Merge tag 'v4.20-rc7' into perf/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

437 files changed, 4850 insertions, 2108 deletions

diff --git a/CREDITS b/CREDITS
index c9273393fe14..7d397ee67524 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2541,6 +2541,10 @@ S: Ormond
 S: Victoria 3163
 S: Australia
 
+N: Eric Miao
+E: eric.y.miao@gmail.com
+D: MMP support
+
 N: Pauline Middelink
 E: middelin@polyware.nl
 D: General low-level bug fixes, /proc fixes, identd support
@@ -4115,6 +4119,10 @@ S: 1507 145th Place SE #B5
 S: Bellevue, Washington 98007
 S: USA
 
+N: Haojian Zhuang
+E: haojian.zhuang@gmail.com
+D: MMP support
+
 N: Richard Zidlicky
 E: rz@linux-m68k.org, rdzidlic@geocities.com
 W: http://www.geocities.com/rdzidlic
diff --git a/Documentation/ABI/testing/sysfs-class-net-dsa b/Documentation/ABI/testing/sysfs-class-net-dsa
index f240221e071e..985d84c585c6 100644
--- a/Documentation/ABI/testing/sysfs-class-net-dsa
+++ b/Documentation/ABI/testing/sysfs-class-net-dsa
@@ -1,4 +1,4 @@
-What:           /sys/class/net/<iface>/tagging
+What:           /sys/class/net/<iface>/dsa/tagging
 Date:           August 2018
 KernelVersion:  4.20
 Contact:        netdev@vger.kernel.org
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index dbe96cb5558e..6a6d67acaf69 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -187,6 +187,8 @@ Takes xa_lock internally:
  * :c:func:`xa_erase_bh`
  * :c:func:`xa_erase_irq`
  * :c:func:`xa_cmpxchg`
+ * :c:func:`xa_cmpxchg_bh`
+ * :c:func:`xa_cmpxchg_irq`
  * :c:func:`xa_store_range`
  * :c:func:`xa_alloc`
  * :c:func:`xa_alloc_bh`
@@ -263,7 +265,8 @@ using :c:func:`xa_lock_irqsave` in both the interrupt handler and process
 context, or :c:func:`xa_lock_irq` in process context and :c:func:`xa_lock`
 in the interrupt handler.  Some of the more common patterns have helper
 functions such as :c:func:`xa_store_bh`, :c:func:`xa_store_irq`,
-:c:func:`xa_erase_bh` and :c:func:`xa_erase_irq`.
+:c:func:`xa_erase_bh`, :c:func:`xa_erase_irq`, :c:func:`xa_cmpxchg_bh`
+and :c:func:`xa_cmpxchg_irq`.
 
 Sometimes you need to protect access to the XArray with a mutex because
 that lock sits above another mutex in the locking hierarchy.  That does
diff --git a/Documentation/devicetree/bindings/clock/clock-bindings.txt b/Documentation/devicetree/bindings/clock/clock-bindings.txt
index 2ec489eebe72..b646bbcf7f92 100644
--- a/Documentation/devicetree/bindings/clock/clock-bindings.txt
+++ b/Documentation/devicetree/bindings/clock/clock-bindings.txt
@@ -168,3 +168,19 @@ a shared clock is forbidden.
 
 Configuration of common clocks, which affect multiple consumer devices can
 be similarly specified in the clock provider node.
+
+==Protected clocks==
+
+Some platforms or firmwares may not fully expose all the clocks to the OS, such
+as in situations where those clks are used by drivers running in ARM secure
+execution levels. Such a configuration can be specified in device tree with the
+protected-clocks property in the form of a clock specifier list. This property should
+only be specified in the node that is providing the clocks being protected:
+
+   clock-controller@a000f000 {
+        compatible = "vendor,clk95;
+        reg = <0xa000f000 0x1000>
+        #clocks-cells = <1>;
+        ...
+        protected-clocks = <UART3_CLK>, <SPI5_CLK>;
+   };
diff --git a/Documentation/devicetree/bindings/input/input-reset.txt b/Documentation/devicetree/bindings/input/input-reset.txt
index 2bb2626fdb78..1ca6cc5ebf8e 100644
--- a/Documentation/devicetree/bindings/input/input-reset.txt
+++ b/Documentation/devicetree/bindings/input/input-reset.txt
@@ -12,7 +12,7 @@ The /chosen node should contain a 'linux,sysrq-reset-seq' child node to define
 a set of keys.
 
