,7 +917,7 @@ rcar_dmac_chan_prep_sg(struct rcar_dmac_chan *chan, struct scatterlist *sgl,
        rcar_dmac_chan_configure_desc(chan, desc);
-        max_chunk_size = (RCAR_DMATCR_MASK + 1) << desc->xfer_shift;
+        max_chunk_size = RCAR_DMATCR_MASK << desc->xfer_shift;
        /*
         * Allocate and fill the transfer chunk descriptors. We own the only
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index c16600f30611..0bdea60c65dd 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -639,7 +639,7 @@ static void __exit dcdbas_exit(void)
        platform_driver_unregister(&dcdbas_driver);
 }
-module_init(dcdbas_init);
+subsys_initcall_sync(dcdbas_init);
 module_exit(dcdbas_exit);
 MODULE_DESCRIPTION(DRIVER_DESCRIPTION " (version " DRIVER_VERSION ")");
diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index da661bf8cb96..13c1edd37e96 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -68,11 +68,11 @@ void efi_retrieve_tpm2_eventlog_1_2(efi_system_table_t *sys_table_arg)
        efi_guid_t linux_eventlog_guid = LINUX_EFI_TPM_EVENT_LOG_GUID;
        efi_status_t status;
        efi_physical_addr_t log_location, log_last_entry;
-        struct linux_efi_tpm_eventlog *log_tbl;
+        struct linux_efi_tpm_eventlog *log_tbl = NULL;
        unsigned long first_entry_addr, last_entry_addr;
        size_t log_size, last_entry_size;
        efi_bool_t truncated;
-        void *tcg2_protocol;
+        void *tcg2_protocol = NULL;
        status = efi_call_early(locate_protocol, &tcg2_guid, NULL,
                                &tcg2_protocol);
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index e76de57dd617..ebaea8b1594b 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -14,7 +14,6 @@
 * GNU General Public License for more details.
 */
-#include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/gpio.h>
 #include <linux/init.h>
@@ -37,10 +36,9 @@ struct gpio_rcar_priv {
        struct platform_device *pdev;
        struct gpio_chip gpio_chip;
        struct irq_chip irq_chip;
-        struct clk *clk;
        unsigned int irq_parent;
+        atomic_t wakeup_path;
        bool has_both_edge_trigger;
-        bool needs_clk;
 };
 #define IOINTSEL 0x00   /* General IO/Interrupt Switching Register */
@@ -186,13 +184,10 @@ static int gpio_rcar_irq_set_wake(struct irq_data *d, unsigned int on)
                }
        }
-        if (!p->clk)
-                return 0;
        if (on)
-                clk_enable(p->clk);
+                atomic_inc(&p->wakeup_path);
        else
-                clk_disable(p->clk);
+                atomic_dec(&p->wakeup_path);
        return 0;
 }
@@ -330,17 +325,14 @@ static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset,
 struct gpio_rcar_info {
        bool has_both_edge_trigger;
-        bool needs_clk;
 };
 static const struct gpio_rcar_info gpio_rcar_info_gen1 = {
        .has_both_edge_trigger = false,
-        .needs_clk = false,
 };
 static const struct gpio_rcar_info gpio_rcar_info_gen2 = {
        .has_both_edge_trigger = true,
-        .needs_clk = true,
 };
 static const struct of_device_id gpio_rcar_of_table[] = {
@@ -403,7 +395,6 @@ static int gpio_rcar_parse_dt(struct gpio_rcar_priv *p, unsigned int *npins)
        ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0, &args);
        *npins = ret == 0 ? args.args[2] : RCAR_MAX_GPIO_PER_BANK;
        p->has_both_edge_trigger = info->has_both_edge_trigger;
-        p->needs_clk = info->needs_clk;
        if (*npins == 0 || *npins > RCAR_MAX_GPIO_PER_BANK) {
                dev_warn(&p->pdev->dev,
@@ -440,16 +431,6 @@ static int gpio_rcar_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, p);
-        p->clk = devm_clk_get(dev, NULL);
-        if (IS_ERR(p->clk)) {
-                if (p->needs_clk) {
-                        dev_err(dev, "unable to get clock\n");
-                        ret = PTR_ERR(p->clk);
-                        goto err0;
-                }
-                p->clk = NULL;
-        }
        pm_runtime_enable(dev);
        irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
@@ -531,11 +512,24 @@ static int gpio_rcar_remove(struct platform_device *pdev)
        return 0;
 }
+static int __maybe_unused gpio_rcar_suspend(struct device *dev)
+{
+        struct gpio_rcar_priv *p = dev_get_drvdata(dev);
+        if (atomic_read(&p->wakeup_path))
+                device_set_wakeup_path(dev);
+        return 0;
+}
+static SIMPLE_DEV_PM_OPS(gpio_rcar_pm_ops, gpio_rcar_suspend, NULL);
 static struct platform_driver gpio_rcar_device_driver = {
        .probe          = gpio_rcar_probe,
        .remove         = gpio_rcar_remove,
        .driver         = {
                .name   = "gpio_rcar",
+                .pm     = &gpio_rcar_pm_ops,
                .of_match_table = of_match_ptr(gpio_rcar_of_table),
        }
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 57afad79f55d..8fa850a070e0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request(struct amdgpu_device *adev,
        size_t size;
        u32 retry = 3;
+        if (amdgpu_acpi_pcie_notify_device_ready(adev))
+                return -EINVAL;
        /* Get the device handle */
        handle = ACPI_HANDLE(&adev->pdev->dev);
        if (!handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 74d2efaec52f..7a073ac5f9c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector)
                /* don't do anything if sink is not display port, i.e.,
                 * passive dp->(dvi|hdmi) adaptor
                 */
-                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
+                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
-                        int saved_dpms = connector->dpms;
+                    amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) &&
-                        /* Only turn off the display if it's physically disconnected */
+                    amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
-                        if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) {
+                        /* Don't start link training before we have the DPCD */
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                        if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
-                        } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) {
+                                return;
-                                /* Don't try to start link training before we
-                                 * have the dpcd */
+                        /* Turn the connector off and back on immediately, which
-                                if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector))
+                         * will trigger link training
-                                        return;
+                         */
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
-                                /* set it to OFF so that drm_helper_connector_dpms()
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                                 * won't return immediately since the current state
-                                 * is ON at this point.
-                                 */
-                                connector->dpms = DRM_MODE_DPMS_OFF;
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                        }
-                        connector->dpms = saved_dpms;
                }
        }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index af1b879a9ee9..66cb10cdc7c3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2063,9 +2063,12 @@ void amdgpu_device_fini(struct amdgpu_device *adev)
        DRM_INFO("amdgpu: finishing device.\n");
        adev->shutdown = true;
-        if (adev->mode_info.mode_config_initialized)
+        if (adev->mode_info.mode_config_initialized){
-                drm_crtc_force_disable_all(adev->ddev);
+                if (!amdgpu_device_has_dc_support(adev))
+                        drm_crtc_force_disable_all(adev->ddev);
+                else
+                        drm_atomic_helper_shutdown(adev->ddev);
+        }
        amdgpu_ib_pool_fini(adev);
        amdgpu_fence_driver_fini(adev);
        amdgpu_fbdev_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index e48b4ec88c8c..ca6c931dabfa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -36,8 +36,6 @@ void amdgpu_gem_object_free(struct drm_gem_object *gobj)
        struct amdgpu_bo *robj = gem_to_amdgpu_bo(gobj);
        if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                amdgpu_mn_unregister(robj);
                amdgpu_bo_unref(&robj);
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
index 54f06c959340..2264c5c97009 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
@@ -352,6 +352,7 @@ struct amdgpu_mode_info {
        u16 firmware_flags;
        /* pointer to backlight encoder */
        struct amdgpu_encoder *bl_encoder;
+        u8 bl_level; /* saved backlight level */
        struct amdgpu_audio     audio; /* audio stuff */
        int                     num_crtc; /* number of crtcs */
        int                     num_hpd; /* number of hpd pins */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 5c4c3e0d527b..1220322c1680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -56,6 +56,8 @@ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo)
        amdgpu_bo_kunmap(bo);
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
        drm_gem_object_release(&bo->gem_base);
        amdgpu_bo_unref(&bo->parent);
        if (!list_empty(&bo->shadow_list)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 13044e66dcaf..561d3312af32 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -481,7 +481,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf,
        result = 0;
        if (*pos < 12) {
-                early[0] = amdgpu_ring_get_rptr(ring);
+                early[0] = amdgpu_ring_get_rptr(ring) & ring->buf_mask;
                early[1] = amdgpu_ring_get_wptr(ring) & ring->buf_mask;
                early[2] = ring->wptr & ring->buf_mask;
                for (i = *pos / 4; i < 3 && size; i++) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index b2eae86bf906..5c26a8e806b9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -299,12 +299,15 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev)
        cancel_delayed_work_sync(&adev->uvd.idle_work);
-        for (i = 0; i < adev->uvd.max_handles; ++i)
+        /* only valid for physical mode */
-                if (atomic_read(&adev->uvd.handles[i]))
+        if (adev->asic_type < CHIP_POLARIS10) {
-                        break;
+                for (i = 0; i < adev->uvd.max_handles; ++i)
+                        if (atomic_read(&adev->uvd.handles[i]))
+                                break;
-        if (i == AMDGPU_MAX_UVD_HANDLES)
+                if (i == adev->uvd.max_handles)
-                return 0;
+                        return 0;
+        }
        size = amdgpu_bo_size(adev->uvd.vcpu_bo);
        ptr = adev->uvd.cpu_addr;
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
index 2af26d2da127..d702fb8e3427 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
@@ -34,7 +34,7 @@
 #include <linux/backlight.h>
 #include "bif/bif_4_1_d.h"
-static u8
+u8
 amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
 {
        u8 backlight_level;
@@ -48,7 +48,7 @@ amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev)
        return backlight_level;
 }
-static void
+void
 amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
                                            u8 backlight_level)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
index 2bdec40515ce..f77cbdef679e 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.h
@@ -25,6 +25,11 @@
 #define __ATOMBIOS_ENCODER_H__
 u8
+amdgpu_atombios_encoder_get_backlight_level_from_reg(struct amdgpu_device *adev);
+void
+amdgpu_atombios_encoder_set_backlight_level_to_reg(struct amdgpu_device *adev,
+                                                   u8 backlight_level);
+u8
 amdgpu_atombios_encoder_get_backlight_level(struct amdgpu_encoder *amdgpu_encoder);
 void
 amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encoder,
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index f34bc68aadfb..022f303463fc 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2921,6 +2921,11 @@ static int dce_v10_0_hw_fini(void *handle)
 static int dce_v10_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
        return dce_v10_0_hw_fini(handle);
 }
@@ -2929,6 +2934,9 @@ static int dce_v10_0_resume(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        int ret;
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
        ret = dce_v10_0_hw_init(handle);
        /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 26378bd6aba4..800a9f36ab4f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3047,6 +3047,11 @@ static int dce_v11_0_hw_fini(void *handle)
 static int dce_v11_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
        return dce_v11_0_hw_fini(handle);
 }
@@ -3055,6 +3060,9 @@ static int dce_v11_0_resume(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        int ret;
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
        ret = dce_v11_0_hw_init(handle);
        /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index bd2c4f727df6..b8368f69ce1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -2787,6 +2787,11 @@ static int dce_v6_0_hw_fini(void *handle)
 static int dce_v6_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
        return dce_v6_0_hw_fini(handle);
 }
@@ -2795,6 +2800,9 @@ static int dce_v6_0_resume(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        int ret;
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
        ret = dce_v6_0_hw_init(handle);
        /* turn on the BL */
@@ -3093,7 +3101,7 @@ static int dce_v6_0_hpd_irq(struct amdgpu_device *adev,
                tmp |= DC_HPD1_INT_CONTROL__DC_HPD1_INT_ACK_MASK;
                WREG32(mmDC_HPD1_INT_CONTROL + hpd_offsets[hpd], tmp);
                schedule_work(&adev->hotplug_work);
-                DRM_INFO("IH: HPD%d\n", hpd + 1);
+                DRM_DEBUG("IH: HPD%d\n", hpd + 1);
        }
        return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index c008dc030687..012e0a9ae0ff 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2819,6 +2819,11 @@ static int dce_v8_0_hw_fini(void *handle)
 static int dce_v8_0_suspend(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        adev->mode_info.bl_level =
+                amdgpu_atombios_encoder_get_backlight_level_from_reg(adev);
        return dce_v8_0_hw_fini(handle);
 }
@@ -2827,6 +2832,9 @@ static int dce_v8_0_resume(void *handle)
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        int ret;
+        amdgpu_atombios_encoder_set_backlight_level_to_reg(adev,
+                                                           adev->mode_info.bl_level);
        ret = dce_v8_0_hw_init(handle);
        /* turn on the BL */
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index a066c5eda135..a4309698e76c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -4384,34 +4384,8 @@ static void gfx_v7_0_gpu_early_init(struct amdgpu_device *adev)
        case CHIP_KAVERI:
                adev->gfx.config.max_shader_engines = 1;
                adev->gfx.config.max_tile_pipes = 4;
-                if ((adev->pdev->device == 0x1304) ||
+                adev->gfx.config.max_cu_per_sh = 8;
-                    (adev->pdev->device == 0x1305) ||
+                adev->gfx.config.max_backends_per_se = 2;
-                    (adev->pdev->device == 0x130C) ||
-                    (adev->pdev->device == 0x130F) ||
-                    (adev->pdev->device == 0x1310) ||
-                    (adev->pdev->device == 0x1311) ||
-                    (adev->pdev->device == 0x131C)) {
-                        adev->gfx.config.max_cu_per_sh = 8;
-                        adev->gfx.config.max_backends_per_se = 2;
-                } else if ((adev->pdev->device == 0x1309) ||
-                           (adev->pdev->device == 0x130A) ||
-                           (adev->pdev->device == 0x130D) ||
-                           (adev->pdev->device == 0x1313) ||
-                           (adev->pdev->device == 0x131D)) {
-                        adev->gfx.config.max_cu_per_sh = 6;
-                        adev->gfx.config.max_backends_per_se = 2;
-                } else if ((adev->pdev->device == 0x1306) ||
-                           (adev->pdev->device == 0x1307) ||
-                           (adev->pdev->device == 0x130B) ||
-                           (adev->pdev->device == 0x130E) ||
-                           (adev->pdev->device == 0x1315) ||
-                           (adev->pdev->device == 0x131B)) {
-                        adev->gfx.config.max_cu_per_sh = 4;
-                        adev->gfx.config.max_backends_per_se = 1;
-                } else {
-                        adev->gfx.config.max_cu_per_sh = 3;
-                        adev->gfx.config.max_backends_per_se = 1;
-                }
                adev->gfx.config.max_sh_per_se = 1;
                adev->gfx.config.max_texture_channel_caches = 4;
                adev->gfx.config.max_gprs = 256;
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index 543101d5a5ed..2095173aaabf 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -31,6 +31,7 @@
 #include "amdgpu_uvd.h"
 #include "amdgpu_vce.h"
 #include "atom.h"
+#include "amd_pcie.h"
 #include "amdgpu_powerplay.h"
 #include "sid.h"
 #include "si_ih.h"
@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
 {
        struct pci_dev *root = adev->pdev->bus->self;
        int bridge_pos, gpu_pos;
-        u32 speed_cntl, mask, current_data_rate;
+        u32 speed_cntl, current_data_rate;
-        int ret, i;
+        int i;
        u16 tmp16;
        if (pci_is_root_bus(adev->pdev->bus))
@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
        if (adev->flags & AMD_IS_APU)
                return;
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+        if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 |
-        if (ret != 0)
+                                        CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)))
-                return;
-        if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80)))
                return;
        speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
        current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >>
                LC_CURRENT_DATA_RATE_SHIFT;
-        if (mask & DRM_PCIE_SPEED_80) {
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
                if (current_data_rate == 2) {
                        DRM_INFO("PCIE gen 3 link speeds already enabled\n");
                        return;
                }
                DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n");
-        } else if (mask & DRM_PCIE_SPEED_50) {
+        } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) {
                if (current_data_rate == 1) {
                        DRM_INFO("PCIE gen 2 link speeds already enabled\n");
                        return;
@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
        if (!gpu_pos)
                return;
-        if (mask & DRM_PCIE_SPEED_80) {
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
                if (current_data_rate != 2) {
                        u16 bridge_cfg, gpu_cfg;
                        u16 bridge_cfg2, gpu_cfg2;
@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
        pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
        tmp16 &= ~0xf;
-        if (mask & DRM_PCIE_SPEED_80)
+        if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
                tmp16 |= 3;
-        else if (mask & DRM_PCIE_SPEED_50)
+        else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
                tmp16 |= 2;
        else
                tmp16 |= 1;
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index ce675a7f179a..22f0b7ff3ac9 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -26,6 +26,7 @@
 #include "amdgpu_pm.h"
 #include "amdgpu_dpm.h"
 #include "amdgpu_atombios.h"
+#include "amd_pcie.h"
 #include "sid.h"
 #include "r600_dpm.h"
 #include "si_dpm.h"
@@ -3331,29 +3332,6 @@ static void btc_apply_voltage_delta_rules(struct amdgpu_device *adev,
        }
 }
-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev,
-                                               u32 sys_mask,
-                                               enum amdgpu_pcie_gen asic_gen,
-                                               enum amdgpu_pcie_gen default_gen)
-{
-        switch (asic_gen) {
-        case AMDGPU_PCIE_GEN1:
-                return AMDGPU_PCIE_GEN1;
-        case AMDGPU_PCIE_GEN2:
-                return AMDGPU_PCIE_GEN2;
-        case AMDGPU_PCIE_GEN3:
-                return AMDGPU_PCIE_GEN3;
-        default:
-                if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3))
-                        return AMDGPU_PCIE_GEN3;
-                else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2))
-                        return AMDGPU_PCIE_GEN2;
-                else
-                        return AMDGPU_PCIE_GEN1;
-        }
-        return AMDGPU_PCIE_GEN1;
-}
 static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b,
                            u32 *p, u32 *u)
 {
@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(struct amdgpu_device *adev,
                                                              table->ACPIState.levels[0].vddc.index,
                                                              &table->ACPIState.levels[0].std_vddc);
                }
-                table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev,
+                table->ACPIState.levels[0].gen2PCIE =
-                                                                                    si_pi->sys_pcie_mask,
+                        (u8)amdgpu_get_pcie_gen_support(adev,
-                                                                                    si_pi->boot_pcie_gen,
+                                                        si_pi->sys_pcie_mask,
-                                                                                    AMDGPU_PCIE_GEN1);
+                                                        si_pi->boot_pcie_gen,
+                                                        AMDGPU_PCIE_GEN1);
                if (si_pi->vddc_phase_shed_control)
                        si_populate_phase_shedding_value(adev,
@@ -7168,10 +7147,10 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev,
        pl->vddc = le16_to_cpu(clock_info->si.usVDDC);
        pl->vddci = le16_to_cpu(clock_info->si.usVDDCI);
        pl->flags = le32_to_cpu(clock_info->si.ulFlags);
-        pl->pcie_gen = r600_get_pcie_gen_support(adev,
+        pl->pcie_gen = amdgpu_get_pcie_gen_support(adev,
-                                                 si_pi->sys_pcie_mask,
+                                                   si_pi->sys_pcie_mask,
-                                                 si_pi->boot_pcie_gen,
+                                                   si_pi->boot_pcie_gen,
-                                                 clock_info->si.ucPCIEGen);
+                                                   clock_info->si.ucPCIEGen);
        /* patch up vddc if necessary */
        ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc,
@@ -7326,7 +7305,6 @@ static int si_dpm_init(struct amdgpu_device *adev)
        struct si_power_info *si_pi;
        struct atom_clock_dividers dividers;
        int ret;
-        u32 mask;
        si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL);
        if (si_pi == NULL)
@@ -7336,11 +7314,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
        eg_pi = &ni_pi->eg;
        pi = &eg_pi->rv7xx;
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+        si_pi->sys_pcie_mask =
-        if (ret)
+                (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
-                si_pi->sys_pcie_mask = 0;
+                CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
-        else
-                si_pi->sys_pcie_mask = mask;
        si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
        si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev);
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 862835dc054e..63c67346d316 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1037,6 +1037,10 @@ static void handle_hpd_rx_irq(void *param)
                        !is_mst_root_connector) {
                /* Downstream Port status changed. */
                if (dc_link_detect(dc_link, DETECT_REASON_HPDRX)) {
+                        if (aconnector->fake_enable)
+                                aconnector->fake_enable = false;
                        amdgpu_dm_update_connector_after_detect(aconnector);
@@ -2012,30 +2016,32 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
        dst.width = stream->timing.h_addressable;
        dst.height = stream->timing.v_addressable;
-        rmx_type = dm_state->scaling;
+        if (dm_state) {
-        if (rmx_type == RMX_ASPECT || rmx_type == RMX_OFF) {
+                rmx_type = dm_state->scaling;
-                if (src.width * dst.height <
+                if (rmx_type == RMX_ASPECT || rmx_type == RMX_OFF) {
-                                src.height * dst.width) {
+                        if (src.width * dst.height <
-                        /* height needs less upscaling/more downscaling */
+                                        src.height * dst.width) {
-                        dst.width = src.width *
+                                /* height needs less upscaling/more downscaling */
-                                        dst.height / src.height;
+                                dst.width = src.width *
-                } else {
+                                                dst.height / src.height;
-                        /* width needs less upscaling/more downscaling */
+                        } else {
-                        dst.height = src.height *
+                                /* width needs less upscaling/more downscaling */
-                                        dst.width / src.width;
+                                dst.height = src.height *
+                                                dst.width / src.width;
+                        }
+                } else if (rmx_type == RMX_CENTER) {
+                        dst = src;
                }
-        } else if (rmx_type == RMX_CENTER) {
-                dst = src;
-        }
-        dst.x = (stream->timing.h_addressable - dst.width) / 2;
+                dst.x = (stream->timing.h_addressable - dst.width) / 2;
-        dst.y = (stream->timing.v_addressable - dst.height) / 2;
+                dst.y = (stream->timing.v_addressable - dst.height) / 2;
-        if (dm_state->underscan_enable) {
+                if (dm_state->underscan_enable) {
-                dst.x += dm_state->underscan_hborder / 2;
+                        dst.x += dm_state->underscan_hborder / 2;
-                dst.y += dm_state->underscan_vborder / 2;
+                        dst.y += dm_state->underscan_vborder / 2;
-                dst.width -= dm_state->underscan_hborder;
+                        dst.width -= dm_state->underscan_hborder;
-                dst.height -= dm_state->underscan_vborder;
+                        dst.height -= dm_state->underscan_vborder;
+                }
        }
        stream->src = src;
@@ -2360,12 +2366,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
        if (aconnector == NULL) {
                DRM_ERROR("aconnector is NULL!\n");
-                goto drm_connector_null;
+                return stream;
-        }
-        if (dm_state == NULL) {
-                DRM_ERROR("dm_state is NULL!\n");
-                goto dm_state_null;
        }
        drm_connector = &aconnector->base;
@@ -2377,18 +2378,18 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                 */
                if (aconnector->mst_port) {
                        dm_dp_mst_dc_sink_create(drm_connector);
-                        goto mst_dc_sink_create_done;
+                        return stream;
                }
                if (create_fake_sink(aconnector))
-                        goto stream_create_fail;
+                        return stream;
        }
        stream = dc_create_stream_for_sink(aconnector->dc_sink);
        if (stream == NULL) {
                DRM_ERROR("Failed to create stream for sink!\n");
-                goto stream_create_fail;
+                return stream;
        }
        list_for_each_entry(preferred_mode, &aconnector->base.modes, head) {
@@ -2414,9 +2415,12 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
        } else {
                decide_crtc_timing_for_drm_display_mode(
                                &mode, preferred_mode,
-                                dm_state->scaling != RMX_OFF);
+                                dm_state ? (dm_state->scaling != RMX_OFF) : false);
        }
+        if (!dm_state)
+                drm_mode_set_crtcinfo(&mode, 0);
        fill_stream_properties_from_drm_display_mode(stream,
                        &mode, &aconnector->base);
        update_stream_scaling_settings(&mode, dm_state, stream);
@@ -2426,10 +2430,8 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                drm_connector,
                aconnector->dc_sink);
-stream_create_fail:
+        update_stream_signal(stream);
-dm_state_null:
-drm_connector_null:
-mst_dc_sink_create_done:
        return stream;
 }
@@ -2497,6 +2499,27 @@ dm_crtc_duplicate_state(struct drm_crtc *crtc)
        return &state->base;
 }
+static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable)
+{
+        enum dc_irq_source irq_source;
+        struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc);
+        struct amdgpu_device *adev = crtc->dev->dev_private;
+        irq_source = IRQ_TYPE_VBLANK + acrtc->otg_inst;
+        return dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY;
+}
+static int dm_enable_vblank(struct drm_crtc *crtc)
+{
+        return dm_set_vblank(crtc, true);
+}
+static void dm_disable_vblank(struct drm_crtc *crtc)
+{
+        dm_set_vblank(crtc, false);
+}
 /* Implemented only the options currently availible for the driver */
 static const struct drm_crtc_funcs amdgpu_dm_crtc_funcs = {
        .reset = dm_crtc_reset_state,
@@ -2506,6 +2529,8 @@ static const struct drm_crtc_funcs amdgpu_dm_crtc_funcs = {
        .page_flip = drm_atomic_helper_page_flip,
        .atomic_duplicate_state = dm_crtc_duplicate_state,
        .atomic_destroy_state = dm_crtc_destroy_state,
+        .enable_vblank = dm_enable_vblank,
+        .disable_vblank = dm_disable_vblank,
 };
 static enum drm_connector_status
@@ -2800,7 +2825,7 @@ int amdgpu_dm_connector_mode_valid(struct drm_connector *connector,
                goto fail;
        }
-        stream = dc_create_stream_for_sink(dc_sink);
+        stream = create_stream_for_sink(aconnector, mode, NULL);
        if (stream == NULL) {
                DRM_ERROR("Failed to create stream for sink!\n");
                goto fail;
@@ -3060,6 +3085,9 @@ static int dm_plane_atomic_check(struct drm_plane *plane,
        if (!dm_plane_state->dc_state)
                return 0;
+        if (!fill_rects_from_plane_state(state, dm_plane_state->dc_state))
+                return -EINVAL;
        if (dc_validate_plane(dc, dm_plane_state->dc_state) == DC_OK)
                return 0;
@@ -3106,8 +3134,6 @@ static int amdgpu_dm_plane_init(struct amdgpu_display_manager *dm,
        switch (aplane->base.type) {
        case DRM_PLANE_TYPE_PRIMARY:
-                aplane->base.format_default = true;
                res = drm_universal_plane_init(
                                dm->adev->ddev,
                                &aplane->base,
@@ -4632,8 +4658,6 @@ static int dm_update_planes_state(struct dc *dc,
        bool pflip_needed  = !state->allow_modeset;
        int ret = 0;
-        if (pflip_needed)
-                return ret;
        /* Add new planes */
        for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
@@ -4648,6 +4672,8 @@ static int dm_update_planes_state(struct dc *dc,
                /* Remove any changed/removed planes */
                if (!enable) {
+                        if (pflip_needed)
+                                continue;
                        if (!old_plane_crtc)
                                continue;
@@ -4679,6 +4705,7 @@ static int dm_update_planes_state(struct dc *dc,
                        *lock_and_validation_needed = true;
                } else { /* Add new planes */
+                        struct dc_plane_state *dc_new_plane_state;
                        if (drm_atomic_plane_disabling(plane->state, new_plane_state))
                                continue;
@@ -4692,38 +4719,50 @@ static int dm_update_planes_state(struct dc *dc,
                        if (!dm_new_crtc_state->stream)
                                continue;
+                        if (pflip_needed)
+                                continue;
                        WARN_ON(dm_new_plane_state->dc_state);
-                        dm_new_plane_state->dc_state = dc_create_plane_state(dc);
+                        dc_new_plane_state = dc_create_plane_state(dc);
+                        if (!dc_new_plane_state) {
-                        DRM_DEBUG_DRIVER("Enabling DRM plane: %d on DRM crtc %d\n",
-                                        plane->base.id, new_plane_crtc->base.id);
-                        if (!dm_new_plane_state->dc_state) {
                                ret = -EINVAL;
                                return ret;
                        }
+                        DRM_DEBUG_DRIVER("Enabling DRM plane: %d on DRM crtc %d\n",
+                                        plane->base.id, new_plane_crtc->base.id);
                        ret = fill_plane_attributes(
                                new_plane_crtc->dev->dev_private,
-                                dm_new_plane_state->dc_state,
+                                dc_new_plane_state,
                                new_plane_state,
                                new_crtc_state);
-                        if (ret)
+                        if (ret) {
+                                dc_plane_state_release(dc_new_plane_state);
                                return ret;
+                        }
+                        /*
+                         * Any atomic check errors that occur after this will
+                         * not need a release. The plane state will be attached
+                         * to the stream, and therefore part of the atomic
+                         * state. It'll be released when the atomic state is
+                         * cleaned.
+                         */
                        if (!dc_add_plane_to_context(
                                        dc,
                                        dm_new_crtc_state->stream,
-                                        dm_new_plane_state->dc_state,
+                                        dc_new_plane_state,
                                        dm_state->context)) {
+                                dc_plane_state_release(dc_new_plane_state);
                                ret = -EINVAL;
                                return ret;
                        }
+                        dm_new_plane_state->dc_state = dc_new_plane_state;
                        /* Tell DC to do a full surface update every time there
                         * is a plane change. Inefficient, but works for now.
                         */
@@ -4737,6 +4776,33 @@ static int dm_update_planes_state(struct dc *dc,
        return ret;
 }
+static int dm_atomic_check_plane_state_fb(struct drm_atomic_state *state,
+                                          struct drm_crtc *crtc)
+{
+        struct drm_plane *plane;
+        struct drm_crtc_state *crtc_state;
+        WARN_ON(!drm_atomic_get_new_crtc_state(state, crtc));
+        drm_for_each_plane_mask(plane, state->dev, crtc->state->plane_mask) {
+                struct drm_plane_state *plane_state =
+                        drm_atomic_get_plane_state(state, plane);
+                if (IS_ERR(plane_state))
+                        return -EDEADLK;
+                crtc_state = drm_atomic_get_crtc_state(plane_state->state, crtc);
+                if (IS_ERR(crtc_state))
+                        return PTR_ERR(crtc_state);
+                if (crtc->primary == plane && crtc_state->active) {
+                        if (!plane_state->fb)
+                                return -EINVAL;
+                }
+        }
+        return 0;
+}
 static int amdgpu_dm_atomic_check(struct drm_device *dev,
                                  struct drm_atomic_state *state)
 {
@@ -4760,6 +4826,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
                goto fail;
        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+                ret = dm_atomic_check_plane_state_fb(state, crtc);
+                if (ret)
+                        goto fail;
                if (!drm_atomic_crtc_needs_modeset(new_crtc_state) &&
                    !new_crtc_state->color_mgmt_changed)
                        continue;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index 9bd142f65f9b..e1acc10e35a2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -109,7 +109,7 @@ enum dc_edid_status dm_helpers_parse_edid_caps(
                struct cea_sad *sad = &sads[i];
                edid_caps->audio_modes[i].format_code = sad->format;
-                edid_caps->audio_modes[i].channel_count = sad->channels;
+                edid_caps->audio_modes[i].channel_count = sad->channels + 1;
                edid_caps->audio_modes[i].sample_rate = sad->freq;
                edid_caps->audio_modes[i].sample_size = sad->byte2;
        }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
index 1874b6cee6af..422055080df4 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
@@ -683,10 +683,8 @@ static const struct amdgpu_irq_src_funcs dm_hpd_irq_funcs = {
 void amdgpu_dm_set_irq_funcs(struct amdgpu_device *adev)
 {
-        if (adev->mode_info.num_crtc > 0)
-                adev->crtc_irq.num_types = AMDGPU_CRTC_IRQ_VLINE1 + adev->mode_info.num_crtc;
+        adev->crtc_irq.num_types = adev->mode_info.num_crtc;
-        else
-                adev->crtc_irq.num_types = 0;
        adev->crtc_irq.funcs = &dm_crtc_irq_funcs;
        adev->pageflip_irq.num_types = adev->mode_info.num_crtc;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index f3d87f418d2e..93421dad21bd 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -189,6 +189,12 @@ void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
                        .link = aconnector->dc_link,
                        .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
+        /*
+         * TODO: Need to further figure out why ddc.algo is NULL while MST port exists
+         */
+        if (!aconnector->port || !aconnector->port->aux.ddc.algo)
+                return;
        edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
        if (!edid) {
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 35e84ed031de..12868c769606 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1358,13 +1358,13 @@ enum dc_irq_source dc_interrupt_to_irq_source(
        return dal_irq_service_to_irq_source(dc->res_pool->irqs, src_id, ext_id);
 }
-void dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable)
+bool dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable)
 {
        if (dc == NULL)
-                return;
+                return false;
-        dal_irq_service_set(dc->res_pool->irqs, src, enable);
+        return dal_irq_service_set(dc->res_pool->irqs, src, enable);
 }
 void dc_interrupt_ack(struct dc *dc, enum dc_irq_source src)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index a37428271573..be5546181fa8 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1749,8 +1749,7 @@ static void enable_link_hdmi(struct pipe_ctx *pipe_ctx)
                        link->link_enc,
                        pipe_ctx->clock_source->id,
                        display_color_depth,
-                        pipe_ctx->stream->signal == SIGNAL_TYPE_HDMI_TYPE_A,
+                        pipe_ctx->stream->signal,
-                        pipe_ctx->stream->signal == SIGNAL_TYPE_DVI_DUAL_LINK,
                        stream->phy_pix_clk);
        if (pipe_ctx->stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 95b8dd0e53c6..4d07ffebfd31 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -1360,9 +1360,6 @@ bool dc_is_stream_scaling_unchanged(
        return true;
 }
-/* Maximum TMDS single link pixel clock 165MHz */
-#define TMDS_MAX_PIXEL_CLOCK_IN_KHZ 165000
 static void update_stream_engine_usage(
                struct resource_context *res_ctx,
                const struct resource_pool *pool,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 539c3e0a6292..cd5819789d76 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -33,8 +33,7 @@
 /*******************************************************************************
 * Private functions
 ******************************************************************************/
-#define TMDS_MAX_PIXEL_CLOCK_IN_KHZ_UPMOST 297000
+void update_stream_signal(struct dc_stream_state *stream)
-static void update_stream_signal(struct dc_stream_state *stream)
 {
        struct dc_sink *dc_sink = stream->sink;
@@ -45,8 +44,9 @@ static void update_stream_signal(struct dc_stream_state *stream)
                stream->signal = dc_sink->sink_signal;
        if (dc_is_dvi_signal(stream->signal)) {
-                if (stream->timing.pix_clk_khz > TMDS_MAX_PIXEL_CLOCK_IN_KHZ_UPMOST &&
+                if (stream->ctx->dc->caps.dual_link_dvi &&
-                        stream->sink->sink_signal != SIGNAL_TYPE_DVI_SINGLE_LINK)
+                    stream->timing.pix_clk_khz > TMDS_MAX_PIXEL_CLOCK &&
+                    stream->sink->sink_signal != SIGNAL_TYPE_DVI_SINGLE_LINK)
                        stream->signal = SIGNAL_TYPE_DVI_DUAL_LINK;
                else
                        stream->signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
@@ -193,6 +193,7 @@ bool dc_stream_set_cursor_attributes(
        core_dc = stream->ctx->dc;
        res_ctx = &core_dc->current_state->res_ctx;
+        stream->cursor_attributes = *attributes;
        for (i = 0; i < MAX_PIPES; i++) {
                struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
@@ -204,34 +205,8 @@ bool dc_stream_set_cursor_attributes(
                        continue;
-                if (pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes != NULL)
+                core_dc->hwss.set_cursor_attribute(pipe_ctx);
-                        pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes(
-                                                pipe_ctx->plane_res.ipp, attributes);
-                if (pipe_ctx->plane_res.hubp != NULL &&
-                                pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes(
-                                        pipe_ctx->plane_res.hubp, attributes);
-                if (pipe_ctx->plane_res.mi != NULL &&
-                                pipe_ctx->plane_res.mi->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.mi->funcs->set_cursor_attributes(
-                                        pipe_ctx->plane_res.mi, attributes);
-                if (pipe_ctx->plane_res.xfm != NULL &&
-                                pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes(
-                                pipe_ctx->plane_res.xfm, attributes);
-                if (pipe_ctx->plane_res.dpp != NULL &&
-                                pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes != NULL)
-                        pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes(
-                                pipe_ctx->plane_res.dpp, attributes->color_format);
        }
-        stream->cursor_attributes = *attributes;
        return true;
 }
@@ -255,21 +230,10 @@ bool dc_stream_set_cursor_position(
        core_dc = stream->ctx->dc;
        res_ctx = &core_dc->current_state->res_ctx;
+        stream->cursor_position = *position;
        for (i = 0; i < MAX_PIPES; i++) {
                struct pipe_ctx *pipe_ctx = &res_ctx->pipe_ctx[i];
-                struct input_pixel_processor *ipp = pipe_ctx->plane_res.ipp;
-                struct mem_input *mi = pipe_ctx->plane_res.mi;
-                struct hubp *hubp = pipe_ctx->plane_res.hubp;
-                struct dpp *dpp = pipe_ctx->plane_res.dpp;
-                struct dc_cursor_position pos_cpy = *position;
-                struct dc_cursor_mi_param param = {
-                        .pixel_clk_khz = stream->timing.pix_clk_khz,
-                        .ref_clk_khz = core_dc->res_pool->ref_clock_inKhz,
-                        .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
-                        .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
-                        .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
-                };
                if (pipe_ctx->stream != stream ||
                                (!pipe_ctx->plane_res.mi  && !pipe_ctx->plane_res.hubp) ||
@@ -278,33 +242,9 @@ bool dc_stream_set_cursor_position(
                                !pipe_ctx->plane_res.ipp)
                        continue;
-                if (pipe_ctx->plane_state->address.type
+                core_dc->hwss.set_cursor_position(pipe_ctx);
-                                == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
-                        pos_cpy.enable = false;
-                if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
-                        pos_cpy.enable = false;
-                if (ipp != NULL && ipp->funcs->ipp_cursor_set_position != NULL)
-                        ipp->funcs->ipp_cursor_set_position(ipp, &pos_cpy, &param);
-                if (mi != NULL && mi->funcs->set_cursor_position != NULL)
-                        mi->funcs->set_cursor_position(mi, &pos_cpy, &param);
-                if (!hubp)
-                        continue;
-                if (hubp->funcs->set_cursor_position != NULL)
-                        hubp->funcs->set_cursor_position(hubp, &pos_cpy, &param);
-                if (dpp != NULL && dpp->funcs->set_cursor_position != NULL)
-                        dpp->funcs->set_cursor_position(dpp, &pos_cpy, &param, hubp->curs_attr.width);
        }
-        stream->cursor_position = *position;
        return true;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index e2e3c9df79ea..d6d56611604e 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -62,6 +62,7 @@ struct dc_caps {
        bool dcc_const_color;
        bool dynamic_audio;
        bool is_apu;
+        bool dual_link_dvi;
 };
 struct dc_dcc_surface_param {
@@ -672,7 +673,7 @@ enum dc_irq_source dc_interrupt_to_irq_source(
                struct dc *dc,
                uint32_t src_id,
                uint32_t ext_id);
-void dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable);
+bool dc_interrupt_set(struct dc *dc, enum dc_irq_source src, bool enable);
 void dc_interrupt_ack(struct dc *dc, enum dc_irq_source src);
 enum dc_irq_source dc_get_hpd_irq_source_at_index(
                struct dc *dc, uint32_t link_index);
diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
index 01c60f11b2bd..456e4d29eadd 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -237,6 +237,8 @@ enum surface_update_type dc_check_update_surfaces_for_stream(
 */
 struct dc_stream_state *dc_create_stream_for_sink(struct dc_sink *dc_sink);
+void update_stream_signal(struct dc_stream_state *stream);
 void dc_stream_retain(struct dc_stream_state *dc_stream);
 void dc_stream_release(struct dc_stream_state *dc_stream);
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
index b73db9e78437..f11f17fe08f9 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_hwseq.h
@@ -236,6 +236,7 @@
        SR(D2VGA_CONTROL), \
        SR(D3VGA_CONTROL), \
        SR(D4VGA_CONTROL), \
+        SR(VGA_TEST_CONTROL), \
        SR(DC_IP_REQUEST_CNTL), \
        BL_REG_LIST()
@@ -337,6 +338,7 @@ struct dce_hwseq_registers {
        uint32_t D2VGA_CONTROL;
        uint32_t D3VGA_CONTROL;
        uint32_t D4VGA_CONTROL;
+        uint32_t VGA_TEST_CONTROL;
        /* MMHUB registers. read only. temporary hack */
        uint32_t VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_HI32;
        uint32_t VM_CONTEXT0_PAGE_TABLE_BASE_ADDR_LO32;
@@ -493,6 +495,12 @@ struct dce_hwseq_registers {
        HWS_SF(, DOMAIN6_PG_STATUS, DOMAIN6_PGFSM_PWR_STATUS, mask_sh), \
        HWS_SF(, DOMAIN7_PG_STATUS, DOMAIN7_PGFSM_PWR_STATUS, mask_sh), \
        HWS_SF(, DC_IP_REQUEST_CNTL, IP_REQUEST_EN, mask_sh), \
+        HWS_SF(, D1VGA_CONTROL, D1VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D2VGA_CONTROL, D2VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D3VGA_CONTROL, D3VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, D4VGA_CONTROL, D4VGA_MODE_ENABLE, mask_sh),\
+        HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_ENABLE, mask_sh),\
+        HWS_SF(, VGA_TEST_CONTROL, VGA_TEST_RENDER_START, mask_sh),\
        HWS_SF(, LVTMA_PWRSEQ_CNTL, LVTMA_BLON, mask_sh), \
        HWS_SF(, LVTMA_PWRSEQ_STATE, LVTMA_PWRSEQ_TARGET_STATE_R, mask_sh)
@@ -583,7 +591,13 @@ struct dce_hwseq_registers {
        type DCFCLK_GATE_DIS; \
        type DCHUBBUB_GLOBAL_TIMER_REFDIV; \
        type DENTIST_DPPCLK_WDIVIDER; \
-        type DENTIST_DISPCLK_WDIVIDER;
+        type DENTIST_DISPCLK_WDIVIDER; \
+        type VGA_TEST_ENABLE; \
+        type VGA_TEST_RENDER_START; \
+        type D1VGA_MODE_ENABLE; \
+        type D2VGA_MODE_ENABLE; \
+        type D3VGA_MODE_ENABLE; \
+        type D4VGA_MODE_ENABLE;
 struct dce_hwseq_shift {
        HWSEQ_REG_FIELD_LIST(uint8_t)
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
index a266e3f5e75f..e4741f1a2b01 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
@@ -82,13 +82,6 @@
 #define DCE110_DIG_FE_SOURCE_SELECT_DIGF 0x20
 #define DCE110_DIG_FE_SOURCE_SELECT_DIGG 0x40
-/* Minimum pixel clock, in KHz. For TMDS signal is 25.00 MHz */
-#define TMDS_MIN_PIXEL_CLOCK 25000
-/* Maximum pixel clock, in KHz. For TMDS signal is 165.00 MHz */
-#define TMDS_MAX_PIXEL_CLOCK 165000
-/* For current ASICs pixel clock - 600MHz */
-#define MAX_ENCODER_CLOCK 600000
 enum {
        DP_MST_UPDATE_MAX_RETRY = 50
 };
@@ -683,6 +676,7 @@ void dce110_link_encoder_construct(
 {
        struct bp_encoder_cap_info bp_cap_info = {0};
        const struct dc_vbios_funcs *bp_funcs = init_data->ctx->dc_bios->funcs;
+        enum bp_result result = BP_RESULT_OK;
        enc110->base.funcs = &dce110_lnk_enc_funcs;
        enc110->base.ctx = init_data->ctx;
@@ -757,15 +751,24 @@ void dce110_link_encoder_construct(
                enc110->base.preferred_engine = ENGINE_ID_UNKNOWN;
        }
+        /* default to one to mirror Windows behavior */
+        enc110->base.features.flags.bits.HDMI_6GB_EN = 1;
+        result = bp_funcs->get_encoder_cap_info(enc110->base.ctx->dc_bios,
+                                                enc110->base.id, &bp_cap_info);
        /* Override features with DCE-specific values */
-        if (BP_RESULT_OK == bp_funcs->get_encoder_cap_info(
+        if (BP_RESULT_OK == result) {
-                        enc110->base.ctx->dc_bios, enc110->base.id,
-                        &bp_cap_info)) {
                enc110->base.features.flags.bits.IS_HBR2_CAPABLE =
                                bp_cap_info.DP_HBR2_EN;
                enc110->base.features.flags.bits.IS_HBR3_CAPABLE =
                                bp_cap_info.DP_HBR3_EN;
                enc110->base.features.flags.bits.HDMI_6GB_EN = bp_cap_info.HDMI_6GB_EN;
+        } else {
+                dm_logger_write(enc110->base.ctx->logger, LOG_WARNING,
+                                "%s: Failed to get encoder_cap_info from VBIOS with error code %d!\n",
+                                __func__,
+                                result);
        }
 }
@@ -904,8 +907,7 @@ void dce110_link_encoder_enable_tmds_output(
        struct link_encoder *enc,
        enum clock_source_id clock_source,
        enum dc_color_depth color_depth,
-        bool hdmi,
+        enum signal_type signal,
-        bool dual_link,
        uint32_t pixel_clock)
 {
        struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc);
@@ -919,16 +921,12 @@ void dce110_link_encoder_enable_tmds_output(
        cntl.engine_id = enc->preferred_engine;
        cntl.transmitter = enc110->base.transmitter;
        cntl.pll_id = clock_source;
-        if (hdmi) {
+        cntl.signal = signal;
-                cntl.signal = SIGNAL_TYPE_HDMI_TYPE_A;
+        if (cntl.signal == SIGNAL_TYPE_DVI_DUAL_LINK)
-                cntl.lanes_number = 4;
-        } else if (dual_link) {
-                cntl.signal = SIGNAL_TYPE_DVI_DUAL_LINK;
                cntl.lanes_number = 8;
-        } else {
+        else
-                cntl.signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
                cntl.lanes_number = 4;
-        }
        cntl.hpd_sel = enc110->base.hpd_source;
        cntl.pixel_clock = pixel_clock;
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
index 8ca9afe47a2b..0ec3433d34b6 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
@@ -210,8 +210,7 @@ void dce110_link_encoder_enable_tmds_output(
        struct link_encoder *enc,
        enum clock_source_id clock_source,
        enum dc_color_depth color_depth,
-        bool hdmi,
+        enum signal_type signal,
-        bool dual_link,
        uint32_t pixel_clock);
 /* enables DP PHY output */
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c b/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
index 3931412ab6d3..87093894ea9e 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_opp.c
@@ -128,23 +128,22 @@ static void set_truncation(
                return;
        }
        /* on other format-to do */
-        if (params->flags.TRUNCATE_ENABLED == 0 ||
+        if (params->flags.TRUNCATE_ENABLED == 0)
-                        params->flags.TRUNCATE_DEPTH == 2)
                return;
        /*Set truncation depth and Enable truncation*/
        REG_UPDATE_3(FMT_BIT_DEPTH_CONTROL,
                                FMT_TRUNCATE_EN, 1,
                                FMT_TRUNCATE_DEPTH,
-                                params->flags.TRUNCATE_MODE,
+                                params->flags.TRUNCATE_DEPTH,
                                FMT_TRUNCATE_MODE,
-                                params->flags.TRUNCATE_DEPTH);
+                                params->flags.TRUNCATE_MODE);
 }
 /**
 *      set_spatial_dither
 *      1) set spatial dithering mode: pattern of seed
- *      2) set spatical dithering depth: 0 for 18bpp or 1 for 24bpp
+ *      2) set spatial dithering depth: 0 for 18bpp or 1 for 24bpp
 *      3) set random seed
 *      4) set random mode
 *              lfsr is reset every frame or not reset
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
index 3ea43e2a9450..442dd2d93618 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
@@ -852,6 +852,7 @@ static bool construct(
        dc->caps.max_downscale_ratio = 200;
        dc->caps.i2c_speed_in_khz = 40;
        dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
        for (i = 0; i < pool->base.pipe_count; i++) {
                pool->base.timing_generators[i] =
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 86cdd7b4811f..6f382a3ac90f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -688,15 +688,22 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
        struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;
        struct dc_link *link = pipe_ctx->stream->sink->link;
-        /* 1. update AVI info frame (HDMI, DP)
-         * we always need to update info frame
-        */
        uint32_t active_total_with_borders;
        uint32_t early_control = 0;
        struct timing_generator *tg = pipe_ctx->stream_res.tg;
-        /* TODOFPGA may change to hwss.update_info_frame */
+        /* For MST, there are multiply stream go to only one link.
+         * connect DIG back_end to front_end while enable_stream and
+         * disconnect them during disable_stream
+         * BY this, it is logic clean to separate stream and link */
+        link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
+                                                    pipe_ctx->stream_res.stream_enc->id, true);
+        /* update AVI info frame (HDMI, DP)*/
+        /* TODO: FPGA may change to hwss.update_info_frame */
        dce110_update_info_frame(pipe_ctx);
        /* enable early control to avoid corruption on DP monitor*/
        active_total_with_borders =
                        timing->h_addressable
@@ -717,12 +724,8 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
                        pipe_ctx->stream_res.stream_enc->funcs->dp_audio_enable(pipe_ctx->stream_res.stream_enc);
        }
-        /* For MST, there are multiply stream go to only one link.
-         * connect DIG back_end to front_end while enable_stream and
-         * disconnect them during disable_stream
-         * BY this, it is logic clean to separate stream and link */
-        link->link_enc->funcs->connect_dig_be_to_fe(link->link_enc,
-                                                    pipe_ctx->stream_res.stream_enc->id, true);
 }
@@ -1690,9 +1693,13 @@ static void apply_min_clocks(
 *  Check if FBC can be enabled
 */
 static bool should_enable_fbc(struct dc *dc,
-                              struct dc_state *context)
+                              struct dc_state *context,
+                              uint32_t *pipe_idx)
 {
-        struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[0];
+        uint32_t i;
+        struct pipe_ctx *pipe_ctx = NULL;
+        struct resource_context *res_ctx = &context->res_ctx;
        ASSERT(dc->fbc_compressor);
@@ -1704,6 +1711,14 @@ static bool should_enable_fbc(struct dc *dc,
        if (context->stream_count != 1)
                return false;
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                if (res_ctx->pipe_ctx[i].stream) {
+                        pipe_ctx = &res_ctx->pipe_ctx[i];
+                        *pipe_idx = i;
+                        break;
+                }
+        }
        /* Only supports eDP */
        if (pipe_ctx->stream->sink->link->connector_signal != SIGNAL_TYPE_EDP)
                return false;
@@ -1729,11 +1744,14 @@ static bool should_enable_fbc(struct dc *dc,
 static void enable_fbc(struct dc *dc,
                       struct dc_state *context)
 {
-        if (should_enable_fbc(dc, context)) {
+        uint32_t pipe_idx = 0;
+        if (should_enable_fbc(dc, context, &pipe_idx)) {
                /* Program GRPH COMPRESSED ADDRESS and PITCH */
                struct compr_addr_and_pitch_params params = {0, 0, 0};
                struct compressor *compr = dc->fbc_compressor;
-                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[0];
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[pipe_idx];
                params.source_view_width = pipe_ctx->stream->timing.h_addressable;
                params.source_view_height = pipe_ctx->stream->timing.v_addressable;
@@ -2915,6 +2933,49 @@ static void program_csc_matrix(struct pipe_ctx *pipe_ctx,
        }
 }
+void dce110_set_cursor_position(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_position pos_cpy = pipe_ctx->stream->cursor_position;
+        struct input_pixel_processor *ipp = pipe_ctx->plane_res.ipp;
+        struct mem_input *mi = pipe_ctx->plane_res.mi;
+        struct dc_cursor_mi_param param = {
+                .pixel_clk_khz = pipe_ctx->stream->timing.pix_clk_khz,
+                .ref_clk_khz = pipe_ctx->stream->ctx->dc->res_pool->ref_clock_inKhz,
+                .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
+                .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
+                .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
+        };
+        if (pipe_ctx->plane_state->address.type
+                        == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
+                pos_cpy.enable = false;
+        if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
+                pos_cpy.enable = false;
+        if (ipp->funcs->ipp_cursor_set_position)
+                ipp->funcs->ipp_cursor_set_position(ipp, &pos_cpy, &param);
+        if (mi->funcs->set_cursor_position)
+                mi->funcs->set_cursor_position(mi, &pos_cpy, &param);
+}
+void dce110_set_cursor_attribute(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_attributes *attributes = &pipe_ctx->stream->cursor_attributes;
+        if (pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes)
+                pipe_ctx->plane_res.ipp->funcs->ipp_cursor_set_attributes(
+                                pipe_ctx->plane_res.ipp, attributes);
+        if (pipe_ctx->plane_res.mi->funcs->set_cursor_attributes)
+                pipe_ctx->plane_res.mi->funcs->set_cursor_attributes(
+                                pipe_ctx->plane_res.mi, attributes);
+        if (pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes)
+                pipe_ctx->plane_res.xfm->funcs->set_cursor_attributes(
+                                pipe_ctx->plane_res.xfm, attributes);
+}
 static void ready_shared_resources(struct dc *dc, struct dc_state *context) {}
 static void optimize_shared_resources(struct dc *dc) {}
@@ -2957,6 +3018,8 @@ static const struct hw_sequencer_funcs dce110_funcs = {
        .edp_backlight_control = hwss_edp_backlight_control,
        .edp_power_control = hwss_edp_power_control,
        .edp_wait_for_hpd_ready = hwss_edp_wait_for_hpd_ready,
+        .set_cursor_position = dce110_set_cursor_position,
+        .set_cursor_attribute = dce110_set_cursor_attribute
 };
 void dce110_hw_sequencer_construct(struct dc *dc)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
index 7c4779578fb7..00f18c485e1e 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
@@ -846,6 +846,16 @@ static bool dce110_validate_bandwidth(
        return result;
 }
+enum dc_status dce110_validate_plane(const struct dc_plane_state *plane_state,
+                                     struct dc_caps *caps)
+{
+        if (((plane_state->dst_rect.width * 2) < plane_state->src_rect.width) ||
+            ((plane_state->dst_rect.height * 2) < plane_state->src_rect.height))
+                return DC_FAIL_SURFACE_VALIDATE;
+        return DC_OK;
+}
 static bool dce110_validate_surface_sets(
                struct dc_state *context)
 {
@@ -869,6 +879,13 @@ static bool dce110_validate_surface_sets(
                                        plane->src_rect.height > 1080))
                                        return false;
+                                /* we don't have the logic to support underlay
+                                 * only yet so block the use case where we get
+                                 * NV12 plane as top layer
+                                 */
+                                if (j == 0)
+                                        return false;
                                /* irrespective of plane format,
                                 * stream should be RGB encoded
                                 */
@@ -1021,6 +1038,7 @@ static const struct resource_funcs dce110_res_pool_funcs = {
        .link_enc_create = dce110_link_encoder_create,
        .validate_guaranteed = dce110_validate_guaranteed,
        .validate_bandwidth = dce110_validate_bandwidth,
+        .validate_plane = dce110_validate_plane,
        .acquire_idle_pipe_for_layer = dce110_acquire_underlay,
        .add_stream_to_ctx = dce110_add_stream_to_ctx,
        .validate_global = dce110_validate_global
diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
index 663e0a047a4b..98d9cd0109e1 100644
--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
@@ -1103,6 +1103,8 @@ static bool construct(
        dc->caps.max_downscale_ratio = 200;
        dc->caps.i2c_speed_in_khz = 100;
        dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
        /*************************************************
         *  Create resources                             *
diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
index 57cd67359567..5aab01db28ee 100644
--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
@@ -835,6 +835,8 @@ static bool construct(
        dc->caps.max_downscale_ratio = 200;
        dc->caps.i2c_speed_in_khz = 100;
        dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
        dc->debug = debug_defaults;
        /*************************************************
diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
index 8f2bd56f3461..25d7eb1567ae 100644
--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
@@ -793,6 +793,7 @@ static bool dce80_construct(
        dc->caps.max_downscale_ratio = 200;
        dc->caps.i2c_speed_in_khz = 40;
        dc->caps.max_cursor_size = 128;
+        dc->caps.dual_link_dvi = true;
        /*************************************************
         *  Create resources                             *
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 82572863acab..dc1e010725c1 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -238,10 +238,34 @@ static void enable_power_gating_plane(
 static void disable_vga(
        struct dce_hwseq *hws)
 {
+        unsigned int in_vga1_mode = 0;
+        unsigned int in_vga2_mode = 0;
+        unsigned int in_vga3_mode = 0;
+        unsigned int in_vga4_mode = 0;
+        REG_GET(D1VGA_CONTROL, D1VGA_MODE_ENABLE, &in_vga1_mode);
+        REG_GET(D2VGA_CONTROL, D2VGA_MODE_ENABLE, &in_vga2_mode);
+        REG_GET(D3VGA_CONTROL, D3VGA_MODE_ENABLE, &in_vga3_mode);
+        REG_GET(D4VGA_CONTROL, D4VGA_MODE_ENABLE, &in_vga4_mode);
+        if (in_vga1_mode == 0 && in_vga2_mode == 0 &&
+                        in_vga3_mode == 0 && in_vga4_mode == 0)
+                return;
        REG_WRITE(D1VGA_CONTROL, 0);
        REG_WRITE(D2VGA_CONTROL, 0);
        REG_WRITE(D3VGA_CONTROL, 0);
        REG_WRITE(D4VGA_CONTROL, 0);
+        /* HW Engineer's Notes:
+         *  During switch from vga->extended, if we set the VGA_TEST_ENABLE and
+         *  then hit the VGA_TEST_RENDER_START, then the DCHUBP timing gets updated correctly.
+         *
+         *  Then vBIOS will have it poll for the VGA_TEST_RENDER_DONE and unset
+         *  VGA_TEST_ENABLE, to leave it in the same state as before.
+         */
+        REG_UPDATE(VGA_TEST_CONTROL, VGA_TEST_ENABLE, 1);
+        REG_UPDATE(VGA_TEST_CONTROL, VGA_TEST_RENDER_START, 1);
 }
 static void dpp_pg_control(
@@ -1761,6 +1785,11 @@ static void update_dchubp_dpp(
                        &pipe_ctx->plane_res.scl_data.viewport_c);
        }
+        if (pipe_ctx->stream->cursor_attributes.address.quad_part != 0) {
+                dc->hwss.set_cursor_position(pipe_ctx);
+                dc->hwss.set_cursor_attribute(pipe_ctx);
+        }
        if (plane_state->update_flags.bits.full_update) {
                /*gamut remap*/
                program_gamut_remap(pipe_ctx);
@@ -2296,7 +2325,7 @@ static bool dcn10_dummy_display_power_gating(
        return true;
 }
-void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
+static void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
 {
        struct dc_plane_state *plane_state = pipe_ctx->plane_state;
        struct timing_generator *tg = pipe_ctx->stream_res.tg;
@@ -2316,12 +2345,46 @@ void dcn10_update_pending_status(struct pipe_ctx *pipe_ctx)
        }
 }
-void dcn10_update_dchub(struct dce_hwseq *hws, struct dchub_init_data *dh_data)
+static void dcn10_update_dchub(struct dce_hwseq *hws, struct dchub_init_data *dh_data)
 {
        if (hws->ctx->dc->res_pool->hubbub != NULL)
                hubbub1_update_dchub(hws->ctx->dc->res_pool->hubbub, dh_data);
 }
+static void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_position pos_cpy = pipe_ctx->stream->cursor_position;
+        struct hubp *hubp = pipe_ctx->plane_res.hubp;
+        struct dpp *dpp = pipe_ctx->plane_res.dpp;
+        struct dc_cursor_mi_param param = {
+                .pixel_clk_khz = pipe_ctx->stream->timing.pix_clk_khz,
+                .ref_clk_khz = pipe_ctx->stream->ctx->dc->res_pool->ref_clock_inKhz,
+                .viewport_x_start = pipe_ctx->plane_res.scl_data.viewport.x,
+                .viewport_width = pipe_ctx->plane_res.scl_data.viewport.width,
+                .h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz
+        };
+        if (pipe_ctx->plane_state->address.type
+                        == PLN_ADDR_TYPE_VIDEO_PROGRESSIVE)
+                pos_cpy.enable = false;
+        if (pipe_ctx->top_pipe && pipe_ctx->plane_state != pipe_ctx->top_pipe->plane_state)
+                pos_cpy.enable = false;
+        hubp->funcs->set_cursor_position(hubp, &pos_cpy, &param);
+        dpp->funcs->set_cursor_position(dpp, &pos_cpy, &param, hubp->curs_attr.width);
+}
+static void dcn10_set_cursor_attribute(struct pipe_ctx *pipe_ctx)
+{
+        struct dc_cursor_attributes *attributes = &pipe_ctx->stream->cursor_attributes;
+        pipe_ctx->plane_res.hubp->funcs->set_cursor_attributes(
+                        pipe_ctx->plane_res.hubp, attributes);
+        pipe_ctx->plane_res.dpp->funcs->set_cursor_attributes(
+                pipe_ctx->plane_res.dpp, attributes->color_format);
+}
 static const struct hw_sequencer_funcs dcn10_funcs = {
        .program_gamut_remap = program_gamut_remap,
        .program_csc_matrix = program_csc_matrix,
@@ -2362,6 +2425,8 @@ static const struct hw_sequencer_funcs dcn10_funcs = {
        .edp_backlight_control = hwss_edp_backlight_control,
        .edp_power_control = hwss_edp_power_control,
        .edp_wait_for_hpd_ready = hwss_edp_wait_for_hpd_ready,
+        .set_cursor_position = dcn10_set_cursor_position,
+        .set_cursor_attribute = dcn10_set_cursor_attribute
 };
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
index 0fd329deacd8..54d8a1386142 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
@@ -123,8 +123,7 @@ struct link_encoder_funcs {
        void (*enable_tmds_output)(struct link_encoder *enc,
                enum clock_source_id clock_source,
                enum dc_color_depth color_depth,
-                bool hdmi,
+                enum signal_type signal,
-                bool dual_link,
                uint32_t pixel_clock);
        void (*enable_dp_output)(struct link_encoder *enc,
                const struct dc_link_settings *link_settings,
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
index 4c0aa56f7bae..379c6ecd271a 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
@@ -198,6 +198,9 @@ struct hw_sequencer_funcs {
                        bool enable);
        void (*edp_wait_for_hpd_ready)(struct dc_link *link, bool power_up);
+        void (*set_cursor_position)(struct pipe_ctx *pipe);
+        void (*set_cursor_attribute)(struct pipe_ctx *pipe);
 };
 void color_space_to_black_color(
diff --git a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
index f7e40b292dfb..d3e1923b01a8 100644
--- a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
+++ b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c
@@ -217,7 +217,7 @@ bool dce110_vblank_set(
                        core_dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg;
        if (enable) {
-                if (!tg->funcs->arm_vert_intr(tg, 2)) {
+                if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) {
                        DC_ERROR("Failed to get VBLANK!\n");
                        return false;
                }
diff --git a/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c b/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
index 57a54a7b89e5..1c079ba37c30 100644
--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_link_encoder.c
@@ -42,8 +42,7 @@ static void virtual_link_encoder_enable_tmds_output(
        struct link_encoder *enc,
        enum clock_source_id clock_source,
        enum dc_color_depth color_depth,
-        bool hdmi,
+        enum signal_type signal,
-        bool dual_link,
        uint32_t pixel_clock) {}
 static void virtual_link_encoder_enable_dp_output(
diff --git a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
index 7a9b43f84a31..36bbad594267 100644
--- a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
+++ b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h
@@ -419,11 +419,6 @@ struct bios_event_info {
        bool backlight_changed;
 };
-enum {
-        HDMI_PIXEL_CLOCK_IN_KHZ_297 = 297000,
-        TMDS_PIXEL_CLOCK_IN_KHZ_165 = 165000
-};
 /*
 * DFS-bypass flag
 */
diff --git a/drivers/gpu/drm/amd/display/include/signal_types.h b/drivers/gpu/drm/amd/display/include/signal_types.h
index b5ebde642207..199c5db67cbc 100644
--- a/drivers/gpu/drm/amd/display/include/signal_types.h
+++ b/drivers/gpu/drm/amd/display/include/signal_types.h
@@ -26,6 +26,11 @@
 #ifndef __DC_SIGNAL_TYPES_H__
 #define __DC_SIGNAL_TYPES_H__
+/* Minimum pixel clock, in KHz. For TMDS signal is 25.00 MHz */
+#define TMDS_MIN_PIXEL_CLOCK 25000
+/* Maximum pixel clock, in KHz. For TMDS signal is 165.00 MHz */
+#define TMDS_MAX_PIXEL_CLOCK 165000
 enum signal_type {
        SIGNAL_TYPE_NONE                = 0L,           /* no signal */
        SIGNAL_TYPE_DVI_SINGLE_LINK     = (1 << 0),
diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h
index 5f4c2e833a65..d665dd5af5dd 100644
--- a/drivers/gpu/drm/ast/ast_tables.h
+++ b/drivers/gpu/drm/ast/ast_tables.h
@@ -97,7 +97,7 @@ static const struct ast_vbios_dclk_info dclk_table[] = {
        {0x67, 0x22, 0x00},                     /* 0E: VCLK157_5        */
        {0x6A, 0x22, 0x00},                     /* 0F: VCLK162          */
        {0x4d, 0x4c, 0x80},                     /* 10: VCLK154          */
-        {0xa7, 0x78, 0x80},                     /* 11: VCLK83.5         */
+        {0x68, 0x6f, 0x80},                     /* 11: VCLK83.5         */
        {0x28, 0x49, 0x80},                     /* 12: VCLK106.5        */
        {0x37, 0x49, 0x80},                     /* 13: VCLK146.25       */
        {0x1f, 0x45, 0x80},                     /* 14: VCLK148.5        */
@@ -127,7 +127,7 @@ static const struct ast_vbios_dclk_info dclk_table_ast2500[] = {
        {0x67, 0x22, 0x00},                     /* 0E: VCLK157_5        */
        {0x6A, 0x22, 0x00},                     /* 0F: VCLK162          */
        {0x4d, 0x4c, 0x80},                     /* 10: VCLK154          */
-        {0xa7, 0x78, 0x80},                     /* 11: VCLK83.5         */
+        {0x68, 0x6f, 0x80},                     /* 11: VCLK83.5         */
        {0x28, 0x49, 0x80},                     /* 12: VCLK106.5        */
        {0x37, 0x49, 0x80},                     /* 13: VCLK146.25       */
        {0x1f, 0x45, 0x80},                     /* 14: VCLK148.5        */
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index c0530a1af5e3..2dc5e8bed172 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -461,6 +461,12 @@ int drm_mode_getfb(struct drm_device *dev,
        if (!fb)
                return -ENOENT;
+        /* Multi-planar framebuffers need getfb2. */
+        if (fb->format->num_planes > 1) {
+                ret = -EINVAL;
+                goto out;
+        }
        r->height = fb->height;
        r->width = fb->width;
        r->depth = fb->format->depth;
@@ -484,6 +490,7 @@ int drm_mode_getfb(struct drm_device *dev,
                ret = -ENODEV;
        }
+out:
        drm_framebuffer_put(fb);
        return ret;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index c8454ac43fae..db6b94dda5df 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -471,6 +471,7 @@ struct parser_exec_state {
         * used when ret from 2nd level batch buffer
         */
        int saved_buf_addr_type;
+        bool is_ctx_wa;
        struct cmd_info *info;
@@ -1715,6 +1716,11 @@ static int perform_bb_shadow(struct parser_exec_state *s)
        bb->accessing = true;
        bb->bb_start_cmd_va = s->ip_va;
+        if ((s->buf_type == BATCH_BUFFER_INSTRUCTION) && (!s->is_ctx_wa))
+                bb->bb_offset = s->ip_va - s->rb_va;
+        else
+                bb->bb_offset = 0;
        /*
         * ip_va saves the virtual address of the shadow batch buffer, while
         * ip_gma saves the graphics address of the original batch buffer.
@@ -2571,6 +2577,7 @@ static int scan_workload(struct intel_vgpu_workload *workload)
        s.ring_tail = gma_tail;
        s.rb_va = workload->shadow_ring_buffer_va;
        s.workload = workload;
+        s.is_ctx_wa = false;
        if ((bypass_scan_mask & (1 << workload->ring_id)) ||
                gma_head == gma_tail)
@@ -2624,6 +2631,7 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
        s.ring_tail = gma_tail;
        s.rb_va = wa_ctx->indirect_ctx.shadow_va;
        s.workload = workload;
+        s.is_ctx_wa = true;
        if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
                ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 256f1bb522b7..152df3d0291e 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -394,9 +394,11 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
         * performace for batch mmio read/write, so we need
         * handle forcewake mannually.
         */
+        intel_runtime_pm_get(dev_priv);
        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
        switch_mmio(pre, next, ring_id);
        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
+        intel_runtime_pm_put(dev_priv);
 }
 /**
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index b55b3580ca1d..d74d6f05c62c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -52,6 +52,54 @@ static void set_context_pdp_root_pointer(
                pdp_pair[i].val = pdp[7 - i];
 }
+/*
+ * when populating shadow ctx from guest, we should not overrride oa related
+ * registers, so that they will not be overlapped by guest oa configs. Thus
+ * made it possible to capture oa data from host for both host and guests.
+ */
+static void sr_oa_regs(struct intel_vgpu_workload *workload,
+                u32 *reg_state, bool save)
+{
+        struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        u32 ctx_oactxctrl = dev_priv->perf.oa.ctx_oactxctrl_offset;
+        u32 ctx_flexeu0 = dev_priv->perf.oa.ctx_flexeu0_offset;
+        int i = 0;
+        u32 flex_mmio[] = {
+                i915_mmio_reg_offset(EU_PERF_CNTL0),
+                i915_mmio_reg_offset(EU_PERF_CNTL1),
+                i915_mmio_reg_offset(EU_PERF_CNTL2),
+                i915_mmio_reg_offset(EU_PERF_CNTL3),
+                i915_mmio_reg_offset(EU_PERF_CNTL4),
+                i915_mmio_reg_offset(EU_PERF_CNTL5),
+                i915_mmio_reg_offset(EU_PERF_CNTL6),
+        };
+        if (!workload || !reg_state || workload->ring_id != RCS)
+                return;
+        if (save) {
+                workload->oactxctrl = reg_state[ctx_oactxctrl + 1];
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+                        workload->flex_mmio[i] = reg_state[state_offset + 1];
+                }
+        } else {
+                reg_state[ctx_oactxctrl] =
+                        i915_mmio_reg_offset(GEN8_OACTXCONTROL);
+                reg_state[ctx_oactxctrl + 1] = workload->oactxctrl;
+                for (i = 0; i < ARRAY_SIZE(workload->flex_mmio); i++) {
+                        u32 state_offset = ctx_flexeu0 + i * 2;
+                        u32 mmio = flex_mmio[i];
+                        reg_state[state_offset] = mmio;
+                        reg_state[state_offset + 1] = workload->flex_mmio[i];
+                }
+        }
+}
 static int populate_shadow_context(struct intel_vgpu_workload *workload)
 {
        struct intel_vgpu *vgpu = workload->vgpu;
@@ -98,6 +146,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
        page = i915_gem_object_get_page(ctx_obj, LRC_STATE_PN);
        shadow_ring_context = kmap(page);
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, true);
 #define COPY_REG(name) \
        intel_gvt_hypervisor_read_gpa(vgpu, workload->ring_context_gpa \
                + RING_CTX_OFF(name.val), &shadow_ring_context->name.val, 4)
@@ -122,6 +171,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                        sizeof(*shadow_ring_context),
                        I915_GTT_PAGE_SIZE - sizeof(*shadow_ring_context));
+        sr_oa_regs(workload, (u32 *)shadow_ring_context, false);
        kunmap(page);
        return 0;
 }
@@ -376,6 +426,17 @@ static int prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
                        goto err;
                }
+                /* For privilge batch buffer and not wa_ctx, the bb_start_cmd_va
+                 * is only updated into ring_scan_buffer, not real ring address
+                 * allocated in later copy_workload_to_ring_buffer. pls be noted
+                 * shadow_ring_buffer_va is now pointed to real ring buffer va
+                 * in copy_workload_to_ring_buffer.
+                 */
+                if (bb->bb_offset)
+                        bb->bb_start_cmd_va = workload->shadow_ring_buffer_va
+                                + bb->bb_offset;
                /* relocate shadow batch buffer */
                bb->bb_start_cmd_va[1] = i915_ggtt_offset(bb->vma);
                if (gmadr_bytes == 8)
@@ -1044,10 +1105,12 @@ int intel_vgpu_setup_submission(struct intel_vgpu *vgpu)
        bitmap_zero(s->shadow_ctx_desc_updated, I915_NUM_ENGINES);
-        s->workloads = kmem_cache_create("gvt-g_vgpu_workload",
+        s->workloads = kmem_cache_create_usercopy("gvt-g_vgpu_workload",
-                        sizeof(struct intel_vgpu_workload), 0,
+                                                  sizeof(struct intel_vgpu_workload), 0,
-                        SLAB_HWCACHE_ALIGN,
+                                                  SLAB_HWCACHE_ALIGN,
-                        NULL);
+                                                  offsetof(struct intel_vgpu_workload, rb_tail),
+                                                  sizeof_field(struct intel_vgpu_workload, rb_tail),
+                                                  NULL);
        if (!s->workloads) {
                ret = -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.h b/drivers/gpu/drm/i915/gvt/scheduler.h
index ff175a98b19e..a79a4f60637e 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.h
+++ b/drivers/gpu/drm/i915/gvt/scheduler.h
@@ -110,6 +110,10 @@ struct intel_vgpu_workload {
        /* shadow batch buffer */
        struct list_head shadow_bb;
        struct intel_shadow_wa_ctx wa_ctx;
+        /* oa registers */
+        u32 oactxctrl;
+        u32 flex_mmio[7];
 };
 struct intel_vgpu_shadow_bb {
@@ -120,6 +124,7 @@ struct intel_vgpu_shadow_bb {
        u32 *bb_start_cmd_va;
        unsigned int clflush;
        bool accessing;
+        unsigned long bb_offset;
 };
 #define workload_q_head(vgpu, ring_id) \
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index dd89abd2263d..6ff5d655c202 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -434,20 +434,28 @@ i915_gem_object_wait_reservation(struct reservation_object *resv,
                        dma_fence_put(shared[i]);
                kfree(shared);
+                /*
+                 * If both shared fences and an exclusive fence exist,
+                 * then by construction the shared fences must be later
+                 * than the exclusive fence. If we successfully wait for
+                 * all the shared fences, we know that the exclusive fence
+                 * must all be signaled. If all the shared fences are
+                 * signaled, we can prune the array and recover the
+                 * floating references on the fences/requests.
+                 */
                prune_fences = count && timeout >= 0;
        } else {
                excl = reservation_object_get_excl_rcu(resv);
        }
-        if (excl && timeout >= 0) {
+        if (excl && timeout >= 0)
                timeout = i915_gem_object_wait_fence(excl, flags, timeout,
                                                     rps_client);
-                prune_fences = timeout >= 0;
-        }
        dma_fence_put(excl);
-        /* Oportunistically prune the fences iff we know they have *all* been
+        /*
+         * Opportunistically prune the fences iff we know they have *all* been
         * signaled and that the reservation object has not been changed (i.e.
         * no new fences have been added).
         */
@@ -3205,8 +3213,10 @@ void i915_gem_set_wedged(struct drm_i915_private *i915)
         * rolling the global seqno forward (since this would complete requests
         * for which we haven't set the fence error to EIO yet).
         */
-        for_each_engine(engine, i915, id)
+        for_each_engine(engine, i915, id) {
+                i915_gem_reset_prepare_engine(engine);
                engine->submit_request = nop_submit_request;
+        }
        /*
         * Make sure no one is running the old callback before we proceed with
@@ -3244,6 +3254,8 @@ void i915_gem_set_wedged(struct drm_i915_private *i915)
                intel_engine_init_global_seqno(engine,
                                               intel_engine_last_submit(engine));
                spin_unlock_irqrestore(&engine->timeline->lock, flags);
+                i915_gem_reset_finish_engine(engine);
        }
        set_bit(I915_WEDGED, &i915->gpu_error.flags);
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 0be50e43507d..f8fe5ffcdcff 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1303,9 +1303,8 @@ static void i915_oa_stream_destroy(struct i915_perf_stream *stream)
         */
        mutex_lock(&dev_priv->drm.struct_mutex);
        dev_priv->perf.oa.exclusive_stream = NULL;
-        mutex_unlock(&dev_priv->drm.struct_mutex);
        dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+        mutex_unlock(&dev_priv->drm.struct_mutex);
        free_oa_buffer(dev_priv);
@@ -1756,22 +1755,13 @@ static int gen8_switch_to_updated_kernel_context(struct drm_i915_private *dev_pr
 * Note: it's only the RCS/Render context that has any OA state.
 */
 static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
-                                       const struct i915_oa_config *oa_config,
+                                       const struct i915_oa_config *oa_config)
-                                       bool interruptible)
 {
        struct i915_gem_context *ctx;
        int ret;
        unsigned int wait_flags = I915_WAIT_LOCKED;
-        if (interruptible) {
+        lockdep_assert_held(&dev_priv->drm.struct_mutex);
-                ret = i915_mutex_lock_interruptible(&dev_priv->drm);
-                if (ret)
-                        return ret;
-                wait_flags |= I915_WAIT_INTERRUPTIBLE;
-        } else {
-                mutex_lock(&dev_priv->drm.struct_mutex);
-        }
        /* Switch away from any user context. */
        ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config);
@@ -1819,8 +1809,6 @@ static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv,
        }
 out:
-        mutex_unlock(&dev_priv->drm.struct_mutex);
        return ret;
 }
@@ -1863,7 +1851,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv,
         * to make sure all slices/subslices are ON before writing to NOA
         * registers.
         */
-        ret = gen8_configure_all_contexts(dev_priv, oa_config, true);
+        ret = gen8_configure_all_contexts(dev_priv, oa_config);
        if (ret)
                return ret;
@@ -1878,7 +1866,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv,
 static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
 {
        /* Reset all contexts' slices/subslices configurations. */
-        gen8_configure_all_contexts(dev_priv, NULL, false);
+        gen8_configure_all_contexts(dev_priv, NULL);
        I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) &
                                      ~GT_NOA_ENABLE));
@@ -1888,7 +1876,7 @@ static void gen8_disable_metric_set(struct drm_i915_private *dev_priv)
 static void gen10_disable_metric_set(struct drm_i915_private *dev_priv)
 {
        /* Reset all contexts' slices/subslices configurations. */
-        gen8_configure_all_contexts(dev_priv, NULL, false);
+        gen8_configure_all_contexts(dev_priv, NULL);
        /* Make sure we disable noa to save power. */
        I915_WRITE(RPM_CONFIG1,
@@ -2138,6 +2126,10 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream,
        if (ret)
                goto err_oa_buf_alloc;
+        ret = i915_mutex_lock_interruptible(&dev_priv->drm);
+        if (ret)
+                goto err_lock;
        ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv,
                                                      stream->oa_config);
        if (ret)
@@ -2145,23 +2137,17 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream,
        stream->ops = &i915_oa_stream_ops;
-        /* Lock device for exclusive_stream access late because
-         * enable_metric_set() might lock as well on gen8+.
-         */
-        ret = i915_mutex_lock_interruptible(&dev_priv->drm);
-        if (ret)
-                goto err_lock;
        dev_priv->perf.oa.exclusive_stream = stream;
        mutex_unlock(&dev_priv->drm.struct_mutex);
        return 0;
-err_lock:
+err_enable:
        dev_priv->perf.oa.ops.disable_metric_set(dev_priv);
+        mutex_unlock(&dev_priv->drm.struct_mutex);
-err_enable:
+err_lock:
        free_oa_buffer(dev_priv);
 err_oa_buf_alloc:
diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c
index b33d2158c234..e5e6f6bb2b05 100644
--- a/drivers/gpu/drm/i915/i915_sysfs.c
+++ b/drivers/gpu/drm/i915/i915_sysfs.c
@@ -304,8 +304,9 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
 {
        struct drm_i915_private *dev_priv = kdev_minor_to_i915(kdev);
        struct intel_rps *rps = &dev_priv->gt_pm.rps;
-        u32 val;
+        bool boost = false;
        ssize_t ret;
+        u32 val;
        ret = kstrtou32(buf, 0, &val);
        if (ret)
@@ -317,8 +318,13 @@ static ssize_t gt_boost_freq_mhz_store(struct device *kdev,
                return -EINVAL;
        mutex_lock(&dev_priv->pcu_lock);
-        rps->boost_freq = val;
+        if (val != rps->boost_freq) {
+                rps->boost_freq = val;
+                boost = atomic_read(&rps->num_waiters);
+        }
        mutex_unlock(&dev_priv->pcu_lock);
+        if (boost)
+                schedule_work(&rps->work);
        return count;
 }
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f51645a08dca..6aff9d096e13 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2175,8 +2175,7 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
                intel_prepare_dp_ddi_buffers(encoder, crtc_state);
        intel_ddi_init_dp_buf_reg(encoder);
-        if (!is_mst)
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
-                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
        intel_dp_start_link_train(intel_dp);
        if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
                intel_dp_stop_link_train(intel_dp);
@@ -2274,14 +2273,12 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
        struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
        struct intel_digital_port *dig_port = enc_to_dig_port(&encoder->base);
        struct intel_dp *intel_dp = &dig_port->dp;
-        bool is_mst = intel_crtc_has_type(old_crtc_state, INTEL_OUTPUT_DP_MST);
        /*
         * Power down sink before disabling the port, otherwise we end
         * up getting interrupts from the sink on detecting link loss.
         */
-        if (!is_mst)
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
-                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
        intel_disable_ddi_buf(encoder);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 35c5299feab6..a29868cd30c7 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -620,19 +620,15 @@ static int
 bxt_power_sequencer_idx(struct intel_dp *intel_dp)
 {
        struct drm_i915_private *dev_priv = to_i915(intel_dp_to_dev(intel_dp));
+        int backlight_controller = dev_priv->vbt.backlight.controller;
        lockdep_assert_held(&dev_priv->pps_mutex);
        /* We should never land here with regular DP ports */
        WARN_ON(!intel_dp_is_edp(intel_dp));
-        /*
-         * TODO: BXT has 2 PPS instances. The correct port->PPS instance
-         * mapping needs to be retrieved from VBT, for now just hard-code to
-         * use instance #0 always.
-         */
        if (!intel_dp->pps_reset)
-                return 0;
+                return backlight_controller;
        intel_dp->pps_reset = false;
@@ -642,7 +638,7 @@ bxt_power_sequencer_idx(struct intel_dp *intel_dp)
         */
        intel_dp_init_panel_power_sequencer_registers(intel_dp, false);
-        return 0;
+        return backlight_controller;
 }
 typedef bool (*vlv_pipe_check)(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_hangcheck.c b/drivers/gpu/drm/i915/intel_hangcheck.c
index 348a4f7ffb67..53747318f4a7 100644
--- a/drivers/gpu/drm/i915/intel_hangcheck.c
+++ b/drivers/gpu/drm/i915/intel_hangcheck.c
@@ -246,7 +246,7 @@ engine_stuck(struct intel_engine_cs *engine, u64 acthd)
         */
        tmp = I915_READ_CTL(engine);
        if (tmp & RING_WAIT) {
-                i915_handle_error(dev_priv, 0,
+                i915_handle_error(dev_priv, BIT(engine->id),
                                  "Kicking stuck wait on %s",
                                  engine->name);
                I915_WRITE_CTL(engine, tmp);
@@ -258,7 +258,7 @@ engine_stuck(struct intel_engine_cs *engine, u64 acthd)
                default:
                        return ENGINE_DEAD;
                case 1:
-                        i915_handle_error(dev_priv, 0,
+                        i915_handle_error(dev_priv, ALL_ENGINES,
                                          "Kicking stuck semaphore on %s",
                                          engine->name);
                        I915_WRITE_CTL(engine, tmp);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 7ece2f061b9e..e0fca035ff78 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -719,6 +719,8 @@ static void execlists_cancel_requests(struct intel_engine_cs *engine)
        struct rb_node *rb;
        unsigned long flags;
+        GEM_TRACE("%s\n", engine->name);
        spin_lock_irqsave(&engine->timeline->lock, flags);
        /* Cancel the requests on the HW and clear the ELSP tracker. */
@@ -765,6 +767,9 @@ static void execlists_cancel_requests(struct intel_engine_cs *engine)
         */
        clear_bit(ENGINE_IRQ_EXECLIST, &engine->irq_posted);
+        /* Mark all CS interrupts as complete */
+        execlists->active = 0;
        spin_unlock_irqrestore(&engine->timeline->lock, flags);
 }
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 9a9961802f5c..e83af0f2be86 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -225,7 +225,11 @@ static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                  struct drm_crtc_state *old_crtc_state)
 {
        drm_crtc_vblank_on(crtc);
+}
+static void ipu_crtc_atomic_flush(struct drm_crtc *crtc,
+                                  struct drm_crtc_state *old_crtc_state)
+{
        spin_lock_irq(&crtc->dev->event_lock);
        if (crtc->state->event) {
                WARN_ON(drm_crtc_vblank_get(crtc));
@@ -293,6 +297,7 @@ static const struct drm_crtc_helper_funcs ipu_helper_funcs = {
        .mode_set_nofb = ipu_crtc_mode_set_nofb,
        .atomic_check = ipu_crtc_atomic_check,
        .atomic_begin = ipu_crtc_atomic_begin,
+        .atomic_flush = ipu_crtc_atomic_flush,
        .atomic_disable = ipu_crtc_atomic_disable,
        .atomic_enable = ipu_crtc_atomic_enable,
 };
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 57ed56d8623f..d9113faaa62f 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -22,6 +22,7 @@
 #include <drm/drm_plane_helper.h>
 #include "video/imx-ipu-v3.h"
+#include "imx-drm.h"
 #include "ipuv3-plane.h"
 struct ipu_plane_state {
@@ -272,7 +273,7 @@ static void ipu_plane_destroy(struct drm_plane *plane)
        kfree(ipu_plane);
 }
-void ipu_plane_state_reset(struct drm_plane *plane)
+static void ipu_plane_state_reset(struct drm_plane *plane)
 {
        struct ipu_plane_state *ipu_state;
@@ -292,7 +293,8 @@ void ipu_plane_state_reset(struct drm_plane *plane)
        plane->state = &ipu_state->base;
 }
-struct drm_plane_state *ipu_plane_duplicate_state(struct drm_plane *plane)
+static struct drm_plane_state *
+ipu_plane_duplicate_state(struct drm_plane *plane)
 {
        struct ipu_plane_state *state;
@@ -306,8 +308,8 @@ struct drm_plane_state *ipu_plane_duplicate_state(struct drm_plane *plane)
        return &state->base;
 }
-void ipu_plane_destroy_state(struct drm_plane *plane,
+static void ipu_plane_destroy_state(struct drm_plane *plane,
-                             struct drm_plane_state *state)
+                                    struct drm_plane_state *state)
 {
        struct ipu_plane_state *ipu_state = to_ipu_plane_state(state);
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
index 380f340204e8..debbbf0fd4bd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -134,7 +134,7 @@ nv50_get_intensity(struct backlight_device *bd)
        struct nouveau_encoder *nv_encoder = bl_get_data(bd);
        struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
        struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
        u32 div = 1025;
        u32 val;
@@ -149,7 +149,7 @@ nv50_set_intensity(struct backlight_device *bd)
        struct nouveau_encoder *nv_encoder = bl_get_data(bd);
        struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
        struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
        u32 div = 1025;
        u32 val = (bd->props.brightness * div) / 100;
@@ -170,7 +170,7 @@ nva3_get_intensity(struct backlight_device *bd)
        struct nouveau_encoder *nv_encoder = bl_get_data(bd);
        struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
        struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
        u32 div, val;
        div  = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -188,7 +188,7 @@ nva3_set_intensity(struct backlight_device *bd)
        struct nouveau_encoder *nv_encoder = bl_get_data(bd);
        struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev);
        struct nvif_object *device = &drm->client.device.object;
-        int or = nv_encoder->or;
+        int or = ffs(nv_encoder->dcb->or) - 1;
        u32 div, val;
        div = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or));
@@ -228,7 +228,7 @@ nv50_backlight_init(struct drm_connector *connector)
                        return -ENODEV;
        }
-        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(nv_encoder->or)))
+        if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1)))
                return 0;
        if (drm->client.device.info.chipset <= 0xa0 ||
@@ -268,13 +268,13 @@ nouveau_backlight_init(struct drm_device *dev)
        struct nvif_device *device = &drm->client.device;
        struct drm_connector *connector;
+        INIT_LIST_HEAD(&drm->bl_connectors);
        if (apple_gmux_present()) {
                NV_INFO(drm, "Apple GMUX detected: not registering Nouveau backlight interface\n");
                return 0;
        }
-        INIT_LIST_HEAD(&drm->bl_connectors);
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
                    connector->connector_type != DRM_MODE_CONNECTOR_eDP)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
index 93946dcee319..1c12e58f44c2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
@@ -1354,7 +1354,7 @@ nvkm_vmm_get_locked(struct nvkm_vmm *vmm, bool getref, bool mapref, bool sparse,
                tail = this->addr + this->size;
                if (vmm->func->page_block && next && next->page != p)
-                        tail = ALIGN_DOWN(addr, vmm->func->page_block);
+                        tail = ALIGN_DOWN(tail, vmm->func->page_block);
                if (addr <= tail && tail - addr >= size) {
                        rb_erase(&this->tree, &vmm->free);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index d3045a371a55..7c73bc7e2f85 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3221,35 +3221,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
        case CHIP_KAVERI:
                rdev->config.cik.max_shader_engines = 1;
                rdev->config.cik.max_tile_pipes = 4;
-                if ((rdev->pdev->device == 0x1304) ||
+                rdev->config.cik.max_cu_per_sh = 8;
-                    (rdev->pdev->device == 0x1305) ||
+                rdev->config.cik.max_backends_per_se = 2;
-                    (rdev->pdev->device == 0x130C) ||
-                    (rdev->pdev->device == 0x130F) ||
-                    (rdev->pdev->device == 0x1310) ||
-                    (rdev->pdev->device == 0x1311) ||
-                    (rdev->pdev->device == 0x131C)) {
-                        rdev->config.cik.max_cu_per_sh = 8;
-                        rdev->config.cik.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x1309) ||
-                           (rdev->pdev->device == 0x130A) ||
-                           (rdev->pdev->device == 0x130D) ||
-                           (rdev->pdev->device == 0x1313) ||
-                           (rdev->pdev->device == 0x131D)) {
-                        rdev->config.cik.max_cu_per_sh = 6;
-                        rdev->config.cik.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x1306) ||
-                           (rdev->pdev->device == 0x1307) ||
-                           (rdev->pdev->device == 0x130B) ||
-                           (rdev->pdev->device == 0x130E) ||
-                           (rdev->pdev->device == 0x1315) ||
-                           (rdev->pdev->device == 0x1318) ||
-                           (rdev->pdev->device == 0x131B)) {
-                        rdev->config.cik.max_cu_per_sh = 4;
-                        rdev->config.cik.max_backends_per_se = 1;
-                } else {
-                        rdev->config.cik.max_cu_per_sh = 3;
-                        rdev->config.cik.max_backends_per_se = 1;
-                }
                rdev->config.cik.max_sh_per_se = 1;
                rdev->config.cik.max_texture_channel_caches = 4;
                rdev->config.cik.max_gprs = 256;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 2e2ca3c6b47d..df9469a8fdb1 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -90,25 +90,18 @@ void radeon_connector_hotplug(struct drm_connector *connector)
                /* don't do anything if sink is not display port, i.e.,
                 * passive dp->(dvi|hdmi) adaptor
                 */
-                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) {
+                if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT &&
-                        int saved_dpms = connector->dpms;
+                    radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
-                        /* Only turn off the display if it's physically disconnected */
+                    radeon_dp_needs_link_train(radeon_connector)) {
-                        if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
+                        /* Don't start link training before we have the DPCD */
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                        if (!radeon_dp_getdpcd(radeon_connector))
-                        } else if (radeon_dp_needs_link_train(radeon_connector)) {
+                                return;
-                                /* Don't try to start link training before we
-                                 * have the dpcd */
+                        /* Turn the connector off and back on immediately, which
-                                if (!radeon_dp_getdpcd(radeon_connector))
+                         * will trigger link training
-                                        return;
+                         */
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
-                                /* set it to OFF so that drm_helper_connector_dpms()
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                                 * won't return immediately since the current state
-                                 * is ON at this point.