 Required property:
-sysrq-reset-seq: array of Linux keycodes, one keycode per cell.
+keyset: array of Linux keycodes, one keycode per cell.
 
 Optional property:
 timeout-ms: duration keys must be pressed together in milliseconds before
diff --git a/Documentation/devicetree/bindings/media/rockchip-vpu.txt b/Documentation/devicetree/bindings/media/rockchip-vpu.txt
deleted file mode 100644
index 35dc464ad7c8..000000000000
--- a/Documentation/devicetree/bindings/media/rockchip-vpu.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-device-tree bindings for rockchip VPU codec
-
-Rockchip (Video Processing Unit) present in various Rockchip platforms,
-such as RK3288 and RK3399.
-
-Required properties:
-- compatible: value should be one of the following
-                "rockchip,rk3288-vpu";
-                "rockchip,rk3399-vpu";
-- interrupts: encoding and decoding interrupt specifiers
-- interrupt-names: should be "vepu" and "vdpu"
-- clocks: phandle to VPU aclk, hclk clocks
-- clock-names: should be "aclk" and "hclk"
-- power-domains: phandle to power domain node
-- iommus: phandle to a iommu node
-
-Example:
-SoC-specific DT entry:
-        vpu: video-codec@ff9a0000 {
-                compatible = "rockchip,rk3288-vpu";
-                reg = <0x0 0xff9a0000 0x0 0x800>;
-                interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>,
-                             <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
-                interrupt-names = "vepu", "vdpu";
-                clocks = <&cru ACLK_VCODEC>, <&cru HCLK_VCODEC>;
-                clock-names = "aclk", "hclk";
-                power-domains = <&power RK3288_PD_VIDEO>;
-                iommus = <&vpu_mmu>;
-        };
diff --git a/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst b/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
index 0f8b31874002..de131f00c249 100644
--- a/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
+++ b/Documentation/media/uapi/mediactl/media-ioc-request-alloc.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_ioc_request_alloc:
 
diff --git a/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst b/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
index 6dd2d7fea714..5d2604345e19 100644
--- a/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
+++ b/Documentation/media/uapi/mediactl/media-request-ioc-queue.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_request_ioc_queue:
 
diff --git a/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst b/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
index febe888494c8..ec61960c81ce 100644
--- a/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
+++ b/Documentation/media/uapi/mediactl/media-request-ioc-reinit.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media_request_ioc_reinit:
 
diff --git a/Documentation/media/uapi/mediactl/request-api.rst b/Documentation/media/uapi/mediactl/request-api.rst
index 5f4a23029c48..945113dcb218 100644
--- a/Documentation/media/uapi/mediactl/request-api.rst
+++ b/Documentation/media/uapi/mediactl/request-api.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _media-request-api:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-close.rst b/Documentation/media/uapi/mediactl/request-func-close.rst
index 098d7f2b9548..dcf3f35bcf17 100644
--- a/Documentation/media/uapi/mediactl/request-func-close.rst
+++ b/Documentation/media/uapi/mediactl/request-func-close.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-close:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-ioctl.rst b/Documentation/media/uapi/mediactl/request-func-ioctl.rst
index ff7b072a6999..11a22f887843 100644
--- a/Documentation/media/uapi/mediactl/request-func-ioctl.rst
+++ b/Documentation/media/uapi/mediactl/request-func-ioctl.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-ioctl:
 
diff --git a/Documentation/media/uapi/mediactl/request-func-poll.rst b/Documentation/media/uapi/mediactl/request-func-poll.rst
index 85191254f381..2609fd54d519 100644
--- a/Documentation/media/uapi/mediactl/request-func-poll.rst
+++ b/Documentation/media/uapi/mediactl/request-func-poll.rst
@@ -1,4 +1,28 @@
-.. SPDX-License-Identifier: GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
+.. This file is dual-licensed: you can use it either under the terms
+.. of the GPL or the GFDL 1.1+ license, at your option. Note that this
+.. dual licensing only applies to this file, and not this project as a
+.. whole.
+..
+.. a) This file is free software; you can redistribute it and/or
+..    modify it under the terms of the GNU General Public License as
+..    published by the Free Software Foundation; either version 2 of
+..    the License, or (at your option) any later version.
+..
+..    This file is distributed in the hope that it will be useful,
+..    but WITHOUT ANY WARRANTY; without even the implied warranty of
+..    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+..    GNU General Public License for more details.
+..
+.. Or, alternatively,
+..
+.. b) Permission is granted to copy, distribute and/or modify this
+..    document under the terms of the GNU Free Documentation License,
+..    Version 1.1 or any later version published by the Free Software
+..    Foundation, with no Invariant Sections, no Front-Cover Texts
+..    and no Back-Cover Texts. A copy of the license is included at
+..    Documentation/media/uapi/fdl-appendix.rst.
+..
+.. TODO: replace it to GPL-2.0 OR GFDL-1.1-or-later WITH no-invariant-sections
 
 .. _request-func-poll:
 
diff --git a/Documentation/media/uapi/v4l/extended-controls.rst b/Documentation/media/uapi/v4l/extended-controls.rst
index 65a1d873196b..027358b91082 100644
--- a/Documentation/media/uapi/v4l/extended-controls.rst
+++ b/Documentation/media/uapi/v4l/extended-controls.rst
@@ -1505,6 +1505,11 @@ enum v4l2_mpeg_video_h264_hierarchical_coding_type -
     configuring a stateless hardware decoding pipeline for MPEG-2.
     The bitstream parameters are defined according to :ref:`mpeg2part2`.
 
+    .. note::
+
+       This compound control is not yet part of the public kernel API and
+       it is expected to change.
+
 .. c:type:: v4l2_ctrl_mpeg2_slice_params
 
 .. cssclass:: longtable
@@ -1625,6 +1630,11 @@ enum v4l2_mpeg_video_h264_hierarchical_coding_type -
     Specifies quantization matrices (as extracted from the bitstream) for the
     associated MPEG-2 slice data.
 
+    .. note::
+
+       This compound control is not yet part of the public kernel API and
+       it is expected to change.
+
 .. c:type:: v4l2_ctrl_mpeg2_quantization
 
 .. cssclass:: longtable
diff --git a/MAINTAINERS b/MAINTAINERS
index 6682420421c1..3318f30903b2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1472,6 +1472,7 @@ F:	drivers/clk/sirf/
 F:      drivers/clocksource/timer-prima2.c
 F:      drivers/clocksource/timer-atlas7.c
 N:      [^a-z]sirf
+X:      drivers/gnss
 
 ARM/EBSA110 MACHINE SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
@@ -1738,13 +1739,17 @@ ARM/Mediatek SoC support
 M:      Matthias Brugger <matthias.bgg@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-mediatek@lists.infradead.org (moderated for non-subscribers)
+W:      https://mtk.bcnfs.org/
+C:      irc://chat.freenode.net/linux-mediatek
 S:      Maintained
 F:      arch/arm/boot/dts/mt6*
 F:      arch/arm/boot/dts/mt7*
 F:      arch/arm/boot/dts/mt8*
 F:      arch/arm/mach-mediatek/
 F:      arch/arm64/boot/dts/mediatek/
+F:      drivers/soc/mediatek/
 N:      mtk
+N:      mt[678]
 K:      mediatek
 
 ARM/Mediatek USB3 PHY DRIVER
@@ -3271,11 +3276,16 @@ S:	Maintained
 F:      sound/pci/oxygen/
 