-                                 */
-                                connector->dpms = DRM_MODE_DPMS_OFF;
-                                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                        }
-                        connector->dpms = saved_dpms;
                }
        }
 }
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index a9962ffba720..27d8e7dd2d06 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -34,8 +34,6 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
        struct radeon_bo *robj = gem_to_radeon_bo(gobj);
        if (robj) {
-                if (robj->gem_base.import_attach)
-                        drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
                radeon_mn_unregister(robj);
                radeon_bo_unref(&robj);
        }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 15404af9d740..31f5ad605e59 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -82,6 +82,8 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
        mutex_unlock(&bo->rdev->gem.mutex);
        radeon_bo_clear_surface_reg(bo);
        WARN_ON_ONCE(!list_empty(&bo->va));
+        if (bo->gem_base.import_attach)
+                drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg);
        drm_gem_object_release(&bo->gem_base);
        kfree(bo);
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_crtc.c b/drivers/gpu/drm/sun4i/sun4i_crtc.c
index 5decae0069d0..78cbc3145e44 100644
--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c
@@ -93,6 +93,8 @@ static void sun4i_crtc_atomic_disable(struct drm_crtc *crtc,
        DRM_DEBUG_DRIVER("Disabling the CRTC\n");
+        drm_crtc_vblank_off(crtc);
        sun4i_tcon_set_status(scrtc->tcon, encoder, false);
        if (crtc->state->event && !crtc->state->active) {
@@ -113,6 +115,8 @@ static void sun4i_crtc_atomic_enable(struct drm_crtc *crtc,
        DRM_DEBUG_DRIVER("Enabling the CRTC\n");
        sun4i_tcon_set_status(scrtc->tcon, encoder, true);
+        drm_crtc_vblank_on(crtc);
 }
 static void sun4i_crtc_mode_set_nofb(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
index 023f39bda633..e36004fbe453 100644
--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c
+++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
@@ -132,10 +132,13 @@ static int sun4i_dclk_get_phase(struct clk_hw *hw)
 static int sun4i_dclk_set_phase(struct clk_hw *hw, int degrees)
 {
        struct sun4i_dclk *dclk = hw_to_dclk(hw);
+        u32 val = degrees / 120;
+        val <<= 28;
        regmap_update_bits(dclk->regmap, SUN4I_TCON0_IO_POL_REG,
                           GENMASK(29, 28),
-                           degrees / 120);
+                           val);
        return 0;
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 4570da0227b4..d9a71f361b14 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -111,7 +111,7 @@ static int sun4i_drv_bind(struct device *dev)
        /* drm_vblank_init calls kcalloc, which can fail */
        ret = drm_vblank_init(drm, drm->mode_config.num_crtc);
        if (ret)
-                goto free_mem_region;
+                goto cleanup_mode_config;
        drm->irq_enabled = true;
@@ -139,7 +139,6 @@ finish_poll:
        sun4i_framebuffer_free(drm);
 cleanup_mode_config:
        drm_mode_config_cleanup(drm);
-free_mem_region:
        of_reserved_mem_device_release(dev);
 free_drm:
        drm_dev_unref(drm);
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 500b6fb3e028..fa4bcd092eaf 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -538,7 +538,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                                             &sun4i_hdmi_regmap_config);
        if (IS_ERR(hdmi->regmap)) {
                dev_err(dev, "Couldn't create HDMI encoder regmap\n");
-                return PTR_ERR(hdmi->regmap);
+                ret = PTR_ERR(hdmi->regmap);
+                goto err_disable_mod_clk;
        }
        ret = sun4i_tmds_create(hdmi);
@@ -551,7 +552,8 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
                hdmi->ddc_parent_clk = devm_clk_get(dev, "ddc");
                if (IS_ERR(hdmi->ddc_parent_clk)) {
                        dev_err(dev, "Couldn't get the HDMI DDC clock\n");
-                        return PTR_ERR(hdmi->ddc_parent_clk);
+                        ret = PTR_ERR(hdmi->ddc_parent_clk);
+                        goto err_disable_mod_clk;
                }
        } else {
                hdmi->ddc_parent_clk = hdmi->tmds_clk;
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index 832f8f9bc47f..b8da5a50a61d 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -92,6 +92,8 @@ static int sun4i_rgb_mode_valid(struct drm_connector *connector,
        DRM_DEBUG_DRIVER("Vertical parameters OK\n");
+        tcon->dclk_min_div = 6;
+        tcon->dclk_max_div = 127;
        rounded_rate = clk_round_rate(tcon->dclk, rate);
        if (rounded_rate < rate)
                return MODE_CLOCK_LOW;
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index b3960118deb9..a818ca491605 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -101,10 +101,13 @@ static void sun4i_tcon_channel_set_status(struct sun4i_tcon *tcon, int channel,
                return;
        }
-        if (enabled)
+        if (enabled) {
                clk_prepare_enable(clk);
-        else
+                clk_rate_exclusive_get(clk);
+        } else {
+                clk_rate_exclusive_put(clk);
                clk_disable_unprepare(clk);
+        }
 }
 static void sun4i_tcon_lvds_set_status(struct sun4i_tcon *tcon,
@@ -260,7 +263,7 @@ static void sun4i_tcon0_mode_set_common(struct sun4i_tcon *tcon,
                                        const struct drm_display_mode *mode)
 {
        /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->dclk, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->dclk, mode->crtc_clock * 1000);
        /* Set the resolution */
        regmap_write(tcon->regs, SUN4I_TCON0_BASIC0_REG,
@@ -421,7 +424,7 @@ static void sun4i_tcon1_mode_set(struct sun4i_tcon *tcon,
        WARN_ON(!tcon->quirks->has_channel_1);
        /* Configure the dot clock */
-        clk_set_rate_exclusive(tcon->sclk1, mode->crtc_clock * 1000);
+        clk_set_rate(tcon->sclk1, mode->crtc_clock * 1000);
        /* Adjust clock delay */
        clk_delay = sun4i_tcon_get_clk_delay(mode, 1);
@@ -873,52 +876,56 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
                return ret;
        }
-        /*
+        if (tcon->quirks->supports_lvds) {
-         * This can only be made optional since we've had DT nodes
+                /*
-         * without the LVDS reset properties.
+                 * This can only be made optional since we've had DT
-         *
+                 * nodes without the LVDS reset properties.
-         * If the property is missing, just disable LVDS, and print a
+                 *
-         * warning.
+                 * If the property is missing, just disable LVDS, and
-         */
+                 * print a warning.
-        tcon->lvds_rst = devm_reset_control_get_optional(dev, "lvds");
+                 */
-        if (IS_ERR(tcon->lvds_rst)) {
+                tcon->lvds_rst = devm_reset_control_get_optional(dev, "lvds");
-                dev_err(dev, "Couldn't get our reset line\n");
+                if (IS_ERR(tcon->lvds_rst)) {
-                return PTR_ERR(tcon->lvds_rst);
+                        dev_err(dev, "Couldn't get our reset line\n");
-        } else if (tcon->lvds_rst) {
+                        return PTR_ERR(tcon->lvds_rst);
-                has_lvds_rst = true;
+                } else if (tcon->lvds_rst) {
-                reset_control_reset(tcon->lvds_rst);
+                        has_lvds_rst = true;
-        } else {
+                        reset_control_reset(tcon->lvds_rst);
-                has_lvds_rst = false;
+                } else {
-        }
+                        has_lvds_rst = false;
+                }
-        /*
+                /*
-         * This can only be made optional since we've had DT nodes
+                 * This can only be made optional since we've had DT
-         * without the LVDS reset properties.
+                 * nodes without the LVDS reset properties.
-         *
+                 *
-         * If the property is missing, just disable LVDS, and print a
+                 * If the property is missing, just disable LVDS, and
-         * warning.
+                 * print a warning.
-         */
+                 */
-        if (tcon->quirks->has_lvds_alt) {
+                if (tcon->quirks->has_lvds_alt) {
-                tcon->lvds_pll = devm_clk_get(dev, "lvds-alt");
+                        tcon->lvds_pll = devm_clk_get(dev, "lvds-alt");
-                if (IS_ERR(tcon->lvds_pll)) {
+                        if (IS_ERR(tcon->lvds_pll)) {
-                        if (PTR_ERR(tcon->lvds_pll) == -ENOENT) {
+                                if (PTR_ERR(tcon->lvds_pll) == -ENOENT) {
-                                has_lvds_alt = false;
+                                        has_lvds_alt = false;
+                                } else {
+                                        dev_err(dev, "Couldn't get the LVDS PLL\n");
+                                        return PTR_ERR(tcon->lvds_pll);
+                                }
                        } else {
-                                dev_err(dev, "Couldn't get the LVDS PLL\n");
+                                has_lvds_alt = true;
-                                return PTR_ERR(tcon->lvds_pll);
                        }
-                } else {
-                        has_lvds_alt = true;
                }
-        }
-        if (!has_lvds_rst || (tcon->quirks->has_lvds_alt && !has_lvds_alt)) {
+                if (!has_lvds_rst ||
-                dev_warn(dev,
+                    (tcon->quirks->has_lvds_alt && !has_lvds_alt)) {
-                         "Missing LVDS properties, Please upgrade your DT\n");
+                        dev_warn(dev, "Missing LVDS properties, Please upgrade your DT\n");
-                dev_warn(dev, "LVDS output disabled\n");
+                        dev_warn(dev, "LVDS output disabled\n");
-                can_lvds = false;
+                        can_lvds = false;
+                } else {
+                        can_lvds = true;
+                }
        } else {
-                can_lvds = true;
+                can_lvds = false;
        }
        ret = sun4i_tcon_init_clocks(dev, tcon);
@@ -1137,7 +1144,7 @@ static const struct sun4i_tcon_quirks sun8i_a33_quirks = {
 };
 static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = {
-        /* nothing is supported */
+        .supports_lvds          = true,
 };
 static const struct sun4i_tcon_quirks sun8i_v3s_quirks = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
index b761c7b823c5..278700c7bf9f 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
@@ -175,6 +175,7 @@ struct sun4i_tcon_quirks {
        bool    has_channel_1;  /* a33 does not have channel 1 */
        bool    has_lvds_alt;   /* Does the LVDS clock have a parent other than the TCON clock? */
        bool    needs_de_be_mux; /* sun6i needs mux to select backend */
+        bool    supports_lvds;   /* Does the TCON support an LVDS output? */
        /* callback to handle tcon muxing options */
        int     (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *);
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index b8403ed48285..fbffe1948b3b 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -1903,8 +1903,12 @@ cleanup:
        if (!IS_ERR(primary))
                drm_plane_cleanup(primary);
-        if (group && tegra->domain) {
+        if (group && dc->domain) {
-                iommu_detach_group(tegra->domain, group);
+                if (group == tegra->group) {
+                        iommu_detach_group(dc->domain, group);
+                        tegra->group = NULL;
+                }
                dc->domain = NULL;
        }
@@ -1913,8 +1917,10 @@ cleanup:
 static int tegra_dc_exit(struct host1x_client *client)
 {
+        struct drm_device *drm = dev_get_drvdata(client->parent);
        struct iommu_group *group = iommu_group_get(client->dev);
        struct tegra_dc *dc = host1x_client_to_dc(client);
+        struct tegra_drm *tegra = drm->dev_private;
        int err;
        devm_free_irq(dc->dev, dc->irq, dc);
@@ -1926,7 +1932,11 @@ static int tegra_dc_exit(struct host1x_client *client)
        }
        if (group && dc->domain) {
-                iommu_detach_group(dc->domain, group);
+                if (group == tegra->group) {
+                        iommu_detach_group(dc->domain, group);
+                        tegra->group = NULL;
+                }
                dc->domain = NULL;
        }
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index d50bddb2e447..7fcf4a242840 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -250,6 +250,7 @@ static void tegra_drm_unload(struct drm_device *drm)
        drm_kms_helper_poll_fini(drm);
        tegra_drm_fb_exit(drm);
+        drm_atomic_helper_shutdown(drm);
        drm_mode_config_cleanup(drm);
        err = host1x_device_exit(device);
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 4d2ed966f9e3..87c5d89bc9ba 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -1072,7 +1072,6 @@ static int tegra_dsi_exit(struct host1x_client *client)
        struct tegra_dsi *dsi = host1x_client_to_dsi(client);
        tegra_output_exit(&dsi->output);
-        regulator_disable(dsi->vdd);
        return 0;
 }
diff --git a/drivers/gpu/drm/tegra/plane.c b/drivers/gpu/drm/tegra/plane.c
index 36a06a993698..94dac79ac3c9 100644
--- a/drivers/gpu/drm/tegra/plane.c
+++ b/drivers/gpu/drm/tegra/plane.c
@@ -297,6 +297,10 @@ int tegra_plane_format_get_alpha(unsigned int opaque, unsigned int *alpha)
        case WIN_COLOR_DEPTH_B8G8R8X8:
                *alpha = WIN_COLOR_DEPTH_B8G8R8A8;
                return 0;
+        case WIN_COLOR_DEPTH_B5G6R5:
+                *alpha = opaque;
+                return 0;
        }
        return -EINVAL;
@@ -330,9 +334,6 @@ void tegra_plane_check_dependent(struct tegra_plane *tegra,
        unsigned int zpos[2];
        unsigned int i;
-        for (i = 0; i < 3; i++)
-                state->dependent[i] = false;
        for (i = 0; i < 2; i++)
                zpos[i] = 0;
@@ -346,6 +347,8 @@ void tegra_plane_check_dependent(struct tegra_plane *tegra,
                index = tegra_plane_get_overlap_index(tegra, p);
+                state->dependent[index] = false;
                /*
                 * If any of the other planes is on top of this plane and uses
                 * a format with an alpha component, mark this plane as being
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index b5b335c9b2bb..2ebdc6d5a76e 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
        unsigned long start = vma->vm_start;
        unsigned long size = vma->vm_end - vma->vm_start;
-        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+        unsigned long offset;
        unsigned long page, pos;
-        if (offset + size > info->fix.smem_len)
+        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+                return -EINVAL;
+        offset = vma->vm_pgoff << PAGE_SHIFT;
+        if (offset > info->fix.smem_len || size > info->fix.smem_len - offset)
                return -EINVAL;
        pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 184340d486c3..86d25f18aa99 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1337,6 +1337,19 @@ static void __vmw_svga_disable(struct vmw_private *dev_priv)
 */
 void vmw_svga_disable(struct vmw_private *dev_priv)
 {
+        /*
+         * Disabling SVGA will turn off device modesetting capabilities, so
+         * notify KMS about that so that it doesn't cache atomic state that
+         * isn't valid anymore, for example crtcs turned on.
+         * Strictly we'd want to do this under the SVGA lock (or an SVGA mutex),
+         * but vmw_kms_lost_device() takes the reservation sem and thus we'll
+         * end up with lock order reversal. Thus, a master may actually perform
+         * a new modeset just after we call vmw_kms_lost_device() and race with
+         * vmw_svga_disable(), but that should at worst cause atomic KMS state
+         * to be inconsistent with the device, causing modesetting problems.
+         *
+         */
+        vmw_kms_lost_device(dev_priv->dev);
        ttm_write_lock(&dev_priv->reservation_sem, false);
        spin_lock(&dev_priv->svga_lock);
        if (dev_priv->bdev.man[TTM_PL_VRAM].use_type) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index d08753e8fd94..9116fe8baebc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -938,6 +938,7 @@ int vmw_kms_present(struct vmw_private *dev_priv,
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv);
+void vmw_kms_lost_device(struct drm_device *dev);
 int vmw_dumb_create(struct drm_file *file_priv,
                    struct drm_device *dev,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ead61015cd79..3c824fd7cbf3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -31,7 +31,6 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_rect.h>
 /* Might need a hrtimer here? */
 #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1)
@@ -2517,9 +2516,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
 * Helper to be used if an error forces the caller to undo the actions of
 * vmw_kms_helper_resource_prepare.
 */
-void vmw_kms_helper_resource_revert(struct vmw_resource *res)
+void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx)
 {
-        vmw_kms_helper_buffer_revert(res->backup);
+        struct vmw_resource *res = ctx->res;
+        vmw_kms_helper_buffer_revert(ctx->buf);
+        vmw_dmabuf_unreference(&ctx->buf);
        vmw_resource_unreserve(res, false, NULL, 0);
        mutex_unlock(&res->dev_priv->cmdbuf_mutex);
 }
@@ -2536,10 +2538,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res)
 * interrupted by a signal.
 */
 int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
-                                    bool interruptible)
+                                    bool interruptible,
+                                    struct vmw_validation_ctx *ctx)
 {
        int ret = 0;
+        ctx->buf = NULL;
+        ctx->res = res;
        if (interruptible)
                ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex);
        else
@@ -2558,6 +2564,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
                                                    res->dev_priv->has_mob);
                if (ret)
                        goto out_unreserve;
+                ctx->buf = vmw_dmabuf_reference(res->backup);
        }
        ret = vmw_resource_validate(res);
        if (ret)
@@ -2565,7 +2573,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
        return 0;
 out_revert:
-        vmw_kms_helper_buffer_revert(res->backup);
+        vmw_kms_helper_buffer_revert(ctx->buf);
 out_unreserve:
        vmw_resource_unreserve(res, false, NULL, 0);
 out_unlock:
@@ -2581,11 +2589,13 @@ out_unlock:
 * @out_fence: Optional pointer to a fence pointer. If non-NULL, a
 * ref-counted fence pointer is returned here.
 */
-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
+void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
-                             struct vmw_fence_obj **out_fence)
+                                    struct vmw_fence_obj **out_fence)
 {
-        if (res->backup || out_fence)
+        struct vmw_resource *res = ctx->res;
-                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup,
+        if (ctx->buf || out_fence)
+                vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf,
                                             out_fence, NULL);
        vmw_resource_unreserve(res, false, NULL, 0);
@@ -2851,3 +2861,14 @@ int vmw_kms_set_config(struct drm_mode_set *set,
        return drm_atomic_helper_set_config(set, ctx);
 }
+/**
+ * vmw_kms_lost_device - Notify kms that modesetting capabilities will be lost
+ *
+ * @dev: Pointer to the drm device
+ */
+void vmw_kms_lost_device(struct drm_device *dev)
+{
+        drm_atomic_helper_shutdown(dev);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index cd9da2dd79af..3d2ca280eaa7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -240,6 +240,11 @@ struct vmw_display_unit {
        int set_gui_y;
 };
+struct vmw_validation_ctx {
+        struct vmw_resource *res;
+        struct vmw_dma_buffer *buf;
+};
 #define vmw_crtc_to_du(x) \
        container_of(x, struct vmw_display_unit, crtc)
 #define vmw_connector_to_du(x) \
@@ -296,9 +301,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
                                  struct drm_vmw_fence_rep __user *
                                  user_fence_rep);
 int vmw_kms_helper_resource_prepare(struct vmw_resource *res,
-                                    bool interruptible);
+                                    bool interruptible,
-void vmw_kms_helper_resource_revert(struct vmw_resource *res);
+                                    struct vmw_validation_ctx *ctx);
-void vmw_kms_helper_resource_finish(struct vmw_resource *res,
+void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx);
+void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx,
                                    struct vmw_fence_obj **out_fence);
 int vmw_kms_readback(struct vmw_private *dev_priv,
                     struct drm_file *file_priv,
@@ -439,5 +445,4 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
 int vmw_kms_set_config(struct drm_mode_set *set,
                       struct drm_modeset_acquire_ctx *ctx);
 #endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 63a4cd794b73..3ec9eae831b8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -909,12 +909,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
        struct vmw_framebuffer_surface *vfbs =
                container_of(framebuffer, typeof(*vfbs), base);
        struct vmw_kms_sou_surface_dirty sdirty;
+        struct vmw_validation_ctx ctx;
        int ret;
        if (!srf)
                srf = &vfbs->surface->res;
-        ret = vmw_kms_helper_resource_prepare(srf, true);
+        ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
        if (ret)
                return ret;
@@ -933,7 +934,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv,
        ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips,
                                   dest_x, dest_y, num_clips, inc,
                                   &sdirty.base);
-        vmw_kms_helper_resource_finish(srf, out_fence);
+        vmw_kms_helper_resource_finish(&ctx, out_fence);
        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index b68d74888ab1..6b969e5dea2a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -980,12 +980,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
        struct vmw_framebuffer_surface *vfbs =
                container_of(framebuffer, typeof(*vfbs), base);
        struct vmw_stdu_dirty sdirty;
+        struct vmw_validation_ctx ctx;
        int ret;
        if (!srf)
                srf = &vfbs->surface->res;
-        ret = vmw_kms_helper_resource_prepare(srf, true);
+        ret = vmw_kms_helper_resource_prepare(srf, true, &ctx);
        if (ret)
                return ret;
@@ -1008,7 +1009,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv,
                                   dest_x, dest_y, num_clips, inc,
                                   &sdirty.base);
 out_finish:
-        vmw_kms_helper_resource_finish(srf, out_fence);
+        vmw_kms_helper_resource_finish(&ctx, out_fence);
        return ret;
 }
diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c
index 97b99500153d..83f9dd934a5d 100644
--- a/drivers/gpu/ipu-v3/ipu-prg.c
+++ b/drivers/gpu/ipu-v3/ipu-prg.c
@@ -250,10 +250,14 @@ void ipu_prg_channel_disable(struct ipuv3_channel *ipu_chan)
 {
        int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num);
        struct ipu_prg *prg = ipu_chan->ipu->prg_priv;
-        struct ipu_prg_channel *chan = &prg->chan[prg_chan];
+        struct ipu_prg_channel *chan;
        u32 val;
-        if (!chan->enabled || prg_chan < 0)
+        if (prg_chan < 0)
+                return;
+        chan = &prg->chan[prg_chan];
+        if (!chan->enabled)
                return;
        pm_runtime_get_sync(prg->dev);
@@ -280,13 +284,15 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan,
 {
        int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num);
        struct ipu_prg *prg = ipu_chan->ipu->prg_priv;
-        struct ipu_prg_channel *chan = &prg->chan[prg_chan];
+        struct ipu_prg_channel *chan;
        u32 val;
        int ret;
        if (prg_chan < 0)
                return prg_chan;
+        chan = &prg->chan[prg_chan];
        if (chan->enabled) {
                ipu_pre_update(prg->pres[chan->used_pre], *eba);
                return 0;
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index a5b4cf030c11..9183d148d644 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -550,18 +550,13 @@ static int addr_resolve(struct sockaddr *src_in,
                dst_release(dst);
        }
-        if (ndev->flags & IFF_LOOPBACK) {
+        if (ndev) {
-                ret = rdma_translate_ip(dst_in, addr);
+                if (ndev->flags & IFF_LOOPBACK)
-                /*
+                        ret = rdma_translate_ip(dst_in, addr);
-                 * Put the loopback device and get the translated
+                else
-                 * device instead.
+                        addr->bound_dev_if = ndev->ifindex;
-                 */
                dev_put(ndev);
-                ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
-        } else {
-                addr->bound_dev_if = ndev->ifindex;
        }
-        dev_put(ndev);
        return ret;
 }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 915bbd867b61..66f203730e80 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3069,7 +3069,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list,
                        continue;
                /* different dest port -> unique */
-                if (!cma_any_port(cur_daddr) &&
+                if (!cma_any_port(daddr) &&
+                    !cma_any_port(cur_daddr) &&
                    (dport != cur_dport))
                        continue;
@@ -3080,7 +3081,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list,
                        continue;
                /* different dst address -> unique */
-                if (!cma_any_addr(cur_daddr) &&
+                if (!cma_any_addr(daddr) &&
+                    !cma_any_addr(cur_daddr) &&
                    cma_addr_cmp(daddr, cur_daddr))
                        continue;
@@ -3378,13 +3380,13 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
                }
 #endif
        }
+        daddr = cma_dst_addr(id_priv);
+        daddr->sa_family = addr->sa_family;
        ret = cma_get_port(id_priv);
        if (ret)
                goto err2;
-        daddr = cma_dst_addr(id_priv);
-        daddr->sa_family = addr->sa_family;
        return 0;
 err2:
        if (id_priv->cma_dev)
@@ -4173,6 +4175,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr,
        struct cma_multicast *mc;
        int ret;
+        if (!id->device)
+                return -EINVAL;
        id_priv = container_of(id, struct rdma_id_private, id);
        if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) &&
            !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED))
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index bc79ca8215d7..af5ad6a56ae4 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -17,6 +17,7 @@
 /* # of WCs to poll for with a single call to ib_poll_cq */
 #define IB_POLL_BATCH                   16
+#define IB_POLL_BATCH_DIRECT            8
 /* # of WCs to iterate over before yielding */
 #define IB_POLL_BUDGET_IRQ              256
@@ -25,18 +26,18 @@
 #define IB_POLL_FLAGS \
        (IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS)
-static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
+static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs,
+                           int batch)
 {
        int i, n, completed = 0;
-        struct ib_wc *wcs = poll_wc ? : cq->wc;
        /*
         * budget might be (-1) if the caller does not
         * want to bound this call, thus we need unsigned
         * minimum here.
         */
-        while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
+        while ((n = ib_poll_cq(cq, min_t(u32, batch,
-                        budget - completed), wcs)) > 0) {
+                                         budget - completed), wcs)) > 0) {
                for (i = 0; i < n; i++) {
                        struct ib_wc *wc = &wcs[i];
@@ -48,8 +49,7 @@ static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
                completed += n;
-                if (n != IB_POLL_BATCH ||
+                if (n != batch || (budget != -1 && completed >= budget))
-                    (budget != -1 && completed >= budget))
                        break;
        }
@@ -72,9 +72,9 @@ static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *poll_wc)
 */
 int ib_process_cq_direct(struct ib_cq *cq, int budget)
 {
-        struct ib_wc wcs[IB_POLL_BATCH];
+        struct ib_wc wcs[IB_POLL_BATCH_DIRECT];
-        return __ib_process_cq(cq, budget, wcs);
+        return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT);
 }
 EXPORT_SYMBOL(ib_process_cq_direct);
@@ -88,7 +88,7 @@ static int ib_poll_handler(struct irq_poll *iop, int budget)
        struct ib_cq *cq = container_of(iop, struct ib_cq, iop);
        int completed;
-        completed = __ib_process_cq(cq, budget, NULL);
+        completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH);
        if (completed < budget) {
                irq_poll_complete(&cq->iop);
                if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
@@ -108,7 +108,8 @@ static void ib_cq_poll_work(struct work_struct *work)
        struct ib_cq *cq = container_of(work, struct ib_cq, work);
        int completed;
-        completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, NULL);
+        completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc,
+                                    IB_POLL_BATCH);
        if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
            ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
                queue_work(ib_comp_wq, &cq->work);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index e8010e73a1cf..bb065c9449be 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -536,14 +536,14 @@ int ib_register_device(struct ib_device *device,
        ret = device->query_device(device, &device->attrs, &uhw);
        if (ret) {
                pr_warn("Couldn't query the device attributes\n");
-                goto cache_cleanup;
+                goto cg_cleanup;
        }
        ret = ib_device_register_sysfs(device, port_callback);
        if (ret) {
                pr_warn("Couldn't register device %s with driver model\n",
                        device->name);
-                goto cache_cleanup;
+                goto cg_cleanup;
        }
        device->reg_state = IB_DEV_REGISTERED;
@@ -559,6 +559,8 @@ int ib_register_device(struct ib_device *device,
        mutex_unlock(&device_mutex);
        return 0;
+cg_cleanup:
+        ib_device_unregister_rdmacg(device);
 cache_cleanup:
        ib_cache_cleanup_one(device);
        ib_cache_release_one(device);
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 8cf15d4a8ac4..9f029a1ca5ea 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1291,10 +1291,9 @@ int ib_init_ah_attr_from_path(struct ib_device *device, u8 port_num,
                resolved_dev = dev_get_by_index(dev_addr.net,
                                                dev_addr.bound_dev_if);
-                if (resolved_dev->flags & IFF_LOOPBACK) {
+                if (!resolved_dev) {
-                        dev_put(resolved_dev);
+                        dev_put(idev);
-                        resolved_dev = idev;
+                        return -ENODEV;
-                        dev_hold(resolved_dev);
                }
                ndev = ib_get_ndev_from_path(rec);
                rcu_read_lock();
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index f015f1bf88c9..e5a1e7d81326 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id,
        ctx = idr_find(&ctx_idr, id);
        if (!ctx)
                ctx = ERR_PTR(-ENOENT);
-        else if (ctx->file != file)
+        else if (ctx->file != file || !ctx->cm_id)
                ctx = ERR_PTR(-EINVAL);
        return ctx;
 }
@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
        struct rdma_ucm_create_id cmd;
        struct rdma_ucm_create_id_resp resp;
        struct ucma_context *ctx;
+        struct rdma_cm_id *cm_id;
        enum ib_qp_type qp_type;
        int ret;
@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                return -ENOMEM;
        ctx->uid = cmd.uid;
-        ctx->cm_id = rdma_create_id(current->nsproxy->net_ns,
+        cm_id = rdma_create_id(current->nsproxy->net_ns,
-                                    ucma_event_handler, ctx, cmd.ps, qp_type);
+                               ucma_event_handler, ctx, cmd.ps, qp_type);
-        if (IS_ERR(ctx->cm_id)) {
+        if (IS_ERR(cm_id)) {
-                ret = PTR_ERR(ctx->cm_id);
+                ret = PTR_ERR(cm_id);
                goto err1;
        }
@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                ret = -EFAULT;
                goto err2;
        }
+        ctx->cm_id = cm_id;
        return 0;
 err2:
-        rdma_destroy_id(ctx->cm_id);
+        rdma_destroy_id(cm_id);
 err1:
        mutex_lock(&mut);
        idr_remove(&ctx_idr, ctx->id);
        mutex_unlock(&mut);
+        mutex_lock(&file->mut);
+        list_del(&ctx->list);
+        mutex_unlock(&file->mut);
        kfree(ctx);
        return ret;
 }
@@ -664,19 +670,23 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                               int in_len, int out_len)
 {
        struct rdma_ucm_resolve_ip cmd;
+        struct sockaddr *src, *dst;
        struct ucma_context *ctx;
        int ret;
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
+        src = (struct sockaddr *) &cmd.src_addr;
+        dst = (struct sockaddr *) &cmd.dst_addr;
+        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+                return -EINVAL;
        ctx = ucma_get_ctx(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
-        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
-                                (struct sockaddr *) &cmd.dst_addr,
-                                cmd.timeout_ms);
        ucma_put_ctx(ctx);
        return ret;
 }
@@ -1149,6 +1159,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
+        if (cmd.qp_state > IB_QPS_ERR)
+                return -EINVAL;
        ctx = ucma_get_ctx(file, cmd.id);
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
@@ -1294,6 +1307,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
        if (IS_ERR(ctx))
                return PTR_ERR(ctx);
+        if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+                return -EINVAL;
        optval = memdup_user((void __user *) (unsigned long) cmd.optval,
                             cmd.optlen);
        if (IS_ERR(optval)) {
@@ -1343,7 +1359,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
                return -ENOSPC;
        addr = (struct sockaddr *) &cmd->addr;
-        if (!cmd->addr_size || (cmd->addr_size != rdma_addr_size(addr)))
+        if (cmd->addr_size != rdma_addr_size(addr))
                return -EINVAL;
        if (cmd->join_flags == RDMA_MC_JOIN_FLAG_FULLMEMBER)
@@ -1411,6 +1427,9 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
        join_cmd.uid = cmd.uid;
        join_cmd.id = cmd.id;
        join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        if (!join_cmd.addr_size)
+                return -EINVAL;
        join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER;
        memcpy(&join_cmd.addr, &cmd.addr, join_cmd.addr_size);
@@ -1426,6 +1445,9 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                return -EFAULT;
+        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+                return -EINVAL;
        return ucma_process_join(file, &cmd, out_len);
 }
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index 3eb7a8387116..96f76896488d 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -57,8 +57,8 @@
 #define BNXT_RE_PAGE_SIZE_8M            BIT(BNXT_RE_PAGE_SHIFT_8M)
 #define BNXT_RE_PAGE_SIZE_1G            BIT(BNXT_RE_PAGE_SHIFT_1G)
-#define BNXT_RE_MAX_MR_SIZE_LOW         BIT(BNXT_RE_PAGE_SHIFT_1G)
+#define BNXT_RE_MAX_MR_SIZE_LOW         BIT_ULL(BNXT_RE_PAGE_SHIFT_1G)
-#define BNXT_RE_MAX_MR_SIZE_HIGH        BIT(39)
+#define BNXT_RE_MAX_MR_SIZE_HIGH        BIT_ULL(39)
 #define BNXT_RE_MAX_MR_SIZE             BNXT_RE_MAX_MR_SIZE_HIGH
 #define BNXT_RE_MAX_QPC_COUNT           (64 * 1024)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 643174d949a8..8301d7e5fa8c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -785,7 +785,7 @@ int bnxt_re_query_ah(struct ib_ah *ib_ah, struct rdma_ah_attr *ah_attr)
        return 0;
 }
-static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
+unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
        __acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
 {
        unsigned long flags;
@@ -799,8 +799,8 @@ static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
        return flags;
 }
-static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
+void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
-                               unsigned long flags)
+                        unsigned long flags)
        __releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
 {
        if (qp->rcq != qp->scq)
@@ -1606,6 +1606,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
        int status;
        union ib_gid sgid;
        struct ib_gid_attr sgid_attr;
+        unsigned int flags;
        u8 nw_type;
        qp->qplib_qp.modify_flags = 0;
@@ -1634,14 +1635,18 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                        dev_dbg(rdev_to_dev(rdev),
                                "Move QP = %p to flush list\n",
                                qp);
+                        flags = bnxt_re_lock_cqs(qp);
                        bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+                        bnxt_re_unlock_cqs(qp, flags);
                }
                if (!qp->sumem &&
                    qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_RESET) {
                        dev_dbg(rdev_to_dev(rdev),
                                "Move QP = %p out of flush list\n",
                                qp);
+                        flags = bnxt_re_lock_cqs(qp);
                        bnxt_qplib_clean_qp(&qp->qplib_qp);
+                        bnxt_re_unlock_cqs(qp, flags);
                }
        }
        if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
@@ -2227,10 +2232,13 @@ static int bnxt_re_build_inv_wqe(struct ib_send_wr *wr,
        wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV;
        wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey;
+        /* Need unconditional fence for local invalidate
+         * opcode to work as expected.
+         */
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
        if (wr->send_flags & IB_SEND_SIGNALED)
                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
-        if (wr->send_flags & IB_SEND_FENCE)
-                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
        if (wr->send_flags & IB_SEND_SOLICITED)
                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT;
@@ -2251,8 +2259,12 @@ static int bnxt_re_build_reg_wqe(struct ib_reg_wr *wr,
        wqe->frmr.levels = qplib_frpl->hwq.level + 1;
        wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR;
-        if (wr->wr.send_flags & IB_SEND_FENCE)
+        /* Need unconditional fence for reg_mr
-                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+         * opcode to function as expected.
+         */
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
        if (wr->wr.send_flags & IB_SEND_SIGNALED)
                wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
@@ -3586,7 +3598,7 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
        int umem_pgs, page_shift, rc;
        if (length > BNXT_RE_MAX_MR_SIZE) {
-                dev_err(rdev_to_dev(rdev), "MR Size: %lld > Max supported:%ld\n",
+                dev_err(rdev_to_dev(rdev), "MR Size: %lld > Max supported:%lld\n",
                        length, BNXT_RE_MAX_MR_SIZE);
                return ERR_PTR(-ENOMEM);
        }
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index b88a48d43a9d..e62b7c2c7da6 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -222,4 +222,7 @@ struct ib_ucontext *bnxt_re_alloc_ucontext(struct ib_device *ibdev,
                                           struct ib_udata *udata);
 int bnxt_re_dealloc_ucontext(struct ib_ucontext *context);
 int bnxt_re_mmap(struct ib_ucontext *context, struct vm_area_struct *vma);
+unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp);
+void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, unsigned long flags);
 #endif /* __BNXT_RE_IB_VERBS_H__ */
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 33a448036c2e..f6e361750466 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -730,6 +730,13 @@ static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event,
                                         struct bnxt_re_qp *qp)
 {
        struct ib_event event;
+        unsigned int flags;
+        if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) {
+                flags = bnxt_re_lock_cqs(qp);
+                bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+                bnxt_re_unlock_cqs(qp, flags);
+        }
        memset(&event, 0, sizeof(event));
        if (qp->qplib_qp.srq) {
@@ -1416,9 +1423,12 @@ static void bnxt_re_task(struct work_struct *work)
        switch (re_work->event) {
        case NETDEV_REGISTER:
                rc = bnxt_re_ib_reg(rdev);
-                if (rc)
+                if (rc) {
                        dev_err(rdev_to_dev(rdev),
                                "Failed to register with IB: %#x", rc);
+                        bnxt_re_remove_one(rdev);
+                        bnxt_re_dev_unreg(rdev);
+                }
                break;
        case NETDEV_UP:
                bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 3ea5b9624f6b..3a78faba8d91 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -88,75 +88,35 @@ static void __bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp)
        }
 }
-void bnxt_qplib_acquire_cq_locks(struct bnxt_qplib_qp *qp,
+static void bnxt_qplib_acquire_cq_flush_locks(struct bnxt_qplib_qp *qp,
-                                 unsigned long *flags)
+                                       unsigned long *flags)
-        __acquires(&qp->scq->hwq.lock) __acquires(&qp->rcq->hwq.lock)
+        __acquires(&qp->scq->flush_lock) __acquires(&qp->rcq->flush_lock)
 {
-        spin_lock_irqsave(&qp->scq->hwq.lock, *flags);
+        spin_lock_irqsave(&qp->scq->flush_lock, *flags);
        if (qp->scq == qp->rcq)
-                __acquire(&qp->rcq->hwq.lock);
+                __acquire(&qp->rcq->flush_lock);
        else
-                spin_lock(&qp->rcq->hwq.lock);
+                spin_lock(&qp->rcq->flush_lock);
 }
-void bnxt_qplib_release_cq_locks(struct bnxt_qplib_qp *qp,
+static void bnxt_qplib_release_cq_flush_locks(struct bnxt_qplib_qp *qp,
-                                 unsigned long *flags)
+                                       unsigned long *flags)
-        __releases(&qp->scq->hwq.lock) __releases(&qp->rcq->hwq.lock)
+        __releases(&qp->scq->flush_lock) __releases(&qp->rcq->flush_lock)
 {
        if (qp->scq == qp->rcq)
-                __release(&qp->rcq->hwq.lock);
+                __release(&qp->rcq->flush_lock);
        else
-                spin_unlock(&qp->rcq->hwq.lock);
+                spin_unlock(&qp->rcq->flush_lock);
-        spin_unlock_irqrestore(&qp->scq->hwq.lock, *flags);
+        spin_unlock_irqrestore(&qp->scq->flush_lock, *flags);
-}
-static struct bnxt_qplib_cq *bnxt_qplib_find_buddy_cq(struct bnxt_qplib_qp *qp,
-                                                      struct bnxt_qplib_cq *cq)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-        if (qp->scq == qp->rcq)
-                buddy_cq = NULL;
-        else if (qp->scq == cq)
-                buddy_cq = qp->rcq;
-        else
-                buddy_cq = qp->scq;
-        return buddy_cq;
-}
-static void bnxt_qplib_lock_buddy_cq(struct bnxt_qplib_qp *qp,
-                                     struct bnxt_qplib_cq *cq)
-        __acquires(&buddy_cq->hwq.lock)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-        buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-        if (!buddy_cq)
-                __acquire(&cq->hwq.lock);
-        else
-                spin_lock(&buddy_cq->hwq.lock);
-}
-static void bnxt_qplib_unlock_buddy_cq(struct bnxt_qplib_qp *qp,
-                                       struct bnxt_qplib_cq *cq)
-        __releases(&buddy_cq->hwq.lock)
-{
-        struct bnxt_qplib_cq *buddy_cq = NULL;
-        buddy_cq = bnxt_qplib_find_buddy_cq(qp, cq);
-        if (!buddy_cq)
-                __release(&cq->hwq.lock);
-        else
-                spin_unlock(&buddy_cq->hwq.lock);
 }
 void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp)
 {
        unsigned long flags;
-        bnxt_qplib_acquire_cq_locks(qp, &flags);
+        bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
        __bnxt_qplib_add_flush_qp(qp);
-        bnxt_qplib_release_cq_locks(qp, &flags);
+        bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 static void __bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
@@ -177,7 +137,7 @@ void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
 {
        unsigned long flags;
-        bnxt_qplib_acquire_cq_locks(qp, &flags);
+        bnxt_qplib_acquire_cq_flush_locks(qp, &flags);
        __clean_cq(qp->scq, (u64)(unsigned long)qp);
        qp->sq.hwq.prod = 0;
        qp->sq.hwq.cons = 0;
@@ -186,7 +146,7 @@ void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
        qp->rq.hwq.cons = 0;
        __bnxt_qplib_del_flush_qp(qp);
-        bnxt_qplib_release_cq_locks(qp, &flags);
+        bnxt_qplib_release_cq_flush_locks(qp, &flags);
 }
 static void bnxt_qpn_cqn_sched_task(struct work_struct *work)
@@ -283,7 +243,7 @@ static void bnxt_qplib_service_nq(unsigned long data)
        u32 sw_cons, raw_cons;
        u16 type;
        int budget = nq->budget;
-        u64 q_handle;
+        uintptr_t q_handle;
        /* Service the NQ until empty */
        raw_cons = hwq->cons;
@@ -566,7 +526,7 @@ int bnxt_qplib_create_srq(struct bnxt_qplib_res *res,
        /* Configure the request */
        req.dpi = cpu_to_le32(srq->dpi->dpi);
-        req.srq_handle = cpu_to_le64(srq);
+        req.srq_handle = cpu_to_le64((uintptr_t)srq);
        req.srq_size = cpu_to_le16((u16)srq->hwq.max_elements);
        pbl = &srq->hwq.pbl[PBL_LVL_0];
@@ -2107,9 +2067,6 @@ void bnxt_qplib_mark_qp_error(void *qp_handle)
        /* Must block new posting of SQ and RQ */
        qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
        bnxt_qplib_cancel_phantom_processing(qp);
-        /* Add qp to flush list of the CQ */
-        __bnxt_qplib_add_flush_qp(qp);
 }
 /* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
@@ -2285,9 +2242,9 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
                                sw_sq_cons, cqe->wr_id, cqe->status);
                        cqe++;
                        (*budget)--;
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
                        bnxt_qplib_mark_qp_error(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
+                        /* Add qp to flush list of the CQ */
+                        bnxt_qplib_add_flush_qp(qp);
                } else {
                        if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
                                /* Before we complete, do WA 9060 */
@@ -2403,9 +2360,7 @@ static int bnxt_qplib_cq_process_res_rc(struct bnxt_qplib_cq *cq,
                if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                        qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                        /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
                }
        }
@@ -2489,9 +2444,7 @@ static int bnxt_qplib_cq_process_res_ud(struct bnxt_qplib_cq *cq,
                if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                        qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                        /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
                }
        }
 done:
@@ -2501,11 +2454,9 @@ done:
 bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
 {
        struct cq_base *hw_cqe, **hw_cqe_ptr;
-        unsigned long flags;
        u32 sw_cons, raw_cons;
        bool rc = true;
-        spin_lock_irqsave(&cq->hwq.lock, flags);
        raw_cons = cq->hwq.cons;
        sw_cons = HWQ_CMP(raw_cons, &cq->hwq);
        hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
@@ -2513,7 +2464,6 @@ bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
         /* Check for Valid bit. If the CQE is valid, return false */
        rc = !CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements);
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
        return rc;
 }
@@ -2602,9 +2552,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct bnxt_qplib_cq *cq,
                if (hwcqe->status != CQ_RES_RC_STATUS_OK) {
                        qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
                        /* Add qp to flush list of the CQ */
-                        bnxt_qplib_lock_buddy_cq(qp, cq);
+                        bnxt_qplib_add_flush_qp(qp);
-                        __bnxt_qplib_add_flush_qp(qp);
-                        bnxt_qplib_unlock_buddy_cq(qp, cq);
                }
        }
@@ -2719,9 +2667,7 @@ do_rq:
         */
        /* Add qp to flush list of the CQ */
-        bnxt_qplib_lock_buddy_cq(qp, cq);
+        bnxt_qplib_add_flush_qp(qp);
-        __bnxt_qplib_add_flush_qp(qp);
-        bnxt_qplib_unlock_buddy_cq(qp, cq);
 done:
        return rc;
 }
@@ -2750,7 +2696,7 @@ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq,
        u32 budget = num_cqes;
        unsigned long flags;
-        spin_lock_irqsave(&cq->hwq.lock, flags);
+        spin_lock_irqsave(&cq->flush_lock, flags);
        list_for_each_entry(qp, &cq->sqf_head, sq_flush) {
                dev_dbg(&cq->hwq.pdev->dev,
                        "QPLIB: FP: Flushing SQ QP= %p",
@@ -2764,7 +2710,7 @@ int bnxt_qplib_process_flush_list(struct bnxt_qplib_cq *cq,
                        qp);
                __flush_rq(&qp->rq, qp, &cqe, &budget);
        }
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
+        spin_unlock_irqrestore(&cq->flush_lock, flags);
        return num_cqes - budget;
 }
@@ -2773,11 +2719,9 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                       int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
        struct cq_base *hw_cqe, **hw_cqe_ptr;
-        unsigned long flags;
        u32 sw_cons, raw_cons;
        int budget, rc = 0;
-        spin_lock_irqsave(&cq->hwq.lock, flags);
        raw_cons = cq->hwq.cons;
        budget = num_cqes;
@@ -2853,20 +2797,15 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ);
        }
 exit:
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
        return num_cqes - budget;
 }
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&cq->hwq.lock, flags);
        if (arm_type)
                bnxt_qplib_arm_cq(cq, arm_type);
        /* Using cq->arm_state variable to track whether to issue cq handler */
        atomic_set(&cq->arm_state, 1);
-        spin_unlock_irqrestore(&cq->hwq.lock, flags);
 }
 void bnxt_qplib_flush_cqn_wq(struct bnxt_qplib_qp *qp)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index ca0a2ffa3509..ade9f13c0fd1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -389,6 +389,18 @@ struct bnxt_qplib_cq {
        struct list_head                sqf_head, rqf_head;
        atomic_t                        arm_state;
        spinlock_t                      compl_lock; /* synch CQ handlers */
+/* Locking Notes:
+ * QP can move to error state from modify_qp, async error event or error
+ * CQE as part of poll_cq. When QP is moved to error state, it gets added
+ * to two flush lists, one each for SQ and RQ.
+ * Each flush list is protected by qplib_cq->flush_lock. Both scq and rcq
+ * flush_locks should be acquired when QP is moved to error. The control path
+ * operations(modify_qp and async error events) are synchronized with poll_cq
+ * using upper level CQ locks (bnxt_re_cq->cq_lock) of both SCQ and RCQ.
+ * The qplib_cq->flush_lock is required to synchronize two instances of poll_cq
+ * of the same QP while manipulating the flush list.
+ */
+        spinlock_t                      flush_lock; /* QP flush management */
 };
 #define BNXT_QPLIB_MAX_IRRQE_ENTRY_SIZE sizeof(struct xrrq_irrq)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 8329ec6a7946..80027a494730 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -305,9 +305,8 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
                        err_event->res_err_state_reason);
                if (!qp)
                        break;
-                bnxt_qplib_acquire_cq_locks(qp, &flags);
                bnxt_qplib_mark_qp_error(qp);
-                bnxt_qplib_release_cq_locks(qp, &flags);
+                rcfw->aeq_handler(rcfw, qp_event, qp);
                break;
        default:
                /* Command Response */
@@ -460,7 +459,11 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
        int rc;
        RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
+        /* Supply (log-base-2-of-host-page-size - base-page-shift)
+         * to bono to adjust the doorbell page sizes.
+         */
+        req.log2_dbr_pg_size = cpu_to_le16(PAGE_SHIFT -
+                                           RCFW_DBR_BASE_PAGE_SHIFT);
        /*
         * VFs need not setup the HW context area, PF
         * shall setup this area for VF. Skipping the
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 6bee6e3636ea..c7cce2e4185e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -49,6 +49,7 @@
 #define RCFW_COMM_SIZE                  0x104
 #define RCFW_DBR_PCI_BAR_REGION         2
+#define RCFW_DBR_BASE_PAGE_SHIFT        12
 #define RCFW_CMD_PREP(req, CMD, cmd_flags)                              \
        do {                                                            \
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 03057983341f..ee98e5efef84 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -139,7 +139,8 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
        attr->max_pkey = le32_to_cpu(sb->max_pkeys);
        attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
-        attr->l2_db_size = (sb->l2_db_space_size + 1) * PAGE_SIZE;
+        attr->l2_db_size = (sb->l2_db_space_size + 1) *
+                            (0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
        attr->max_sgid = le32_to_cpu(sb->max_gid);
        bnxt_qplib_query_version(rcfw, attr->fw_ver);
diff --git a/drivers/infiniband/hw/bnxt_re/roce_hsi.h b/drivers/infiniband/hw/bnxt_re/roce_hsi.h
index 2d7ea096a247..3e5a4f760d0e 100644
--- a/drivers/infiniband/hw/bnxt_re/roce_hsi.h
+++ b/drivers/infiniband/hw/bnxt_re/roce_hsi.h
@@ -1761,7 +1761,30 @@ struct cmdq_initialize_fw {
        #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_2M               (0x3UL << 4)
        #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_8M               (0x4UL << 4)
        #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_1G               (0x5UL << 4)
-        __le16 reserved16;
+        /* This value is (log-base-2-of-DBR-page-size - 12).
+         * 0 for 4KB. HW supported values are enumerated below.
+         */
+        __le16  log2_dbr_pg_size;
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_MASK        0xfUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_SFT         0
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4K       0x0UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8K       0x1UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16K      0x2UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32K      0x3UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64K      0x4UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128K     0x5UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_256K     0x6UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_512K     0x7UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_1M       0x8UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_2M       0x9UL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4M       0xaUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8M       0xbUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16M      0xcUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32M      0xdUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64M      0xeUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M     0xfUL
+        #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_LAST                \
+                        CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M
        __le64 qpc_page_dir;
        __le64 mrw_page_dir;
        __le64 srq_page_dir;
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 9a566ee3ceff..82adc0d1d30e 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -601,6 +601,7 @@ static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct
        wc->dlid_path_bits = 0;
        if (is_eth) {
+                wc->slid = 0;
                wc->vlan_id = be16_to_cpu(hdr->tun.sl_vid);
                memcpy(&(wc->smac[0]), (char *)&hdr->tun.mac_31_0, 4);
                memcpy(&(wc->smac[4]), (char *)&hdr->tun.slid_mac_47_32, 2);
@@ -851,7 +852,6 @@ repoll:
                        }
                }
-                wc->slid           = be16_to_cpu(cqe->rlid);
                g_mlpath_rqpn      = be32_to_cpu(cqe->g_mlpath_rqpn);
                wc->src_qp         = g_mlpath_rqpn & 0xffffff;
                wc->dlid_path_bits = (g_mlpath_rqpn >> 24) & 0x7f;
@@ -860,6 +860,7 @@ repoll:
                wc->wc_flags      |= mlx4_ib_ipoib_csum_ok(cqe->status,
                                        cqe->checksum) ? IB_WC_IP_CSUM_OK : 0;
                if (is_eth) {
+                        wc->slid = 0;
                        wc->sl  = be16_to_cpu(cqe->sl_vid) >> 13;
                        if (be32_to_cpu(cqe->vlan_my_qpn) &
                                        MLX4_CQE_CVLAN_PRESENT_MASK) {
@@ -871,6 +872,7 @@ repoll:
                        memcpy(wc->smac, cqe->smac, ETH_ALEN);
                        wc->wc_flags |= (IB_WC_WITH_VLAN | IB_WC_WITH_SMAC);
                } else {
+                        wc->slid = be16_to_cpu(cqe->rlid);
                        wc->sl  = be16_to_cpu(cqe->sl_vid) >> 12;
                        wc->vlan_id = 0xffff;
                }
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 8d2ee9322f2e..5a0e4fc4785a 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -219,8 +219,6 @@ static int mlx4_ib_update_gids_v1_v2(struct gid_entry *gids,
                        gid_tbl[i].version = 2;
                        if (!ipv6_addr_v4mapped((struct in6_addr *)&gids[i].gid))
                                gid_tbl[i].type = 1;
-                        else
-                                memset(&gid_tbl[i].gid, 0, 12);
                }
        }
@@ -366,8 +364,13 @@ static int mlx4_ib_del_gid(struct ib_device *device,
                if (!gids) {
                        ret = -ENOMEM;
                } else {
-                        for (i = 0; i < MLX4_MAX_PORT_GIDS; i++)
+                        for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) {
-                                memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid));
+                                memcpy(&gids[i].gid,
+                                       &port_gid_table->gids[i].gid,
+                                       sizeof(union ib_gid));
+                                gids[i].gid_type =
+                                    port_gid_table->gids[i].gid_type;
+                        }
                }
        }
        spin_unlock_bh(&iboe->lock);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index c4c7b82f4ac1..94a27d89a303 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -221,7 +221,6 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
                wc->ex.invalidate_rkey = be32_to_cpu(cqe->imm_inval_pkey);
                break;
        }
-        wc->slid           = be16_to_cpu(cqe->slid);
        wc->src_qp         = be32_to_cpu(cqe->flags_rqpn) & 0xffffff;
        wc->dlid_path_bits = cqe->ml_path;
        g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3;
@@ -236,10 +235,12 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
        }
        if (ll != IB_LINK_LAYER_ETHERNET) {
+                wc->slid = be16_to_cpu(cqe->slid);
                wc->sl = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0xf;
                return;
        }
+        wc->slid = 0;
        vlan_present = cqe->l4_l3_hdr_type & 0x1;
        roce_packet_type   = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0x3;
        if (vlan_present) {
@@ -1188,7 +1189,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq,
        if (ucmd.reserved0 || ucmd.reserved1)
                return -EINVAL;
-        umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size,
+        /* check multiplication overflow */
+        if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
+                return -EINVAL;
+        umem = ib_umem_get(context, ucmd.buf_addr,
+                           (size_t)ucmd.cqe_size * entries,
                           IB_ACCESS_LOCAL_WRITE, 1);
        if (IS_ERR(umem)) {
                err = PTR_ERR(umem);
diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
index 61cc3d7db257..0e04fdddf670 100644
--- a/drivers/infiniband/hw/mlx5/ib_rep.c
+++ b/drivers/infiniband/hw/mlx5/ib_rep.c
@@ -30,12 +30,15 @@ static const struct mlx5_ib_profile rep_profile = {
        STAGE_CREATE(MLX5_IB_STAGE_BFREG,
                     mlx5_ib_stage_bfrag_init,
                     mlx5_ib_stage_bfrag_cleanup),
+        STAGE_CREATE(MLX5_IB_STAGE_PRE_IB_REG_UMR,
+                     NULL,
+                     mlx5_ib_stage_pre_ib_reg_umr_cleanup),
        STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
                     mlx5_ib_stage_ib_reg_init,
                     mlx5_ib_stage_ib_reg_cleanup),
-        STAGE_CREATE(MLX5_IB_STAGE_UMR_RESOURCES,
+        STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
-                     mlx5_ib_stage_umr_res_init,
+                     mlx5_ib_stage_post_ib_reg_umr_init,
-                     mlx5_ib_stage_umr_res_cleanup),
+                     NULL),
        STAGE_CREATE(MLX5_IB_STAGE_CLASS_ATTR,
                     mlx5_ib_stage_class_attr_init,
                     NULL),
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d9474b95d8e5..390e4375647e 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -256,12 +256,16 @@ struct mlx5_core_dev *mlx5_ib_get_native_port_mdev(struct mlx5_ib_dev *ibdev,
        struct mlx5_ib_multiport_info *mpi;
        struct mlx5_ib_port *port;
+        if (!mlx5_core_mp_enabled(ibdev->mdev) ||
+            ll != IB_LINK_LAYER_ETHERNET) {
+                if (native_port_num)
+                        *native_port_num = ib_port_num;
+                return ibdev->mdev;
+        }
        if (native_port_num)
                *native_port_num = 1;
-        if (!mlx5_core_mp_enabled(ibdev->mdev) || ll != IB_LINK_LAYER_ETHERNET)
-                return ibdev->mdev;
        port = &ibdev->port[ib_port_num - 1];
        if (!port)
                return NULL;
@@ -3297,7 +3301,7 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
        struct mlx5_ib_dev *ibdev;
        struct ib_event ibev;
        bool fatal = false;
-        u8 port = 0;
+        u8 port = (u8)work->param;
        if (mlx5_core_is_mp_slave(work->dev)) {
                ibdev = mlx5_ib_get_ibdev_from_mpi(work->context);
@@ -3317,8 +3321,6 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
        case MLX5_DEV_EVENT_PORT_UP:
        case MLX5_DEV_EVENT_PORT_DOWN:
        case MLX5_DEV_EVENT_PORT_INITIALIZED:
-                port = (u8)work->param;
                /* In RoCE, port up/down events are handled in
                 * mlx5_netdev_event().
                 */
@@ -3332,24 +3334,19 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
        case MLX5_DEV_EVENT_LID_CHANGE:
                ibev.event = IB_EVENT_LID_CHANGE;
-                port = (u8)work->param;
                break;
        case MLX5_DEV_EVENT_PKEY_CHANGE:
                ibev.event = IB_EVENT_PKEY_CHANGE;
-                port = (u8)work->param;
                schedule_work(&ibdev->devr.ports[port - 1].pkey_change_work);
                break;
        case MLX5_DEV_EVENT_GUID_CHANGE:
                ibev.event = IB_EVENT_GID_CHANGE;
-                port = (u8)work->param;
                break;
        case MLX5_DEV_EVENT_CLIENT_REREG:
                ibev.event = IB_EVENT_CLIENT_REREGISTER;
-                port = (u8)work->param;
                break;
        case MLX5_DEV_EVENT_DELAY_DROP_TIMEOUT:
                schedule_work(&ibdev->delay_drop.delay_drop_work);
@@ -3361,7 +3358,7 @@ static void mlx5_ib_handle_event(struct work_struct *_work)
        ibev.device           = &ibdev->ib_dev;
        ibev.element.port_num = port;
-        if (port < 1 || port > ibdev->num_ports) {
+        if (!rdma_is_port_valid(&ibdev->ib_dev, port)) {
                mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
                goto out;
        }
@@ -4999,19 +4996,19 @@ int mlx5_ib_stage_ib_reg_init(struct mlx5_ib_dev *dev)
        return ib_register_device(&dev->ib_dev, NULL);
 }
-void mlx5_ib_stage_ib_reg_cleanup(struct mlx5_ib_dev *dev)
+void mlx5_ib_stage_pre_ib_reg_umr_cleanup(struct mlx5_ib_dev *dev)
 {
-        ib_unregister_device(&dev->ib_dev);
+        destroy_umrc_res(dev);
 }
-int mlx5_ib_stage_umr_res_init(struct mlx5_ib_dev *dev)
+void mlx5_ib_stage_ib_reg_cleanup(struct mlx5_ib_dev *dev)
 {
-        return create_umr_res(dev);
+        ib_unregister_device(&dev->ib_dev);
 }
-void mlx5_ib_stage_umr_res_cleanup(struct mlx5_ib_dev *dev)
+int mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev)
 {
-        destroy_umrc_res(dev);
+        return create_umr_res(dev);
 }
 static int mlx5_ib_stage_delay_drop_init(struct mlx5_ib_dev *dev)
@@ -5130,12 +5127,15 @@ static const struct mlx5_ib_profile pf_profile = {
        STAGE_CREATE(MLX5_IB_STAGE_BFREG,
                     mlx5_ib_stage_bfrag_init,
                     mlx5_ib_stage_bfrag_cleanup),
+        STAGE_CREATE(MLX5_IB_STAGE_PRE_IB_REG_UMR,
+                     NULL,
+                     mlx5_ib_stage_pre_ib_reg_umr_cleanup),
        STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
                     mlx5_ib_stage_ib_reg_init,
                     mlx5_ib_stage_ib_reg_cleanup),
-        STAGE_CREATE(MLX5_IB_STAGE_UMR_RESOURCES,
+        STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
-                     mlx5_ib_stage_umr_res_init,
+                     mlx5_ib_stage_post_ib_reg_umr_init,
-                     mlx5_ib_stage_umr_res_cleanup),
+                     NULL),
        STAGE_CREATE(MLX5_IB_STAGE_DELAY_DROP,
                     mlx5_ib_stage_delay_drop_init,
                     mlx5_ib_stage_delay_drop_cleanup),
@@ -5172,12 +5172,15 @@ static const struct mlx5_ib_profile nic_rep_profile = {
        STAGE_CREATE(MLX5_IB_STAGE_BFREG,
                     mlx5_ib_stage_bfrag_init,
                     mlx5_ib_stage_bfrag_cleanup),
+        STAGE_CREATE(MLX5_IB_STAGE_PRE_IB_REG_UMR,
+                     NULL,
+                     mlx5_ib_stage_pre_ib_reg_umr_cleanup),
        STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
                     mlx5_ib_stage_ib_reg_init,
                     mlx5_ib_stage_ib_reg_cleanup),
-        STAGE_CREATE(MLX5_IB_STAGE_UMR_RESOURCES,
+        STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
-                     mlx5_ib_stage_umr_res_init,
+                     mlx5_ib_stage_post_ib_reg_umr_init,
-                     mlx5_ib_stage_umr_res_cleanup),
+                     NULL),
        STAGE_CREATE(MLX5_IB_STAGE_CLASS_ATTR,
                     mlx5_ib_stage_class_attr_init,
                     NULL),
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index e0bad28e0f09..c33bf1523d67 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -742,8 +742,9 @@ enum mlx5_ib_stages {
        MLX5_IB_STAGE_CONG_DEBUGFS,
        MLX5_IB_STAGE_UAR,
        MLX5_IB_STAGE_BFREG,
+        MLX5_IB_STAGE_PRE_IB_REG_UMR,
        MLX5_IB_STAGE_IB_REG,
-        MLX5_IB_STAGE_UMR_RESOURCES,
+        MLX5_IB_STAGE_POST_IB_REG_UMR,
        MLX5_IB_STAGE_DELAY_DROP,
        MLX5_IB_STAGE_CLASS_ATTR,
        MLX5_IB_STAGE_REP_REG,
@@ -1068,10 +1069,10 @@ int mlx5_ib_stage_counters_init(struct mlx5_ib_dev *dev);
 void mlx5_ib_stage_counters_cleanup(struct mlx5_ib_dev *dev);
 int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev);
 void mlx5_ib_stage_bfrag_cleanup(struct mlx5_ib_dev *dev);
+void mlx5_ib_stage_pre_ib_reg_umr_cleanup(struct mlx5_ib_dev *dev);
 int mlx5_ib_stage_ib_reg_init(struct mlx5_ib_dev *dev);
 void mlx5_ib_stage_ib_reg_cleanup(struct mlx5_ib_dev *dev);
-int mlx5_ib_stage_umr_res_init(struct mlx5_ib_dev *dev);
+int mlx5_ib_stage_post_ib_reg_umr_init(struct mlx5_ib_dev *dev);
-void mlx5_ib_stage_umr_res_cleanup(struct mlx5_ib_dev *dev);
 int mlx5_ib_stage_class_attr_init(struct mlx5_ib_dev *dev);
 void __mlx5_ib_remove(struct mlx5_ib_dev *dev,
                      const struct mlx5_ib_profile *profile,
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index a5fad3e87ff7..95a36e9ea552 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -839,7 +839,8 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
        *umem = ib_umem_get(pd->uobject->context, start, length,
                            access_flags, 0);
        err = PTR_ERR_OR_ZERO(*umem);
-        if (err < 0) {
+        if (err) {
+                *umem = NULL;
                mlx5_ib_err(dev, "umem get failed (%d)\n", err);
                return err;
        }
@@ -1416,6 +1417,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                if (err) {
                        mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                        ib_umem_release(mr->umem);
+                        mr->umem = NULL;
                        clean_mr(dev, mr);
                        return err;
                }
@@ -1499,14 +1501,11 @@ static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                u32 key = mr->mmkey.key;
                err = destroy_mkey(dev, mr);
-                kfree(mr);
                if (err) {
                        mlx5_ib_warn(dev, "failed to destroy mkey 0x%x (%d)\n",
                                     key, err);
                        return err;
                }
-        } else {
-                mlx5_mr_cache_free(dev, mr);
        }
        return 0;
@@ -1549,6 +1548,11 @@ static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
                atomic_sub(npages, &dev->mdev->priv.reg_pages);
        }
+        if (!mr->allocated_from_cache)
+                kfree(mr);
+        else
+                mlx5_mr_cache_free(dev, mr);
        return 0;
 }
@@ -1817,7 +1821,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr,
        mr->ibmr.iova = sg_dma_address(sg) + sg_offset;
        mr->ibmr.length = 0;
-        mr->ndescs = sg_nents;
        for_each_sg(sgl, sg, sg_nents, i) {
                if (unlikely(i >= mr->max_descs))
@@ -1829,6 +1832,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr,
                sg_offset = 0;
        }
+        mr->ndescs = i;
        if (sg_offset_p)
                *sg_offset_p = sg_offset;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0e67e3682bca..85c612ac547a 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1177,7 +1177,7 @@ static void destroy_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
        ib_umem_release(sq->ubuffer.umem);
 }
-static int get_rq_pas_size(void *qpc)
+static size_t get_rq_pas_size(void *qpc)
 {
        u32 log_page_size = MLX5_GET(qpc, qpc, log_page_size) + 12;
        u32 log_rq_stride = MLX5_GET(qpc, qpc, log_rq_stride);
@@ -1193,7 +1193,8 @@ static int get_rq_pas_size(void *qpc)
 }
 static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
-                                   struct mlx5_ib_rq *rq, void *qpin)
+                                   struct mlx5_ib_rq *rq, void *qpin,
+                                   size_t qpinlen)
 {
        struct mlx5_ib_qp *mqp = rq->base.container_mibqp;
        __be64 *pas;
@@ -1202,9 +1203,12 @@ static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev,
        void *rqc;
        void *wq;
        void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc);
-        int inlen;
+        size_t rq_pas_size = get_rq_pas_size(qpc);
+        size_t inlen;
        int err;
-        u32 rq_pas_size = get_rq_pas_size(qpc);
+        if (qpinlen < rq_pas_size + MLX5_BYTE_OFF(create_qp_in, pas))
+                return -EINVAL;
        inlen = MLX5_ST_SZ_BYTES(create_rq_in) + rq_pas_size;
        in = kvzalloc(inlen, GFP_KERNEL);
@@ -1297,7 +1301,7 @@ static void destroy_raw_packet_qp_tir(struct mlx5_ib_dev *dev,
 }
 static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
-                                u32 *in,
+                                u32 *in, size_t inlen,
                                struct ib_pd *pd)
 {
        struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
@@ -1329,7 +1333,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                        rq->flags |= MLX5_IB_RQ_CVLAN_STRIPPING;
                if (qp->flags & MLX5_IB_QP_PCI_WRITE_END_PADDING)
                        rq->flags |= MLX5_IB_RQ_PCI_WRITE_END_PADDING;
-                err = create_raw_packet_qp_rq(dev, rq, in);
+                err = create_raw_packet_qp_rq(dev, rq, in, inlen);
                if (err)
                        goto err_destroy_sq;
@@ -1608,6 +1612,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
        u32 uidx = MLX5_IB_DEFAULT_UIDX;
        struct mlx5_ib_create_qp ucmd;
        struct mlx5_ib_qp_base *base;
+        int mlx5_st;
        void *qpc;
        u32 *in;
        int err;
@@ -1616,6 +1621,10 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
        spin_lock_init(&qp->sq.lock);
        spin_lock_init(&qp->rq.lock);
+        mlx5_st = to_mlx5_st(init_attr->qp_type);
+        if (mlx5_st < 0)
+                return -EINVAL;
        if (init_attr->rwq_ind_tbl) {
                if (!udata)
                        return -ENOSYS;
@@ -1777,7 +1786,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
        qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
-        MLX5_SET(qpc, qpc, st, to_mlx5_st(init_attr->qp_type));
+        MLX5_SET(qpc, qpc, st, mlx5_st);
        MLX5_SET(qpc, qpc, pm_state, MLX5_QP_PM_MIGRATED);
        if (init_attr->qp_type != MLX5_IB_QPT_REG_UMR)
@@ -1891,11 +1900,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                }
        }
+        if (inlen < 0) {
+                err = -EINVAL;
+                goto err;
+        }
        if (init_attr->qp_type == IB_QPT_RAW_PACKET ||
            qp->flags & MLX5_IB_QP_UNDERLAY) {
                qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd.sq_buf_addr;
                raw_packet_qp_copy_info(qp, &qp->raw_packet_qp);
-                err = create_raw_packet_qp(dev, qp, in, pd);
+                err = create_raw_packet_qp(dev, qp, in, inlen, pd);
        } else {
                err = mlx5_core_create_qp(dev->mdev, &base->mqp, in, inlen);
        }
@@ -3116,8 +3130,10 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
                goto out;
        if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE ||
-            !optab[mlx5_cur][mlx5_new])
+            !optab[mlx5_cur][mlx5_new]) {
+                err = -EINVAL;
                goto out;
+        }
        op = optab[mlx5_cur][mlx5_new];
        optpar = ib_mask_to_mlx5_opt(attr_mask);
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 6d5fadad9090..3c7522d025f2 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -241,8 +241,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 {
        struct mlx5_ib_dev *dev = to_mdev(pd->device);
        struct mlx5_ib_srq *srq;
-        int desc_size;
+        size_t desc_size;
-        int buf_size;
+        size_t buf_size;
        int err;
        struct mlx5_srq_attr in = {0};
        __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz);
@@ -266,15 +266,18 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
        desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
                    srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
+        if (desc_size == 0 || srq->msrq.max_gs > desc_size)
+                return ERR_PTR(-EINVAL);
        desc_size = roundup_pow_of_two(desc_size);
-        desc_size = max_t(int, 32, desc_size);
+        desc_size = max_t(size_t, 32, desc_size);
+        if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
+                return ERR_PTR(-EINVAL);
        srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
                sizeof(struct mlx5_wqe_data_seg);
        srq->msrq.wqe_shift = ilog2(desc_size);
        buf_size = srq->msrq.max * desc_size;
-        mlx5_ib_dbg(dev, "desc_size 0x%x, req wr 0x%x, srq size 0x%x, max_gs 0x%x, max_avail_gather 0x%x\n",
+        if (buf_size < desc_size)
-                    desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs,
+                return ERR_PTR(-EINVAL);
-                    srq->msrq.max_avail_gather);
        in.type = init_attr->srq_type;
        if (pd->uobject)
diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
index 478b7317b80a..26dc374787f7 100644
--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
@@ -458,8 +458,7 @@ qedr_addr6_resolve(struct qedr_dev *dev,
                }
                return -EINVAL;
        }
-        neigh = dst_neigh_lookup(dst, &dst_in);
+        neigh = dst_neigh_lookup(dst, &fl6.daddr);
        if (neigh) {
                rcu_read_lock();
                if (neigh->nud_state & NUD_VALID) {
@@ -494,10 +493,14 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        qp = idr_find(&dev->qpidr, conn_param->qpn);
-        laddr = (struct sockaddr_in *)&cm_id->local_addr;
+        laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
-        raddr = (struct sockaddr_in *)&cm_id->remote_addr;
+        raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
-        laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
+        laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
-        raddr6 = (struct sockaddr_in6 *)&cm_id->remote_addr;
+        raddr6 = (struct sockaddr_in6 *)&cm_id->m_remote_addr;
+        DP_DEBUG(dev, QEDR_MSG_IWARP, "MAPPED %d %d\n",
+                 ntohs(((struct sockaddr_in *)&cm_id->remote_addr)->sin_port),
+                 ntohs(raddr->sin_port));
        DP_DEBUG(dev, QEDR_MSG_IWARP,
                 "Connect source address: %pISpc, remote address: %pISpc\n",
@@ -599,8 +602,8 @@ int qedr_iw_create_listen(struct iw_cm_id *cm_id, int backlog)
        int rc;
        int i;
-        laddr = (struct sockaddr_in *)&cm_id->local_addr;
+        laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
-        laddr6 = (struct sockaddr_in6 *)&cm_id->local_addr;
+        laddr6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
        DP_DEBUG(dev, QEDR_MSG_IWARP,
                 "Create Listener address: %pISpc\n", &cm_id->local_addr);
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 53f00dbf313f..875b17272d65 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -3034,6 +3034,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
        switch (wr->opcode) {
        case IB_WR_SEND_WITH_IMM:
+                if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+                        rc = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
                wqe->req_type = RDMA_SQ_REQ_TYPE_SEND_WITH_IMM;
                swqe = (struct rdma_sq_send_wqe_1st *)wqe;
                swqe->wqe_size = 2;
@@ -3075,6 +3080,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                break;
        case IB_WR_RDMA_WRITE_WITH_IMM:
+                if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
+                        rc = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
                wqe->req_type = RDMA_SQ_REQ_TYPE_RDMA_WR_WITH_IMM;
                rwqe = (struct rdma_sq_rdma_wqe_1st *)wqe;
@@ -3724,7 +3734,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 {
        struct qedr_dev *dev = get_qedr_dev(ibcq->device);
        struct qedr_cq *cq = get_qedr_cq(ibcq);
-        union rdma_cqe *cqe = cq->latest_cqe;
+        union rdma_cqe *cqe;
        u32 old_cons, new_cons;
        unsigned long flags;
        int update = 0;
@@ -3741,6 +3751,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                return qedr_gsi_poll_cq(ibcq, num_entries, wc);
        spin_lock_irqsave(&cq->cq_lock, flags);
+        cqe = cq->latest_cqe;
        old_cons = qed_chain_get_cons_idx_u32(&cq->pbl);
        while (num_entries && is_valid_cqe(cq, cqe)) {
                struct qedr_qp *qp;
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 1b2e5362a3ff..cc429b567d0a 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -489,11 +489,13 @@ static int rvt_check_refs(struct rvt_mregion *mr, const char *t)
        unsigned long timeout;
        struct rvt_dev_info *rdi = ib_to_rvt(mr->pd->device);
-        if (percpu_ref_is_zero(&mr->refcount))
+        if (mr->lkey) {
-                return 0;
+                /* avoid dma mr */
-        /* avoid dma mr */
-        if (mr->lkey)
                rvt_dereg_clean_qps(mr);
+                /* @mr was indexed on rcu protected @lkey_table */
+                synchronize_rcu();
+        }
        timeout = wait_for_completion_timeout(&mr->comp, 5 * HZ);
        if (!timeout) {
                rvt_pr_err(rdi,
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 1f316d66e6f7..41614c185918 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct input_dev *dev)
 {
        struct matrix_keypad *keypad = input_get_drvdata(dev);
+        spin_lock_irq(&keypad->lock);
        keypad->stopped = true;
-        mb();
+        spin_unlock_irq(&keypad->lock);
        flush_work(&keypad->work.work);
        /*
         * matrix_keypad_scan() will leave IRQs enabled;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 3d2e23a0ae39..a246fc686bb7 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -173,7 +173,6 @@ static const char * const smbus_pnp_ids[] = {
        "LEN0046", /* X250 */
        "LEN004a", /* W541 */
        "LEN200f", /* T450s */
-        "LEN2018", /* T460p */
        NULL
 };
diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
index db4f6bb502e3..a5ab774da4cc 100644
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -1,11 +1,8 @@
-/*
+// SPDX-License-Identifier: GPL-2.0
- * Copyright (C) 2012 Samsung Electronics Co.Ltd
+// Melfas MMS114/MMS152 touchscreen device driver
- * Author: Joonyoung Shim <jy0922.shim@samsung.com>
+//
- *
+// Copyright (c) 2012 Samsung Electronics Co., Ltd.
- * This program is free software; you can redistribute it and/or modify
+// Author: Joonyoung Shim <jy0922.shim@samsung.com>
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
 #include <linux/module.h>
 #include <linux/delay.h>
@@ -624,4 +621,4 @@ module_i2c_driver(mms114_driver);
 /* Module information */
 MODULE_AUTHOR("Joonyoung Shim <jy0922.shim@samsung.com>");
 MODULE_DESCRIPTION("MELFAS mms114 Touchscreen driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 1d3056f53747..2cbb19cddbf8 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1412,7 +1412,7 @@ static struct irq_chip its_irq_chip = {
 * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations.
 */
 #define IRQS_PER_CHUNK_SHIFT    5
-#define IRQS_PER_CHUNK          (1 << IRQS_PER_CHUNK_SHIFT)
+#define IRQS_PER_CHUNK          (1UL << IRQS_PER_CHUNK_SHIFT)
 #define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 static unsigned long *lpi_bitmap;
@@ -2119,11 +2119,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
        /*
-         * At least one bit of EventID is being used, hence a minimum
+         * We allocate at least one chunk worth of LPIs bet device,
-         * of two entries. No, the architecture doesn't let you
+         * and thus that many ITEs. The device may require less though.
-         * express an ITT with a single entry.
         */
-        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
+        nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs));
        sz = nr_ites * its->ite_size;
        sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
        itt = kzalloc(sz, GFP_KERNEL);
@@ -2495,7 +2494,7 @@ static int its_vpe_set_affinity(struct irq_data *d,
 static void its_vpe_schedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
        u64 val;
        /* Schedule the VPE */
@@ -2527,7 +2526,7 @@ static void its_vpe_schedule(struct its_vpe *vpe)
 static void its_vpe_deschedule(struct its_vpe *vpe)
 {
-        void * __iomem vlpi_base = gic_data_rdist_vlpi_base();
+        void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
        u32 count = 1000000;    /* 1s! */
        bool clean;
        u64 val;
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 675eda5ff2b8..4760307ab43f 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -28,20 +28,6 @@ struct gpcv2_irqchip_data {
 static struct gpcv2_irqchip_data *imx_gpcv2_instance;
-/*
- * Interface for the low level wakeup code.
- */
-u32 imx_gpcv2_get_wakeup_source(u32 **sources)
-{
-        if (!imx_gpcv2_instance)
-                return 0;
-        if (sources)
-                *sources = imx_gpcv2_instance->wakeup_sources;
-        return IMR_NUM;
-}
 static int gpcv2_wakeup_source_save(void)
 {
        struct gpcv2_irqchip_data *cd;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 4d1d8dfb2d2a..f2273143b3cb 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -963,6 +963,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
        uint32_t rtime = cpu_to_le32(get_seconds());
        struct uuid_entry *u;
        char buf[BDEVNAME_SIZE];
+        struct cached_dev *exist_dc, *t;
        bdevname(dc->bdev, buf);
@@ -987,6 +988,16 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
                return -EINVAL;
        }
+        /* Check whether already attached */
+        list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
+                if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
+                        pr_err("Tried to attach %s but duplicate UUID already attached",
+                                buf);
+                        return -EINVAL;
+                }
+        }
        u = uuid_find(c, dc->sb.uuid);
        if (u &&
@@ -1204,7 +1215,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
        return;
 err:
-        pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+        pr_notice("error %s: %s", bdevname(bdev, name), err);
        bcache_device_stop(&dc->disk);
 }
@@ -1883,6 +1894,8 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
        const char *err = NULL; /* must be set for any error case */
        int ret = 0;
+        bdevname(bdev, name);
        memcpy(&ca->sb, sb, sizeof(struct cache_sb));
        ca->bdev = bdev;
        ca->bdev->bd_holder = ca;
@@ -1891,11 +1904,12 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
        bio_first_bvec_all(&ca->sb_bio)->bv_page = sb_page;
        get_page(sb_page);
-        if (blk_queue_discard(bdev_get_queue(ca->bdev)))
+        if (blk_queue_discard(bdev_get_queue(bdev)))
                ca->discard = CACHE_DISCARD(&ca->sb);
        ret = cache_alloc(ca);
        if (ret != 0) {
+                blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
                if (ret == -ENOMEM)
                        err = "cache_alloc(): -ENOMEM";
                else
@@ -1918,14 +1932,14 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                goto out;
        }
-        pr_info("registered cache device %s", bdevname(bdev, name));
+        pr_info("registered cache device %s", name);
 out:
        kobject_put(&ca->kobj);
 err:
        if (err)
-                pr_notice("error opening %s: %s", bdevname(bdev, name), err);
+                pr_notice("error %s: %s", name, err);
        return ret;
 }
@@ -2014,6 +2028,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
        if (err)
                goto err_close;
+        err = "failed to register device";
        if (SB_IS_BDEV(sb)) {
                struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
                if (!dc)
@@ -2028,7 +2043,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
                        goto err_close;
                if (register_cache(sb, sb_page, bdev, ca) != 0)
-                        goto err_close;
+                        goto err;
        }
 out:
        if (sb_page)
@@ -2041,7 +2056,7 @@ out:
 err_close:
        blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
 err:
-        pr_info("error opening %s: %s", path, err);
+        pr_info("error %s: %s", path, err);
        ret = -EINVAL;
        goto out;
 }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 414c9af54ded..aa2032fa80d4 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -386,9 +386,6 @@ static void __cache_size_refresh(void)
 static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
                               enum data_mode *data_mode)
 {
-        unsigned noio_flag;
-        void *ptr;
        if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
                *data_mode = DATA_MODE_SLAB;
                return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
         * all allocations done by this process (including pagetables) are done
         * as if GFP_NOIO was specified.
         */
+        if (gfp_mask & __GFP_NORETRY) {
+                unsigned noio_flag = memalloc_noio_save();
+                void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-        if (gfp_mask & __GFP_NORETRY)
-                noio_flag = memalloc_noio_save();
-        ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
-        if (gfp_mask & __GFP_NORETRY)
                memalloc_noio_restore(noio_flag);
+                return ptr;
+        }
-        return ptr;
+        return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL);
 }
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 7d3e572072f5..a05a560d3cba 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -211,29 +211,27 @@ static int alloc_multipath_stage2(struct dm_target *ti, struct multipath *m)
                else
                        m->queue_mode = DM_TYPE_REQUEST_BASED;
-        } else if (m->queue_mode == DM_TYPE_BIO_BASED ||
+        } else if (m->queue_mode == DM_TYPE_BIO_BASED) {
-                   m->queue_mode == DM_TYPE_NVME_BIO_BASED) {
                INIT_WORK(&m->process_queued_bios, process_queued_bios);
+                /*
-                if (m->queue_mode == DM_TYPE_BIO_BASED) {
+                 * bio-based doesn't support any direct scsi_dh management;
-                        /*
+                 * it just discovers if a scsi_dh is attached.
-                         * bio-based doesn't support any direct scsi_dh management;
+                 */
-                         * it just discovers if a scsi_dh is attached.