 C-SKY ARCHITECTURE
-M:      Guo Ren <ren_guo@c-sky.com>
+M:      Guo Ren <guoren@kernel.org>
 T:      git https://github.com/c-sky/csky-linux.git
 S:      Supported
 F:      arch/csky/
 F:      Documentation/devicetree/bindings/csky/
+F:      drivers/irqchip/irq-csky-*
+F:      Documentation/devicetree/bindings/interrupt-controller/csky,*
+F:      drivers/clocksource/timer-gx6605s.c
+F:      drivers/clocksource/timer-mp-csky.c
+F:      Documentation/devicetree/bindings/timer/csky,*
 K:      csky
 N:      csky
 
@@ -4837,6 +4847,7 @@ F:	include/uapi/drm/vmwgfx_drm.h
 
 DRM DRIVERS
 M:      David Airlie <airlied@linux.ie>
+M:      Daniel Vetter <daniel@ffwll.ch>
 L:      dri-devel@lists.freedesktop.org
 T:      git git://anongit.freedesktop.org/drm/drm
 B:      https://bugs.freedesktop.org/
@@ -6316,6 +6327,7 @@ F:	include/uapi/linux/gigaset_dev.h
 
 GNSS SUBSYSTEM
 M:      Johan Hovold <johan@kernel.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss.git
 S:      Maintained
 F:      Documentation/ABI/testing/sysfs-class-gnss
 F:      Documentation/devicetree/bindings/gnss/
@@ -9998,12 +10010,9 @@ S:	Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
 
 MMP SUPPORT
-M:      Eric Miao <eric.y.miao@gmail.com>
-M:      Haojian Zhuang <haojian.zhuang@gmail.com>
+R:      Lubomir Rintel <lkundrak@v3.sk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-T:      git git://github.com/hzhuang1/linux.git
-T:      git git://git.linaro.org/people/ycmiao/pxa-linux.git
-S:      Maintained
+S:      Odd Fixes
 F:      arch/arm/boot/dts/mmp*
 F:      arch/arm/mach-mmp/
 
@@ -13883,6 +13892,13 @@ F:	drivers/md/raid*
 F:      include/linux/raid/
 F:      include/uapi/linux/raid/
 
+SOCIONEXT (SNI) AVE NETWORK DRIVER
+M:      Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/socionext/sni_ave.c
+F:      Documentation/devicetree/bindings/net/socionext,uniphier-ave4.txt
+
 SOCIONEXT (SNI) NETSEC NETWORK DRIVER
 M:      Jassi Brar <jaswinder.singh@linaro.org>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index e9fd22c8445e..56d5270f22f8 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 20
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index a37fd990bd55..4b5b1b244f86 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -634,6 +634,7 @@ setup_arch(char **cmdline_p)
 
         /* Find our memory.  */
         setup_memory(kernel_end);
+        memblock_set_bottom_up(true);
 
         /* First guess at cpu cache sizes.  Do this before init_arch.  */
         determine_cpu_caches(cpu->type);
diff --git a/arch/alpha/mm/numa.c b/arch/alpha/mm/numa.c
index 74846553e3f1..d0b73371e985 100644
--- a/arch/alpha/mm/numa.c
+++ b/arch/alpha/mm/numa.c
@@ -144,14 +144,14 @@ setup_memory_node(int nid, void *kernel_end)
         if (!nid && (node_max_pfn < end_kernel_pfn || node_min_pfn > start_kernel_pfn))
                 panic("kernel loaded out of ram");
 
+        memblock_add(PFN_PHYS(node_min_pfn),
+                     (node_max_pfn - node_min_pfn) << PAGE_SHIFT);
+
         /* Zone start phys-addr must be 2^(MAX_ORDER-1) aligned.
            Note that we round this down, not up - node memory
            has much larger alignment than 8Mb, so it's safe. */
         node_min_pfn &= ~((1UL << (MAX_ORDER-1))-1);
 
-        memblock_add(PFN_PHYS(node_min_pfn),
-                     (node_max_pfn - node_min_pfn) << PAGE_SHIFT);
-
         NODE_DATA(nid)->node_start_pfn = node_min_pfn;
         NODE_DATA(nid)->node_present_pages = node_max_pfn - node_min_pfn;
 
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index c9e2a1323536..6dd783557330 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -109,7 +109,7 @@ endmenu
 
 choice
         prompt "ARC Instruction Set"
-        default ISA_ARCOMPACT
+        default ISA_ARCV2
 
 config ISA_ARCOMPACT
         bool "ARCompact ISA"
@@ -176,13 +176,11 @@ endchoice
 
 config CPU_BIG_ENDIAN
         bool "Enable Big Endian Mode"
-        default n
         help
           Build kernel for Big Endian Mode of ARC CPU
 
 config SMP
         bool "Symmetric Multi-Processing"
-        default n
         select ARC_MCIP if ISA_ARCV2
         help
           This enables support for systems with more than one CPU.
@@ -254,7 +252,6 @@ config ARC_CACHE_PAGES
 config ARC_CACHE_VIPT_ALIASING
         bool "Support VIPT Aliasing D$"
         depends on ARC_HAS_DCACHE && ISA_ARCOMPACT
-        default n
 
 endif   #ARC_CACHE
 
@@ -262,7 +259,6 @@ config ARC_HAS_ICCM
         bool "Use ICCM"
         help
           Single Cycle RAMS to store Fast Path Code
-        default n
 
 config ARC_ICCM_SZ
         int "ICCM Size in KB"
@@ -273,7 +269,6 @@ config ARC_HAS_DCCM
         bool "Use DCCM"
         help
           Single Cycle RAMS to store Fast Path Data
-        default n
 
 config ARC_DCCM_SZ
         int "DCCM Size in KB"
@@ -366,13 +361,11 @@ if ISA_ARCOMPACT
 
 config ARC_COMPACT_IRQ_LEVELS
         bool "Setup Timer IRQ as high Priority"
-        default n
         # if SMP, LV2 enabled ONLY if ARC implementation has LV2 re-entrancy
         depends on !SMP
 
 config ARC_FPU_SAVE_RESTORE
         bool "Enable FPU state persistence across context switch"
-        default n
         help
           Double Precision Floating Point unit had dedicated regs which
           need to be saved/restored across context-switch.
@@ -453,7 +446,6 @@ config HIGHMEM
 
 config ARC_HAS_PAE40
         bool "Support for the 40-bit Physical Address Extension"
-        default n
         depends on ISA_ARCV2
         select HIGHMEM
         select PHYS_ADDR_T_64BIT
@@ -496,7 +488,6 @@ config HZ
 
 config ARC_METAWARE_HLINK
         bool "Support for Metaware debugger assisted Host access"
-        default n
         help
           This options allows a Linux userland apps to directly access
           host file system (open/creat/read/write etc) with help from
@@ -524,13 +515,11 @@ config ARC_DW2_UNWIND
 
 config ARC_DBG_TLB_PARANOIA
         bool "Paranoia Checks in Low Level TLB Handlers"
-        default n
 
 endif
 
 config ARC_UBOOT_SUPPORT
         bool "Support uboot arg Handling"
-        default n
         help
           ARC Linux by default checks for uboot provided args as pointers to
           external cmdline or DTB. This however breaks in absence of uboot,
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index c64c505d966c..df00578c279d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -6,7 +6,7 @@
 # published by the Free Software Foundation.
 #
 