+                set_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags);
-                         */
-                        set_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags);
-                }
-        }
-        if (m->queue_mode != DM_TYPE_NVME_BIO_BASED) {
-                set_bit(MPATHF_QUEUE_IO, &m->flags);
-                atomic_set(&m->pg_init_in_progress, 0);
-                atomic_set(&m->pg_init_count, 0);
-                m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
-                init_waitqueue_head(&m->pg_init_wait);
        }
        dm_table_set_type(ti->table, m->queue_mode);
+        /*
+         * Init fields that are only used when a scsi_dh is attached
+         * - must do this unconditionally (really doesn't hurt non-SCSI uses)
+         */
+        set_bit(MPATHF_QUEUE_IO, &m->flags);
+        atomic_set(&m->pg_init_in_progress, 0);
+        atomic_set(&m->pg_init_count, 0);
+        m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
+        init_waitqueue_head(&m->pg_init_wait);
        return 0;
 }
@@ -337,9 +335,6 @@ static void __switch_pg(struct multipath *m, struct priority_group *pg)
 {
        m->current_pg = pg;
-        if (m->queue_mode == DM_TYPE_NVME_BIO_BASED)
-                return;
        /* Must we initialise the PG first, and queue I/O till it's ready? */
        if (m->hw_handler_name) {
                set_bit(MPATHF_PG_INIT_REQUIRED, &m->flags);
@@ -385,8 +380,7 @@ static struct pgpath *choose_pgpath(struct multipath *m, size_t nr_bytes)
        unsigned bypassed = 1;
        if (!atomic_read(&m->nr_valid_paths)) {
-                if (m->queue_mode != DM_TYPE_NVME_BIO_BASED)
+                clear_bit(MPATHF_QUEUE_IO, &m->flags);
-                        clear_bit(MPATHF_QUEUE_IO, &m->flags);
                goto failed;
        }
@@ -599,7 +593,7 @@ static struct pgpath *__map_bio(struct multipath *m, struct bio *bio)
        return pgpath;
 }
-static struct pgpath *__map_bio_nvme(struct multipath *m, struct bio *bio)
+static struct pgpath *__map_bio_fast(struct multipath *m, struct bio *bio)
 {
        struct pgpath *pgpath;
        unsigned long flags;
@@ -634,8 +628,8 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio,
 {
        struct pgpath *pgpath;
-        if (m->queue_mode == DM_TYPE_NVME_BIO_BASED)
+        if (!m->hw_handler_name)
-                pgpath = __map_bio_nvme(m, bio);
+                pgpath = __map_bio_fast(m, bio);
        else
                pgpath = __map_bio(m, bio);
@@ -675,8 +669,7 @@ static void process_queued_io_list(struct multipath *m)
 {
        if (m->queue_mode == DM_TYPE_MQ_REQUEST_BASED)
                dm_mq_kick_requeue_list(dm_table_get_md(m->ti->table));
-        else if (m->queue_mode == DM_TYPE_BIO_BASED ||
+        else if (m->queue_mode == DM_TYPE_BIO_BASED)
-                 m->queue_mode == DM_TYPE_NVME_BIO_BASED)
                queue_work(kmultipathd, &m->process_queued_bios);
 }
@@ -811,15 +804,14 @@ static int parse_path_selector(struct dm_arg_set *as, struct priority_group *pg,
        return 0;
 }
-static int setup_scsi_dh(struct block_device *bdev, struct multipath *m, char **error)
+static int setup_scsi_dh(struct block_device *bdev, struct multipath *m,
+                         const char *attached_handler_name, char **error)
 {
        struct request_queue *q = bdev_get_queue(bdev);
-        const char *attached_handler_name;
        int r;
        if (test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
 retain:
-                attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                if (attached_handler_name) {
                        /*
                         * Clear any hw_handler_params associated with a
@@ -873,6 +865,8 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
        int r;
        struct pgpath *p;
        struct multipath *m = ti->private;
+        struct request_queue *q;
+        const char *attached_handler_name;
        /* we need at least a path arg */
        if (as->argc < 1) {
@@ -891,9 +885,11 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                goto bad;
        }
-        if (m->queue_mode != DM_TYPE_NVME_BIO_BASED) {
+        q = bdev_get_queue(p->path.dev->bdev);
+        attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
+        if (attached_handler_name) {
                INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
-                r = setup_scsi_dh(p->path.dev->bdev, m, &ti->error);
+                r = setup_scsi_dh(p->path.dev->bdev, m, attached_handler_name, &ti->error);
                if (r) {
                        dm_put_device(ti, p->path.dev);
                        goto bad;
@@ -1001,8 +997,7 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
        if (!hw_argc)
                return 0;
-        if (m->queue_mode == DM_TYPE_BIO_BASED ||
+        if (m->queue_mode == DM_TYPE_BIO_BASED) {
-            m->queue_mode == DM_TYPE_NVME_BIO_BASED) {
                dm_consume_args(as, hw_argc);
                DMERR("bio-based multipath doesn't allow hardware handler args");
                return 0;
@@ -1091,8 +1086,6 @@ static int parse_features(struct dm_arg_set *as, struct multipath *m)
                        if (!strcasecmp(queue_mode_name, "bio"))
                                m->queue_mode = DM_TYPE_BIO_BASED;
-                        else if (!strcasecmp(queue_mode_name, "nvme"))
-                                m->queue_mode = DM_TYPE_NVME_BIO_BASED;
                        else if (!strcasecmp(queue_mode_name, "rq"))
                                m->queue_mode = DM_TYPE_REQUEST_BASED;
                        else if (!strcasecmp(queue_mode_name, "mq"))
@@ -1193,7 +1186,7 @@ static int multipath_ctr(struct dm_target *ti, unsigned argc, char **argv)
        ti->num_discard_bios = 1;
        ti->num_write_same_bios = 1;
        ti->num_write_zeroes_bios = 1;
-        if (m->queue_mode == DM_TYPE_BIO_BASED || m->queue_mode == DM_TYPE_NVME_BIO_BASED)
+        if (m->queue_mode == DM_TYPE_BIO_BASED)
                ti->per_io_data_size = multipath_per_bio_data_size();
        else
                ti->per_io_data_size = sizeof(struct dm_mpath_io);
@@ -1730,9 +1723,6 @@ static void multipath_status(struct dm_target *ti, status_type_t type,
                        case DM_TYPE_BIO_BASED:
                                DMEMIT("queue_mode bio ");
                                break;
-                        case DM_TYPE_NVME_BIO_BASED:
-                                DMEMIT("queue_mode nvme ");
-                                break;
                        case DM_TYPE_MQ_REQUEST_BASED:
                                DMEMIT("queue_mode mq ");
                                break;
@@ -2030,8 +2020,9 @@ static int multipath_busy(struct dm_target *ti)
 *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
        .name = "multipath",
-        .version = {1, 12, 0},
+        .version = {1, 13, 0},
-        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
+        .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE |
+                    DM_TARGET_PASSES_INTEGRITY,
        .module = THIS_MODULE,
        .ctr = multipath_ctr,
        .dtr = multipath_dtr,
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 7ef469e902c6..c1d1034ff7b7 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3408,9 +3408,10 @@ static sector_t rs_get_progress(struct raid_set *rs, unsigned long recovery,
                set_bit(RT_FLAG_RS_IN_SYNC, &rs->runtime_flags);
        } else {
-                if (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
+                if (!test_bit(MD_RECOVERY_INTR, &recovery) &&
-                    test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
+                    (test_bit(MD_RECOVERY_NEEDED, &recovery) ||
-                    test_bit(MD_RECOVERY_RUNNING, &recovery))
+                     test_bit(MD_RECOVERY_RESHAPE, &recovery) ||
+                     test_bit(MD_RECOVERY_RUNNING, &recovery)))
                        r = mddev->curr_resync_completed;
                else
                        r = mddev->recovery_cp;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 5fe7ec356c33..7eb3e2a3c07d 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -942,17 +942,12 @@ static int dm_table_determine_type(struct dm_table *t)
        if (t->type != DM_TYPE_NONE) {
                /* target already set the table's type */
-                if (t->type == DM_TYPE_BIO_BASED)
+                if (t->type == DM_TYPE_BIO_BASED) {
-                        return 0;
+                        /* possibly upgrade to a variant of bio-based */
-                else if (t->type == DM_TYPE_NVME_BIO_BASED) {
+                        goto verify_bio_based;
-                        if (!dm_table_does_not_support_partial_completion(t)) {
-                                DMERR("nvme bio-based is only possible with devices"
-                                      " that don't support partial completion");
-                                return -EINVAL;
-                        }
-                        /* Fallthru, also verify all devices are blk-mq */
                }
                BUG_ON(t->type == DM_TYPE_DAX_BIO_BASED);
+                BUG_ON(t->type == DM_TYPE_NVME_BIO_BASED);
                goto verify_rq_based;
        }
@@ -985,6 +980,7 @@ static int dm_table_determine_type(struct dm_table *t)
        }
        if (bio_based) {
+verify_bio_based:
                /* We must use this table as bio-based */
                t->type = DM_TYPE_BIO_BASED;
                if (dm_table_supports_dax(t) ||
@@ -1755,7 +1751,7 @@ static int device_no_partial_completion(struct dm_target *ti, struct dm_dev *dev
        char b[BDEVNAME_SIZE];
        /* For now, NVMe devices are the only devices of this class */
-        return (strncmp(bdevname(dev->bdev, b), "nvme", 3) == 0);
+        return (strncmp(bdevname(dev->bdev, b), "nvme", 4) == 0);
 }
 static bool dm_table_does_not_support_partial_completion(struct dm_table *t)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 68136806d365..45328d8b2859 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -458,9 +458,11 @@ static int dm_blk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
        return dm_get_geometry(md, geo);
 }
-static int dm_grab_bdev_for_ioctl(struct mapped_device *md,
+static char *_dm_claim_ptr = "I belong to device-mapper";
-                                  struct block_device **bdev,
-                                  fmode_t *mode)
+static int dm_get_bdev_for_ioctl(struct mapped_device *md,
+                                 struct block_device **bdev,
+                                 fmode_t *mode)
 {
        struct dm_target *tgt;
        struct dm_table *map;
@@ -490,6 +492,10 @@ retry:
                goto out;
        bdgrab(*bdev);
+        r = blkdev_get(*bdev, *mode, _dm_claim_ptr);
+        if (r < 0)
+                goto out;
        dm_put_live_table(md, srcu_idx);
        return r;
@@ -508,7 +514,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
        struct mapped_device *md = bdev->bd_disk->private_data;
        int r;
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
        if (r < 0)
                return r;
@@ -528,7 +534,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
        r =  __blkdev_driver_ioctl(bdev, mode, cmd, arg);
 out:
-        bdput(bdev);
+        blkdev_put(bdev, mode);
        return r;
 }
@@ -708,14 +714,13 @@ static void dm_put_live_table_fast(struct mapped_device *md) __releases(RCU)
 static int open_table_device(struct table_device *td, dev_t dev,
                             struct mapped_device *md)
 {
-        static char *_claim_ptr = "I belong to device-mapper";
        struct block_device *bdev;
        int r;
        BUG_ON(td->dm_dev.bdev);
-        bdev = blkdev_get_by_dev(dev, td->dm_dev.mode | FMODE_EXCL, _claim_ptr);
+        bdev = blkdev_get_by_dev(dev, td->dm_dev.mode | FMODE_EXCL, _dm_claim_ptr);
        if (IS_ERR(bdev))
                return PTR_ERR(bdev);
@@ -3011,7 +3016,7 @@ static int dm_pr_reserve(struct block_device *bdev, u64 key, enum pr_type type,
        fmode_t mode;
        int r;
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
        if (r < 0)
                return r;
@@ -3021,7 +3026,7 @@ static int dm_pr_reserve(struct block_device *bdev, u64 key, enum pr_type type,
        else
                r = -EOPNOTSUPP;
-        bdput(bdev);
+        blkdev_put(bdev, mode);
        return r;
 }
@@ -3032,7 +3037,7 @@ static int dm_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
        fmode_t mode;
        int r;
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
        if (r < 0)
                return r;
@@ -3042,7 +3047,7 @@ static int dm_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
        else
                r = -EOPNOTSUPP;
-        bdput(bdev);
+        blkdev_put(bdev, mode);
        return r;
 }
@@ -3054,7 +3059,7 @@ static int dm_pr_preempt(struct block_device *bdev, u64 old_key, u64 new_key,
        fmode_t mode;
        int r;
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
        if (r < 0)
                return r;
@@ -3064,7 +3069,7 @@ static int dm_pr_preempt(struct block_device *bdev, u64 old_key, u64 new_key,
        else
                r = -EOPNOTSUPP;
-        bdput(bdev);
+        blkdev_put(bdev, mode);
        return r;
 }
@@ -3075,7 +3080,7 @@ static int dm_pr_clear(struct block_device *bdev, u64 key)
        fmode_t mode;
        int r;
-        r = dm_grab_bdev_for_ioctl(md, &bdev, &mode);
+        r = dm_get_bdev_for_ioctl(md, &bdev, &mode);
        if (r < 0)
                return r;
@@ -3085,7 +3090,7 @@ static int dm_pr_clear(struct block_device *bdev, u64 key)
        else
                r = -EOPNOTSUPP;
-        bdput(bdev);
+        blkdev_put(bdev, mode);
        return r;
 }
diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c
index 337462e1569f..038509e5d031 100644
--- a/drivers/misc/ocxl/file.c
+++ b/drivers/misc/ocxl/file.c
@@ -102,10 +102,32 @@ static long afu_ioctl_attach(struct ocxl_context *ctx,
        return rc;
 }
+static long afu_ioctl_get_metadata(struct ocxl_context *ctx,
+                struct ocxl_ioctl_metadata __user *uarg)
+{
+        struct ocxl_ioctl_metadata arg;
+        memset(&arg, 0, sizeof(arg));
+        arg.version = 0;
+        arg.afu_version_major = ctx->afu->config.version_major;
+        arg.afu_version_minor = ctx->afu->config.version_minor;
+        arg.pasid = ctx->pasid;
+        arg.pp_mmio_size = ctx->afu->config.pp_mmio_stride;
+        arg.global_mmio_size = ctx->afu->config.global_mmio_size;
+        if (copy_to_user(uarg, &arg, sizeof(arg)))
+                return -EFAULT;
+        return 0;
+}
 #define CMD_STR(x) (x == OCXL_IOCTL_ATTACH ? "ATTACH" :                 \
                        x == OCXL_IOCTL_IRQ_ALLOC ? "IRQ_ALLOC" :       \
                        x == OCXL_IOCTL_IRQ_FREE ? "IRQ_FREE" :         \
                        x == OCXL_IOCTL_IRQ_SET_FD ? "IRQ_SET_FD" :     \
+                        x == OCXL_IOCTL_GET_METADATA ? "GET_METADATA" : \
                        "UNKNOWN")
 static long afu_ioctl(struct file *file, unsigned int cmd,
@@ -159,6 +181,11 @@ static long afu_ioctl(struct file *file, unsigned int cmd,
                                        irq_fd.eventfd);
                break;
+        case OCXL_IOCTL_GET_METADATA:
+                rc = afu_ioctl_get_metadata(ctx,
+                                (struct ocxl_ioctl_metadata __user *) args);
+                break;
        default:
                rc = -EINVAL;
        }
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 20135a5de748..2cfb963d9f37 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -72,6 +72,7 @@ MODULE_ALIAS("mmc:block");
 #define MMC_BLK_TIMEOUT_MS  (10 * 1000)
 #define MMC_SANITIZE_REQ_TIMEOUT 240000
 #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
+#define MMC_EXTRACT_VALUE_FROM_ARG(x) ((x & 0x0000FF00) >> 8)
 #define mmc_req_rel_wr(req)     ((req->cmd_flags & REQ_FUA) && \
                                  (rq_data_dir(req) == WRITE))
@@ -587,6 +588,24 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
        }
        /*
+         * Make sure the cache of the PARTITION_CONFIG register and
+         * PARTITION_ACCESS bits is updated in case the ioctl ext_csd write
+         * changed it successfully.
+         */
+        if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_PART_CONFIG) &&
+            (cmd.opcode == MMC_SWITCH)) {
+                struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
+                u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg);
+                /*
+                 * Update cache so the next mmc_blk_part_switch call operates
+                 * on up-to-date data.
+                 */
+                card->ext_csd.part_config = value;
+                main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK;
+        }
+        /*
         * According to the SD specs, some commands require a delay after
         * issuing the command.
         */
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index 79a5b985ccf5..9c821eedd156 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -82,6 +82,7 @@ struct mmc_fixup {
 #define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX        0x90
+#define CID_MANFID_NUMONYX      0xFE
 #define END_FIXUP { NULL }
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index 75d317623852..5153577754f0 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -109,6 +109,12 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
         */
        MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_HYNIX,
                              0x014a, add_quirk, MMC_QUIRK_BROKEN_HPI, 5),
+        /*
+         * Certain Micron (Numonyx) eMMC 4.5 cards might get broken when HPI
+         * feature is used so disable the HPI feature for such buggy cards.
+         */
+        MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_NUMONYX,
+                              0x014e, add_quirk, MMC_QUIRK_BROKEN_HPI, 6),
        END_FIXUP
 };
diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index fa41d9422d57..a84aa3f1ae85 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -165,9 +165,15 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing)
 static int dw_mci_exynos_runtime_resume(struct device *dev)
 {
        struct dw_mci *host = dev_get_drvdata(dev);
+        int ret;
+        ret = dw_mci_runtime_resume(dev);
+        if (ret)
+                return ret;
        dw_mci_exynos_config_smu(host);
-        return dw_mci_runtime_resume(dev);
+        return ret;
 }
 /**
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index d9b4acefed31..06d47414d0c1 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -413,7 +413,9 @@ static inline void dw_mci_set_cto(struct dw_mci *host)
        cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
        if (cto_div == 0)
                cto_div = 1;
-        cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz);
+        cto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * cto_clks * cto_div,
+                                  host->bus_hz);
        /* add a bit spare time */
        cto_ms += 10;
@@ -562,6 +564,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
                                        (sizeof(struct idmac_desc_64addr) *
                                                        (i + 1))) >> 32;
                        /* Initialize reserved and buffer size fields to "0" */
+                        p->des0 = 0;
                        p->des1 = 0;
                        p->des2 = 0;
                        p->des3 = 0;
@@ -584,6 +587,7 @@ static int dw_mci_idmac_init(struct dw_mci *host)
                     i++, p++) {
                        p->des3 = cpu_to_le32(host->sg_dma +
                                        (sizeof(struct idmac_desc) * (i + 1)));
+                        p->des0 = 0;
                        p->des1 = 0;
                }
@@ -1799,8 +1803,8 @@ static bool dw_mci_reset(struct dw_mci *host)
        }
        if (host->use_dma == TRANS_MODE_IDMAC)
-                /* It is also recommended that we reset and reprogram idmac */
+                /* It is also required that we reinit idmac */
-                dw_mci_idmac_reset(host);
+                dw_mci_idmac_init(host);
        ret = true;
@@ -1948,8 +1952,9 @@ static void dw_mci_set_drto(struct dw_mci *host)
        drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
        if (drto_div == 0)
                drto_div = 1;
-        drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
-                               host->bus_hz);
+        drto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * drto_clks * drto_div,
+                                   host->bus_hz);
        /* add a bit spare time */
        drto_ms += 10;
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index 4065da58789d..32321bd596d8 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -680,7 +680,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
        host->hw_name   = "ACPI";
        host->ops       = &sdhci_acpi_ops_dflt;
        host->irq       = platform_get_irq(pdev, 0);
-        if (host->irq <= 0) {
+        if (host->irq < 0) {
                err = -EINVAL;
                goto err_free;
        }
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
index 1e37313054f3..6da69af103e6 100644
--- a/drivers/net/can/cc770/cc770.c
+++ b/drivers/net/can/cc770/cc770.c
@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev,
        return 0;
 }
-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static void cc770_tx(struct net_device *dev, int mo)
 {
        struct cc770_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
+        struct can_frame *cf = (struct can_frame *)priv->tx_skb->data;
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        unsigned int mo = obj2msgobj(CC770_OBJ_TX);
        u8 dlc, rtr;
        u32 id;
        int i;
-        if (can_dropped_invalid_skb(dev, skb))
-                return NETDEV_TX_OK;
-        if ((cc770_read_reg(priv,
-                            msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
-                netdev_err(dev, "TX register is still occupied!\n");
-                return NETDEV_TX_BUSY;
-        }
-        netif_stop_queue(dev);
        dlc = cf->can_dlc;
        id = cf->can_id;
-        if (cf->can_id & CAN_RTR_FLAG)
+        rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR;
-                rtr = 0;
-        else
+        cc770_write_reg(priv, msgobj[mo].ctrl0,
-                rtr = MSGCFG_DIR;
+                        MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
        cc770_write_reg(priv, msgobj[mo].ctrl1,
                        RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES);
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
-                        MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES);
        if (id & CAN_EFF_FLAG) {
                id &= CAN_EFF_MASK;
                cc770_write_reg(priv, msgobj[mo].config,
@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
        for (i = 0; i < dlc; i++)
                cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]);
-        /* Store echo skb before starting the transfer */
-        can_put_echo_skb(skb, dev, 0);
        cc770_write_reg(priv, msgobj[mo].ctrl1,
-                        RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
+                        RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC);
+        cc770_write_reg(priv, msgobj[mo].ctrl0,
+                        MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC);
+}
-        stats->tx_bytes += dlc;
+static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct cc770_priv *priv = netdev_priv(dev);
+        unsigned int mo = obj2msgobj(CC770_OBJ_TX);
+        if (can_dropped_invalid_skb(dev, skb))
+                return NETDEV_TX_OK;
-        /*
+        netif_stop_queue(dev);
-         * HM: We had some cases of repeated IRQs so make sure the
-         * INT is acknowledged I know it's already further up, but
+        if ((cc770_read_reg(priv,
-         * doing again fixed the issue
+                            msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) {
-         */
+                netdev_err(dev, "TX register is still occupied!\n");
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
+                return NETDEV_TX_BUSY;
-                        MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
+        }
+        priv->tx_skb = skb;
+        cc770_tx(dev, mo);
        return NETDEV_TX_OK;
 }
@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o)
        struct cc770_priv *priv = netdev_priv(dev);
        struct net_device_stats *stats = &dev->stats;
        unsigned int mo = obj2msgobj(o);
+        struct can_frame *cf;
+        u8 ctrl1;
+        ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1);
-        /* Nothing more to send, switch off interrupts */
        cc770_write_reg(priv, msgobj[mo].ctrl0,
                        MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES);
-        /*
+        cc770_write_reg(priv, msgobj[mo].ctrl1,
-         * We had some cases of repeated IRQ so make sure the
+                        RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES);
-         * INT is acknowledged
+        if (unlikely(!priv->tx_skb)) {
+                netdev_err(dev, "missing tx skb in tx interrupt\n");
+                return;
+        }
+        if (unlikely(ctrl1 & MSGLST_SET)) {
+                stats->rx_over_errors++;
+                stats->rx_errors++;
+        }
+        /* When the CC770 is sending an RTR message and it receives a regular
+         * message that matches the id of the RTR message, it will overwrite the
+         * outgoing message in the TX register. When this happens we must
+         * process the received message and try to transmit the outgoing skb
+         * again.
         */
-        cc770_write_reg(priv, msgobj[mo].ctrl0,
+        if (unlikely(ctrl1 & NEWDAT_SET)) {
-                        MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES);
+                cc770_rx(dev, mo, ctrl1);
+                cc770_tx(dev, mo);
+                return;
+        }
+        cf = (struct can_frame *)priv->tx_skb->data;
+        stats->tx_bytes += cf->can_dlc;
        stats->tx_packets++;
+        can_put_echo_skb(priv->tx_skb, dev, 0);
        can_get_echo_skb(dev, 0);
+        priv->tx_skb = NULL;
        netif_wake_queue(dev);
 }
@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv)
        priv->can.do_set_bittiming = cc770_set_bittiming;
        priv->can.do_set_mode = cc770_set_mode;
        priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+        priv->tx_skb = NULL;
        memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags));
diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h
index a1739db98d91..95752e1d1283 100644
--- a/drivers/net/can/cc770/cc770.h
+++ b/drivers/net/can/cc770/cc770.h
@@ -193,6 +193,8 @@ struct cc770_priv {
        u8 cpu_interface;       /* CPU interface register */
        u8 clkout;              /* Clock out register */
        u8 bus_config;          /* Bus conffiguration register */
+        struct sk_buff *tx_skb;
 };
 struct net_device *alloc_cc770dev(int sizeof_priv);
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 2772d05ff11c..fedd927ba6ed 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -30,6 +30,7 @@
 #define IFI_CANFD_STCMD_ERROR_ACTIVE            BIT(2)
 #define IFI_CANFD_STCMD_ERROR_PASSIVE           BIT(3)
 #define IFI_CANFD_STCMD_BUSOFF                  BIT(4)
+#define IFI_CANFD_STCMD_ERROR_WARNING           BIT(5)
 #define IFI_CANFD_STCMD_BUSMONITOR              BIT(16)
 #define IFI_CANFD_STCMD_LOOPBACK                BIT(18)
 #define IFI_CANFD_STCMD_DISABLE_CANFD           BIT(24)
@@ -52,7 +53,10 @@
 #define IFI_CANFD_TXSTCMD_OVERFLOW              BIT(13)
 #define IFI_CANFD_INTERRUPT                     0xc
+#define IFI_CANFD_INTERRUPT_ERROR_BUSOFF        BIT(0)
 #define IFI_CANFD_INTERRUPT_ERROR_WARNING       BIT(1)
+#define IFI_CANFD_INTERRUPT_ERROR_STATE_CHG     BIT(2)
+#define IFI_CANFD_INTERRUPT_ERROR_REC_TEC_INC   BIT(3)
 #define IFI_CANFD_INTERRUPT_ERROR_COUNTER       BIT(10)
 #define IFI_CANFD_INTERRUPT_TXFIFO_EMPTY        BIT(16)
 #define IFI_CANFD_INTERRUPT_TXFIFO_REMOVE       BIT(22)
@@ -61,6 +65,10 @@
 #define IFI_CANFD_INTERRUPT_SET_IRQ             ((u32)BIT(31))
 #define IFI_CANFD_IRQMASK                       0x10
+#define IFI_CANFD_IRQMASK_ERROR_BUSOFF          BIT(0)
+#define IFI_CANFD_IRQMASK_ERROR_WARNING         BIT(1)
+#define IFI_CANFD_IRQMASK_ERROR_STATE_CHG       BIT(2)
+#define IFI_CANFD_IRQMASK_ERROR_REC_TEC_INC     BIT(3)
 #define IFI_CANFD_IRQMASK_SET_ERR               BIT(7)
 #define IFI_CANFD_IRQMASK_SET_TS                BIT(15)
 #define IFI_CANFD_IRQMASK_TXFIFO_EMPTY          BIT(16)
@@ -136,6 +144,8 @@
 #define IFI_CANFD_SYSCLOCK                      0x50
 #define IFI_CANFD_VER                           0x54
+#define IFI_CANFD_VER_REV_MASK                  0xff
+#define IFI_CANFD_VER_REV_MIN_SUPPORTED         0x15
 #define IFI_CANFD_IP_ID                         0x58
 #define IFI_CANFD_IP_ID_VALUE                   0xD073CAFD
@@ -220,7 +230,10 @@ static void ifi_canfd_irq_enable(struct net_device *ndev, bool enable)
        if (enable) {
                enirq = IFI_CANFD_IRQMASK_TXFIFO_EMPTY |
-                        IFI_CANFD_IRQMASK_RXFIFO_NEMPTY;
+                        IFI_CANFD_IRQMASK_RXFIFO_NEMPTY |
+                        IFI_CANFD_IRQMASK_ERROR_STATE_CHG |
+                        IFI_CANFD_IRQMASK_ERROR_WARNING |
+                        IFI_CANFD_IRQMASK_ERROR_BUSOFF;
                if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
                        enirq |= IFI_CANFD_INTERRUPT_ERROR_COUNTER;
        }
@@ -361,12 +374,13 @@ static int ifi_canfd_handle_lost_msg(struct net_device *ndev)
        return 1;
 }
-static int ifi_canfd_handle_lec_err(struct net_device *ndev, const u32 errctr)
+static int ifi_canfd_handle_lec_err(struct net_device *ndev)
 {
        struct ifi_canfd_priv *priv = netdev_priv(ndev);
        struct net_device_stats *stats = &ndev->stats;
        struct can_frame *cf;
        struct sk_buff *skb;
+        u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
        const u32 errmask = IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST |
                            IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST |
                            IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST |
@@ -449,6 +463,11 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
        switch (new_state) {
        case CAN_STATE_ERROR_ACTIVE:
+                /* error active state */
+                priv->can.can_stats.error_warning++;
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                break;
+        case CAN_STATE_ERROR_WARNING:
                /* error warning state */
                priv->can.can_stats.error_warning++;
                priv->can.state = CAN_STATE_ERROR_WARNING;
@@ -477,7 +496,7 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
        ifi_canfd_get_berr_counter(ndev, &bec);
        switch (new_state) {
-        case CAN_STATE_ERROR_ACTIVE:
+        case CAN_STATE_ERROR_WARNING:
                /* error warning state */
                cf->can_id |= CAN_ERR_CRTL;
                cf->data[1] = (bec.txerr > bec.rxerr) ?
@@ -510,22 +529,21 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev,
        return 1;
 }
-static int ifi_canfd_handle_state_errors(struct net_device *ndev, u32 stcmd)
+static int ifi_canfd_handle_state_errors(struct net_device *ndev)
 {
        struct ifi_canfd_priv *priv = netdev_priv(ndev);
+        u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
        int work_done = 0;
-        u32 isr;
-        /*
+        if ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) &&
-         * The ErrWarn condition is a little special, since the bit is
+            (priv->can.state != CAN_STATE_ERROR_ACTIVE)) {
-         * located in the INTERRUPT register instead of STCMD register.
+                netdev_dbg(ndev, "Error, entered active state\n");
-         */
+                work_done += ifi_canfd_handle_state_change(ndev,
-        isr = readl(priv->base + IFI_CANFD_INTERRUPT);
+                                                CAN_STATE_ERROR_ACTIVE);
-        if ((isr & IFI_CANFD_INTERRUPT_ERROR_WARNING) &&
+        }
+        if ((stcmd & IFI_CANFD_STCMD_ERROR_WARNING) &&
            (priv->can.state != CAN_STATE_ERROR_WARNING)) {
-                /* Clear the interrupt */
-                writel(IFI_CANFD_INTERRUPT_ERROR_WARNING,
-                       priv->base + IFI_CANFD_INTERRUPT);
                netdev_dbg(ndev, "Error, entered warning state\n");
                work_done += ifi_canfd_handle_state_change(ndev,
                                                CAN_STATE_ERROR_WARNING);
@@ -552,18 +570,11 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
 {
        struct net_device *ndev = napi->dev;
        struct ifi_canfd_priv *priv = netdev_priv(ndev);
-        const u32 stcmd_state_mask = IFI_CANFD_STCMD_ERROR_PASSIVE |
-                                     IFI_CANFD_STCMD_BUSOFF;
-        int work_done = 0;
-        u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
        u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
-        u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
+        int work_done = 0;
        /* Handle bus state changes */
-        if ((stcmd & stcmd_state_mask) ||
+        work_done += ifi_canfd_handle_state_errors(ndev);
-            ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) == 0))
-                work_done += ifi_canfd_handle_state_errors(ndev, stcmd);
        /* Handle lost messages on RX */
        if (rxstcmd & IFI_CANFD_RXSTCMD_OVERFLOW)
@@ -571,7 +582,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
        /* Handle lec errors on the bus */
        if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
-                work_done += ifi_canfd_handle_lec_err(ndev, errctr);
+                work_done += ifi_canfd_handle_lec_err(ndev);
        /* Handle normal messages on RX */
        if (!(rxstcmd & IFI_CANFD_RXSTCMD_EMPTY))
@@ -592,12 +603,13 @@ static irqreturn_t ifi_canfd_isr(int irq, void *dev_id)
        struct net_device_stats *stats = &ndev->stats;
        const u32 rx_irq_mask = IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY |
                                IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY_PER |
+                                IFI_CANFD_INTERRUPT_ERROR_COUNTER |
+                                IFI_CANFD_INTERRUPT_ERROR_STATE_CHG |
                                IFI_CANFD_INTERRUPT_ERROR_WARNING |
-                                IFI_CANFD_INTERRUPT_ERROR_COUNTER;
+                                IFI_CANFD_INTERRUPT_ERROR_BUSOFF;
        const u32 tx_irq_mask = IFI_CANFD_INTERRUPT_TXFIFO_EMPTY |
                                IFI_CANFD_INTERRUPT_TXFIFO_REMOVE;
-        const u32 clr_irq_mask = ~((u32)(IFI_CANFD_INTERRUPT_SET_IRQ |
+        const u32 clr_irq_mask = ~((u32)IFI_CANFD_INTERRUPT_SET_IRQ);
-                                         IFI_CANFD_INTERRUPT_ERROR_WARNING));
        u32 isr;
        isr = readl(priv->base + IFI_CANFD_INTERRUPT);
@@ -933,7 +945,7 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
        struct resource *res;
        void __iomem *addr;
        int irq, ret;
-        u32 id;
+        u32 id, rev;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        addr = devm_ioremap_resource(dev, res);
@@ -947,6 +959,13 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev)
                return -EINVAL;
        }
+        rev = readl(addr + IFI_CANFD_VER) & IFI_CANFD_VER_REV_MASK;
+        if (rev < IFI_CANFD_VER_REV_MIN_SUPPORTED) {
+                dev_err(dev, "This block is too old (rev %i), minimum supported is rev %i\n",
+                        rev, IFI_CANFD_VER_REV_MIN_SUPPORTED);
+                return -EINVAL;
+        }
        ndev = alloc_candev(sizeof(*priv), 1);
        if (!ndev)
                return -ENOMEM;
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 2594f7779c6f..b397a33f3d32 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -26,6 +26,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/iopoll.h>
 #include <linux/can/dev.h>
+#include <linux/pinctrl/consumer.h>
 /* napi related */
 #define M_CAN_NAPI_WEIGHT       64
@@ -253,7 +254,7 @@ enum m_can_mram_cfg {
 /* Rx FIFO 0/1 Configuration (RXF0C/RXF1C) */
 #define RXFC_FWM_SHIFT  24
-#define RXFC_FWM_MASK   (0x7f < RXFC_FWM_SHIFT)
+#define RXFC_FWM_MASK   (0x7f << RXFC_FWM_SHIFT)
 #define RXFC_FS_SHIFT   16
 #define RXFC_FS_MASK    (0x7f << RXFC_FS_SHIFT)
@@ -1700,6 +1701,8 @@ static __maybe_unused int m_can_suspend(struct device *dev)
                m_can_clk_stop(priv);
        }
+        pinctrl_pm_select_sleep_state(dev);
        priv->can.state = CAN_STATE_SLEEPING;
        return 0;
@@ -1710,6 +1713,8 @@ static __maybe_unused int m_can_resume(struct device *dev)
        struct net_device *ndev = dev_get_drvdata(dev);
        struct m_can_priv *priv = netdev_priv(ndev);
+        pinctrl_pm_select_default_state(dev);
        m_can_init_ram(priv);
        priv->can.state = CAN_STATE_ERROR_ACTIVE;
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 55513411a82e..ed8561d4a90f 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -262,7 +262,6 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
                spin_lock_irqsave(&priv->echo_lock, flags);
                can_get_echo_skb(priv->ndev, msg->client);
-                spin_unlock_irqrestore(&priv->echo_lock, flags);
                /* count bytes of the echo instead of skb */
                stats->tx_bytes += cf_len;
@@ -271,6 +270,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
                /* restart tx queue (a slot is free) */
                netif_wake_queue(priv->ndev);
+                spin_unlock_irqrestore(&priv->echo_lock, flags);
                return 0;
        }
@@ -333,7 +333,6 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
        /* this STATUS is the CNF of the RX_BARRIER: Tx path can be setup */
        if (pucan_status_is_rx_barrier(msg)) {
-                unsigned long flags;
                if (priv->enable_tx_path) {
                        int err = priv->enable_tx_path(priv);
@@ -342,16 +341,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
                                return err;
                }
-                /* restart network queue only if echo skb array is free */
+                /* start network queue (echo_skb array is empty) */
-                spin_lock_irqsave(&priv->echo_lock, flags);
+                netif_start_queue(ndev);
-                if (!priv->can.echo_skb[priv->echo_idx]) {
-                        spin_unlock_irqrestore(&priv->echo_lock, flags);
-                        netif_wake_queue(ndev);
-                } else {
-                        spin_unlock_irqrestore(&priv->echo_lock, flags);
-                }
                return 0;
        }
@@ -726,11 +717,6 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
         */
        should_stop_tx_queue = !!(priv->can.echo_skb[priv->echo_idx]);
-        spin_unlock_irqrestore(&priv->echo_lock, flags);
-        /* write the skb on the interface */
-        priv->write_tx_msg(priv, msg);
        /* stop network tx queue if not enough room to save one more msg too */
        if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
                should_stop_tx_queue |= (room_left <
@@ -742,6 +728,11 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb,
        if (should_stop_tx_queue)
                netif_stop_queue(ndev);
+        spin_unlock_irqrestore(&priv->echo_lock, flags);
+        /* write the skb on the interface */
+        priv->write_tx_msg(priv, msg);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
index 788c3464a3b0..3c51a884db87 100644
--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
+++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
@@ -349,8 +349,12 @@ static irqreturn_t pciefd_irq_handler(int irq, void *arg)
                priv->tx_pages_free++;
                spin_unlock_irqrestore(&priv->tx_lock, flags);
-                /* wake producer up */
+                /* wake producer up (only if enough room in echo_skb array) */
-                netif_wake_queue(priv->ucan.ndev);
+                spin_lock_irqsave(&priv->ucan.echo_lock, flags);
+                if (!priv->ucan.can.echo_skb[priv->ucan.echo_idx])
+                        netif_wake_queue(priv->ucan.ndev);
+                spin_unlock_irqrestore(&priv->ucan.echo_lock, flags);
        }
        /* re-enable Rx DMA transfer for this CAN */
diff --git a/drivers/net/dsa/Makefile b/drivers/net/dsa/Makefile
index d040aeb45172..15c2a831edf1 100644
--- a/drivers/net/dsa/Makefile
+++ b/drivers/net/dsa/Makefile
@@ -1,7 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_NET_DSA_BCM_SF2)   += bcm-sf2.o
 bcm-sf2-objs                    := bcm_sf2.o bcm_sf2_cfp.o
-obj-$(CONFIG_NET_DSA_LOOP)      += dsa_loop.o dsa_loop_bdinfo.o
+obj-$(CONFIG_NET_DSA_LOOP)      += dsa_loop.o
+ifdef CONFIG_NET_DSA_LOOP
+obj-$(CONFIG_FIXED_PHY)         += dsa_loop_bdinfo.o
+endif
 obj-$(CONFIG_NET_DSA_MT7530)    += mt7530.o
 obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o
 obj-$(CONFIG_NET_DSA_QCA8K)     += qca8k.o
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index cd16067265dd..78616787f2a3 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -814,8 +814,8 @@ void b53_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
        unsigned int i;
        for (i = 0; i < mib_size; i++)
-                memcpy(data + i * ETH_GSTRING_LEN,
+                strlcpy(data + i * ETH_GSTRING_LEN,
-                       mibs[i].name, ETH_GSTRING_LEN);
+                        mibs[i].name, ETH_GSTRING_LEN);
 }
 EXPORT_SYMBOL(b53_get_strings);
diff --git a/drivers/net/ethernet/8390/Kconfig b/drivers/net/ethernet/8390/Kconfig
index 29c3075bfb05..fdc673484add 100644
--- a/drivers/net/ethernet/8390/Kconfig
+++ b/drivers/net/ethernet/8390/Kconfig
@@ -3,7 +3,7 @@
 #
 config NET_VENDOR_8390
-        bool "National Semi-conductor 8390 devices"
+        bool "National Semiconductor 8390 devices"
        default y
        depends on NET_VENDOR_NATSEMI
        ---help---
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 0b49f1aeebd3..fc7383106946 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -36,6 +36,8 @@
 #define AQ_CFG_TX_FRAME_MAX  (16U * 1024U)
 #define AQ_CFG_RX_FRAME_MAX  (4U * 1024U)
+#define AQ_CFG_TX_CLEAN_BUDGET 256U
 /* LRO */
 #define AQ_CFG_IS_LRO_DEF           1U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index ebbaf63eaf47..c96a92118b8b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -247,6 +247,8 @@ void aq_nic_ndev_init(struct aq_nic_s *self)
        self->ndev->hw_features |= aq_hw_caps->hw_features;
        self->ndev->features = aq_hw_caps->hw_features;
        self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
+        self->ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
        self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
        self->ndev->max_mtu = aq_hw_caps->mtu - ETH_FCS_LEN - ETH_HLEN;
@@ -937,3 +939,23 @@ err_exit:
 out:
        return err;
 }
+void aq_nic_shutdown(struct aq_nic_s *self)
+{
+        int err = 0;
+        if (!self->ndev)
+                return;
+        rtnl_lock();
+        netif_device_detach(self->ndev);
+        err = aq_nic_stop(self);
+        if (err < 0)
+                goto err_exit;
+        aq_nic_deinit(self);
+err_exit:
+        rtnl_unlock();
+}
+\ No newline at end of file
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index d16b0f1a95aa..219b550d1665 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -118,5 +118,6 @@ struct aq_nic_cfg_s *aq_nic_get_cfg(struct aq_nic_s *self);
 u32 aq_nic_get_fw_version(struct aq_nic_s *self);
 int aq_nic_change_pm_state(struct aq_nic_s *self, pm_message_t *pm_msg);
 int aq_nic_update_interrupt_moderation_settings(struct aq_nic_s *self);
+void aq_nic_shutdown(struct aq_nic_s *self);
 #endif /* AQ_NIC_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 87c4308b52a7..ecc6306f940f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -323,6 +323,20 @@ static void aq_pci_remove(struct pci_dev *pdev)
        pci_disable_device(pdev);
 }
+static void aq_pci_shutdown(struct pci_dev *pdev)
+{
+        struct aq_nic_s *self = pci_get_drvdata(pdev);
+        aq_nic_shutdown(self);
+        pci_disable_device(pdev);
+        if (system_state == SYSTEM_POWER_OFF) {
+                pci_wake_from_d3(pdev, false);
+                pci_set_power_state(pdev, PCI_D3hot);
+        }
+}
 static int aq_pci_suspend(struct pci_dev *pdev, pm_message_t pm_msg)
 {
        struct aq_nic_s *self = pci_get_drvdata(pdev);
@@ -345,6 +359,7 @@ static struct pci_driver aq_pci_ops = {
        .remove = aq_pci_remove,
        .suspend = aq_pci_suspend,
        .resume = aq_pci_resume,
+        .shutdown = aq_pci_shutdown,
 };
 module_pci_driver(aq_pci_ops);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 0be6a11370bb..b5f1f62e8e25 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -136,11 +136,12 @@ void aq_ring_queue_stop(struct aq_ring_s *ring)
                netif_stop_subqueue(ndev, ring->idx);
 }
-void aq_ring_tx_clean(struct aq_ring_s *self)
+bool aq_ring_tx_clean(struct aq_ring_s *self)
 {
        struct device *dev = aq_nic_get_dev(self->aq_nic);
+        unsigned int budget = AQ_CFG_TX_CLEAN_BUDGET;
-        for (; self->sw_head != self->hw_head;
+        for (; self->sw_head != self->hw_head && budget--;
                self->sw_head = aq_ring_next_dx(self, self->sw_head)) {
                struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
@@ -167,6 +168,8 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                buff->pa = 0U;
                buff->eop_index = 0xffffU;
        }
+        return !!budget;
 }
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 965fae0fb6e0..ac1329f4051d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -153,7 +153,7 @@ void aq_ring_free(struct aq_ring_s *self);
 void aq_ring_update_queue_state(struct aq_ring_s *ring);
 void aq_ring_queue_wake(struct aq_ring_s *ring);
 void aq_ring_queue_stop(struct aq_ring_s *ring);
-void aq_ring_tx_clean(struct aq_ring_s *self);
+bool aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                     struct napi_struct *napi,
                     int *work_done,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index f890b8a5a862..d335c334fa56 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -35,12 +35,12 @@ struct aq_vec_s {
 static int aq_vec_poll(struct napi_struct *napi, int budget)
 {
        struct aq_vec_s *self = container_of(napi, struct aq_vec_s, napi);
+        unsigned int sw_tail_old = 0U;
        struct aq_ring_s *ring = NULL;
+        bool was_tx_cleaned = true;
+        unsigned int i = 0U;
        int work_done = 0;
        int err = 0;
-        unsigned int i = 0U;
-        unsigned int sw_tail_old = 0U;
-        bool was_tx_cleaned = false;
        if (!self) {
                err = -EINVAL;
@@ -57,9 +57,8 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                        if (ring[AQ_VEC_TX_ID].sw_head !=
                            ring[AQ_VEC_TX_ID].hw_head) {
-                                aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
+                                was_tx_cleaned = aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
                                aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
-                                was_tx_cleaned = true;
                        }
                        err = self->aq_hw_ops->hw_ring_rx_receive(self->aq_hw,
@@ -90,7 +89,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                        }
                }
-                if (was_tx_cleaned)
+                if (!was_tx_cleaned)
                        work_done = budget;
                if (work_done < budget) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 967f0fd07fcf..d3b847ec7465 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -21,6 +21,10 @@
 #define HW_ATL_UCP_0X370_REG    0x0370U
+#define HW_ATL_MIF_CMD          0x0200U
+#define HW_ATL_MIF_ADDR         0x0208U
+#define HW_ATL_MIF_VAL          0x020CU
 #define HW_ATL_FW_SM_RAM        0x2U
 #define HW_ATL_MPI_FW_VERSION   0x18
 #define HW_ATL_MPI_CONTROL_ADR  0x0368U
@@ -79,16 +83,15 @@ int hw_atl_utils_initfw(struct aq_hw_s *self, const struct aq_fw_ops **fw_ops)
 static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
 {
+        u32 gsr, val;
        int k = 0;
-        u32 gsr;
        aq_hw_write_reg(self, 0x404, 0x40e1);
        AQ_HW_SLEEP(50);
        /* Cleanup SPI */
-        aq_hw_write_reg(self, 0x534, 0xA0);
+        val = aq_hw_read_reg(self, 0x53C);
-        aq_hw_write_reg(self, 0x100, 0x9F);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
-        aq_hw_write_reg(self, 0x100, 0x809F);
        gsr = aq_hw_read_reg(self, HW_ATL_GLB_SOFT_RES_ADR);
        aq_hw_write_reg(self, HW_ATL_GLB_SOFT_RES_ADR, (gsr & 0xBFFF) | 0x8000);
@@ -97,7 +100,14 @@ static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
        aq_hw_write_reg(self, 0x404, 0x80e0);
        aq_hw_write_reg(self, 0x32a8, 0x0);
        aq_hw_write_reg(self, 0x520, 0x1);
+        /* Reset SPI again because of possible interrupted SPI burst */
+        val = aq_hw_read_reg(self, 0x53C);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
        AQ_HW_SLEEP(10);
+        /* Clear SPI reset state */
+        aq_hw_write_reg(self, 0x53C, val & ~0x10);
        aq_hw_write_reg(self, 0x404, 0x180e0);
        for (k = 0; k < 1000; k++) {
@@ -141,13 +151,15 @@ static int hw_atl_utils_soft_reset_flb(struct aq_hw_s *self)
                aq_pr_err("FW kickstart failed\n");
                return -EIO;
        }
+        /* Old FW requires fixed delay after init */
+        AQ_HW_SLEEP(15);
        return 0;
 }
 static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
 {
-        u32 gsr, rbl_status;
+        u32 gsr, val, rbl_status;
        int k;
        aq_hw_write_reg(self, 0x404, 0x40e1);
@@ -157,6 +169,10 @@ static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
        /* Alter RBL status */
        aq_hw_write_reg(self, 0x388, 0xDEAD);
+        /* Cleanup SPI */
+        val = aq_hw_read_reg(self, 0x53C);
+        aq_hw_write_reg(self, 0x53C, val | 0x10);
        /* Global software reset*/
        hw_atl_rx_rx_reg_res_dis_set(self, 0U);
        hw_atl_tx_tx_reg_res_dis_set(self, 0U);
@@ -204,6 +220,8 @@ static int hw_atl_utils_soft_reset_rbl(struct aq_hw_s *self)
                aq_pr_err("FW kickstart failed\n");
                return -EIO;
        }
+        /* Old FW requires fixed delay after init */
+        AQ_HW_SLEEP(15);
        return 0;
 }
@@ -255,18 +273,22 @@ int hw_atl_utils_fw_downld_dwords(struct aq_hw_s *self, u32 a,
                }
        }
-        aq_hw_write_reg(self, 0x00000208U, a);
+        aq_hw_write_reg(self, HW_ATL_MIF_ADDR, a);
-        for (++cnt; --cnt;) {
-                u32 i = 0U;
-                aq_hw_write_reg(self, 0x00000200U, 0x00008000U);
+        for (++cnt; --cnt && !err;) {
+                aq_hw_write_reg(self, HW_ATL_MIF_CMD, 0x00008000U);
-                for (i = 1024U;
+                if (IS_CHIP_FEATURE(REVISION_B1))
-                        (0x100U & aq_hw_read_reg(self, 0x00000200U)) && --i;) {
+                        AQ_HW_WAIT_FOR(a != aq_hw_read_reg(self,
-                }
+                                                           HW_ATL_MIF_ADDR),
+                                       1, 1000U);
+                else
+                        AQ_HW_WAIT_FOR(!(0x100 & aq_hw_read_reg(self,
+                                                           HW_ATL_MIF_CMD)),
+                                       1, 1000U);
-                *(p++) = aq_hw_read_reg(self, 0x0000020CU);
+                *(p++) = aq_hw_read_reg(self, HW_ATL_MIF_VAL);
+                a += 4;
        }
        hw_atl_reg_glb_cpu_sem_set(self, 1U, HW_ATL_FW_SM_RAM);
@@ -662,14 +684,18 @@ void hw_atl_utils_hw_chip_features_init(struct aq_hw_s *self, u32 *p)
        u32 val = hw_atl_reg_glb_mif_id_get(self);
        u32 mif_rev = val & 0xFFU;
-        if ((3U & mif_rev) == 1U) {
+        if ((0xFU & mif_rev) == 1U) {
-                chip_features |=
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_A0 |
-                        HAL_ATLANTIC_UTILS_CHIP_REVISION_A0 |
                        HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
                        HAL_ATLANTIC_UTILS_CHIP_MIPS;
-        } else if ((3U & mif_rev) == 2U) {
+        } else if ((0xFU & mif_rev) == 2U) {
-                chip_features |=
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_B0 |
-                        HAL_ATLANTIC_UTILS_CHIP_REVISION_B0 |
+                        HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
+                        HAL_ATLANTIC_UTILS_CHIP_MIPS |
+                        HAL_ATLANTIC_UTILS_CHIP_TPO2 |
+                        HAL_ATLANTIC_UTILS_CHIP_RPF2;
+        } else if ((0xFU & mif_rev) == 0xAU) {
+                chip_features |= HAL_ATLANTIC_UTILS_CHIP_REVISION_B1 |
                        HAL_ATLANTIC_UTILS_CHIP_MPI_AQ |
                        HAL_ATLANTIC_UTILS_CHIP_MIPS |
                        HAL_ATLANTIC_UTILS_CHIP_TPO2 |
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index 2c690947910a..cd8f18f39c61 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -161,6 +161,7 @@ struct __packed hw_aq_atl_utils_mbox {
 #define HAL_ATLANTIC_UTILS_CHIP_MPI_AQ       0x00000010U
 #define HAL_ATLANTIC_UTILS_CHIP_REVISION_A0  0x01000000U
 #define HAL_ATLANTIC_UTILS_CHIP_REVISION_B0  0x02000000U
+#define HAL_ATLANTIC_UTILS_CHIP_REVISION_B1  0x04000000U
 #define IS_CHIP_FEATURE(_F_) (HAL_ATLANTIC_UTILS_CHIP_##_F_ & \
        self->chip_features)
diff --git a/drivers/net/ethernet/aquantia/atlantic/ver.h b/drivers/net/ethernet/aquantia/atlantic/ver.h
index 5265b937677b..a445de6837a6 100644
--- a/drivers/net/ethernet/aquantia/atlantic/ver.h
+++ b/drivers/net/ethernet/aquantia/atlantic/ver.h
@@ -13,7 +13,7 @@
 #define NIC_MAJOR_DRIVER_VERSION           2
 #define NIC_MINOR_DRIVER_VERSION           0
 #define NIC_BUILD_DRIVER_VERSION           2
-#define NIC_REVISION_DRIVER_VERSION        0
+#define NIC_REVISION_DRIVER_VERSION        1
 #define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index 16f9bee992fe..0f6576802607 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -169,8 +169,10 @@ static int emac_rockchip_probe(struct platform_device *pdev)
        /* Optional regulator for PHY */
        priv->regulator = devm_regulator_get_optional(dev, "phy");
        if (IS_ERR(priv->regulator)) {
-                if (PTR_ERR(priv->regulator) == -EPROBE_DEFER)
+                if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) {
-                        return -EPROBE_DEFER;
+                        err = -EPROBE_DEFER;
+                        goto out_clk_disable;
+                }
                dev_err(dev, "no regulator found\n");
                priv->regulator = NULL;
        }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f15a8fc6dfc9..3fc549b88c43 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -855,10 +855,12 @@ static void bcm_sysport_tx_reclaim_one(struct bcm_sysport_tx_ring *ring,
 static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
                                             struct bcm_sysport_tx_ring *ring)
 {
-        unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs;
        unsigned int pkts_compl = 0, bytes_compl = 0;
        struct net_device *ndev = priv->netdev;
+        unsigned int txbds_processed = 0;
        struct bcm_sysport_cb *cb;
+        unsigned int txbds_ready;
+        unsigned int c_index;
        u32 hw_ind;
        /* Clear status before servicing to reduce spurious interrupts */
@@ -871,29 +873,23 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
        /* Compute how many descriptors have been processed since last call */
        hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));
        c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK;
-        ring->p_index = (hw_ind & RING_PROD_INDEX_MASK);
+        txbds_ready = (c_index - ring->c_index) & RING_CONS_INDEX_MASK;
-        last_c_index = ring->c_index;
-        num_tx_cbs = ring->size;
-        c_index &= (num_tx_cbs - 1);
-        if (c_index >= last_c_index)
-                last_tx_cn = c_index - last_c_index;
-        else
-                last_tx_cn = num_tx_cbs - last_c_index + c_index;
        netif_dbg(priv, tx_done, ndev,
-                  "ring=%d c_index=%d last_tx_cn=%d last_c_index=%d\n",
+                  "ring=%d old_c_index=%u c_index=%u txbds_ready=%u\n",
-                  ring->index, c_index, last_tx_cn, last_c_index);
+                  ring->index, ring->c_index, c_index, txbds_ready);
-        while (last_tx_cn-- > 0) {
+        while (txbds_processed < txbds_ready) {
-                cb = ring->cbs + last_c_index;
+                cb = &ring->cbs[ring->clean_index];
                bcm_sysport_tx_reclaim_one(ring, cb, &bytes_compl, &pkts_compl);
                ring->desc_count++;
-                last_c_index++;
+                txbds_processed++;
-                last_c_index &= (num_tx_cbs - 1);
+                if (likely(ring->clean_index < ring->size - 1))
+                        ring->clean_index++;
+                else
+                        ring->clean_index = 0;
        }
        u64_stats_update_begin(&priv->syncp);
@@ -1394,6 +1390,7 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
        netif_tx_napi_add(priv->netdev, &ring->napi, bcm_sysport_tx_poll, 64);
        ring->index = index;
        ring->size = size;
+        ring->clean_index = 0;
        ring->alloc_size = ring->size;
        ring->desc_cpu = p;
        ring->desc_count = ring->size;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index f5a984c1c986..19c91c76e327 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -706,7 +706,7 @@ struct bcm_sysport_tx_ring {
        unsigned int    desc_count;     /* Number of descriptors */
        unsigned int    curr_desc;      /* Current descriptor */
        unsigned int    c_index;        /* Last consumer index */
-        unsigned int    p_index;        /* Current producer index */
+        unsigned int    clean_index;    /* Current clean index */
        struct bcm_sysport_cb *cbs;     /* Transmit control blocks */
        struct dma_desc *desc_cpu;      /* CPU view of the descriptor */
        struct bcm_sysport_priv *priv;  /* private context backpointer */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 74fc9af4aadb..b8388e93520a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13913,7 +13913,7 @@ static void bnx2x_register_phc(struct bnx2x *bp)
        bp->ptp_clock = ptp_clock_register(&bp->ptp_clock_info, &bp->pdev->dev);
        if (IS_ERR(bp->ptp_clock)) {
                bp->ptp_clock = NULL;
-                BNX2X_ERR("PTP clock registeration failed\n");
+                BNX2X_ERR("PTP clock registration failed\n");
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 1500243b9886..c7e5e6f09647 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1439,7 +1439,7 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                u16 vlan_proto = tpa_info->metadata >>
                        RX_CMP_FLAGS2_METADATA_TPID_SFT;
-                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_VID_MASK;
+                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_TCI_MASK;
                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
        }
@@ -1623,7 +1623,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
             cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) &&
            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                u32 meta_data = le32_to_cpu(rxcmp1->rx_cmp_meta_data);
-                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_VID_MASK;
+                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_TCI_MASK;
                u16 vlan_proto = meta_data >> RX_CMP_FLAGS2_METADATA_TPID_SFT;
                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
@@ -3847,6 +3847,9 @@ static int bnxt_hwrm_vnic_set_tpa(struct bnxt *bp, u16 vnic_id, u32 tpa_flags)
        struct bnxt_vnic_info *vnic = &bp->vnic_info[vnic_id];
        struct hwrm_vnic_tpa_cfg_input req = {0};
+        if (vnic->fw_vnic_id == INVALID_HW_RING_ID)
+                return 0;
        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_VNIC_TPA_CFG, -1, -1);
        if (tpa_flags) {
@@ -4558,18 +4561,17 @@ int __bnxt_hwrm_get_tx_rings(struct bnxt *bp, u16 fid, int *tx_rings)
        return rc;
 }
-static int
+static void
-bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
+__bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, struct hwrm_func_cfg_input *req,
-                           int ring_grps, int cp_rings, int vnics)
+                             int tx_rings, int rx_rings, int ring_grps,
+                             int cp_rings, int vnics)
 {
-        struct hwrm_func_cfg_input req = {0};
        u32 enables = 0;
-        int rc;
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
+        bnxt_hwrm_cmd_hdr_init(bp, req, HWRM_FUNC_CFG, -1, -1);
-        req.fid = cpu_to_le16(0xffff);
+        req->fid = cpu_to_le16(0xffff);
        enables |= tx_rings ? FUNC_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
-        req.num_tx_rings = cpu_to_le16(tx_rings);
+        req->num_tx_rings = cpu_to_le16(tx_rings);
        if (bp->flags & BNXT_FLAG_NEW_RM) {
                enables |= rx_rings ? FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
                enables |= cp_rings ? FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
@@ -4578,16 +4580,53 @@ bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                           FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
                enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
-                req.num_rx_rings = cpu_to_le16(rx_rings);
+                req->num_rx_rings = cpu_to_le16(rx_rings);
-                req.num_hw_ring_grps = cpu_to_le16(ring_grps);
+                req->num_hw_ring_grps = cpu_to_le16(ring_grps);
-                req.num_cmpl_rings = cpu_to_le16(cp_rings);
+                req->num_cmpl_rings = cpu_to_le16(cp_rings);
-                req.num_stat_ctxs = req.num_cmpl_rings;
+                req->num_stat_ctxs = req->num_cmpl_rings;
-                req.num_vnics = cpu_to_le16(vnics);
+                req->num_vnics = cpu_to_le16(vnics);
        }
-        if (!enables)
+        req->enables = cpu_to_le32(enables);
+}
+static void
+__bnxt_hwrm_reserve_vf_rings(struct bnxt *bp,
+                             struct hwrm_func_vf_cfg_input *req, int tx_rings,
+                             int rx_rings, int ring_grps, int cp_rings,
+                             int vnics)
+{
+        u32 enables = 0;
+        bnxt_hwrm_cmd_hdr_init(bp, req, HWRM_FUNC_VF_CFG, -1, -1);
+        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
+        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
+        enables |= cp_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
+                              FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
+        enables |= ring_grps ? FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
+        enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
+        req->num_tx_rings = cpu_to_le16(tx_rings);
+        req->num_rx_rings = cpu_to_le16(rx_rings);
+        req->num_hw_ring_grps = cpu_to_le16(ring_grps);
+        req->num_cmpl_rings = cpu_to_le16(cp_rings);
+        req->num_stat_ctxs = req->num_cmpl_rings;
+        req->num_vnics = cpu_to_le16(vnics);
+        req->enables = cpu_to_le32(enables);
+}
+static int
+bnxt_hwrm_reserve_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
+                           int ring_grps, int cp_rings, int vnics)
+{
+        struct hwrm_func_cfg_input req = {0};
+        int rc;
+        __bnxt_hwrm_reserve_pf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
+        if (!req.enables)
                return 0;
-        req.enables = cpu_to_le32(enables);
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                return -ENOMEM;
@@ -4604,7 +4643,6 @@ bnxt_hwrm_reserve_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                           int ring_grps, int cp_rings, int vnics)
 {
        struct hwrm_func_vf_cfg_input req = {0};
-        u32 enables = 0;
        int rc;
        if (!(bp->flags & BNXT_FLAG_NEW_RM)) {
@@ -4612,22 +4650,8 @@ bnxt_hwrm_reserve_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                return 0;
        }
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_CFG, -1, -1);
+        __bnxt_hwrm_reserve_vf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
-        enables |= tx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS : 0;
+                                     cp_rings, vnics);
-        enables |= rx_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS : 0;
-        enables |= cp_rings ? FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                              FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS : 0;
-        enables |= ring_grps ? FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS : 0;
-        enables |= vnics ? FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS : 0;
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        req.num_rx_rings = cpu_to_le16(rx_rings);
-        req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-        req.num_cmpl_rings = cpu_to_le16(cp_rings);
-        req.num_stat_ctxs = req.num_cmpl_rings;
-        req.num_vnics = cpu_to_le16(vnics);
-        req.enables = cpu_to_le32(enables);
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                return -ENOMEM;
@@ -4743,39 +4767,25 @@ static bool bnxt_need_reserve_rings(struct bnxt *bp)
 }
 static int bnxt_hwrm_check_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                    int ring_grps, int cp_rings)
+                                    int ring_grps, int cp_rings, int vnics)
 {
        struct hwrm_func_vf_cfg_input req = {0};
-        u32 flags, enables;
+        u32 flags;
        int rc;
        if (!(bp->flags & BNXT_FLAG_NEW_RM))
                return 0;
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_CFG, -1, -1);
+        __bnxt_hwrm_reserve_vf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
+                                     cp_rings, vnics);
        flags = FUNC_VF_CFG_REQ_FLAGS_TX_ASSETS_TEST |
                FUNC_VF_CFG_REQ_FLAGS_RX_ASSETS_TEST |
                FUNC_VF_CFG_REQ_FLAGS_CMPL_ASSETS_TEST |
                FUNC_VF_CFG_REQ_FLAGS_RING_GRP_ASSETS_TEST |
                FUNC_VF_CFG_REQ_FLAGS_STAT_CTX_ASSETS_TEST |
                FUNC_VF_CFG_REQ_FLAGS_VNIC_ASSETS_TEST;
-        enables = FUNC_VF_CFG_REQ_ENABLES_NUM_TX_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_RX_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_STAT_CTXS |
-                  FUNC_VF_CFG_REQ_ENABLES_NUM_VNICS;
        req.flags = cpu_to_le32(flags);
-        req.enables = cpu_to_le32(enables);
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        req.num_rx_rings = cpu_to_le16(rx_rings);
-        req.num_cmpl_rings = cpu_to_le16(cp_rings);
-        req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-        req.num_stat_ctxs = cpu_to_le16(cp_rings);
-        req.num_vnics = cpu_to_le16(1);
-        if (bp->flags & BNXT_FLAG_RFS)
-                req.num_vnics = cpu_to_le16(rx_rings + 1);
        rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                return -ENOMEM;
@@ -4783,38 +4793,23 @@ static int bnxt_hwrm_check_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
 }
 static int bnxt_hwrm_check_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                    int ring_grps, int cp_rings)
+                                    int ring_grps, int cp_rings, int vnics)
 {
        struct hwrm_func_cfg_input req = {0};
-        u32 flags, enables;
+        u32 flags;
        int rc;
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
+        __bnxt_hwrm_reserve_pf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
-        req.fid = cpu_to_le16(0xffff);
+                                     cp_rings, vnics);
        flags = FUNC_CFG_REQ_FLAGS_TX_ASSETS_TEST;
-        enables = FUNC_CFG_REQ_ENABLES_NUM_TX_RINGS;
+        if (bp->flags & BNXT_FLAG_NEW_RM)
-        req.num_tx_rings = cpu_to_le16(tx_rings);
-        if (bp->flags & BNXT_FLAG_NEW_RM) {
                flags |= FUNC_CFG_REQ_FLAGS_RX_ASSETS_TEST |
                         FUNC_CFG_REQ_FLAGS_CMPL_ASSETS_TEST |
                         FUNC_CFG_REQ_FLAGS_RING_GRP_ASSETS_TEST |
                         FUNC_CFG_REQ_FLAGS_STAT_CTX_ASSETS_TEST |
                         FUNC_CFG_REQ_FLAGS_VNIC_ASSETS_TEST;
-                enables |= FUNC_CFG_REQ_ENABLES_NUM_RX_RINGS |
-                           FUNC_CFG_REQ_ENABLES_NUM_CMPL_RINGS |
-                           FUNC_CFG_REQ_ENABLES_NUM_HW_RING_GRPS |
-                           FUNC_CFG_REQ_ENABLES_NUM_STAT_CTXS |
-                           FUNC_CFG_REQ_ENABLES_NUM_VNICS;
-                req.num_rx_rings = cpu_to_le16(rx_rings);
-                req.num_cmpl_rings = cpu_to_le16(cp_rings);
-                req.num_hw_ring_grps = cpu_to_le16(ring_grps);
-                req.num_stat_ctxs = cpu_to_le16(cp_rings);
-                req.num_vnics = cpu_to_le16(1);
-                if (bp->flags & BNXT_FLAG_RFS)
-                        req.num_vnics = cpu_to_le16(rx_rings + 1);
-        }
        req.flags = cpu_to_le32(flags);
-        req.enables = cpu_to_le32(enables);
        rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                return -ENOMEM;
@@ -4822,17 +4817,17 @@ static int bnxt_hwrm_check_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
 }
 static int bnxt_hwrm_check_rings(struct bnxt *bp, int tx_rings, int rx_rings,
-                                 int ring_grps, int cp_rings)
+                                 int ring_grps, int cp_rings, int vnics)
 {
        if (bp->hwrm_spec_code < 0x10801)
                return 0;
        if (BNXT_PF(bp))
                return bnxt_hwrm_check_pf_rings(bp, tx_rings, rx_rings,
-                                                ring_grps, cp_rings);
+                                                ring_grps, cp_rings, vnics);
        return bnxt_hwrm_check_vf_rings(bp, tx_rings, rx_rings, ring_grps,
-                                        cp_rings);
+                                        cp_rings, vnics);
 }
 static void bnxt_hwrm_set_coal_params(struct bnxt_coal *hw_coal,
@@ -5865,7 +5860,6 @@ static int bnxt_init_msix(struct bnxt *bp)
                if (rc)
                        goto msix_setup_exit;
-                bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
                bp->cp_nr_rings = (min == 1) ?
                                  max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
                                  bp->tx_nr_rings + bp->rx_nr_rings;
@@ -5897,7 +5891,6 @@ static int bnxt_init_inta(struct bnxt *bp)
        bp->rx_nr_rings = 1;
        bp->tx_nr_rings = 1;
        bp->cp_nr_rings = 1;
-        bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
        bp->flags |= BNXT_FLAG_SHARED_RINGS;
        bp->irq_tbl[0].vector = bp->pdev->irq;
        return 0;
@@ -7531,7 +7524,7 @@ int bnxt_check_rings(struct bnxt *bp, int tx, int rx, bool sh, int tcs,
        int max_rx, max_tx, tx_sets = 1;
        int tx_rings_needed;
        int rx_rings = rx;
-        int cp, rc;
+        int cp, vnics, rc;
        if (tcs)
                tx_sets = tcs;
@@ -7547,10 +7540,15 @@ int bnxt_check_rings(struct bnxt *bp, int tx, int rx, bool sh, int tcs,
        if (max_tx < tx_rings_needed)
                return -ENOMEM;
+        vnics = 1;
+        if (bp->flags & BNXT_FLAG_RFS)
+                vnics += rx_rings;
        if (bp->flags & BNXT_FLAG_AGG_RINGS)
                rx_rings <<= 1;
        cp = sh ? max_t(int, tx_rings_needed, rx) : tx_rings_needed + rx;
-        return bnxt_hwrm_check_rings(bp, tx_rings_needed, rx_rings, rx, cp);
+        return bnxt_hwrm_check_rings(bp, tx_rings_needed, rx_rings, rx, cp,
+                                     vnics);
 }
 static void bnxt_unmap_bars(struct bnxt *bp, struct pci_dev *pdev)
@@ -8437,13 +8435,20 @@ int bnxt_restore_pf_fw_resources(struct bnxt *bp)
                return 0;
        bnxt_hwrm_func_qcaps(bp);
-        __bnxt_close_nic(bp, true, false);
+        if (netif_running(bp->dev))
+                __bnxt_close_nic(bp, true, false);
        bnxt_clear_int_mode(bp);
        rc = bnxt_init_int_mode(bp);
-        if (rc)
-                dev_close(bp->dev);
+        if (netif_running(bp->dev)) {
-        else
+                if (rc)
-                rc = bnxt_open_nic(bp, true, false);
+                        dev_close(bp->dev);
+                else
+                        rc = bnxt_open_nic(bp, true, false);
+        }
        return rc;
 }
@@ -8664,6 +8669,11 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc)
                goto init_err_pci_clean;
+        /* No TC has been set yet and rings may have been trimmed due to
+         * limited MSIX, so we re-initialize the TX rings per TC.
+         */
+        bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
        bnxt_get_wol_settings(bp);
        if (bp->flags & BNXT_FLAG_WOL_CAP)
                device_set_wakeup_enable(&pdev->dev, bp->wol);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 1989c470172c..5e3d62189cab 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -189,6 +189,7 @@ struct rx_cmp_ext {
        #define RX_CMP_FLAGS2_T_L4_CS_CALC                      (0x1 << 3)
        #define RX_CMP_FLAGS2_META_FORMAT_VLAN                  (0x1 << 4)
        __le32 rx_cmp_meta_data;
+        #define RX_CMP_FLAGS2_METADATA_TCI_MASK                 0xffff
        #define RX_CMP_FLAGS2_METADATA_VID_MASK                 0xfff
        #define RX_CMP_FLAGS2_METADATA_TPID_MASK                0xffff0000
         #define RX_CMP_FLAGS2_METADATA_TPID_SFT                 16
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index fbe6e208e17b..65c2cee35766 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -349,6 +349,9 @@ static int bnxt_hwrm_cfa_flow_free(struct bnxt *bp, __le16 flow_handle)
        if (rc)
                netdev_info(bp->dev, "Error: %s: flow_handle=0x%x rc=%d",
                            __func__, flow_handle, rc);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -484,13 +487,15 @@ static int bnxt_hwrm_cfa_flow_alloc(struct bnxt *bp, struct bnxt_tc_flow *flow,
        req.action_flags = cpu_to_le16(action_flags);
        mutex_lock(&bp->hwrm_cmd_lock);
        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (!rc)
                *flow_handle = resp->flow_handle;
        mutex_unlock(&bp->hwrm_cmd_lock);
+        if (rc == HWRM_ERR_CODE_RESOURCE_ALLOC_ERROR)
+                rc = -ENOSPC;
+        else if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -561,6 +566,8 @@ static int hwrm_cfa_decap_filter_alloc(struct bnxt *bp,
                netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
        mutex_unlock(&bp->hwrm_cmd_lock);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -576,6 +583,9 @@ static int hwrm_cfa_decap_filter_free(struct bnxt *bp,
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -624,6 +634,8 @@ static int hwrm_cfa_encap_record_alloc(struct bnxt *bp,
                netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
        mutex_unlock(&bp->hwrm_cmd_lock);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -639,6 +651,9 @@ static int hwrm_cfa_encap_record_free(struct bnxt *bp,
        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
        if (rc)
                netdev_info(bp->dev, "%s: Error rc=%d", __func__, rc);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
@@ -1269,11 +1284,8 @@ static int bnxt_tc_del_flow(struct bnxt *bp,
        flow_node = rhashtable_lookup_fast(&tc_info->flow_table,
                                           &tc_flow_cmd->cookie,
                                           tc_info->flow_ht_params);
-        if (!flow_node) {
+        if (!flow_node)
-                netdev_info(bp->dev, "ERROR: no flow_node for cookie %lx",
-                            tc_flow_cmd->cookie);
                return -EINVAL;
-        }
        return __bnxt_tc_del_flow(bp, flow_node);
 }
@@ -1290,11 +1302,8 @@ static int bnxt_tc_get_flow_stats(struct bnxt *bp,
        flow_node = rhashtable_lookup_fast(&tc_info->flow_table,
                                           &tc_flow_cmd->cookie,
                                           tc_info->flow_ht_params);
-        if (!flow_node) {
+        if (!flow_node)
-                netdev_info(bp->dev, "Error: no flow_node for cookie %lx",
-                            tc_flow_cmd->cookie);
                return -1;
-        }
        flow = &flow_node->flow;
        curr_stats = &flow->stats;
@@ -1344,8 +1353,10 @@ bnxt_hwrm_cfa_flow_stats_get(struct bnxt *bp, int num_flows,
        } else {
                netdev_info(bp->dev, "error rc=%d", rc);
        }
        mutex_unlock(&bp->hwrm_cmd_lock);
+        if (rc)
+                rc = -EIO;
        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index c1841db1b500..f2593978ae75 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
                tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
-                usleep_range(10, 20);
+                udelay(10);
                timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
        }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 99c9b88d6d34..e880be8e3c45 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5234,7 +5234,6 @@ static void cxgb4_mgmt_setup(struct net_device *dev)
        /* Initialize the device structure. */
        dev->netdev_ops = &cxgb4_mgmt_netdev_ops;
        dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops;
-        dev->needs_free_netdev = true;
 }
 static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
@@ -5445,6 +5444,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        adapter->name = pci_name(pdev);
        adapter->mbox = func;
        adapter->pf = func;
+        adapter->params.chip = chip;
+        adapter->adap_idx = adap_idx;
        adapter->msg_enable = DFLT_MSG_ENABLE;
        adapter->mbox_log = kzalloc(sizeof(*adapter->mbox_log) +
                                    (sizeof(struct mbox_cmd) *
diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 5eb999af2c40..bd3f6e4d1341 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -540,6 +540,7 @@ static int gmac_setup_txqs(struct net_device *netdev)
        if (port->txq_dma_base & ~DMA_Q_BASE_MASK) {
                dev_warn(geth->dev, "TX queue base it not aligned\n");
+                kfree(skb_tab);
                return -ENOMEM;
        }
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 159dc2df878d..fd43f98ddbe7 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2021,7 +2021,6 @@ static inline int dpaa_xmit(struct dpaa_priv *priv,
        }
        if (unlikely(err < 0)) {
-                percpu_stats->tx_errors++;
                percpu_stats->tx_fifo_errors++;
                return err;
        }
@@ -2289,7 +2288,6 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
        vaddr = phys_to_virt(addr);
        prefetch(vaddr + qm_fd_get_offset(fd));
-        fd_format = qm_fd_get_format(fd);
        /* The only FD types that we may receive are contig and S/G */
        WARN_ON((fd_format != qm_fd_contig) && (fd_format != qm_fd_sg));
@@ -2322,8 +2320,10 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
        skb_len = skb->len;
-        if (unlikely(netif_receive_skb(skb) == NET_RX_DROP))
+        if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) {
+                percpu_stats->rx_dropped++;
                return qman_cb_dqrr_consume;
+        }
        percpu_stats->rx_packets++;
        percpu_stats->rx_bytes += skb_len;
@@ -2871,7 +2871,7 @@ static int dpaa_remove(struct platform_device *pdev)
        struct device *dev;
        int err;
-        dev = &pdev->dev;
+        dev = pdev->dev.parent;
        net_dev = dev_get_drvdata(dev);
        priv = netdev_priv(net_dev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 7a7f3a42b2aa..d4604bc8eb5b 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3600,6 +3600,8 @@ fec_drv_remove(struct platform_device *pdev)
        fec_enet_mii_remove(fep);
        if (fep->reg_phy)
                regulator_disable(fep->reg_phy);
+        pm_runtime_put(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
        if (of_phy_is_fixed_link(np))
                of_phy_deregister_fixed_link(np);
        of_node_put(fep->phy_node);
diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
index 9a581faaa742..57b1e2b47c0a 100644
--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
@@ -1100,7 +1100,7 @@ int dtsec_add_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
        set_bucket(dtsec->regs, bucket, true);
        /* Create element to be added to the driver hash table */
-        hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
+        hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
        if (!hash_entry)
                return -ENOMEM;
        hash_entry->addr = addr;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 86944bc3b273..74bd260ca02a 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data)
 static int hns_gmac_get_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                return ARRAY_SIZE(g_gmac_stats_string);
        return 0;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index b62816c1574e..93e71e27401b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb)
 int hns_ppe_get_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                return ETH_PPE_STATIC_NUM;
        return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 6f3570cfb501..e2e28532e4dc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data)
 */
 int hns_rcb_get_ring_sset_count(int stringset)
 {
-        if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
+        if (stringset == ETH_SS_STATS)
                return HNS_RING_STATIC_REG_NUM;
        return 0;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 7ea7f8a4aa2a..2e14a3ae1d8b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset)
                        cnt--;
                return cnt;
-        } else {
+        } else if (stringset == ETH_SS_STATS) {
                return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset));
+        } else {
+                return -EOPNOTSUPP;
        }
 }
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index afb7ebe20b24..824fd44e25f0 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -400,6 +400,10 @@
 #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
 #define E1000_ICR_RXO           0x00000040 /* Receiver Overrun */
 #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_MDAC          0x00000200 /* MDIO Access Complete */
+#define E1000_ICR_SRPD          0x00010000 /* Small Receive Packet Detected */
+#define E1000_ICR_ACK           0x00020000 /* Receive ACK Frame Detected */
+#define E1000_ICR_MNG           0x00040000 /* Manageability Event Detected */
 #define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
 /* If this bit asserted, the driver should claim the interrupt */
 #define E1000_ICR_INT_ASSERTED  0x80000000
@@ -407,7 +411,7 @@
 #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
 #define E1000_ICR_TXQ0          0x00400000 /* Tx Queue 0 Interrupt */
 #define E1000_ICR_TXQ1          0x00800000 /* Tx Queue 1 Interrupt */
-#define E1000_ICR_OTHER         0x01000000 /* Other Interrupts */
+#define E1000_ICR_OTHER         0x01000000 /* Other Interrupt */
 /* PBA ECC Register */
 #define E1000_PBA_ECC_COUNTER_MASK  0xFFF00000 /* ECC counter mask */
@@ -431,12 +435,27 @@
        E1000_IMS_RXSEQ  |    \
        E1000_IMS_LSC)
+/* These are all of the events related to the OTHER interrupt.
+ */
+#define IMS_OTHER_MASK ( \
+        E1000_IMS_LSC  | \
+        E1000_IMS_RXO  | \
+        E1000_IMS_MDAC | \
+        E1000_IMS_SRPD | \
+        E1000_IMS_ACK  | \
+        E1000_IMS_MNG)
 /* Interrupt Mask Set */
 #define E1000_IMS_TXDW      E1000_ICR_TXDW      /* Transmit desc written back */
 #define E1000_IMS_LSC       E1000_ICR_LSC       /* Link Status Change */
 #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
 #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
+#define E1000_IMS_RXO       E1000_ICR_RXO       /* Receiver Overrun */
 #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
+#define E1000_IMS_MDAC      E1000_ICR_MDAC      /* MDIO Access Complete */
+#define E1000_IMS_SRPD      E1000_ICR_SRPD      /* Small Receive Packet */
+#define E1000_IMS_ACK       E1000_ICR_ACK       /* Receive ACK Frame Detected */
+#define E1000_IMS_MNG       E1000_ICR_MNG       /* Manageability Event */
 #define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
 #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
 #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 31277d3bb7dc..1dddfb7b2de6 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1367,9 +1367,6 @@ out:
 *  Checks to see of the link status of the hardware has changed.  If a
 *  change in link status has been detected, then we read the PHY registers
 *  to get the current speed/duplex if link exists.
- *
- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
- *  up).
 **/
 static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 {
@@ -1385,7 +1382,8 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         * Change or Rx Sequence Error interrupt.
         */
        if (!mac->get_link_status)
-                return 1;
+                return 0;
+        mac->get_link_status = false;
        /* First we want to see if the MII Status Register reports
         * link.  If so, then we want to get the current speed/duplex
@@ -1393,12 +1391,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         */
        ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
        if (ret_val)
-                return ret_val;
+                goto out;
        if (hw->mac.type == e1000_pchlan) {
                ret_val = e1000_k1_gig_workaround_hv(hw, link);
                if (ret_val)
-                        return ret_val;
+                        goto out;
        }
        /* When connected at 10Mbps half-duplex, some parts are excessively
@@ -1431,7 +1429,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                ret_val = hw->phy.ops.acquire(hw);
                if (ret_val)
-                        return ret_val;
+                        goto out;
                if (hw->mac.type == e1000_pch2lan)
                        emi_addr = I82579_RX_CONFIG;
@@ -1453,7 +1451,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                hw->phy.ops.release(hw);
                if (ret_val)
-                        return ret_val;
+                        goto out;
                if (hw->mac.type >= e1000_pch_spt) {
                        u16 data;
@@ -1462,14 +1460,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        if (speed == SPEED_1000) {
                                ret_val = hw->phy.ops.acquire(hw);
                                if (ret_val)
-                                        return ret_val;
+                                        goto out;
                                ret_val = e1e_rphy_locked(hw,
                                                          PHY_REG(776, 20),
                                                          &data);
                                if (ret_val) {
                                        hw->phy.ops.release(hw);
-                                        return ret_val;
+                                        goto out;
                                }
                                ptr_gap = (data & (0x3FF << 2)) >> 2;
@@ -1483,18 +1481,18 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                                }
                                hw->phy.ops.release(hw);
                                if (ret_val)
-                                        return ret_val;
+                                        goto out;
                        } else {
                                ret_val = hw->phy.ops.acquire(hw);
                                if (ret_val)
-                                        return ret_val;
+                                        goto out;
                                ret_val = e1e_wphy_locked(hw,
                                                          PHY_REG(776, 20),
                                                          0xC023);
                                hw->phy.ops.release(hw);
                                if (ret_val)
-                                        return ret_val;
+                                        goto out;
                        }
                }
@@ -1521,7 +1519,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
            (hw->adapter->pdev->device == E1000_DEV_ID_PCH_I218_V3)) {
                ret_val = e1000_k1_workaround_lpt_lp(hw, link);
                if (ret_val)
-                        return ret_val;
+                        goto out;
        }
        if (hw->mac.type >= e1000_pch_lpt) {
                /* Set platform power management values for
@@ -1529,7 +1527,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                 */
                ret_val = e1000_platform_pm_pch_lpt(hw, link);
                if (ret_val)
-                        return ret_val;
+                        goto out;
        }
        /* Clear link partner's EEE ability */
@@ -1552,9 +1550,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
        }
        if (!link)
-                return 0;       /* No link detected */
+                goto out;
-        mac->get_link_status = false;
        switch (hw->mac.type) {
        case e1000_pch2lan:
@@ -1616,12 +1612,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         * different link partner.
         */
        ret_val = e1000e_config_fc_after_link_up(hw);
-        if (ret_val) {
+        if (ret_val)
                e_dbg("Error configuring flow control\n");
-                return ret_val;
-        }
-        return 1;
+        return ret_val;
+out:
+        mac->get_link_status = true;
+        return ret_val;
 }
 static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
index f457c5703d0c..5bdc3a2d4fd7 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -410,9 +410,6 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw)
 *  Checks to see of the link status of the hardware has changed.  If a
 *  change in link status has been detected, then we read the PHY registers
 *  to get the current speed/duplex if link exists.
- *
- *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
- *  up).
 **/
 s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
 {
@@ -426,20 +423,16 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
         * Change or Rx Sequence Error interrupt.
         */
        if (!mac->get_link_status)
-                return 1;
+                return 0;
+        mac->get_link_status = false;
        /* First we want to see if the MII Status Register reports
         * link.  If so, then we want to get the current speed/duplex
         * of the PHY.
         */
        ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link);
-        if (ret_val)
+        if (ret_val || !link)
-                return ret_val;
+                goto out;
-        if (!link)
-                return 0;       /* No link detected */
-        mac->get_link_status = false;
        /* Check if there was DownShift, must be checked
         * immediately after link-up
@@ -464,12 +457,14 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
         * different link partner.