-KBUILD_DEFCONFIG := nsim_700_defconfig
+KBUILD_DEFCONFIG := nsim_hs_defconfig
 
 cflags-y        += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
 cflags-$(CONFIG_ISA_ARCOMPACT)  += -mA7
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index ef149f59929a..43f17b51ee89 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -222,6 +222,21 @@
                         bus-width = <4>;
                         dma-coherent;
                 };
+
+                gpio: gpio@3000 {
+                        compatible = "snps,dw-apb-gpio";
+                        reg = <0x3000 0x20>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        gpio_port_a: gpio-controller@0 {
+                                compatible = "snps,dw-apb-gpio-port";
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                snps,nr-gpios = <24>;
+                                reg = <0>;
+                        };
+                };
         };
 
         memory@80000000 {
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index 41bc08be6a3b..020d4493edfd 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -14,6 +14,7 @@ CONFIG_PERF_EVENTS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
 CONFIG_MODULE_UNLOAD=y
@@ -95,6 +96,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index 1e1c4a8011b5..666314fffc60 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -94,6 +94,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index 6b0c0cfd5c30..429832b8560b 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -97,6 +97,7 @@ CONFIG_VFAT_FS=y
 CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 1dec2b4bc5e6..87b23b7fb781 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -45,6 +45,9 @@ CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_DWAPB=y
 # CONFIG_HWMON is not set
 CONFIG_DRM=y
 # CONFIG_DRM_FBDEV_EMULATION is not set
@@ -65,6 +68,7 @@ CONFIG_EXT3_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 31ba224bbfb4..6e84060e7c90 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -15,6 +15,7 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
@@ -73,6 +74,7 @@ CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_ROOT_NFS=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 8e0b8b134cd9..219c2a65294b 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 # CONFIG_LBDAF is not set
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index f14eeff7d308..35dfc6491a09 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
 CONFIG_PERF_EVENTS=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_KPROBES=y
 CONFIG_MODULES=y
 # CONFIG_LBDAF is not set
@@ -66,5 +67,6 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index 025298a48305..1638e5bc9672 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -65,5 +65,6 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index df7b77b13b82..11cfbdb0f441 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -76,6 +76,7 @@ CONFIG_EXT2_FS_XATTR=y
 CONFIG_TMPFS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FTRACE=y
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index a7f65313f84a..e71ade3cf9c8 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y
 # CONFIG_AIO is not set
 CONFIG_EMBEDDED=y
 # CONFIG_COMPAT_BRK is not set
+CONFIG_ISA_ARCOMPACT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index db47c3541f15..1e59a2e9c602 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -85,6 +85,7 @@ CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index a8ac5e917d9a..b5c3f6c54b03 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -90,6 +90,7 @@ CONFIG_NTFS_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
 CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index ff7d3232764a..f393b663413e 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -113,7 +113,9 @@ extern unsigned long perip_base, perip_end;
 
 /* IO coherency related Auxiliary registers */
 #define ARC_REG_IO_COH_ENABLE   0x500
+#define ARC_IO_COH_ENABLE_BIT   BIT(0)
 #define ARC_REG_IO_COH_PARTIAL  0x501
+#define ARC_IO_COH_PARTIAL_BIT  BIT(0)
 #define ARC_REG_IO_COH_AP0_BASE 0x508
 #define ARC_REG_IO_COH_AP0_SIZE 0x509
 
diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
index c22b181e8206..2f39d9b3886e 100644
--- a/arch/arc/include/asm/io.h
+++ b/arch/arc/include/asm/io.h
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
 #include <asm/page.h>
+#include <asm/unaligned.h>
 
 #ifdef CONFIG_ISA_ARCV2
 #include <asm/barrier.h>
@@ -94,6 +95,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
         return w;
 }
 
+/*
+ * {read,write}s{b,w,l}() repeatedly access the same IO address in
+ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
+ * @count times
+ */
+#define __raw_readsx(t,f) \
+static inline void __raw_reads##f(const volatile void __iomem *addr,    \
+                                  void *ptr, unsigned int count)        \
+{                                                                       \
+        bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0;        \
+        u##t *buf = ptr;                                                \
+                                                                        \
+        if (!count)                                                     \
+                return;                                                 \
+                                                                        \
+        /* Some ARC CPU's don't support unaligned accesses */           \
+        if (is_aligned) {                                               \
+                do {                                                    \
+                        u##t x = __raw_read##f(addr);                   \
+                        *buf++ = x;                                     \
+                } while (--count);                                      \
+        } else {                                                        \
+                do {                                                    \
+                        u##t x = __raw_read##f(addr);                   \
+                        put_unaligned(x, buf++);                        \
+                } while (--count);                                      \
+        }                                                               \
+}
+
+#define __raw_readsb __raw_readsb
+__raw_readsx(8, b)
+#define __raw_readsw __raw_readsw
+__raw_readsx(16, w)
+#define __raw_readsl __raw_readsl
+__raw_readsx(32, l)
+
 #define __raw_writeb __raw_writeb
 static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
 {
@@ -126,6 +163,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
 
 }
 
+#define __raw_writesx(t,f)                                              \
+static inline void __raw_writes##f(volatile void __iomem *addr,         \
+                                   const void *ptr, unsigned int count) \
+{                                                                       \
+        bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0;        \
+        const u##t *buf = ptr;                                          \
+                                                                        \
+        if (!count)                                                     \
+                return;                                                 \
+                                                                        \
+        /* Some ARC CPU's don't support unaligned accesses */           \
+        if (is_aligned) {                                               \
+                do {                                                    \
+                        __raw_write##f(*buf++, addr);                   \
+                } while (--count);                                      \
+        } else {                                                        \
+                do {                                                    \
+                        __raw_write##f(get_unaligned(buf++), addr);     \
+                } while (--count);                                      \
+        }                                                               \
+}
+
+#define __raw_writesb __raw_writesb
+__raw_writesx(8, b)
+#define __raw_writesw __raw_writesw
+__raw_writesx(16, w)
+#define __raw_writesl __raw_writesl
+__raw_writesx(32, l)
+
 /*
  * MMIO can also get buffered/optimized in micro-arch, so barriers needed
  * Based on ARM model for the typical use case
@@ -141,10 +207,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
 #define readb(c)                ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
 #define readw(c)                ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
 #define readl(c)                ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
+#define readsb(p,d,l)           ({ __raw_readsb(p,d,l); __iormb(); })
+#define readsw(p,d,l)           ({ __raw_readsw(p,d,l); __iormb(); })
+#define readsl(p,d,l)           ({ __raw_readsl(p,d,l); __iormb(); })
 
 #define writeb(v,c)             ({ __iowmb(); writeb_relaxed(v,c); })
 #define writew(v,c)             ({ __iowmb(); writew_relaxed(v,c); })
 #define writel(v,c)             ({ __iowmb(); writel_relaxed(v,c); })
+#define writesb(p,d,l)          ({ __iowmb(); __raw_writesb(p,d,l); })
+#define writesw(p,d,l)          ({ __iowmb(); __raw_writesw(p,d,l); })
+#define writesl(p,d,l)          ({ __iowmb(); __raw_writesl(p,d,l); })
 
 /*
  * Relaxed API for drivers which can handle barrier ordering themselves
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index b2cae79a25d7..eea8c5ce6335 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -243,7 +243,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[cpu_id];
         struct bcr_identity *core = &cpu->core;
-        int i, n = 0;
+        int i, n = 0, ua = 0;
 
         FIX_PTR(cpu);
 
@@ -263,10 +263,13 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        IS_AVAIL2(cpu->extn.rtc, "RTC [UP 64-bit] ", CONFIG_ARC_TIMERS_64BIT),
                        IS_AVAIL2(cpu->extn.gfrc, "GFRC [SMP 64-bit] ", CONFIG_ARC_TIMERS_64BIT));
 