         */
        ret_val = e1000e_config_fc_after_link_up(hw);
-        if (ret_val) {
+        if (ret_val)
                e_dbg("Error configuring flow control\n");
-                return ret_val;
-        }
-        return 1;
+        return ret_val;
+out:
+        mac->get_link_status = true;
+        return ret_val;
 }
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 1298b69f990b..dc853b0863af 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1914,30 +1914,20 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data)
        struct net_device *netdev = data;
        struct e1000_adapter *adapter = netdev_priv(netdev);
        struct e1000_hw *hw = &adapter->hw;
-        u32 icr;
+        u32 icr = er32(ICR);
-        bool enable = true;
+        if (icr & adapter->eiac_mask)
-        icr = er32(ICR);
+                ew32(ICS, (icr & adapter->eiac_mask));
-        if (icr & E1000_ICR_RXO) {
-                ew32(ICR, E1000_ICR_RXO);
-                enable = false;
-                /* napi poll will re-enable Other, make sure it runs */
-                if (napi_schedule_prep(&adapter->napi)) {
-                        adapter->total_rx_bytes = 0;
-                        adapter->total_rx_packets = 0;
-                        __napi_schedule(&adapter->napi);
-                }
-        }
        if (icr & E1000_ICR_LSC) {
-                ew32(ICR, E1000_ICR_LSC);
                hw->mac.get_link_status = true;
                /* guard against interrupt when we're going down */
                if (!test_bit(__E1000_DOWN, &adapter->state))
                        mod_timer(&adapter->watchdog_timer, jiffies + 1);
        }
-        if (enable && !test_bit(__E1000_DOWN, &adapter->state))
+        if (!test_bit(__E1000_DOWN, &adapter->state))
-                ew32(IMS, E1000_IMS_OTHER);
+                ew32(IMS, E1000_IMS_OTHER | IMS_OTHER_MASK);
        return IRQ_HANDLED;
 }
@@ -2040,7 +2030,6 @@ static void e1000_configure_msix(struct e1000_adapter *adapter)
                       hw->hw_addr + E1000_EITR_82574(vector));
        else
                writel(1, hw->hw_addr + E1000_EITR_82574(vector));
-        adapter->eiac_mask |= E1000_IMS_OTHER;
        /* Cause Tx interrupts on every write back */
        ivar |= BIT(31);
@@ -2265,7 +2254,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
        if (adapter->msix_entries) {
                ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
-                ew32(IMS, adapter->eiac_mask | E1000_IMS_LSC);
+                ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER |
+                     IMS_OTHER_MASK);
        } else if (hw->mac.type >= e1000_pch_lpt) {
                ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
        } else {
@@ -2333,8 +2323,8 @@ static int e1000_alloc_ring_dma(struct e1000_adapter *adapter,
 {
        struct pci_dev *pdev = adapter->pdev;
-        ring->desc = dma_alloc_coherent(&pdev->dev, ring->size, &ring->dma,
+        ring->desc = dma_zalloc_coherent(&pdev->dev, ring->size, &ring->dma,
-                                        GFP_KERNEL);
+                                         GFP_KERNEL);
        if (!ring->desc)
                return -ENOMEM;
@@ -2707,8 +2697,7 @@ static int e1000e_poll(struct napi_struct *napi, int weight)
                napi_complete_done(napi, work_done);
                if (!test_bit(__E1000_DOWN, &adapter->state)) {
                        if (adapter->msix_entries)
-                                ew32(IMS, adapter->rx_ring->ims_val |
+                                ew32(IMS, adapter->rx_ring->ims_val);
-                                     E1000_IMS_OTHER);
                        else
                                e1000_irq_enable(adapter);
                }
@@ -5101,7 +5090,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
        case e1000_media_type_copper:
                if (hw->mac.get_link_status) {
                        ret_val = hw->mac.ops.check_for_link(hw);
-                        link_active = ret_val > 0;
+                        link_active = !hw->mac.get_link_status;
                } else {
                        link_active = true;
                }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 21d29f7936f6..d39b0b7011b2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -124,7 +124,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
                trigger_cmd_completions(dev);
        }
-        mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0);
+        mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 1);
        mlx5_core_err(dev, "end\n");
 unlock:
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
index ba338428ffd1..3c0d882ba183 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
@@ -443,6 +443,17 @@ int mlxsw_afa_block_jump(struct mlxsw_afa_block *block, u16 group_id)
 }
 EXPORT_SYMBOL(mlxsw_afa_block_jump);
+int mlxsw_afa_block_terminate(struct mlxsw_afa_block *block)
+{
+        if (block->finished)
+                return -EINVAL;
+        mlxsw_afa_set_goto_set(block->cur_set,
+                               MLXSW_AFA_SET_GOTO_BINDING_CMD_TERM, 0);
+        block->finished = true;
+        return 0;
+}
+EXPORT_SYMBOL(mlxsw_afa_block_terminate);
 static struct mlxsw_afa_fwd_entry *
 mlxsw_afa_fwd_entry_create(struct mlxsw_afa *mlxsw_afa, u8 local_port)
 {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
index 6dd601703c99..3a155d104384 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.h
@@ -67,6 +67,7 @@ char *mlxsw_afa_block_first_set(struct mlxsw_afa_block *block);
 u32 mlxsw_afa_block_first_set_kvdl_index(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_continue(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_jump(struct mlxsw_afa_block *block, u16 group_id);
+int mlxsw_afa_block_terminate(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_append_drop(struct mlxsw_afa_block *block);
 int mlxsw_afa_block_append_trap(struct mlxsw_afa_block *block, u16 trap_id);
 int mlxsw_afa_block_append_trap_and_forward(struct mlxsw_afa_block *block,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 92194a9b2caf..21bee8f19894 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -535,6 +535,7 @@ void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
                                u16 group_id);
+int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei);
 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
index 1c1601a43978..79b1fa27a9a4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
@@ -518,6 +518,11 @@ int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
        return mlxsw_afa_block_jump(rulei->act_block, group_id);
 }
+int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
+{
+        return mlxsw_afa_block_terminate(rulei->act_block);
+}
 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei)
 {
        return mlxsw_afa_block_append_drop(rulei->act_block);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 93728c694e6d..0a9adc5962fb 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -385,13 +385,13 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_sb_cms_egress[] = {
 static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = {
        MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0),
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_SB_CM(10000, 0, 0),
        MLXSW_SP_CPU_PORT_SB_CM,
        MLXSW_SP_CPU_PORT_SB_CM,
        MLXSW_SP_CPU_PORT_SB_CM,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 6ce00e28d4ea..89dbf569dff5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -65,7 +65,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
        tcf_exts_to_list(exts, &actions);
        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_ok(a)) {
-                        err = mlxsw_sp_acl_rulei_act_continue(rulei);
+                        err = mlxsw_sp_acl_rulei_act_terminate(rulei);
                        if (err)
                                return err;
                } else if (is_tcf_gact_shot(a)) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
index 948aceb512c5..4b87ec20e658 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
@@ -51,6 +51,9 @@ struct mlxsw_sp_span_inspected_port {
        struct list_head list;
        enum mlxsw_sp_span_type type;
        u8 local_port;
+        /* Whether this is a directly bound mirror (port-to-port) or an ACL. */
+        bool bound;
 };
 struct mlxsw_sp_span_parms {
diff --git a/drivers/net/ethernet/natsemi/Kconfig b/drivers/net/ethernet/natsemi/Kconfig
index a10ef50e4f12..017fb2322589 100644
--- a/drivers/net/ethernet/natsemi/Kconfig
+++ b/drivers/net/ethernet/natsemi/Kconfig
@@ -1,16 +1,16 @@
 #
-# National Semi-conductor device configuration
+# National Semiconductor device configuration
 #
 config NET_VENDOR_NATSEMI
-        bool "National Semi-conductor devices"
+        bool "National Semiconductor devices"
        default y
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y.
          Note that the answer to this question doesn't directly affect the
          kernel: saying N will just cause the configurator to skip all
-          the questions about National Semi-conductor devices. If you say Y,
+          the questions about National Semiconductor devices. If you say Y,
          you will be asked for your specific card in the following questions.
 if NET_VENDOR_NATSEMI
diff --git a/drivers/net/ethernet/natsemi/Makefile b/drivers/net/ethernet/natsemi/Makefile
index cc664977596e..a759aa09ef59 100644
--- a/drivers/net/ethernet/natsemi/Makefile
+++ b/drivers/net/ethernet/natsemi/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 #
-# Makefile for the National Semi-conductor Sonic devices.
+# Makefile for the National Semiconductor Sonic devices.
 #
 obj-$(CONFIG_MACSONIC) += macsonic.o
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index 6f546e869d8d..00f41c145d4d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -2480,7 +2480,10 @@ int qed_cxt_free_proto_ilt(struct qed_hwfn *p_hwfn, enum protocol_type proto)
        if (rc)
                return rc;
-        /* Free Task CXT */
+        /* Free Task CXT ( Intentionally RoCE as task-id is shared between
+         * RoCE and iWARP )
+         */
+        proto = PROTOCOLID_ROCE;
        rc = qed_cxt_free_ilt_range(p_hwfn, QED_ELEM_TASK, 0,
                                    qed_cxt_get_proto_tid_count(p_hwfn, proto));
        if (rc)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index 03ad4eeac7f8..69051e98aff9 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1703,6 +1703,13 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
        iph = (struct iphdr *)((u8 *)(ethh) + eth_hlen);
        if (eth_type == ETH_P_IP) {
+                if (iph->protocol != IPPROTO_TCP) {
+                        DP_NOTICE(p_hwfn,
+                                  "Unexpected ip protocol on ll2 %x\n",
+                                  iph->protocol);
+                        return -EINVAL;
+                }
                cm_info->local_ip[0] = ntohl(iph->daddr);
                cm_info->remote_ip[0] = ntohl(iph->saddr);
                cm_info->ip_version = TCP_IPV4;
@@ -1711,6 +1718,14 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
                *payload_len = ntohs(iph->tot_len) - ip_hlen;
        } else if (eth_type == ETH_P_IPV6) {
                ip6h = (struct ipv6hdr *)iph;
+                if (ip6h->nexthdr != IPPROTO_TCP) {
+                        DP_NOTICE(p_hwfn,
+                                  "Unexpected ip protocol on ll2 %x\n",
+                                  iph->protocol);
+                        return -EINVAL;
+                }
                for (i = 0; i < 4; i++) {
                        cm_info->local_ip[i] =
                            ntohl(ip6h->daddr.in6_u.u6_addr32[i]);
@@ -1928,8 +1943,8 @@ qed_iwarp_update_fpdu_length(struct qed_hwfn *p_hwfn,
                /* Missing lower byte is now available */
                mpa_len = fpdu->fpdu_length | *mpa_data;
                fpdu->fpdu_length = QED_IWARP_FPDU_LEN_WITH_PAD(mpa_len);
-                fpdu->mpa_frag_len = fpdu->fpdu_length;
                /* one byte of hdr */
+                fpdu->mpa_frag_len = 1;
                fpdu->incomplete_bytes = fpdu->fpdu_length - 1;
                DP_VERBOSE(p_hwfn,
                           QED_MSG_RDMA,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index 5d040b873137..a411f9c702a1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -379,6 +379,7 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)
        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
        qed_rdma_free_reserved_lkey(p_hwfn);
+        qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
        qed_rdma_resc_free(p_hwfn);
 }
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 2db70eabddfe..a01e7d6e5442 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -288,7 +288,7 @@ int __init qede_init(void)
        }
        /* Must register notifier before pci ops, since we might miss
-         * interface rename after pci probe and netdev registeration.
+         * interface rename after pci probe and netdev registration.
         */
        ret = register_netdevice_notifier(&qede_netdev_notifier);
        if (ret) {
@@ -988,7 +988,7 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
        if (rc)
                goto err3;
-        /* Prepare the lock prior to the registeration of the netdev,
+        /* Prepare the lock prior to the registration of the netdev,
         * as once it's registered we might reach flows requiring it
         * [it's even possible to reach a flow needing it directly
         * from there, although it's unlikely].
@@ -2067,8 +2067,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode,
        link_params.link_up = true;
        edev->ops->common->set_link(edev->cdev, &link_params);
-        qede_rdma_dev_event_open(edev);
        edev->state = QEDE_STATE_OPEN;
        DP_INFO(edev, "Ending successfully qede load\n");
@@ -2169,12 +2167,14 @@ static void qede_link_update(void *dev, struct qed_link_output *link)
                        DP_NOTICE(edev, "Link is up\n");
                        netif_tx_start_all_queues(edev->ndev);
                        netif_carrier_on(edev->ndev);
+                        qede_rdma_dev_event_open(edev);
                }
        } else {
                if (netif_carrier_ok(edev->ndev)) {
                        DP_NOTICE(edev, "Link is down\n");
                        netif_tx_disable(edev->ndev);
                        netif_carrier_off(edev->ndev);
+                        qede_rdma_dev_event_close(edev);
                }
        }
 }
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
index 9b2280badaf7..02adb513f475 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
@@ -485,7 +485,7 @@ int qede_ptp_enable(struct qede_dev *edev, bool init_tc)
        ptp->clock = ptp_clock_register(&ptp->clock_info, &edev->pdev->dev);
        if (IS_ERR(ptp->clock)) {
                rc = -EINVAL;
-                DP_ERR(edev, "PTP clock registeration failed\n");
+                DP_ERR(edev, "PTP clock registration failed\n");
                goto err2;
        }
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 9cbb27263742..d5a32b7c7dc5 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -1194,9 +1194,9 @@ void emac_mac_tx_process(struct emac_adapter *adpt, struct emac_tx_queue *tx_q)
        while (tx_q->tpd.consume_idx != hw_consume_idx) {
                tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.consume_idx);
                if (tpbuf->dma_addr) {
-                        dma_unmap_single(adpt->netdev->dev.parent,
+                        dma_unmap_page(adpt->netdev->dev.parent,
-                                         tpbuf->dma_addr, tpbuf->length,
+                                       tpbuf->dma_addr, tpbuf->length,
-                                         DMA_TO_DEVICE);
+                                       DMA_TO_DEVICE);
                        tpbuf->dma_addr = 0;
                }
@@ -1353,9 +1353,11 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
                tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
                tpbuf->length = mapped_len;
-                tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
+                tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
-                                                 skb->data, tpbuf->length,
+                                               virt_to_page(skb->data),
-                                                 DMA_TO_DEVICE);
+                                               offset_in_page(skb->data),
+                                               tpbuf->length,
+                                               DMA_TO_DEVICE);
                ret = dma_mapping_error(adpt->netdev->dev.parent,
                                        tpbuf->dma_addr);
                if (ret)
@@ -1371,9 +1373,12 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
        if (mapped_len < len) {
                tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
                tpbuf->length = len - mapped_len;
-                tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
+                tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
-                                                 skb->data + mapped_len,
+                                               virt_to_page(skb->data +
-                                                 tpbuf->length, DMA_TO_DEVICE);
+                                                            mapped_len),
+                                               offset_in_page(skb->data +
+                                                              mapped_len),
+                                               tpbuf->length, DMA_TO_DEVICE);
                ret = dma_mapping_error(adpt->netdev->dev.parent,
                                        tpbuf->dma_addr);
                if (ret)
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 012fb66eed8d..f0afb88d7bc2 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
        pdata = netdev_priv(dev);
        BUG_ON(!pdata);
        BUG_ON(!pdata->ioaddr);
-        WARN_ON(dev->phydev);
        SMSC_TRACE(pdata, ifdown, "Stopping driver");
+        unregister_netdev(dev);
        mdiobus_unregister(pdata->mii_bus);
        mdiobus_free(pdata->mii_bus);
-        unregister_netdev(dev);
        res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                           "smsc911x-memory");
        if (!res)
diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
index 111e7ca9df56..f5c5984afefb 100644
--- a/drivers/net/ethernet/socionext/sni_ave.c
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -1295,7 +1295,7 @@ static int ave_open(struct net_device *ndev)
        val |= AVE_IIRQC_EN0 | (AVE_INTM_COUNT << 16);
        writel(val, priv->base + AVE_IIRQC);
-        val = AVE_GI_RXIINT | AVE_GI_RXOVF | AVE_GI_TX;
+        val = AVE_GI_RXIINT | AVE_GI_RXOVF | AVE_GI_TX | AVE_GI_RXDROP;
        ave_irq_restore(ndev, val);
        napi_enable(&priv->napi_rx);
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 63d3d6b215f3..a94f50442613 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -312,7 +312,7 @@ static struct vnet *vnet_new(const u64 *local_mac,
        dev->ethtool_ops = &vnet_ethtool_ops;
        dev->watchdog_timeo = VNET_TX_TIMEOUT;
-        dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_GSO_SOFTWARE |
+        dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_ALL_TSO |
                           NETIF_F_HW_CSUM | NETIF_F_SG;
        dev->features = dev->hw_features;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 8af8891078e2..1b4af54a4968 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1075,7 +1075,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                /* set speed_in input in case RMII mode is used in 100Mbps */
                if (phy->speed == 100)
                        mac_control |= BIT(15);
-                else if (phy->speed == 10)
+                /* in band mode only works in 10Mbps RGMII mode */
+                else if ((phy->speed == 10) && phy_interface_is_rgmii(phy))
                        mac_control |= BIT(18); /* In Band mode */
                if (priv->rx_pause)
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 0db3bd1ea06f..32861036c3fc 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -173,6 +173,7 @@ struct rndis_device {
        struct list_head req_list;
        struct work_struct mcast_work;
+        u32 filter;
        bool link_state;        /* 0 - link up, 1 - link down */
@@ -211,7 +212,6 @@ void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
 void rndis_set_subchannel(struct work_struct *w);
-bool rndis_filter_opened(const struct netvsc_device *nvdev);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index aa95e81af6e5..4123d081b1c7 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -93,6 +93,11 @@ static void free_netvsc_device(struct rcu_head *head)
                = container_of(head, struct netvsc_device, rcu);
        int i;
+        kfree(nvdev->extension);
+        vfree(nvdev->recv_buf);
+        vfree(nvdev->send_buf);
+        kfree(nvdev->send_section_map);
        for (i = 0; i < VRSS_CHANNEL_MAX; i++)
                vfree(nvdev->chan_table[i].mrc.slots);
@@ -218,12 +223,6 @@ static void netvsc_teardown_gpadl(struct hv_device *device,
                net_device->recv_buf_gpadl_handle = 0;
        }
-        if (net_device->recv_buf) {
-                /* Free up the receive buffer */
-                vfree(net_device->recv_buf);
-                net_device->recv_buf = NULL;
-        }
        if (net_device->send_buf_gpadl_handle) {
                ret = vmbus_teardown_gpadl(device->channel,
                                           net_device->send_buf_gpadl_handle);
@@ -238,12 +237,6 @@ static void netvsc_teardown_gpadl(struct hv_device *device,
                }
                net_device->send_buf_gpadl_handle = 0;
        }
-        if (net_device->send_buf) {
-                /* Free up the send buffer */
-                vfree(net_device->send_buf);
-                net_device->send_buf = NULL;
-        }
-        kfree(net_device->send_section_map);
 }
 int netvsc_alloc_recv_comp_ring(struct netvsc_device *net_device, u32 q_idx)
@@ -580,26 +573,29 @@ void netvsc_device_remove(struct hv_device *device)
                = rtnl_dereference(net_device_ctx->nvdev);
        int i;
-        cancel_work_sync(&net_device->subchan_work);
        netvsc_revoke_buf(device, net_device);
        RCU_INIT_POINTER(net_device_ctx->nvdev, NULL);
+        /* And disassociate NAPI context from device */
+        for (i = 0; i < net_device->num_chn; i++)
+                netif_napi_del(&net_device->chan_table[i].napi);
        /*
         * At this point, no one should be accessing net_device
         * except in here
         */
        netdev_dbg(ndev, "net device safe to remove\n");
+        /* older versions require that buffer be revoked before close */
+        if (net_device->nvsp_version < NVSP_PROTOCOL_VERSION_4)
+                netvsc_teardown_gpadl(device, net_device);
        /* Now, we can close the channel safely */
        vmbus_close(device->channel);
-        netvsc_teardown_gpadl(device, net_device);
+        if (net_device->nvsp_version >= NVSP_PROTOCOL_VERSION_4)
+                netvsc_teardown_gpadl(device, net_device);
-        /* And dissassociate NAPI context from device */
-        for (i = 0; i < net_device->num_chn; i++)
-                netif_napi_del(&net_device->chan_table[i].napi);
        /* Release all resources */
        free_netvsc_device_rcu(net_device);
@@ -663,14 +659,18 @@ static void netvsc_send_tx_complete(struct netvsc_device *net_device,
        queue_sends =
                atomic_dec_return(&net_device->chan_table[q_idx].queue_sends);
-        if (net_device->destroy && queue_sends == 0)
+        if (unlikely(net_device->destroy)) {
-                wake_up(&net_device->wait_drain);
+                if (queue_sends == 0)
+                        wake_up(&net_device->wait_drain);
+        } else {
+                struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
-        if (netif_tx_queue_stopped(netdev_get_tx_queue(ndev, q_idx)) &&
+                if (netif_tx_queue_stopped(txq) &&
-            (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER ||
+                    (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER ||
-             queue_sends < 1)) {
+                     queue_sends < 1)) {
-                netif_tx_wake_queue(netdev_get_tx_queue(ndev, q_idx));
+                        netif_tx_wake_queue(txq);
-                ndev_ctx->eth_stats.wake_queue++;
+                        ndev_ctx->eth_stats.wake_queue++;
+                }
        }
 }
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index cdb78eefab67..f28c85d212ce 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -46,7 +46,10 @@
 #include "hyperv_net.h"
-#define RING_SIZE_MIN           64
+#define RING_SIZE_MIN   64
+#define RETRY_US_LO     5000
+#define RETRY_US_HI     10000
+#define RETRY_MAX       2000    /* >10 sec */
 #define LINKCHANGE_INT (2 * HZ)
 #define VF_TAKEOVER_INT (HZ / 10)
@@ -89,15 +92,20 @@ static void netvsc_change_rx_flags(struct net_device *net, int change)
 static void netvsc_set_rx_mode(struct net_device *net)
 {
        struct net_device_context *ndev_ctx = netdev_priv(net);
-        struct net_device *vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev);
+        struct net_device *vf_netdev;
-        struct netvsc_device *nvdev = rtnl_dereference(ndev_ctx->nvdev);
+        struct netvsc_device *nvdev;
+        rcu_read_lock();
+        vf_netdev = rcu_dereference(ndev_ctx->vf_netdev);
        if (vf_netdev) {
                dev_uc_sync(vf_netdev, net);
                dev_mc_sync(vf_netdev, net);
        }
-        rndis_filter_update(nvdev);
+        nvdev = rcu_dereference(ndev_ctx->nvdev);
+        if (nvdev)
+                rndis_filter_update(nvdev);
+        rcu_read_unlock();
 }
 static int netvsc_open(struct net_device *net)
@@ -118,10 +126,8 @@ static int netvsc_open(struct net_device *net)
        }
        rdev = nvdev->extension;
-        if (!rdev->link_state) {
+        if (!rdev->link_state)
                netif_carrier_on(net);
-                netif_tx_wake_all_queues(net);
-        }
        if (vf_netdev) {
                /* Setting synthetic device up transparently sets
@@ -137,36 +143,25 @@ static int netvsc_open(struct net_device *net)
        return 0;
 }
-static int netvsc_close(struct net_device *net)
+static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
 {
-        struct net_device_context *net_device_ctx = netdev_priv(net);
+        unsigned int retry = 0;
-        struct net_device *vf_netdev
+        int i;
-                = rtnl_dereference(net_device_ctx->vf_netdev);
-        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
-        int ret = 0;
-        u32 aread, i, msec = 10, retry = 0, retry_max = 20;
-        struct vmbus_channel *chn;
-        netif_tx_disable(net);
-        /* No need to close rndis filter if it is removed already */
-        if (!nvdev)
-                goto out;
-        ret = rndis_filter_close(nvdev);
-        if (ret != 0) {
-                netdev_err(net, "unable to close device (ret %d).\n", ret);
-                return ret;
-        }
        /* Ensure pending bytes in ring are read */
-        while (true) {
+        for (;;) {
-                aread = 0;
+                u32 aread = 0;
                for (i = 0; i < nvdev->num_chn; i++) {
-                        chn = nvdev->chan_table[i].channel;
+                        struct vmbus_channel *chn
+                                = nvdev->chan_table[i].channel;
                        if (!chn)
                                continue;
+                        /* make sure receive not running now */
+                        napi_synchronize(&nvdev->chan_table[i].napi);
                        aread = hv_get_bytes_to_read(&chn->inbound);
                        if (aread)
                                break;
@@ -176,22 +171,40 @@ static int netvsc_close(struct net_device *net)
                                break;
                }
-                retry++;
+                if (aread == 0)
-                if (retry > retry_max || aread == 0)
+                        return 0;
-                        break;
-                msleep(msec);
+                if (++retry > RETRY_MAX)
+                        return -ETIMEDOUT;
-                if (msec < 1000)
+                usleep_range(RETRY_US_LO, RETRY_US_HI);
-                        msec *= 2;
        }
+}
-        if (aread) {
+static int netvsc_close(struct net_device *net)
-                netdev_err(net, "Ring buffer not empty after closing rndis\n");
+{
-                ret = -ETIMEDOUT;
+        struct net_device_context *net_device_ctx = netdev_priv(net);
+        struct net_device *vf_netdev
+                = rtnl_dereference(net_device_ctx->vf_netdev);
+        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+        int ret;
+        netif_tx_disable(net);
+        /* No need to close rndis filter if it is removed already */
+        if (!nvdev)
+                return 0;
+        ret = rndis_filter_close(nvdev);
+        if (ret != 0) {
+                netdev_err(net, "unable to close device (ret %d).\n", ret);
+                return ret;
        }
-out:
+        ret = netvsc_wait_until_empty(nvdev);
+        if (ret)
+                netdev_err(net, "Ring buffer not empty after closing rndis\n");
        if (vf_netdev)
                dev_close(vf_netdev);
@@ -840,16 +853,81 @@ static void netvsc_get_channels(struct net_device *net,
        }
 }
+static int netvsc_detach(struct net_device *ndev,
+                         struct netvsc_device *nvdev)
+{
+        struct net_device_context *ndev_ctx = netdev_priv(ndev);
+        struct hv_device *hdev = ndev_ctx->device_ctx;
+        int ret;
+        /* Don't try continuing to try and setup sub channels */
+        if (cancel_work_sync(&nvdev->subchan_work))
+                nvdev->num_chn = 1;
+        /* If device was up (receiving) then shutdown */
+        if (netif_running(ndev)) {
+                netif_tx_disable(ndev);
+                ret = rndis_filter_close(nvdev);
+                if (ret) {
+                        netdev_err(ndev,
+                                   "unable to close device (ret %d).\n", ret);
+                        return ret;
+                }
+                ret = netvsc_wait_until_empty(nvdev);
+                if (ret) {
+                        netdev_err(ndev,
+                                   "Ring buffer not empty after closing rndis\n");
+                        return ret;
+                }
+        }
+        netif_device_detach(ndev);
+        rndis_filter_device_remove(hdev, nvdev);
+        return 0;
+}
+static int netvsc_attach(struct net_device *ndev,
+                         struct netvsc_device_info *dev_info)
+{
+        struct net_device_context *ndev_ctx = netdev_priv(ndev);
+        struct hv_device *hdev = ndev_ctx->device_ctx;
+        struct netvsc_device *nvdev;
+        struct rndis_device *rdev;
+        int ret;
+        nvdev = rndis_filter_device_add(hdev, dev_info);
+        if (IS_ERR(nvdev))
+                return PTR_ERR(nvdev);
+        /* Note: enable and attach happen when sub-channels setup */
+        netif_carrier_off(ndev);
+        if (netif_running(ndev)) {
+                ret = rndis_filter_open(nvdev);
+                if (ret)
+                        return ret;
+                rdev = nvdev->extension;
+                if (!rdev->link_state)
+                        netif_carrier_on(ndev);
+        }
+        return 0;
+}
 static int netvsc_set_channels(struct net_device *net,
                               struct ethtool_channels *channels)
 {
        struct net_device_context *net_device_ctx = netdev_priv(net);
-        struct hv_device *dev = net_device_ctx->device_ctx;
        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
        unsigned int orig, count = channels->combined_count;
        struct netvsc_device_info device_info;
-        bool was_opened;
+        int ret;
-        int ret = 0;
        /* We do not support separate count for rx, tx, or other */
        if (count == 0 ||
@@ -866,9 +944,6 @@ static int netvsc_set_channels(struct net_device *net,
                return -EINVAL;
        orig = nvdev->num_chn;
-        was_opened = rndis_filter_opened(nvdev);
-        if (was_opened)
-                rndis_filter_close(nvdev);
        memset(&device_info, 0, sizeof(device_info));
        device_info.num_chn = count;
@@ -877,28 +952,17 @@ static int netvsc_set_channels(struct net_device *net,
        device_info.recv_sections = nvdev->recv_section_cnt;
        device_info.recv_section_size = nvdev->recv_section_size;
-        rndis_filter_device_remove(dev, nvdev);
+        ret = netvsc_detach(net, nvdev);
+        if (ret)
+                return ret;
-        nvdev = rndis_filter_device_add(dev, &device_info);
+        ret = netvsc_attach(net, &device_info);
-        if (IS_ERR(nvdev)) {
+        if (ret) {
-                ret = PTR_ERR(nvdev);
                device_info.num_chn = orig;
-                nvdev = rndis_filter_device_add(dev, &device_info);
+                if (netvsc_attach(net, &device_info))
+                        netdev_err(net, "restoring channel setting failed\n");
-                if (IS_ERR(nvdev)) {
-                        netdev_err(net, "restoring channel setting failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
        }
-        if (was_opened)
-                rndis_filter_open(nvdev);
-        /* We may have missed link change notifications */
-        net_device_ctx->last_reconfig = 0;
-        schedule_delayed_work(&net_device_ctx->dwork, 0);
        return ret;
 }
@@ -964,10 +1028,8 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
        struct net_device_context *ndevctx = netdev_priv(ndev);
        struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct hv_device *hdev = ndevctx->device_ctx;
        int orig_mtu = ndev->mtu;
        struct netvsc_device_info device_info;
-        bool was_opened;
        int ret = 0;
        if (!nvdev || nvdev->destroy)
@@ -980,11 +1042,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                        return ret;
        }
-        netif_device_detach(ndev);
-        was_opened = rndis_filter_opened(nvdev);
-        if (was_opened)
-                rndis_filter_close(nvdev);
        memset(&device_info, 0, sizeof(device_info));
        device_info.num_chn = nvdev->num_chn;
        device_info.send_sections = nvdev->send_section_cnt;
@@ -992,35 +1049,27 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
        device_info.recv_sections = nvdev->recv_section_cnt;
        device_info.recv_section_size = nvdev->recv_section_size;
-        rndis_filter_device_remove(hdev, nvdev);
+        ret = netvsc_detach(ndev, nvdev);
+        if (ret)
+                goto rollback_vf;
        ndev->mtu = mtu;
-        nvdev = rndis_filter_device_add(hdev, &device_info);
+        ret = netvsc_attach(ndev, &device_info);
-        if (IS_ERR(nvdev)) {
+        if (ret)
-                ret = PTR_ERR(nvdev);
+                goto rollback;
-                /* Attempt rollback to original MTU */
-                ndev->mtu = orig_mtu;
-                nvdev = rndis_filter_device_add(hdev, &device_info);
-                if (vf_netdev)
-                        dev_set_mtu(vf_netdev, orig_mtu);
-                if (IS_ERR(nvdev)) {
-                        netdev_err(ndev, "restoring mtu failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
-        }
-        if (was_opened)
+        return 0;
-                rndis_filter_open(nvdev);
-        netif_device_attach(ndev);
+rollback:
+        /* Attempt rollback to original MTU */
+        ndev->mtu = orig_mtu;
-        /* We may have missed link change notifications */
+        if (netvsc_attach(ndev, &device_info))
-        schedule_delayed_work(&ndevctx->dwork, 0);
+                netdev_err(ndev, "restoring mtu failed\n");
+rollback_vf:
+        if (vf_netdev)
+                dev_set_mtu(vf_netdev, orig_mtu);
        return ret;
 }
@@ -1526,11 +1575,9 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
        struct net_device_context *ndevctx = netdev_priv(ndev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct hv_device *hdev = ndevctx->device_ctx;
        struct netvsc_device_info device_info;
        struct ethtool_ringparam orig;
        u32 new_tx, new_rx;
-        bool was_opened;
        int ret = 0;
        if (!nvdev || nvdev->destroy)
@@ -1555,34 +1602,18 @@ static int netvsc_set_ringparam(struct net_device *ndev,
        device_info.recv_sections = new_rx;
        device_info.recv_section_size = nvdev->recv_section_size;
-        netif_device_detach(ndev);
+        ret = netvsc_detach(ndev, nvdev);
-        was_opened = rndis_filter_opened(nvdev);
+        if (ret)
-        if (was_opened)
+                return ret;
-                rndis_filter_close(nvdev);
-        rndis_filter_device_remove(hdev, nvdev);
-        nvdev = rndis_filter_device_add(hdev, &device_info);
-        if (IS_ERR(nvdev)) {
-                ret = PTR_ERR(nvdev);
+        ret = netvsc_attach(ndev, &device_info);
+        if (ret) {
                device_info.send_sections = orig.tx_pending;
                device_info.recv_sections = orig.rx_pending;
-                nvdev = rndis_filter_device_add(hdev, &device_info);
-                if (IS_ERR(nvdev)) {
-                        netdev_err(ndev, "restoring ringparam failed: %ld\n",
-                                   PTR_ERR(nvdev));
-                        return ret;
-                }
-        }
-        if (was_opened)
-                rndis_filter_open(nvdev);
-        netif_device_attach(ndev);
-        /* We may have missed link change notifications */
+                if (netvsc_attach(ndev, &device_info))
-        ndevctx->last_reconfig = 0;
+                        netdev_err(ndev, "restoring ringparam failed");
-        schedule_delayed_work(&ndevctx->dwork, 0);
+        }
        return ret;
 }
@@ -1846,8 +1877,12 @@ static void __netvsc_vf_setup(struct net_device *ndev,
        /* set multicast etc flags on VF */
        dev_change_flags(vf_netdev, ndev->flags | IFF_SLAVE);
+        /* sync address list from ndev to VF */
+        netif_addr_lock_bh(ndev);
        dev_uc_sync(vf_netdev, ndev);
        dev_mc_sync(vf_netdev, ndev);
+        netif_addr_unlock_bh(ndev);
        if (netif_running(ndev)) {
                ret = dev_open(vf_netdev);
@@ -2063,8 +2098,8 @@ no_net:
 static int netvsc_remove(struct hv_device *dev)
 {
        struct net_device_context *ndev_ctx;
-        struct net_device *vf_netdev;
+        struct net_device *vf_netdev, *net;
-        struct net_device *net;
+        struct netvsc_device *nvdev;
        net = hv_get_drvdata(dev);
        if (net == NULL) {
@@ -2074,10 +2109,14 @@ static int netvsc_remove(struct hv_device *dev)
        ndev_ctx = netdev_priv(net);
-        netif_device_detach(net);
        cancel_delayed_work_sync(&ndev_ctx->dwork);
+        rcu_read_lock();
+        nvdev = rcu_dereference(ndev_ctx->nvdev);
+        if  (nvdev)
+                cancel_work_sync(&nvdev->subchan_work);
        /*
         * Call to the vsc driver to let it know that the device is being
         * removed. Also blocks mtu and channel changes.
@@ -2087,11 +2126,13 @@ static int netvsc_remove(struct hv_device *dev)
        if (vf_netdev)
                netvsc_unregister_vf(vf_netdev);
+        if (nvdev)
+                rndis_filter_device_remove(dev, nvdev);
        unregister_netdevice(net);
-        rndis_filter_device_remove(dev,
-                                   rtnl_dereference(ndev_ctx->nvdev));
        rtnl_unlock();
+        rcu_read_unlock();
        hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 2dc00f714482..020f8bc54386 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -267,13 +267,23 @@ static void rndis_set_link_state(struct rndis_device *rdev,
        }
 }
-static void rndis_filter_receive_response(struct rndis_device *dev,
+static void rndis_filter_receive_response(struct net_device *ndev,
-                                       struct rndis_message *resp)
+                                          struct netvsc_device *nvdev,
+                                          const struct rndis_message *resp)
 {
+        struct rndis_device *dev = nvdev->extension;
        struct rndis_request *request = NULL;
        bool found = false;
        unsigned long flags;
-        struct net_device *ndev = dev->ndev;
+        /* This should never happen, it means control message
+         * response received after device removed.
+         */
+        if (dev->state == RNDIS_DEV_UNINITIALIZED) {
+                netdev_err(ndev,
+                           "got rndis message uninitialized\n");
+                return;
+        }
        spin_lock_irqsave(&dev->request_lock, flags);
        list_for_each_entry(request, &dev->req_list, list_ent) {
@@ -355,7 +365,6 @@ static inline void *rndis_get_ppi(struct rndis_packet *rpkt, u32 type)
 static int rndis_filter_receive_data(struct net_device *ndev,
                                     struct netvsc_device *nvdev,
-                                     struct rndis_device *dev,
                                     struct rndis_message *msg,
                                     struct vmbus_channel *channel,
                                     void *data, u32 data_buflen)
@@ -375,7 +384,7 @@ static int rndis_filter_receive_data(struct net_device *ndev,
         * should be the data packet size plus the trailer padding size
         */
        if (unlikely(data_buflen < rndis_pkt->data_len)) {
-                netdev_err(dev->ndev, "rndis message buffer "
+                netdev_err(ndev, "rndis message buffer "
                           "overflow detected (got %u, min %u)"
                           "...dropping this message!\n",
                           data_buflen, rndis_pkt->data_len);
@@ -403,35 +412,20 @@ int rndis_filter_receive(struct net_device *ndev,
                         void *data, u32 buflen)
 {
        struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        struct rndis_device *rndis_dev = net_dev->extension;
        struct rndis_message *rndis_msg = data;
-        /* Make sure the rndis device state is initialized */
-        if (unlikely(!rndis_dev)) {
-                netif_dbg(net_device_ctx, rx_err, ndev,
-                          "got rndis message but no rndis device!\n");
-                return NVSP_STAT_FAIL;
-        }
-        if (unlikely(rndis_dev->state == RNDIS_DEV_UNINITIALIZED)) {
-                netif_dbg(net_device_ctx, rx_err, ndev,
-                          "got rndis message uninitialized\n");
-                return NVSP_STAT_FAIL;
-        }
        if (netif_msg_rx_status(net_device_ctx))
                dump_rndis_message(ndev, rndis_msg);
        switch (rndis_msg->ndis_msg_type) {
        case RNDIS_MSG_PACKET:
-                return rndis_filter_receive_data(ndev, net_dev,
+                return rndis_filter_receive_data(ndev, net_dev, rndis_msg,
-                                                 rndis_dev, rndis_msg,
                                                 channel, data, buflen);
        case RNDIS_MSG_INIT_C:
        case RNDIS_MSG_QUERY_C:
        case RNDIS_MSG_SET_C:
                /* completion msgs */
-                rndis_filter_receive_response(rndis_dev, rndis_msg);
+                rndis_filter_receive_response(ndev, net_dev, rndis_msg);
                break;
        case RNDIS_MSG_INDICATE:
@@ -828,13 +822,15 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev,
        struct rndis_set_request *set;
        int ret;
+        if (dev->filter == new_filter)
+                return 0;
        request = get_rndis_request(dev, RNDIS_MSG_SET,
                        RNDIS_MESSAGE_SIZE(struct rndis_set_request) +
                        sizeof(u32));
        if (!request)
                return -ENOMEM;
        /* Setup the rndis set */
        set = &request->request_msg.msg.set_req;
        set->oid = RNDIS_OID_GEN_CURRENT_PACKET_FILTER;
@@ -845,8 +841,10 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev,
               &new_filter, sizeof(u32));
        ret = rndis_filter_send_request(dev, request);
-        if (ret == 0)
+        if (ret == 0) {
                wait_for_completion(&request->wait_event);
+                dev->filter = new_filter;
+        }
        put_rndis_request(dev, request);
@@ -864,9 +862,9 @@ static void rndis_set_multicast(struct work_struct *w)
                filter = NDIS_PACKET_TYPE_PROMISCUOUS;
        } else {
                if (flags & IFF_ALLMULTI)
-                        flags |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+                        filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
                if (flags & IFF_BROADCAST)
-                        flags |= NDIS_PACKET_TYPE_BROADCAST;
+                        filter |= NDIS_PACKET_TYPE_BROADCAST;
        }
        rndis_filter_set_packet_filter(rdev, filter);
@@ -1124,6 +1122,7 @@ void rndis_set_subchannel(struct work_struct *w)
        for (i = 0; i < VRSS_SEND_TAB_SIZE; i++)
                ndev_ctx->tx_table[i] = i % nvdev->num_chn;
+        netif_device_attach(ndev);
        rtnl_unlock();
        return;
@@ -1134,6 +1133,8 @@ failed:
        nvdev->max_chn = 1;
        nvdev->num_chn = 1;
+        netif_device_attach(ndev);
 unlock:
        rtnl_unlock();
 }
@@ -1336,6 +1337,10 @@ out:
                net_device->num_chn = 1;
        }
+        /* No sub channels, device is ready */
+        if (net_device->num_chn == 1)
+                netif_device_attach(net);
        return net_device;
 err_dev_remv:
@@ -1348,16 +1353,12 @@ void rndis_filter_device_remove(struct hv_device *dev,
 {
        struct rndis_device *rndis_dev = net_dev->extension;
-        /* Don't try and setup sub channels if about to halt */
-        cancel_work_sync(&net_dev->subchan_work);
        /* Halt and release the rndis device */
        rndis_filter_halt_device(net_dev, rndis_dev);
        net_dev->extension = NULL;
        netvsc_device_remove(dev);
-        kfree(rndis_dev);
 }
 int rndis_filter_open(struct netvsc_device *nvdev)
@@ -1375,10 +1376,3 @@ int rndis_filter_close(struct netvsc_device *nvdev)
        return rndis_filter_close_device(nvdev->extension);
 }
-bool rndis_filter_opened(const struct netvsc_device *nvdev)
-{
-        const struct rndis_device *dev = nvdev->extension;
-        return dev->state == RNDIS_DEV_DATAINITIALIZED;
-}
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 7de88b33d5b9..9cbb0c8a896a 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
        err = netdev_upper_dev_link(real_dev, dev, extack);
        if (err < 0)
-                goto unregister;
+                goto put_dev;
        /* need to be already registered so that ->init has run and
         * the MAC addr is set
@@ -3316,7 +3316,8 @@ del_dev:
        macsec_del_dev(macsec);
 unlink:
        netdev_upper_dev_unlink(real_dev, dev);
-unregister:
+put_dev:
+        dev_put(real_dev);
        unregister_netdevice(dev);
        return err;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 8fc02d9db3d0..725f4b4afc6d 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1036,7 +1036,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
        lowerdev_features &= (features | ~NETIF_F_LRO);
        features = netdev_increment_features(lowerdev_features, features, mask);
        features |= ALWAYS_ON_FEATURES;
-        features &= ~NETIF_F_NETNS_LOCAL;
+        features &= (ALWAYS_ON_FEATURES | MACVLAN_FEATURES);
        return features;
 }
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index 171010eb4d9c..5ad130c3da43 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -341,8 +341,8 @@ void bcm_phy_get_strings(struct phy_device *phydev, u8 *data)
        unsigned int i;
        for (i = 0; i < ARRAY_SIZE(bcm_phy_hw_stats); i++)
-                memcpy(data + i * ETH_GSTRING_LEN,
+                strlcpy(data + i * ETH_GSTRING_LEN,
-                       bcm_phy_hw_stats[i].string, ETH_GSTRING_LEN);
+                        bcm_phy_hw_stats[i].string, ETH_GSTRING_LEN);
 }
 EXPORT_SYMBOL_GPL(bcm_phy_get_strings);
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 98fd6b7ceeec..a75c511950c3 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1452,8 +1452,8 @@ static void marvell_get_strings(struct phy_device *phydev, u8 *data)
        int i;
        for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
-                memcpy(data + i * ETH_GSTRING_LEN,
+                strlcpy(data + i * ETH_GSTRING_LEN,
-                       marvell_hw_stats[i].string, ETH_GSTRING_LEN);
+                        marvell_hw_stats[i].string, ETH_GSTRING_LEN);
        }
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 0f45310300f6..f41b224a9cdb 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -635,25 +635,6 @@ static int ksz8873mll_config_aneg(struct phy_device *phydev)
        return 0;
 }
-/* This routine returns -1 as an indication to the caller that the
- * Micrel ksz9021 10/100/1000 PHY does not support standard IEEE
- * MMD extended PHY registers.
- */
-static int
-ksz9021_rd_mmd_phyreg(struct phy_device *phydev, int devad, u16 regnum)
-{
-        return -1;
-}
-/* This routine does nothing since the Micrel ksz9021 does not support
- * standard IEEE MMD extended PHY registers.
- */
-static int
-ksz9021_wr_mmd_phyreg(struct phy_device *phydev, int devad, u16 regnum, u16 val)
-{
-        return -1;
-}
 static int kszphy_get_sset_count(struct phy_device *phydev)
 {
        return ARRAY_SIZE(kszphy_hw_stats);
@@ -664,8 +645,8 @@ static void kszphy_get_strings(struct phy_device *phydev, u8 *data)
        int i;
        for (i = 0; i < ARRAY_SIZE(kszphy_hw_stats); i++) {
-                memcpy(data + i * ETH_GSTRING_LEN,
+                strlcpy(data + i * ETH_GSTRING_LEN,
-                       kszphy_hw_stats[i].string, ETH_GSTRING_LEN);
+                        kszphy_hw_stats[i].string, ETH_GSTRING_LEN);
        }
 }
@@ -946,8 +927,8 @@ static struct phy_driver ksphy_driver[] = {
        .get_stats      = kszphy_get_stats,
        .suspend        = genphy_suspend,
        .resume         = genphy_resume,
-        .read_mmd       = ksz9021_rd_mmd_phyreg,
+        .read_mmd       = genphy_read_mmd_unsupported,
-        .write_mmd      = ksz9021_wr_mmd_phyreg,
+        .write_mmd      = genphy_write_mmd_unsupported,
 }, {
        .phy_id         = PHY_ID_KSZ9031,
        .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c2d9027be863..05c1e8ef15e6 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -618,6 +618,68 @@ static void phy_error(struct phy_device *phydev)
 }
 /**
+ * phy_disable_interrupts - Disable the PHY interrupts from the PHY side
+ * @phydev: target phy_device struct
+ */
+static int phy_disable_interrupts(struct phy_device *phydev)
+{
+        int err;
+        /* Disable PHY interrupts */
+        err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
+        if (err)
+                return err;
+        /* Clear the interrupt */
+        return phy_clear_interrupt(phydev);
+}
+/**
+ * phy_change - Called by the phy_interrupt to handle PHY changes
+ * @phydev: phy_device struct that interrupted
+ */
+static irqreturn_t phy_change(struct phy_device *phydev)
+{
+        if (phy_interrupt_is_valid(phydev)) {
+                if (phydev->drv->did_interrupt &&
+                    !phydev->drv->did_interrupt(phydev))
+                        return IRQ_NONE;
+                if (phydev->state == PHY_HALTED)
+                        if (phy_disable_interrupts(phydev))
+                                goto phy_err;
+        }
+        mutex_lock(&phydev->lock);
+        if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
+                phydev->state = PHY_CHANGELINK;
+        mutex_unlock(&phydev->lock);
+        /* reschedule state queue work to run as soon as possible */
+        phy_trigger_machine(phydev, true);
+        if (phy_interrupt_is_valid(phydev) && phy_clear_interrupt(phydev))
+                goto phy_err;
+        return IRQ_HANDLED;
+phy_err:
+        phy_error(phydev);
+        return IRQ_NONE;
+}
+/**
+ * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes
+ * @work: work_struct that describes the work to be done
+ */
+void phy_change_work(struct work_struct *work)
+{
+        struct phy_device *phydev =
+                container_of(work, struct phy_device, phy_queue);
+        phy_change(phydev);
+}
+/**
 * phy_interrupt - PHY interrupt handler
 * @irq: interrupt line
 * @phy_dat: phy_device pointer
@@ -632,9 +694,7 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
        if (PHY_HALTED == phydev->state)
                return IRQ_NONE;                /* It can't be ours.  */
-        phy_change(phydev);
+        return phy_change(phydev);
-        return IRQ_HANDLED;
 }
 /**
@@ -652,23 +712,6 @@ static int phy_enable_interrupts(struct phy_device *phydev)
 }
 /**
- * phy_disable_interrupts - Disable the PHY interrupts from the PHY side
- * @phydev: target phy_device struct
- */
-static int phy_disable_interrupts(struct phy_device *phydev)
-{
-        int err;
-        /* Disable PHY interrupts */
-        err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED);
-        if (err)
-                return err;
-        /* Clear the interrupt */
-        return phy_clear_interrupt(phydev);
-}
-/**
 * phy_start_interrupts - request and enable interrupts for a PHY device
 * @phydev: target phy_device struct
 *
@@ -711,50 +754,6 @@ int phy_stop_interrupts(struct phy_device *phydev)
 EXPORT_SYMBOL(phy_stop_interrupts);
 /**
- * phy_change - Called by the phy_interrupt to handle PHY changes
- * @phydev: phy_device struct that interrupted
- */
-void phy_change(struct phy_device *phydev)
-{
-        if (phy_interrupt_is_valid(phydev)) {
-                if (phydev->drv->did_interrupt &&
-                    !phydev->drv->did_interrupt(phydev))
-                        return;
-                if (phydev->state == PHY_HALTED)
-                        if (phy_disable_interrupts(phydev))
-                                goto phy_err;
-        }
-        mutex_lock(&phydev->lock);
-        if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
-                phydev->state = PHY_CHANGELINK;
-        mutex_unlock(&phydev->lock);
-        /* reschedule state queue work to run as soon as possible */
-        phy_trigger_machine(phydev, true);
-        if (phy_interrupt_is_valid(phydev) && phy_clear_interrupt(phydev))
-                goto phy_err;
-        return;
-phy_err:
-        phy_error(phydev);
-}
-/**
- * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes
- * @work: work_struct that describes the work to be done
- */
-void phy_change_work(struct work_struct *work)
-{
-        struct phy_device *phydev =
-                container_of(work, struct phy_device, phy_queue);
-        phy_change(phydev);
-}
-/**
 * phy_stop - Bring down the PHY link, and stop checking the status
 * @phydev: target phy_device struct
 */
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b285323327c4..ac23322a32e1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1012,10 +1012,17 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
        err = sysfs_create_link(&phydev->mdio.dev.kobj, &dev->dev.kobj,
                                "attached_dev");
        if (!err) {
-                err = sysfs_create_link(&dev->dev.kobj, &phydev->mdio.dev.kobj,
+                err = sysfs_create_link_nowarn(&dev->dev.kobj,
-                                        "phydev");
+                                               &phydev->mdio.dev.kobj,
-                if (err)
+                                               "phydev");
-                        goto error;
+                if (err) {
+                        dev_err(&dev->dev, "could not add device link to %s err %d\n",
+                                kobject_name(&phydev->mdio.dev.kobj),
+                                err);
+                        /* non-fatal - some net drivers can use one netdevice
+                         * with more then one phy
+                         */
+                }
                phydev->sysfs_links = true;
        }
@@ -1666,6 +1673,23 @@ int genphy_config_init(struct phy_device *phydev)
 }
 EXPORT_SYMBOL(genphy_config_init);
+/* This is used for the phy device which doesn't support the MMD extended
+ * register access, but it does have side effect when we are trying to access
+ * the MMD register via indirect method.
+ */
+int genphy_read_mmd_unsupported(struct phy_device *phdev, int devad, u16 regnum)
+{
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(genphy_read_mmd_unsupported);
+int genphy_write_mmd_unsupported(struct phy_device *phdev, int devnum,
+                                 u16 regnum, u16 val)
+{
+        return -EOPNOTSUPP;
+}
+EXPORT_SYMBOL(genphy_write_mmd_unsupported);
 int genphy_suspend(struct phy_device *phydev)
 {
        return phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN);
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index ee3ca4a2f12b..9f48ecf9c627 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -172,6 +172,8 @@ static struct phy_driver realtek_drvs[] = {
                .flags          = PHY_HAS_INTERRUPT,
                .ack_interrupt  = &rtl821x_ack_interrupt,
                .config_intr    = &rtl8211b_config_intr,
+                .read_mmd       = &genphy_read_mmd_unsupported,
+                .write_mmd      = &genphy_write_mmd_unsupported,
        }, {
                .phy_id         = 0x001cc914,
                .name           = "RTL8211DN Gigabit Ethernet",
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 7dc2f34e7229..926c2c322d43 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -257,7 +257,7 @@ struct ppp_net {
 /* Prototypes. */
 static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
                        struct file *file, unsigned int cmd, unsigned long arg);
-static void ppp_xmit_process(struct ppp *ppp);
+static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb);
 static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb);
 static void ppp_push(struct ppp *ppp);
 static void ppp_channel_push(struct channel *pch);
@@ -513,13 +513,12 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,
                goto out;
        }
-        skb_queue_tail(&pf->xq, skb);
        switch (pf->kind) {
        case INTERFACE:
-                ppp_xmit_process(PF_TO_PPP(pf));
+                ppp_xmit_process(PF_TO_PPP(pf), skb);
                break;
        case CHANNEL:
+                skb_queue_tail(&pf->xq, skb);
                ppp_channel_push(PF_TO_CHANNEL(pf));
                break;
        }
@@ -1268,8 +1267,8 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
        put_unaligned_be16(proto, pp);
        skb_scrub_packet(skb, !net_eq(ppp->ppp_net, dev_net(dev)));
-        skb_queue_tail(&ppp->file.xq, skb);
+        ppp_xmit_process(ppp, skb);
-        ppp_xmit_process(ppp);
        return NETDEV_TX_OK;
 outf:
@@ -1421,13 +1420,14 @@ static void ppp_setup(struct net_device *dev)
 */
 /* Called to do any work queued up on the transmit side that can now be done */
-static void __ppp_xmit_process(struct ppp *ppp)
+static void __ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)
 {
-        struct sk_buff *skb;
        ppp_xmit_lock(ppp);
        if (!ppp->closing) {
                ppp_push(ppp);
+                if (skb)
+                        skb_queue_tail(&ppp->file.xq, skb);
                while (!ppp->xmit_pending &&
                       (skb = skb_dequeue(&ppp->file.xq)))
                        ppp_send_frame(ppp, skb);
@@ -1441,7 +1441,7 @@ static void __ppp_xmit_process(struct ppp *ppp)
        ppp_xmit_unlock(ppp);
 }
-static void ppp_xmit_process(struct ppp *ppp)
+static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)
 {
        local_bh_disable();
@@ -1449,7 +1449,7 @@ static void ppp_xmit_process(struct ppp *ppp)
                goto err;
        (*this_cpu_ptr(ppp->xmit_recursion))++;
-        __ppp_xmit_process(ppp);
+        __ppp_xmit_process(ppp, skb);
        (*this_cpu_ptr(ppp->xmit_recursion))--;
        local_bh_enable();
@@ -1459,6 +1459,8 @@ static void ppp_xmit_process(struct ppp *ppp)
 err:
        local_bh_enable();
+        kfree_skb(skb);
        if (net_ratelimit())
                netdev_err(ppp->dev, "recursion detected\n");
 }
@@ -1943,7 +1945,7 @@ static void __ppp_channel_push(struct channel *pch)
        if (skb_queue_empty(&pch->file.xq)) {
                ppp = pch->ppp;
                if (ppp)
-                        __ppp_xmit_process(ppp);
+                        __ppp_xmit_process(ppp, NULL);
        }
 }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 5dd781e65958..222093e878a8 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2401,7 +2401,7 @@ send_done:
        if (!nlh) {
                err = __send_and_alloc_skb(&skb, team, portid, send_func);
                if (err)
-                        goto errout;
+                        return err;
                goto send_done;
        }
@@ -2687,7 +2687,7 @@ send_done:
        if (!nlh) {
                err = __send_and_alloc_skb(&skb, team, portid, send_func);
                if (err)
-                        goto errout;
+                        return err;
                goto send_done;
        }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index baeafa004463..a1ba262f40ad 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -656,7 +656,7 @@ static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
        return tun;
 }
-static void tun_ptr_free(void *ptr)
+void tun_ptr_free(void *ptr)
 {
        if (!ptr)
                return;
@@ -668,6 +668,7 @@ static void tun_ptr_free(void *ptr)
                __skb_array_destroy_skb(ptr);
        }
 }
+EXPORT_SYMBOL_GPL(tun_ptr_free);
 static void tun_queue_purge(struct tun_file *tfile)
 {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8a22ff67b026..d9eea8cfe6cb 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -315,6 +315,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev)
 void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
 {
        struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
+        unsigned long flags;
        int     status;
        if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
@@ -326,10 +327,10 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
        if (skb->protocol == 0)
                skb->protocol = eth_type_trans (skb, dev->net);
-        u64_stats_update_begin(&stats64->syncp);
+        flags = u64_stats_update_begin_irqsave(&stats64->syncp);
        stats64->rx_packets++;
        stats64->rx_bytes += skb->len;
-        u64_stats_update_end(&stats64->syncp);
+        u64_stats_update_end_irqrestore(&stats64->syncp, flags);
        netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n",
                  skb->len + sizeof (struct ethhdr), skb->protocol);
@@ -1248,11 +1249,12 @@ static void tx_complete (struct urb *urb)
        if (urb->status == 0) {
                struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64);
+                unsigned long flags;
-                u64_stats_update_begin(&stats64->syncp);
+                flags = u64_stats_update_begin_irqsave(&stats64->syncp);
                stats64->tx_packets += entry->packets;
                stats64->tx_bytes += entry->length;
-                u64_stats_update_end(&stats64->syncp);
+                u64_stats_update_end_irqrestore(&stats64->syncp, flags);
        } else {
                dev->net->stats.tx_errors++;
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 8b39c160743d..e04937f44f33 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -977,6 +977,8 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
        int ret;
        u32 count;
+        int num_pkts;
+        int tx_num_deferred;
        unsigned long flags;
        struct vmxnet3_tx_ctx ctx;
        union Vmxnet3_GenericDesc *gdesc;
@@ -1075,12 +1077,12 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 #else
        gdesc = ctx.sop_txd;
 #endif
+        tx_num_deferred = le32_to_cpu(tq->shared->txNumDeferred);
        if (ctx.mss) {
                gdesc->txd.hlen = ctx.eth_ip_hdr_size + ctx.l4_hdr_size;
                gdesc->txd.om = VMXNET3_OM_TSO;
                gdesc->txd.msscof = ctx.mss;
-                le32_add_cpu(&tq->shared->txNumDeferred, (skb->len -
+                num_pkts = (skb->len - gdesc->txd.hlen + ctx.mss - 1) / ctx.mss;
-                             gdesc->txd.hlen + ctx.mss - 1) / ctx.mss);
        } else {
                if (skb->ip_summed == CHECKSUM_PARTIAL) {
                        gdesc->txd.hlen = ctx.eth_ip_hdr_size;
@@ -1091,8 +1093,10 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                        gdesc->txd.om = 0;
                        gdesc->txd.msscof = 0;
                }
-                le32_add_cpu(&tq->shared->txNumDeferred, 1);
+                num_pkts = 1;
        }
+        le32_add_cpu(&tq->shared->txNumDeferred, num_pkts);
+        tx_num_deferred += num_pkts;
        if (skb_vlan_tag_present(skb)) {
                gdesc->txd.ti = 1;
@@ -1118,8 +1122,7 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
        spin_unlock_irqrestore(&tq->tx_lock, flags);
-        if (le32_to_cpu(tq->shared->txNumDeferred) >=
+        if (tx_num_deferred >= le32_to_cpu(tq->shared->txThreshold)) {
-                                        le32_to_cpu(tq->shared->txThreshold)) {
                tq->shared->txNumDeferred = 0;
                VMXNET3_WRITE_BAR0_REG(adapter,
                                       VMXNET3_REG_TXPROD + tq->qid * 8,
@@ -1470,7 +1473,8 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                        vmxnet3_rx_csum(adapter, skb,
                                        (union Vmxnet3_GenericDesc *)rcd);
                        skb->protocol = eth_type_trans(skb, adapter->netdev);
-                        if (!rcd->tcp || !adapter->lro)
+                        if (!rcd->tcp ||
+                            !(adapter->netdev->features & NETIF_F_LRO))
                                goto not_lro;
                        if (segCnt != 0 && mss != 0) {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 5ba222920e80..59ec34052a65 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
 * Version numbers
 */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.11.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040b00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
@@ -342,9 +342,6 @@ struct vmxnet3_adapter {
        u8                      __iomem *hw_addr1; /* for BAR 1 */
        u8                              version;
-        bool                            rxcsum;
-        bool                            lro;
 #ifdef VMXNET3_RSS
        struct UPT1_RSSConf             *rss_conf;
        bool                            rss;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index e89e5ef2c2a4..f246e9ed4a81 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -729,6 +729,7 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
        ieee80211_hw_set(hw, SPECTRUM_MGMT);
        ieee80211_hw_set(hw, SIGNAL_DBM);
        ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+        ieee80211_hw_set(hw, DOESNT_SUPPORT_QOS_NDP);
        if (ath9k_ps_enable)
                ieee80211_hw_set(hw, SUPPORTS_PS);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
index df8a1ecb9924..232dcbb83311 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
@@ -181,6 +181,7 @@ enum brcmf_netif_stop_reason {
 * @netif_stop_lock: spinlock for update netif_stop from multiple sources.
 * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
 * @pend_8021x_wait: used for signalling change in count.
+ * @fwil_fwerr: flag indicating fwil layer should return firmware error codes.
 */
 struct brcmf_if {
        struct brcmf_pub *drvr;
@@ -198,6 +199,7 @@ struct brcmf_if {
        wait_queue_head_t pend_8021x_wait;
        struct in6_addr ipv6_addr_tbl[NDOL_MAX_ENTRIES];
        u8 ipv6addr_idx;
+        bool fwil_fwerr;
 };
 int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index 47de35a33853..bede7b7fd996 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -104,6 +104,9 @@ static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
        u32 data;
        int err;
+        /* we need to know firmware error */
+        ifp->fwil_fwerr = true;
        err = brcmf_fil_iovar_int_get(ifp, name, &data);
        if (err == 0) {
                brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
@@ -112,6 +115,8 @@ static void brcmf_feat_iovar_int_get(struct brcmf_if *ifp,
                brcmf_dbg(TRACE, "%s feature check failed: %d\n",
                          brcmf_feat_names[id], err);
        }
+        ifp->fwil_fwerr = false;
 }
 static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
@@ -120,6 +125,9 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
 {
        int err;
+        /* we need to know firmware error */
+        ifp->fwil_fwerr = true;
        err = brcmf_fil_iovar_data_set(ifp, name, data, len);
        if (err != -BRCMF_FW_UNSUPPORTED) {
                brcmf_dbg(INFO, "enabling feature: %s\n", brcmf_feat_names[id]);
@@ -128,6 +136,8 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
                brcmf_dbg(TRACE, "%s feature check failed: %d\n",
                          brcmf_feat_names[id], err);
        }
+        ifp->fwil_fwerr = false;
 }
 #define MAX_CAPS_BUFFER_SIZE    512
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
index f2cfdd3b2bf1..fc5751116d99 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.c
@@ -131,6 +131,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
                          brcmf_fil_get_errstr((u32)(-fwerr)), fwerr);
                err = -EBADE;
        }
+        if (ifp->fwil_fwerr)
+                return fwerr;
        return err;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 2ee54133efa1..82064e909784 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
 * @dev_addr: optional device address.
 *
 * P2P needs mac addresses for P2P device and interface. If no device
- * address it specified, these are derived from the primary net device, ie.
+ * address it specified, these are derived from a random ethernet
- * the permanent ethernet address of the device.
+ * address.
 */
 static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr)
 {
-        struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+        bool random_addr = false;
-        bool local_admin = false;
-        if (!dev_addr || is_zero_ether_addr(dev_addr)) {
+        if (!dev_addr || is_zero_ether_addr(dev_addr))
-                dev_addr = pri_ifp->mac_addr;
+                random_addr = true;
-                local_admin = true;
-        }
-        /* Generate the P2P Device Address.  This consists of the device's
+        /* Generate the P2P Device Address obtaining a random ethernet
-         * primary MAC address with the locally administered bit set.
+         * address with the locally administered bit set.
         */
-        memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
+        if (random_addr)
-        if (local_admin)
+                eth_random_addr(p2p->dev_addr);
-                p2p->dev_addr[0] |= 0x02;
+        else
+                memcpy(p2p->dev_addr, dev_addr, ETH_ALEN);
        /* Generate the P2P Interface Address.  If the discovery and connection
         * BSSCFGs need to simultaneously co-exist, then this address must be
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index c5f2ddf9b0fe..e5a2fc738ac3 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -91,7 +91,6 @@ config IWLWIFI_BCAST_FILTERING
 config IWLWIFI_PCIE_RTPM
       bool "Enable runtime power management mode for PCIe devices"
       depends on IWLMVM && PM && EXPERT
-       default false
       help
         Say Y here to enable runtime power management for PCIe
         devices.  If enabled, the device will go into low power mode
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
index 3721a3ed358b..f824bebceb06 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h
@@ -211,7 +211,7 @@ enum {
 * @TE_V2_NOTIF_HOST_FRAG_END:request/receive notification on frag end
 * @TE_V2_NOTIF_INTERNAL_FRAG_START: internal FW use.
 * @TE_V2_NOTIF_INTERNAL_FRAG_END: internal FW use.
- * @T2_V2_START_IMMEDIATELY: start time event immediately
+ * @TE_V2_START_IMMEDIATELY: start time event immediately
 * @TE_V2_DEP_OTHER: depends on another time event
 * @TE_V2_DEP_TSF: depends on a specific time
 * @TE_V2_EVENT_SOCIOPATHIC: can't co-exist with other events of tha same MAC
@@ -230,7 +230,7 @@ enum iwl_time_event_policy {
        TE_V2_NOTIF_HOST_FRAG_END = BIT(5),
        TE_V2_NOTIF_INTERNAL_FRAG_START = BIT(6),
        TE_V2_NOTIF_INTERNAL_FRAG_END = BIT(7),
-        T2_V2_START_IMMEDIATELY = BIT(11),
+        TE_V2_START_IMMEDIATELY = BIT(11),
        /* placement characteristics */
        TE_V2_DEP_OTHER = BIT(TE_V2_PLACEMENT_POS),
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 67aefc8fc9ac..7bd704a3e640 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -942,7 +944,6 @@ dump_trans_data:
 out:
        iwl_fw_free_dump_desc(fwrt);
-        fwrt->dump.trig = NULL;
        clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status);
        IWL_DEBUG_INFO(fwrt, "WRT dump done\n");
 }
@@ -1112,6 +1113,14 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
            fwrt->ops->dump_start(fwrt->ops_ctx))
                return;
+        if (fwrt->ops && fwrt->ops->fw_running &&
+            !fwrt->ops->fw_running(fwrt->ops_ctx)) {
+                IWL_ERR(fwrt, "Firmware not running - cannot dump error\n");
+                iwl_fw_free_dump_desc(fwrt);
+                clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status);
+                goto out;
+        }
        if (fwrt->trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
                /* stop recording */
                iwl_fw_dbg_stop_recording(fwrt);
@@ -1145,7 +1154,7 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
                        iwl_write_prph(fwrt->trans, DBGC_OUT_CTRL, out_ctrl);
                }
        }
+out:
        if (fwrt->ops && fwrt->ops->dump_end)
                fwrt->ops->dump_end(fwrt->ops_ctx);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 223fb77a3aa9..72259bff9922 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -8,6 +8,7 @@
 * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -33,6 +34,7 @@
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -91,6 +93,7 @@ static inline void iwl_fw_free_dump_desc(struct iwl_fw_runtime *fwrt)
        if (fwrt->dump.desc != &iwl_dump_desc_assert)
                kfree(fwrt->dump.desc);
        fwrt->dump.desc = NULL;
+        fwrt->dump.trig = NULL;
 }
 void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
index e57ff92a68ae..3da468d2cc92 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/debugfs.h
@@ -75,6 +75,20 @@ static inline void iwl_fw_cancel_timestamp(struct iwl_fw_runtime *fwrt)
        cancel_delayed_work_sync(&fwrt->timestamp.wk);
 }
+static inline void iwl_fw_suspend_timestamp(struct iwl_fw_runtime *fwrt)
+{
+        cancel_delayed_work_sync(&fwrt->timestamp.wk);
+}
+static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt)
+{
+        if (!fwrt->timestamp.delay)
+                return;
+        schedule_delayed_work(&fwrt->timestamp.wk,
+                              round_jiffies_relative(fwrt->timestamp.delay));
+}
 #else
 static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
                                          struct dentry *dbgfs_dir)
@@ -84,4 +98,8 @@ static inline int iwl_fwrt_dbgfs_register(struct iwl_fw_runtime *fwrt,
 static inline void iwl_fw_cancel_timestamp(struct iwl_fw_runtime *fwrt) {}
+static inline void iwl_fw_suspend_timestamp(struct iwl_fw_runtime *fwrt) {}
+static inline void iwl_fw_resume_timestamp(struct iwl_fw_runtime *fwrt) {}
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/init.c b/drivers/net/wireless/intel/iwlwifi/fw/init.c
index c39fe84bb4c4..2efac307909e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/init.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/init.c
@@ -77,8 +77,14 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 }
 IWL_EXPORT_SYMBOL(iwl_fw_runtime_init);
-void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt)
+void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt)
 {
-        iwl_fw_cancel_timestamp(fwrt);
+        iwl_fw_suspend_timestamp(fwrt);
 }
-IWL_EXPORT_SYMBOL(iwl_fw_runtime_exit);
+IWL_EXPORT_SYMBOL(iwl_fw_runtime_suspend);
+void iwl_fw_runtime_resume(struct iwl_fw_runtime *fwrt)
+{
+        iwl_fw_resume_timestamp(fwrt);
+}
+IWL_EXPORT_SYMBOL(iwl_fw_runtime_resume);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
index e25c049f980f..3fb940ebd74a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
@@ -6,6 +6,7 @@
 * GPL LICENSE SUMMARY
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -26,6 +27,7 @@
 * BSD LICENSE
 *
 * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -68,6 +70,7 @@
 struct iwl_fw_runtime_ops {
        int (*dump_start)(void *ctx);
        void (*dump_end)(void *ctx);
+        bool (*fw_running)(void *ctx);
 };
 #define MAX_NUM_LMAC 2
@@ -150,6 +153,10 @@ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
 void iwl_fw_runtime_exit(struct iwl_fw_runtime *fwrt);
+void iwl_fw_runtime_suspend(struct iwl_fw_runtime *fwrt);
+void iwl_fw_runtime_resume(struct iwl_fw_runtime *fwrt);
 static inline void iwl_fw_set_current_image(struct iwl_fw_runtime *fwrt,
                                            enum iwl_ucode_type cur_fw_img)
 {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 0e6cf39285f4..2efe9b099556 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1098,6 +1098,8 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        /* make sure the d0i3 exit work is not pending */
        flush_work(&mvm->d0i3_exit_work);
+        iwl_fw_runtime_suspend(&mvm->fwrt);
        ret = iwl_trans_suspend(trans);
        if (ret)
                return ret;
@@ -2012,6 +2014,8 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
        mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
+        iwl_fw_runtime_resume(&mvm->fwrt);
        return ret;
 }
@@ -2038,6 +2042,8 @@ static int iwl_mvm_d3_test_open(struct inode *inode, struct file *file)
        mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_D3;
+        iwl_fw_runtime_suspend(&mvm->fwrt);
        /* start pseudo D3 */
        rtnl_lock();
        err = __iwl_mvm_suspend(mvm->hw, mvm->hw->wiphy->wowlan_config, true);
@@ -2098,6 +2104,8 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
        __iwl_mvm_resume(mvm, true);
        rtnl_unlock();
+        iwl_fw_runtime_resume(&mvm->fwrt);
        mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
        iwl_abort_notification_waits(&mvm->notif_wait);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index a7892c1254a2..9c436d8d001d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +36,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -1281,9 +1283,6 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 {
        int ret;
-        if (!iwl_mvm_firmware_running(mvm))
-                return -EIO;
        ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE);
        if (ret)
                return ret;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 2f22e14e00fe..8ba16fc24e3a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -438,7 +438,8 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        }
        /* Allocate the CAB queue for softAP and GO interfaces */
-        if (vif->type == NL80211_IFTYPE_AP) {
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC) {
                /*
                 * For TVQM this will be overwritten later with the FW assigned
                 * queue value (when queue is enabled).
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 8aed40a8bc38..ebf511150f4d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -2106,15 +2107,40 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
        if (ret)
                goto out_remove;
-        ret = iwl_mvm_add_mcast_sta(mvm, vif);
+        /*
-        if (ret)
+         * This is not very nice, but the simplest:
-                goto out_unbind;
+         * For older FWs adding the mcast sta before the bcast station may
+         * cause assert 0x2b00.
-        /* Send the bcast station. At this stage the TBTT and DTIM time events
+         * This is fixed in later FW so make the order of removal depend on
-         * are added and applied to the scheduler */
+         * the TLV
-        ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
+         */
-        if (ret)
+        if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) {
-                goto out_rm_mcast;
+                ret = iwl_mvm_add_mcast_sta(mvm, vif);
+                if (ret)
+                        goto out_unbind;
+                /*
+                 * Send the bcast station. At this stage the TBTT and DTIM time
+                 * events are added and applied to the scheduler
+                 */
+                ret = iwl_mvm_send_add_bcast_sta(mvm, vif);
+                if (ret) {
+                        iwl_mvm_rm_mcast_sta(mvm, vif);
+                        goto out_unbind;
+                }
+        } else {
+                /*
+                 * Send the bcast station. At this stage the TBTT and DTIM time
+                 * events are added and applied to the scheduler
+                 */
+                iwl_mvm_send_add_bcast_sta(mvm, vif);
+                if (ret)
+                        goto out_unbind;
+                iwl_mvm_add_mcast_sta(mvm, vif);
+                if (ret) {
+                        iwl_mvm_send_rm_bcast_sta(mvm, vif);
+                        goto out_unbind;
+                }
+        }
        /* must be set before quota calculations */
        mvmvif->ap_ibss_active = true;
@@ -2144,7 +2170,6 @@ out_quota_failed:
        iwl_mvm_power_update_mac(mvm);
        mvmvif->ap_ibss_active = false;
        iwl_mvm_send_rm_bcast_sta(mvm, vif);
-out_rm_mcast:
        iwl_mvm_rm_mcast_sta(mvm, vif);
 out_unbind:
        iwl_mvm_binding_remove_vif(mvm, vif);
@@ -2682,6 +2707,10 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                /* enable beacon filtering */
                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
+                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
+                                     false);
                ret = 0;
        } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                   new_state == IEEE80211_STA_ASSOC) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 2d28e0804218..89ff02d7c876 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -90,6 +90,7 @@
 #include "fw/runtime.h"
 #include "fw/dbg.h"
 #include "fw/acpi.h"
+#include "fw/debugfs.h"
 #define IWL_MVM_MAX_ADDRESSES           5
 /* RSSI offset for WkP */
@@ -1783,6 +1784,7 @@ static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
 {
+        iwl_fw_cancel_timestamp(&mvm->fwrt);
        iwl_free_fw_paging(&mvm->fwrt);
        clear_bit(IWL_MVM_STATUS_FIRMWARE_RUNNING, &mvm->status);
        iwl_fw_dump_conf_clear(&mvm->fwrt);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 5d525a0023dc..ab7fb5aad984 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +36,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -552,9 +554,15 @@ static void iwl_mvm_fwrt_dump_end(void *ctx)
        iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT);
 }
+static bool iwl_mvm_fwrt_fw_running(void *ctx)
+{
+        return iwl_mvm_firmware_running(ctx);
+}
 static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = {
        .dump_start = iwl_mvm_fwrt_dump_start,
        .dump_end = iwl_mvm_fwrt_dump_end,
+        .fw_running = iwl_mvm_fwrt_fw_running,
 };
 static struct iwl_op_mode *
@@ -802,7 +810,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        iwl_mvm_leds_exit(mvm);
        iwl_mvm_thermal_exit(mvm);
 out_free:
-        iwl_fw_runtime_exit(&mvm->fwrt);
        iwl_fw_flush_dump(&mvm->fwrt);
        if (iwlmvm_mod_params.init_dbg)
@@ -843,7 +850,6 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
        kfree(mvm->d3_resume_sram);
 #endif
-        iwl_fw_runtime_exit(&mvm->fwrt);
        iwl_trans_op_mode_leave(mvm->trans);
        iwl_phy_db_free(mvm->phy_db);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 60abb0084ee5..47f4c7a1d80d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2684,7 +2684,8 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
                                struct ieee80211_sta *sta,
                                struct iwl_lq_sta *lq_sta,
                                enum nl80211_band band,
-                                struct rs_rate *rate)
+                                struct rs_rate *rate,
+                                bool init)
 {
        int i, nentries;
        unsigned long active_rate;
@@ -2738,14 +2739,25 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
         */
        if (sta->vht_cap.vht_supported &&
            best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
-                switch (sta->bandwidth) {
+                /*
-                case IEEE80211_STA_RX_BW_160:
+                 * In AP mode, when a new station associates, rs is initialized
-                case IEEE80211_STA_RX_BW_80:
+                 * immediately upon association completion, before the phy
-                case IEEE80211_STA_RX_BW_40:
+                 * context is updated with the association parameters, so the
+                 * sta bandwidth might be wider than the phy context allows.
+                 * To avoid this issue, always initialize rs with 20mhz
+                 * bandwidth rate, and after authorization, when the phy context
+                 * is already up-to-date, re-init rs with the correct bw.
+                 */
+                u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
+                switch (bw) {
+                case RATE_MCS_CHAN_WIDTH_40:
+                case RATE_MCS_CHAN_WIDTH_80:
+                case RATE_MCS_CHAN_WIDTH_160:
                        initial_rates = rs_optimal_rates_vht;
                        nentries = ARRAY_SIZE(rs_optimal_rates_vht);
                        break;
-                case IEEE80211_STA_RX_BW_20:
+                case RATE_MCS_CHAN_WIDTH_20:
                        initial_rates = rs_optimal_rates_vht_20mhz;
                        nentries = ARRAY_SIZE(rs_optimal_rates_vht_20mhz);
                        break;
@@ -2756,7 +2768,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
                active_rate = lq_sta->active_siso_rate;
                rate->type = LQ_VHT_SISO;
-                rate->bw = rs_bw_from_sta_bw(sta);
+                rate->bw = bw;
        } else if (sta->ht_cap.ht_supported &&
                   best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
                initial_rates = rs_optimal_rates_ht;
@@ -2839,7 +2851,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
        tbl = &(lq_sta->lq_info[active_tbl]);
        rate = &tbl->rate;
-        rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
+        rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
        rs_init_optimal_rate(mvm, sta, lq_sta);
        WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a3f7c1bf3cc8..580de5851fc7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -71,6 +71,7 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
        struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
        struct iwl_mvm_key_pn *ptk_pn;
+        int res;
        u8 tid, keyidx;
        u8 pn[IEEE80211_CCMP_PN_LEN];
        u8 *extiv;
@@ -127,12 +128,13 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
        pn[4] = extiv[1];
        pn[5] = extiv[0];
-        if (memcmp(pn, ptk_pn->q[queue].pn[tid],
+        res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
-                   IEEE80211_CCMP_PN_LEN) <= 0)
+        if (res < 0)
+                return -1;
+        if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
                return -1;
-        if (!(stats->flag & RX_FLAG_AMSDU_MORE))
+        memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
-                memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
        stats->flag |= RX_FLAG_PN_VALIDATED;
        return 0;
@@ -314,28 +316,21 @@ static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
 }
 /*
- * returns true if a packet outside BA session is a duplicate and
+ * returns true if a packet is a duplicate and should be dropped.
- * should be dropped
+ * Updates AMSDU PN tracking info
 */
-static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
+static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
-                                  struct ieee80211_rx_status *rx_status,
+                           struct ieee80211_rx_status *rx_status,
-                                  struct ieee80211_hdr *hdr,
+                           struct ieee80211_hdr *hdr,
-                                  struct iwl_rx_mpdu_desc *desc)
+                           struct iwl_rx_mpdu_desc *desc)
 {
        struct iwl_mvm_sta *mvm_sta;
        struct iwl_mvm_rxq_dup_data *dup_data;
-        u8 baid, tid, sub_frame_idx;
+        u8 tid, sub_frame_idx;
        if (WARN_ON(IS_ERR_OR_NULL(sta)))
                return false;
-        baid = (le32_to_cpu(desc->reorder_data) &
-                IWL_RX_MPDU_REORDER_BAID_MASK) >>
-                IWL_RX_MPDU_REORDER_BAID_SHIFT;
-        if (baid != IWL_RX_REORDER_DATA_INVALID_BAID)
-                return false;
        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
        dup_data = &mvm_sta->dup_data[queue];
@@ -365,6 +360,12 @@ static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
                     dup_data->last_sub_frame[tid] >= sub_frame_idx))
                return true;
+        /* Allow same PN as the first subframe for following sub frames */
+        if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
+            sub_frame_idx > dup_data->last_sub_frame[tid] &&
+            desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
+                rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
        dup_data->last_seq[tid] = hdr->seq_ctrl;
        dup_data->last_sub_frame[tid] = sub_frame_idx;
@@ -971,7 +972,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
                if (ieee80211_is_data(hdr->frame_control))
                        iwl_mvm_rx_csum(sta, skb, desc);
-                if (iwl_mvm_is_nonagg_dup(sta, queue, rx_status, hdr, desc)) {
+                if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
                        kfree_skb(skb);
                        goto out;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 6b2674e02606..630e23cb0ffb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2039,7 +2039,7 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        struct iwl_trans_txq_scd_cfg cfg = {
                .fifo = IWL_MVM_TX_FIFO_MCAST,
                .sta_id = msta->sta_id,
-                .tid = IWL_MAX_TID_COUNT,
+                .tid = 0,
                .aggregate = false,
                .frame_limit = IWL_FRAME_LIMIT,
        };
@@ -2053,6 +2053,17 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                return -ENOTSUPP;
        /*
+         * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+         * invalid, so make sure we use the queue we want.
+         * Note that this is done here as we want to avoid making DQA
+         * changes in mac80211 layer.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC) {
+                vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                mvmvif->cab_queue = vif->cab_queue;
+        }
+        /*
         * While in previous FWs we had to exclude cab queue from TFD queue
         * mask, now it is needed as any other queue.
         */
@@ -2079,24 +2090,13 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        if (iwl_mvm_has_new_tx_api(mvm)) {
                int queue = iwl_mvm_tvqm_enable_txq(mvm, vif->cab_queue,
                                                    msta->sta_id,
-                                                    IWL_MAX_TID_COUNT,
+                                                    0,
                                                    timeout);
                mvmvif->cab_queue = queue;
        } else if (!fw_has_api(&mvm->fw->ucode_capa,
-                               IWL_UCODE_TLV_API_STA_TYPE)) {
+                               IWL_UCODE_TLV_API_STA_TYPE))
-                /*
-                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
-                 * invalid, so make sure we use the queue we want.
-                 * Note that this is done here as we want to avoid making DQA
-                 * changes in mac80211 layer.
-                 */
-                if (vif->type == NL80211_IFTYPE_ADHOC) {
-                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
-                        mvmvif->cab_queue = vif->cab_queue;
-                }
                iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                   &cfg, timeout);
-        }
        return 0;
 }
@@ -2115,7 +2115,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true, 0);
        iwl_mvm_disable_txq(mvm, mvmvif->cab_queue, vif->cab_queue,
-                            IWL_MAX_TID_COUNT, 0);
+                            0, 0);
        ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
        if (ret)
@@ -3170,8 +3170,9 @@ static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
        int ret, size;
        u32 status;
+        /* This is a valid situation for GTK removal */
        if (sta_id == IWL_MVM_INVALID_STA)
-                return -EINVAL;
+                return 0;
        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
                                 STA_KEY_FLG_KEYID_MSK);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 200ab50ec86b..acb217e666db 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -616,7 +616,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
        time_cmd.repeat = 1;
        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                      TE_V2_NOTIF_HOST_EVENT_END |
-                                      T2_V2_START_IMMEDIATELY);
+                                      TE_V2_START_IMMEDIATELY);
        if (!wait_for_notif) {
                iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
@@ -803,7 +803,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        time_cmd.repeat = 1;
        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                      TE_V2_NOTIF_HOST_EVENT_END |
-                                      T2_V2_START_IMMEDIATELY);
+                                      TE_V2_START_IMMEDIATELY);
        return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
@@ -913,6 +913,8 @@ int iwl_mvm_schedule_csa_period(struct iwl_mvm *mvm,
        time_cmd.interval = cpu_to_le32(1);
        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
                                      TE_V2_ABSENCE);
+        if (!apply_time)
+                time_cmd.policy |= cpu_to_le16(TE_V2_START_IMMEDIATELY);
        return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dda77b327c98..af6dfceab6b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -419,11 +419,11 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
 {
        struct ieee80211_key_conf *keyconf = info->control.hw_key;
        u8 *crypto_hdr = skb_frag->data + hdrlen;
+        enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM;
        u64 pn;
        switch (keyconf->cipher) {
        case WLAN_CIPHER_SUITE_CCMP:
-        case WLAN_CIPHER_SUITE_CCMP_256:
                iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd);
                iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
                break;
@@ -447,13 +447,16 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
                break;
        case WLAN_CIPHER_SUITE_GCMP:
        case WLAN_CIPHER_SUITE_GCMP_256:
+                type = TX_CMD_SEC_GCMP;
+                /* Fall through */
+        case WLAN_CIPHER_SUITE_CCMP_256:
                /* TODO: Taking the key from the table might introduce a race
                 * when PTK rekeying is done, having an old packets with a PN
                 * based on the old key but the message encrypted with a new
                 * one.
                 * Need to handle this.
                 */
-                tx_cmd->sec_ctl |= TX_CMD_SEC_GCMP | TX_CMD_SEC_KEY_FROM_TABLE;
+                tx_cmd->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE;
                tx_cmd->key[0] = keyconf->hw_key_idx;
                iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
                break;
@@ -645,7 +648,11 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
                    info.control.vif->type == NL80211_IFTYPE_AP ||
                    info.control.vif->type == NL80211_IFTYPE_ADHOC) {
-                        sta_id = mvmvif->bcast_sta.sta_id;
+                        if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE)
+                                sta_id = mvmvif->bcast_sta.sta_id;
+                        else
+                                sta_id = mvmvif->mcast_sta.sta_id;
                        queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info,
                                                           hdr->frame_control);
                        if (queue < 0)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 6d0a907d5ba5..fabae0f60683 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -147,7 +147,7 @@ static void iwl_pcie_gen2_tfd_unmap(struct iwl_trans *trans,
        /* Sanity check on number of chunks */
        num_tbs = iwl_pcie_gen2_get_num_tbs(trans, tfd);
-        if (num_tbs >= trans_pcie->max_tbs) {
+        if (num_tbs > trans_pcie->max_tbs) {
                IWL_ERR(trans, "Too many chunks: %i\n", num_tbs);
                return;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index 3f85713c41dc..1a566287993d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -378,7 +378,7 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
        /* Sanity check on number of chunks */
        num_tbs = iwl_pcie_tfd_get_num_tbs(trans, tfd);
-        if (num_tbs >= trans_pcie->max_tbs) {
+        if (num_tbs > trans_pcie->max_tbs) {
                IWL_ERR(trans, "Too many chunks: %i\n", num_tbs);
                /* @todo issue fatal error, it is quite serious situation */
                return;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 7b6c3640a94f..100cf42db65d 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2742,6 +2742,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
        mutex_init(&data->mutex);
        data->netgroup = hwsim_net_get_netgroup(net);
+        data->wmediumd = hwsim_net_get_wmediumd(net);
        /* Enable frame retransmissions for lossy channels */
        hw->max_rates = 4;
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index f9ccd13c79f9..e7bbbc95cdb1 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -1125,7 +1125,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw)
        /* Configuration Space offset 0x70f BIT7 is used to control L0S */
        tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f);
-        _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7));
+        _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) |
+                             ASPM_L1_LATENCY << 3);
        /* Configuration Space offset 0x719 Bit3 is for L1
         * BIT4 is for clock request
diff --git a/drivers/nvdimm/blk.c b/drivers/nvdimm/blk.c
index 345acca576b3..1bd7b3734751 100644
--- a/drivers/nvdimm/blk.c
+++ b/drivers/nvdimm/blk.c
@@ -278,8 +278,6 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
        disk->queue             = q;
        disk->flags             = GENHD_FL_EXT_DEVT;
        nvdimm_namespace_disk_name(&nsblk->common, disk->disk_name);
-        set_capacity(disk, 0);
-        device_add_disk(dev, disk);
        if (devm_add_action_or_reset(dev, nd_blk_release_disk, disk))
                return -ENOMEM;
@@ -292,6 +290,7 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
        }
        set_capacity(disk, available_disk_size >> SECTOR_SHIFT);
+        device_add_disk(dev, disk);
        revalidate_disk(disk);
        return 0;
 }
diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index 2ef544f10ec8..4b95ac513de2 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1545,8 +1545,6 @@ static int btt_blk_init(struct btt *btt)
        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, btt->btt_queue);
        btt->btt_queue->queuedata = btt;
-        set_capacity(btt->btt_disk, 0);
-        device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
        if (btt_meta_size(btt)) {
                int rc = nd_integrity_init(btt->btt_disk, btt_meta_size(btt));
@@ -1558,6 +1556,7 @@ static int btt_blk_init(struct btt *btt)
                }
        }
        set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9);
+        device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
        btt->nd_btt->size = btt->nlba * (u64)btt->sector_size;
        revalidate_disk(btt->btt_disk);
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index f5c4e8c6e29d..2f4d18752c97 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -304,7 +304,7 @@ static const struct attribute_group *nd_pfn_attribute_groups[] = {
 struct device *nd_pfn_devinit(struct nd_pfn *nd_pfn,
                struct nd_namespace_common *ndns)
 {
-        struct device *dev = &nd_pfn->dev;
+        struct device *dev;
        if (!nd_pfn)
                return NULL;
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index e6d01911e092..1593e1806b16 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -532,11 +532,13 @@ static ssize_t persistence_domain_show(struct device *dev,
                struct device_attribute *attr, char *buf)
 {
        struct nd_region *nd_region = to_nd_region(dev);
-        unsigned long flags = nd_region->flags;
-        return sprintf(buf, "%s%s\n",
+        if (test_bit(ND_REGION_PERSIST_CACHE, &nd_region->flags))
-                        flags & BIT(ND_REGION_PERSIST_CACHE) ? "cpu_cache " : "",
+                return sprintf(buf, "cpu_cache\n");
-                        flags & BIT(ND_REGION_PERSIST_MEMCTRL) ? "memory_controller " : "");
+        else if (test_bit(ND_REGION_PERSIST_MEMCTRL, &nd_region->flags))
+                return sprintf(buf, "memory_controller\n");
+        else
+                return sprintf(buf, "\n");
 }
 static DEVICE_ATTR_RO(persistence_domain);
@@ -593,6 +595,13 @@ static umode_t region_visible(struct kobject *kobj, struct attribute *a, int n)
                        return 0;
        }
+        if (a == &dev_attr_persistence_domain.attr) {
+                if ((nd_region->flags & (BIT(ND_REGION_PERSIST_CACHE)
+                                        | BIT(ND_REGION_PERSIST_MEMCTRL))) == 0)
+                        return 0;
+                return a->mode;
+        }
        if (a != &dev_attr_set_cookie.attr
                        && a != &dev_attr_available_size.attr)
                return a->mode;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 817e5e2766da..7aeca5db7916 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3033,7 +3033,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
                        ns->disk->disk_name);
        nvme_mpath_add_disk(ns->head);
-        nvme_mpath_add_disk_links(ns);
        return;
 out_unlink_ns:
        mutex_lock(&ctrl->subsys->lock);
@@ -3053,7 +3052,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                return;
        if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
-                nvme_mpath_remove_disk_links(ns);
                sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
                                        &nvme_ns_id_attr_group);
                if (ns->ndev)
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index a1c58e35075e..8f0f34d06d46 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -650,6 +650,11 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                ret = -EINVAL;
                                goto out;
                        }
+                        if (opts->discovery_nqn) {
+                                pr_debug("Ignoring nr_io_queues value for discovery controller\n");
+                                break;
+                        }
                        opts->nr_io_queues = min_t(unsigned int,
                                        num_online_cpus(), token);
                        break;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 7f51f8414b97..1dc1387b7134 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1206,7 +1206,7 @@ nvme_fc_connect_admin_queue(struct nvme_fc_ctrl *ctrl,
                                sizeof(struct fcnvme_lsdesc_cr_assoc_cmd));
        assoc_rqst->assoc_cmd.ersp_ratio = cpu_to_be16(ersp_ratio);
-        assoc_rqst->assoc_cmd.sqsize = cpu_to_be16(qsize);
+        assoc_rqst->assoc_cmd.sqsize = cpu_to_be16(qsize - 1);
        /* Linux supports only Dynamic controllers */
        assoc_rqst->assoc_cmd.cntlid = cpu_to_be16(0xffff);
        uuid_copy(&assoc_rqst->assoc_cmd.hostid, &ctrl->ctrl.opts->host->id);
@@ -1321,7 +1321,7 @@ nvme_fc_connect_queue(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
                                sizeof(struct fcnvme_lsdesc_cr_conn_cmd));
        conn_rqst->connect_cmd.ersp_ratio = cpu_to_be16(ersp_ratio);
        conn_rqst->connect_cmd.qid  = cpu_to_be16(queue->qnum);
-        conn_rqst->connect_cmd.sqsize = cpu_to_be16(qsize);
+        conn_rqst->connect_cmd.sqsize = cpu_to_be16(qsize - 1);
        lsop->queue = queue;
        lsreq->rqstaddr = conn_rqst;
@@ -2481,11 +2481,11 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
                goto out_free_tag_set;
        }
-        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
        if (ret)
                goto out_cleanup_blk_queue;
-        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
        if (ret)
                goto out_delete_hw_queues;
@@ -2532,11 +2532,11 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
        if (ret)
                goto out_free_io_queues;
-        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
        if (ret)
                goto out_free_io_queues;
-        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.opts->queue_size);
+        ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
        if (ret)
                goto out_delete_hw_queues;
@@ -2632,13 +2632,12 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
        nvme_fc_init_queue(ctrl, 0);
        ret = __nvme_fc_create_hw_queue(ctrl, &ctrl->queues[0], 0,
-                                NVME_AQ_BLK_MQ_DEPTH);
+                                NVME_AQ_DEPTH);
        if (ret)
                goto out_free_queue;
        ret = nvme_fc_connect_admin_queue(ctrl, &ctrl->queues[0],
-                                NVME_AQ_BLK_MQ_DEPTH,
+                                NVME_AQ_DEPTH, (NVME_AQ_DEPTH / 4));
-                                (NVME_AQ_BLK_MQ_DEPTH / 4));
        if (ret)
                goto out_delete_hw_queue;
@@ -2666,7 +2665,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
        }
        ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->ctrl.cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->ctrl.cap), ctrl->ctrl.sqsize);
        ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap);
        if (ret)
@@ -2699,6 +2698,14 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
                opts->queue_size = ctrl->ctrl.maxcmd;
        }
+        if (opts->queue_size > ctrl->ctrl.sqsize + 1) {
+                /* warn if sqsize is lower than queue_size */
+                dev_warn(ctrl->ctrl.device,
+                        "queue_size %zu > ctrl sqsize %u, clamping down\n",
+                        opts->queue_size, ctrl->ctrl.sqsize + 1);
+                opts->queue_size = ctrl->ctrl.sqsize + 1;
+        }
        ret = nvme_fc_init_aen_ops(ctrl);
        if (ret)
                goto out_term_aen_ops;
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index b7e5c6db4d92..060f69e03427 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -210,25 +210,6 @@ void nvme_mpath_add_disk(struct nvme_ns_head *head)
        mutex_unlock(&head->subsys->lock);
 }
-void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
-        struct kobject *slave_disk_kobj, *holder_disk_kobj;
-        if (!ns->head->disk)
-                return;
-        slave_disk_kobj = &disk_to_dev(ns->disk)->kobj;
-        if (sysfs_create_link(ns->head->disk->slave_dir, slave_disk_kobj,
-                        kobject_name(slave_disk_kobj)))
-                return;
-        holder_disk_kobj = &disk_to_dev(ns->head->disk)->kobj;
-        if (sysfs_create_link(ns->disk->part0.holder_dir, holder_disk_kobj,
-                        kobject_name(holder_disk_kobj)))
-                sysfs_remove_link(ns->head->disk->slave_dir,
-                        kobject_name(slave_disk_kobj));
-}
 void nvme_mpath_remove_disk(struct nvme_ns_head *head)
 {
        if (!head->disk)
@@ -243,14 +224,3 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
        blk_cleanup_queue(head->disk->queue);
        put_disk(head->disk);
 }
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
-        if (!ns->head->disk)
-                return;
-        sysfs_remove_link(ns->disk->part0.holder_dir,
-                        kobject_name(&disk_to_dev(ns->head->disk)->kobj));
-        sysfs_remove_link(ns->head->disk->slave_dir,
-                        kobject_name(&disk_to_dev(ns->disk)->kobj));
-}
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 0521e4707d1c..d733b14ede9d 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -410,9 +410,7 @@ bool nvme_req_needs_failover(struct request *req, blk_status_t error);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
 int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
 void nvme_mpath_add_disk(struct nvme_ns_head *head);
-void nvme_mpath_add_disk_links(struct nvme_ns *ns);
 void nvme_mpath_remove_disk(struct nvme_ns_head *head);
-void nvme_mpath_remove_disk_links(struct nvme_ns *ns);
 static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
@@ -454,12 +452,6 @@ static inline void nvme_mpath_add_disk(struct nvme_ns_head *head)
 static inline void nvme_mpath_remove_disk(struct nvme_ns_head *head)
 {
 }
-static inline void nvme_mpath_add_disk_links(struct nvme_ns *ns)
-{
-}
-static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
-{
-}
 static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
 }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 5933a5c732e8..b6f43b738f03 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1153,12 +1153,6 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
        if (!(csts & NVME_CSTS_CFS) && !nssro)
                return false;
-        /* If PCI error recovery process is happening, we cannot reset or
-         * the recovery mechanism will surely fail.
-         */
-        if (pci_channel_offline(to_pci_dev(dev->dev)))
-                return false;
        return true;
 }
@@ -1189,6 +1183,13 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
        struct nvme_command cmd;
        u32 csts = readl(dev->bar + NVME_REG_CSTS);
+        /* If PCI error recovery process is happening, we cannot reset or
+         * the recovery mechanism will surely fail.
+         */
+        mb();
+        if (pci_channel_offline(to_pci_dev(dev->dev)))
+                return BLK_EH_RESET_TIMER;
        /*
         * Reset immediately if the controller is failed
         */
@@ -1913,7 +1914,7 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
        int result, nr_io_queues;
        unsigned long size;
-        nr_io_queues = num_present_cpus();
+        nr_io_queues = num_possible_cpus();
        result = nvme_set_queue_count(&dev->ctrl, &nr_io_queues);
        if (result < 0)
                return result;
diff --git a/drivers/pci/dwc/pcie-designware-host.c b/drivers/pci/dwc/pcie-designware-host.c
index 8de2d5c69b1d..dc9303abda42 100644
--- a/drivers/pci/dwc/pcie-designware-host.c
+++ b/drivers/pci/dwc/pcie-designware-host.c
@@ -613,7 +613,7 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
        /* setup bus numbers */
        val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS);
        val &= 0xff000000;
-        val |= 0x00010100;
+        val |= 0x00ff0100;
        dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val);
        /* setup command register */
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8b14bd326d4a..46d47bd6ca1f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3908,6 +3908,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
                         quirk_dma_func1_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642,
                         quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645,
+                         quirk_dma_func1_alias);
 /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON,
                         PCI_DEVICE_ID_JMICRON_JMB388_ESD,
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 0c2ed11c0603..f63db346c219 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -638,7 +638,7 @@ static int arm_perf_teardown_cpu(unsigned int cpu, struct hlist_node *node)
                if (irq_is_percpu_devid(irq))
                        disable_percpu_irq(irq);
                else
-                        disable_irq(irq);
+                        disable_irq_nosync(irq);
        }
        per_cpu(cpu_armpmu, cpu) = NULL;
diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c
index c5ff4525edef..c5493ea51282 100644
--- a/drivers/phy/qualcomm/phy-qcom-ufs.c
+++ b/drivers/phy/qualcomm/phy-qcom-ufs.c
@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy)
        return 0;
 }
 EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off);
+MODULE_AUTHOR("Yaniv Gardi <ygardi@codeaurora.org>");
+MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
+MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/chrome/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
index 6dec6ab13300..d8599736a41a 100644
--- a/drivers/platform/chrome/chromeos_laptop.c
+++ b/drivers/platform/chrome/chromeos_laptop.c
@@ -423,7 +423,7 @@ static int chromeos_laptop_probe(struct platform_device *pdev)
        return ret;
 }
-static const struct chromeos_laptop samsung_series_5_550 = {
+static struct chromeos_laptop samsung_series_5_550 = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
@@ -432,14 +432,14 @@ static const struct chromeos_laptop samsung_series_5_550 = {
        },
 };
-static const struct chromeos_laptop samsung_series_5 = {
+static struct chromeos_laptop samsung_series_5 = {
        .i2c_peripherals = {
                /* Light Sensor. */
                { .add = setup_tsl2583_als, I2C_ADAPTER_SMBUS },
        },
 };
-static const struct chromeos_laptop chromebook_pixel = {
+static struct chromeos_laptop chromebook_pixel = {
        .i2c_peripherals = {
                /* Touch Screen. */
                { .add = setup_atmel_1664s_ts, I2C_ADAPTER_PANEL },
@@ -450,14 +450,14 @@ static const struct chromeos_laptop chromebook_pixel = {
        },
 };
-static const struct chromeos_laptop hp_chromebook_14 = {
+static struct chromeos_laptop hp_chromebook_14 = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
        },
 };
-static const struct chromeos_laptop dell_chromebook_11 = {
+static struct chromeos_laptop dell_chromebook_11 = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
@@ -466,28 +466,28 @@ static const struct chromeos_laptop dell_chromebook_11 = {
        },
 };
-static const struct chromeos_laptop toshiba_cb35 = {
+static struct chromeos_laptop toshiba_cb35 = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_DESIGNWARE_0 },
        },
 };
-static const struct chromeos_laptop acer_c7_chromebook = {
+static struct chromeos_laptop acer_c7_chromebook = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
        },
 };
-static const struct chromeos_laptop acer_ac700 = {
+static struct chromeos_laptop acer_ac700 = {
        .i2c_peripherals = {
                /* Light Sensor. */
                { .add = setup_tsl2563_als, I2C_ADAPTER_SMBUS },
        },
 };
-static const struct chromeos_laptop acer_c720 = {
+static struct chromeos_laptop acer_c720 = {
        .i2c_peripherals = {
                /* Touchscreen. */
                { .add = setup_atmel_1664s_ts, I2C_ADAPTER_DESIGNWARE_1 },
@@ -500,14 +500,14 @@ static const struct chromeos_laptop acer_c720 = {
        },
 };
-static const struct chromeos_laptop hp_pavilion_14_chromebook = {
+static struct chromeos_laptop hp_pavilion_14_chromebook = {
        .i2c_peripherals = {
                /* Touchpad. */
                { .add = setup_cyapa_tp, I2C_ADAPTER_SMBUS },
        },
 };
-static const struct chromeos_laptop cr48 = {
+static struct chromeos_laptop cr48 = {
        .i2c_peripherals = {
                /* Light Sensor. */
                { .add = setup_tsl2563_als, I2C_ADAPTER_SMBUS },
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 9a8f96465cdc..51ebc5a6053f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -105,31 +105,45 @@ config ASUS_LAPTOP
          If you have an ACPI-compatible ASUS laptop, say Y or M here.
+#
+# The DELL_SMBIOS driver depends on ACPI_WMI and/or DCDBAS if those
+# backends are selected. The "depends" line prevents a configuration
+# where DELL_SMBIOS=y while either of those dependencies =m.
+#
 config DELL_SMBIOS
-        tristate
+        tristate "Dell SMBIOS driver"
+        depends on DCDBAS || DCDBAS=n
+        depends on ACPI_WMI || ACPI_WMI=n
+        ---help---
+        This provides support for the Dell SMBIOS calling interface.
+        If you have a Dell computer you should enable this option.
+        Be sure to select at least one backend for it to work properly.
 config DELL_SMBIOS_WMI
-        tristate "Dell SMBIOS calling interface (WMI implementation)"
+        bool "Dell SMBIOS driver WMI backend"
+        default y
        depends on ACPI_WMI
        select DELL_WMI_DESCRIPTOR
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
        ---help---
        This provides an implementation for the Dell SMBIOS calling interface
        communicated over ACPI-WMI.
-        If you have a Dell computer from >2007 you should say Y or M here.
+        If you have a Dell computer from >2007 you should say Y here.
        If you aren't sure and this module doesn't work for your computer
        it just won't load.
 config DELL_SMBIOS_SMM
-        tristate "Dell SMBIOS calling interface (SMM implementation)"
+        bool "Dell SMBIOS driver SMM backend"
+        default y
        depends on DCDBAS
-        select DELL_SMBIOS
+        depends on DELL_SMBIOS
        ---help---
        This provides an implementation for the Dell SMBIOS calling interface
        communicated over SMI/SMM.
-        If you have a Dell computer from <=2017 you should say Y or M here.
+        If you have a Dell computer from <=2017 you should say Y here.
        If you aren't sure and this module doesn't work for your computer
        it just won't load.
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index c388608ad2a3..2ba6cb795338 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -13,8 +13,9 @@ obj-$(CONFIG_MSI_LAPTOP)	+= msi-laptop.o
 obj-$(CONFIG_ACPI_CMPC)         += classmate-laptop.o
 obj-$(CONFIG_COMPAL_LAPTOP)     += compal-laptop.o
 obj-$(CONFIG_DELL_SMBIOS)       += dell-smbios.o
-obj-$(CONFIG_DELL_SMBIOS_WMI)   += dell-smbios-wmi.o
+dell-smbios-objs                := dell-smbios-base.o
-obj-$(CONFIG_DELL_SMBIOS_SMM)   += dell-smbios-smm.o
+dell-smbios-$(CONFIG_DELL_SMBIOS_WMI)   += dell-smbios-wmi.o
+dell-smbios-$(CONFIG_DELL_SMBIOS_SMM)   += dell-smbios-smm.o
 obj-$(CONFIG_DELL_LAPTOP)       += dell-laptop.o
 obj-$(CONFIG_DELL_WMI)          += dell-wmi.o
 obj-$(CONFIG_DELL_WMI_DESCRIPTOR)       += dell-wmi-descriptor.o
diff --git a/drivers/platform/x86/dell-smbios.c b/drivers/platform/x86/dell-smbios-base.c
index 8541cde4cb7d..2485c80a9fdd 100644
--- a/drivers/platform/x86/dell-smbios.c
+++ b/drivers/platform/x86/dell-smbios-base.c
@@ -36,7 +36,7 @@ static DEFINE_MUTEX(smbios_mutex);
 struct smbios_device {
        struct list_head list;
        struct device *device;
-        int (*call_fn)(struct calling_interface_buffer *);
+        int (*call_fn)(struct calling_interface_buffer *arg);
 };
 struct smbios_call {
@@ -352,8 +352,10 @@ static void __init parse_da_table(const struct dmi_header *dm)
        struct calling_interface_structure *table =
                container_of(dm, struct calling_interface_structure, header);
-        /* 4 bytes of table header, plus 7 bytes of Dell header, plus at least
+        /*
-           6 bytes of entry */
+         * 4 bytes of table header, plus 7 bytes of Dell header
+         * plus at least 6 bytes of entry
+         */
        if (dm->length < 17)
                return;
@@ -554,7 +556,7 @@ static void free_group(struct platform_device *pdev)
 static int __init dell_smbios_init(void)
 {
        const struct dmi_device *valid;
-        int ret;
+        int ret, wmi, smm;
        valid = dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL);
        if (!valid) {
@@ -589,8 +591,24 @@ static int __init dell_smbios_init(void)
        if (ret)
                goto fail_create_group;
+        /* register backends */
+        wmi = init_dell_smbios_wmi();
+        if (wmi)
+                pr_debug("Failed to initialize WMI backend: %d\n", wmi);
+        smm = init_dell_smbios_smm();
+        if (smm)
+                pr_debug("Failed to initialize SMM backend: %d\n", smm);
+        if (wmi && smm) {
+                pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
+                        wmi, smm);
+                goto fail_sysfs;
+        }
        return 0;
+fail_sysfs:
+        free_group(platform_device);
 fail_create_group:
        platform_device_del(platform_device);
@@ -607,6 +625,8 @@ fail_platform_driver:
 static void __exit dell_smbios_exit(void)
 {
+        exit_dell_smbios_wmi();
+        exit_dell_smbios_smm();
        mutex_lock(&smbios_mutex);
        if (platform_device) {
                free_group(platform_device);
@@ -617,11 +637,12 @@ static void __exit dell_smbios_exit(void)
        mutex_unlock(&smbios_mutex);
 }
-subsys_initcall(dell_smbios_init);
+module_init(dell_smbios_init);
 module_exit(dell_smbios_exit);
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
 MODULE_AUTHOR("Gabriele Mazzotta <gabriele.mzt@gmail.com>");
 MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
+MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
 MODULE_DESCRIPTION("Common functions for kernel modules using Dell SMBIOS");
 MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios-smm.c b/drivers/platform/x86/dell-smbios-smm.c
index 89f65c4651a0..e9e9da556318 100644
--- a/drivers/platform/x86/dell-smbios-smm.c
+++ b/drivers/platform/x86/dell-smbios-smm.c
@@ -58,7 +58,7 @@ static const struct dmi_system_id dell_device_table[] __initconst = {
 };
 MODULE_DEVICE_TABLE(dmi, dell_device_table);
-static void __init parse_da_table(const struct dmi_header *dm)
+static void parse_da_table(const struct dmi_header *dm)
 {
        struct calling_interface_structure *table =
                container_of(dm, struct calling_interface_structure, header);
@@ -73,7 +73,7 @@ static void __init parse_da_table(const struct dmi_header *dm)
        da_command_code = table->cmdIOCode;
 }
-static void __init find_cmd_address(const struct dmi_header *dm, void *dummy)
+static void find_cmd_address(const struct dmi_header *dm, void *dummy)
 {
        switch (dm->type) {
        case 0xda: /* Calling interface */
@@ -128,7 +128,7 @@ static bool test_wsmt_enabled(void)
        return false;
 }
-static int __init dell_smbios_smm_init(void)
+int init_dell_smbios_smm(void)
 {
        int ret;
        /*
@@ -176,7 +176,7 @@ fail_platform_device_alloc:
        return ret;
 }
-static void __exit dell_smbios_smm_exit(void)
+void exit_dell_smbios_smm(void)
 {
        if (platform_device) {
                dell_smbios_unregister_device(&platform_device->dev);
@@ -184,13 +184,3 @@ static void __exit dell_smbios_smm_exit(void)
                free_page((unsigned long)buffer);
        }
 }
-subsys_initcall(dell_smbios_smm_init);
-module_exit(dell_smbios_smm_exit);
-MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
-MODULE_AUTHOR("Gabriele Mazzotta <gabriele.mzt@gmail.com>");
-MODULE_AUTHOR("Pali Rohár <pali.rohar@gmail.com>");
-MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
-MODULE_DESCRIPTION("Dell SMBIOS communications over SMI");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index 609557aa5868..fbefedb1c172 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -228,7 +228,7 @@ static const struct wmi_device_id dell_smbios_wmi_id_table[] = {
        { },
 };
-static void __init parse_b1_table(const struct dmi_header *dm)
+static void parse_b1_table(const struct dmi_header *dm)
 {
        struct misc_bios_flags_structure *flags =
        container_of(dm, struct misc_bios_flags_structure, header);
@@ -242,7 +242,7 @@ static void __init parse_b1_table(const struct dmi_header *dm)
                wmi_supported = 1;
 }
-static void __init find_b1(const struct dmi_header *dm, void *dummy)
+static void find_b1(const struct dmi_header *dm, void *dummy)
 {
        switch (dm->type) {
        case 0xb1: /* misc bios flags */
@@ -261,7 +261,7 @@ static struct wmi_driver dell_smbios_wmi_driver = {
        .filter_callback = dell_smbios_wmi_filter,
 };
-static int __init init_dell_smbios_wmi(void)
+int init_dell_smbios_wmi(void)
 {
        dmi_walk(find_b1, NULL);
@@ -271,15 +271,9 @@ static int __init init_dell_smbios_wmi(void)
        return wmi_driver_register(&dell_smbios_wmi_driver);
 }
-static void __exit exit_dell_smbios_wmi(void)
+void exit_dell_smbios_wmi(void)
 {
        wmi_driver_unregister(&dell_smbios_wmi_driver);
 }
-module_init(init_dell_smbios_wmi);
-module_exit(exit_dell_smbios_wmi);
 MODULE_ALIAS("wmi:" DELL_WMI_SMBIOS_GUID);
-MODULE_AUTHOR("Mario Limonciello <mario.limonciello@dell.com>");
-MODULE_DESCRIPTION("Dell SMBIOS communications over WMI");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-smbios.h b/drivers/platform/x86/dell-smbios.h
index 138d478d9adc..d8adaf959740 100644
--- a/drivers/platform/x86/dell-smbios.h
+++ b/drivers/platform/x86/dell-smbios.h
@@ -75,4 +75,29 @@ int dell_laptop_register_notifier(struct notifier_block *nb);
 int dell_laptop_unregister_notifier(struct notifier_block *nb);
 void dell_laptop_call_notifier(unsigned long action, void *data);
-#endif
+/* for the supported backends */
+#ifdef CONFIG_DELL_SMBIOS_WMI
+int init_dell_smbios_wmi(void);
+void exit_dell_smbios_wmi(void);
+#else /* CONFIG_DELL_SMBIOS_WMI */
+static inline int init_dell_smbios_wmi(void)
+{
+        return -ENODEV;
+}
+static inline void exit_dell_smbios_wmi(void)
+{}
+#endif /* CONFIG_DELL_SMBIOS_WMI */
+#ifdef CONFIG_DELL_SMBIOS_SMM
+int init_dell_smbios_smm(void);
+void exit_dell_smbios_smm(void);
+#else /* CONFIG_DELL_SMBIOS_SMM */
+static inline int init_dell_smbios_smm(void)
+{
+        return -ENODEV;
+}
+static inline void exit_dell_smbios_smm(void)
+{}
+#endif /* CONFIG_DELL_SMBIOS_SMM */
+#endif /* _DELL_SMBIOS_H_ */
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 2c9927430d85..8d102195a392 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -714,7 +714,7 @@ static int __init dell_wmi_init(void)
        return wmi_driver_register(&dell_wmi_driver);
 }
-module_init(dell_wmi_init);
+late_initcall(dell_wmi_init);
 static void __exit dell_wmi_exit(void)
 {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index dd4708c58480..1fc0c0811da4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -4310,7 +4310,7 @@ static int _regulator_resume_early(struct device *dev, void *data)
        rstate = regulator_get_suspend_state(rdev, *state);
        if (rstate == NULL)
-                return -EINVAL;
+                return 0;
        mutex_lock(&rdev->mutex);
diff --git a/drivers/regulator/stm32-vrefbuf.c b/drivers/regulator/stm32-vrefbuf.c
index 72c8b3e1022b..e0a9c445ed67 100644
--- a/drivers/regulator/stm32-vrefbuf.c
+++ b/drivers/regulator/stm32-vrefbuf.c
@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct regulator_dev *rdev)
         * arbitrary timeout.
         */
        ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val,
-                                 !(val & STM32_VRR), 650, 10000);
+                                 val & STM32_VRR, 650, 10000);
        if (ret) {
                dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n");
                val = readl_relaxed(priv->base + STM32_VREFBUF_CSR);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index a7c15f0085e2..ecef8e73d40b 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2581,8 +2581,6 @@ int dasd_cancel_req(struct dasd_ccw_req *cqr)
        case DASD_CQR_QUEUED:
                /* request was not started - just set to cleared */
                cqr->status = DASD_CQR_CLEARED;
-                if (cqr->callback_data == DASD_SLEEPON_START_TAG)
-                        cqr->callback_data = DASD_SLEEPON_END_TAG;
                break;
        case DASD_CQR_IN_IO:
                /* request in IO - terminate IO and release again */
@@ -3902,9 +3900,12 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                wait_event(dasd_flush_wq,
                           (cqr->status != DASD_CQR_CLEAR_PENDING));
-                /* mark sleepon requests as ended */
+                /*
-                if (cqr->callback_data == DASD_SLEEPON_START_TAG)
+                 * requeue requests to blocklayer will only work
-                        cqr->callback_data = DASD_SLEEPON_END_TAG;
+                 * for block device requests
+                 */
+                if (_dasd_requeue_request(cqr))
+                        continue;
                /* remove requests from device and block queue */
                list_del_init(&cqr->devlist);
@@ -3917,13 +3918,6 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                        cqr = refers;
                }
-                /*
-                 * requeue requests to blocklayer will only work
-                 * for block device requests
-                 */
-                if (_dasd_requeue_request(cqr))
-                        continue;
                if (cqr->block)
                        list_del_init(&cqr->blocklist);
                cqr->block->base->discipline->free_cp(
@@ -3940,8 +3934,7 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
                list_splice_tail(&requeue_queue, &device->ccw_queue);
                spin_unlock_irq(get_ccwdev_lock(device->cdev));
        }
-        /* wake up generic waitqueue for eventually ended sleepon requests */
+        dasd_schedule_device_bh(device);
-        wake_up(&generic_waitq);
        return rc;
 }
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 1319122e9d12..9169af7dbb43 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -795,6 +795,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event)
        ccw_device_set_timeout(cdev, 0);
        cdev->private->iretry = 255;
+        cdev->private->async_kill_io_rc = -ETIMEDOUT;
        ret = ccw_device_cancel_halt_clear(cdev);
        if (ret == -EBUSY) {
                ccw_device_set_timeout(cdev, 3*HZ);
@@ -871,7 +872,7 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
        /* OK, i/o is dead now. Call interrupt handler. */
        if (cdev->handler)
                cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-EIO));
+                              ERR_PTR(cdev->private->async_kill_io_rc));
 }
 static void
@@ -888,14 +889,16 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
        ccw_device_online_verify(cdev, 0);
        if (cdev->handler)
                cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-EIO));
+                              ERR_PTR(cdev->private->async_kill_io_rc));
 }
 void ccw_device_kill_io(struct ccw_device *cdev)
 {
        int ret;
+        ccw_device_set_timeout(cdev, 0);
        cdev->private->iretry = 255;
+        cdev->private->async_kill_io_rc = -EIO;
        ret = ccw_device_cancel_halt_clear(cdev);
        if (ret == -EBUSY) {
                ccw_device_set_timeout(cdev, 3*HZ);
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 1caf6a398760..75ce12a24dc2 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -159,7 +159,7 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
 }
 /**
- * ccw_device_start_key() - start a s390 channel program with key
+ * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
 * @cdev: target ccw device
 * @cpa: logical start address of channel program
 * @intparm: user specific interruption parameter; will be presented back to
@@ -170,10 +170,15 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
 * @key: storage key to be used for the I/O
 * @flags: additional flags; defines the action to be performed for I/O
 *         processing.
+ * @expires: timeout value in jiffies
 *
 * Start a S/390 channel program. When the interrupt arrives, the
 * IRQ handler is called, either immediately, delayed (dev-end missing,
 * or sense required) or never (no IRQ handler registered).
+ * This function notifies the device driver if the channel program has not
+ * completed during the time specified by @expires. If a timeout occurs, the
+ * channel program is terminated via xsch, hsch or csch, and the device's
+ * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
 * Returns:
 *  %0, if the operation was successful;
 *  -%EBUSY, if the device is busy, or status pending;
@@ -182,9 +187,9 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
 * Context:
 *  Interrupts disabled, ccw device lock held
 */
-int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
+int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
-                         unsigned long intparm, __u8 lpm, __u8 key,
+                                 unsigned long intparm, __u8 lpm, __u8 key,
-                         unsigned long flags)
+                                 unsigned long flags, int expires)
 {
        struct subchannel *sch;
        int ret;
@@ -224,6 +229,8 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
        switch (ret) {
        case 0:
                cdev->private->intparm = intparm;
+                if (expires)
+                        ccw_device_set_timeout(cdev, expires);
                break;
        case -EACCES:
        case -ENODEV:
@@ -234,7 +241,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
 }
 /**
- * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
+ * ccw_device_start_key() - start a s390 channel program with key
 * @cdev: target ccw device
 * @cpa: logical start address of channel program
 * @intparm: user specific interruption parameter; will be presented back to
@@ -245,15 +252,10 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
 * @key: storage key to be used for the I/O
 * @flags: additional flags; defines the action to be performed for I/O
 *         processing.
- * @expires: timeout value in jiffies
 *
 * Start a S/390 channel program. When the interrupt arrives, the
 * IRQ handler is called, either immediately, delayed (dev-end missing,
 * or sense required) or never (no IRQ handler registered).
- * This function notifies the device driver if the channel program has not
- * completed during the time specified by @expires. If a timeout occurs, the
- * channel program is terminated via xsch, hsch or csch, and the device's
- * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
 * Returns:
 *  %0, if the operation was successful;
 *  -%EBUSY, if the device is busy, or status pending;
@@ -262,19 +264,12 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
 * Context:
 *  Interrupts disabled, ccw device lock held
 */
-int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
+int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
-                                 unsigned long intparm, __u8 lpm, __u8 key,
+                         unsigned long intparm, __u8 lpm, __u8 key,
-                                 unsigned long flags, int expires)
+                         unsigned long flags)
 {
-        int ret;
+        return ccw_device_start_timeout_key(cdev, cpa, intparm, lpm, key,
+                                            flags, 0);
-        if (!cdev)
-                return -ENODEV;
-        ccw_device_set_timeout(cdev, expires);
-        ret = ccw_device_start_key(cdev, cpa, intparm, lpm, key, flags);
-        if (ret != 0)
-                ccw_device_set_timeout(cdev, 0);
-        return ret;
 }
 /**
@@ -489,18 +484,20 @@ void ccw_device_get_id(struct ccw_device *cdev, struct ccw_dev_id *dev_id)
 EXPORT_SYMBOL(ccw_device_get_id);
 /**
- * ccw_device_tm_start_key() - perform start function
+ * ccw_device_tm_start_timeout_key() - perform start function
 * @cdev: ccw device on which to perform the start function
 * @tcw: transport-command word to be started
 * @intparm: user defined parameter to be passed to the interrupt handler
 * @lpm: mask of paths to use
 * @key: storage key to use for storage access
+ * @expires: time span in jiffies after which to abort request
 *
 * Start the tcw on the given ccw device. Return zero on success, non-zero
 * otherwise.
 */
-int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
+int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
-                            unsigned long intparm, u8 lpm, u8 key)
+                                    unsigned long intparm, u8 lpm, u8 key,
+                                    int expires)
 {
        struct subchannel *sch;
        int rc;
@@ -527,37 +524,32 @@ int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
                        return -EACCES;
        }
        rc = cio_tm_start_key(sch, tcw, lpm, key);
-        if (rc == 0)
+        if (rc == 0) {
                cdev->private->intparm = intparm;
+                if (expires)
+                        ccw_device_set_timeout(cdev, expires);
+        }
        return rc;
 }
-EXPORT_SYMBOL(ccw_device_tm_start_key);
+EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
 /**
- * ccw_device_tm_start_timeout_key() - perform start function
+ * ccw_device_tm_start_key() - perform start function
 * @cdev: ccw device on which to perform the start function
 * @tcw: transport-command word to be started
 * @intparm: user defined parameter to be passed to the interrupt handler
 * @lpm: mask of paths to use
 * @key: storage key to use for storage access
- * @expires: time span in jiffies after which to abort request
 *
 * Start the tcw on the given ccw device. Return zero on success, non-zero
 * otherwise.
 */
-int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
+int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
-                                    unsigned long intparm, u8 lpm, u8 key,
+                            unsigned long intparm, u8 lpm, u8 key)
-                                    int expires)
 {
-        int ret;
+        return ccw_device_tm_start_timeout_key(cdev, tcw, intparm, lpm, key, 0);
-        ccw_device_set_timeout(cdev, expires);
-        ret = ccw_device_tm_start_key(cdev, tcw, intparm, lpm, key);
-        if (ret != 0)
-                ccw_device_set_timeout(cdev, 0);
-        return ret;
 }
-EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
+EXPORT_SYMBOL(ccw_device_tm_start_key);
 /**
 * ccw_device_tm_start() - perform start function
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index af571d8d6925..90e4e3a7841b 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -157,6 +157,7 @@ struct ccw_device_private {
        unsigned long intparm;  /* user interruption parameter */
        struct qdio_irq *qdio_data;
        struct irb irb;         /* device status */
+        int async_kill_io_rc;
        struct senseid senseid; /* SenseID info */
        struct pgid pgid[8];    /* path group IDs per chpid*/
        struct ccw1 iccws[2];   /* ccws for SNID/SID/SPGID commands */
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 8c97ce2516bb..19203340f879 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -527,8 +527,7 @@ static inline int qeth_is_cq(struct qeth_card *card, unsigned int queue)
            queue == card->qdio.no_in_queues - 1;
 }
+static int __qeth_issue_next_read(struct qeth_card *card)
-static int qeth_issue_next_read(struct qeth_card *card)
 {
        int rc;
        struct qeth_cmd_buffer *iob;
@@ -559,6 +558,17 @@ static int qeth_issue_next_read(struct qeth_card *card)
        return rc;
 }
+static int qeth_issue_next_read(struct qeth_card *card)
+{
+        int ret;
+        spin_lock_irq(get_ccwdev_lock(CARD_RDEV(card)));
+        ret = __qeth_issue_next_read(card);
+        spin_unlock_irq(get_ccwdev_lock(CARD_RDEV(card)));
+        return ret;
+}
 static struct qeth_reply *qeth_alloc_reply(struct qeth_card *card)
 {
        struct qeth_reply *reply;
@@ -957,7 +967,7 @@ void qeth_clear_thread_running_bit(struct qeth_card *card, unsigned long thread)
        spin_lock_irqsave(&card->thread_mask_lock, flags);
        card->thread_running_mask &= ~thread;
        spin_unlock_irqrestore(&card->thread_mask_lock, flags);
-        wake_up(&card->wait_q);
+        wake_up_all(&card->wait_q);
 }
 EXPORT_SYMBOL_GPL(qeth_clear_thread_running_bit);
@@ -1161,6 +1171,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                }
                rc = qeth_get_problem(cdev, irb);
                if (rc) {
+                        card->read_or_write_problem = 1;
                        qeth_clear_ipacmd_list(card);
                        qeth_schedule_recovery(card);
                        goto out;
@@ -1179,7 +1190,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
                return;
        if (channel == &card->read &&
            channel->state == CH_STATE_UP)
-                qeth_issue_next_read(card);
+                __qeth_issue_next_read(card);
        iob = channel->iob;
        index = channel->buf_no;
@@ -5083,8 +5094,6 @@ static void qeth_core_free_card(struct qeth_card *card)
        QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
        qeth_clean_channel(&card->read);
        qeth_clean_channel(&card->write);
-        if (card->dev)
-                free_netdev(card->dev);
        qeth_free_qdio_buffers(card);
        unregister_service_level(&card->qeth_service_level);
        kfree(card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 8f5babdccb42..50a313806dde 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -913,8 +913,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
                qeth_l2_set_offline(cgdev);
        if (card->dev) {
-                netif_napi_del(&card->napi);
                unregister_netdev(card->dev);
+                free_netdev(card->dev);
                card->dev = NULL;
        }
        return;
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index ef3f548b7d35..c1a16a74aa83 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2713,8 +2713,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
                qeth_l3_set_offline(cgdev);
        if (card->dev) {
-                netif_napi_del(&card->napi);
                unregister_netdev(card->dev);
+                free_netdev(card->dev);
                card->dev = NULL;
        }
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 57bf43e34863..dd9464920456 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct device *dev)
        if (shost->work_q)
                destroy_workqueue(shost->work_q);
-        destroy_rcu_head(&shost->rcu);
        if (shost->shost_state == SHOST_CREATED) {
                /*
                 * Free the shost_dev device name here if scsi_host_alloc()
@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
        INIT_LIST_HEAD(&shost->starved_list);
        init_waitqueue_head(&shost->host_wait);
        mutex_init(&shost->scan_mutex);
-        init_rcu_head(&shost->rcu);
        index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
        if (index < 0)
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 6de9681ace82..ceab5e5c41c2 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -223,6 +223,7 @@ out_done:
 static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
 {
        struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host);
+        struct domain_device *dev = cmd_to_domain_dev(cmd);
        struct sas_task *task = TO_SAS_TASK(cmd);
        /* At this point, we only get called following an actual abort
@@ -231,6 +232,14 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
         */
        sas_end_task(cmd, task);
+        if (dev_is_sata(dev)) {
+                /* defer commands to libata so that libata EH can
+                 * handle ata qcs correctly
+                 */
+                list_move_tail(&cmd->eh_entry, &sas_ha->eh_ata_q);
+                return;
+        }
        /* now finish the command and move it on to the error
         * handler done list, this also takes it off the
         * error handler pending list.
@@ -238,22 +247,6 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
        scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q);
 }
-static void sas_eh_defer_cmd(struct scsi_cmnd *cmd)
-{
-        struct domain_device *dev = cmd_to_domain_dev(cmd);
-        struct sas_ha_struct *ha = dev->port->ha;
-        struct sas_task *task = TO_SAS_TASK(cmd);
-        if (!dev_is_sata(dev)) {
-                sas_eh_finish_cmd(cmd);
-                return;
-        }
-        /* report the timeout to libata */
-        sas_end_task(cmd, task);
-        list_move_tail(&cmd->eh_entry, &ha->eh_ata_q);
-}
 static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd *my_cmd)
 {
        struct scsi_cmnd *cmd, *n;
@@ -261,7 +254,7 @@ static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd
        list_for_each_entry_safe(cmd, n, error_q, eh_entry) {
                if (cmd->device->sdev_target == my_cmd->device->sdev_target &&
                    cmd->device->lun == my_cmd->device->lun)
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
        }
 }
@@ -631,12 +624,12 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
                case TASK_IS_DONE:
                        SAS_DPRINTK("%s: task 0x%p is done\n", __func__,
                                    task);
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
                        continue;
                case TASK_IS_ABORTED:
                        SAS_DPRINTK("%s: task 0x%p is aborted\n",
                                    __func__, task);
-                        sas_eh_defer_cmd(cmd);
+                        sas_eh_finish_cmd(cmd);
                        continue;
                case TASK_IS_AT_LU:
                        SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task);
@@ -647,7 +640,7 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
                                            "recovered\n",
                                            SAS_ADDR(task->dev),
                                            cmd->device->lun);
-                                sas_eh_defer_cmd(cmd);
+                                sas_eh_finish_cmd(cmd);
                                sas_scsi_clear_queue_lu(work_q, cmd);
                                goto Again;
                        }
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 073ced07e662..dc8e850fbfd2 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -216,36 +216,30 @@ inline void megasas_return_cmd_fusion(struct megasas_instance *instance,
 /**
 * megasas_fire_cmd_fusion -    Sends command to the FW
 * @instance:                   Adapter soft state
- * @req_desc:                   32bit or 64bit Request descriptor
+ * @req_desc:                   64bit Request descriptor
 *
- * Perform PCI Write. Ventura supports 32 bit Descriptor.
+ * Perform PCI Write.
- * Prior to Ventura (12G) MR controller supports 64 bit Descriptor.
 */
 static void
 megasas_fire_cmd_fusion(struct megasas_instance *instance,
                union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc)
 {
-        if (instance->adapter_type == VENTURA_SERIES)
-                writel(le32_to_cpu(req_desc->u.low),
-                        &instance->reg_set->inbound_single_queue_port);
-        else {
 #if defined(writeq) && defined(CONFIG_64BIT)
-                u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) |
+        u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) |
-                                le32_to_cpu(req_desc->u.low));
+                le32_to_cpu(req_desc->u.low));
-                writeq(req_data, &instance->reg_set->inbound_low_queue_port);
+        writeq(req_data, &instance->reg_set->inbound_low_queue_port);
 #else
-                unsigned long flags;
+        unsigned long flags;
-                spin_lock_irqsave(&instance->hba_lock, flags);
+        spin_lock_irqsave(&instance->hba_lock, flags);
-                writel(le32_to_cpu(req_desc->u.low),
+        writel(le32_to_cpu(req_desc->u.low),
-                        &instance->reg_set->inbound_low_queue_port);
+                &instance->reg_set->inbound_low_queue_port);
-                writel(le32_to_cpu(req_desc->u.high),
+        writel(le32_to_cpu(req_desc->u.high),
-                        &instance->reg_set->inbound_high_queue_port);
+                &instance->reg_set->inbound_high_queue_port);
-                mmiowb();
+        mmiowb();
-                spin_unlock_irqrestore(&instance->hba_lock, flags);
+        spin_unlock_irqrestore(&instance->hba_lock, flags);
 #endif
-        }
 }
 /**
@@ -982,7 +976,6 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
        const char *sys_info;
        MFI_CAPABILITIES *drv_ops;
        u32 scratch_pad_2;
-        unsigned long flags;
        ktime_t time;
        bool cur_fw_64bit_dma_capable;
@@ -1121,14 +1114,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
                        break;
        }
-        /* For Ventura also IOC INIT required 64 bit Descriptor write. */
+        megasas_fire_cmd_fusion(instance, &req_desc);
-        spin_lock_irqsave(&instance->hba_lock, flags);
-        writel(le32_to_cpu(req_desc.u.low),
-               &instance->reg_set->inbound_low_queue_port);
-        writel(le32_to_cpu(req_desc.u.high),
-               &instance->reg_set->inbound_high_queue_port);
-        mmiowb();
-        spin_unlock_irqrestore(&instance->hba_lock, flags);
        wait_and_poll(instance, cmd, MFI_POLL_TIMEOUT_SECS);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 59a87ca328d3..0aafbfd1b746 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -6297,14 +6297,14 @@ _base_reset_handler(struct MPT3SAS_ADAPTER *ioc, int reset_phase)
 }
 /**
- * _wait_for_commands_to_complete - reset controller
+ * mpt3sas_wait_for_commands_to_complete - reset controller
 * @ioc: Pointer to MPT_ADAPTER structure
 *
 * This function is waiting 10s for all pending commands to complete
 * prior to putting controller in reset.
 */
-static void
+void
-_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc)
+mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc)
 {
        u32 ioc_state;
@@ -6377,7 +6377,7 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc,
                        is_fault = 1;
        }
        _base_reset_handler(ioc, MPT3_IOC_PRE_RESET);
-        _wait_for_commands_to_complete(ioc);
+        mpt3sas_wait_for_commands_to_complete(ioc);
        _base_mask_interrupts(ioc);
        r = _base_make_ioc_ready(ioc, type);
        if (r)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index 789bc421424b..99ccf83b8c51 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -1433,6 +1433,9 @@ void mpt3sas_base_update_missing_delay(struct MPT3SAS_ADAPTER *ioc,
 int mpt3sas_port_enable(struct MPT3SAS_ADAPTER *ioc);
+void
+mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc);
 /* scsih shared API */
 struct scsi_cmnd *mpt3sas_scsih_scsi_lookup_get(struct MPT3SAS_ADAPTER *ioc,
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 74fca184dba9..a1cb0236c550 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -2835,7 +2835,8 @@ scsih_abort(struct scsi_cmnd *scmd)
        _scsih_tm_display_info(ioc, scmd);
        sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                sdev_printk(KERN_INFO, scmd->device,
                        "device been deleted! scmd(%p)\n", scmd);
                scmd->result = DID_NO_CONNECT << 16;
@@ -2898,7 +2899,8 @@ scsih_dev_reset(struct scsi_cmnd *scmd)
        _scsih_tm_display_info(ioc, scmd);
        sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                sdev_printk(KERN_INFO, scmd->device,
                        "device been deleted! scmd(%p)\n", scmd);
                scmd->result = DID_NO_CONNECT << 16;
@@ -2961,7 +2963,8 @@ scsih_target_reset(struct scsi_cmnd *scmd)
        _scsih_tm_display_info(ioc, scmd);
        sas_device_priv_data = scmd->device->hostdata;
-        if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
+        if (!sas_device_priv_data || !sas_device_priv_data->sas_target ||
+            ioc->remove_host) {
                starget_printk(KERN_INFO, starget, "target been deleted! scmd(%p)\n",
                        scmd);
                scmd->result = DID_NO_CONNECT << 16;
@@ -3019,7 +3022,7 @@ scsih_host_reset(struct scsi_cmnd *scmd)
            ioc->name, scmd);
        scsi_print_command(scmd);
-        if (ioc->is_driver_loading) {
+        if (ioc->is_driver_loading || ioc->remove_host) {
                pr_info(MPT3SAS_FMT "Blocking the host reset\n",
                    ioc->name);
                r = FAILED;
@@ -4453,7 +4456,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc)
                st = scsi_cmd_priv(scmd);
                mpt3sas_base_clear_st(ioc, st);
                scsi_dma_unmap(scmd);
-                if (ioc->pci_error_recovery)
+                if (ioc->pci_error_recovery || ioc->remove_host)
                        scmd->result = DID_NO_CONNECT << 16;
                else
                        scmd->result = DID_RESET << 16;
@@ -9739,6 +9742,10 @@ static void scsih_remove(struct pci_dev *pdev)
        unsigned long flags;
        ioc->remove_host = 1;
+        mpt3sas_wait_for_commands_to_complete(ioc);
+        _scsih_flush_running_cmds(ioc);
        _scsih_fw_event_cleanup_queue(ioc);
        spin_lock_irqsave(&ioc->fw_event_lock, flags);
@@ -9815,6 +9822,10 @@ scsih_shutdown(struct pci_dev *pdev)
        unsigned long flags;
        ioc->remove_host = 1;
+        mpt3sas_wait_for_commands_to_complete(ioc);
+        _scsih_flush_running_cmds(ioc);
        _scsih_fw_event_cleanup_queue(ioc);
        spin_lock_irqsave(&ioc->fw_event_lock, flags);
@@ -10547,7 +10558,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
            "fw_event_%s%d", ioc->driver_name, ioc->id);
        ioc->firmware_event_thread = alloc_ordered_workqueue(
-            ioc->firmware_event_name, WQ_MEM_RECLAIM);
+            ioc->firmware_event_name, 0);
        if (!ioc->firmware_event_thread) {
                pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                    ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index 667d7697ba01..d09afe1b567d 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -762,6 +762,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
        iscsi_cid = cqe->conn_id;
        qedi_conn = qedi->cid_que.conn_cid_tbl[iscsi_cid];
+        if (!qedi_conn) {
+                QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+                          "icid not found 0x%x\n", cqe->conn_id);
+                return;
+        }
        /* Based on this itt get the corresponding qedi_cmd */
        spin_lock_bh(&qedi_conn->tmf_work_lock);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index be7d6824581a..c9689f97c307 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -261,9 +261,9 @@
 struct name_list_extended {
        struct get_name_list_extended *l;
        dma_addr_t              ldma;
-        struct list_head        fcports;        /* protect by sess_list */
+        struct list_head        fcports;
+        spinlock_t              fcports_lock;
        u32                     size;
-        u8                      sent;
 };
 /*
 * Timeout timer counts in seconds
@@ -2217,6 +2217,7 @@ typedef struct {
 /* FCP-4 types */
 #define FC4_TYPE_FCP_SCSI       0x08
+#define FC4_TYPE_NVME           0x28
 #define FC4_TYPE_OTHER          0x0
 #define FC4_TYPE_UNKNOWN        0xff
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 5bf9a59432f6..403fa096f8c8 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3179,6 +3179,7 @@ done_free_sp:
        sp->free(sp);
        fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        return rval;
 }
@@ -3370,6 +3371,7 @@ done_free_sp:
        sp->free(sp);
        fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        return rval;
 }
@@ -3971,6 +3973,9 @@ out:
        spin_lock_irqsave(&vha->work_lock, flags);
        vha->scan.scan_flags &= ~SF_SCANNING;
        spin_unlock_irqrestore(&vha->work_lock, flags);
+        if ((fc4type == FC4_TYPE_FCP_SCSI) && vha->flags.nvme_enabled)
+                qla24xx_async_gpnft(vha, FC4_TYPE_NVME);
 }
 static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2dea1129d396..8d7fab3cd01d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -213,6 +213,7 @@ done_free_sp:
        sp->free(sp);
        fcport->flags &= ~FCF_ASYNC_SENT;
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        return rval;
 }
@@ -263,7 +264,7 @@ qla2x00_async_logout(struct scsi_qla_host *vha, fc_port_t *fcport)
 done_free_sp:
        sp->free(sp);
 done:
-        fcport->flags &= ~FCF_ASYNC_SENT;
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
        return rval;
 }
@@ -271,6 +272,7 @@ void
 qla2x00_async_prlo_done(struct scsi_qla_host *vha, fc_port_t *fcport,
    uint16_t *data)
 {
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        /* Don't re-login in target mode */
        if (!fcport->tgt_session)
                qla2x00_mark_device_lost(vha, fcport, 1, 0);
@@ -284,6 +286,7 @@ qla2x00_async_prlo_sp_done(void *s, int res)
        struct srb_iocb *lio = &sp->u.iocb_cmd;
        struct scsi_qla_host *vha = sp->vha;
+        sp->fcport->flags &= ~FCF_ASYNC_ACTIVE;
        if (!test_bit(UNLOADING, &vha->dpc_flags))
                qla2x00_post_async_prlo_done_work(sp->fcport->vha, sp->fcport,
                    lio->u.logio.data);
@@ -322,6 +325,7 @@ qla2x00_async_prlo(struct scsi_qla_host *vha, fc_port_t *fcport)
 done_free_sp:
        sp->free(sp);
 done:
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        return rval;
 }
@@ -375,6 +379,8 @@ qla2x00_async_adisc_sp_done(void *ptr, int res)
            "Async done-%s res %x %8phC\n",
            sp->name, res, sp->fcport->port_name);
+        sp->fcport->flags &= ~FCF_ASYNC_SENT;
        memset(&ea, 0, sizeof(ea));
        ea.event = FCME_ADISC_DONE;
        ea.rc = res;
@@ -425,7 +431,7 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport,
 done_free_sp:
        sp->free(sp);
 done:
-        fcport->flags &= ~FCF_ASYNC_SENT;
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
        qla2x00_post_async_adisc_work(vha, fcport, data);
        return rval;
 }
@@ -643,8 +649,7 @@ qla24xx_async_gnl_sp_done(void *s, int res)
                    (loop_id & 0x7fff));
        }
-        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+        spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
-        vha->gnl.sent = 0;
        INIT_LIST_HEAD(&h);
        fcport = tf = NULL;
@@ -653,12 +658,16 @@ qla24xx_async_gnl_sp_done(void *s, int res)
        list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
                list_del_init(&fcport->gnl_entry);
+                spin_lock(&vha->hw->tgt.sess_lock);
                fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+                spin_unlock(&vha->hw->tgt.sess_lock);
                ea.fcport = fcport;
                qla2x00_fcport_event_handler(vha, &ea);
        }
+        spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
+        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
        /* create new fcport if fw has knowledge of new sessions */
        for (i = 0; i < n; i++) {
                port_id_t id;
@@ -710,18 +719,21 @@ int qla24xx_async_gnl(struct scsi_qla_host *vha, fc_port_t *fcport)
        ql_dbg(ql_dbg_disc, vha, 0x20d9,
            "Async-gnlist WWPN %8phC \n", fcport->port_name);
-        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+        spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
+        if (!list_empty(&fcport->gnl_entry)) {
+                spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
+                rval = QLA_SUCCESS;
+                goto done;
+        }
+        spin_lock(&vha->hw->tgt.sess_lock);
        fcport->disc_state = DSC_GNL;
        fcport->last_rscn_gen = fcport->rscn_gen;
        fcport->last_login_gen = fcport->login_gen;
+        spin_unlock(&vha->hw->tgt.sess_lock);
        list_add_tail(&fcport->gnl_entry, &vha->gnl.fcports);
-        if (vha->gnl.sent) {
+        spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
-                spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
-                return QLA_SUCCESS;
-        }
-        vha->gnl.sent = 1;
-        spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
        sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
        if (!sp)
@@ -1049,6 +1061,7 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
        fc_port_t *fcport = ea->fcport;
        struct port_database_24xx *pd;
        struct srb *sp = ea->sp;
+        uint8_t ls;
        pd = (struct port_database_24xx *)sp->u.iocb_cmd.u.mbx.in;
@@ -1061,7 +1074,12 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
        if (fcport->disc_state == DSC_DELETE_PEND)
                return;
-        switch (pd->current_login_state) {
+        if (fcport->fc4f_nvme)
+                ls = pd->current_login_state >> 4;
+        else
+                ls = pd->current_login_state & 0xf;
+        switch (ls) {
        case PDS_PRLI_COMPLETE:
                __qla24xx_parse_gpdb(vha, fcport, pd);
                break;
@@ -1151,8 +1169,9 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
        if (fcport->scan_state != QLA_FCPORT_FOUND)
                return 0;
-        if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
+        if ((fcport->loop_id != FC_NO_LOOP_ID) &&
-            (fcport->fw_login_state == DSC_LS_PRLI_PEND))
+            ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
+             (fcport->fw_login_state == DSC_LS_PRLI_PEND)))
                return 0;
        if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
@@ -1527,6 +1546,7 @@ qla24xx_abort_sp_done(void *ptr, int res)
        srb_t *sp = ptr;
        struct srb_iocb *abt = &sp->u.iocb_cmd;
+        del_timer(&sp->u.iocb_cmd.timer);
        complete(&abt->u.abt.comp);
 }
@@ -1699,7 +1719,6 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
                        set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
                        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
-                        ea->fcport->loop_id = FC_NO_LOOP_ID;
                        ea->fcport->chip_reset = vha->hw->base_qpair->chip_reset;
                        ea->fcport->logout_on_delete = 1;
                        ea->fcport->send_els_logo = 0;
@@ -1791,6 +1810,7 @@ qla2x00_async_logout_done(struct scsi_qla_host *vha, fc_port_t *fcport,
        qla2x00_mark_device_lost(vha, fcport, 1, 0);
        qlt_logo_completion_handler(fcport, data[0]);
        fcport->login_gen++;
+        fcport->flags &= ~FCF_ASYNC_ACTIVE;
        return;
 }
@@ -1798,6 +1818,7 @@ void
 qla2x00_async_adisc_done(struct scsi_qla_host *vha, fc_port_t *fcport,
    uint16_t *data)
 {
+        fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
        if (data[0] == MBS_COMMAND_COMPLETE) {
                qla2x00_update_fcport(vha, fcport);
@@ -1805,7 +1826,6 @@ qla2x00_async_adisc_done(struct scsi_qla_host *vha, fc_port_t *fcport,
        }
        /* Retry login. */
-        fcport->flags &= ~FCF_ASYNC_SENT;
        if (data[1] & QLA_LOGIO_LOGIN_RETRIED)
                set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
        else
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index afcb5567998a..5c5dcca4d1da 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -454,7 +454,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req,
        ha->req_q_map[0] = req;
        set_bit(0, ha->rsp_qid_map);
        set_bit(0, ha->req_qid_map);
-        return 1;
+        return 0;
 fail_qpair_map:
        kfree(ha->base_qpair);
@@ -471,6 +471,9 @@ fail_req_map:
 static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
 {
+        if (!ha->req_q_map)
+                return;
        if (IS_QLAFX00(ha)) {
                if (req && req->ring_fx00)
                        dma_free_coherent(&ha->pdev->dev,
@@ -481,14 +484,17 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req)
                (req->length + 1) * sizeof(request_t),
                req->ring, req->dma);
-        if (req)
+        if (req) {
                kfree(req->outstanding_cmds);
+                kfree(req);
-        kfree(req);
+        }
 }
 static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
 {
+        if (!ha->rsp_q_map)
+                return;
        if (IS_QLAFX00(ha)) {
                if (rsp && rsp->ring)
                        dma_free_coherent(&ha->pdev->dev,
@@ -499,7 +505,8 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp)
                (rsp->length + 1) * sizeof(response_t),
                rsp->ring, rsp->dma);
        }
-        kfree(rsp);
+        if (rsp)
+                kfree(rsp);
 }
 static void qla2x00_free_queues(struct qla_hw_data *ha)
@@ -1723,6 +1730,8 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
        struct qla_tgt_cmd *cmd;
        uint8_t trace = 0;
+        if (!ha->req_q_map)
+                return;
        spin_lock_irqsave(qp->qp_lock_ptr, flags);
        req = qp->req;
        for (cnt = 1; cnt < req->num_outstanding_cmds; cnt++) {
@@ -3095,14 +3104,14 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        /* Set up the irqs */
        ret = qla2x00_request_irqs(ha, rsp);
        if (ret)
-                goto probe_hw_failed;
+                goto probe_failed;
        /* Alloc arrays of request and response ring ptrs */
-        if (!qla2x00_alloc_queues(ha, req, rsp)) {
+        if (qla2x00_alloc_queues(ha, req, rsp)) {
                ql_log(ql_log_fatal, base_vha, 0x003d,
                    "Failed to allocate memory for queue pointers..."
                    "aborting.\n");
-                goto probe_init_failed;
+                goto probe_failed;
        }
        if (ha->mqenable && shost_use_blk_mq(host)) {
@@ -3387,15 +3396,6 @@ skip_dpc:
        return 0;
-probe_init_failed:
-        qla2x00_free_req_que(ha, req);
-        ha->req_q_map[0] = NULL;
-        clear_bit(0, ha->req_qid_map);
-        qla2x00_free_rsp_que(ha, rsp);
-        ha->rsp_q_map[0] = NULL;
-        clear_bit(0, ha->rsp_qid_map);
-        ha->max_req_queues = ha->max_rsp_queues = 0;
 probe_failed:
        if (base_vha->timer_active)
                qla2x00_stop_timer(base_vha);
@@ -4508,11 +4508,17 @@ qla2x00_mem_free(struct qla_hw_data *ha)
        if (ha->init_cb)
                dma_free_coherent(&ha->pdev->dev, ha->init_cb_size,
                        ha->init_cb, ha->init_cb_dma);
-        vfree(ha->optrom_buffer);
-        kfree(ha->nvram);
+        if (ha->optrom_buffer)
-        kfree(ha->npiv_info);
+                vfree(ha->optrom_buffer);
-        kfree(ha->swl);
+        if (ha->nvram)
-        kfree(ha->loop_id_map);
+                kfree(ha->nvram);
+        if (ha->npiv_info)
+                kfree(ha->npiv_info);
+        if (ha->swl)
+                kfree(ha->swl);
+        if (ha->loop_id_map)
+                kfree(ha->loop_id_map);
        ha->srb_mempool = NULL;
        ha->ctx_mempool = NULL;
@@ -4528,6 +4534,15 @@ qla2x00_mem_free(struct qla_hw_data *ha)
        ha->ex_init_cb_dma = 0;
        ha->async_pd = NULL;
        ha->async_pd_dma = 0;
+        ha->loop_id_map = NULL;
+        ha->npiv_info = NULL;
+        ha->optrom_buffer = NULL;
+        ha->swl = NULL;
+        ha->nvram = NULL;
+        ha->mctp_dump = NULL;
+        ha->dcbx_tlv = NULL;
+        ha->xgmac_data = NULL;
+        ha->sfp_data = NULL;
        ha->s_dma_pool = NULL;
        ha->dl_dma_pool = NULL;
@@ -4577,6 +4592,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
        spin_lock_init(&vha->work_lock);
        spin_lock_init(&vha->cmd_list_lock);
+        spin_lock_init(&vha->gnl.fcports_lock);
        init_waitqueue_head(&vha->fcport_waitQ);
        init_waitqueue_head(&vha->vref_waitq);
@@ -4806,9 +4822,12 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                        fcport->d_id = e->u.new_sess.id;
                        fcport->flags |= FCF_FABRIC_DEVICE;
                        fcport->fw_login_state = DSC_LS_PLOGI_PEND;
-                        if (e->u.new_sess.fc4_type == FC4_TYPE_FCP_SCSI)
+                        if (e->u.new_sess.fc4_type == FC4_TYPE_FCP_SCSI) {
                                fcport->fc4_type = FC4_TYPE_FCP_SCSI;
+                        } else if (e->u.new_sess.fc4_type == FC4_TYPE_NVME) {
+                                fcport->fc4_type = FC4_TYPE_OTHER;
+                                fcport->fc4f_nvme = FC4_TYPE_NVME;
+                        }
                        memcpy(fcport->port_name, e->u.new_sess.port_name,
                            WWN_SIZE);
                } else {
@@ -4877,6 +4896,8 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                        }
                        qlt_plogi_ack_unref(vha, pla);
                } else {
+                        fc_port_t *dfcp = NULL;
                        spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
                        tfcp = qla2x00_find_fcport_by_nportid(vha,
                            &e->u.new_sess.id, 1);
@@ -4899,11 +4920,13 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
                                default:
                                        fcport->login_pause = 1;
                                        tfcp->conflict = fcport;
-                                        qlt_schedule_sess_for_deletion(tfcp);
+                                        dfcp = tfcp;
                                        break;
                                }
                        }
                        spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+                        if (dfcp)
+                                qlt_schedule_sess_for_deletion(tfcp);
                        wwn = wwn_to_u64(fcport->node_name);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 896b2d8bd803..b49ac85f3de2 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1224,10 +1224,10 @@ static void qla24xx_chk_fcp_state(struct fc_port *sess)
        }
 }
-/* ha->tgt.sess_lock supposed to be held on entry */
 void qlt_schedule_sess_for_deletion(struct fc_port *sess)
 {
        struct qla_tgt *tgt = sess->tgt;
+        struct qla_hw_data *ha = sess->vha->hw;
        unsigned long flags;
        if (sess->disc_state == DSC_DELETE_PEND)
@@ -1244,16 +1244,16 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
                        return;
        }
+        spin_lock_irqsave(&ha->tgt.sess_lock, flags);
        if (sess->deleted == QLA_SESS_DELETED)
                sess->logout_on_delete = 0;
-        spin_lock_irqsave(&sess->vha->work_lock, flags);
        if (sess->deleted == QLA_SESS_DELETION_IN_PROGRESS) {
-                spin_unlock_irqrestore(&sess->vha->work_lock, flags);
+                spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
                return;
        }
        sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
-        spin_unlock_irqrestore(&sess->vha->work_lock, flags);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
        sess->disc_state = DSC_DELETE_PEND;
@@ -1262,13 +1262,10 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
        ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
            "Scheduling sess %p for deletion\n", sess);
-        /* use cancel to push work element through before re-queue */
-        cancel_work_sync(&sess->del_work);
        INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
-        queue_work(sess->vha->hw->wq, &sess->del_work);
+        WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
 }
-/* ha->tgt.sess_lock supposed to be held on entry */
 static void qlt_clear_tgt_db(struct qla_tgt *tgt)
 {
        struct fc_port *sess;
@@ -1451,8 +1448,8 @@ qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport, int max_gen)
        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf008, "qla_tgt_fc_port_deleted %p", sess);
        sess->local = 1;
-        qlt_schedule_sess_for_deletion(sess);
        spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+        qlt_schedule_sess_for_deletion(sess);
 }
 static inline int test_tgt_sess_count(struct qla_tgt *tgt)
@@ -1512,10 +1509,8 @@ int qlt_stop_phase1(struct qla_tgt *tgt)
         * Lock is needed, because we still can get an incoming packet.
         */
        mutex_lock(&vha->vha_tgt.tgt_mutex);
-        spin_lock_irqsave(&ha->tgt.sess_lock, flags);
        tgt->tgt_stop = 1;
        qlt_clear_tgt_db(tgt);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
        mutex_unlock(&vha->vha_tgt.tgt_mutex);
        mutex_unlock(&qla_tgt_mutex);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index d042915ce895..ca53a5f785ee 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -223,7 +223,8 @@ static void scsi_eh_reset(struct scsi_cmnd *scmd)
 static void scsi_eh_inc_host_failed(struct rcu_head *head)
 {
-        struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu);
+        struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+        struct Scsi_Host *shost = scmd->device->host;
        unsigned long flags;
        spin_lock_irqsave(shost->host_lock, flags);
@@ -259,7 +260,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd *scmd)
         * Ensure that all tasks observe the host state change before the
         * host_failed change.
         */
-        call_rcu(&shost->rcu, scsi_eh_inc_host_failed);
+        call_rcu(&scmd->rcu, scsi_eh_inc_host_failed);
 }
 /**
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index a86df9ca7d1c..c84f931388f2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -671,6 +671,7 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
        if (!blk_rq_is_scsi(req)) {
                WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED));
                cmd->flags &= ~SCMD_INITIALIZED;
+                destroy_rcu_head(&cmd->rcu);
        }
        if (req->mq_ctx) {
@@ -720,6 +721,8 @@ static blk_status_t __scsi_error_from_host_byte(struct scsi_cmnd *cmd,
                int result)
 {
        switch (host_byte(result)) {
+        case DID_OK:
+                return BLK_STS_OK;
        case DID_TRANSPORT_FAILFAST:
                return BLK_STS_TRANSPORT;
        case DID_TARGET_FAILURE:
@@ -1151,6 +1154,7 @@ static void scsi_initialize_rq(struct request *rq)
        struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq);
        scsi_req_init(&cmd->req);
+        init_rcu_head(&cmd->rcu);
        cmd->jiffies_at_alloc = jiffies;
        cmd->retries = 0;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bff21e636ddd..3541caf3fceb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2595,6 +2595,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
        int res;
        struct scsi_device *sdp = sdkp->device;
        struct scsi_mode_data data;
+        int disk_ro = get_disk_ro(sdkp->disk);
        int old_wp = sdkp->write_prot;
        set_disk_ro(sdkp->disk, 0);
@@ -2635,7 +2636,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
                          "Test WP failed, assume Write Enabled\n");
        } else {
                sdkp->write_prot = ((data.device_specific & 0x80) != 0);
-                set_disk_ro(sdkp->disk, sdkp->write_prot);
+                set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
                if (sdkp->first_scan || old_wp != sdkp->write_prot) {
                        sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
                                  sdkp->write_prot ? "on" : "off");
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 6c348a211ebb..89cf4498f535 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -403,7 +403,7 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
 */
 static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
-        u64 zone_blocks;
+        u64 zone_blocks = 0;
        sector_t block = 0;
        unsigned char *buf;
        unsigned char *rec;
@@ -421,10 +421,8 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        /* Do a report zone to get the same field */
        ret = sd_zbc_report_zones(sdkp, buf, SD_ZBC_BUF_SIZE, 0);
-        if (ret) {
+        if (ret)
-                zone_blocks = 0;
+                goto out_free;
-                goto out;
-        }
        same = buf[4] & 0x0f;
        if (same > 0) {
@@ -464,7 +462,7 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
                        ret = sd_zbc_report_zones(sdkp, buf,
                                                  SD_ZBC_BUF_SIZE, block);
                        if (ret)
-                                return ret;
+                                goto out_free;
                }
        } while (block < sdkp->capacity);
@@ -472,35 +470,32 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
        zone_blocks = sdkp->zone_blocks;
 out:
-        kfree(buf);
        if (!zone_blocks) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Devices with non constant zone "
                                  "size are not supported\n");
-                return -ENODEV;
+                ret = -ENODEV;
-        }
+        } else if (!is_power_of_2(zone_blocks)) {
-        if (!is_power_of_2(zone_blocks)) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Devices with non power of 2 zone "
                                  "size are not supported\n");
-                return -ENODEV;
+                ret = -ENODEV;
-        }
+        } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
-        if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) {
                if (sdkp->first_scan)
                        sd_printk(KERN_NOTICE, sdkp,
                                  "Zone size too large\n");
-                return -ENODEV;
+                ret = -ENODEV;
+        } else {
+                sdkp->zone_blocks = zone_blocks;
+                sdkp->zone_shift = ilog2(zone_blocks);
        }
-        sdkp->zone_blocks = zone_blocks;
+out_free:
-        sdkp->zone_shift = ilog2(zone_blocks);
+        kfree(buf);
-        return 0;
+        return ret;
 }
 /**
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 6be5ab32c94f..8c51d628b52e 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1311,7 +1311,8 @@ static int storvsc_do_io(struct hv_device *device,
                         */
                        cpumask_and(&alloced_mask, &stor_device->alloced_cpus,
                                    cpumask_of_node(cpu_to_node(q_num)));
-                        for_each_cpu(tgt_cpu, &alloced_mask) {
+                        for_each_cpu_wrap(tgt_cpu, &alloced_mask,
+                                        outgoing_channel->target_cpu + 1) {
                                if (tgt_cpu != outgoing_channel->target_cpu) {
                                        outgoing_channel =
                                        stor_device->stor_chns[tgt_cpu];
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index e4f5bb056fd2..ba3cfa8e279b 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -2443,39 +2443,21 @@ struct cgr_comp {
        struct completion completion;
 };
-static int qman_delete_cgr_thread(void *p)
+static void qman_delete_cgr_smp_call(void *p)
 {
-        struct cgr_comp *cgr_comp = (struct cgr_comp *)p;
+        qman_delete_cgr((struct qman_cgr *)p);
-        int ret;
-        ret = qman_delete_cgr(cgr_comp->cgr);
-        complete(&cgr_comp->completion);
-        return ret;
 }
 void qman_delete_cgr_safe(struct qman_cgr *cgr)
 {
-        struct task_struct *thread;
-        struct cgr_comp cgr_comp;
        preempt_disable();
        if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id()) {
-                init_completion(&cgr_comp.completion);
+                smp_call_function_single(qman_cgr_cpus[cgr->cgrid],
-                cgr_comp.cgr = cgr;
+                                         qman_delete_cgr_smp_call, cgr, true);
-                thread = kthread_create(qman_delete_cgr_thread, &cgr_comp,
-                                        "cgr_del");
-                if (IS_ERR(thread))
-                        goto out;
-                kthread_bind(thread, qman_cgr_cpus[cgr->cgrid]);
-                wake_up_process(thread);
-                wait_for_completion(&cgr_comp.completion);
                preempt_enable();
                return;
        }
-out:
        qman_delete_cgr(cgr);
        preempt_enable();
 }
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6dbba5aff191..86580b6df33d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -326,24 +326,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin)
        mutex_lock(&ashmem_mutex);
        if (asma->size == 0) {
-                ret = -EINVAL;
+                mutex_unlock(&ashmem_mutex);
-                goto out;
+                return -EINVAL;
        }
        if (!asma->file) {
-                ret = -EBADF;
+                mutex_unlock(&ashmem_mutex);
-                goto out;
+                return -EBADF;
        }
+        mutex_unlock(&ashmem_mutex);
        ret = vfs_llseek(asma->file, offset, origin);
        if (ret < 0)
-                goto out;
+                return ret;
        /** Copy f_pos from backing file, since f_ops->llseek() sets it */
        file->f_pos = asma->file->f_pos;
-out:
-        mutex_unlock(&ashmem_mutex);
        return ret;
 }
@@ -702,16 +701,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
        size_t pgstart, pgend;
        int ret = -EINVAL;
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+                return -EFAULT;
        mutex_lock(&ashmem_mutex);
        if (unlikely(!asma->file))
                goto out_unlock;
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
-                ret = -EFAULT;
-                goto out_unlock;
-        }
        /* per custom, you can pass zero for len to mean "everything onward" */
        if (!pin.len)
                pin.len = PAGE_ALIGN(asma->size) - pin.offset;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index e618a87521a3..9d733471ca2e 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -475,8 +475,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s,
        struct comedi_cmd *cmd = &async->cmd;
        if (cmd->stop_src == TRIG_COUNT) {
-                unsigned int nscans = nsamples / cmd->scan_end_arg;
+                unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg);
-                unsigned int scans_left = __comedi_nscans_left(s, nscans);
                unsigned int scan_pos =
                    comedi_bytes_to_samples(s, async->scan_progress);
                unsigned long long samples_left = 0;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 5c0e59e8fe46..cbe98bc2b998 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2180,6 +2180,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
                                }
                                if (tty_hung_up_p(file))
                                        break;
+                                /*
+                                 * Abort readers for ttys which never actually
+                                 * get hung up.  See __tty_hangup().
+                                 */
+                                if (test_bit(TTY_HUPPING, &tty->flags))
+                                        break;
                                if (!timeout)
                                        break;
                                if (file->f_flags & O_NONBLOCK) {
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 54adf8d56350..a93f77ab3da0 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -3387,11 +3387,9 @@ static int serial_pci_is_class_communication(struct pci_dev *dev)
        /*
         * If it is not a communications device or the programming
         * interface is greater than 6, give up.
-         *
-         * (Should we try to make guesses for multiport serial devices
-         * later?)
         */
        if ((((dev->class >> 8) != PCI_CLASS_COMMUNICATION_SERIAL) &&
+             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MULTISERIAL) &&
             ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MODEM)) ||
            (dev->class & 0xff) > 6)
                return -ENODEV;
@@ -3428,6 +3426,12 @@ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
 {
        int num_iomem, num_port, first_port = -1, i;
+        /*
+         * Should we try to make guesses for multiport serial devices later?
+         */
+        if ((dev->class >> 8) == PCI_CLASS_COMMUNICATION_MULTISERIAL)
+                return -ENODEV;
        num_iomem = num_port = 0;
        for (i = 0; i < PCI_NUM_BAR_RESOURCES; i++) {
                if (pci_resource_flags(dev, i) & IORESOURCE_IO) {
@@ -4699,6 +4703,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
                PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
                pbn_b2_4_115200 },
        /*
+         * BrainBoxes UC-260
+         */
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+                PCI_ANY_ID, PCI_ANY_ID,
+                PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        {       PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+                PCI_ANY_ID, PCI_ANY_ID,
+                 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+                pbn_b2_4_115200 },
+        /*
         * Perle PCI-RAS cards
         */
        {       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030,
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index df46a9e88c34..e287fe8f10fc 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1734,6 +1734,7 @@ static void atmel_get_ip_name(struct uart_port *port)
                switch (version) {
                case 0x302:
                case 0x10213:
+                case 0x10302:
                        dev_dbg(port->dev, "This version is usart\n");
                        atmel_port->has_frac_baudrate = true;
                        atmel_port->has_hw_timer = true;
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index 870e84fb6e39..a24278380fec 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -245,11 +245,12 @@ int __init of_setup_earlycon(const struct earlycon_id *match,
        }
        port->mapbase = addr;
        port->uartclk = BASE_BAUD * 16;
-        port->membase = earlycon_map(port->mapbase, SZ_4K);
        val = of_get_flat_dt_prop(node, "reg-offset", NULL);
        if (val)
                port->mapbase += be32_to_cpu(*val);
+        port->membase = earlycon_map(port->mapbase, SZ_4K);
        val = of_get_flat_dt_prop(node, "reg-shift", NULL);
        if (val)
                port->regshift = be32_to_cpu(*val);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 1d7ca382bc12..a33c685af990 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2093,7 +2093,7 @@ static int serial_imx_probe(struct platform_device *pdev)
        uart_get_rs485_mode(&pdev->dev, &sport->port.rs485);
        if (sport->port.rs485.flags & SER_RS485_ENABLED &&
-            (!sport->have_rtscts || !sport->have_rtsgpio))
+            (!sport->have_rtscts && !sport->have_rtsgpio))
                dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
        imx_rs485_config(&sport->port, &sport->port.rs485);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index c8dde56b532b..35b9201db3b4 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1144,6 +1144,8 @@ static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state)
                uport->ops->config_port(uport, flags);
                ret = uart_startup(tty, state, 1);
+                if (ret == 0)
+                        tty_port_set_initialized(port, true);
                if (ret > 0)
                        ret = 0;
        }
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 7257c078e155..44adf9db38f8 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -885,6 +885,8 @@ static void sci_receive_chars(struct uart_port *port)
                /* Tell the rest of the system the news. New characters! */
                tty_flip_buffer_push(tport);
        } else {
+                /* TTY buffers full; read from RX reg to prevent lockup */
+                serial_port_in(port, SCxRDR);
                serial_port_in(port, SCxSR); /* dummy read */
                sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port));
        }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index eb9133b472f4..63114ea35ec1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -586,6 +586,14 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
                return;
        }
+        /*
+         * Some console devices aren't actually hung up for technical and
+         * historical reasons, which can lead to indefinite interruptible
+         * sleep in n_tty_read().  The following explicitly tells
+         * n_tty_read() to abort readers.
+         */
+        set_bit(TTY_HUPPING, &tty->flags);
        /* inuse_filps is protected by the single tty lock,
           this really needs to change if we want to flush the
           workqueue with the lock held */
@@ -640,6 +648,7 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
         * from the ldisc side, which is now guaranteed.
         */
        set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
        tty_unlock(tty);
        if (f)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index c64cf6c4a83d..0c11d40a12bc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -151,6 +151,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
        ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
+        /* Linger a bit, prior to the next control message. */
+        if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+                msleep(200);
        kfree(dr);
        return ret;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f4a548471f0f..54b019e267c5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,7 +230,8 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
        /* Corsair Strafe RGB */
-        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+          USB_QUIRK_DELAY_CTRL_MSG },
        /* Corsair K70 LUX */
        { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 03fd20f0b496..c4a47496d2fb 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -137,7 +137,7 @@ static void dwc2_set_stm32f4x9_fsotg_params(struct dwc2_hsotg *hsotg)
        p->activate_stm_fs_transceiver = true;
 }
-static void dwc2_set_stm32f7xx_hsotg_params(struct dwc2_hsotg *hsotg)
+static void dwc2_set_stm32f7_hsotg_params(struct dwc2_hsotg *hsotg)
 {
        struct dwc2_core_params *p = &hsotg->params;
@@ -164,8 +164,8 @@ const struct of_device_id dwc2_of_match_table[] = {
        { .compatible = "st,stm32f4x9-fsotg",
          .data = dwc2_set_stm32f4x9_fsotg_params },
        { .compatible = "st,stm32f4x9-hsotg" },
-        { .compatible = "st,stm32f7xx-hsotg",
+        { .compatible = "st,stm32f7-hsotg",
-          .data = dwc2_set_stm32f7xx_hsotg_params },
+          .data = dwc2_set_stm32f7_hsotg_params },
        {},
 };
 MODULE_DEVICE_TABLE(of, dwc2_of_match_table);
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index f1d838a4acd6..e94bf91cc58a 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -175,7 +175,7 @@ void dwc3_set_mode(struct dwc3 *dwc, u32 mode)
        dwc->desired_dr_role = mode;
        spin_unlock_irqrestore(&dwc->lock, flags);
-        queue_work(system_power_efficient_wq, &dwc->drd_work);
+        queue_work(system_freezable_wq, &dwc->drd_work);
 }
 u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index c2592d883f67..d2428a9e8900 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1538,7 +1538,6 @@ ffs_fs_kill_sb(struct super_block *sb)
        if (sb->s_fs_info) {
                ffs_release_dev(sb->s_fs_info);
                ffs_data_closed(sb->s_fs_info);
-                ffs_data_put(sb->s_fs_info);
        }
 }
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 84f88fa411cd..d088c340e4d0 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -447,7 +447,8 @@ static int ohci_init (struct ohci_hcd *ohci)
        struct usb_hcd *hcd = ohci_to_hcd(ohci);
        /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        if (!(hcd->driver->flags & HCD_LOCAL_MEM))
+                hcd->self.sg_tablesize = ~0;
        if (distrust_firmware)
                ohci->flags |= OHCI_QUIRK_HUB_POWER;
diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
index a1ab8acf39ba..c359bae7b754 100644
--- a/drivers/usb/host/xhci-dbgcap.c
+++ b/drivers/usb/host/xhci-dbgcap.c
@@ -328,13 +328,14 @@ dbc_ep_do_queue(struct dbc_ep *dep, struct dbc_request *req)
 int dbc_ep_queue(struct dbc_ep *dep, struct dbc_request *req,
                 gfp_t gfp_flags)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = dep->dbc;
        int                     ret = -ESHUTDOWN;
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        if (dbc->state == DS_CONFIGURED)
                ret = dbc_ep_do_queue(dep, req);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        mod_delayed_work(system_wq, &dbc->event_work, 0);
@@ -521,15 +522,16 @@ static void xhci_do_dbc_stop(struct xhci_hcd *xhci)
 static int xhci_dbc_start(struct xhci_hcd *xhci)
 {
        int                     ret;
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        WARN_ON(!dbc);
        pm_runtime_get_sync(xhci_to_hcd(xhci)->self.controller);
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        ret = xhci_do_dbc_start(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        if (ret) {
                pm_runtime_put(xhci_to_hcd(xhci)->self.controller);
@@ -541,6 +543,7 @@ static int xhci_dbc_start(struct xhci_hcd *xhci)
 static void xhci_dbc_stop(struct xhci_hcd *xhci)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
@@ -551,9 +554,9 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
        if (port->registered)
                xhci_dbc_tty_unregister_device(xhci);
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        xhci_do_dbc_stop(xhci);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
 }
@@ -779,14 +782,15 @@ static void xhci_dbc_handle_events(struct work_struct *work)
        int                     ret;
        enum evtreturn          evtr;
        struct xhci_dbc         *dbc;
+        unsigned long           flags;
        struct xhci_hcd         *xhci;
        dbc = container_of(to_delayed_work(work), struct xhci_dbc, event_work);
        xhci = dbc->xhci;
-        spin_lock(&dbc->lock);
+        spin_lock_irqsave(&dbc->lock, flags);
        evtr = xhci_dbc_do_handle_events(dbc);
-        spin_unlock(&dbc->lock);
+        spin_unlock_irqrestore(&dbc->lock, flags);
        switch (evtr) {
        case EVT_GSER:
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 8d47b6fbf973..75f0b92694ba 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -92,21 +92,23 @@ static void dbc_start_rx(struct dbc_port *port)
 static void
 dbc_read_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        list_add_tail(&req->list_pool, &port->read_queue);
        tasklet_schedule(&port->push);
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
 {
+        unsigned long           flags;
        struct xhci_dbc         *dbc = xhci->dbc;
        struct dbc_port         *port = &dbc->port;
-        spin_lock(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        list_add(&req->list_pool, &port->write_pool);
        switch (req->status) {
        case 0:
@@ -119,7 +121,7 @@ static void dbc_write_complete(struct xhci_hcd *xhci, struct dbc_request *req)
                          req->status);
                break;
        }
-        spin_unlock(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
@@ -327,12 +329,13 @@ static void dbc_rx_push(unsigned long _port)
 {
        struct dbc_request      *req;
        struct tty_struct       *tty;
+        unsigned long           flags;
        bool                    do_push = false;
        bool                    disconnect = false;
        struct dbc_port         *port = (void *)_port;
        struct list_head        *queue = &port->read_queue;
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        tty = port->port.tty;
        while (!list_empty(queue)) {
                req = list_first_entry(queue, struct dbc_request, list_pool);
@@ -392,16 +395,17 @@ static void dbc_rx_push(unsigned long _port)
        if (!disconnect)
                dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
 }
 static int dbc_port_activate(struct tty_port *_port, struct tty_struct *tty)
 {
+        unsigned long   flags;
        struct dbc_port *port = container_of(_port, struct dbc_port, port);
-        spin_lock_irq(&port->port_lock);
+        spin_lock_irqsave(&port->port_lock, flags);
        dbc_start_rx(port);
-        spin_unlock_irq(&port->port_lock);
+        spin_unlock_irqrestore(&port->port_lock, flags);
        return 0;
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5262fa571a5d..d9f831b67e57 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,6 +126,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                xhci->quirks |= XHCI_AMD_PLL_FIX;
+        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+                xhci->quirks |= XHCI_SUSPEND_DELAY;
        if (pdev->vendor == PCI_VENDOR_ID_AMD)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6f038306c14d..6652e2d5bd2e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -360,7 +360,6 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
 {
        struct usb_hcd  *hcd = dev_get_drvdata(dev);
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        int ret;
        /*
         * xhci_suspend() needs `do_wakeup` to know whether host is allowed
@@ -370,12 +369,7 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev)
         * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
         * also applies to runtime suspend.
         */
-        ret = xhci_suspend(xhci, device_may_wakeup(dev));
+        return xhci_suspend(xhci, device_may_wakeup(dev));
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_disable_unprepare(xhci->clk);
-        return ret;
 }
 static int __maybe_unused xhci_plat_resume(struct device *dev)
@@ -384,9 +378,6 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        int ret;
-        if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk))
-                clk_prepare_enable(xhci->clk);
        ret = xhci_priv_resume_quirk(hcd);
        if (ret)
                return ret;
diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
index f0b559660007..f33ffc2bc4ed 100644
--- a/drivers/usb/host/xhci-rcar.c
+++ b/drivers/usb/host/xhci-rcar.c
@@ -83,6 +83,10 @@ static const struct soc_device_attribute rcar_quirks_match[]  = {
                .soc_id = "r8a7796",
                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
        },
+        {
+                .soc_id = "r8a77965",
+                .data = (void *)RCAR_XHCI_FIRMWARE_V3,
+        },
        { /* sentinel */ },
 };
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 25d4b748a56f..5d37700ae4b0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -877,6 +877,9 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
        clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
        del_timer_sync(&xhci->shared_hcd->rh_timer);
+        if (xhci->quirks & XHCI_SUSPEND_DELAY)
+                usleep_range(1000, 1500);
        spin_lock_irq(&xhci->lock);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e4d7d3d06a75..866e141d4972 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -718,11 +718,12 @@ struct xhci_ep_ctx {
 /* bits 10:14 are Max Primary Streams */
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
-#define EP_INTERVAL(p)          (((p) & 0xff) << 16)
+#define EP_INTERVAL(p)                  (((p) & 0xff) << 16)
-#define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
+#define EP_INTERVAL_TO_UFRAMES(p)       (1 << (((p) >> 16) & 0xff))
-#define CTX_TO_EP_INTERVAL(p)   (((p) >> 16) & 0xff)
+#define CTX_TO_EP_INTERVAL(p)           (((p) >> 16) & 0xff)
-#define EP_MAXPSTREAMS_MASK     (0x1f << 10)
+#define EP_MAXPSTREAMS_MASK             (0x1f << 10)
-#define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define EP_MAXPSTREAMS(p)               (((p) << 10) & EP_MAXPSTREAMS_MASK)
+#define CTX_TO_EP_MAXPSTREAMS(p)        (((p) & EP_MAXPSTREAMS_MASK) >> 10)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
 /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
@@ -1825,6 +1826,7 @@ struct xhci_hcd {
 #define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
+#define XHCI_SUSPEND_DELAY      (1 << 30)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
@@ -2549,21 +2551,22 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
        u8 burst;
        u8 cerr;
        u8 mult;
-        u8 lsa;
-        u8 hid;
+        bool lsa;
+        bool hid;
        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
        ep_state = info & EP_STATE_MASK;
-        max_pstr = info & EP_MAXPSTREAMS_MASK;
+        max_pstr = CTX_TO_EP_MAXPSTREAMS(info);
        interval = CTX_TO_EP_INTERVAL(info);
        mult = CTX_TO_EP_MULT(info) + 1;
-        lsa = info & EP_HAS_LSA;
+        lsa = !!(info & EP_HAS_LSA);
        cerr = (info2 & (3 << 1)) >> 1;
        ep_type = CTX_TO_EP_TYPE(info2);
-        hid = info2 & (1 << 7);
+        hid = !!(info2 & (1 << 7));
        burst = CTX_TO_MAX_BURST(info2);
        maxp = MAX_PACKET_DECODED(info2);
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index f5e1bb5e5217..984f7e12a6a5 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -85,6 +85,8 @@ struct mon_reader_text {
        wait_queue_head_t wait;
        int printf_size;
+        size_t printf_offset;
+        size_t printf_togo;
        char *printf_buf;
        struct mutex printf_lock;
@@ -376,75 +378,103 @@ err_alloc:
        return rc;
 }
-/*
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
- * For simplicity, we read one record in one system call and throw out
+    char __user * const buf, const size_t nbytes)
- * what does not fit. This means that the following does not work:
+{
- *   dd if=/dbg/usbmon/0t bs=10
+        const size_t togo = min(nbytes, rp->printf_togo);
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+        if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+                return -EFAULT;
+        rp->printf_togo -= togo;
+        rp->printf_offset += togo;
+        return togo;
+}
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_t(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
        struct mon_reader_text *rp = file->private_data;
        struct mon_event_text *ep;
        struct mon_text_ptr ptr;
+        ssize_t ret;
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
        mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
+        if (rp->printf_togo == 0) {
-        ptr.limit = rp->printf_size;
+                ep = mon_text_read_wait(rp, file);
-        mon_text_read_head_t(rp, &ptr, ep);
+                if (IS_ERR(ep)) {
-        mon_text_read_statset(rp, &ptr, ep);
+                        mutex_unlock(&rp->printf_lock);
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                        return PTR_ERR(ep);
-            " %d", ep->length);
+                }
-        mon_text_read_data(rp, &ptr, ep);
+                ptr.cnt = 0;
+                ptr.pbuf = rp->printf_buf;
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
+                ptr.limit = rp->printf_size;
-                ptr.cnt = -EFAULT;
+                mon_text_read_head_t(rp, &ptr, ep);
+                mon_text_read_statset(rp, &ptr, ep);
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+                kmem_cache_free(rp->e_slab, ep);
+        }
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
        mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
+        return ret;
-        return ptr.cnt;
 }
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_u(struct file *file, char __user *buf,
-                                size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
        struct mon_reader_text *rp = file->private_data;
        struct mon_event_text *ep;
        struct mon_text_ptr ptr;
+        ssize_t ret;
-        ep = mon_text_read_wait(rp, file);
-        if (IS_ERR(ep))
-                return PTR_ERR(ep);
        mutex_lock(&rp->printf_lock);
-        ptr.cnt = 0;
-        ptr.pbuf = rp->printf_buf;
-        ptr.limit = rp->printf_size;
-        mon_text_read_head_u(rp, &ptr, ep);
+        if (rp->printf_togo == 0) {
-        if (ep->type == 'E') {
-                mon_text_read_statset(rp, &ptr, ep);
+                ep = mon_text_read_wait(rp, file);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                if (IS_ERR(ep)) {
-                mon_text_read_isostat(rp, &ptr, ep);
+                        mutex_unlock(&rp->printf_lock);
-                mon_text_read_isodesc(rp, &ptr, ep);
+                        return PTR_ERR(ep);
-        } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                }
-                mon_text_read_intstat(rp, &ptr, ep);
+                ptr.cnt = 0;
-        } else {
+                ptr.pbuf = rp->printf_buf;
-                mon_text_read_statset(rp, &ptr, ep);
+                ptr.limit = rp->printf_size;
+                mon_text_read_head_u(rp, &ptr, ep);
+                if (ep->type == 'E') {
+                        mon_text_read_statset(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+                        mon_text_read_isostat(rp, &ptr, ep);
+                        mon_text_read_isodesc(rp, &ptr, ep);
+                } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+                        mon_text_read_intstat(rp, &ptr, ep);
+                } else {
+                        mon_text_read_statset(rp, &ptr, ep);
+                }
+                ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+                    " %d", ep->length);
+                mon_text_read_data(rp, &ptr, ep);
+                rp->printf_togo = ptr.cnt;
+                rp->printf_offset = 0;
+                kmem_cache_free(rp->e_slab, ep);
        }
-        ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-            " %d", ep->length);
-        mon_text_read_data(rp, &ptr, ep);
-        if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
+        ret = mon_text_copy_to_user(rp, buf, nbytes);
-                ptr.cnt = -EFAULT;
        mutex_unlock(&rp->printf_lock);
-        kmem_cache_free(rp->e_slab, ep);
+        return ret;
-        return ptr.cnt;
 }
 static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index eef4ad578b31..4d723077be2b 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1756,6 +1756,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
        int             vbus;
        u8              devctl;
+        pm_runtime_get_sync(dev);
        spin_lock_irqsave(&musb->lock, flags);
        val = musb->a_wait_bcon;
        vbus = musb_platform_get_vbus_status(musb);
@@ -1769,6 +1770,7 @@ vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
                        vbus = 0;
        }
        spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_put_sync(dev);
        return sprintf(buf, "Vbus %s, timeout %lu msec\n",
                        vbus ? "on" : "off", val);
@@ -2471,11 +2473,11 @@ static int musb_remove(struct platform_device *pdev)
        musb_disable_interrupts(musb);
        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
        spin_unlock_irqrestore(&musb->lock, flags);
+        musb_platform_exit(musb);
        pm_runtime_dont_use_autosuspend(musb->controller);
        pm_runtime_put_sync(musb->controller);
        pm_runtime_disable(musb->controller);
-        musb_platform_exit(musb);
        musb_phy_callback = NULL;
        if (musb->dma_controller)
                musb_dma_controller_destroy(musb->dma_controller);
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 3b1b9695177a..6034c39b67d1 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -1076,7 +1076,7 @@ static int uas_post_reset(struct usb_interface *intf)
                return 0;
        err = uas_configure_endpoints(devinfo);
-        if (err && err != ENODEV)
+        if (err && err != -ENODEV)
                shost_printk(KERN_ERR, shost,
                             "%s: alloc streams error %d after reset",
                             __func__, err);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 264af199aec8..747d3a9596d9 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2118,6 +2118,13 @@ UNUSUAL_DEV(  0x152d, 0x2566, 0x0114, 0x0114,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_BROKEN_FUA ),
+/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */
+UNUSUAL_DEV(  0x152d, 0x2567, 0x0117, 0x0117,
+                "JMicron",
+                "USB to ATA/ATAPI Bridge",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA ),
 /* Reported-by George Cherian <george.cherian@cavium.com> */
 UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
                "JMicron",
diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
index 9ce4756adad6..dcd8ef085b30 100644
--- a/drivers/usb/typec/fusb302/fusb302.c
+++ b/drivers/usb/typec/fusb302/fusb302.c
@@ -1857,7 +1857,8 @@ static int fusb302_probe(struct i2c_client *client,
        chip->tcpm_port = tcpm_register_port(&client->dev, &chip->tcpc_dev);
        if (IS_ERR(chip->tcpm_port)) {
                ret = PTR_ERR(chip->tcpm_port);
-                dev_err(dev, "cannot register tcpm port, ret=%d", ret);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "cannot register tcpm port, ret=%d", ret);
                goto destroy_workqueue;
        }
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index f4d563ee7690..8b637a4b474b 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -252,9 +252,6 @@ struct tcpm_port {
        unsigned int nr_src_pdo;
        u32 snk_pdo[PDO_MAX_OBJECTS];
        unsigned int nr_snk_pdo;
-        unsigned int nr_fixed; /* number of fixed sink PDOs */
-        unsigned int nr_var; /* number of variable sink PDOs */
-        unsigned int nr_batt; /* number of battery sink PDOs */
        u32 snk_vdo[VDO_MAX_OBJECTS];
        unsigned int nr_snk_vdo;
@@ -1770,90 +1767,39 @@ static int tcpm_pd_check_request(struct tcpm_port *port)
        return 0;
 }
-#define min_power(x, y) min(pdo_max_power(x), pdo_max_power(y))
+static int tcpm_pd_select_pdo(struct tcpm_port *port)
-#define min_current(x, y) min(pdo_max_current(x), pdo_max_current(y))
-static int tcpm_pd_select_pdo(struct tcpm_port *port, int *sink_pdo,
-                              int *src_pdo)
 {
-        unsigned int i, j, max_mw = 0, max_mv = 0, mw = 0, mv = 0, ma = 0;
+        unsigned int i, max_mw = 0, max_mv = 0;
        int ret = -EINVAL;
        /*
-         * Select the source PDO providing the most power which has a
+         * Select the source PDO providing the most power while staying within
-         * matchig sink cap.
+         * the board's voltage limits. Prefer PDO providing exp
         */
        for (i = 0; i < port->nr_source_caps; i++) {
                u32 pdo = port->source_caps[i];
                enum pd_pdo_type type = pdo_type(pdo);
+                unsigned int mv, ma, mw;
-                if (type == PDO_TYPE_FIXED) {
+                if (type == PDO_TYPE_FIXED)
-                        for (j = 0; j < port->nr_fixed; j++) {
+                        mv = pdo_fixed_voltage(pdo);
-                                if (pdo_fixed_voltage(pdo) ==
+                else
-                                    pdo_fixed_voltage(port->snk_pdo[j])) {
+                        mv = pdo_min_voltage(pdo);
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_fixed_voltage(pdo);
+                if (type == PDO_TYPE_BATT) {
-                                        mw = ma * mv / 1000;
+                        mw = pdo_max_power(pdo);
-                                        if (mw > max_mw ||
+                } else {
-                                            (mw == max_mw && mv > max_mv)) {
+                        ma = min(pdo_max_current(pdo),
-                                                ret = 0;
+                                 port->max_snk_ma);
-                                                *src_pdo = i;
+                        mw = ma * mv / 1000;
-                                                *sink_pdo = j;
+                }
-                                                max_mw = mw;
-                                                max_mv = mv;
+                /* Perfer higher voltages if available */
-                                        }
+                if ((mw > max_mw || (mw == max_mw && mv > max_mv)) &&
-                                        /* There could only be one fixed pdo
+                    mv <= port->max_snk_mv) {
-                                         * at a specific voltage level.
+                        ret = i;
-                                         * So breaking here.
+                        max_mw = mw;
-                                         */
+                        max_mv = mv;
-                                        break;
-                                }
-                        }
-                } else if (type == PDO_TYPE_BATT) {
-                        for (j = port->nr_fixed;
-                             j < port->nr_fixed +
-                                 port->nr_batt;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        mw = min_power(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
-                } else if (type == PDO_TYPE_VAR) {
-                        for (j = port->nr_fixed +
-                                 port->nr_batt;
-                             j < port->nr_fixed +
-                                 port->nr_batt +
-                                 port->nr_var;
-                             j++) {
-                                if (pdo_min_voltage(pdo) >=
-                                     pdo_min_voltage(port->snk_pdo[j]) &&
-                                     pdo_max_voltage(pdo) <=
-                                     pdo_max_voltage(port->snk_pdo[j])) {
-                                        ma = min_current(pdo, port->snk_pdo[j]);
-                                        mv = pdo_min_voltage(pdo);
-                                        mw = ma * mv / 1000;
-                                        if (mw > max_mw ||
-                                            (mw == max_mw && mv > max_mv)) {
-                                                ret = 0;
-                                                *src_pdo = i;
-                                                *sink_pdo = j;
-                                                max_mw = mw;
-                                                max_mv = mv;
-                                        }
-                                }
-                        }
                }
        }
@@ -1865,14 +1811,13 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
        unsigned int mv, ma, mw, flags;
        unsigned int max_ma, max_mw;
        enum pd_pdo_type type;
-        int src_pdo_index, snk_pdo_index;
+        int index;
-        u32 pdo, matching_snk_pdo;
+        u32 pdo;
-        if (tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index) < 0)
+        index = tcpm_pd_select_pdo(port);
+        if (index < 0)
                return -EINVAL;
+        pdo = port->source_caps[index];
-        pdo = port->source_caps[src_pdo_index];
-        matching_snk_pdo = port->snk_pdo[snk_pdo_index];
        type = pdo_type(pdo);
        if (type == PDO_TYPE_FIXED)
@@ -1880,28 +1825,26 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
        else
                mv = pdo_min_voltage(pdo);
-        /* Select maximum available current within the sink pdo's limit */
+        /* Select maximum available current within the board's power limit */
        if (type == PDO_TYPE_BATT) {
-                mw = min_power(pdo, matching_snk_pdo);
+                mw = pdo_max_power(pdo);
-                ma = 1000 * mw / mv;
+                ma = 1000 * min(mw, port->max_snk_mw) / mv;
        } else {
-                ma = min_current(pdo, matching_snk_pdo);
+                ma = min(pdo_max_current(pdo),
-                mw = ma * mv / 1000;
+                         1000 * port->max_snk_mw / mv);
        }
+        ma = min(ma, port->max_snk_ma);
        flags = RDO_USB_COMM | RDO_NO_SUSPEND;
        /* Set mismatch bit if offered power is less than operating power */
+        mw = ma * mv / 1000;
        max_ma = ma;
        max_mw = mw;
        if (mw < port->operating_snk_mw) {
                flags |= RDO_CAP_MISMATCH;
-                if (type == PDO_TYPE_BATT &&
+                max_mw = port->operating_snk_mw;
-                    (pdo_max_power(matching_snk_pdo) > pdo_max_power(pdo)))
+                max_ma = max_mw * 1000 / mv;
-                        max_mw = pdo_max_power(matching_snk_pdo);
-                else if (pdo_max_current(matching_snk_pdo) >
-                         pdo_max_current(pdo))
-                        max_ma = pdo_max_current(matching_snk_pdo);
        }
        tcpm_log(port, "cc=%d cc1=%d cc2=%d vbus=%d vconn=%s polarity=%d",
@@ -1910,16 +1853,16 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
                 port->polarity);
        if (type == PDO_TYPE_BATT) {
-                *rdo = RDO_BATT(src_pdo_index + 1, mw, max_mw, flags);
+                *rdo = RDO_BATT(index + 1, mw, max_mw, flags);
                tcpm_log(port, "Requesting PDO %d: %u mV, %u mW%s",
-                         src_pdo_index, mv, mw,
+                         index, mv, mw,
                         flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
        } else {
-                *rdo = RDO_FIXED(src_pdo_index + 1, ma, max_ma, flags);
+                *rdo = RDO_FIXED(index + 1, ma, max_ma, flags);
                tcpm_log(port, "Requesting PDO %d: %u mV, %u mA%s",
-                         src_pdo_index, mv, ma,
+                         index, mv, ma,
                         flags & RDO_CAP_MISMATCH ? " [mismatch]" : "");
        }
@@ -3650,19 +3593,6 @@ int tcpm_update_sink_capabilities(struct tcpm_port *port, const u32 *pdo,
 }
 EXPORT_SYMBOL_GPL(tcpm_update_sink_capabilities);
-static int nr_type_pdos(const u32 *pdo, unsigned int nr_pdo,
-                        enum pd_pdo_type type)
-{
-        int count = 0;
-        int i;
-        for (i = 0; i < nr_pdo; i++) {
-                if (pdo_type(pdo[i]) == type)
-                        count++;
-        }
-        return count;
-}
 struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
 {
        struct tcpm_port *port;
@@ -3708,15 +3638,6 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                          tcpc->config->nr_src_pdo);
        port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                          tcpc->config->nr_snk_pdo);
-        port->nr_fixed =  nr_type_pdos(port->snk_pdo,
-                                       port->nr_snk_pdo,
-                                       PDO_TYPE_FIXED);
-        port->nr_var = nr_type_pdos(port->snk_pdo,
-                                    port->nr_snk_pdo,
-                                    PDO_TYPE_VAR);
-        port->nr_batt = nr_type_pdos(port->snk_pdo,
-                                     port->nr_snk_pdo,
-                                     PDO_TYPE_BATT);
        port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
                                          tcpc->config->nr_snk_vdo);
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index d86f72bbbb91..6dcd3ff655c3 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -105,10 +105,14 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
        if (rv != 0)
                return -EINVAL;
+        if (!udc) {
+                dev_err(dev, "no device");
+                return -ENODEV;
+        }
        spin_lock_irqsave(&udc->lock, flags);
        /* Don't export what we don't have */
-        if (!udc || !udc->driver || !udc->pullup) {
+        if (!udc->driver || !udc->pullup) {
-                dev_err(dev, "no device or gadget not bound");
+                dev_err(dev, "gadget not bound");
                ret = -ENODEV;
                goto unlock;
        }
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index b5fb56b822fd..a31d9b240af8 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -170,7 +170,7 @@ static void vhost_net_buf_unproduce(struct vhost_net_virtqueue *nvq)
        if (nvq->rx_ring && !vhost_net_buf_is_empty(rxq)) {
                ptr_ring_unconsume(nvq->rx_ring, rxq->queue + rxq->head,
                                   vhost_net_buf_get_size(rxq),
-                                   __skb_array_destroy_skb);
+                                   tun_ptr_free);
                rxq->head = rxq->tail = 0;
        }
 }
@@ -948,6 +948,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                n->vqs[i].done_idx = 0;
                n->vqs[i].vhost_hlen = 0;
                n->vqs[i].sock_hlen = 0;
+                n->vqs[i].rx_ring = NULL;
                vhost_net_buf_init(&n->vqs[i].rxq);
        }
        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
@@ -972,6 +973,7 @@ static struct socket *vhost_net_stop_vq(struct vhost_net *n,
        vhost_net_disable_vq(n, vq);
        vq->private_data = NULL;
        vhost_net_buf_unproduce(nvq);
+        nvq->rx_ring = NULL;
        mutex_unlock(&vq->mutex);
        return sock;
 }
@@ -1160,14 +1162,14 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                vhost_net_disable_vq(n, vq);
                vq->private_data = sock;
                vhost_net_buf_unproduce(nvq);
-                if (index == VHOST_NET_VQ_RX)
-                        nvq->rx_ring = get_tap_ptr_ring(fd);
                r = vhost_vq_init_access(vq);
                if (r)
                        goto err_used;
                r = vhost_net_enable_vq(n, vq);
                if (r)
                        goto err_used;
+                if (index == VHOST_NET_VQ_RX)
+                        nvq->rx_ring = get_tap_ptr_ring(fd);
                oldubufs = nvq->ubufs;
                nvq->ubufs = ubufs;
diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
index af6fc97f4ba4..a436d44f1b7f 100644
--- a/drivers/video/fbdev/sbuslib.c
+++ b/drivers/video/fbdev/sbuslib.c
@@ -122,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                unsigned char __user *ured;
                unsigned char __user *ugreen;
                unsigned char __user *ublue;
-                int index, count, i;
+                unsigned int index, count, i;
                if (get_user(index, &c->index) ||
                    __get_user(count, &c->count) ||
@@ -161,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                unsigned char __user *ugreen;
                unsigned char __user *ublue;
                struct fb_cmap *cmap = &info->cmap;
-                int index, count, i;
+                unsigned int index, count, i;
                u8 red, green, blue;
                if (get_user(index, &c->index) ||
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index eb30f3e09a47..71458f493cf8 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -428,8 +428,6 @@ unmap_release:
                i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next);
        }
-        vq->vq.num_free += total_sg;
        if (indirect)
                kfree(desc);
diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index e0678c14480f..3a33c5344bd5 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -566,7 +566,8 @@ static ssize_t watchdog_write(struct file *file, const char __user *buf,
                                char c;
                                if (get_user(c, buf + i))
                                        return -EFAULT;
-                                expect_close = (c == 'V');
+                                if (c == 'V')
+                                        expect_close = true;
                        }
                        /* Properly order writes across fork()ed processes */
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index f1f00dfc0e68..b0a158073abd 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -28,16 +28,7 @@
 #include <linux/types.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#include <linux/dmi.h>
-#include <linux/spinlock.h>
-#include <linux/nmi.h>
-#include <linux/kdebug.h>
-#include <linux/notifier.h>
-#include <asm/set_memory.h>
-#endif /* CONFIG_HPWDT_NMI_DECODING */
 #include <asm/nmi.h>
-#include <asm/frame.h>
 #define HPWDT_VERSION                   "1.4.0"
 #define SECS_TO_TICKS(secs)             ((secs) * 1000 / 128)
@@ -48,6 +39,9 @@
 static unsigned int soft_margin = DEFAULT_MARGIN;       /* in seconds */
 static unsigned int reload;                     /* the computed soft_margin */
 static bool nowayout = WATCHDOG_NOWAYOUT;
+#ifdef CONFIG_HPWDT_NMI_DECODING
+static unsigned int allow_kdump = 1;
+#endif
 static char expect_release;
 static unsigned long hpwdt_is_open;
@@ -63,373 +57,6 @@ static const struct pci_device_id hpwdt_devices[] = {
 };
 MODULE_DEVICE_TABLE(pci, hpwdt_devices);
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#define PCI_BIOS32_SD_VALUE             0x5F32335F      /* "_32_" */
-#define CRU_BIOS_SIGNATURE_VALUE        0x55524324
-#define PCI_BIOS32_PARAGRAPH_LEN        16
-#define PCI_ROM_BASE1                   0x000F0000
-#define ROM_SIZE                        0x10000
-struct bios32_service_dir {
-        u32 signature;
-        u32 entry_point;
-        u8 revision;
-        u8 length;
-        u8 checksum;
-        u8 reserved[5];
-};
-/* type 212 */
-struct smbios_cru64_info {
-        u8 type;
-        u8 byte_length;
-        u16 handle;
-        u32 signature;
-        u64 physical_address;
-        u32 double_length;
-        u32 double_offset;
-};
-#define SMBIOS_CRU64_INFORMATION        212
-/* type 219 */
-struct smbios_proliant_info {
-        u8 type;
-        u8 byte_length;
-        u16 handle;
-        u32 power_features;
-        u32 omega_features;
-        u32 reserved;
-        u32 misc_features;
-};
-#define SMBIOS_ICRU_INFORMATION         219
-struct cmn_registers {
-        union {
-                struct {
-                        u8 ral;
-                        u8 rah;
-                        u16 rea2;
-                };
-                u32 reax;
-        } u1;
-        union {
-                struct {
-                        u8 rbl;
-                        u8 rbh;
-                        u8 reb2l;
-                        u8 reb2h;
-                };
-                u32 rebx;
-        } u2;
-        union {
-                struct {
-                        u8 rcl;
-                        u8 rch;
-                        u16 rec2;
-                };
-                u32 recx;
-        } u3;
-        union {
-                struct {
-                        u8 rdl;
-                        u8 rdh;
-                        u16 red2;
-                };
-                u32 redx;
-        } u4;
-        u32 resi;
-        u32 redi;
-        u16 rds;
-        u16 res;
-        u32 reflags;
-}  __attribute__((packed));
-static unsigned int hpwdt_nmi_decoding;
-static unsigned int allow_kdump = 1;
-static unsigned int is_icru;
-static unsigned int is_uefi;
-static DEFINE_SPINLOCK(rom_lock);
-static void *cru_rom_addr;
-static struct cmn_registers cmn_regs;
-extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs,
-                                                unsigned long *pRomEntry);
-#ifdef CONFIG_X86_32
-/* --32 Bit Bios------------------------------------------------------------ */
-#define HPWDT_ARCH      32
-asm(".text                          \n\t"
-    ".align 4                       \n\t"
-    ".globl asminline_call          \n"
-    "asminline_call:                \n\t"
-    "pushl       %ebp               \n\t"
-    "movl        %esp, %ebp         \n\t"
-    "pusha                          \n\t"
-    "pushf                          \n\t"
-    "push        %es                \n\t"
-    "push        %ds                \n\t"
-    "pop         %es                \n\t"
-    "movl        8(%ebp),%eax       \n\t"
-    "movl        4(%eax),%ebx       \n\t"
-    "movl        8(%eax),%ecx       \n\t"
-    "movl        12(%eax),%edx      \n\t"
-    "movl        16(%eax),%esi      \n\t"
-    "movl        20(%eax),%edi      \n\t"
-    "movl        (%eax),%eax        \n\t"
-    "push        %cs                \n\t"
-    "call        *12(%ebp)          \n\t"
-    "pushf                          \n\t"
-    "pushl       %eax               \n\t"
-    "movl        8(%ebp),%eax       \n\t"
-    "movl        %ebx,4(%eax)       \n\t"
-    "movl        %ecx,8(%eax)       \n\t"
-    "movl        %edx,12(%eax)      \n\t"
-    "movl        %esi,16(%eax)      \n\t"
-    "movl        %edi,20(%eax)      \n\t"
-    "movw        %ds,24(%eax)       \n\t"
-    "movw        %es,26(%eax)       \n\t"
-    "popl        %ebx               \n\t"
-    "movl        %ebx,(%eax)        \n\t"
-    "popl        %ebx               \n\t"
-    "movl        %ebx,28(%eax)      \n\t"
-    "pop         %es                \n\t"
-    "popf                           \n\t"
-    "popa                           \n\t"
-    "leave                          \n\t"
-    "ret                            \n\t"
-    ".previous");
-/*
- *      cru_detect
- *
- *      Routine Description:
- *      This function uses the 32-bit BIOS Service Directory record to
- *      search for a $CRU record.
- *
- *      Return Value:
- *      0        :  SUCCESS
- *      <0       :  FAILURE
- */
-static int cru_detect(unsigned long map_entry,
-        unsigned long map_offset)
-{
-        void *bios32_map;
-        unsigned long *bios32_entrypoint;
-        unsigned long cru_physical_address;
-        unsigned long cru_length;
-        unsigned long physical_bios_base = 0;
-        unsigned long physical_bios_offset = 0;
-        int retval = -ENODEV;
-        bios32_map = ioremap(map_entry, (2 * PAGE_SIZE));
-        if (bios32_map == NULL)
-                return -ENODEV;
-        bios32_entrypoint = bios32_map + map_offset;
-        cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-        set_memory_x((unsigned long)bios32_map, 2);
-        asminline_call(&cmn_regs, bios32_entrypoint);
-        if (cmn_regs.u1.ral != 0) {
-                pr_warn("Call succeeded but with an error: 0x%x\n",
-                        cmn_regs.u1.ral);
-        } else {
-                physical_bios_base = cmn_regs.u2.rebx;
-                physical_bios_offset = cmn_regs.u4.redx;
-                cru_length = cmn_regs.u3.recx;
-                cru_physical_address =
-                        physical_bios_base + physical_bios_offset;
-                /* If the values look OK, then map it in. */
-                if ((physical_bios_base + physical_bios_offset)) {
-                        cru_rom_addr =
-                                ioremap(cru_physical_address, cru_length);
-                        if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
-                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
-                                retval = 0;
-                        }
-                }
-                pr_debug("CRU Base Address:   0x%lx\n", physical_bios_base);
-                pr_debug("CRU Offset Address: 0x%lx\n", physical_bios_offset);
-                pr_debug("CRU Length:         0x%lx\n", cru_length);
-                pr_debug("CRU Mapped Address: %p\n", &cru_rom_addr);
-        }
-        iounmap(bios32_map);
-        return retval;
-}
-/*
- *      bios_checksum
- */
-static int bios_checksum(const char __iomem *ptr, int len)
-{
-        char sum = 0;
-        int i;
-        /*
-         * calculate checksum of size bytes. This should add up
-         * to zero if we have a valid header.
-         */
-        for (i = 0; i < len; i++)
-                sum += ptr[i];
-        return ((sum == 0) && (len > 0));
-}
-/*
- *      bios32_present
- *
- *      Routine Description:
- *      This function finds the 32-bit BIOS Service Directory
- *
- *      Return Value:
- *      0        :  SUCCESS
- *      <0       :  FAILURE
- */
-static int bios32_present(const char __iomem *p)
-{
-        struct bios32_service_dir *bios_32_ptr;
-        int length;
-        unsigned long map_entry, map_offset;
-        bios_32_ptr = (struct bios32_service_dir *) p;
-        /*
-         * Search for signature by checking equal to the swizzled value
-         * instead of calling another routine to perform a strcmp.
-         */
-        if (bios_32_ptr->signature == PCI_BIOS32_SD_VALUE) {
-                length = bios_32_ptr->length * PCI_BIOS32_PARAGRAPH_LEN;
-                if (bios_checksum(p, length)) {
-                        /*
-                         * According to the spec, we're looking for the
-                         * first 4KB-aligned address below the entrypoint
-                         * listed in the header. The Service Directory code
-                         * is guaranteed to occupy no more than 2 4KB pages.
-                         */
-                        map_entry = bios_32_ptr->entry_point & ~(PAGE_SIZE - 1);
-                        map_offset = bios_32_ptr->entry_point - map_entry;
-                        return cru_detect(map_entry, map_offset);
-                }
-        }
-        return -ENODEV;
-}
-static int detect_cru_service(void)
-{
-        char __iomem *p, *q;
-        int rc = -1;
-        /*
-         * Search from 0x0f0000 through 0x0fffff, inclusive.
-         */
-        p = ioremap(PCI_ROM_BASE1, ROM_SIZE);
-        if (p == NULL)
-                return -ENOMEM;
-        for (q = p; q < p + ROM_SIZE; q += 16) {
-                rc = bios32_present(q);
-                if (!rc)
-                        break;
-        }
-        iounmap(p);
-        return rc;
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_32 */
-#ifdef CONFIG_X86_64
-/* --64 Bit Bios------------------------------------------------------------ */
-#define HPWDT_ARCH      64
-asm(".text                      \n\t"
-    ".align 4                   \n\t"
-    ".globl asminline_call      \n\t"
-    ".type asminline_call, @function \n\t"
-    "asminline_call:            \n\t"
-    FRAME_BEGIN
-    "pushq      %rax            \n\t"
-    "pushq      %rbx            \n\t"
-    "pushq      %rdx            \n\t"
-    "pushq      %r12            \n\t"
-    "pushq      %r9             \n\t"
-    "movq       %rsi, %r12      \n\t"
-    "movq       %rdi, %r9       \n\t"
-    "movl       4(%r9),%ebx     \n\t"
-    "movl       8(%r9),%ecx     \n\t"
-    "movl       12(%r9),%edx    \n\t"
-    "movl       16(%r9),%esi    \n\t"
-    "movl       20(%r9),%edi    \n\t"
-    "movl       (%r9),%eax      \n\t"
-    "call       *%r12           \n\t"
-    "pushfq                     \n\t"
-    "popq        %r12           \n\t"
-    "movl       %eax, (%r9)     \n\t"
-    "movl       %ebx, 4(%r9)    \n\t"
-    "movl       %ecx, 8(%r9)    \n\t"
-    "movl       %edx, 12(%r9)   \n\t"
-    "movl       %esi, 16(%r9)   \n\t"
-    "movl       %edi, 20(%r9)   \n\t"
-    "movq       %r12, %rax      \n\t"
-    "movl       %eax, 28(%r9)   \n\t"
-    "popq       %r9             \n\t"
-    "popq       %r12            \n\t"
-    "popq       %rdx            \n\t"
-    "popq       %rbx            \n\t"
-    "popq       %rax            \n\t"
-    FRAME_END
-    "ret                        \n\t"
-    ".previous");
-/*
- *      dmi_find_cru
- *
- *      Routine Description:
- *      This function checks whether or not a SMBIOS/DMI record is
- *      the 64bit CRU info or not
- */
-static void dmi_find_cru(const struct dmi_header *dm, void *dummy)
-{
-        struct smbios_cru64_info *smbios_cru64_ptr;
-        unsigned long cru_physical_address;
-        if (dm->type == SMBIOS_CRU64_INFORMATION) {
-                smbios_cru64_ptr = (struct smbios_cru64_info *) dm;
-                if (smbios_cru64_ptr->signature == CRU_BIOS_SIGNATURE_VALUE) {
-                        cru_physical_address =
-                                smbios_cru64_ptr->physical_address +
-                                smbios_cru64_ptr->double_offset;
-                        cru_rom_addr = ioremap(cru_physical_address,
-                                smbios_cru64_ptr->double_length);
-                        set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
-                                smbios_cru64_ptr->double_length >> PAGE_SHIFT);
-                }
-        }
-}
-static int detect_cru_service(void)
-{
-        cru_rom_addr = NULL;
-        dmi_walk(dmi_find_cru, NULL);
-        /* if cru_rom_addr has been set then we found a CRU service */
-        return ((cru_rom_addr != NULL) ? 0 : -ENODEV);
-}
-/* ------------------------------------------------------------------------- */
-#endif /* CONFIG_X86_64 */
-#endif /* CONFIG_HPWDT_NMI_DECODING */
 /*
 *      Watchdog operations
@@ -486,30 +113,12 @@ static int hpwdt_my_nmi(void)
 */
 static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
 {
-        unsigned long rom_pl;
-        static int die_nmi_called;
-        if (!hpwdt_nmi_decoding)
-                return NMI_DONE;
        if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi())
                return NMI_DONE;
-        spin_lock_irqsave(&rom_lock, rom_pl);
-        if (!die_nmi_called && !is_icru && !is_uefi)
-                asminline_call(&cmn_regs, cru_rom_addr);
-        die_nmi_called = 1;
-        spin_unlock_irqrestore(&rom_lock, rom_pl);
        if (allow_kdump)
                hpwdt_stop();
-        if (!is_icru && !is_uefi) {
-                if (cmn_regs.u1.ral == 0) {
-                        nmi_panic(regs, "An NMI occurred, but unable to determine source.\n");
-                        return NMI_HANDLED;
-                }
-        }
        nmi_panic(regs, "An NMI occurred. Depending on your system the reason "
                "for the NMI is logged in any one of the following "
                "resources:\n"
@@ -675,84 +284,11 @@ static struct miscdevice hpwdt_miscdev = {
 *      Init & Exit
 */
-#ifdef CONFIG_HPWDT_NMI_DECODING
-#ifdef CONFIG_X86_LOCAL_APIC
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-        /*
-         * If nmi_watchdog is turned off then we can turn on
-         * our nmi decoding capability.
-         */
-        hpwdt_nmi_decoding = 1;
-}
-#else
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-        dev_warn(&dev->dev, "NMI decoding is disabled. "
-                "Your kernel does not support a NMI Watchdog.\n");
-}
-#endif /* CONFIG_X86_LOCAL_APIC */
-/*
- *      dmi_find_icru
- *
- *      Routine Description:
- *      This function checks whether or not we are on an iCRU-based server.
- *      This check is independent of architecture and needs to be made for
- *      any ProLiant system.
- */
-static void dmi_find_icru(const struct dmi_header *dm, void *dummy)
-{
-        struct smbios_proliant_info *smbios_proliant_ptr;
-        if (dm->type == SMBIOS_ICRU_INFORMATION) {
-                smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
-                if (smbios_proliant_ptr->misc_features & 0x01)
-                        is_icru = 1;
-                if (smbios_proliant_ptr->misc_features & 0x1400)
-                        is_uefi = 1;
-        }
-}
 static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
 {
+#ifdef CONFIG_HPWDT_NMI_DECODING
        int retval;
-        /*
-         * On typical CRU-based systems we need to map that service in
-         * the BIOS. For 32 bit Operating Systems we need to go through
-         * the 32 Bit BIOS Service Directory. For 64 bit Operating
-         * Systems we get that service through SMBIOS.
-         *
-         * On systems that support the new iCRU service all we need to
-         * do is call dmi_walk to get the supported flag value and skip
-         * the old cru detect code.
-         */
-        dmi_walk(dmi_find_icru, NULL);
-        if (!is_icru && !is_uefi) {
-                /*
-                * We need to map the ROM to get the CRU service.
-                * For 32 bit Operating Systems we need to go through the 32 Bit
-                * BIOS Service Directory
-                * For 64 bit Operating Systems we get that service through SMBIOS.
-                */
-                retval = detect_cru_service();
-                if (retval < 0) {
-                        dev_warn(&dev->dev,
-                                "Unable to detect the %d Bit CRU Service.\n",
-                                HPWDT_ARCH);
-                        return retval;
-                }
-                /*
-                * We know this is the only CRU call we need to make so lets keep as
-                * few instructions as possible once the NMI comes in.
-                */
-                cmn_regs.u1.rah = 0x0D;
-                cmn_regs.u1.ral = 0x02;
-        }
        /*
         * Only one function can register for NMI_UNKNOWN
         */
@@ -780,45 +316,26 @@ error:
        dev_warn(&dev->dev,
                "Unable to register a die notifier (err=%d).\n",
                retval);
-        if (cru_rom_addr)
-                iounmap(cru_rom_addr);
        return retval;
+#endif  /* CONFIG_HPWDT_NMI_DECODING */
+        return 0;
 }
 static void hpwdt_exit_nmi_decoding(void)
 {
+#ifdef CONFIG_HPWDT_NMI_DECODING
        unregister_nmi_handler(NMI_UNKNOWN, "hpwdt");
        unregister_nmi_handler(NMI_SERR, "hpwdt");
        unregister_nmi_handler(NMI_IO_CHECK, "hpwdt");
-        if (cru_rom_addr)
+#endif
-                iounmap(cru_rom_addr);
-}
-#else /* !CONFIG_HPWDT_NMI_DECODING */
-static void hpwdt_check_nmi_decoding(struct pci_dev *dev)
-{
-}
-static int hpwdt_init_nmi_decoding(struct pci_dev *dev)
-{
-        return 0;
 }
-static void hpwdt_exit_nmi_decoding(void)
-{
-}
-#endif /* CONFIG_HPWDT_NMI_DECODING */
 static int hpwdt_init_one(struct pci_dev *dev,
                                        const struct pci_device_id *ent)
 {
        int retval;
        /*
-         * Check if we can do NMI decoding or not
-         */
-        hpwdt_check_nmi_decoding(dev);
-        /*
         * First let's find out if we are on an iLO2+ server. We will
         * not run on a legacy ASM box.
         * So we only support the G5 ProLiant servers and higher.
@@ -922,6 +439,6 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 #ifdef CONFIG_HPWDT_NMI_DECODING
 module_param(allow_kdump, int, 0);
 MODULE_PARM_DESC(allow_kdump, "Start a kernel dump after NMI occurs");
-#endif /* !CONFIG_HPWDT_NMI_DECODING */
+#endif /* CONFIG_HPWDT_NMI_DECODING */
 module_pci_driver(hpwdt_driver);
diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
index 316c2eb122d2..e8bd9887c566 100644
--- a/drivers/watchdog/sbsa_gwdt.c
+++ b/drivers/watchdog/sbsa_gwdt.c
@@ -50,6 +50,7 @@
 */
 #include <linux/io.h>
+#include <linux/io-64-nonatomic-lo-hi.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -159,7 +160,7 @@ static unsigned int sbsa_gwdt_get_timeleft(struct watchdog_device *wdd)
            !(readl(gwdt->control_base + SBSA_GWDT_WCS) & SBSA_GWDT_WCS_WS0))
                timeleft += readl(gwdt->control_base + SBSA_GWDT_WOR);
-        timeleft += readq(gwdt->control_base + SBSA_GWDT_WCV) -
+        timeleft += lo_hi_readq(gwdt->control_base + SBSA_GWDT_WCV) -
                    arch_counter_get_cntvct();
        do_div(timeleft, gwdt->clk);
diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
index 6d1fbda0f461..0da9943d405f 100644
--- a/drivers/watchdog/wdat_wdt.c
+++ b/drivers/watchdog/wdat_wdt.c
@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
                memset(&r, 0, sizeof(r));
                r.start = gas->address;
-                r.end = r.start + gas->access_width;
+                r.end = r.start + gas->access_width - 1;
                if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
                        r.flags = IORESOURCE_MEM;
                } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 74888cacd0b0..ec9eb4fba59c 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -466,8 +466,11 @@ int xenbus_probe_node(struct xen_bus_type *bus,
        /* Register with generic device framework. */
        err = device_register(&xendev->dev);
-        if (err)
+        if (err) {
+                put_device(&xendev->dev);
+                xendev = NULL;
                goto fail;
+        }
        return 0;
 fail:
diff --git a/fs/aio.c b/fs/aio.c
index a062d75109cb..6bcd3fb5265a 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -68,9 +68,9 @@ struct aio_ring {
 #define AIO_RING_PAGES  8
 struct kioctx_table {
-        struct rcu_head rcu;
+        struct rcu_head         rcu;
-        unsigned        nr;
+        unsigned                nr;
-        struct kioctx   *table[];
+        struct kioctx __rcu     *table[];
 };
 struct kioctx_cpu {
@@ -115,7 +115,8 @@ struct kioctx {
        struct page             **ring_pages;
        long                    nr_pages;
-        struct work_struct      free_work;
+        struct rcu_head         free_rcu;
+        struct work_struct      free_work;      /* see free_ioctx() */
        /*
         * signals when all in-flight requests are done
@@ -329,7 +330,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
        for (i = 0; i < table->nr; i++) {
                struct kioctx *ctx;
-                ctx = table->table[i];
+                ctx = rcu_dereference(table->table[i]);
                if (ctx && ctx->aio_ring_file == file) {
                        if (!atomic_read(&ctx->dead)) {
                                ctx->user_id = ctx->mmap_base = vma->vm_start;
@@ -588,6 +589,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb)
        return cancel(&kiocb->common);
 }
+/*
+ * free_ioctx() should be RCU delayed to synchronize against the RCU
+ * protected lookup_ioctx() and also needs process context to call
+ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and
+ * ->free_work.
+ */
 static void free_ioctx(struct work_struct *work)
 {
        struct kioctx *ctx = container_of(work, struct kioctx, free_work);
@@ -601,6 +608,14 @@ static void free_ioctx(struct work_struct *work)
        kmem_cache_free(kioctx_cachep, ctx);
 }
+static void free_ioctx_rcufn(struct rcu_head *head)
+{
+        struct kioctx *ctx = container_of(head, struct kioctx, free_rcu);
+        INIT_WORK(&ctx->free_work, free_ioctx);
+        schedule_work(&ctx->free_work);
+}
 static void free_ioctx_reqs(struct percpu_ref *ref)
 {
        struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
@@ -609,8 +624,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref)
        if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count))
                complete(&ctx->rq_wait->comp);
-        INIT_WORK(&ctx->free_work, free_ioctx);
+        /* Synchronize against RCU protected table->table[] dereferences */
-        schedule_work(&ctx->free_work);
+        call_rcu(&ctx->free_rcu, free_ioctx_rcufn);
 }
 /*
@@ -651,9 +666,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
        while (1) {
                if (table)
                        for (i = 0; i < table->nr; i++)
-                                if (!table->table[i]) {
+                                if (!rcu_access_pointer(table->table[i])) {
                                        ctx->id = i;
-                                        table->table[i] = ctx;
+                                        rcu_assign_pointer(table->table[i], ctx);
                                        spin_unlock(&mm->ioctx_lock);
                                        /* While kioctx setup is in progress,
@@ -834,11 +849,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
        }
        table = rcu_dereference_raw(mm->ioctx_table);
-        WARN_ON(ctx != table->table[ctx->id]);
+        WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id]));
-        table->table[ctx->id] = NULL;
+        RCU_INIT_POINTER(table->table[ctx->id], NULL);
        spin_unlock(&mm->ioctx_lock);
-        /* percpu_ref_kill() will do the necessary call_rcu() */
+        /* free_ioctx_reqs() will do the necessary RCU synchronization */
        wake_up_all(&ctx->wait);
        /*
@@ -880,7 +895,8 @@ void exit_aio(struct mm_struct *mm)
        skipped = 0;
        for (i = 0; i < table->nr; ++i) {
-                struct kioctx *ctx = table->table[i];
+                struct kioctx *ctx =
+                        rcu_dereference_protected(table->table[i], true);
                if (!ctx) {
                        skipped++;
@@ -1069,7 +1085,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
        if (!table || id >= table->nr)
                goto out;
-        ctx = table->table[id];
+        ctx = rcu_dereference(table->table[id]);
        if (ctx && ctx->user_id == ctx_id) {
                percpu_ref_get(&ctx->users);
                ret = ctx;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index f94b2d8c744a..26484648d090 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1519,6 +1519,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
                if (!node)
                        break;
                bytenr = node->val;
+                shared.share_count = 0;
                cond_resched();
        }
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index dec0907dfb8a..fcfc20de2df3 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1370,6 +1370,7 @@ static int find_bio_stripe(struct btrfs_raid_bio *rbio,
                stripe_start = stripe->physical;
                if (physical >= stripe_start &&
                    physical < stripe_start + rbio->stripe_len &&
+                    stripe->dev->bdev &&
                    bio->bi_disk == stripe->dev->bdev->bd_disk &&
                    bio->bi_partno == stripe->dev->bdev->bd_partno) {
                        return i;
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index d11c70bff5a9..a8bafed931f4 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -423,7 +423,7 @@ static ssize_t btrfs_nodesize_show(struct kobject *kobj,
 {
        struct btrfs_fs_info *fs_info = to_fs_info(kobj);
-        return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->nodesize);
+        return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->super_copy->nodesize);
 }
 BTRFS_ATTR(, nodesize, btrfs_nodesize_show);
@@ -433,7 +433,8 @@ static ssize_t btrfs_sectorsize_show(struct kobject *kobj,
 {
        struct btrfs_fs_info *fs_info = to_fs_info(kobj);
-        return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize);
+        return snprintf(buf, PAGE_SIZE, "%u\n",
+                        fs_info->super_copy->sectorsize);
 }
 BTRFS_ATTR(, sectorsize, btrfs_sectorsize_show);
@@ -443,7 +444,8 @@ static ssize_t btrfs_clone_alignment_show(struct kobject *kobj,
 {
        struct btrfs_fs_info *fs_info = to_fs_info(kobj);
-        return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize);
+        return snprintf(buf, PAGE_SIZE, "%u\n",
+                        fs_info->super_copy->sectorsize);
 }
 BTRFS_ATTR(, clone_alignment, btrfs_clone_alignment_show);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 9220f004001c..04f07144b45c 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1722,23 +1722,19 @@ static void update_super_roots(struct btrfs_fs_info *fs_info)
        super = fs_info->super_copy;
-        /* update latest btrfs_super_block::chunk_root refs */
        root_item = &fs_info->chunk_root->root_item;
-        btrfs_set_super_chunk_root(super, root_item->bytenr);
+        super->chunk_root = root_item->bytenr;
-        btrfs_set_super_chunk_root_generation(super, root_item->generation);
+        super->chunk_root_generation = root_item->generation;
-        btrfs_set_super_chunk_root_level(super, root_item->level);
+        super->chunk_root_level = root_item->level;
-        /* update latest btrfs_super_block::root refs */
        root_item = &fs_info->tree_root->root_item;
-        btrfs_set_super_root(super, root_item->bytenr);
+        super->root = root_item->bytenr;
-        btrfs_set_super_generation(super, root_item->generation);
+        super->generation = root_item->generation;
-        btrfs_set_super_root_level(super, root_item->level);
+        super->root_level = root_item->level;
        if (btrfs_test_opt(fs_info, SPACE_CACHE))
-                btrfs_set_super_cache_generation(super, root_item->generation);
+                super->cache_generation = root_item->generation;
        if (test_bit(BTRFS_FS_UPDATE_UUID_TREE_GEN, &fs_info->flags))
-                btrfs_set_super_uuid_tree_generation(super,
+                super->uuid_tree_generation = root_item->generation;
-                                                     root_item->generation);
 }
 int btrfs_transaction_in_commit(struct btrfs_fs_info *info)
diff --git a/fs/dcache.c b/fs/dcache.c
index 7c38f39958bc..8945e6cabd93 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -647,11 +647,16 @@ again:
                spin_unlock(&parent->d_lock);
                goto again;
        }
-        rcu_read_unlock();
+        if (parent != dentry) {
-        if (parent != dentry)
                spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
-        else
+                if (unlikely(dentry->d_lockref.count < 0)) {
+                        spin_unlock(&parent->d_lock);
+                        parent = NULL;
+                }
+        } else {
                parent = NULL;
+        }
+        rcu_read_unlock();
        return parent;
 }
@@ -2474,7 +2479,7 @@ struct dentry *d_alloc_parallel(struct dentry *parent,
 retry:
        rcu_read_lock();
-        seq = smp_load_acquire(&parent->d_inode->i_dir_seq) & ~1;
+        seq = smp_load_acquire(&parent->d_inode->i_dir_seq);
        r_seq = read_seqbegin(&rename_lock);
        dentry = __d_lookup_rcu(parent, name, &d_seq);
        if (unlikely(dentry)) {
@@ -2495,8 +2500,14 @@ retry:
                rcu_read_unlock();
                goto retry;
        }
+        if (unlikely(seq & 1)) {
+                rcu_read_unlock();
+                goto retry;
+        }
        hlist_bl_lock(b);
-        if (unlikely(parent->d_inode->i_dir_seq != seq)) {
+        if (unlikely(READ_ONCE(parent->d_inode->i_dir_seq) != seq)) {
                hlist_bl_unlock(b);
                rcu_read_unlock();
                goto retry;
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 86d6a4435c87..51f940e76c5e 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -807,9 +807,6 @@ do_alloc:
                        iomap->length = hole_size(inode, lblock, &mp);
                else
                        iomap->length = size - pos;
-        } else {
-                if (height <= ip->i_height)
-                        iomap->length = hole_size(inode, lblock, &mp);
        }
        goto out_release;
 }
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8fe1b0aa2896..b9a254dcc0e7 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -108,6 +108,16 @@ static void huge_pagevec_release(struct pagevec *pvec)
        pagevec_reinit(pvec);
 }
+/*
+ * Mask used when checking the page offset value passed in via system
+ * calls.  This value will be converted to a loff_t which is signed.
+ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the
+ * value.  The extra bit (- 1 in the shift value) is to take the sign
+ * bit into account.
+ */
+#define PGOFF_LOFFT_MAX \
+        (((1UL << (PAGE_SHIFT + 1)) - 1) <<  (BITS_PER_LONG - (PAGE_SHIFT + 1)))
 static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 {
        struct inode *inode = file_inode(file);
@@ -127,12 +137,13 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
        vma->vm_ops = &hugetlb_vm_ops;
        /*
-         * Offset passed to mmap (before page shift) could have been
+         * page based offset in vm_pgoff could be sufficiently large to
-         * negative when represented as a (l)off_t.
+         * overflow a (l)off_t when converted to byte offset.
         */
-        if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
+        if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
                return -EINVAL;
+        /* must be huge page aligned */
        if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
                return -EINVAL;
diff --git a/fs/namei.c b/fs/namei.c
index 921ae32dbc80..cafa365eeb70 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -559,9 +559,10 @@ static int __nd_alloc_stack(struct nameidata *nd)
 static bool path_connected(const struct path *path)
 {
        struct vfsmount *mnt = path->mnt;
+        struct super_block *sb = mnt->mnt_sb;
-        /* Only bind mounts can have disconnected paths */
+        /* Bind mounts and multi-root filesystems can have disconnected paths */
-        if (mnt->mnt_root == mnt->mnt_sb->s_root)
+        if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root))
                return true;
        return is_subdir(path->dentry, mnt->mnt_root);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 8c10b0562e75..621c517b325c 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -86,10 +86,10 @@ struct nfs_direct_req {
        struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX];
        int                     mirror_count;
+        loff_t                  io_start;       /* Start offset for I/O */
        ssize_t                 count,          /* bytes actually processed */
                                max_count,      /* max expected count */
                                bytes_left,     /* bytes left to be sent */
-                                io_start,       /* start of IO */
                                error;          /* any reported error */
        struct completion       completion;     /* wait for i/o completion */
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index c13e826614b5..ee723aa153a3 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -292,8 +292,11 @@ pnfs_detach_layout_hdr(struct pnfs_layout_hdr *lo)
 void
 pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
 {
-        struct inode *inode = lo->plh_inode;
+        struct inode *inode;
+        if (!lo)
+                return;
+        inode = lo->plh_inode;
        pnfs_layoutreturn_before_put_layout_hdr(lo);
        if (refcount_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) {
@@ -1241,10 +1244,12 @@ retry:
        spin_lock(&ino->i_lock);
        lo = nfsi->layout;
        if (!lo || !pnfs_layout_is_valid(lo) ||
-            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags))
+            test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) {
+                lo = NULL;
                goto out_noroc;
+        }
+        pnfs_get_layout_hdr(lo);
        if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) {
-                pnfs_get_layout_hdr(lo);
                spin_unlock(&ino->i_lock);
                wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN,
                                TASK_UNINTERRUPTIBLE);
@@ -1312,10 +1317,12 @@ out_noroc:
                struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld;
                if (ld->prepare_layoutreturn)
                        ld->prepare_layoutreturn(args);
+                pnfs_put_layout_hdr(lo);
                return true;
        }
        if (layoutreturn)
                pnfs_send_layoutreturn(lo, &stateid, iomode, true);
+        pnfs_put_layout_hdr(lo);
        return false;
 }
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 29bacdc56f6a..5e470e233c83 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2631,6 +2631,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server,
                /* initial superblock/root creation */
                mount_info->fill_super(s, mount_info);
                nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned);
+                if (!(server->flags & NFS_MOUNT_UNSHARED))
+                        s->s_iflags |= SB_I_MULTIROOT;
        }
        mntroot = nfs_get_root(s, mount_info->mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 7428a669d7a7..e7d8ceae8f26 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1876,40 +1876,43 @@ int nfs_generic_commit_list(struct inode *inode, struct list_head *head,
        return status;
 }
-int nfs_commit_inode(struct inode *inode, int how)
+static int __nfs_commit_inode(struct inode *inode, int how,
+                struct writeback_control *wbc)
 {
        LIST_HEAD(head);
        struct nfs_commit_info cinfo;
        int may_wait = how & FLUSH_SYNC;
-        int error = 0;
+        int ret, nscan;
-        int res;
        nfs_init_cinfo_from_inode(&cinfo, inode);
        nfs_commit_begin(cinfo.mds);
-        res = nfs_scan_commit(inode, &head, &cinfo);
+        for (;;) {
-        if (res)
+                ret = nscan = nfs_scan_commit(inode, &head, &cinfo);
-                error = nfs_generic_commit_list(inode, &head, how, &cinfo);
+                if (ret <= 0)
+                        break;
+                ret = nfs_generic_commit_list(inode, &head, how, &cinfo);
+                if (ret < 0)
+                        break;
+                ret = 0;
+                if (wbc && wbc->sync_mode == WB_SYNC_NONE) {
+                        if (nscan < wbc->nr_to_write)
+                                wbc->nr_to_write -= nscan;
+                        else
+                                wbc->nr_to_write = 0;
+                }
+                if (nscan < INT_MAX)
+                        break;
+                cond_resched();
+        }
        nfs_commit_end(cinfo.mds);
-        if (res == 0)
+        if (ret || !may_wait)
-                return res;
+                return ret;
-        if (error < 0)
+        return wait_on_commit(cinfo.mds);
-                goto out_error;
+}
-        if (!may_wait)
-                goto out_mark_dirty;
+int nfs_commit_inode(struct inode *inode, int how)
-        error = wait_on_commit(cinfo.mds);
+{
-        if (error < 0)
+        return __nfs_commit_inode(inode, how, NULL);
-                return error;
-        return res;
-out_error:
-        res = error;
-        /* Note: If we exit without ensuring that the commit is complete,
-         * we must mark the inode as dirty. Otherwise, future calls to
-         * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure
-         * that the data is on the disk.
-         */
-out_mark_dirty:
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return res;
 }
 EXPORT_SYMBOL_GPL(nfs_commit_inode);
@@ -1919,11 +1922,11 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
        int flags = FLUSH_SYNC;
        int ret = 0;
-        /* no commits means nothing needs to be done */
-        if (!atomic_long_read(&nfsi->commit_info.ncommit))
-                return ret;
        if (wbc->sync_mode == WB_SYNC_NONE) {
+                /* no commits means nothing needs to be done */
+                if (!atomic_long_read(&nfsi->commit_info.ncommit))
+                        goto check_requests_outstanding;
                /* Don't commit yet if this is a non-blocking flush and there
                 * are a lot of outstanding writes for this mapping.
                 */
@@ -1934,16 +1937,16 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                flags = 0;
        }
-        ret = nfs_commit_inode(inode, flags);
+        ret = __nfs_commit_inode(inode, flags, wbc);
-        if (ret >= 0) {
+        if (!ret) {
-                if (wbc->sync_mode == WB_SYNC_NONE) {
+                if (flags & FLUSH_SYNC)
-                        if (ret < wbc->nr_to_write)
+                        return 0;
-                                wbc->nr_to_write -= ret;
+        } else if (atomic_long_read(&nfsi->commit_info.ncommit))
-                        else
+                goto out_mark_dirty;
-                                wbc->nr_to_write = 0;
-                }
+check_requests_outstanding:
-                return 0;
+        if (!atomic_read(&nfsi->commit_info.rpcs_out))
-        }
+                return ret;
 out_mark_dirty:
        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
        return ret;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 150521c9671b..61b770e39809 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -268,6 +268,35 @@ free_blocked_lock(struct nfsd4_blocked_lock *nbl)
        kfree(nbl);
 }
+static void
+remove_blocked_locks(struct nfs4_lockowner *lo)
+{
+        struct nfs4_client *clp = lo->lo_owner.so_client;
+        struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
+        struct nfsd4_blocked_lock *nbl;
+        LIST_HEAD(reaplist);
+        /* Dequeue all blocked locks */
+        spin_lock(&nn->blocked_locks_lock);
+        while (!list_empty(&lo->lo_blocked)) {
+                nbl = list_first_entry(&lo->lo_blocked,
+                                        struct nfsd4_blocked_lock,
+                                        nbl_list);
+                list_del_init(&nbl->nbl_list);
+                list_move(&nbl->nbl_lru, &reaplist);
+        }
+        spin_unlock(&nn->blocked_locks_lock);
+        /* Now free them */
+        while (!list_empty(&reaplist)) {
+                nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
+                                        nbl_lru);
+                list_del_init(&nbl->nbl_lru);
+                posix_unblock_lock(&nbl->nbl_lock);
+                free_blocked_lock(nbl);
+        }
+}
 static int
 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
 {
@@ -1866,6 +1895,7 @@ static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 static void
 __destroy_client(struct nfs4_client *clp)
 {
+        int i;
        struct nfs4_openowner *oo;
        struct nfs4_delegation *dp;
        struct list_head reaplist;
@@ -1895,6 +1925,16 @@ __destroy_client(struct nfs4_client *clp)
                nfs4_get_stateowner(&oo->oo_owner);
                release_openowner(oo);
        }
+        for (i = 0; i < OWNER_HASH_SIZE; i++) {
+                struct nfs4_stateowner *so, *tmp;
+                list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
+                                         so_strhash) {
+                        /* Should be no openowners at this point */
+                        WARN_ON_ONCE(so->so_is_open_owner);
+                        remove_blocked_locks(lockowner(so));
+                }
+        }
        nfsd4_return_all_client_layouts(clp);
        nfsd4_shutdown_callback(clp);
        if (clp->cl_cb_conn.cb_xprt)
@@ -6355,6 +6395,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
        }
        spin_unlock(&clp->cl_lock);
        free_ol_stateid_reaplist(&reaplist);
+        remove_blocked_locks(lo);
        nfs4_put_stateowner(&lo->lo_owner);
        return status;
@@ -7140,6 +7181,8 @@ nfs4_state_destroy_net(struct net *net)
                }
        }
+        WARN_ON(!list_empty(&nn->blocked_locks_lru));
        for (i = 0; i < CLIENT_HASH_SIZE; i++) {
                while (!list_empty(&nn->unconf_id_hashtbl[i])) {
                        clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
@@ -7206,7 +7249,6 @@ nfs4_state_shutdown_net(struct net *net)
        struct nfs4_delegation *dp = NULL;
        struct list_head *pos, *next, reaplist;
        struct nfsd_net *nn = net_generic(net, nfsd_net_id);
-        struct nfsd4_blocked_lock *nbl;
        cancel_delayed_work_sync(&nn->laundromat_work);
        locks_end_grace(&nn->nfsd4_manager);
@@ -7227,24 +7269,6 @@ nfs4_state_shutdown_net(struct net *net)
                nfs4_put_stid(&dp->dl_stid);
        }
-        BUG_ON(!list_empty(&reaplist));
-        spin_lock(&nn->blocked_locks_lock);
-        while (!list_empty(&nn->blocked_locks_lru)) {
-                nbl = list_first_entry(&nn->blocked_locks_lru,
-                                        struct nfsd4_blocked_lock, nbl_lru);
-                list_move(&nbl->nbl_lru, &reaplist);
-                list_del_init(&nbl->nbl_list);
-        }
-        spin_unlock(&nn->blocked_locks_lock);
-        while (!list_empty(&reaplist)) {
-                nbl = list_first_entry(&reaplist,
-                                        struct nfsd4_blocked_lock, nbl_lru);
-                list_del_init(&nbl->nbl_lru);
-                posix_unblock_lock(&nbl->nbl_lock);
-                free_blocked_lock(nbl);
-        }
        nfsd4_client_tracking_exit(net);
        nfs4_state_destroy_net(net);
 }
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index 406e72de88f6..ce6ff5a0a6e4 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -24,6 +24,8 @@ config OVERLAY_FS_REDIRECT_DIR
          an overlay which has redirects on a kernel that doesn't support this
          feature will have unexpected results.
+          If unsure, say N.
 config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
        bool "Overlayfs: follow redirects even if redirects are turned off"
        default y
@@ -32,8 +34,13 @@ config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
          Disable this to get a possibly more secure configuration, but that
          might not be backward compatible with previous kernels.
+          If backward compatibility is not an issue, then it is safe and
+          recommended to say N here.
          For more information, see Documentation/filesystems/overlayfs.txt
+          If unsure, say Y.
 config OVERLAY_FS_INDEX
        bool "Overlayfs: turn on inodes index feature by default"
        depends on OVERLAY_FS
@@ -51,6 +58,8 @@ config OVERLAY_FS_INDEX
          That is, mounting an overlay which has an inodes index on a kernel
          that doesn't support this feature will have unexpected results.
+          If unsure, say N.
 config OVERLAY_FS_NFS_EXPORT
        bool "Overlayfs: turn on NFS export feature by default"
        depends on OVERLAY_FS
@@ -72,3 +81,8 @@ config OVERLAY_FS_NFS_EXPORT
          Note, that the NFS export feature is not backward compatible.
          That is, mounting an overlay which has a full index on a kernel
          that doesn't support this feature will have unexpected results.
+          Most users should say N here and enable this feature on a case-by-
+          case basis with the "nfs_export=on" mount option.
+          Say N unless you fully understand the consequences.
diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
index bb94ce9da5c8..87bd4148f4fb 100644
--- a/fs/overlayfs/export.c
+++ b/fs/overlayfs/export.c
@@ -19,6 +19,142 @@
 #include <linux/ratelimit.h>
 #include "overlayfs.h"
+static int ovl_encode_maybe_copy_up(struct dentry *dentry)
+{
+        int err;
+        if (ovl_dentry_upper(dentry))
+                return 0;
+        err = ovl_want_write(dentry);
+        if (!err) {
+                err = ovl_copy_up(dentry);
+                ovl_drop_write(dentry);
+        }
+        if (err) {
+                pr_warn_ratelimited("overlayfs: failed to copy up on encode (%pd2, err=%i)\n",
+                                    dentry, err);
+        }
+        return err;
+}
+/*
+ * Before encoding a non-upper directory file handle from real layer N, we need
+ * to check if it will be possible to reconnect an overlay dentry from the real
+ * lower decoded dentry. This is done by following the overlay ancestry up to a
+ * "layer N connected" ancestor and verifying that all parents along the way are
+ * "layer N connectable". If an ancestor that is NOT "layer N connectable" is
+ * found, we need to copy up an ancestor, which is "layer N connectable", thus
+ * making that ancestor "layer N connected". For example:
+ *
+ * layer 1: /a
+ * layer 2: /a/b/c
+ *
+ * The overlay dentry /a is NOT "layer 2 connectable", because if dir /a is
+ * copied up and renamed, upper dir /a will be indexed by lower dir /a from
+ * layer 1. The dir /a from layer 2 will never be indexed, so the algorithm (*)
+ * in ovl_lookup_real_ancestor() will not be able to lookup a connected overlay
+ * dentry from the connected lower dentry /a/b/c.
+ *
+ * To avoid this problem on decode time, we need to copy up an ancestor of
+ * /a/b/c, which is "layer 2 connectable", on encode time. That ancestor is
+ * /a/b. After copy up (and index) of /a/b, it will become "layer 2 connected"
+ * and when the time comes to decode the file handle from lower dentry /a/b/c,
+ * ovl_lookup_real_ancestor() will find the indexed ancestor /a/b and decoding
+ * a connected overlay dentry will be accomplished.
+ *
+ * (*) the algorithm in ovl_lookup_real_ancestor() can be improved to lookup an
+ * entry /a in the lower layers above layer N and find the indexed dir /a from
+ * layer 1. If that improvement is made, then the check for "layer N connected"
+ * will need to verify there are no redirects in lower layers above N. In the
+ * example above, /a will be "layer 2 connectable". However, if layer 2 dir /a
+ * is a target of a layer 1 redirect, then /a will NOT be "layer 2 connectable":
+ *
+ * layer 1: /A (redirect = /a)
+ * layer 2: /a/b/c
+ */
+/* Return the lowest layer for encoding a connectable file handle */
+static int ovl_connectable_layer(struct dentry *dentry)
+{
+        struct ovl_entry *oe = OVL_E(dentry);
+        /* We can get overlay root from root of any layer */
+        if (dentry == dentry->d_sb->s_root)
+                return oe->numlower;
+        /*
+         * If it's an unindexed merge dir, then it's not connectable with any
+         * lower layer
+         */
+        if (ovl_dentry_upper(dentry) &&
+            !ovl_test_flag(OVL_INDEX, d_inode(dentry)))
+                return 0;
+        /* We can get upper/overlay path from indexed/lower dentry */
+        return oe->lowerstack[0].layer->idx;
+}
+/*
+ * @dentry is "connected" if all ancestors up to root or a "connected" ancestor
+ * have the same uppermost lower layer as the origin's layer. We may need to
+ * copy up a "connectable" ancestor to make it "connected". A "connected" dentry
+ * cannot become non "connected", so cache positive result in dentry flags.
+ *
+ * Return the connected origin layer or < 0 on error.
+ */
+static int ovl_connect_layer(struct dentry *dentry)
+{
+        struct dentry *next, *parent = NULL;
+        int origin_layer;
+        int err = 0;
+        if (WARN_ON(dentry == dentry->d_sb->s_root) ||
+            WARN_ON(!ovl_dentry_lower(dentry)))
+                return -EIO;
+        origin_layer = OVL_E(dentry)->lowerstack[0].layer->idx;
+        if (ovl_dentry_test_flag(OVL_E_CONNECTED, dentry))
+                return origin_layer;
+        /* Find the topmost origin layer connectable ancestor of @dentry */
+        next = dget(dentry);
+        for (;;) {
+                parent = dget_parent(next);
+                if (WARN_ON(parent == next)) {
+                        err = -EIO;
+                        break;
+                }
+                /*
+                 * If @parent is not origin layer connectable, then copy up
+                 * @next which is origin layer connectable and we are done.
+                 */
+                if (ovl_connectable_layer(parent) < origin_layer) {
+                        err = ovl_encode_maybe_copy_up(next);
+                        break;
+                }
+                /* If @parent is connected or indexed we are done */
+                if (ovl_dentry_test_flag(OVL_E_CONNECTED, parent) ||
+                    ovl_test_flag(OVL_INDEX, d_inode(parent)))
+                        break;
+                dput(next);
+                next = parent;
+        }
+        dput(parent);
+        dput(next);
+        if (!err)
+                ovl_dentry_set_flag(OVL_E_CONNECTED, dentry);
+        return err ?: origin_layer;
+}
 /*
 * We only need to encode origin if there is a chance that the same object was
 * encoded pre copy up and then we need to stay consistent with the same
@@ -41,73 +177,59 @@
 * L = lower file handle
 *
 * (*) Connecting an overlay dir from real lower dentry is not always
- * possible when there are redirects in lower layers. To mitigate this case,
+ * possible when there are redirects in lower layers and non-indexed merge dirs.
- * we copy up the lower dir first and then encode an upper dir file handle.
+ * To mitigate those case, we may copy up the lower dir ancestor before encode
+ * a lower dir file handle.
+ *
+ * Return 0 for upper file handle, > 0 for lower file handle or < 0 on error.
 */
-static bool ovl_should_encode_origin(struct dentry *dentry)
+static int ovl_check_encode_origin(struct dentry *dentry)
 {
        struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
+        /* Upper file handle for pure upper */
        if (!ovl_dentry_lower(dentry))
-                return false;
+                return 0;
        /*
-         * Decoding a merge dir, whose origin's parent is under a redirected
+         * Upper file handle for non-indexed upper.
-         * lower dir is not always possible. As a simple aproximation, we do
-         * not encode lower dir file handles when overlay has multiple lower
-         * layers and origin is below the topmost lower layer.
         *
-         * TODO: copy up only the parent that is under redirected lower.
+         * Root is never indexed, so if there's an upper layer, encode upper for
+         * root.
         */
-        if (d_is_dir(dentry) && ofs->upper_mnt &&
-            OVL_E(dentry)->lowerstack[0].layer->idx > 1)
-                return false;
-        /* Decoding a non-indexed upper from origin is not implemented */
        if (ovl_dentry_upper(dentry) &&
            !ovl_test_flag(OVL_INDEX, d_inode(dentry)))
-                return false;
-        return true;
-}
-static int ovl_encode_maybe_copy_up(struct dentry *dentry)
-{
-        int err;
-        if (ovl_dentry_upper(dentry))
                return 0;
-        err = ovl_want_write(dentry);
+        /*
-        if (err)
+         * Decoding a merge dir, whose origin's ancestor is under a redirected
-                return err;
+         * lower dir or under a non-indexed upper is not always possible.
+         * ovl_connect_layer() will try to make origin's layer "connected" by
-        err = ovl_copy_up(dentry);
+         * copying up a "connectable" ancestor.
+         */
+        if (d_is_dir(dentry) && ofs->upper_mnt)
+                return ovl_connect_layer(dentry);
-        ovl_drop_write(dentry);
+        /* Lower file handle for indexed and non-upper dir/non-dir */
-        return err;
+        return 1;
 }
 static int ovl_d_to_fh(struct dentry *dentry, char *buf, int buflen)
 {
-        struct dentry *origin = ovl_dentry_lower(dentry);
        struct ovl_fh *fh = NULL;
-        int err;
+        int err, enc_lower;
        /*
-         * If we should not encode a lower dir file handle, copy up and encode
+         * Check if we should encode a lower or upper file handle and maybe
-         * an upper dir file handle.
+         * copy up an ancestor to make lower file handle connectable.
         */
-        if (!ovl_should_encode_origin(dentry)) {
+        err = enc_lower = ovl_check_encode_origin(dentry);
-                err = ovl_encode_maybe_copy_up(dentry);
+        if (enc_lower < 0)
-                if (err)
+                goto fail;
-                        goto fail;
-                origin = NULL;
-        }
-        /* Encode an upper or origin file handle */
+        /* Encode an upper or lower file handle */
-        fh = ovl_encode_fh(origin ?: ovl_dentry_upper(dentry), !origin);
+        fh = ovl_encode_fh(enc_lower ? ovl_dentry_lower(dentry) :
+                                       ovl_dentry_upper(dentry), !enc_lower);
        err = PTR_ERR(fh);
        if (IS_ERR(fh))
                goto fail;
@@ -355,8 +477,8 @@ static struct dentry *ovl_lookup_real_inode(struct super_block *sb,
                dput(upper);
        }
-        if (!this)
+        if (IS_ERR_OR_NULL(this))
-                return NULL;
+                return this;
        if (WARN_ON(ovl_dentry_real_at(this, layer->idx) != real)) {
                dput(this);
@@ -498,7 +620,7 @@ static struct dentry *ovl_lookup_real(struct super_block *sb,
                        if (err == -ECHILD) {
                                this = ovl_lookup_real_ancestor(sb, real,
                                                                layer);
-                                err = IS_ERR(this) ? PTR_ERR(this) : 0;
+                                err = PTR_ERR_OR_ZERO(this);
                        }
                        if (!err) {
                                dput(connected);
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index fcd97b783fa1..3b1bd469accd 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -669,38 +669,59 @@ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
        return inode;
 }
+/*
+ * Does overlay inode need to be hashed by lower inode?
+ */
+static bool ovl_hash_bylower(struct super_block *sb, struct dentry *upper,
+                             struct dentry *lower, struct dentry *index)
+{
+        struct ovl_fs *ofs = sb->s_fs_info;
+        /* No, if pure upper */
+        if (!lower)
+                return false;
+        /* Yes, if already indexed */
+        if (index)
+                return true;
+        /* Yes, if won't be copied up */
+        if (!ofs->upper_mnt)
+                return true;
+        /* No, if lower hardlink is or will be broken on copy up */
+        if ((upper || !ovl_indexdir(sb)) &&
+            !d_is_dir(lower) && d_inode(lower)->i_nlink > 1)
+                return false;
+        /* No, if non-indexed upper with NFS export */
+        if (sb->s_export_op && upper)
+                return false;
+        /* Otherwise, hash by lower inode for fsnotify */
+        return true;
+}
 struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry,
                            struct dentry *lowerdentry, struct dentry *index,
                            unsigned int numlower)
 {
-        struct ovl_fs *ofs = sb->s_fs_info;
        struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL;
        struct inode *inode;
-        /* Already indexed or could be indexed on copy up? */
+        bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, index);
-        bool indexed = (index || (ovl_indexdir(sb) && !upperdentry));
-        struct dentry *origin = indexed ? lowerdentry : NULL;
        bool is_dir;
-        if (WARN_ON(upperdentry && indexed && !lowerdentry))
-                return ERR_PTR(-EIO);
        if (!realinode)
                realinode = d_inode(lowerdentry);
        /*
-         * Copy up origin (lower) may exist for non-indexed non-dir upper, but
+         * Copy up origin (lower) may exist for non-indexed upper, but we must
-         * we must not use lower as hash key in that case.
+         * not use lower as hash key if this is a broken hardlink.
-         * Hash non-dir that is or could be indexed by origin inode.
-         * Hash dir that is or could be merged by origin inode.
-         * Hash pure upper and non-indexed non-dir by upper inode.
-         * Hash non-indexed dir by upper inode for NFS export.
         */
        is_dir = S_ISDIR(realinode->i_mode);
-        if (is_dir && (indexed || !sb->s_export_op || !ofs->upper_mnt))
+        if (upperdentry || bylower) {
-                origin = lowerdentry;
+                struct inode *key = d_inode(bylower ? lowerdentry :
+                                                      upperdentry);
-        if (upperdentry || origin) {
-                struct inode *key = d_inode(origin ?: upperdentry);
                unsigned int nlink = is_dir ? 1 : realinode->i_nlink;
                inode = iget5_locked(sb, (unsigned long) key,
@@ -728,6 +749,7 @@ struct inode *ovl_get_inode(struct super_block *sb, struct dentry *upperdentry,
                        nlink = ovl_get_nlink(lowerdentry, upperdentry, nlink);
                set_nlink(inode, nlink);
        } else {
+                /* Lower hardlink that will be broken on copy up */
                inode = new_inode(sb);
                if (!inode)
                        goto out_nomem;
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index de3e6da1d5a5..70fcfcc684cc 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -913,9 +913,6 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                stack[ctr].layer = lower.layer;
                ctr++;
-                if (d.stop)
-                        break;
                /*
                 * Following redirects can have security consequences: it's like
                 * a symlink into the lower layer without the permission checks.
@@ -933,6 +930,9 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                        goto out_put;
                }
+                if (d.stop)
+                        break;
                if (d.redirect && d.redirect[0] == '/' && poe != roe) {
                        poe = roe;
                        /* Find the current layer on the root dentry */
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 0df25a9c94bd..225ff1171147 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -40,6 +40,7 @@ enum ovl_inode_flag {
 enum ovl_entry_flag {
        OVL_E_UPPER_ALIAS,
        OVL_E_OPAQUE,
+        OVL_E_CONNECTED,
 };
 /*
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 9ee37c76091d..7c24619ae7fc 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1359,6 +1359,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        /* Root is always merge -> can have whiteouts */
        ovl_set_flag(OVL_WHITEOUTS, d_inode(root_dentry));
+        ovl_dentry_set_flag(OVL_E_CONNECTED, root_dentry);
        ovl_inode_init(d_inode(root_dentry), upperpath.dentry,
                       ovl_dentry_lower(root_dentry));
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index 8664db25a9a6..215c225b2ca1 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -106,6 +106,7 @@ int sysfs_create_link_nowarn(struct kobject *kobj, struct kobject *target,
 {
        return sysfs_do_create_link(kobj, target, name, 0);
 }
+EXPORT_SYMBOL_GPL(sysfs_create_link_nowarn);
 /**
 *      sysfs_delete_link - remove symlink in object's directory.
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 66e1edbfb2b2..046469fcc1b8 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -955,15 +955,29 @@ static inline bool imap_needs_alloc(struct inode *inode,
                (IS_DAX(inode) && imap->br_state == XFS_EXT_UNWRITTEN);
 }
+static inline bool needs_cow_for_zeroing(struct xfs_bmbt_irec *imap, int nimaps)
+{
+        return nimaps &&
+                imap->br_startblock != HOLESTARTBLOCK &&
+                imap->br_state != XFS_EXT_UNWRITTEN;
+}
 static inline bool need_excl_ilock(struct xfs_inode *ip, unsigned flags)
 {
        /*
-         * COW writes will allocate delalloc space, so we need to make sure
+         * COW writes may allocate delalloc space or convert unwritten COW
-         * to take the lock exclusively here.
+         * extents, so we need to make sure to take the lock exclusively here.
         */
        if (xfs_is_reflink_inode(ip) && (flags & (IOMAP_WRITE | IOMAP_ZERO)))
                return true;
-        if ((flags & IOMAP_DIRECT) && (flags & IOMAP_WRITE))
+        /*
+         * Extents not yet cached requires exclusive access, don't block.
+         * This is an opencoded xfs_ilock_data_map_shared() to cater for the
+         * non-blocking behaviour.
+         */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            !(ip->i_df.if_flags & XFS_IFEXTENTS))
                return true;
        return false;
 }
@@ -993,16 +1007,18 @@ xfs_file_iomap_begin(
                return xfs_file_iomap_begin_delay(inode, offset, length, iomap);
        }
-        if (need_excl_ilock(ip, flags)) {
+        if (need_excl_ilock(ip, flags))
                lockmode = XFS_ILOCK_EXCL;
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
+        else
-        } else {
+                lockmode = XFS_ILOCK_SHARED;
-                lockmode = xfs_ilock_data_map_shared(ip);
-        }
-        if ((flags & IOMAP_NOWAIT) && !(ip->i_df.if_flags & XFS_IFEXTENTS)) {
+        if (flags & IOMAP_NOWAIT) {
-                error = -EAGAIN;
+                if (!(ip->i_df.if_flags & XFS_IFEXTENTS))
-                goto out_unlock;
+                        return -EAGAIN;
+                if (!xfs_ilock_nowait(ip, lockmode))
+                        return -EAGAIN;
+        } else {
+                xfs_ilock(ip, lockmode);
        }
        ASSERT(offset <= mp->m_super->s_maxbytes);
@@ -1024,7 +1040,9 @@ xfs_file_iomap_begin(
                        goto out_unlock;
        }
-        if ((flags & (IOMAP_WRITE | IOMAP_ZERO)) && xfs_is_reflink_inode(ip)) {
+        if (xfs_is_reflink_inode(ip) &&
+            ((flags & IOMAP_WRITE) ||
+             ((flags & IOMAP_ZERO) && needs_cow_for_zeroing(&imap, nimaps)))) {
                if (flags & IOMAP_DIRECT) {
                        /*
                         * A reflinked inode will result in CoW alloc.
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 2cfa3075d148..bfbb44a5ad38 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -983,6 +983,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
 int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot);
 int pud_clear_huge(pud_t *pud);
 int pmd_clear_huge(pmd_t *pmd);
+int pud_free_pmd_page(pud_t *pud);
+int pmd_free_pte_page(pmd_t *pmd);
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
 static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
 {
@@ -1008,6 +1010,14 @@ static inline int pmd_clear_huge(pmd_t *pmd)
 {
        return 0;
 }
+static inline int pud_free_pmd_page(pud_t *pud)
+{
+        return 0;
+}
+static inline int pmd_free_pte_page(pmd_t *pmd)
+{
+        return 0;
+}
 #endif  /* CONFIG_HAVE_ARCH_HUGE_VMAP */
 #ifndef __HAVE_ARCH_FLUSH_PMD_TLB_RANGE
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index cdbd142ca7f2..02924ae2527e 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -360,6 +360,7 @@ void kvm_vgic_put(struct kvm_vcpu *vcpu);
 bool kvm_vcpu_has_pending_irqs(struct kvm_vcpu *vcpu);
 void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu);
 void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu);
+void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid);
 void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg);
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 9f242b876fde..f8e76d01a5ad 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -755,13 +755,13 @@ struct sock_cgroup_data {
 * updaters and return part of the previous pointer as the prioidx or
 * classid.  Such races are short-lived and the result isn't critical.
 */
-static inline u16 sock_cgroup_prioidx(struct sock_cgroup_data *skcd)
+static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)
 {
        /* fallback to 1 which is always the ID of the root cgroup */
        return (skcd->is_data & 1) ? skcd->prioidx : 1;
 }
-static inline u32 sock_cgroup_classid(struct sock_cgroup_data *skcd)
+static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)
 {
        /* fallback to 0 which is the unconfigured default classid */
        return (skcd->is_data & 1) ? skcd->classid : 0;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 8a9643857c4a..16c3027074a2 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -17,6 +17,7 @@
 #include <linux/if.h>
 #include <linux/fs.h>
 #include <linux/aio_abi.h>      /* for aio_context_t */
+#include <linux/uaccess.h>
 #include <linux/unistd.h>
 #include <asm/compat.h>
@@ -229,13 +230,13 @@ typedef struct compat_siginfo {
                                short int _addr_lsb;    /* Valid LSB of the reported address. */
                                /* used when si_code=SEGV_BNDERR */
                                struct {
-                                        short _dummy_bnd;
+                                        compat_uptr_t _dummy_bnd;
                                        compat_uptr_t _lower;
                                        compat_uptr_t _upper;
                                } _addr_bnd;
                                /* used when si_code=SEGV_PKUERR */
                                struct {
-                                        short _dummy_pkey;
+                                        compat_uptr_t _dummy_pkey;
                                        u32 _pkey;
                                } _addr_pkey;
                        };
@@ -550,8 +551,29 @@ asmlinkage long compat_sys_settimeofday(struct compat_timeval __user *tv,
 asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp);
 extern int get_compat_sigset(sigset_t *set, const compat_sigset_t __user *compat);
-extern int put_compat_sigset(compat_sigset_t __user *compat,
-                             const sigset_t *set, unsigned int size);
+/*
+ * Defined inline such that size can be compile time constant, which avoids
+ * CONFIG_HARDENED_USERCOPY complaining about copies from task_struct
+ */
+static inline int
+put_compat_sigset(compat_sigset_t __user *compat, const sigset_t *set,
+                  unsigned int size)
+{
+        /* size <= sizeof(compat_sigset_t) <= sizeof(sigset_t) */
+#ifdef __BIG_ENDIAN
+        compat_sigset_t v;
+        switch (_NSIG_WORDS) {
+        case 4: v.sig[7] = (set->sig[3] >> 32); v.sig[6] = set->sig[3];
+        case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2];
+        case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1];
+        case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0];
+        }
+        return copy_to_user(compat, &v, size) ? -EFAULT : 0;
+#else
+        return copy_to_user(compat, set, size) ? -EFAULT : 0;
+#endif
+}
 asmlinkage long compat_sys_migrate_pages(compat_pid_t pid,
                compat_ulong_t maxnode, const compat_ulong_t __user *old_nodes,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 79c413985305..c6baf767619e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1317,6 +1317,7 @@ extern int send_sigurg(struct fown_struct *fown);
 #define SB_I_CGROUPWB   0x00000001      /* cgroup-aware writeback enabled */
 #define SB_I_NOEXEC     0x00000002      /* Ignore executables on this fs */
 #define SB_I_NODEV      0x00000004      /* Ignore devices on this fs */
+#define SB_I_MULTIROOT  0x00000008      /* Multiple roots to the dentry tree */
 /* sb->s_iflags to limit user namespace mounts */
 #define SB_I_USERNS_VISIBLE             0x00000010 /* fstype already mounted */
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index c5b0a75a7812..fd00170b494f 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -25,6 +25,7 @@ struct ptr_ring *tun_get_tx_ring(struct file *file);
 bool tun_is_xdp_buff(void *ptr);
 void *tun_xdp_to_ptr(void *ptr);
 void *tun_ptr_to_xdp(void *ptr);
+void tun_ptr_free(void *ptr);
 #else
 #include <linux/err.h>
 #include <linux/errno.h>
@@ -50,5 +51,8 @@ static inline void *tun_ptr_to_xdp(void *ptr)
 {
        return NULL;
 }
+static inline void tun_ptr_free(void *ptr)
+{
+}
 #endif /* CONFIG_TUN */
 #endif /* __IF_TUN_H */
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 5e6a2d4dc366..c4a1cff9c768 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -300,30 +300,34 @@ static inline bool vlan_hw_offload_capable(netdev_features_t features,
 }
 /**
- * __vlan_insert_tag - regular VLAN tag inserting
+ * __vlan_insert_inner_tag - inner VLAN tag inserting
 * @skb: skbuff to tag
 * @vlan_proto: VLAN encapsulation protocol
 * @vlan_tci: VLAN TCI to insert
+ * @mac_len: MAC header length including outer vlan headers
 *
- * Inserts the VLAN tag into @skb as part of the payload
+ * Inserts the VLAN tag into @skb as part of the payload at offset mac_len
 * Returns error if skb_cow_head failes.
 *
 * Does not change skb->protocol so this function can be used during receive.
 */
-static inline int __vlan_insert_tag(struct sk_buff *skb,
+static inline int __vlan_insert_inner_tag(struct sk_buff *skb,
-                                    __be16 vlan_proto, u16 vlan_tci)
+                                          __be16 vlan_proto, u16 vlan_tci,
+                                          unsigned int mac_len)
 {
        struct vlan_ethhdr *veth;
        if (skb_cow_head(skb, VLAN_HLEN) < 0)
                return -ENOMEM;
-        veth = skb_push(skb, VLAN_HLEN);
+        skb_push(skb, VLAN_HLEN);
-        /* Move the mac addresses to the beginning of the new header. */
+        /* Move the mac header sans proto to the beginning of the new header. */
-        memmove(skb->data, skb->data + VLAN_HLEN, 2 * ETH_ALEN);
+        memmove(skb->data, skb->data + VLAN_HLEN, mac_len - ETH_TLEN);
        skb->mac_header -= VLAN_HLEN;
+        veth = (struct vlan_ethhdr *)(skb->data + mac_len - ETH_HLEN);
        /* first, the ethernet type */
        veth->h_vlan_proto = vlan_proto;
@@ -334,12 +338,30 @@ static inline int __vlan_insert_tag(struct sk_buff *skb,
 }
 /**
- * vlan_insert_tag - regular VLAN tag inserting
+ * __vlan_insert_tag - regular VLAN tag inserting
 * @skb: skbuff to tag
 * @vlan_proto: VLAN encapsulation protocol
 * @vlan_tci: VLAN TCI to insert
 *
 * Inserts the VLAN tag into @skb as part of the payload
+ * Returns error if skb_cow_head failes.
+ *
+ * Does not change skb->protocol so this function can be used during receive.
+ */
+static inline int __vlan_insert_tag(struct sk_buff *skb,
+                                    __be16 vlan_proto, u16 vlan_tci)
+{
+        return __vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, ETH_HLEN);
+}
+/**
+ * vlan_insert_inner_tag - inner VLAN tag inserting
+ * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
+ * @vlan_tci: VLAN TCI to insert
+ * @mac_len: MAC header length including outer vlan headers
+ *
+ * Inserts the VLAN tag into @skb as part of the payload at offset mac_len
 * Returns a VLAN tagged skb. If a new skb is created, @skb is freed.
 *
 * Following the skb_unshare() example, in case of error, the calling function
@@ -347,12 +369,14 @@ static inline int __vlan_insert_tag(struct sk_buff *skb,
 *
 * Does not change skb->protocol so this function can be used during receive.
 */
-static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+static inline struct sk_buff *vlan_insert_inner_tag(struct sk_buff *skb,
-                                              __be16 vlan_proto, u16 vlan_tci)
+                                                    __be16 vlan_proto,
+                                                    u16 vlan_tci,
+                                                    unsigned int mac_len)
 {
        int err;
-        err = __vlan_insert_tag(skb, vlan_proto, vlan_tci);
+        err = __vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, mac_len);
        if (err) {
                dev_kfree_skb_any(skb);
                return NULL;
@@ -361,6 +385,26 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
 }
 /**
+ * vlan_insert_tag - regular VLAN tag inserting
+ * @skb: skbuff to tag
+ * @vlan_proto: VLAN encapsulation protocol
+ * @vlan_tci: VLAN TCI to insert
+ *
+ * Inserts the VLAN tag into @skb as part of the payload
+ * Returns a VLAN tagged skb. If a new skb is created, @skb is freed.
+ *
+ * Following the skb_unshare() example, in case of error, the calling function
+ * doesn't have to worry about freeing the original skb.
+ *
+ * Does not change skb->protocol so this function can be used during receive.
+ */
+static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb,
+                                              __be16 vlan_proto, u16 vlan_tci)
+{
+        return vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, ETH_HLEN);
+}
+/**
 * vlan_insert_tag_set_proto - regular VLAN tag inserting
 * @skb: skbuff to tag
 * @vlan_proto: VLAN encapsulation protocol
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index c00c4c33e432..b26eccc78fb1 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -503,6 +503,7 @@
 #define ICH_HCR_EN                      (1 << 0)
 #define ICH_HCR_UIE                     (1 << 1)
+#define ICH_HCR_NPIE                    (1 << 3)
 #define ICH_HCR_TC                      (1 << 10)
 #define ICH_HCR_TALL0                   (1 << 11)
 #define ICH_HCR_TALL1                   (1 << 12)
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index d3453ee072fc..68d8b1f73682 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -84,6 +84,7 @@
 #define GICH_HCR_EN                     (1 << 0)
 #define GICH_HCR_UIE                    (1 << 1)
+#define GICH_HCR_NPIE                   (1 << 3)
 #define GICH_LR_VIRTUALID               (0x3ff << 0)
 #define GICH_LR_PHYSID_CPUID_SHIFT      (10)
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 8be5077efb5f..f92ea7783652 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -187,7 +187,6 @@ int memblock_search_pfn_nid(unsigned long pfn, unsigned long *start_pfn,
                            unsigned long  *end_pfn);
 void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
                          unsigned long *out_end_pfn, int *out_nid);
-unsigned long memblock_next_valid_pfn(unsigned long pfn, unsigned long max_pfn);
 /**
 * for_each_mem_pfn_range - early memory pfn range iterator
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 4814cad7456e..cded85ab6fe4 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -462,8 +462,8 @@ struct mlx5_core_srq {
        struct mlx5_core_rsc_common     common; /* must be first */
        u32             srqn;
        int             max;
-        int             max_gs;
+        size_t          max_gs;
-        int             max_avail_gather;
+        size_t          max_avail_gather;
        int             wqe_shift;
        void (*event)   (struct mlx5_core_srq *, enum mlx5_event);
diff --git a/include/linux/net.h b/include/linux/net.h
index 000d1aada74f..2248a052061d 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -222,6 +222,7 @@ enum {
 int sock_wake_async(struct socket_wq *sk_wq, int how, int band);
 int sock_register(const struct net_proto_family *fam);
 void sock_unregister(int family);
+bool sock_is_registered(int family);
 int __sock_create(struct net *net, int family, int type, int proto,
                  struct socket **res, int kern);
 int sock_create(int family, int type, int proto, struct socket **res);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 1313b35c3ab7..14529511c4b8 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -285,6 +285,8 @@ unsigned int *xt_alloc_entry_offsets(unsigned int size);
 bool xt_find_jump_offset(const unsigned int *offsets,
                         unsigned int target, unsigned int size);
+int xt_check_proc_name(const char *name, unsigned int size);
 int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto,
                   bool inv_proto);
 int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
diff --git a/include/linux/of_pci.h b/include/linux/of_pci.h
index 88865e0ebf4d..091033a6b836 100644
--- a/include/linux/of_pci.h
+++ b/include/linux/of_pci.h
@@ -13,7 +13,6 @@ struct device_node;
 struct device_node *of_pci_find_child_device(struct device_node *parent,
                                             unsigned int devfn);
 int of_pci_get_devfn(struct device_node *np);
-int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin);
 int of_pci_parse_bus_range(struct device_node *node, struct resource *res);
 int of_get_pci_domain_nr(struct device_node *node);
 int of_pci_get_max_link_speed(struct device_node *node);
@@ -34,12 +33,6 @@ static inline int of_pci_get_devfn(struct device_node *np)
 }
 static inline int
-of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
-{
-        return 0;
-}
-static inline int
 of_pci_parse_bus_range(struct device_node *node, struct resource *res)
 {
        return -EINVAL;
@@ -67,6 +60,16 @@ of_pci_get_max_link_speed(struct device_node *node)
 static inline void of_pci_check_probe_only(void) { }
 #endif
+#if IS_ENABLED(CONFIG_OF_IRQ)
+int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin);
+#else
+static inline int
+of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        return 0;
+}
+#endif
 #if defined(CONFIG_OF_ADDRESS)
 int of_pci_get_host_bridge_resources(struct device_node *dev,
                        unsigned char busno, unsigned char bus_max,
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index 864d167a1073..009cdf3d65b6 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -30,10 +30,14 @@
 * calls io_destroy() or the process exits.
 *
 * In the aio code, kill_ioctx() is called when we wish to destroy a kioctx; it
- * calls percpu_ref_kill(), then hlist_del_rcu() and synchronize_rcu() to remove
+ * removes the kioctx from the proccess's table of kioctxs and kills percpu_ref.
- * the kioctx from the proccess's list of kioctxs - after that, there can't be
+ * After that, there can't be any new users of the kioctx (from lookup_ioctx())
- * any new users of the kioctx (from lookup_ioctx()) and it's then safe to drop
+ * and it's then safe to drop the initial ref with percpu_ref_put().
- * the initial ref with percpu_ref_put().
+ *
+ * Note that the free path, free_ioctx(), needs to go through explicit call_rcu()
+ * to synchronize with RCU protected lookup_ioctx().  percpu_ref operations don't
+ * imply RCU grace periods of any kind and if a user wants to combine percpu_ref
+ * with RCU protection, it must be done explicitly.
 *
 * Code that does a two stage shutdown like this often needs some kind of
 * explicit synchronization to ensure the initial refcount can only be dropped
@@ -113,8 +117,10 @@ void percpu_ref_reinit(struct percpu_ref *ref);
 * Must be used to drop the initial ref on a percpu refcount; must be called
 * precisely once before shutdown.
 *
- * Puts @ref in non percpu mode, then does a call_rcu() before gathering up the
+ * Switches @ref into atomic mode before gathering up the percpu counters
- * percpu counters and dropping the initial ref.
+ * and dropping the initial ref.
+ *
+ * There are no implied RCU grace periods between kill and release.
 */
 static inline void percpu_ref_kill(struct percpu_ref *ref)
 {
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 5a9b1753fdc5..f0b5870a6d40 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -984,6 +984,10 @@ static inline int genphy_no_soft_reset(struct phy_device *phydev)
 {
        return 0;
 }
+int genphy_read_mmd_unsupported(struct phy_device *phdev, int devad,
+                                u16 regnum);
+int genphy_write_mmd_unsupported(struct phy_device *phdev, int devnum,
+                                 u16 regnum, u16 val);
 /* Clause 45 PHY */
 int genphy_c45_restart_aneg(struct phy_device *phydev);
@@ -1020,7 +1024,6 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner);
 int phy_drivers_register(struct phy_driver *new_driver, int n,
                         struct module *owner);
 void phy_state_machine(struct work_struct *work);
-void phy_change(struct phy_device *phydev);
 void phy_change_work(struct work_struct *work);
 void phy_mac_interrupt(struct phy_device *phydev);
 void phy_start_machine(struct phy_device *phydev);
diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index c9df2527e0cd..668a21f04b09 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -766,8 +766,10 @@ slow_path:
                if (!key ||
                    (params.obj_cmpfn ?
                     params.obj_cmpfn(&arg, rht_obj(ht, head)) :
-                     rhashtable_compare(&arg, rht_obj(ht, head))))
+                     rhashtable_compare(&arg, rht_obj(ht, head)))) {
+                        pprev = &head->next;
                        continue;
+                }
                data = rht_obj(ht, head);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d8340e6e8814..47082f54ec1f 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -4040,6 +4040,12 @@ static inline bool skb_is_gso_v6(const struct sk_buff *skb)
        return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
 }
+/* Note: Should be called only if skb_is_gso(skb) is true */
+static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
+{
+        return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
+}
 static inline void skb_gso_reset(struct sk_buff *skb)
 {
        skb_shinfo(skb)->gso_size = 0;
@@ -4047,6 +4053,22 @@ static inline void skb_gso_reset(struct sk_buff *skb)
        skb_shinfo(skb)->gso_type = 0;
 }
+static inline void skb_increase_gso_size(struct skb_shared_info *shinfo,
+                                         u16 increment)
+{
+        if (WARN_ON_ONCE(shinfo->gso_size == GSO_BY_FRAGS))
+                return;
+        shinfo->gso_size += increment;
+}
+static inline void skb_decrease_gso_size(struct skb_shared_info *shinfo,
+                                         u16 decrement)
+{
+        if (WARN_ON_ONCE(shinfo->gso_size == GSO_BY_FRAGS))
+                return;
+        shinfo->gso_size -= decrement;
+}
 void __skb_warn_lro_forwarding(const struct sk_buff *skb);
 static inline bool skb_warn_if_lro(const struct sk_buff *skb)
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 0a6c71e0ad01..47f8af22f216 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -364,6 +364,7 @@ struct tty_file_private {
 #define TTY_PTY_LOCK            16      /* pty private */
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
 #define TTY_HUPPED              18      /* Post driver->hangup() */
+#define TTY_HUPPING             19      /* Hangup in progress */
 #define TTY_LDISC_HALTED        22      /* Line discipline is halted */
 /* Values for tty->flow_change */
diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
index 5bdbd9f49395..07ee0f84a46c 100644
--- a/include/linux/u64_stats_sync.h
+++ b/include/linux/u64_stats_sync.h
@@ -90,6 +90,28 @@ static inline void u64_stats_update_end(struct u64_stats_sync *syncp)
 #endif
 }
+static inline unsigned long
+u64_stats_update_begin_irqsave(struct u64_stats_sync *syncp)
+{
+        unsigned long flags = 0;
+#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
+        local_irq_save(flags);
+        write_seqcount_begin(&syncp->seq);
+#endif
+        return flags;
+}
+static inline void
+u64_stats_update_end_irqrestore(struct u64_stats_sync *syncp,
+                                unsigned long flags)
+{
+#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
+        write_seqcount_end(&syncp->seq);
+        local_irq_restore(flags);
+#endif
+}
 static inline void u64_stats_update_begin_raw(struct u64_stats_sync *syncp)
 {
 #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index f1fcec2fd5f8..b7a99ce56bc9 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -63,4 +63,7 @@
 */
 #define USB_QUIRK_DISCONNECT_SUSPEND            BIT(12)
+/* Device needs a pause after every control message. */
+#define USB_QUIRK_DELAY_CTRL_MSG                BIT(13)
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index bc0cda180c8b..0c3301421c57 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -456,7 +456,6 @@ extern int schedule_on_each_cpu(work_func_t func);
 int execute_in_process_context(work_func_t fn, struct execute_work *);
 extern bool flush_work(struct work_struct *work);
-extern bool cancel_work(struct work_struct *work);
 extern bool cancel_work_sync(struct work_struct *work);
 extern bool flush_delayed_work(struct delayed_work *dwork);
diff --git a/include/net/ip.h b/include/net/ip.h
index d53b5a9eae34..36f8f7811093 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -337,6 +337,13 @@ int ip_decrease_ttl(struct iphdr *iph)
        return --iph->ttl;
 }
+static inline int ip_mtu_locked(const struct dst_entry *dst)
+{
+        const struct rtable *rt = (const struct rtable *)dst;
+        return rt->rt_mtu_locked || dst_metric_locked(dst, RTAX_MTU);
+}
 static inline
 int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst)
 {
@@ -344,7 +351,7 @@ int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst)
        return  pmtudisc == IP_PMTUDISC_DO ||
                (pmtudisc == IP_PMTUDISC_WANT &&
-                 !(dst_metric_locked(dst, RTAX_MTU)));
+                 !ip_mtu_locked(dst));
 }
 static inline bool ip_sk_accept_pmtu(const struct sock *sk)
@@ -370,7 +377,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
        struct net *net = dev_net(dst->dev);
        if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
-            dst_metric_locked(dst, RTAX_MTU) ||
+            ip_mtu_locked(dst) ||
            !forwarding)
                return dst_mtu(dst);
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index ce2abc0ff102..0084013d6bed 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -183,6 +183,9 @@ void rt6_disable_ip(struct net_device *dev, unsigned long event);
 void rt6_sync_down_dev(struct net_device *dev, unsigned long event);
 void rt6_multipath_rebalance(struct rt6_info *rt);
+void rt6_uncached_list_add(struct rt6_info *rt);
+void rt6_uncached_list_del(struct rt6_info *rt);
 static inline const struct rt6_info *skb_rt6_info(const struct sk_buff *skb)
 {
        const struct dst_entry *dst = skb_dst(skb);
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 7c7522e8585b..81d0f2107ff1 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -59,6 +59,7 @@ struct fib_nh_exception {
        int                             fnhe_genid;
        __be32                          fnhe_daddr;
        u32                             fnhe_pmtu;
+        bool                            fnhe_mtu_locked;
        __be32                          fnhe_gw;
        unsigned long                   fnhe_expires;
        struct rtable __rcu             *fnhe_rth_input;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 2fd59ed3be00..2449982daf75 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -2077,6 +2077,9 @@ struct ieee80211_txq {
 *      virtual interface might not be given air time for the transmission of
 *      the frame, as it is not synced with the AP/P2P GO yet, and thus the
 *      deauthentication frame might not be transmitted.
+ >
+ * @IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP: The driver (or firmware) doesn't
+ *      support QoS NDP for AP probing - that's most likely a driver bug.
 *
 * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
 */
@@ -2122,6 +2125,7 @@ enum ieee80211_hw_flags {
        IEEE80211_HW_SUPPORTS_TX_FRAG,
        IEEE80211_HW_SUPPORTS_TDLS_BUFFER_STA,
        IEEE80211_HW_DEAUTH_NEED_MGD_TX_PREP,
+        IEEE80211_HW_DOESNT_SUPPORT_QOS_NDP,
        /* keep last, obviously */
        NUM_IEEE80211_HW_FLAGS
diff --git a/include/net/route.h b/include/net/route.h
index 158833ea7988..dbb032d5921b 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -63,7 +63,8 @@ struct rtable {
        __be32                  rt_gateway;
        /* Miscellaneous cached information */
-        u32                     rt_pmtu;
+        u32                     rt_mtu_locked:1,
+                                rt_pmtu:31;
        struct list_head        rt_uncached;
        struct uncached_list    *rt_uncached_list;
@@ -225,6 +226,9 @@ struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
 void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
+void rt_add_uncached_list(struct rtable *rt);
+void rt_del_uncached_list(struct rtable *rt);
 static inline void ip_rt_put(struct rtable *rt)
 {
        /* dst_release() accepts a NULL parameter.
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index d4907b584b38..493e311bbe93 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -824,6 +824,16 @@ static inline void __qdisc_drop(struct sk_buff *skb, struct sk_buff **to_free)
        *to_free = skb;
 }
+static inline void __qdisc_drop_all(struct sk_buff *skb,
+                                    struct sk_buff **to_free)
+{
+        if (skb->prev)
+                skb->prev->next = *to_free;
+        else
+                skb->next = *to_free;
+        *to_free = skb;
+}
 static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
                                                   struct qdisc_skb_head *qh,
                                                   struct sk_buff **to_free)
@@ -956,6 +966,15 @@ static inline int qdisc_drop(struct sk_buff *skb, struct Qdisc *sch,
        return NET_XMIT_DROP;
 }
+static inline int qdisc_drop_all(struct sk_buff *skb, struct Qdisc *sch,
+                                 struct sk_buff **to_free)
+{
+        __qdisc_drop_all(skb, to_free);
+        qdisc_qstats_drop(sch);
+        return NET_XMIT_DROP;
+}
 /* Length to Time (L2T) lookup in a qdisc_rate_table, to determine how
   long it will take to send a packet given its size.
 */
diff --git a/include/net/sock.h b/include/net/sock.h
index b7c75e024e37..709311132d4c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1138,6 +1138,7 @@ struct proto {
 int proto_register(struct proto *prot, int alloc_slab);
 void proto_unregister(struct proto *prot);
+int sock_load_diag_module(int family, int protocol);
 #ifdef SOCK_REFCNT_DEBUG
 static inline void sk_refcnt_debug_inc(struct sock *sk)
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 73b2387e3f74..ff3ed435701f 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1537,10 +1537,6 @@ struct ib_xrcd {
        struct mutex            tgt_qp_mutex;
        struct list_head        tgt_qp_list;
-        /*
-         * Implementation details of the RDMA core, don't use in drivers:
-         */
-        struct rdma_restrack_entry res;
 };
 struct ib_ah {
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index d8d4a902a88d..2280b2351739 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -68,6 +68,9 @@ struct scsi_cmnd {
        struct list_head list;  /* scsi_cmnd participates in queue lists */
        struct list_head eh_entry; /* entry for the host eh_cmd_q */
        struct delayed_work abort_work;
+        struct rcu_head rcu;
        int eh_eflags;          /* Used by error handlr */
        /*
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 1a1df0d21ee3..a8b7bf879ced 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -571,8 +571,6 @@ struct Scsi_Host {
                struct blk_mq_tag_set   tag_set;
        };
-        struct rcu_head rcu;
        atomic_t host_busy;                /* commands actually active on low-level */
        atomic_t host_blocked;
diff --git a/include/trace/events/mmc.h b/include/trace/events/mmc.h
index 200f731be557..7b706ff21335 100644
--- a/include/trace/events/mmc.h
+++ b/include/trace/events/mmc.h
@@ -86,8 +86,8 @@ TRACE_EVENT(mmc_request_start,
                  __entry->stop_flags, __entry->stop_retries,
                  __entry->sbc_opcode, __entry->sbc_arg,
                  __entry->sbc_flags, __entry->sbc_retries,
-                  __entry->blocks, __entry->blk_addr,
+                  __entry->blocks, __entry->blksz,
-                  __entry->blksz, __entry->data_flags, __entry->tag,
+                  __entry->blk_addr, __entry->data_flags, __entry->tag,
                  __entry->can_retune, __entry->doing_retune,
                  __entry->retune_now, __entry->need_retune,
                  __entry->hold_retune, __entry->retune_period)
diff --git a/include/uapi/asm-generic/siginfo.h b/include/uapi/asm-generic/siginfo.h
index 85dc965afd89..99c902e460c2 100644
--- a/include/uapi/asm-generic/siginfo.h
+++ b/include/uapi/asm-generic/siginfo.h
@@ -102,13 +102,13 @@ typedef struct siginfo {
                                short _addr_lsb; /* LSB of the reported address */
                                /* used when si_code=SEGV_BNDERR */
                                struct {
-                                        short _dummy_bnd;
+                                        void *_dummy_bnd;
                                        void __user *_lower;
                                        void __user *_upper;
                                } _addr_bnd;
                                /* used when si_code=SEGV_PKUERR */
                                struct {
-                                        short _dummy_pkey;
+                                        void *_dummy_pkey;
                                        __u32 _pkey;
                                } _addr_pkey;
                        };
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index 2e4a6c1accaa..3a45b4ad71a3 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -30,6 +30,7 @@
 */
 #define ETH_ALEN        6               /* Octets in one ethernet addr   */
+#define ETH_TLEN        2               /* Octets in ethernet type field */
 #define ETH_HLEN        14              /* Total octets in header.       */
 #define ETH_ZLEN        60              /* Min. octets in frame sans FCS */
 #define ETH_DATA_LEN    1500            /* Max. octets in payload        */
diff --git a/include/uapi/misc/ocxl.h b/include/uapi/misc/ocxl.h
index 4b0b0b756f3e..0af83d80fb3e 100644
--- a/include/uapi/misc/ocxl.h
+++ b/include/uapi/misc/ocxl.h
@@ -32,6 +32,22 @@ struct ocxl_ioctl_attach {
        __u64 reserved3;
 };
+struct ocxl_ioctl_metadata {
+        __u16 version; // struct version, always backwards compatible
+        // Version 0 fields
+        __u8  afu_version_major;
+        __u8  afu_version_minor;
+        __u32 pasid;            // PASID assigned to the current context
+        __u64 pp_mmio_size;     // Per PASID MMIO size
+        __u64 global_mmio_size;
+        // End version 0 fields
+        __u64 reserved[13]; // Total of 16*u64
+};
 struct ocxl_ioctl_irq_fd {
        __u64 irq_offset;
        __s32 eventfd;
@@ -45,5 +61,6 @@ struct ocxl_ioctl_irq_fd {
 #define OCXL_IOCTL_IRQ_ALLOC    _IOR(OCXL_MAGIC, 0x11, __u64)
 #define OCXL_IOCTL_IRQ_FREE     _IOW(OCXL_MAGIC, 0x12, __u64)
 #define OCXL_IOCTL_IRQ_SET_FD   _IOW(OCXL_MAGIC, 0x13, struct ocxl_ioctl_irq_fd)
+#define OCXL_IOCTL_GET_METADATA _IOR(OCXL_MAGIC, 0x14, struct ocxl_ioctl_metadata)
 #endif /* _UAPI_MISC_OCXL_H */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 3aeb4ea2a93a..dd172ee16716 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1849,7 +1849,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
        union bpf_attr attr = {};
        int err;
-        if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
+        if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
                return -EPERM;
        err = check_uarg_tail_zero(uattr, sizeof(attr), size);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 8cda3bc3ae22..4bfb2908ec15 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -3183,6 +3183,16 @@ static int cgroup_enable_threaded(struct cgroup *cgrp)
        if (cgroup_is_threaded(cgrp))
                return 0;
+        /*
+         * If @cgroup is populated or has domain controllers enabled, it
+         * can't be switched.  While the below cgroup_can_be_thread_root()
+         * test can catch the same conditions, that's only when @parent is
+         * not mixable, so let's check it explicitly.
+         */
+        if (cgroup_is_populated(cgrp) ||
+            cgrp->subtree_control & ~cgrp_dfl_threaded_ss_mask)
+                return -EOPNOTSUPP;
        /* we're joining the parent's domain, ensure its validity */
        if (!cgroup_is_valid_domain(dom_cgrp) ||
            !cgroup_can_be_thread_root(dom_cgrp))
diff --git a/kernel/compat.c b/kernel/compat.c
index 3247fe761f60..3f5fa8902e7d 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -488,25 +488,6 @@ get_compat_sigset(sigset_t *set, const compat_sigset_t __user *compat)
 }
 EXPORT_SYMBOL_GPL(get_compat_sigset);
-int
-put_compat_sigset(compat_sigset_t __user *compat, const sigset_t *set,
-                  unsigned int size)
-{
-        /* size <= sizeof(compat_sigset_t) <= sizeof(sigset_t) */
-#ifdef __BIG_ENDIAN
-        compat_sigset_t v;
-        switch (_NSIG_WORDS) {
-        case 4: v.sig[7] = (set->sig[3] >> 32); v.sig[6] = set->sig[3];
-        case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2];
-        case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1];
-        case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0];
-        }
-        return copy_to_user(compat, &v, size) ? -EFAULT : 0;
-#else
-        return copy_to_user(compat, set, size) ? -EFAULT : 0;
-#endif
-}
 #ifdef CONFIG_NUMA
 COMPAT_SYSCALL_DEFINE6(move_pages, pid_t, pid, compat_ulong_t, nr_pages,
                       compat_uptr_t __user *, pages32,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 96db9ae5d5af..4b838470fac4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2246,7 +2246,7 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
                        struct perf_event_context *task_ctx,
                        enum event_type_t event_type)
 {
-        enum event_type_t ctx_event_type = event_type & EVENT_ALL;
+        enum event_type_t ctx_event_type;
        bool cpu_event = !!(event_type & EVENT_CPU);
        /*
@@ -2256,6 +2256,8 @@ static void ctx_resched(struct perf_cpu_context *cpuctx,
        if (event_type & EVENT_PINNED)
                event_type |= EVENT_FLEXIBLE;
+        ctx_event_type = event_type & EVENT_ALL;
        perf_pmu_disable(cpuctx->ctx.pmu);
        if (task_ctx)
                task_ctx_sched_out(cpuctx, task_ctx, event_type);
diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 21b0122cb39c..1d5632d8bbcc 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -14,6 +14,15 @@
 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs);
+static void fei_post_handler(struct kprobe *kp, struct pt_regs *regs,
+                             unsigned long flags)
+{
+        /*
+         * A dummy post handler is required to prohibit optimizing, because
+         * jump optimization does not support execution path overriding.
+         */
+}
 struct fei_attr {
        struct list_head list;
        struct kprobe kp;
@@ -56,6 +65,7 @@ static struct fei_attr *fei_attr_new(const char *sym, unsigned long addr)
                        return NULL;
                }
                attr->kp.pre_handler = fei_kprobe_handler;
+                attr->kp.post_handler = fei_post_handler;
                attr->retval = adjust_error_retval(addr, 0);
                INIT_LIST_HEAD(&attr->list);
        }
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 52a0a7af8640..e7214093dcd1 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -373,7 +373,8 @@ static void __jump_label_update(struct static_key *key,
                        if (kernel_text_address(entry->code))
                                arch_jump_label_transform(entry, jump_label_type(entry));
                        else
-                                WARN_ONCE(1, "can't patch jump_label at %pS", (void *)entry->code);
+                                WARN_ONCE(1, "can't patch jump_label at %pS",
+                                          (void *)(unsigned long)entry->code);
                }
        }
 }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 65cc0cb984e6..940633c63254 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1616,11 +1616,12 @@ bool __sched __rt_mutex_futex_unlock(struct rt_mutex *lock,
 void __sched rt_mutex_futex_unlock(struct rt_mutex *lock)
 {
        DEFINE_WAKE_Q(wake_q);
+        unsigned long flags;
        bool postunlock;
-        raw_spin_lock_irq(&lock->wait_lock);
+        raw_spin_lock_irqsave(&lock->wait_lock, flags);
        postunlock = __rt_mutex_futex_unlock(lock, &wake_q);
-        raw_spin_unlock_irq(&lock->wait_lock);
+        raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
        if (postunlock)
                rt_mutex_postunlock(&wake_q);
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 4dd4274cabe2..895e6b76b25e 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -427,7 +427,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
 err_pfn_remap:
 err_radix:
        pgmap_radix_release(res, pgoff);
-        devres_free(pgmap);
        return ERR_PTR(error);
 }
 EXPORT_SYMBOL(devm_memremap_pages);
diff --git a/kernel/module.c b/kernel/module.c
index ad2d420024f6..e42764acedb4 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -4228,7 +4228,7 @@ static int modules_open(struct inode *inode, struct file *file)
                m->private = kallsyms_show_value() ? NULL : (void *)8ul;
        }
-        return 0;
+        return err;
 }
 static const struct file_operations proc_modules_operations = {
diff --git a/kernel/panic.c b/kernel/panic.c
index 2cfef408fec9..4b794f1d8561 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -640,7 +640,7 @@ device_initcall(register_warn_debugfs);
 */
 __visible void __stack_chk_fail(void)
 {
-        panic("stack-protector: Kernel stack is corrupted in: %p\n",
+        panic("stack-protector: Kernel stack is corrupted in: %pB\n",
                __builtin_return_address(0));
 }
 EXPORT_SYMBOL(__stack_chk_fail);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e7c535eee0a6..c94895bc5a2c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6683,13 +6683,18 @@ static int tg_cfs_schedulable_down(struct task_group *tg, void *data)
                parent_quota = parent_b->hierarchical_quota;
                /*
-                 * Ensure max(child_quota) <= parent_quota, inherit when no
+                 * Ensure max(child_quota) <= parent_quota.  On cgroup2,
+                 * always take the min.  On cgroup1, only inherit when no
                 * limit is set:
                 */
-                if (quota == RUNTIME_INF)
+                if (cgroup_subsys_on_dfl(cpu_cgrp_subsys)) {
-                        quota = parent_quota;
+                        quota = min(quota, parent_quota);
-                else if (parent_quota != RUNTIME_INF && quota > parent_quota)
+                } else {
-                        return -EINVAL;
+                        if (quota == RUNTIME_INF)
+                                quota = parent_quota;
+                        else if (parent_quota != RUNTIME_INF && quota > parent_quota)
+                                return -EINVAL;
+                }
        }
        cfs_b->hierarchical_quota = quota;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index c634e093951f..7f9691c86b6e 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -661,7 +661,41 @@ static const struct bpf_func_proto bpf_get_stackid_proto_tp = {
        .arg3_type      = ARG_ANYTHING,
 };
-BPF_CALL_3(bpf_perf_prog_read_value_tp, struct bpf_perf_event_data_kern *, ctx,
+static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+{
+        switch (func_id) {
+        case BPF_FUNC_perf_event_output:
+                return &bpf_perf_event_output_proto_tp;
+        case BPF_FUNC_get_stackid:
+                return &bpf_get_stackid_proto_tp;
+        default:
+                return tracing_func_proto(func_id);
+        }
+}
+static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    struct bpf_insn_access_aux *info)
+{
+        if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
+                return false;
+        if (type != BPF_READ)
+                return false;
+        if (off % size != 0)
+                return false;
+        BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
+        return true;
+}
+const struct bpf_verifier_ops tracepoint_verifier_ops = {
+        .get_func_proto  = tp_prog_func_proto,
+        .is_valid_access = tp_prog_is_valid_access,
+};
+const struct bpf_prog_ops tracepoint_prog_ops = {
+};
+BPF_CALL_3(bpf_perf_prog_read_value, struct bpf_perf_event_data_kern *, ctx,
           struct bpf_perf_event_value *, buf, u32, size)
 {
        int err = -EINVAL;
@@ -678,8 +712,8 @@ clear:
        return err;
 }
-static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
+static const struct bpf_func_proto bpf_perf_prog_read_value_proto = {
-         .func           = bpf_perf_prog_read_value_tp,
+         .func           = bpf_perf_prog_read_value,
         .gpl_only       = true,
         .ret_type       = RET_INTEGER,
         .arg1_type      = ARG_PTR_TO_CTX,
@@ -687,7 +721,7 @@ static const struct bpf_func_proto bpf_perf_prog_read_value_proto_tp = {
         .arg3_type      = ARG_CONST_SIZE,
 };
-static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
+static const struct bpf_func_proto *pe_prog_func_proto(enum bpf_func_id func_id)
 {
        switch (func_id) {
        case BPF_FUNC_perf_event_output:
@@ -695,34 +729,12 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
        case BPF_FUNC_get_stackid:
                return &bpf_get_stackid_proto_tp;
        case BPF_FUNC_perf_prog_read_value:
-                return &bpf_perf_prog_read_value_proto_tp;
+                return &bpf_perf_prog_read_value_proto;
        default:
                return tracing_func_proto(func_id);
        }
 }
-static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
-                                    struct bpf_insn_access_aux *info)
-{
-        if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
-                return false;
-        if (type != BPF_READ)
-                return false;
-        if (off % size != 0)
-                return false;
-        BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(__u64));
-        return true;
-}
-const struct bpf_verifier_ops tracepoint_verifier_ops = {
-        .get_func_proto  = tp_prog_func_proto,
-        .is_valid_access = tp_prog_is_valid_access,
-};
-const struct bpf_prog_ops tracepoint_prog_ops = {
-};
 static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
                                    struct bpf_insn_access_aux *info)
 {
@@ -791,7 +803,7 @@ static u32 pe_prog_convert_ctx_access(enum bpf_access_type type,
 }
 const struct bpf_verifier_ops perf_event_verifier_ops = {
-        .get_func_proto         = tp_prog_func_proto,
+        .get_func_proto         = pe_prog_func_proto,
        .is_valid_access        = pe_prog_is_valid_access,
        .convert_ctx_access     = pe_prog_convert_ctx_access,
 };
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index bb9a519cbf50..6ec6ba65127b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3018,14 +3018,6 @@ static bool __cancel_work(struct work_struct *work, bool is_dwork)
        return ret;
 }
-/*
- * See cancel_delayed_work()
- */
-bool cancel_work(struct work_struct *work)
-{
-        return __cancel_work(work, false);
-}
 /**
 * cancel_delayed_work - cancel a delayed work
 * @dwork: delayed_work to cancel
@@ -5337,7 +5329,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
        ret = device_register(&wq_dev->dev);
        if (ret) {
-                kfree(wq_dev);
+                put_device(&wq_dev->dev);
                wq->wq_dev = NULL;
                return ret;
        }
diff --git a/lib/btree.c b/lib/btree.c
index f93a945274af..590facba2c50 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -3,7 +3,7 @@
 *
 * As should be obvious for Linux kernel code, license is GPLv2
 *
- * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
+ * Copyright (c) 2007-2008 Joern Engel <joern@purestorage.com>
 * Bits and pieces stolen from Peter Zijlstra's code, which is
 * Copyright 2007, Red Hat Inc. Peter Zijlstra
 * GPLv2
@@ -76,6 +76,8 @@ struct btree_geo btree_geo128 = {
 };
 EXPORT_SYMBOL_GPL(btree_geo128);
+#define MAX_KEYLEN      (2 * LONG_PER_U64)
 static struct kmem_cache *btree_cachep;
 void *btree_alloc(gfp_t gfp_mask, void *pool_data)
@@ -313,7 +315,7 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 {
        int i, height;
        unsigned long *node, *oldnode;
-        unsigned long *retry_key = NULL, key[geo->keylen];
+        unsigned long *retry_key = NULL, key[MAX_KEYLEN];
        if (keyzero(geo, __key))
                return NULL;
@@ -639,8 +641,8 @@ EXPORT_SYMBOL_GPL(btree_remove);
 int btree_merge(struct btree_head *target, struct btree_head *victim,
                struct btree_geo *geo, gfp_t gfp)
 {
-        unsigned long key[geo->keylen];
+        unsigned long key[MAX_KEYLEN];
-        unsigned long dup[geo->keylen];
+        unsigned long dup[MAX_KEYLEN];
        void *val;
        int err;
diff --git a/lib/bug.c b/lib/bug.c
index c1b0fad31b10..1077366f496b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
                return BUG_TRAP_TYPE_NONE;
        bug = find_bug(bugaddr);
+        if (!bug)
+                return BUG_TRAP_TYPE_NONE;
        file = NULL;
        line = 0;
@@ -191,7 +193,7 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
        if (file)
                pr_crit("kernel BUG at %s:%u!\n", file, line);
        else
-                pr_crit("Kernel BUG at %p [verbose debug info unavailable]\n",
+                pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
                        (void *)bugaddr);
        return BUG_TRAP_TYPE_BUG;
diff --git a/lib/ioremap.c b/lib/ioremap.c
index b808a390e4c3..54e5bbaa3200 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -91,7 +91,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
                if (ioremap_pmd_enabled() &&
                    ((next - addr) == PMD_SIZE) &&
-                    IS_ALIGNED(phys_addr + addr, PMD_SIZE)) {
+                    IS_ALIGNED(phys_addr + addr, PMD_SIZE) &&
+                    pmd_free_pte_page(pmd)) {
                        if (pmd_set_huge(pmd, phys_addr + addr, prot))
                                continue;
                }
@@ -117,7 +118,8 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
                if (ioremap_pud_enabled() &&
                    ((next - addr) == PUD_SIZE) &&
-                    IS_ALIGNED(phys_addr + addr, PUD_SIZE)) {
+                    IS_ALIGNED(phys_addr + addr, PUD_SIZE) &&
+                    pud_free_pmd_page(pud)) {
                        if (pud_set_huge(pud, phys_addr + addr, prot))
                                continue;
                }
diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 30e7dd88148b..9f96fa7bc000 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -322,6 +322,8 @@ EXPORT_SYMBOL_GPL(percpu_ref_switch_to_percpu);
 * This function normally doesn't block and can be called from any context
 * but it may block if @confirm_kill is specified and @ref is in the
 * process of switching to atomic mode by percpu_ref_switch_to_atomic().
+ *
+ * There are no implied RCU grace periods between kill and release.
 */
 void percpu_ref_kill_and_confirm(struct percpu_ref *ref,
                                 percpu_ref_func_t *confirm_kill)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 3825c30aaa36..47de025b6245 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -506,8 +506,10 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
                if (!key ||
                    (ht->p.obj_cmpfn ?
                     ht->p.obj_cmpfn(&arg, rht_obj(ht, head)) :
-                     rhashtable_compare(&arg, rht_obj(ht, head))))
+                     rhashtable_compare(&arg, rht_obj(ht, head)))) {
+                        pprev = &head->next;
                        continue;
+                }
                if (!ht->rhlist)
                        return rht_obj(ht, head);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 2efb213716fa..3e9335493fe4 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -5467,7 +5467,7 @@ static struct bpf_test tests[] = {
        {
                "BPF_MAXINSNS: Jump, gap, jump, ...",
                { },
-#ifdef CONFIG_BPF_JIT_ALWAYS_ON
+#if defined(CONFIG_BPF_JIT_ALWAYS_ON) && defined(CONFIG_X86)
                CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
 #else
                CLASSIC | FLAG_NO_DATA,
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index e372b97eee13..0e5b7a61460b 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -1141,7 +1141,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
        mutex_lock(&reg_dev_mutex);
        /* int should suffice for number of devices, test for wrap */
-        if (unlikely(num_test_devs + 1) < 0) {
+        if (num_test_devs + 1 == INT_MAX) {
                pr_err("reached limit of number of test devices\n");
                goto out;
        }
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 76d3667fdea2..f4000c137dbe 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -79,6 +79,21 @@ struct thread_data {
        struct test_obj *objs;
 };
+static u32 my_hashfn(const void *data, u32 len, u32 seed)
+{
+        const struct test_obj_rhl *obj = data;
+        return (obj->value.id % 10) << RHT_HASH_RESERVED_SPACE;
+}
+static int my_cmpfn(struct rhashtable_compare_arg *arg, const void *obj)
+{
+        const struct test_obj_rhl *test_obj = obj;
+        const struct test_obj_val *val = arg->key;
+        return test_obj->value.id - val->id;
+}
 static struct rhashtable_params test_rht_params = {
        .head_offset = offsetof(struct test_obj, node),
        .key_offset = offsetof(struct test_obj, value),
@@ -87,6 +102,17 @@ static struct rhashtable_params test_rht_params = {
        .nulls_base = (3U << RHT_BASE_SHIFT),
 };
+static struct rhashtable_params test_rht_params_dup = {
+        .head_offset = offsetof(struct test_obj_rhl, list_node),
+        .key_offset = offsetof(struct test_obj_rhl, value),
+        .key_len = sizeof(struct test_obj_val),
+        .hashfn = jhash,
+        .obj_hashfn = my_hashfn,
+        .obj_cmpfn = my_cmpfn,
+        .nelem_hint = 128,
+        .automatic_shrinking = false,
+};
 static struct semaphore prestart_sem;
 static struct semaphore startup_sem = __SEMAPHORE_INITIALIZER(startup_sem, 0);
@@ -465,6 +491,112 @@ static int __init test_rhashtable_max(struct test_obj *array,
        return err;
 }
+static unsigned int __init print_ht(struct rhltable *rhlt)
+{
+        struct rhashtable *ht;
+        const struct bucket_table *tbl;
+        char buff[512] = "";
+        unsigned int i, cnt = 0;
+        ht = &rhlt->ht;
+        tbl = rht_dereference(ht->tbl, ht);
+        for (i = 0; i < tbl->size; i++) {
+                struct rhash_head *pos, *next;
+                struct test_obj_rhl *p;
+                pos = rht_dereference(tbl->buckets[i], ht);
+                next = !rht_is_a_nulls(pos) ? rht_dereference(pos->next, ht) : NULL;
+                if (!rht_is_a_nulls(pos)) {
+                        sprintf(buff, "%s\nbucket[%d] -> ", buff, i);
+                }
+                while (!rht_is_a_nulls(pos)) {
+                        struct rhlist_head *list = container_of(pos, struct rhlist_head, rhead);
+                        sprintf(buff, "%s[[", buff);
+                        do {
+                                pos = &list->rhead;
+                                list = rht_dereference(list->next, ht);
+                                p = rht_obj(ht, pos);
+                                sprintf(buff, "%s val %d (tid=%d)%s", buff, p->value.id, p->value.tid,
+                                        list? ", " : " ");
+                                cnt++;
+                        } while (list);
+                        pos = next,
+                        next = !rht_is_a_nulls(pos) ?
+                                rht_dereference(pos->next, ht) : NULL;
+                        sprintf(buff, "%s]]%s", buff, !rht_is_a_nulls(pos) ? " -> " : "");
+                }
+        }
+        printk(KERN_ERR "\n---- ht: ----%s\n-------------\n", buff);
+        return cnt;
+}
+static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
+                                  int cnt, bool slow)
+{
+        struct rhltable rhlt;
+        unsigned int i, ret;
+        const char *key;
+        int err = 0;
+        err = rhltable_init(&rhlt, &test_rht_params_dup);
+        if (WARN_ON(err))
+                return err;
+        for (i = 0; i < cnt; i++) {
+                rhl_test_objects[i].value.tid = i;
+                key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
+                key += test_rht_params_dup.key_offset;
+                if (slow) {
+                        err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
+                                                             &rhl_test_objects[i].list_node.rhead));
+                        if (err == -EAGAIN)
+                                err = 0;
+                } else
+                        err = rhltable_insert(&rhlt,
+                                              &rhl_test_objects[i].list_node,
+                                              test_rht_params_dup);
+                if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
+                        goto skip_print;
+        }
+        ret = print_ht(&rhlt);
+        WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
+skip_print:
+        rhltable_destroy(&rhlt);
+        return 0;
+}
+static int __init test_insert_duplicates_run(void)
+{
+        struct test_obj_rhl rhl_test_objects[3] = {};
+        pr_info("test inserting duplicates\n");
+        /* two different values that map to same bucket */
+        rhl_test_objects[0].value.id = 1;
+        rhl_test_objects[1].value.id = 21;
+        /* and another duplicate with same as [0] value
+         * which will be second on the bucket list */
+        rhl_test_objects[2].value.id = rhl_test_objects[0].value.id;
+        test_insert_dup(rhl_test_objects, 2, false);
+        test_insert_dup(rhl_test_objects, 3, false);
+        test_insert_dup(rhl_test_objects, 2, true);
+        test_insert_dup(rhl_test_objects, 3, true);
+        return 0;
+}
 static int thread_lookup_test(struct thread_data *tdata)
 {
        unsigned int entries = tdata->entries;
@@ -613,6 +745,8 @@ static int __init test_rht_init(void)
        do_div(total_time, runs);
        pr_info("Average test time: %llu\n", total_time);
+        test_insert_duplicates_run();
        if (!tcount)
                return 0;
diff --git a/mm/gup.c b/mm/gup.c
index 1b46e6e74881..6afae32571ca 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -516,7 +516,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
        }
        if (ret & VM_FAULT_RETRY) {
-                if (nonblocking)
+                if (nonblocking && !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
                        *nonblocking = 0;
                return -EBUSY;
        }
@@ -890,7 +890,10 @@ static __always_inline long __get_user_pages_locked(struct task_struct *tsk,
                                break;
                }
                if (*locked) {
-                        /* VM_FAULT_RETRY didn't trigger */
+                        /*
+                         * VM_FAULT_RETRY didn't trigger or it was a
+                         * FOLL_NOWAIT.
+                         */
                        if (!pages_done)
                                pages_done = ret;
                        break;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 87ab9b8f56b5..5a68730eebd6 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -555,7 +555,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        VM_BUG_ON_PAGE(!PageCompound(page), page);
-        if (mem_cgroup_try_charge(page, vma->vm_mm, gfp, &memcg, true)) {
+        if (mem_cgroup_try_charge(page, vma->vm_mm, gfp | __GFP_NORETRY, &memcg,
+                                  true)) {
                put_page(page);
                count_vm_event(THP_FAULT_FALLBACK);
                return VM_FAULT_FALLBACK;
@@ -1316,7 +1317,7 @@ alloc:
        }
        if (unlikely(mem_cgroup_try_charge(new_page, vma->vm_mm,
-                                        huge_gfp, &memcg, true))) {
+                                huge_gfp | __GFP_NORETRY, &memcg, true))) {
                put_page(new_page);
                split_huge_pmd(vma, vmf->pmd, vmf->address);
                if (page)
@@ -2783,11 +2784,13 @@ static unsigned long deferred_split_scan(struct shrinker *shrink,
        list_for_each_safe(pos, next, &list) {
                page = list_entry((void *)pos, struct page, mapping);
-                lock_page(page);
+                if (!trylock_page(page))
+                        goto next;
                /* split_huge_page() removes page from list on success */
                if (!split_huge_page(page))
                        split++;
                unlock_page(page);
+next:
                put_page(page);
        }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7c204e3d132b..976bbc5646fe 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -18,6 +18,7 @@
 #include <linux/bootmem.h>
 #include <linux/sysfs.h>
 #include <linux/slab.h>
+#include <linux/mmdebug.h>
 #include <linux/sched/signal.h>
 #include <linux/rmap.h>
 #include <linux/string_helpers.h>
@@ -1583,7 +1584,7 @@ static struct page *alloc_surplus_huge_page(struct hstate *h, gfp_t gfp_mask,
                page = NULL;
        } else {
                h->surplus_huge_pages++;
-                h->nr_huge_pages_node[page_to_nid(page)]++;
+                h->surplus_huge_pages_node[page_to_nid(page)]++;
        }
 out_unlock:
@@ -4374,6 +4375,12 @@ int hugetlb_reserve_pages(struct inode *inode,
        struct resv_map *resv_map;
        long gbl_reserve;
+        /* This should never happen */
+        if (from > to) {
+                VM_WARN(1, "%s called with a negative range\n", __func__);
+                return -EINVAL;
+        }
        /*
         * Only apply hugepage reservation if asked. At fault time, an
         * attempt will be made for VM_NORESERVE to allocate a page
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index b7e2268dfc9a..e42568284e06 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -530,7 +530,12 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
                        goto out;
                }
-                VM_BUG_ON_PAGE(PageCompound(page), page);
+                /* TODO: teach khugepaged to collapse THP mapped with pte */
+                if (PageCompound(page)) {
+                        result = SCAN_PAGE_COMPOUND;
+                        goto out;
+                }
                VM_BUG_ON_PAGE(!PageAnon(page), page);
                /*
@@ -960,7 +965,9 @@ static void collapse_huge_page(struct mm_struct *mm,
                goto out_nolock;
        }
-        if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) {
+        /* Do not oom kill for khugepaged charges */
+        if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY,
+                                           &memcg, true))) {
                result = SCAN_CGROUP_CHARGE_FAIL;
                goto out_nolock;
        }
@@ -1319,7 +1326,9 @@ static void collapse_shmem(struct mm_struct *mm,
                goto out;
        }
-        if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) {
+        /* Do not oom kill for khugepaged charges */
+        if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY,
+                                           &memcg, true))) {
                result = SCAN_CGROUP_CHARGE_FAIL;
                goto out;
        }
diff --git a/mm/memblock.c b/mm/memblock.c
index 5a9ca2a1751b..48376bd33274 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1101,34 +1101,6 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid,
                *out_nid = r->nid;
 }
-unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
-                                                      unsigned long max_pfn)
-{
-        struct memblock_type *type = &memblock.memory;
-        unsigned int right = type->cnt;
-        unsigned int mid, left = 0;
-        phys_addr_t addr = PFN_PHYS(pfn + 1);
-        do {
-                mid = (right + left) / 2;
-                if (addr < type->regions[mid].base)
-                        right = mid;
-                else if (addr >= (type->regions[mid].base +
-                                  type->regions[mid].size))
-                        left = mid + 1;
-                else {
-                        /* addr is within the region, so pfn + 1 is valid */
-                        return min(pfn + 1, max_pfn);
-                }
-        } while (left < right);
-        if (right == type->cnt)
-                return max_pfn;
-        else
-                return min(PHYS_PFN(type->regions[right].base), max_pfn);
-}
 /**
 * memblock_set_node - set node ID on memblock regions
 * @base: base of area to set node ID for
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d879f1d8a44a..32cba0332787 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2124,6 +2124,9 @@ bool __mpol_equal(struct mempolicy *a, struct mempolicy *b)
        case MPOL_INTERLEAVE:
                return !!nodes_equal(a->v.nodes, b->v.nodes);
        case MPOL_PREFERRED:
+                /* a's ->flags is the same as b's */
+                if (a->flags & MPOL_F_LOCAL)
+                        return true;
                return a->v.preferred_node == b->v.preferred_node;
        default:
                BUG();
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cb416723538f..1741dd23e7c1 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1910,7 +1910,9 @@ static int move_freepages(struct zone *zone,
         * Remove at a later date when no bug reports exist related to
         * grouping pages by mobility
         */
-        VM_BUG_ON(page_zone(start_page) != page_zone(end_page));
+        VM_BUG_ON(pfn_valid(page_to_pfn(start_page)) &&
+                  pfn_valid(page_to_pfn(end_page)) &&
+                  page_zone(start_page) != page_zone(end_page));
 #endif
        if (num_movable)
@@ -3594,7 +3596,7 @@ static bool __need_fs_reclaim(gfp_t gfp_mask)
                return false;
        /* this guy won't enter reclaim */
-        if ((current->flags & PF_MEMALLOC) && !(gfp_mask & __GFP_NOMEMALLOC))
+        if (current->flags & PF_MEMALLOC)
                return false;
        /* We're only interested __GFP_FS allocations for now */
@@ -5354,17 +5356,8 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
                if (context != MEMMAP_EARLY)
                        goto not_early;
-                if (!early_pfn_valid(pfn)) {
+                if (!early_pfn_valid(pfn))
-#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP
-                        /*
-                         * Skip to the pfn preceding the next valid one (or
-                         * end_pfn), such that we hit a valid pfn (or end_pfn)
-                         * on our next iteration of the loop.
-                         */
-                        pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1;
-#endif
                        continue;
-                }
                if (!early_pfn_in_nid(pfn, nid))
                        continue;
                if (!update_defer_init(pgdat, pfn, end_pfn, &nr_initialised))
diff --git a/mm/percpu-km.c b/mm/percpu-km.c
index d2a76642c4ae..38de70ab1a0d 100644
--- a/mm/percpu-km.c
+++ b/mm/percpu-km.c
@@ -34,7 +34,7 @@
 #include <linux/log2.h>
 static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
-                               int page_start, int page_end)
+                               int page_start, int page_end, gfp_t gfp)
 {
        return 0;
 }
@@ -45,18 +45,18 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
        /* nada */
 }
-static struct pcpu_chunk *pcpu_create_chunk(void)
+static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 {
        const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
        struct pcpu_chunk *chunk;
        struct page *pages;
        int i;
-        chunk = pcpu_alloc_chunk();
+        chunk = pcpu_alloc_chunk(gfp);
        if (!chunk)
                return NULL;
-        pages = alloc_pages(GFP_KERNEL, order_base_2(nr_pages));
+        pages = alloc_pages(gfp, order_base_2(nr_pages));
        if (!pages) {
                pcpu_free_chunk(chunk);
                return NULL;
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 9158e5a81391..d8078de912de 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -37,7 +37,7 @@ static struct page **pcpu_get_pages(void)
        lockdep_assert_held(&pcpu_alloc_mutex);
        if (!pages)
-                pages = pcpu_mem_zalloc(pages_size);
+                pages = pcpu_mem_zalloc(pages_size, GFP_KERNEL);
        return pages;
 }
@@ -73,18 +73,21 @@ static void pcpu_free_pages(struct pcpu_chunk *chunk,
 * @pages: array to put the allocated pages into, indexed by pcpu_page_idx()
 * @page_start: page index of the first page to be allocated
 * @page_end: page index of the last page to be allocated + 1
+ * @gfp: allocation flags passed to the underlying allocator
 *
 * Allocate pages [@page_start,@page_end) into @pages for all units.
 * The allocation is for @chunk.  Percpu core doesn't care about the
 * content of @pages and will pass it verbatim to pcpu_map_pages().
 */
 static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
-                            struct page **pages, int page_start, int page_end)
+                            struct page **pages, int page_start, int page_end,
+                            gfp_t gfp)
 {
-        const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM;
        unsigned int cpu, tcpu;
        int i;
+        gfp |= __GFP_HIGHMEM;
        for_each_possible_cpu(cpu) {
                for (i = page_start; i < page_end; i++) {
                        struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
@@ -262,6 +265,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
 * @chunk: chunk of interest
 * @page_start: the start page
 * @page_end: the end page
+ * @gfp: allocation flags passed to the underlying memory allocator
 *
 * For each cpu, populate and map pages [@page_start,@page_end) into
 * @chunk.
@@ -270,7 +274,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
 * pcpu_alloc_mutex, does GFP_KERNEL allocation.
 */
 static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
-                               int page_start, int page_end)
+                               int page_start, int page_end, gfp_t gfp)
 {
        struct page **pages;
@@ -278,7 +282,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
        if (!pages)
                return -ENOMEM;
-        if (pcpu_alloc_pages(chunk, pages, page_start, page_end))
+        if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp))
                return -ENOMEM;
        if (pcpu_map_pages(chunk, pages, page_start, page_end)) {
@@ -325,12 +329,12 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
        pcpu_free_pages(chunk, pages, page_start, page_end);
 }
-static struct pcpu_chunk *pcpu_create_chunk(void)
+static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 {
        struct pcpu_chunk *chunk;
        struct vm_struct **vms;
-        chunk = pcpu_alloc_chunk();
+        chunk = pcpu_alloc_chunk(gfp);
        if (!chunk)
                return NULL;
diff --git a/mm/percpu.c b/mm/percpu.c
index 50e7fdf84055..9297098519a6 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -80,6 +80,7 @@
 #include <linux/vmalloc.h>
 #include <linux/workqueue.h>
 #include <linux/kmemleak.h>
+#include <linux/sched.h>
 #include <asm/cacheflush.h>
 #include <asm/sections.h>
@@ -447,26 +448,25 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits,
 /**
 * pcpu_mem_zalloc - allocate memory
 * @size: bytes to allocate
+ * @gfp: allocation flags
 *
 * Allocate @size bytes.  If @size is smaller than PAGE_SIZE,
- * kzalloc() is used; otherwise, vzalloc() is used.  The returned
+ * kzalloc() is used; otherwise, the equivalent of vzalloc() is used.
- * memory is always zeroed.
+ * This is to facilitate passing through whitelisted flags.  The
- *
+ * returned memory is always zeroed.
- * CONTEXT:
- * Does GFP_KERNEL allocation.
 *
 * RETURNS:
 * Pointer to the allocated area on success, NULL on failure.
 */
-static void *pcpu_mem_zalloc(size_t size)
+static void *pcpu_mem_zalloc(size_t size, gfp_t gfp)
 {
        if (WARN_ON_ONCE(!slab_is_available()))
                return NULL;
        if (size <= PAGE_SIZE)
-                return kzalloc(size, GFP_KERNEL);
+                return kzalloc(size, gfp);
        else
-                return vzalloc(size);
+                return __vmalloc(size, gfp | __GFP_ZERO, PAGE_KERNEL);
 }
 /**
@@ -1154,12 +1154,12 @@ static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
        return chunk;
 }
-static struct pcpu_chunk *pcpu_alloc_chunk(void)
+static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
 {
        struct pcpu_chunk *chunk;
        int region_bits;
-        chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size);
+        chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp);
        if (!chunk)
                return NULL;
@@ -1168,17 +1168,17 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
        region_bits = pcpu_chunk_map_bits(chunk);
        chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) *
-                                           sizeof(chunk->alloc_map[0]));
+                                           sizeof(chunk->alloc_map[0]), gfp);
        if (!chunk->alloc_map)
                goto alloc_map_fail;
        chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) *
-                                           sizeof(chunk->bound_map[0]));
+                                           sizeof(chunk->bound_map[0]), gfp);
        if (!chunk->bound_map)
                goto bound_map_fail;
        chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) *
-                                           sizeof(chunk->md_blocks[0]));
+                                           sizeof(chunk->md_blocks[0]), gfp);
        if (!chunk->md_blocks)
                goto md_blocks_fail;
@@ -1277,9 +1277,11 @@ static void pcpu_chunk_depopulated(struct pcpu_chunk *chunk,
 * pcpu_addr_to_page            - translate address to physical address
 * pcpu_verify_alloc_info       - check alloc_info is acceptable during init
 */
-static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size);
+static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
-static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size);
+                               int page_start, int page_end, gfp_t gfp);
-static struct pcpu_chunk *pcpu_create_chunk(void);
+static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
+                                  int page_start, int page_end);
+static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp);
 static void pcpu_destroy_chunk(struct pcpu_chunk *chunk);
 static struct page *pcpu_addr_to_page(void *addr);
 static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
@@ -1339,6 +1341,8 @@ static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
 static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
                                 gfp_t gfp)
 {
+        /* whitelisted flags that can be passed to the backing allocators */
+        gfp_t pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
        bool is_atomic = (gfp & GFP_KERNEL) != GFP_KERNEL;
        bool do_warn = !(gfp & __GFP_NOWARN);
        static int warn_limit = 10;
@@ -1369,8 +1373,17 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
                return NULL;
        }
-        if (!is_atomic)
+        if (!is_atomic) {
-                mutex_lock(&pcpu_alloc_mutex);
+                /*
+                 * pcpu_balance_workfn() allocates memory under this mutex,
+                 * and it may wait for memory reclaim. Allow current task
+                 * to become OOM victim, in case of memory pressure.
+                 */
+                if (gfp & __GFP_NOFAIL)
+                        mutex_lock(&pcpu_alloc_mutex);
+                else if (mutex_lock_killable(&pcpu_alloc_mutex))
+                        return NULL;
+        }
        spin_lock_irqsave(&pcpu_lock, flags);
@@ -1421,7 +1434,7 @@ restart:
        }
        if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) {
-                chunk = pcpu_create_chunk();
+                chunk = pcpu_create_chunk(pcpu_gfp);
                if (!chunk) {
                        err = "failed to allocate new chunk";
                        goto fail;
@@ -1450,7 +1463,7 @@ area_found:
                                           page_start, page_end) {
                        WARN_ON(chunk->immutable);
-                        ret = pcpu_populate_chunk(chunk, rs, re);
+                        ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
                        spin_lock_irqsave(&pcpu_lock, flags);
                        if (ret) {
@@ -1561,10 +1574,17 @@ void __percpu *__alloc_reserved_percpu(size_t size, size_t align)
 * pcpu_balance_workfn - manage the amount of free chunks and populated pages
 * @work: unused
 *
- * Reclaim all fully free chunks except for the first one.
+ * Reclaim all fully free chunks except for the first one.  This is also
+ * responsible for maintaining the pool of empty populated pages.  However,
+ * it is possible that this is called when physical memory is scarce causing
+ * OOM killer to be triggered.  We should avoid doing so until an actual
+ * allocation causes the failure as it is possible that requests can be
+ * serviced from already backed regions.
 */
 static void pcpu_balance_workfn(struct work_struct *work)
 {
+        /* gfp flags passed to underlying allocators */
+        const gfp_t gfp = GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN;
        LIST_HEAD(to_free);
        struct list_head *free_head = &pcpu_slot[pcpu_nr_slots - 1];
        struct pcpu_chunk *chunk, *next;
@@ -1600,6 +1620,7 @@ static void pcpu_balance_workfn(struct work_struct *work)
                        spin_unlock_irq(&pcpu_lock);
                }
                pcpu_destroy_chunk(chunk);
+                cond_resched();
        }
        /*
@@ -1645,7 +1666,7 @@ retry_pop:
                                           chunk->nr_pages) {
                        int nr = min(re - rs, nr_to_pop);
-                        ret = pcpu_populate_chunk(chunk, rs, rs + nr);
+                        ret = pcpu_populate_chunk(chunk, rs, rs + nr, gfp);
                        if (!ret) {
                                nr_to_pop -= nr;
                                spin_lock_irq(&pcpu_lock);
@@ -1662,7 +1683,7 @@ retry_pop:
        if (nr_to_pop) {
                /* ran out of chunks to populate, create a new one and retry */
-                chunk = pcpu_create_chunk();
+                chunk = pcpu_create_chunk(gfp);
                if (chunk) {
                        spin_lock_irq(&pcpu_lock);
                        pcpu_chunk_relocate(chunk, -1);
diff --git a/mm/shmem.c b/mm/shmem.c
index 1907688b75ee..b85919243399 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -493,36 +493,45 @@ next:
                info = list_entry(pos, struct shmem_inode_info, shrinklist);
                inode = &info->vfs_inode;
-                if (nr_to_split && split >= nr_to_split) {
+                if (nr_to_split && split >= nr_to_split)
-                        iput(inode);
+                        goto leave;
-                        continue;
-                }
-                page = find_lock_page(inode->i_mapping,
+                page = find_get_page(inode->i_mapping,
                                (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
                if (!page)
                        goto drop;
+                /* No huge page at the end of the file: nothing to split */
                if (!PageTransHuge(page)) {
-                        unlock_page(page);
                        put_page(page);
                        goto drop;
                }
+                /*
+                 * Leave the inode on the list if we failed to lock
+                 * the page at this time.
+                 *
+                 * Waiting for the lock may lead to deadlock in the
+                 * reclaim path.
+                 */
+                if (!trylock_page(page)) {
+                        put_page(page);
+                        goto leave;
+                }
                ret = split_huge_page(page);
                unlock_page(page);
                put_page(page);
-                if (ret) {
+                /* If split failed leave the inode on the list */
-                        /* split failed: leave it on the list */
+                if (ret)
-                        iput(inode);
+                        goto leave;
-                        continue;
-                }
                split++;
 drop:
                list_del_init(&info->shrinklist);
                removed++;
+leave:
                iput(inode);
        }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index bee53495a829..cd5dc3faaa57 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1780,6 +1780,20 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
                set_bit(PGDAT_WRITEBACK, &pgdat->flags);
        /*
+         * If dirty pages are scanned that are not queued for IO, it
+         * implies that flushers are not doing their job. This can
+         * happen when memory pressure pushes dirty pages to the end of
+         * the LRU before the dirty limits are breached and the dirty
+         * data has expired. It can also happen when the proportion of
+         * dirty pages grows not through writes but through memory
+         * pressure reclaiming all the clean cache. And in some cases,
+         * the flushers simply cannot keep up with the allocation
+         * rate. Nudge the flusher threads in case they are asleep.
+         */
+        if (stat.nr_unqueued_dirty == nr_taken)
+                wakeup_flusher_threads(WB_REASON_VMSCAN);
+        /*
         * Legacy memcg will stall in page writeback so avoid forcibly
         * stalling here.
         */
@@ -1791,22 +1805,9 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
                if (stat.nr_dirty && stat.nr_dirty == stat.nr_congested)
                        set_bit(PGDAT_CONGESTED, &pgdat->flags);
-                /*
+                /* Allow kswapd to start writing pages during reclaim. */
-                 * If dirty pages are scanned that are not queued for IO, it
+                if (stat.nr_unqueued_dirty == nr_taken)
-                 * implies that flushers are not doing their job. This can
-                 * happen when memory pressure pushes dirty pages to the end of
-                 * the LRU before the dirty limits are breached and the dirty
-                 * data has expired. It can also happen when the proportion of
-                 * dirty pages grows not through writes but through memory
-                 * pressure reclaiming all the clean cache. And in some cases,
-                 * the flushers simply cannot keep up with the allocation
-                 * rate. Nudge the flusher threads in case they are asleep, but
-                 * also allow kswapd to start writing pages during reclaim.
-                 */
-                if (stat.nr_unqueued_dirty == nr_taken) {
-                        wakeup_flusher_threads(WB_REASON_VMSCAN);
                        set_bit(PGDAT_DIRTY, &pgdat->flags);
-                }
                /*
                 * If kswapd scans pages marked marked for immediate
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 64aa9f755e1d..45c9bf5ff3a0 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -48,8 +48,8 @@ bool vlan_do_receive(struct sk_buff **skbp)
                 * original position later
                 */
                skb_push(skb, offset);
-                skb = *skbp = vlan_insert_tag(skb, skb->vlan_proto,
+                skb = *skbp = vlan_insert_inner_tag(skb, skb->vlan_proto,
-                                              skb->vlan_tci);
+                                                    skb->vlan_tci, skb->mac_len);
                if (!skb)
                        return false;
                skb_pull(skb, offset + VLAN_HLEN);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 75dda9454ccf..a60bacf7120b 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -400,7 +400,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
                   batadv_arp_hw_src(skb, hdr_size), &ip_src,
                   batadv_arp_hw_dst(skb, hdr_size), &ip_dst);
-        if (hdr_size == 0)
+        if (hdr_size < sizeof(struct batadv_unicast_packet))
                return;
        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 7d5e9abb7a65..55c358ad3331 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -24,6 +24,7 @@
 #include <linux/debugfs.h>
 #include <linux/errno.h>
 #include <linux/etherdevice.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
index 52d8a4b848c0..853773e45f79 100644
--- a/net/batman-adv/log.c
+++ b/net/batman-adv/log.c
@@ -22,6 +22,7 @@
 #include <linux/compiler.h>
 #include <linux/debugfs.h>
 #include <linux/errno.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 5615b6abea6f..de3a055f7dd8 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -598,8 +598,8 @@ update:
                bat_priv->mcast.enabled = true;
        }
-        return !(mcast_data.flags &
+        return !(mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV4 &&
-                 (BATADV_MCAST_WANT_ALL_IPV4 | BATADV_MCAST_WANT_ALL_IPV6));
+                 mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV6);
 }
 /**
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 289df027ecdd..cc3ed93a6d51 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -759,6 +759,7 @@ free_skb:
 /**
 * batadv_reroute_unicast_packet() - update the unicast header for re-routing
 * @bat_priv: the bat priv with all the soft interface information
+ * @skb: unicast packet to process
 * @unicast_packet: the unicast header to be updated
 * @dst_addr: the payload destination
 * @vid: VLAN identifier
@@ -770,7 +771,7 @@ free_skb:
 * Return: true if the packet header has been updated, false otherwise
 */
 static bool
-batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
+batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                              struct batadv_unicast_packet *unicast_packet,
                              u8 *dst_addr, unsigned short vid)
 {
@@ -799,8 +800,10 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
        }
        /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
        ether_addr_copy(unicast_packet->dest, orig_addr);
        unicast_packet->ttvn = orig_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
        ret = true;
 out:
@@ -841,7 +844,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         * the packet to
         */
        if (batadv_tt_local_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) {
-                if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+                if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                                  ethhdr->h_dest, vid))
                        batadv_dbg_ratelimited(BATADV_DBG_TT,
                                               bat_priv,
@@ -887,7 +890,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         * destination can possibly be updated and forwarded towards the new
         * target host
         */
-        if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+        if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                          ethhdr->h_dest, vid)) {
                batadv_dbg_ratelimited(BATADV_DBG_TT, bat_priv,
                                       "Rerouting unicast packet to %pM (dst=%pM): TTVN mismatch old_ttvn=%u new_ttvn=%u\n",
@@ -910,12 +913,14 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
        if (!primary_if)
                return false;
+        /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
        ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr);
+        unicast_packet->ttvn = curr_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
        batadv_hardif_put(primary_if);
-        unicast_packet->ttvn = curr_ttvn;
        return true;
 }
@@ -968,14 +973,10 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
        struct batadv_orig_node *orig_node = NULL, *orig_node_gw = NULL;
        int check, hdr_size = sizeof(*unicast_packet);
        enum batadv_subtype subtype;
-        struct ethhdr *ethhdr;
        int ret = NET_RX_DROP;
        bool is4addr, is_gw;
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        ethhdr = eth_hdr(skb);
        is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR;
        /* the caller function should have already pulled 2 bytes */
        if (is4addr)
@@ -995,12 +996,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
        if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size))
                goto free_skb;
+        unicast_packet = (struct batadv_unicast_packet *)skb->data;
        /* packet for me */
        if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                /* If this is a unicast packet from another backgone gw,
                 * drop it.
                 */
-                orig_addr_gw = ethhdr->h_source;
+                orig_addr_gw = eth_hdr(skb)->h_source;
                orig_node_gw = batadv_orig_hash_find(bat_priv, orig_addr_gw);
                if (orig_node_gw) {
                        is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw,
@@ -1015,6 +1018,8 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                }
                if (is4addr) {
+                        unicast_4addr_packet =
+                                (struct batadv_unicast_4addr_packet *)skb->data;
                        subtype = unicast_4addr_packet->subtype;
                        batadv_dat_inc_counter(bat_priv, subtype);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 01117ae84f1d..a2ddae2f37d7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
        else
                sec_level = authreq_to_seclevel(auth);
-        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
+        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
+                /* If link is already encrypted with sufficient security we
+                 * still need refresh encryption as per Core Spec 5.0 Vol 3,
+                 * Part H 2.4.6
+                 */
+                smp_ltk_encrypt(conn, hcon->sec_level);
                return 0;
+        }
        if (sec_level > hcon->pending_sec_level)
                hcon->pending_sec_level = sec_level;
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index c5afb4232ecb..620e54f08296 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
        return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
 }
+static bool wormhash_offset_invalid(int off, unsigned int len)
+{
+        if (off == 0) /* not present */
+                return false;
+        if (off < (int)sizeof(struct ebt_among_info) ||
+            off % __alignof__(struct ebt_mac_wormhash))
+                return true;
+        off += sizeof(struct ebt_mac_wormhash);
+        return off > len;
+}
+static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b)
+{
+        if (a == 0)
+                a = sizeof(struct ebt_among_info);
+        return ebt_mac_wormhash_size(wh) + a == b;
+}
 static int ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
        const struct ebt_among_info *info = par->matchinfo;
@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
        if (expected_length > em->match_size)
                return -EINVAL;
+        if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) ||
+            wormhash_offset_invalid(info->wh_src_ofs, em->match_size))
+                return -EINVAL;
        wh_dst = ebt_among_wh_dst(info);
        if (poolsize_invalid(wh_dst))
                return -EINVAL;
@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
        if (poolsize_invalid(wh_src))
                return -EINVAL;
+        if (info->wh_src_ofs < info->wh_dst_ofs) {
+                if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs))
+                        return -EINVAL;
+        } else {
+                if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs))
+                        return -EINVAL;
+        }
        expected_length += ebt_mac_wormhash_size(wh_src);
        if (em->match_size != EBT_ALIGN(expected_length)) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 254ef9f49567..a94d23b0a9af 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2119,8 +2119,12 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
         * offsets are relative to beginning of struct ebt_entry (i.e., 0).
         */
        for (i = 0; i < 4 ; ++i) {
-                if (offsets[i] >= *total)
+                if (offsets[i] > *total)
                        return -EINVAL;
+                if (i < 3 && offsets[i] == *total)
+                        return -EINVAL;
                if (i == 0)
                        continue;
                if (offsets[i-1] > offsets[i])
diff --git a/net/core/dev.c b/net/core/dev.c
index d8887cc38e7b..f9c28f44286c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3278,15 +3278,23 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
 #if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)
 static void skb_update_prio(struct sk_buff *skb)
 {
-        struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
+        const struct netprio_map *map;
+        const struct sock *sk;
+        unsigned int prioidx;
-        if (!skb->priority && skb->sk && map) {
+        if (skb->priority)
-                unsigned int prioidx =
+                return;
-                        sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);
+        map = rcu_dereference_bh(skb->dev->priomap);
+        if (!map)
+                return;
+        sk = skb_to_full_sk(skb);
+        if (!sk)
+                return;
-                if (prioidx < map->priomap_len)
+        prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data);
-                        skb->priority = map->priomap[prioidx];
-        }
+        if (prioidx < map->priomap_len)
+                skb->priority = map->priomap[prioidx];
 }
 #else
 #define skb_update_prio(skb)
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 0ab1af04296c..a04e1e88bf3a 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -402,8 +402,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
        if (colon)
                *colon = 0;
-        dev_load(net, ifr->ifr_name);
        /*
         *      See which interface the caller is talking about.
         */
@@ -423,6 +421,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
        case SIOCGIFMAP:
        case SIOCGIFINDEX:
        case SIOCGIFTXQLEN:
+                dev_load(net, ifr->ifr_name);
                rcu_read_lock();
                ret = dev_ifsioc_locked(net, ifr, cmd);
                rcu_read_unlock();
@@ -431,6 +430,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                return ret;
        case SIOCETHTOOL:
+                dev_load(net, ifr->ifr_name);
                rtnl_lock();
                ret = dev_ethtool(net, ifr);
                rtnl_unlock();
@@ -447,6 +447,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
        case SIOCGMIIPHY:
        case SIOCGMIIREG:
        case SIOCSIFNAME:
+                dev_load(net, ifr->ifr_name);
                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                        return -EPERM;
                rtnl_lock();
@@ -494,6 +495,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                /* fall through */
        case SIOCBONDSLAVEINFOQUERY:
        case SIOCBONDINFOQUERY:
+                dev_load(net, ifr->ifr_name);
                rtnl_lock();
                ret = dev_ifsioc(net, ifr, cmd);
                rtnl_unlock();
@@ -518,6 +520,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                    cmd == SIOCGHWTSTAMP ||
                    (cmd >= SIOCDEVPRIVATE &&
                     cmd <= SIOCDEVPRIVATE + 15)) {
+                        dev_load(net, ifr->ifr_name);
                        rtnl_lock();
                        ret = dev_ifsioc(net, ifr, cmd);
                        rtnl_unlock();
diff --git a/net/core/devlink.c b/net/core/devlink.c
index d03b96f87c25..9236e421bd62 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1798,7 +1798,7 @@ send_done:
        if (!nlh) {
                err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                goto send_done;
        }
@@ -1807,7 +1807,6 @@ send_done:
 nla_put_failure:
        err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
        genlmsg_cancel(skb, hdr);
        nlmsg_free(skb);
        return err;
@@ -2073,7 +2072,7 @@ static int devlink_dpipe_entries_fill(struct genl_info *info,
                                             table->counters_enabled,
                                             &dump_ctx);
        if (err)
-                goto err_entries_dump;
+                return err;
 send_done:
        nlh = nlmsg_put(dump_ctx.skb, info->snd_portid, info->snd_seq,
@@ -2081,16 +2080,10 @@ send_done:
        if (!nlh) {
                err = devlink_dpipe_send_and_alloc_skb(&dump_ctx.skb, info);
                if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                goto send_done;
        }
        return genlmsg_reply(dump_ctx.skb, info);
-err_entries_dump:
-err_skb_send_alloc:
-        genlmsg_cancel(dump_ctx.skb, dump_ctx.hdr);
-        nlmsg_free(dump_ctx.skb);
-        return err;
 }
 static int devlink_nl_cmd_dpipe_entries_get(struct sk_buff *skb,
@@ -2229,7 +2222,7 @@ send_done:
        if (!nlh) {
                err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                goto send_done;
        }
        return genlmsg_reply(skb, info);
@@ -2237,7 +2230,6 @@ send_done:
 nla_put_failure:
        err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
        genlmsg_cancel(skb, hdr);
        nlmsg_free(skb);
        return err;
diff --git a/net/core/filter.c b/net/core/filter.c
index c86f03fd9ea5..00c711c5f1a2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2283,6 +2283,10 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
        u32 off = skb_mac_header_len(skb);
        int ret;
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
        ret = skb_cow(skb, len_diff);
        if (unlikely(ret < 0))
                return ret;
@@ -2292,19 +2296,21 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
                return ret;
        if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
                /* SKB_GSO_TCPV4 needs to be changed into
                 * SKB_GSO_TCPV6.
                 */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+                if (shinfo->gso_type & SKB_GSO_TCPV4) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV4;
+                        shinfo->gso_type &= ~SKB_GSO_TCPV4;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV6;
+                        shinfo->gso_type |=  SKB_GSO_TCPV6;
                }
                /* Due to IPv6 header, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_segs = 0;
        }
        skb->protocol = htons(ETH_P_IPV6);
@@ -2319,6 +2325,10 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
        u32 off = skb_mac_header_len(skb);
        int ret;
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
        ret = skb_unclone(skb, GFP_ATOMIC);
        if (unlikely(ret < 0))
                return ret;
@@ -2328,19 +2338,21 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
                return ret;
        if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
                /* SKB_GSO_TCPV6 needs to be changed into
                 * SKB_GSO_TCPV4.
                 */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                if (shinfo->gso_type & SKB_GSO_TCPV6) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV6;
+                        shinfo->gso_type &= ~SKB_GSO_TCPV6;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV4;
+                        shinfo->gso_type |=  SKB_GSO_TCPV4;
                }
                /* Due to IPv4 header, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_segs = 0;
        }
        skb->protocol = htons(ETH_P_IP);
@@ -2439,6 +2451,10 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
        u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
        int ret;
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
        ret = skb_cow(skb, len_diff);
        if (unlikely(ret < 0))
                return ret;
@@ -2448,11 +2464,13 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
                return ret;
        if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
                /* Due to header grow, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_segs = 0;
        }
        return 0;
@@ -2463,6 +2481,10 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
        u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
        int ret;
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
        ret = skb_unclone(skb, GFP_ATOMIC);
        if (unlikely(ret < 0))
                return ret;
@@ -2472,11 +2494,13 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
                return ret;
        if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
                /* Due to header shrink, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_segs = 0;
        }
        return 0;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 715c13495ba6..46cb22215ff4 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4181,7 +4181,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
        skb_queue_tail(&sk->sk_error_queue, skb);
        if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk);
+                sk->sk_error_report(sk);
        return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -4906,7 +4906,7 @@ static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
                        thlen += inner_tcp_hdrlen(skb);
        } else if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
                thlen = tcp_hdrlen(skb);
-        } else if (unlikely(shinfo->gso_type & SKB_GSO_SCTP)) {
+        } else if (unlikely(skb_is_gso_sctp(skb))) {
                thlen = sizeof(struct sctphdr);
        }
        /* UFO sets gso_size to the size of the fragmentation
@@ -5022,13 +5022,16 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
+        int mac_len;
        if (skb_cow(skb, skb_headroom(skb)) < 0) {
                kfree_skb(skb);
                return NULL;
        }
-        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
+        mac_len = skb->data - skb_mac_header(skb);
-                2 * ETH_ALEN);
+        memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+                mac_len - VLAN_HLEN - ETH_TLEN);
        skb->mac_header += VLAN_HLEN;
        return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index f704324d1219..e689496dfd8a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3326,6 +3326,27 @@ void proto_unregister(struct proto *prot)
 }
 EXPORT_SYMBOL(proto_unregister);
+int sock_load_diag_module(int family, int protocol)
+{
+        if (!protocol) {
+                if (!sock_is_registered(family))
+                        return -ENOENT;
+                return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                                      NETLINK_SOCK_DIAG, family);
+        }
+#ifdef CONFIG_INET
+        if (family == AF_INET &&
+            !rcu_access_pointer(inet_protos[protocol]))
+                return -ENOENT;
+#endif
+        return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+                              NETLINK_SOCK_DIAG, family, protocol);
+}
+EXPORT_SYMBOL(sock_load_diag_module);
 #ifdef CONFIG_PROC_FS
 static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
        __acquires(proto_list_mutex)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index aee5642affd9..a3392a8f9276 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -220,8 +220,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
                return -EINVAL;
        if (sock_diag_handlers[req->sdiag_family] == NULL)
-                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                sock_load_diag_module(req->sdiag_family, 0);
-                                NETLINK_SOCK_DIAG, req->sdiag_family);
        mutex_lock(&sock_diag_table_mutex);
        hndl = sock_diag_handlers[req->sdiag_family];
@@ -247,8 +246,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
        case TCPDIAG_GETSOCK:
        case DCCPDIAG_GETSOCK:
                if (inet_rcv_compat == NULL)
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                        sock_load_diag_module(AF_INET, 0);
-                                        NETLINK_SOCK_DIAG, AF_INET);
                mutex_lock(&sock_diag_table_mutex);
                if (inet_rcv_compat != NULL)
@@ -281,14 +279,12 @@ static int sock_diag_bind(struct net *net, int group)
        case SKNLGRP_INET_TCP_DESTROY:
        case SKNLGRP_INET_UDP_DESTROY:
                if (!sock_diag_handlers[AF_INET])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                        sock_load_diag_module(AF_INET, 0);
-                                       NETLINK_SOCK_DIAG, AF_INET);
                break;
        case SKNLGRP_INET6_TCP_DESTROY:
        case SKNLGRP_INET6_UDP_DESTROY:
                if (!sock_diag_handlers[AF_INET6])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                        sock_load_diag_module(AF_INET6, 0);
-                                       NETLINK_SOCK_DIAG, AF_INET6);
                break;
        }
        return 0;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 15bdc002d90c..84cd4e3fd01b 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -794,6 +794,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
        if (skb == NULL)
                goto out_release;
+        if (sk->sk_state == DCCP_CLOSED) {
+                rc = -ENOTCONN;
+                goto out_discard;
+        }
        skb_reserve(skb, sk->sk_prot->max_header);
        rc = memcpy_from_msg(skb_put(skb, len), msg, len);
        if (rc != 0)
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index cb54b81d0bd9..42a7b85b84e1 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -194,7 +194,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                ds->ports[i].dn = cd->port_dn[i];
                ds->ports[i].cpu_dp = dst->cpu_dp;
-                if (dsa_is_user_port(ds, i))
+                if (!dsa_is_user_port(ds, i))
                        continue;
                ret = dsa_slave_create(&ds->ports[i]);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index e4f305320519..275449b0d633 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -207,9 +207,13 @@ static inline void lowpan_netlink_fini(void)
 static int lowpan_device_event(struct notifier_block *unused,
                               unsigned long event, void *ptr)
 {
-        struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
+        struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
+        struct wpan_dev *wpan_dev;
-        if (wdev->type != ARPHRD_IEEE802154)
+        if (ndev->type != ARPHRD_IEEE802154)
+                return NOTIFY_DONE;
+        wpan_dev = ndev->ieee802154_ptr;
+        if (!wpan_dev)
                return NOTIFY_DONE;
        switch (event) {
@@ -218,8 +222,8 @@ static int lowpan_device_event(struct notifier_block *unused,
                 * also delete possible lowpan interfaces which belongs
                 * to the wpan interface.
                 */
-                if (wdev->ieee802154_ptr->lowpan_dev)
+                if (wpan_dev->lowpan_dev)
-                        lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
+                        lowpan_dellink(wpan_dev->lowpan_dev, NULL);
                break;
        default:
                return NOTIFY_DONE;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a383f299ce24..4e5bc4b2f14e 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -53,8 +53,7 @@ static DEFINE_MUTEX(inet_diag_table_mutex);
 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
 {
        if (!inet_diag_table[proto])
-                request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+                sock_load_diag_module(AF_INET, proto);
-                               NETLINK_SOCK_DIAG, AF_INET, proto);
        mutex_lock(&inet_diag_table_mutex);
        if (!inet_diag_table[proto])
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 26a3d0315728..e8ec28999f5c 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -119,6 +119,9 @@ out:
 static bool inet_fragq_should_evict(const struct inet_frag_queue *q)
 {
+        if (!hlist_unhashed(&q->list_evictor))
+                return false;
        return q->net->low_thresh == 0 ||
               frag_mem_limit(q->net) >= q->net->low_thresh;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e74ee837b300..4ac5728689f5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -635,6 +635,7 @@ static inline u32 fnhe_hashfun(__be32 daddr)
 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
 {
        rt->rt_pmtu = fnhe->fnhe_pmtu;
+        rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
        rt->dst.expires = fnhe->fnhe_expires;
        if (fnhe->fnhe_gw) {
@@ -645,7 +646,7 @@ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnh
 }
 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
-                                  u32 pmtu, unsigned long expires)
+                                  u32 pmtu, bool lock, unsigned long expires)
 {
        struct fnhe_hash_bucket *hash;
        struct fib_nh_exception *fnhe;
@@ -682,8 +683,10 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                        fnhe->fnhe_genid = genid;
                if (gw)
                        fnhe->fnhe_gw = gw;
-                if (pmtu)
+                if (pmtu) {
                        fnhe->fnhe_pmtu = pmtu;
+                        fnhe->fnhe_mtu_locked = lock;
+                }
                fnhe->fnhe_expires = max(1UL, expires);
                /* Update all cached dsts too */
                rt = rcu_dereference(fnhe->fnhe_rth_input);
@@ -707,6 +710,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                fnhe->fnhe_daddr = daddr;
                fnhe->fnhe_gw = gw;
                fnhe->fnhe_pmtu = pmtu;
+                fnhe->fnhe_mtu_locked = lock;
                fnhe->fnhe_expires = expires;
                /* Exception created; mark the cached routes for the nexthop
@@ -788,7 +792,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                                struct fib_nh *nh = &FIB_RES_NH(res);
                                update_or_create_fnhe(nh, fl4->daddr, new_gw,
-                                                0, jiffies + ip_rt_gc_timeout);
+                                                0, false,
+                                                jiffies + ip_rt_gc_timeout);
                        }
                        if (kill_route)
                                rt->dst.obsolete = DST_OBSOLETE_KILL;
@@ -1010,15 +1015,18 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 {
        struct dst_entry *dst = &rt->dst;
        struct fib_result res;
+        bool lock = false;
-        if (dst_metric_locked(dst, RTAX_MTU))
+        if (ip_mtu_locked(dst))
                return;
        if (ipv4_mtu(dst) < mtu)
                return;
-        if (mtu < ip_rt_min_pmtu)
+        if (mtu < ip_rt_min_pmtu) {
+                lock = true;
                mtu = ip_rt_min_pmtu;
+        }
        if (rt->rt_pmtu == mtu &&
            time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
@@ -1028,7 +1036,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
        if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
                struct fib_nh *nh = &FIB_RES_NH(res);
-                update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
+                update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
                                      jiffies + ip_rt_mtu_expires);
        }
        rcu_read_unlock();
@@ -1281,7 +1289,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
        mtu = READ_ONCE(dst->dev->mtu);
-        if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
+        if (unlikely(ip_mtu_locked(dst))) {
                if (rt->rt_uses_gateway && mtu > 576)
                        mtu = 576;
        }
@@ -1394,7 +1402,7 @@ struct uncached_list {
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
-static void rt_add_uncached_list(struct rtable *rt)
+void rt_add_uncached_list(struct rtable *rt)
 {
        struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
@@ -1405,14 +1413,8 @@ static void rt_add_uncached_list(struct rtable *rt)
        spin_unlock_bh(&ul->lock);
 }
-static void ipv4_dst_destroy(struct dst_entry *dst)
+void rt_del_uncached_list(struct rtable *rt)
 {
-        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
-        struct rtable *rt = (struct rtable *) dst;
-        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
-                kfree(p);
        if (!list_empty(&rt->rt_uncached)) {
                struct uncached_list *ul = rt->rt_uncached_list;
@@ -1422,6 +1424,17 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
        }
 }
+static void ipv4_dst_destroy(struct dst_entry *dst)
+{
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
+        struct rtable *rt = (struct rtable *)dst;
+        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
+                kfree(p);
+        rt_del_uncached_list(rt);
+}
 void rt_flush_dev(struct net_device *dev)
 {
        struct net *net = dev_net(dev);
@@ -1517,6 +1530,7 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
                rt->rt_is_input = 0;
                rt->rt_iif = 0;
                rt->rt_pmtu = 0;
+                rt->rt_mtu_locked = 0;
                rt->rt_gateway = 0;
                rt->rt_uses_gateway = 0;
                INIT_LIST_HEAD(&rt->rt_uncached);
@@ -2533,6 +2547,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                rt->rt_is_input = ort->rt_is_input;
                rt->rt_iif = ort->rt_iif;
                rt->rt_pmtu = ort->rt_pmtu;
+                rt->rt_mtu_locked = ort->rt_mtu_locked;
                rt->rt_genid = rt_genid_ipv4(net);
                rt->rt_flags = ort->rt_flags;
@@ -2635,6 +2650,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
        memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
        if (rt->rt_pmtu && expires)
                metrics[RTAX_MTU - 1] = rt->rt_pmtu;
+        if (rt->rt_mtu_locked && expires)
+                metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
        if (rtnetlink_put_metrics(skb, metrics) < 0)
                goto nla_put_failure;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d763fae1b574..0c31be306572 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3545,6 +3545,7 @@ int tcp_abort(struct sock *sk, int err)
        bh_unlock_sock(sk);
        local_bh_enable();
+        tcp_write_queue_purge(sk);
        release_sock(sk);
        return 0;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 71fc60f1b326..f7d944855f8e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -34,6 +34,7 @@ static void tcp_write_err(struct sock *sk)
        sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
        sk->sk_error_report(sk);
+        tcp_write_queue_purge(sk);
        tcp_done(sk);
        __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
 }
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 63faeee989a9..2a9764bd1719 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
        skb_reset_network_header(skb);
        skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
        err = 0;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0c752dc3f93b..6c76a757fa4a 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -100,7 +100,9 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        xdst->u.rt.rt_gateway = rt->rt_gateway;
        xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
        xdst->u.rt.rt_pmtu = rt->rt_pmtu;
+        xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked;
        INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
+        rt_add_uncached_list(&xdst->u.rt);
        return 0;
 }
@@ -240,7 +242,8 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
        dst_destroy_metrics_generic(dst);
+        if (xdst->u.rt.rt_uncached_list)
+                rt_del_uncached_list(&xdst->u.rt);
        xfrm_dst_destroy(xdst);
 }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index b27333d7b099..88bc2ef7c7a8 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -146,10 +146,12 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
        struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
        struct inet_sock        *inet = inet_sk(sk);
        struct ipv6_pinfo       *np = inet6_sk(sk);
-        struct in6_addr         *daddr;
+        struct in6_addr         *daddr, old_daddr;
+        __be32                  fl6_flowlabel = 0;
+        __be32                  old_fl6_flowlabel;
+        __be16                  old_dport;
        int                     addr_type;
        int                     err;
-        __be32                  fl6_flowlabel = 0;
        if (usin->sin6_family == AF_INET) {
                if (__ipv6_only_sock(sk))
@@ -238,9 +240,13 @@ ipv4_connected:
                }
        }
+        /* save the current peer information before updating it */
+        old_daddr = sk->sk_v6_daddr;
+        old_fl6_flowlabel = np->flow_label;
+        old_dport = inet->inet_dport;
        sk->sk_v6_daddr = *daddr;
        np->flow_label = fl6_flowlabel;
        inet->inet_dport = usin->sin6_port;
        /*
@@ -250,11 +256,12 @@ ipv4_connected:
        err = ip6_datagram_dst_update(sk, true);
        if (err) {
-                /* Reset daddr and dport so that udp_v6_early_demux()
+                /* Restore the socket peer info, to keep it consistent with
-                 * fails to find this socket
+                 * the old socket state
                 */
-                memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
+                sk->sk_v6_daddr = old_daddr;
-                inet->inet_dport = 0;
+                np->flow_label = old_fl6_flowlabel;
+                inet->inet_dport = old_dport;
                goto out;
        }
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 6adbcf40cf8c..3a98c694da5f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -126,7 +126,8 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
        struct ip6_tnl *t, *cand = NULL;
        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
        int dev_type = (gre_proto == htons(ETH_P_TEB) ||
-                        gre_proto == htons(ETH_P_ERSPAN)) ?
+                        gre_proto == htons(ETH_P_ERSPAN) ||
+                        gre_proto == htons(ETH_P_ERSPAN2)) ?
                       ARPHRD_ETHER : ARPHRD_IP6GRE;
        int score, cand_score = 4;
@@ -905,6 +906,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                truncate = true;
        }
+        if (skb_cow_head(skb, dev->needed_headroom))
+                goto tx_err;
        t->parms.o_flags &= ~TUNNEL_KEY;
        IPCB(skb)->flags = 0;
@@ -947,6 +951,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                                               md->u.md2.dir,
                                               get_hwid(&md->u.md2),
                                               truncate, false);
+                } else {
+                        goto tx_err;
                }
        } else {
                switch (skb->protocol) {
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 10024eb0c521..d1d0b2fa7a07 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1554,7 +1554,8 @@ static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
        *(opt++) = (rd_len >> 3);
        opt += 6;
-        memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
+        skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
+                      rd_len - 8);
 }
 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 939d122e71b4..a2ed9fdd58d4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -128,7 +128,7 @@ struct uncached_list {
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);
-static void rt6_uncached_list_add(struct rt6_info *rt)
+void rt6_uncached_list_add(struct rt6_info *rt)
 {
        struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);
@@ -139,7 +139,7 @@ static void rt6_uncached_list_add(struct rt6_info *rt)
        spin_unlock_bh(&ul->lock);
 }
-static void rt6_uncached_list_del(struct rt6_info *rt)
+void rt6_uncached_list_del(struct rt6_info *rt)
 {
        if (!list_empty(&rt->rt6i_uncached)) {
                struct uncached_list *ul = rt->rt6i_uncached_list;
@@ -1514,7 +1514,30 @@ static void rt6_exceptions_remove_prefsrc(struct rt6_info *rt)
        }
 }
-static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
+static bool rt6_mtu_change_route_allowed(struct inet6_dev *idev,
+                                         struct rt6_info *rt, int mtu)
+{
+        /* If the new MTU is lower than the route PMTU, this new MTU will be the
+         * lowest MTU in the path: always allow updating the route PMTU to
+         * reflect PMTU decreases.
+         *
+         * If the new MTU is higher, and the route PMTU is equal to the local
+         * MTU, this means the old MTU is the lowest in the path, so allow
+         * updating it: if other nodes now have lower MTUs, PMTU discovery will
+         * handle this.
+         */
+        if (dst_mtu(&rt->dst) >= mtu)
+                return true;
+        if (dst_mtu(&rt->dst) == idev->cnf.mtu6)
+                return true;
+        return false;
+}
+static void rt6_exceptions_update_pmtu(struct inet6_dev *idev,
+                                       struct rt6_info *rt, int mtu)
 {
        struct rt6_exception_bucket *bucket;
        struct rt6_exception *rt6_ex;
@@ -1523,20 +1546,22 @@ static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
        bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
                                        lockdep_is_held(&rt6_exception_lock));
-        if (bucket) {
+        if (!bucket)
-                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                return;
-                        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
-                                struct rt6_info *entry = rt6_ex->rt6i;
+        for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
-                                /* For RTF_CACHE with rt6i_pmtu == 0
+                hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
-                                 * (i.e. a redirected route),
+                        struct rt6_info *entry = rt6_ex->rt6i;
-                                 * the metrics of its rt->dst.from has already
-                                 * been updated.
+                        /* For RTF_CACHE with rt6i_pmtu == 0 (i.e. a redirected
-                                 */
+                         * route), the metrics of its rt->dst.from have already
-                                if (entry->rt6i_pmtu && entry->rt6i_pmtu > mtu)
+                         * been updated.
-                                        entry->rt6i_pmtu = mtu;
+                         */
-                        }
+                        if (entry->rt6i_pmtu &&
-                        bucket++;
+                            rt6_mtu_change_route_allowed(idev, entry, mtu))
+                                entry->rt6i_pmtu = mtu;
                }
+                bucket++;
        }
 }
@@ -3899,25 +3924,13 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
           Since RFC 1981 doesn't include administrative MTU increase
           update PMTU increase is a MUST. (i.e. jumbo frame)
         */
-        /*
-           If new MTU is less than route PMTU, this new MTU will be the
-           lowest MTU in the path, update the route PMTU to reflect PMTU
-           decreases; if new MTU is greater than route PMTU, and the
-           old MTU is the lowest MTU in the path, update the route PMTU
-           to reflect the increase. In this case if the other nodes' MTU
-           also have the lowest MTU, TOO BIG MESSAGE will be lead to
-           PMTU discovery.
-         */
        if (rt->dst.dev == arg->dev &&
-            dst_metric_raw(&rt->dst, RTAX_MTU) &&
            !dst_metric_locked(&rt->dst, RTAX_MTU)) {
                spin_lock_bh(&rt6_exception_lock);
-                if (dst_mtu(&rt->dst) >= arg->mtu ||
+                if (dst_metric_raw(&rt->dst, RTAX_MTU) &&
-                    (dst_mtu(&rt->dst) < arg->mtu &&
+                    rt6_mtu_change_route_allowed(idev, rt, arg->mtu))
-                     dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
                        dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
-                }
+                rt6_exceptions_update_pmtu(idev, rt, arg->mtu);
-                rt6_exceptions_update_pmtu(rt, arg->mtu);
                spin_unlock_bh(&rt6_exception_lock);
        }
        return 0;
@@ -4189,6 +4202,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                                r_cfg.fc_encap_type = nla_get_u16(nla);
                }
+                r_cfg.fc_flags |= (rtnh->rtnh_flags & RTNH_F_ONLINK);
                rt = ip6_route_info_create(&r_cfg, extack);
                if (IS_ERR(rt)) {
                        err = PTR_ERR(rt);
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index bd6cc688bd19..7a78dcfda68a 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -93,7 +93,8 @@ static void set_tun_src(struct net *net, struct net_device *dev,
 /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */
 int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
 {
-        struct net *net = dev_net(skb_dst(skb)->dev);
+        struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(dst->dev);
        struct ipv6hdr *hdr, *inner_hdr;
        struct ipv6_sr_hdr *isrh;
        int hdrlen, tot_len, err;
@@ -134,7 +135,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
        isrh->nexthdr = proto;
        hdr->daddr = isrh->segments[isrh->first_segment];
-        set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr);
+        set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
 #ifdef CONFIG_IPV6_SEG6_HMAC
        if (sr_has_hmac(isrh)) {
@@ -418,7 +419,7 @@ static int seg6_build_state(struct nlattr *nla,
        slwt = seg6_lwt_lwtunnel(newts);
-        err = dst_cache_init(&slwt->cache, GFP_KERNEL);
+        err = dst_cache_init(&slwt->cache, GFP_ATOMIC);
        if (err) {
                kfree(newts);
                return err;
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index bb935a3b7fea..de1b0b8c53b0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
        skb_reset_network_header(skb);
        skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
        err = 0;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 88cd0c90fa81..cbb270bd81b0 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,9 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
        xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
        xdst->u.rt6.rt6i_src = rt->rt6i_src;
+        INIT_LIST_HEAD(&xdst->u.rt6.rt6i_uncached);
+        rt6_uncached_list_add(&xdst->u.rt6);
+        atomic_inc(&dev_net(dev)->ipv6.rt6_stats->fib_rt_uncache);
        return 0;
 }
@@ -244,6 +247,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
        if (likely(xdst->u.rt6.rt6i_idev))
                in6_dev_put(xdst->u.rt6.rt6i_idev);
        dst_destroy_metrics_generic(dst);
+        if (xdst->u.rt6.rt6i_uncached_list)
+                rt6_uncached_list_del(&xdst->u.rt6);
        xfrm_dst_destroy(xdst);
 }
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 81ce15ffb878..893a022f9620 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2432,9 +2432,11 @@ static int afiucv_iucv_init(void)
        af_iucv_dev->driver = &af_iucv_driver;
        err = device_register(af_iucv_dev);
        if (err)
-                goto out_driver;
+                goto out_iucv_dev;
        return 0;
+out_iucv_dev:
+        put_device(af_iucv_dev);
 out_driver:
        driver_unregister(&af_iucv_driver);
 out_iucv:
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index a6cd0712e063..516cfad71b85 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                .parse_msg = kcm_parse_func_strparser,
                .read_sock_done = kcm_read_sock_done,
        };
-        int err;
+        int err = 0;
        csk = csock->sk;
        if (!csk)
                return -EINVAL;
+        lock_sock(csk);
        /* Only allow TCP sockets to be attached for now */
        if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
-            csk->sk_protocol != IPPROTO_TCP)
+            csk->sk_protocol != IPPROTO_TCP) {
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
+                goto out;
+        }
        /* Don't allow listeners or closed sockets */
-        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
+        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
+                goto out;
+        }
        psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
-        if (!psock)
+        if (!psock) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
+        }
        psock->mux = mux;
        psock->sk = csk;
@@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
        err = strp_init(&psock->strp, csk, &cb);
        if (err) {
                kmem_cache_free(kcm_psockp, psock);
-                return err;
+                goto out;
        }
        write_lock_bh(&csk->sk_callback_lock);
@@ -1420,7 +1428,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                strp_stop(&psock->strp);
                strp_done(&psock->strp);
                kmem_cache_free(kcm_psockp, psock);
-                return -EALREADY;
+                err = -EALREADY;
+                goto out;
        }
        psock->save_data_ready = csk->sk_data_ready;
@@ -1456,7 +1465,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
        /* Schedule RX work in case there are already bytes queued */
        strp_check_rcv(&psock->strp);
-        return 0;
+out:
+        release_sock(csk);
+        return err;
 }
 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1508,6 +1520,7 @@ static void kcm_unattach(struct kcm_psock *psock)
        if (WARN_ON(psock->rx_kcm)) {
                write_unlock_bh(&csk->sk_callback_lock);
+                release_sock(csk);
                return;
        }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 189a12a5e4ac..b86868da50d4 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -111,6 +111,13 @@ struct l2tp_net {
        spinlock_t l2tp_session_hlist_lock;
 };
+#if IS_ENABLED(CONFIG_IPV6)
+static bool l2tp_sk_is_v6(struct sock *sk)
+{
+        return sk->sk_family == PF_INET6 &&
+               !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
+}
+#endif
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 {
@@ -1049,7 +1056,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
        /* Queue the packet to IP for output */
        skb->ignore_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+        if (l2tp_sk_is_v6(tunnel->sock))
                error = inet6_csk_xmit(tunnel->sock, skb, NULL);
        else
 #endif
@@ -1112,6 +1119,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                goto out_unlock;
        }
+        /* The user-space may change the connection status for the user-space
+         * provided socket at run time: we must check it under the socket lock
+         */
+        if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
+                kfree_skb(skb);
+                ret = NET_XMIT_DROP;
+                goto out_unlock;
+        }
        /* Get routing info from the tunnel socket */
        skb_dst_drop(skb);
        skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
@@ -1131,7 +1147,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
+                if (l2tp_sk_is_v6(sk))
                        udp6_set_csum(udp_get_no_check6_tx(sk),
                                      skb, &inet6_sk(sk)->saddr,
                                      &sk->sk_v6_daddr, udp_len);
@@ -1457,9 +1473,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                encap = cfg->encap;
        /* Quick sanity checks */
+        err = -EPROTONOSUPPORT;
+        if (sk->sk_type != SOCK_DGRAM) {
+                pr_debug("tunl %hu: fd %d wrong socket type\n",
+                         tunnel_id, fd);
+                goto err;
+        }
        switch (encap) {
        case L2TP_ENCAPTYPE_UDP:
-                err = -EPROTONOSUPPORT;
                if (sk->sk_protocol != IPPROTO_UDP) {
                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                               tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
@@ -1467,7 +1488,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                }
                break;
        case L2TP_ENCAPTYPE_IP:
-                err = -EPROTONOSUPPORT;
                if (sk->sk_protocol != IPPROTO_L2TP) {
                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                               tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
@@ -1507,24 +1527,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
        if (cfg != NULL)
                tunnel->debug = cfg->debug;
-#if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
-                if (ipv6_addr_v4mapped(&np->saddr) &&
-                    ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
-                        struct inet_sock *inet = inet_sk(sk);
-                        tunnel->v4mapped = true;
-                        inet->inet_saddr = np->saddr.s6_addr32[3];
-                        inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
-                        inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
-                } else {
-                        tunnel->v4mapped = false;
-                }
-        }
-#endif
        /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
        tunnel->encap = encap;
        if (encap == L2TP_ENCAPTYPE_UDP) {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a1aa9550f04e..2718d0b284d0 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,9 +188,6 @@ struct l2tp_tunnel {
        struct sock             *sock;          /* Parent socket */
        int                     fd;             /* Parent fd, if tunnel socket
                                                 * was created by userspace */
-#if IS_ENABLED(CONFIG_IPV6)
-        bool                    v4mapped;
-#endif
        struct work_struct      del_work;
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index a75653affbf7..b5adf3625d16 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -213,6 +213,7 @@ static const char *hw_flag_names[] = {
        FLAG(SUPPORTS_TX_FRAG),
        FLAG(SUPPORTS_TDLS_BUFFER_STA),
        FLAG(DEAUTH_NEED_MGD_TX_PREP),
+        FLAG(DOESNT_SUPPORT_QOS_NDP),
 #undef FLAG
 };
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0024eff9bb84..fe4aefb06d9f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -897,7 +897,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
        struct ieee80211_hdr_3addr *nullfunc;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, true);
+        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
+                !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
        if (!skb)
                return;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8e19c86d1aa6..fd13d28e4ca7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5423,6 +5423,7 @@ err:
 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
 {
        cancel_delayed_work_sync(&flowtable->data.gc_work);
+        kfree(flowtable->ops);
        kfree(flowtable->name);
        flowtable->data.type->free(&flowtable->data);
        rhashtable_destroy(&flowtable->data.rhashtable);
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 3f1624ee056f..d40591fe1b2f 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -674,7 +674,7 @@ static const struct nft_set_ops *
 nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
                    u32 flags)
 {
-        if (desc->size) {
+        if (desc->size && !(flags & NFT_SET_TIMEOUT)) {
                switch (desc->klen) {
                case 4:
                        return &nft_hash_fast_ops;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d9deebe599ec..6de1f6a4cb80 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
        return buf;
 }
+/**
+ * xt_check_proc_name - check that name is suitable for /proc file creation
+ *
+ * @name: file name candidate
+ * @size: length of buffer
+ *
+ * some x_tables modules wish to create a file in /proc.
+ * This function makes sure that the name is suitable for this
+ * purpose, it checks that name is NUL terminated and isn't a 'special'
+ * name, like "..".
+ *
+ * returns negative number on error or 0 if name is useable.
+ */
+int xt_check_proc_name(const char *name, unsigned int size)
+{
+        if (name[0] == '\0')
+                return -EINVAL;
+        if (strnlen(name, size) == size)
+                return -ENAMETOOLONG;
+        if (strcmp(name, ".") == 0 ||
+            strcmp(name, "..") == 0 ||
+            strchr(name, '/'))
+                return -EINVAL;
+        return 0;
+}
+EXPORT_SYMBOL(xt_check_proc_name);
 int xt_check_match(struct xt_mtchk_param *par,
                   unsigned int size, u_int8_t proto, bool inv_proto)
 {
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index db2fe0911740..ef65b7a9173e 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -917,8 +917,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
        struct hashlimit_cfg3 cfg = {};
        int ret;
-        if (info->name[sizeof(info->name) - 1] != '\0')
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
-                return -EINVAL;
+        if (ret)
+                return ret;
        ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
@@ -935,8 +936,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
        struct hashlimit_cfg3 cfg = {};
        int ret;
-        if (info->name[sizeof(info->name) - 1] != '\0')
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
-                return -EINVAL;
+        if (ret)
+                return ret;
        ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
@@ -950,9 +952,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
 static int hashlimit_mt_check(const struct xt_mtchk_param *par)
 {
        struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
+        int ret;
-        if (info->name[sizeof(info->name) - 1] != '\0')
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
-                return -EINVAL;
+        if (ret)
+                return ret;
        return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg,
                                         info->name, 3);
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 19efdb757944..486dd24da78b 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
                                    info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
                return -EINVAL;
        }
-        if (info->name[0] == '\0' ||
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
-            strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
+        if (ret)
-                return -EINVAL;
+                return ret;
        if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot)
                nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index a6f63a5faee7..af51b8c0a2cb 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1107,7 +1107,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
        if (!err)
                delivered = true;
        else if (err != -ESRCH)
-                goto error;
+                return err;
        return delivered ? 0 : -ESRCH;
 error:
        kfree_skb(skb);
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index 04b94281a30b..b891a91577f8 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -242,14 +242,20 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
                band->type = nla_get_u32(attr[OVS_BAND_ATTR_TYPE]);
                band->rate = nla_get_u32(attr[OVS_BAND_ATTR_RATE]);
+                if (band->rate == 0) {
+                        err = -EINVAL;
+                        goto exit_free_meter;
+                }
                band->burst_size = nla_get_u32(attr[OVS_BAND_ATTR_BURST]);
                /* Figure out max delta_t that is enough to fill any bucket.
                 * Keep max_delta_t size to the bucket units:
                 * pkts => 1/1000 packets, kilobits => bits.
+                 *
+                 * Start with a full bucket.
                 */
-                band_max_delta_t = (band->burst_size + band->rate) * 1000;
+                band->bucket = (band->burst_size + band->rate) * 1000;
-                /* Start with a full bucket. */
+                band_max_delta_t = band->bucket / band->rate;
-                band->bucket = band_max_delta_t;
                if (band_max_delta_t > meter->max_delta_t)
                        meter->max_delta_t = band_max_delta_t;
                band++;
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index da72e0cf2b1f..5cb9b268e8ff 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -352,7 +352,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
        return res;
 out:
        if (res == ACT_P_CREATED)
-                tcf_idr_cleanup(*act, est);
+                tcf_idr_release(*act, bind);
        return ret;
 }
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 1fb1f1f6a555..a527e287c086 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -350,7 +350,7 @@ static int tcf_csum_sctp(struct sk_buff *skb, unsigned int ihl,
 {
        struct sctphdr *sctph;
-        if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                return 1;
        sctph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*sctph));
@@ -626,7 +626,8 @@ static void tcf_csum_cleanup(struct tc_action *a)
        struct tcf_csum_params *params;
        params = rcu_dereference_protected(p->params, 1);
-        kfree_rcu(params, rcu);
+        if (params)
+                kfree_rcu(params, rcu);
 }
 static int tcf_csum_walker(struct net *net, struct sk_buff *skb,
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 10866717f88e..b5e8565b89c7 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -80,9 +80,12 @@ static void ipt_destroy_target(struct xt_entry_target *t)
 static void tcf_ipt_release(struct tc_action *a)
 {
        struct tcf_ipt *ipt = to_ipt(a);
-        ipt_destroy_target(ipt->tcfi_t);
+        if (ipt->tcfi_t) {
+                ipt_destroy_target(ipt->tcfi_t);
+                kfree(ipt->tcfi_t);
+        }
        kfree(ipt->tcfi_tname);
-        kfree(ipt->tcfi_t);
 }
 static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
@@ -187,7 +190,7 @@ err2:
        kfree(tname);
 err1:
        if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
        return err;
 }
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 5e8cc8f63acd..f392ccaaa0d8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -176,7 +176,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                p = to_pedit(*a);
                keys = kmalloc(ksize, GFP_KERNEL);
                if (keys == NULL) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                        kfree(keys_ex);
                        return -ENOMEM;
                }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 51fe4fe343f7..7081ec75e696 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -196,7 +196,7 @@ failure:
        qdisc_put_rtab(P_tab);
        qdisc_put_rtab(R_tab);
        if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
        return err;
 }
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 238dfd27e995..3a89f98f17e6 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -103,7 +103,8 @@ static void tcf_sample_cleanup(struct tc_action *a)
        psample_group = rtnl_dereference(s->psample_group);
        RCU_INIT_POINTER(s->psample_group, NULL);
-        psample_group_put(psample_group);
+        if (psample_group)
+                psample_group_put(psample_group);
 }
 static bool tcf_sample_dev_ok_push(struct net_device *dev)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 91816d73f3f3..e84768ae610a 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -121,7 +121,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                d = to_defact(*a);
                ret = alloc_defdata(d, defdata);
                if (ret < 0) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                        return ret;
                }
                d->tcf_action = parm->action;
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index febec75f4f7a..142a996ac776 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -152,7 +152,7 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
        ASSERT_RTNL();
        p = kzalloc(sizeof(struct tcf_skbmod_params), GFP_KERNEL);
        if (unlikely(!p)) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                        tcf_idr_release(*a, bind);
                return -ENOMEM;
        }
@@ -190,7 +190,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a)
        struct tcf_skbmod_params  *p;
        p = rcu_dereference_protected(d->skbmod_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 9169b7e78ada..a1c8dd406a04 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
                break;
        default:
+                ret = -EINVAL;
                goto err_out;
        }
@@ -207,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a)
        struct tcf_tunnel_key_params *params;
        params = rcu_dereference_protected(t->params, 1);
+        if (params) {
+                if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+                        dst_release(&params->tcft_enc_metadata->dst);
-        if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+                kfree_rcu(params, rcu);
-                dst_release(&params->tcft_enc_metadata->dst);
+        }
-        kfree_rcu(params, rcu);
 }
 static int tunnel_key_dump_addresses(struct sk_buff *skb,
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index c2ee7fd51cc9..4595391c2129 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -195,7 +195,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
        ASSERT_RTNL();
        p = kzalloc(sizeof(*p), GFP_KERNEL);
        if (!p) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                        tcf_idr_release(*a, bind);
                return -ENOMEM;
        }
@@ -225,7 +225,8 @@ static void tcf_vlan_cleanup(struct tc_action *a)
        struct tcf_vlan_params *p;
        p = rcu_dereference_protected(v->vlan_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 static int tcf_vlan_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 190570f21b20..7e3fbe9cc936 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -106,6 +106,14 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
        __skb_queue_tail(&q->skb_bad_txq, skb);
+        if (qdisc_is_percpu_stats(q)) {
+                qdisc_qstats_cpu_backlog_inc(q, skb);
+                qdisc_qstats_cpu_qlen_inc(q);
+        } else {
+                qdisc_qstats_backlog_inc(q, skb);
+                q->q.qlen++;
+        }
        if (lock)
                spin_unlock(lock);
 }
@@ -196,14 +204,6 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,
                        break;
                if (unlikely(skb_get_queue_mapping(nskb) != mapping)) {
                        qdisc_enqueue_skb_bad_txq(q, nskb);
-                        if (qdisc_is_percpu_stats(q)) {
-                                qdisc_qstats_cpu_backlog_inc(q, nskb);
-                                qdisc_qstats_cpu_qlen_inc(q);
-                        } else {
-                                qdisc_qstats_backlog_inc(q, nskb);
-                                q->q.qlen++;
-                        }
                        break;
                }
                skb->next = nskb;
@@ -628,6 +628,7 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
        int band = prio2band[skb->priority & TC_PRIO_MAX];
        struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
        struct skb_array *q = band2list(priv, band);
+        unsigned int pkt_len = qdisc_pkt_len(skb);
        int err;
        err = skb_array_produce(q, skb);
@@ -636,7 +637,10 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
                return qdisc_drop_cpu(skb, qdisc, to_free);
        qdisc_qstats_cpu_qlen_inc(qdisc);
-        qdisc_qstats_cpu_backlog_inc(qdisc, skb);
+        /* Note: skb can not be used after skb_array_produce(),
+         * so we better not use qdisc_qstats_cpu_backlog_inc()
+         */
+        this_cpu_add(qdisc->cpu_qstats->backlog, pkt_len);
        return NET_XMIT_SUCCESS;
 }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7c179addebcd..7d6801fc5340 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -509,7 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
        }
        if (unlikely(sch->q.qlen >= sch->limit))
-                return qdisc_drop(skb, sch, to_free);
+                return qdisc_drop_all(skb, sch, to_free);
        qdisc_qstats_backlog_inc(sch, skb);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0247cc432e02..b381d78548ac 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -106,6 +106,7 @@ int sctp_rcv(struct sk_buff *skb)
        int family;
        struct sctp_af *af;
        struct net *net = dev_net(skb->dev);
+        bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
        if (skb->pkt_type != PACKET_HOST)
                goto discard_it;
@@ -123,8 +124,7 @@ int sctp_rcv(struct sk_buff *skb)
         * it's better to just linearize it otherwise crc computing
         * takes longer.
         */
-        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+        if ((!is_gso && skb_linearize(skb)) ||
-             skb_linearize(skb)) ||
            !pskb_may_pull(skb, sizeof(struct sctphdr)))
                goto discard_it;
@@ -135,7 +135,7 @@ int sctp_rcv(struct sk_buff *skb)
        if (skb_csum_unnecessary(skb))
                __skb_decr_checksum_unnecessary(skb);
        else if (!sctp_checksum_disable &&
-                 !(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+                 !is_gso &&
                 sctp_rcv_checksum(net, skb) < 0)
                goto discard_it;
        skb->csum_valid = 1;
@@ -1218,7 +1218,7 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
         * issue as packets hitting this are mostly INIT or INIT-ACK and
         * those cannot be on GSO-style anyway.
         */
-        if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                return NULL;
        ch = (struct sctp_chunkhdr *)skb->data;
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 48392552ee7c..23ebc5318edc 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,7 +170,7 @@ next_chunk:
                chunk = list_entry(entry, struct sctp_chunk, list);
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
+                if (skb_is_gso(chunk->skb) && skb_is_gso_sctp(chunk->skb)) {
                        /* GSO-marked skbs but without frags, handle
                         * them normally
                         */
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 35bc7106d182..123e9f2dc226 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -45,7 +45,7 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
        struct sk_buff *segs = ERR_PTR(-EINVAL);
        struct sctphdr *sh;
-        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
+        if (!skb_is_gso_sctp(skb))
                goto out;
        sh = sctp_hdr(skb);
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 86913eb5cfa0..5f8046c62d90 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -983,10 +983,6 @@ out:
                lsmc->clcsock = NULL;
        }
        release_sock(lsk);
-        /* no more listening, wake up smc_close_wait_listen_clcsock and
-         * accept
-         */
-        lsk->sk_state_change(lsk);
        sock_put(&lsmc->sk); /* sock_hold in smc_listen */
 }
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index e339c0186dcf..fa41d9881741 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -30,27 +30,6 @@ static void smc_close_cleanup_listen(struct sock *parent)
                smc_close_non_accepted(sk);
 }
-static void smc_close_wait_listen_clcsock(struct smc_sock *smc)
-{
-        DEFINE_WAIT_FUNC(wait, woken_wake_function);
-        struct sock *sk = &smc->sk;
-        signed long timeout;
-        timeout = SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME;
-        add_wait_queue(sk_sleep(sk), &wait);
-        do {
-                release_sock(sk);
-                if (smc->clcsock)
-                        timeout = wait_woken(&wait, TASK_UNINTERRUPTIBLE,
-                                             timeout);
-                sched_annotate_sleep();
-                lock_sock(sk);
-                if (!smc->clcsock)
-                        break;
-        } while (timeout);
-        remove_wait_queue(sk_sleep(sk), &wait);
-}
 /* wait for sndbuf data being transmitted */
 static void smc_close_stream_wait(struct smc_sock *smc, long timeout)
 {
@@ -204,9 +183,11 @@ again:
                        rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
                        /* wake up kernel_accept of smc_tcp_listen_worker */
                        smc->clcsock->sk->sk_data_ready(smc->clcsock->sk);
-                        smc_close_wait_listen_clcsock(smc);
                }
                smc_close_cleanup_listen(sk);
+                release_sock(sk);
+                flush_work(&smc->tcp_listen_work);
+                lock_sock(sk);
                break;
        case SMC_ACTIVE:
                smc_close_stream_wait(smc, timeout);
diff --git a/net/socket.c b/net/socket.c
index d9a1ac233b35..3d1948d27a25 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2590,6 +2590,11 @@ void sock_unregister(int family)
 }
 EXPORT_SYMBOL(sock_unregister);
+bool sock_is_registered(int family)
+{
+        return family < NPROTO && rcu_access_pointer(net_families[family]);
+}
 static int __init sock_init(void)
 {
        int err;
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index ccfdc7115a83..a00ec715aa46 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name)
                struct crypto_comp *tfm;
                /* This can be any valid CPU ID so we don't need locking. */
-                tfm = __this_cpu_read(*pos->tfms);
+                tfm = this_cpu_read(*pos->tfms);
                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
                        pos->users++;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 77d9d1ab05ce..cb3bb9ae4407 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1458,10 +1458,13 @@ xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl,
 static int xfrm_get_tos(const struct flowi *fl, int family)
 {
        const struct xfrm_policy_afinfo *afinfo;
-        int tos = 0;
+        int tos;
        afinfo = xfrm_policy_get_afinfo(family);
-        tos = afinfo ? afinfo->get_tos(fl) : 0;
+        if (!afinfo)
+                return 0;
+        tos = afinfo->get_tos(fl);
        rcu_read_unlock();
@@ -1891,7 +1894,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
        spin_unlock(&pq->hold_queue.lock);
        dst_hold(xfrm_dst_path(dst));
-        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, 0);
+        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, XFRM_LOOKUP_QUEUE);
        if (IS_ERR(dst))
                goto purge_queue;
@@ -2729,14 +2732,14 @@ static const void *xfrm_get_dst_nexthop(const struct dst_entry *dst,
        while (dst->xfrm) {
                const struct xfrm_state *xfrm = dst->xfrm;
+                dst = xfrm_dst_child(dst);
                if (xfrm->props.mode == XFRM_MODE_TRANSPORT)
                        continue;
                if (xfrm->type->flags & XFRM_TYPE_REMOTE_COADDR)
                        daddr = xfrm->coaddr;
                else if (!(xfrm->type->flags & XFRM_TYPE_LOCAL_COADDR))
                        daddr = &xfrm->id.daddr;
-                dst = xfrm_dst_child(dst);
        }
        return daddr;
 }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 1d38c6acf8af..9e3a5e85f828 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -660,7 +660,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff
                } else {
                        XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
                        XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
-                        xo->seq.low = oseq = oseq + 1;
+                        xo->seq.low = oseq + 1;
                        xo->seq.hi = oseq_hi;
                        oseq += skb_shinfo(skb)->gso_segs;
                }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 54e21f19d722..f9d2f2233f09 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
        struct xfrm_mgr *km;
        struct xfrm_policy *pol = NULL;
+#ifdef CONFIG_COMPAT
+        if (in_compat_syscall())
+                return -EOPNOTSUPP;
+#endif
        if (!optval && !optlen) {
                xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
                xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index aff2e84ec761..e92b8c019c88 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
        struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
        struct xfrm_replay_state_esn *rs;
-        if (p->flags & XFRM_STATE_ESN) {
+        if (!rt)
-                if (!rt)
+                return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
-                        return -EINVAL;
-                rs = nla_data(rt);
+        rs = nla_data(rt);
-                if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+        if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
-                        return -EINVAL;
+                return -EINVAL;
-                if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
-                    nla_len(rt) != sizeof(*rs))
-                        return -EINVAL;
-        }
-        if (!rt)
+        if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
-                return 0;
+            nla_len(rt) != sizeof(*rs))
+                return -EINVAL;
        /* As only ESP and AH support ESN feature. */
        if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 5589bae34af6..a6f538b31ad6 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -297,11 +297,11 @@ cmd_dt_S_dtb=						\
        echo '\#include <asm-generic/vmlinux.lds.h>';   \
        echo '.section .dtb.init.rodata,"a"';           \
        echo '.balign STRUCT_ALIGNMENT';                \
-        echo '.global __dtb_$(*F)_begin';               \
+        echo '.global __dtb_$(subst -,_,$(*F))_begin';  \
-        echo '__dtb_$(*F)_begin:';                      \
+        echo '__dtb_$(subst -,_,$(*F))_begin:';         \
        echo '.incbin "$<" ';                           \
-        echo '__dtb_$(*F)_end:';                        \
+        echo '__dtb_$(subst -,_,$(*F))_end:';           \
-        echo '.global __dtb_$(*F)_end';                 \
+        echo '.global __dtb_$(subst -,_,$(*F))_end';    \
        echo '.balign STRUCT_ALIGNMENT';                \
 ) > $@
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index fa3d39b6f23b..449b68c4c90c 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -93,14 +93,6 @@
 * (Note: it'd be easy to port over the complete mkdep state machine,
 *  but I don't think the added complexity is worth it)
 */
-/*
- * Note 2: if somebody writes HELLO_CONFIG_BOOM in a file, it will depend onto
- * CONFIG_BOOM. This could seem a bug (not too hard to fix), but please do not
- * fix it! Some UserModeLinux files (look at arch/um/) call CONFIG_BOOM as
- * UML_CONFIG_BOOM, to avoid conflicts with /usr/include/linux/autoconf.h,
- * through arch/um/include/uml-config.h; this fixdep "bug" makes sure that
- * those files will have correct dependencies.
- */
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -233,8 +225,13 @@ static int str_ends_with(const char *s, int slen, const char *sub)
 static void parse_config_file(const char *p)
 {
        const char *q, *r;
+        const char *start = p;
        while ((p = strstr(p, "CONFIG_"))) {
+                if (p > start && (isalnum(p[-1]) || p[-1] == '_')) {
+                        p += 7;
+                        continue;
+                }
                p += 7;
                q = p;
                while (*q && (isalnum(*q) || *q == '_'))
@@ -286,8 +283,6 @@ static int is_ignored_file(const char *s, int len)
 {
        return str_ends_with(s, len, "include/generated/autoconf.h") ||
               str_ends_with(s, len, "include/generated/autoksyms.h") ||
-               str_ends_with(s, len, "arch/um/include/uml-config.h") ||
-               str_ends_with(s, len, "include/linux/kconfig.h") ||
               str_ends_with(s, len, ".ver");
 }
diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 94b664817ad9..d84a5674e95e 100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
@@ -15,7 +15,7 @@ signal(SIGPIPE, SIG_DFL)
 if len(sys.argv) < 3:
    sys.stderr.write("usage: %s [option] file1 file2\n" % sys.argv[0])
    sys.stderr.write("The options are:\n")
-    sys.stderr.write("-c        cateogrize output based on symbole type\n")
+    sys.stderr.write("-c        categorize output based on symbol type\n")
    sys.stderr.write("-d        Show delta of Data Section\n")
    sys.stderr.write("-t        Show delta of text Section\n")
    sys.exit(-1)
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index b044c0a5a674..02298c9c6020 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1762,10 +1762,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                return -ENOMEM;
        _snd_pcm_hw_params_any(params);
        err = snd_pcm_hw_refine(substream, params);
-        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
-        kfree(params);
        if (err < 0)
-                return err;
+                goto error;
+        format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT);
        for (fmt = 0; fmt < 32; ++fmt) {
                if (snd_mask_test(format_mask, fmt)) {
                        int f = snd_pcm_oss_format_to(fmt);
@@ -1773,7 +1772,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                                formats |= f;
                }
        }
-        return formats;
+ error:
+        kfree(params);
+        return err < 0 ? err : formats;
 }
 static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 04d4db44fae5..61a07fe34cd2 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -255,12 +255,12 @@ static int seq_free_client1(struct snd_seq_client *client)
        if (!client)
                return 0;
-        snd_seq_delete_all_ports(client);
-        snd_seq_queue_client_leave(client->number);
        spin_lock_irqsave(&clients_lock, flags);
        clienttablock[client->number] = 1;
        clienttab[client->number] = NULL;
        spin_unlock_irqrestore(&clients_lock, flags);
+        snd_seq_delete_all_ports(client);
+        snd_seq_queue_client_leave(client->number);
        snd_use_lock_sync(&client->use_lock);
        snd_seq_queue_client_termination(client->number);
        if (client->pool)
@@ -910,7 +910,8 @@ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop)
 static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
                                        struct snd_seq_event *event,
                                        struct file *file, int blocking,
-                                        int atomic, int hop)
+                                        int atomic, int hop,
+                                        struct mutex *mutexp)
 {
        struct snd_seq_event_cell *cell;
        int err;
@@ -948,7 +949,8 @@ static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
                return -ENXIO; /* queue is not allocated */
        /* allocate an event cell */
-        err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file);
+        err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic,
+                                file, mutexp);
        if (err < 0)
                return err;
@@ -1017,12 +1019,11 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                return -ENXIO;
        /* allocate the pool now if the pool is not allocated yet */ 
+        mutex_lock(&client->ioctl_mutex);
        if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-                mutex_lock(&client->ioctl_mutex);
                err = snd_seq_pool_init(client->pool);
-                mutex_unlock(&client->ioctl_mutex);
                if (err < 0)
-                        return -ENOMEM;
+                        goto out;
        }
        /* only process whole events */
@@ -1073,7 +1074,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                /* ok, enqueue it */
                err = snd_seq_client_enqueue_event(client, &event, file,
                                                   !(file->f_flags & O_NONBLOCK),
-                                                   0, 0);
+                                                   0, 0, &client->ioctl_mutex);
                if (err < 0)
                        break;
@@ -1084,6 +1085,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
                written += len;
        }
+ out:
+        mutex_unlock(&client->ioctl_mutex);
        return written ? written : err;
 }
@@ -1838,9 +1841,11 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client,
            (! snd_seq_write_pool_allocated(client) ||
             info->output_pool != client->pool->size)) {
                if (snd_seq_write_pool_allocated(client)) {
+                        /* is the pool in use? */
+                        if (atomic_read(&client->pool->counter))
+                                return -EBUSY;
                        /* remove all existing cells */
                        snd_seq_pool_mark_closing(client->pool);
-                        snd_seq_queue_client_leave_cells(client->number);
                        snd_seq_pool_done(client->pool);
                }
                client->pool->size = info->output_pool;
@@ -2260,7 +2265,8 @@ static int kernel_client_enqueue(int client, struct snd_seq_event *ev,
        if (! cptr->accept_output)
                result = -EPERM;
        else /* send it */
-                result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop);
+                result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+                                                      atomic, hop, NULL);
        snd_seq_client_unlock(cptr);
        return result;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index a8c2822e0198..72c0302a55d2 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f,
                return -EINVAL;
        snd_use_lock_use(&f->use_lock);
-        err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
+        err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */
        if (err < 0) {
                if ((err == -ENOMEM) || (err == -EAGAIN))
                        atomic_inc(&f->overflow);
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index f763682584a8..ab1112e90f88 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_event_cell * cell)
 */
 static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
                              struct snd_seq_event_cell **cellp,
-                              int nonblock, struct file *file)
+                              int nonblock, struct file *file,
+                              struct mutex *mutexp)
 {
        struct snd_seq_event_cell *cell;
        unsigned long flags;
@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
                set_current_state(TASK_INTERRUPTIBLE);
                add_wait_queue(&pool->output_sleep, &wait);
                spin_unlock_irq(&pool->lock);
+                if (mutexp)
+                        mutex_unlock(mutexp);
                schedule();
+                if (mutexp)
+                        mutex_lock(mutexp);
                spin_lock_irq(&pool->lock);
                remove_wait_queue(&pool->output_sleep, &wait);
                /* interrupted? */
@@ -287,7 +292,7 @@ __error:
 */
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
                      struct snd_seq_event_cell **cellp, int nonblock,
-                      struct file *file)
+                      struct file *file, struct mutex *mutexp)
 {
        int ncells, err;
        unsigned int extlen;
@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
        if (ncells >= pool->total_elements)
                return -ENOMEM;
-        err = snd_seq_cell_alloc(pool, &cell, nonblock, file);
+        err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp);
        if (err < 0)
                return err;
@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
                        int size = sizeof(struct snd_seq_event);
                        if (len < size)
                                size = len;
-                        err = snd_seq_cell_alloc(pool, &tmp, nonblock, file);
+                        err = snd_seq_cell_alloc(pool, &tmp, nonblock, file,
+                                                 mutexp);
                        if (err < 0)
                                goto __error;
                        if (cell->event.data.ext.ptr == NULL)
diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h
index 32f959c17786..3abe306c394a 100644
--- a/sound/core/seq/seq_memory.h
+++ b/sound/core/seq/seq_memory.h
@@ -66,7 +66,8 @@ struct snd_seq_pool {
 void snd_seq_cell_free(struct snd_seq_event_cell *cell);
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
-                      struct snd_seq_event_cell **cellp, int nonblock, struct file *file);
+                      struct snd_seq_event_cell **cellp, int nonblock,
+                      struct file *file, struct mutex *mutexp);
 /* return number of unused (free) cells */
 static inline int snd_seq_unused_cells(struct snd_seq_pool *pool)
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
index bc1c8488fc2a..2bc6759e4adc 100644
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo)
        if (f->cells > 0) {
                /* drain prioQ */
                while (f->cells > 0)
-                        snd_seq_cell_free(snd_seq_prioq_cell_out(f));
+                        snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL));
        }
        
        kfree(f);
@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f,
        return 0;
 }
+/* return 1 if the current time >= event timestamp */
+static int event_is_ready(struct snd_seq_event *ev, void *current_time)
+{
+        if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK)
+                return snd_seq_compare_tick_time(current_time, &ev->time.tick);
+        else
+                return snd_seq_compare_real_time(current_time, &ev->time.time);
+}
 /* dequeue cell from prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time)
 {
        struct snd_seq_event_cell *cell;
        unsigned long flags;
@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
        spin_lock_irqsave(&f->lock, flags);
        cell = f->head;
+        if (cell && current_time && !event_is_ready(&cell->event, current_time))
+                cell = NULL;
        if (cell) {
                f->head = cell->next;
@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f)
        return f->cells;
 }
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f)
-{
-        if (f == NULL) {
-                pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n");
-                return NULL;
-        }
-        return f->head;
-}
 static inline int prioq_match(struct snd_seq_event_cell *cell,
                              int client, int timestamp)
 {
diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h
index d38bb78d9345..2c315ca10fc4 100644
--- a/sound/core/seq/seq_prioq.h
+++ b/sound/core/seq/seq_prioq.h
@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo);
 int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell);
 /* dequeue cell from prioq */ 
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f);
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+                                                  void *current_time);
 /* return number of events available in prioq */
 int snd_seq_prioq_avail(struct snd_seq_prioq *f);
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f);
 /* client left queue */
 void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp);        
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 0428e9061b47..b377f5048352 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
      __again:
        /* Process tick queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) {
+        for (;;) {
-                if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick,
+                cell = snd_seq_prioq_cell_out(q->tickq,
-                                              &cell->event.time.tick)) {
+                                              &q->timer->tick.cur_tick);
-                        cell = snd_seq_prioq_cell_out(q->tickq);
+                if (!cell)
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
                        break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
        }
        /* Process time queue... */
-        while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) {
+        for (;;) {
-                if (snd_seq_compare_real_time(&q->timer->cur_time,
+                cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time);
-                                              &cell->event.time.time)) {
+                if (!cell)
-                        cell = snd_seq_prioq_cell_out(q->timeq);
-                        if (cell)
-                                snd_seq_dispatch_event(cell, atomic, hop);
-                } else {
-                        /* event remains in the queue */
                        break;
-                }
+                snd_seq_dispatch_event(cell, atomic, hop);
        }
        /* free lock */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 96143df19b21..d5017adf9feb 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -181,11 +181,15 @@ static const struct kernel_param_ops param_ops_xint = {
 };
 #define param_check_xint param_check_int
-static int power_save = -1;
+static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
 module_param(power_save, xint, 0644);
 MODULE_PARM_DESC(power_save, "Automatic power-saving timeout "
                 "(in second, 0 = disable).");
+static bool pm_blacklist = true;
+module_param(pm_blacklist, bool, 0644);
+MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist");
 /* reset the HD-audio controller in power save mode.
 * this may give more power-saving, but will take longer time to
 * wake up.
@@ -2300,10 +2304,9 @@ static int azx_probe_continue(struct azx *chip)
        val = power_save;
 #ifdef CONFIG_PM
-        if (val == -1) {
+        if (pm_blacklist) {
                const struct snd_pci_quirk *q;
-                val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT;
                q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist);
                if (q && val) {
                        dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n",
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 37e1cf8218ff..5b4dbcec6de8 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -957,6 +957,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
        SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
        SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
        SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
        SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
        SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b9c93fa0a51c..9af301c6bba2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5274,6 +5274,16 @@ static void alc298_fixup_speaker_volume(struct hda_codec *codec,
        }
 }
+/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */
+static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+                                      const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                hda_nid_t conn[2] = { 0x02, 0x03 };
+                snd_hda_override_conn_list(codec, 0x17, 2, conn);
+        }
+}
 /* Hook to update amp GPIO4 for automute */
 static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
                                          struct hda_jack_callback *jack)
@@ -5466,6 +5476,7 @@ enum {
        ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
        ALC255_FIXUP_DELL_SPK_NOISE,
        ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+        ALC295_FIXUP_DISABLE_DAC3,
        ALC280_FIXUP_HP_HEADSET_MIC,
        ALC221_FIXUP_HP_FRONT_MIC,
        ALC292_FIXUP_TPT460,
@@ -5480,10 +5491,12 @@ enum {
        ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
        ALC233_FIXUP_LENOVO_MULTI_CODECS,
        ALC294_FIXUP_LENOVO_MIC_LOCATION,
+        ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
        ALC700_FIXUP_INTEL_REFERENCE,
        ALC274_FIXUP_DELL_BIND_DACS,
        ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
        ALC298_FIXUP_TPT470_DOCK,
+        ALC255_FIXUP_DUMMY_LINEOUT_VERB,
 };
 static const struct hda_fixup alc269_fixups[] = {
@@ -6198,6 +6211,10 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
        },
+        [ALC295_FIXUP_DISABLE_DAC3] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc295_fixup_disable_dac3,
+        },
        [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
@@ -6283,6 +6300,18 @@ static const struct hda_fixup alc269_fixups[] = {
                        { }
                },
        },
+        [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x16, 0x0101102f }, /* Rear Headset HP */
+                        { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */
+                        { 0x1a, 0x01a19030 }, /* Rear Headset MIC */
+                        { 0x1b, 0x02011020 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
        [ALC700_FIXUP_INTEL_REFERENCE] = {
                .type = HDA_FIXUP_VERBS,
                .v.verbs = (const struct hda_verb[]) {
@@ -6319,6 +6348,15 @@ static const struct hda_fixup alc269_fixups[] = {
                .chained = true,
                .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
        },
+        [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x14, 0x0201101f },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6367,10 +6405,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
        SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
        SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+        SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
        SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+        SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
        SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
        SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
        SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6508,9 +6549,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460),
        SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -6872,7 +6915,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                {0x12, 0x90a60120},
                {0x14, 0x90170110},
                {0x21, 0x0321101f}),
-        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                {0x12, 0xb7a60130},
                {0x14, 0x90170110},
                {0x21, 0x04211020}),
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index c33a512283a4..9fb356db3ab2 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -579,13 +579,6 @@ static int acp_init(void __iomem *acp_mmio, u32 asic_type)
                for (bank = 1; bank < 48; bank++)
                        acp_set_sram_bank_state(acp_mmio, bank, false);
        }
-        /* Stoney supports 16bit resolution */
-        if (asic_type == CHIP_STONEY) {
-                val = acp_reg_read(acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-                val |= 0x03;
-                acp_reg_write(val, acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
-        }
        return 0;
 }
@@ -774,6 +767,7 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
 {
        int status;
        uint64_t size;
+        u32 val = 0;
        struct page *pg;
        struct snd_pcm_runtime *runtime;
        struct audio_substream_data *rtd;
@@ -786,6 +780,14 @@ static int acp_dma_hw_params(struct snd_pcm_substream *substream,
        if (WARN_ON(!rtd))
                return -EINVAL;
+        if (adata->asic_type == CHIP_STONEY) {
+                val = acp_reg_read(adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                        val |= ACP_I2S_SP_16BIT_RESOLUTION_EN;
+                else
+                        val |= ACP_I2S_MIC_16BIT_RESOLUTION_EN;
+                acp_reg_write(val, adata->acp_mmio, mmACP_I2S_16BIT_RESOLUTION_EN);
+        }
        size = params_buffer_bytes(params);
        status = snd_pcm_lib_malloc_pages(substream, size);
        if (status < 0)
diff --git a/sound/soc/amd/acp.h b/sound/soc/amd/acp.h
index ecb458935d1e..9293f179f272 100644
--- a/sound/soc/amd/acp.h
+++ b/sound/soc/amd/acp.h
@@ -70,6 +70,8 @@
 #define CAPTURE_END_DMA_DESCR_CH15 7
 #define mmACP_I2S_16BIT_RESOLUTION_EN       0x5209
+#define ACP_I2S_MIC_16BIT_RESOLUTION_EN 0x01
+#define ACP_I2S_SP_16BIT_RESOLUTION_EN  0x02
 enum acp_dma_priority_level {
        /* 0x0 Specifies the DMA channel is given normal priority */
        ACP_DMA_PRIORITY_LEVEL_NORMAL = 0x0,
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 5672e516bec3..c1830ccd3bb8 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -798,12 +798,7 @@ static int hdmi_codec_probe(struct platform_device *pdev)
 static int hdmi_codec_remove(struct platform_device *pdev)
 {
-        struct device *dev = &pdev->dev;
+        snd_soc_unregister_codec(&pdev->dev);
-        struct hdmi_codec_priv *hcp;
-        hcp = dev_get_drvdata(dev);
-        kfree(hcp->chmap_info);
-        snd_soc_unregister_codec(dev);
        return 0;
 }
diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index 831b297978a4..45a73049cf64 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -1722,6 +1722,7 @@ static const struct regmap_config rt5651_regmap = {
        .num_reg_defaults = ARRAY_SIZE(rt5651_reg),
        .ranges = rt5651_ranges,
        .num_ranges = ARRAY_SIZE(rt5651_ranges),
+        .use_single_rw = true,
 };
 #if defined(CONFIG_OF)
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e1ab5537d27a..c5c76ab8ccf1 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -529,10 +529,15 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
 static int sgtl5000_digital_mute(struct snd_soc_dai *codec_dai, int mute)
 {
        struct snd_soc_codec *codec = codec_dai->codec;
-        u16 adcdac_ctrl = SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT;
+        u16 i2s_pwr = SGTL5000_I2S_IN_POWERUP;
-        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
+        /*
-                        adcdac_ctrl, mute ? adcdac_ctrl : 0);
+         * During 'digital mute' do not mute DAC
+         * because LINE_IN would be muted aswell. We want to mute
+         * only I2S block - this can be done by powering it off
+         */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_DIG_POWER,
+                        i2s_pwr, mute ? 0 : i2s_pwr);
        return 0;
 }
@@ -871,15 +876,26 @@ static int sgtl5000_pcm_hw_params(struct snd_pcm_substream *substream,
 static int sgtl5000_set_bias_level(struct snd_soc_codec *codec,
                                   enum snd_soc_bias_level level)
 {
+        struct sgtl5000_priv *sgtl = snd_soc_codec_get_drvdata(codec);
+        int ret;
        switch (level) {
        case SND_SOC_BIAS_ON:
        case SND_SOC_BIAS_PREPARE:
        case SND_SOC_BIAS_STANDBY:
+                regcache_cache_only(sgtl->regmap, false);
+                ret = regcache_sync(sgtl->regmap);
+                if (ret) {
+                        regcache_cache_only(sgtl->regmap, true);
+                        return ret;
+                }
                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                    SGTL5000_REFTOP_POWERUP,
                                    SGTL5000_REFTOP_POWERUP);
                break;
        case SND_SOC_BIAS_OFF:
+                regcache_cache_only(sgtl->regmap, true);
                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
                                    SGTL5000_REFTOP_POWERUP, 0);
                break;
@@ -1237,6 +1253,10 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
         */
        snd_soc_write(codec, SGTL5000_DAP_CTRL, 0);
+        /* Unmute DAC after start */
+        snd_soc_update_bits(codec, SGTL5000_CHIP_ADCDAC_CTRL,
+                SGTL5000_DAC_MUTE_LEFT | SGTL5000_DAC_MUTE_RIGHT, 0);
        return 0;
 err:
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 66e32f5d2917..989d093abda7 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1204,12 +1204,14 @@ static int wmfw_add_ctl(struct wm_adsp *dsp, struct wm_coeff_ctl *ctl)
                kcontrol->put = wm_coeff_put_acked;
                break;
        default:
-                kcontrol->get = wm_coeff_get;
+                if (kcontrol->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
-                kcontrol->put = wm_coeff_put;
+                        ctl->bytes_ext.max = ctl->len;
+                        ctl->bytes_ext.get = wm_coeff_tlv_get;
-                ctl->bytes_ext.max = ctl->len;
+                        ctl->bytes_ext.put = wm_coeff_tlv_put;
-                ctl->bytes_ext.get = wm_coeff_tlv_get;
+                } else {
-                ctl->bytes_ext.put = wm_coeff_tlv_put;
+                        kcontrol->get = wm_coeff_get;
+                        kcontrol->put = wm_coeff_put;
+                }
                break;
        }
diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
index dca1143c1150..a4aa931ebfae 100644
--- a/sound/soc/sunxi/sun4i-i2s.c
+++ b/sound/soc/sunxi/sun4i-i2s.c
@@ -104,7 +104,7 @@
 #define SUN8I_I2S_CHAN_CFG_REG          0x30
 #define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM_MASK     GENMASK(6, 4)
-#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    (chan - 1)
+#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan)    ((chan - 1) << 4)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM_MASK     GENMASK(2, 0)
 #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM(chan)    (chan - 1)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 0dfe4d3f74e2..f41079da38c5 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -213,6 +213,7 @@
 #define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
+#define X86_FEATURE_USE_IBRS_FW         ( 7*32+22) /* "" Use IBRS during runtime firmware calls */
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 0b482c0070e0..465995281dcd 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -55,6 +55,10 @@
 #include "main.h"
+#ifndef BPF_FS_MAGIC
+#define BPF_FS_MAGIC            0xcafe4a11
+#endif
 void p_err(const char *fmt, ...)
 {
        va_list ap;
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 0fb5ef939732..7b26d4b0b052 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -761,6 +761,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_TRACE_PAUSE           __KVM_DEPRECATED_MAIN_0x07
 #define KVM_TRACE_DISABLE         __KVM_DEPRECATED_MAIN_0x08
 #define KVM_GET_EMULATED_CPUID    _IOWR(KVMIO, 0x09, struct kvm_cpuid2)
+#define KVM_GET_MSR_FEATURE_INDEX_LIST    _IOWR(KVMIO, 0x0a, struct kvm_msr_list)
 /*
 * Extension capability list.
@@ -934,6 +935,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_AIS_MIGRATION 150
 #define KVM_CAP_PPC_GET_CPU_CHAR 151
 #define KVM_CAP_S390_BPB 152
+#define KVM_CAP_GET_MSR_FEATURES 153
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 46c1d239cc1b..92b6a2c21631 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1116,42 +1116,29 @@ static int read_unwind_hints(struct objtool_file *file)
 static int read_retpoline_hints(struct objtool_file *file)
 {
-        struct section *sec, *relasec;
+        struct section *sec;
        struct instruction *insn;
        struct rela *rela;
-        int i;
-        sec = find_section_by_name(file->elf, ".discard.retpoline_safe");
+        sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
        if (!sec)
                return 0;
-        relasec = sec->rela;
+        list_for_each_entry(rela, &sec->rela_list, list) {
-        if (!relasec) {
+                if (rela->sym->type != STT_SECTION) {
-                WARN("missing .rela.discard.retpoline_safe section");
+                        WARN("unexpected relocation symbol type in %s", sec->name);
-                return -1;
-        }
-        if (sec->len % sizeof(unsigned long)) {
-                WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long));
-                return -1;
-        }
-        for (i = 0; i < sec->len / sizeof(unsigned long); i++) {
-                rela = find_rela_by_dest(sec, i * sizeof(unsigned long));
-                if (!rela) {
-                        WARN("can't find rela for retpoline_safe[%d]", i);
                        return -1;
                }
                insn = find_insn(file, rela->sym->sec, rela->addend);
                if (!insn) {
-                        WARN("can't find insn for retpoline_safe[%d]", i);
+                        WARN("bad .discard.retpoline_safe entry");
                        return -1;
                }
                if (insn->type != INSN_JUMP_DYNAMIC &&
                    insn->type != INSN_CALL_DYNAMIC) {
-                        WARN_FUNC("retpoline_safe hint not a indirect jump/call",
+                        WARN_FUNC("retpoline_safe hint not an indirect jump/call",
                                  insn->sec, insn->offset);
                        return -1;
                }
diff --git a/tools/perf/Documentation/perf-kallsyms.txt b/tools/perf/Documentation/perf-kallsyms.txt
index 954ea9e21236..cf9f4040ea5c 100644
--- a/tools/perf/Documentation/perf-kallsyms.txt
+++ b/tools/perf/Documentation/perf-kallsyms.txt
@@ -8,7 +8,7 @@ perf-kallsyms - Searches running kernel for symbols
 SYNOPSIS
 --------
 [verse]
-'perf kallsyms <options> symbol_name[,symbol_name...]'
+'perf kallsyms' [<options>] symbol_name[,symbol_name...]
 DESCRIPTION
 -----------
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index bf4ca749d1ac..a217623fec2e 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -881,6 +881,15 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
                }
        }
+        /*
+         * If we have just single event and are sending data
+         * through pipe, we need to force the ids allocation,
+         * because we synthesize event name through the pipe
+         * and need the id for that.
+         */
+        if (data->is_pipe && rec->evlist->nr_entries == 1)
+                rec->opts.sample_id = true;
        if (record__open(rec) != 0) {
                err = -1;
                goto out_child;
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 98bf9d32f222..54a4c152edb3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -917,7 +917,7 @@ static void print_metric_csv(void *ctx,
        char buf[64], *vals, *ends;
        if (unit == NULL || fmt == NULL) {
-                fprintf(out, "%s%s%s%s", csv_sep, csv_sep, csv_sep, csv_sep);
+                fprintf(out, "%s%s", csv_sep, csv_sep);
                return;
        }
        snprintf(buf, sizeof(buf), fmt, val);
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index b7c823ba8374..35ac016fcb98 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -991,7 +991,7 @@ static int perf_top_overwrite_fallback(struct perf_top *top,
        evlist__for_each_entry(evlist, counter)
                counter->attr.write_backward = false;
        opts->overwrite = false;
-        ui__warning("fall back to non-overwrite mode\n");
+        pr_debug2("fall back to non-overwrite mode\n");
        return 1;
 }
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index cfe46236a5e5..57b9b342d533 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -61,6 +61,7 @@ struct record_opts {
        bool         tail_synthesize;
        bool         overwrite;
        bool         ignore_missing_thread;
+        bool         sample_id;
        unsigned int freq;
        unsigned int mmap_pages;
        unsigned int auxtrace_mmap_pages;
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 286427975112..fbf927cf775d 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -327,7 +327,32 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser)
        if (!disasm_line__is_valid_jump(cursor, sym))
                return;
+        /*
+         * This first was seen with a gcc function, _cpp_lex_token, that
+         * has the usual jumps:
+         *
+         *  │1159e6c: ↓ jne    115aa32 <_cpp_lex_token@@Base+0xf92>
+         *
+         * I.e. jumps to a label inside that function (_cpp_lex_token), and
+         * those works, but also this kind:
+         *
+         *  │1159e8b: ↓ jne    c469be <cpp_named_operator2name@@Base+0xa72>
+         *
+         *  I.e. jumps to another function, outside _cpp_lex_token, which
+         *  are not being correctly handled generating as a side effect references
+         *  to ab->offset[] entries that are set to NULL, so to make this code
+         *  more robust, check that here.
+         *
+         *  A proper fix for will be put in place, looking at the function
+         *  name right after the '<' token and probably treating this like a
+         *  'call' instruction.
+         */
        target = ab->offsets[cursor->ops.target.offset];
+        if (target == NULL) {
+                ui_helpline__printf("WARN: jump target inconsistency, press 'o', ab->offsets[%#x] = NULL\n",
+                                    cursor->ops.target.offset);
+                return;
+        }
        bcursor = browser_line(&cursor->al);
        btarget = browser_line(target);
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 9faf3b5367db..6470ea2aa25e 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -60,6 +60,12 @@
 #include "sane_ctype.h"
 #include "symbol/kallsyms.h"
+static bool auxtrace__dont_decode(struct perf_session *session)
+{
+        return !session->itrace_synth_opts ||
+               session->itrace_synth_opts->dont_decode;
+}
 int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
                        struct auxtrace_mmap_params *mp,
                        void *userpg, int fd)
@@ -762,6 +768,9 @@ int auxtrace_queues__process_index(struct auxtrace_queues *queues,
        size_t i;
        int err;
+        if (auxtrace__dont_decode(session))
+                return 0;
        list_for_each_entry(auxtrace_index, &session->auxtrace_index, list) {
                for (i = 0; i < auxtrace_index->nr; i++) {
                        ent = &auxtrace_index->entries[i];
@@ -892,12 +901,6 @@ out_free:
        return err;
 }
-static bool auxtrace__dont_decode(struct perf_session *session)
-{
-        return !session->itrace_synth_opts ||
-               session->itrace_synth_opts->dont_decode;
-}
 int perf_event__process_auxtrace_info(struct perf_tool *tool __maybe_unused,
                                      union perf_event *event,
                                      struct perf_session *session)
diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c
index 1e97937b03a9..6f09e4962dad 100644
--- a/tools/perf/util/record.c
+++ b/tools/perf/util/record.c
@@ -137,6 +137,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
        struct perf_evsel *evsel;
        bool use_sample_identifier = false;
        bool use_comm_exec;
+        bool sample_id = opts->sample_id;
        /*
         * Set the evsel leader links before we configure attributes,
@@ -163,8 +164,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
                 * match the id.
                 */
                use_sample_identifier = perf_can_sample_identifier();
-                evlist__for_each_entry(evlist, evsel)
+                sample_id = true;
-                        perf_evsel__set_sample_id(evsel, use_sample_identifier);
        } else if (evlist->nr_entries > 1) {
                struct perf_evsel *first = perf_evlist__first(evlist);
@@ -174,6 +174,10 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts,
                        use_sample_identifier = perf_can_sample_identifier();
                        break;
                }
+                sample_id = true;
+        }
+        if (sample_id) {
                evlist__for_each_entry(evlist, evsel)
                        perf_evsel__set_sample_id(evsel, use_sample_identifier);
        }
diff --git a/tools/perf/util/trigger.h b/tools/perf/util/trigger.h
index 370138e7e35c..88223bc7c82b 100644
--- a/tools/perf/util/trigger.h
+++ b/tools/perf/util/trigger.h
@@ -12,7 +12,7 @@
 * States and transits:
 *
 *
- *  OFF--(on)--> READY --(hit)--> HIT
+ *  OFF--> ON --> READY --(hit)--> HIT
 *                 ^               |
 *                 |            (ready)
 *                 |               |
@@ -27,8 +27,9 @@ struct trigger {
        volatile enum {
                TRIGGER_ERROR           = -2,
                TRIGGER_OFF             = -1,
-                TRIGGER_READY           = 0,
+                TRIGGER_ON              = 0,
-                TRIGGER_HIT             = 1,
+                TRIGGER_READY           = 1,
+                TRIGGER_HIT             = 2,
        } state;
        const char *name;
 };
@@ -50,7 +51,7 @@ static inline bool trigger_is_error(struct trigger *t)
 static inline void trigger_on(struct trigger *t)
 {
        TRIGGER_WARN_ONCE(t, TRIGGER_OFF);
-        t->state = TRIGGER_READY;
+        t->state = TRIGGER_ON;
 }
 static inline void trigger_ready(struct trigger *t)
diff --git a/tools/testing/selftests/powerpc/mm/subpage_prot.c b/tools/testing/selftests/powerpc/mm/subpage_prot.c
index 35ade7406dcd..3ae77ba93208 100644
--- a/tools/testing/selftests/powerpc/mm/subpage_prot.c
+++ b/tools/testing/selftests/powerpc/mm/subpage_prot.c
@@ -135,6 +135,16 @@ static int run_test(void *addr, unsigned long size)
        return 0;
 }
+static int syscall_available(void)
+{
+        int rc;
+        errno = 0;
+        rc = syscall(__NR_subpage_prot, 0, 0, 0);
+        return rc == 0 || (errno != ENOENT && errno != ENOSYS);
+}
 int test_anon(void)
 {
        unsigned long align;
@@ -145,6 +155,8 @@ int test_anon(void)
        void *mallocblock;
        unsigned long mallocsize;
+        SKIP_IF(!syscall_available());
        if (getpagesize() != 0x10000) {
                fprintf(stderr, "Kernel page size must be 64K!\n");
                return 1;
@@ -180,6 +192,8 @@ int test_file(void)
        off_t filesize;
        int fd;
+        SKIP_IF(!syscall_available());
        fd = open(file_name, O_RDWR);
        if (fd == -1) {
                perror("failed to open file");
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index a23453943ad2..5c72ff978f27 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -16,7 +16,7 @@ $(OUTPUT)/tm-syscall: tm-syscall-asm.S
 $(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include
 $(OUTPUT)/tm-tmspr: CFLAGS += -pthread
 $(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64
-$(OUTPUT)/tm-resched-dscr: ../pmu/lib.o
+$(OUTPUT)/tm-resched-dscr: ../pmu/lib.c
 $(OUTPUT)/tm-unavailable: CFLAGS += -O0 -pthread -m64 -Wno-error=uninitialized -mvsx
 $(OUTPUT)/tm-trap: CFLAGS += -O0 -pthread -m64
diff --git a/tools/testing/selftests/powerpc/tm/tm-trap.c b/tools/testing/selftests/powerpc/tm/tm-trap.c
index 5d92c23ee6cb..179d592f0073 100644
--- a/tools/testing/selftests/powerpc/tm/tm-trap.c
+++ b/tools/testing/selftests/powerpc/tm/tm-trap.c
@@ -255,6 +255,8 @@ int tm_trap_test(void)
        struct sigaction trap_sa;
+        SKIP_IF(!have_htm());
        trap_sa.sa_flags = SA_SIGINFO;
        trap_sa.sa_sigaction = trap_signal_handler;
        sigaction(SIGTRAP, &trap_sa, NULL);
diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests
index d2561895a021..22d564673830 100755
--- a/tools/testing/selftests/vm/run_vmtests
+++ b/tools/testing/selftests/vm/run_vmtests
@@ -2,25 +2,33 @@
 # SPDX-License-Identifier: GPL-2.0
 #please run as root
-#we need 256M, below is the size in kB
-needmem=262144
 mnt=./huge
 exitcode=0
-#get pagesize and freepages from /proc/meminfo
+#get huge pagesize and freepages from /proc/meminfo
 while read name size unit; do
        if [ "$name" = "HugePages_Free:" ]; then
                freepgs=$size
        fi
        if [ "$name" = "Hugepagesize:" ]; then
-                pgsize=$size
+                hpgsize_KB=$size
        fi
 done < /proc/meminfo
+# Simple hugetlbfs tests have a hardcoded minimum requirement of
+# huge pages totaling 256MB (262144KB) in size.  The userfaultfd
+# hugetlb test requires a minimum of 2 * nr_cpus huge pages.  Take
+# both of these requirements into account and attempt to increase
+# number of huge pages available.
+nr_cpus=$(nproc)
+hpgsize_MB=$((hpgsize_KB / 1024))
+half_ufd_size_MB=$((((nr_cpus * hpgsize_MB + 127) / 128) * 128))
+needmem_KB=$((half_ufd_size_MB * 2 * 1024))
 #set proper nr_hugepages
-if [ -n "$freepgs" ] && [ -n "$pgsize" ]; then
+if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then
        nr_hugepgs=`cat /proc/sys/vm/nr_hugepages`
-        needpgs=`expr $needmem / $pgsize`
+        needpgs=$((needmem_KB / hpgsize_KB))
        tries=2
        while [ $tries -gt 0 ] && [ $freepgs -lt $needpgs ]; do
                lackpgs=$(( $needpgs - $freepgs ))
@@ -107,8 +115,9 @@ fi
 echo "---------------------------"
 echo "running userfaultfd_hugetlb"
 echo "---------------------------"
-# 256MB total huge pages == 128MB src and 128MB dst
+# Test requires source and destination huge pages.  Size of source
-./userfaultfd hugetlb 128 32 $mnt/ufd_test_file
+# (half_ufd_size_MB) is passed as argument to test.
+./userfaultfd hugetlb $half_ufd_size_MB 32 $mnt/ufd_test_file
 if [ $? -ne 0 ]; then
        echo "[FAIL]"
        exitcode=1
diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
index 361466a2eaef..ade443a88421 100644
--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -95,6 +95,10 @@ asm (
        "int3\n\t"
        "vmcode_int80:\n\t"
        "int $0x80\n\t"
+        "vmcode_popf_hlt:\n\t"
+        "push %ax\n\t"
+        "popf\n\t"
+        "hlt\n\t"
        "vmcode_umip:\n\t"
        /* addressing via displacements */
        "smsw (2052)\n\t"
@@ -124,8 +128,8 @@ asm (
 extern unsigned char vmcode[], end_vmcode[];
 extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[],
-        vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_umip[],
+        vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[],
-        vmcode_umip_str[], vmcode_umip_sldt[];
+        vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[];
 /* Returns false if the test was skipped. */
 static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
@@ -175,7 +179,7 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
            (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) {
                printf("[OK]\tReturned correctly\n");
        } else {
-                printf("[FAIL]\tIncorrect return reason\n");
+                printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip);
                nerrs++;
        }
@@ -264,6 +268,9 @@ int main(void)
        v86.regs.ds = load_addr / 16;
        v86.regs.es = load_addr / 16;
+        /* Use the end of the page as our stack. */
+        v86.regs.esp = 4096;
        assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */
        /* #BR -- should deliver SIG??? */
@@ -295,6 +302,23 @@ int main(void)
        v86.regs.eflags &= ~X86_EFLAGS_IF;
        do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set");
+        /* POPF with VIP set but IF clear: should not trap */
+        v86.regs.eflags = X86_EFLAGS_VIP;
+        v86.regs.eax = 0;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear");
+        /* POPF with VIP set and IF set: should trap */
+        v86.regs.eflags = X86_EFLAGS_VIP;
+        v86.regs.eax = X86_EFLAGS_IF;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set");
+        /* POPF with VIP clear and IF set: should not trap */
+        v86.regs.eflags = 0;
+        v86.regs.eax = X86_EFLAGS_IF;
+        do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set");
+        v86.regs.eflags = 0;
        /* INT3 -- should cause #BP */
        do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3");
@@ -318,7 +342,7 @@ int main(void)
        clearhandler(SIGSEGV);
        /* Make sure nothing explodes if we fork. */
-        if (fork() > 0)
+        if (fork() == 0)
                return 0;
        return (nerrs == 0 ? 0 : 1);
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index be81621446f0..0b4f1cc2291c 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -450,7 +450,7 @@ static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
                num_vsyscall_traps++;
 }
-static int test_native_vsyscall(void)
+static int test_emulation(void)
 {
        time_t tmp;
        bool is_native;
@@ -458,7 +458,7 @@ static int test_native_vsyscall(void)
        if (!vtime)
                return 0;
-        printf("[RUN]\tchecking for native vsyscall\n");
+        printf("[RUN]\tchecking that vsyscalls are emulated\n");
        sethandler(SIGTRAP, sigtrap, 0);
        set_eflags(get_eflags() | X86_EFLAGS_TF);
        vtime(&tmp);
@@ -474,11 +474,12 @@ static int test_native_vsyscall(void)
         */
        is_native = (num_vsyscall_traps > 1);
-        printf("\tvsyscalls are %s (%d instructions in vsyscall page)\n",
+        printf("[%s]\tvsyscalls are %s (%d instructions in vsyscall page)\n",
+               (is_native ? "FAIL" : "OK"),
               (is_native ? "native" : "emulated"),
               (int)num_vsyscall_traps);
-        return 0;
+        return is_native;
 }
 #endif
@@ -498,7 +499,7 @@ int main(int argc, char **argv)
        nerrs += test_vsys_r();
 #ifdef __x86_64__
-        nerrs += test_native_vsyscall();
+        nerrs += test_emulation();
 #endif
        return nerrs ? 1 : 0;
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 70f4c30918eb..282389eb204f 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -581,6 +581,7 @@ void kvm_timer_sync_hwstate(struct kvm_vcpu *vcpu)
 int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
 {
+        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
        struct arch_timer_context *vtimer = vcpu_vtimer(vcpu);
        struct arch_timer_context *ptimer = vcpu_ptimer(vcpu);
@@ -594,6 +595,9 @@ int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu)
        ptimer->cnt_ctl = 0;
        kvm_timer_update_state(vcpu);
+        if (timer->enabled && irqchip_in_kernel(vcpu->kvm))
+                kvm_vgic_reset_mapped_irq(vcpu, vtimer->irq.irq);
        return 0;
 }
@@ -767,7 +771,7 @@ int kvm_timer_hyp_init(bool has_gic)
                static_branch_enable(&has_gic_active_state);
        }
-        kvm_info("virtual timer IRQ%d\n", host_vtimer_irq);
+        kvm_debug("virtual timer IRQ%d\n", host_vtimer_irq);
        cpuhp_setup_state(CPUHP_AP_KVM_ARM_TIMER_STARTING,
                          "kvm/arm/timer:starting", kvm_timer_starting_cpu,
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 86941f6181bb..53572304843b 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -384,14 +384,11 @@ static void vcpu_power_off(struct kvm_vcpu *vcpu)
 int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
                                    struct kvm_mp_state *mp_state)
 {
-        vcpu_load(vcpu);
        if (vcpu->arch.power_off)
                mp_state->mp_state = KVM_MP_STATE_STOPPED;
        else
                mp_state->mp_state = KVM_MP_STATE_RUNNABLE;
-        vcpu_put(vcpu);
        return 0;
 }
@@ -400,8 +397,6 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
 {
        int ret = 0;
-        vcpu_load(vcpu);
        switch (mp_state->mp_state) {
        case KVM_MP_STATE_RUNNABLE:
                vcpu->arch.power_off = false;
@@ -413,7 +408,6 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
                ret = -EINVAL;
        }
-        vcpu_put(vcpu);
        return ret;
 }
@@ -1036,8 +1030,6 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
        struct kvm_device_attr attr;
        long r;
-        vcpu_load(vcpu);
        switch (ioctl) {
        case KVM_ARM_VCPU_INIT: {
                struct kvm_vcpu_init init;
@@ -1114,7 +1106,6 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                r = -EINVAL;
        }
-        vcpu_put(vcpu);
        return r;
 }
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index f5c3d6d7019e..b89ce5432214 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -215,7 +215,8 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
         * are now visible to the system register interface.
         */
        if (!cpu_if->vgic_sre) {
-                dsb(st);
+                dsb(sy);
+                isb();
                cpu_if->vgic_vmcr = read_gicreg(ICH_VMCR_EL2);
        }
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index ec62d1cccab7..b960acdd0c05 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1810,9 +1810,9 @@ int kvm_mmu_init(void)
         */
        BUG_ON((hyp_idmap_start ^ (hyp_idmap_end - 1)) & PAGE_MASK);
-        kvm_info("IDMAP page: %lx\n", hyp_idmap_start);
+        kvm_debug("IDMAP page: %lx\n", hyp_idmap_start);
-        kvm_info("HYP VA range: %lx:%lx\n",
+        kvm_debug("HYP VA range: %lx:%lx\n",
-                 kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
+                  kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
        if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) &&
            hyp_idmap_start <  kern_hyp_va(~0UL) &&
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 83d82bd7dc4e..dbe99d635c80 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -113,9 +113,12 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
        /* Loop over all IRQs affected by this read */
        for (i = 0; i < len * 8; i++) {
                struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+                unsigned long flags;
+                spin_lock_irqsave(&irq->irq_lock, flags);
                if (irq_is_pending(irq))
                        value |= (1U << i);
+                spin_unlock_irqrestore(&irq->irq_lock, flags);
                vgic_put_irq(vcpu->kvm, irq);
        }
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index c32d7b93ffd1..29556f71b691 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -37,6 +37,13 @@ void vgic_v2_init_lrs(void)
                vgic_v2_write_lr(i, 0);
 }
+void vgic_v2_set_npie(struct kvm_vcpu *vcpu)
+{
+        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
+        cpuif->vgic_hcr |= GICH_HCR_NPIE;
+}
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -64,7 +71,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~GICH_HCR_UIE;
+        cpuif->vgic_hcr &= ~(GICH_HCR_UIE | GICH_HCR_NPIE);
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u32 val = cpuif->vgic_lr[lr];
@@ -410,7 +417,7 @@ int vgic_v2_probe(const struct gic_kvm_info *info)
        kvm_vgic_global_state.type = VGIC_V2;
        kvm_vgic_global_state.max_gic_vcpus = VGIC_V2_MAX_CPUS;
-        kvm_info("vgic-v2@%llx\n", info->vctrl.start);
+        kvm_debug("vgic-v2@%llx\n", info->vctrl.start);
        return 0;
 out:
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 6b329414e57a..0ff2006f3781 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -26,6 +26,13 @@ static bool group1_trap;
 static bool common_trap;
 static bool gicv4_enable;
+void vgic_v3_set_npie(struct kvm_vcpu *vcpu)
+{
+        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
+        cpuif->vgic_hcr |= ICH_HCR_NPIE;
+}
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu)
 {
        struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3;
@@ -47,7 +54,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
        int lr;
        unsigned long flags;
-        cpuif->vgic_hcr &= ~ICH_HCR_UIE;
+        cpuif->vgic_hcr &= ~(ICH_HCR_UIE | ICH_HCR_NPIE);
        for (lr = 0; lr < vgic_cpu->used_lrs; lr++) {
                u64 val = cpuif->vgic_lr[lr];
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index c7c5ef190afa..8201899126f6 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -495,6 +495,32 @@ int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, unsigned int host_irq,
        return ret;
 }
+/**
+ * kvm_vgic_reset_mapped_irq - Reset a mapped IRQ
+ * @vcpu: The VCPU pointer
+ * @vintid: The INTID of the interrupt
+ *
+ * Reset the active and pending states of a mapped interrupt.  Kernel
+ * subsystems injecting mapped interrupts should reset their interrupt lines
+ * when we are doing a reset of the VM.
+ */
+void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid)
+{
+        struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
+        unsigned long flags;
+        if (!irq->hw)
+                goto out;
+        spin_lock_irqsave(&irq->irq_lock, flags);
+        irq->active = false;
+        irq->pending_latch = false;
+        irq->line_level = false;
+        spin_unlock_irqrestore(&irq->irq_lock, flags);
+out:
+        vgic_put_irq(vcpu->kvm, irq);
+}
 int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int vintid)
 {
        struct vgic_irq *irq;
@@ -684,22 +710,37 @@ static inline void vgic_set_underflow(struct kvm_vcpu *vcpu)
                vgic_v3_set_underflow(vcpu);
 }
+static inline void vgic_set_npie(struct kvm_vcpu *vcpu)
+{
+        if (kvm_vgic_global_state.type == VGIC_V2)
+                vgic_v2_set_npie(vcpu);
+        else
+                vgic_v3_set_npie(vcpu);
+}
 /* Requires the ap_list_lock to be held. */
-static int compute_ap_list_depth(struct kvm_vcpu *vcpu)
+static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
+                                 bool *multi_sgi)
 {
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_irq *irq;
        int count = 0;
+        *multi_sgi = false;
        DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
        list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
                spin_lock(&irq->irq_lock);
                /* GICv2 SGIs can count for more than one... */
-                if (vgic_irq_is_sgi(irq->intid) && irq->source)
+                if (vgic_irq_is_sgi(irq->intid) && irq->source) {
-                        count += hweight8(irq->source);
+                        int w = hweight8(irq->source);
-                else
+                        count += w;
+                        *multi_sgi |= (w > 1);
+                } else {
                        count++;
+                }
                spin_unlock(&irq->irq_lock);
        }
        return count;
@@ -710,28 +751,43 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
 {
        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
        struct vgic_irq *irq;
-        int count = 0;
+        int count;
+        bool npie = false;
+        bool multi_sgi;
+        u8 prio = 0xff;
        DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock));
-        if (compute_ap_list_depth(vcpu) > kvm_vgic_global_state.nr_lr)
+        count = compute_ap_list_depth(vcpu, &multi_sgi);
+        if (count > kvm_vgic_global_state.nr_lr || multi_sgi)
                vgic_sort_ap_list(vcpu);
+        count = 0;
        list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
                spin_lock(&irq->irq_lock);
-                if (unlikely(vgic_target_oracle(irq) != vcpu))
-                        goto next;
                /*
-                 * If we get an SGI with multiple sources, try to get
+                 * If we have multi-SGIs in the pipeline, we need to
-                 * them in all at once.
+                 * guarantee that they are all seen before any IRQ of
+                 * lower priority. In that case, we need to filter out
+                 * these interrupts by exiting early. This is easy as
+                 * the AP list has been sorted already.
                 */
-                do {
+                if (multi_sgi && irq->priority > prio) {
+                        spin_unlock(&irq->irq_lock);
+                        break;
+                }
+                if (likely(vgic_target_oracle(irq) == vcpu)) {
                        vgic_populate_lr(vcpu, irq, count++);
-                } while (irq->source && count < kvm_vgic_global_state.nr_lr);
-next:
+                        if (irq->source) {
+                                npie = true;
+                                prio = irq->priority;
+                        }
+                }
                spin_unlock(&irq->irq_lock);
                if (count == kvm_vgic_global_state.nr_lr) {
@@ -742,6 +798,9 @@ next:
                }
        }
+        if (npie)
+                vgic_set_npie(vcpu);
        vcpu->arch.vgic_cpu.used_lrs = count;
        /* Nuke remaining LRs */
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 12c37b89f7a3..f5b8519e5546 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -96,6 +96,7 @@
 /* we only support 64 kB translation table page size */
 #define KVM_ITS_L1E_ADDR_MASK           GENMASK_ULL(51, 16)
+/* Requires the irq_lock to be held by the caller. */
 static inline bool irq_is_pending(struct vgic_irq *irq)
 {
        if (irq->config == VGIC_CONFIG_EDGE)
@@ -159,6 +160,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu);
 void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr);
 void vgic_v2_clear_lr(struct kvm_vcpu *vcpu, int lr);
 void vgic_v2_set_underflow(struct kvm_vcpu *vcpu);
+void vgic_v2_set_npie(struct kvm_vcpu *vcpu);
 int vgic_v2_has_attr_regs(struct kvm_device *dev, struct kvm_device_attr *attr);
 int vgic_v2_dist_uaccess(struct kvm_vcpu *vcpu, bool is_write,
                         int offset, u32 *val);
@@ -188,6 +190,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu);
 void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr);
 void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr);
 void vgic_v3_set_underflow(struct kvm_vcpu *vcpu);
+void vgic_v3_set_npie(struct kvm_vcpu *vcpu);
 void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr);
 void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr);
 void vgic_v3_enable(struct kvm_vcpu *vcpu);
author	David S. Miller <davem@davemloft.net>	2018-03-23 11:24:57 -0400
committer	David S. Miller <davem@davemloft.net>	2018-03-23 11:31:58 -0400
commit	03fe2debbb2771fb90881e4ce8109b09cf772a5c (patch)
tree	fbaf8738296b2e9dcba81c6daef2d515b6c4948c
parent	6686c459e1449a3ee5f3fd313b0a559ace7a700e (diff)
parent	f36b7534b83357cf52e747905de6d65b4f7c2512 (diff)