-        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s",
+#ifdef __ARC_UNALIGNED__
+        ua = 1;
+#endif
+        n += i = scnprintf(buf + n, len - n, "%s%s%s%s%s%s",
                            IS_AVAIL2(cpu->isa.atomic, "atomic ", CONFIG_ARC_HAS_LLSC),
                            IS_AVAIL2(cpu->isa.ldd, "ll64 ", CONFIG_ARC_HAS_LL64),
-                           IS_AVAIL1(cpu->isa.unalign, "unalign (not used)"));
+                           IS_AVAIL1(cpu->isa.unalign, "unalign "), IS_USED_RUN(ua));
 
         if (i)
                 n += scnprintf(buf + n, len - n, "\n\t\t: ");
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index f2701c13a66b..cf9619d4efb4 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1145,6 +1145,20 @@ noinline void __init arc_ioc_setup(void)
         unsigned int ioc_base, mem_sz;
 
         /*
+         * If IOC was already enabled (due to bootloader) it technically needs to
+         * be reconfigured with aperture base,size corresponding to Linux memory map
+         * which will certainly be different than uboot's. But disabling and
+         * reenabling IOC when DMA might be potentially active is tricky business.
+         * To avoid random memory issues later, just panic here and ask user to
+         * upgrade bootloader to one which doesn't enable IOC
+         */
+        if (read_aux_reg(ARC_REG_IO_COH_ENABLE) & ARC_IO_COH_ENABLE_BIT)
+                panic("IOC already enabled, please upgrade bootloader!\n");
+
+        if (!ioc_enable)
+                return;
+
+        /*
          * As for today we don't support both IOC and ZONE_HIGHMEM enabled
          * simultaneously. This happens because as of today IOC aperture covers
          * only ZONE_NORMAL (low mem) and any dma transactions outside this
@@ -1187,8 +1201,8 @@ noinline void __init arc_ioc_setup(void)
                 panic("IOC Aperture start must be aligned to the size of the aperture");
 
         write_aux_reg(ARC_REG_IO_COH_AP0_BASE, ioc_base >> 12);
-        write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
-        write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
+        write_aux_reg(ARC_REG_IO_COH_PARTIAL, ARC_IO_COH_PARTIAL_BIT);
+        write_aux_reg(ARC_REG_IO_COH_ENABLE, ARC_IO_COH_ENABLE_BIT);
 
         /* Re-enable L1 dcache */
         __dc_enable();
@@ -1265,7 +1279,7 @@ void __init arc_cache_init_master(void)
         if (is_isa_arcv2() && l2_line_sz && !slc_enable)
                 arc_slc_disable();
 
-        if (is_isa_arcv2() && ioc_enable)
+        if (is_isa_arcv2() && ioc_exists)
                 arc_ioc_setup();
 
         if (is_isa_arcv2() && l2_line_sz && slc_enable) {
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index c9da6102eb4f..e2d9fc3fea01 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -66,7 +66,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
         struct vm_area_struct *vma = NULL;
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        int si_code;
+        int si_code = 0;
         int ret;
         vm_fault_t fault;
         int write = regs->ecr_cause & ECR_C_PROTV_STORE;  /* ST/EX */
diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
index f2a1d25eb6cf..83e0fbc4a1a1 100644
--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
+++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
@@ -45,7 +45,7 @@
         };
 
         /* The voltage to the MMC card is hardwired at 3.3V */
-        vmmc: fixedregulator@0 {
+        vmmc: regulator-vmmc {
                 compatible = "regulator-fixed";
                 regulator-name = "vmmc";
                 regulator-min-microvolt = <3300000>;
@@ -53,7 +53,7 @@
                 regulator-boot-on;
         };
 
-        veth: fixedregulator@0 {
+        veth: regulator-veth {
                 compatible = "regulator-fixed";
                 regulator-name = "veth";
                 regulator-min-microvolt = <3300000>;
diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
index 7f9cbdf33a51..2f6aa24a0b67 100644
--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
+++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
@@ -145,7 +145,7 @@
         };
 
         /* The voltage to the MMC card is hardwired at 3.3V */
-        vmmc: fixedregulator@0 {
+        vmmc: regulator-vmmc {
                 compatible = "regulator-fixed";
                 regulator-name = "vmmc";
                 regulator-min-microvolt = <3300000>;
@@ -153,7 +153,7 @@
                 regulator-boot-on;
         };
 
-        veth: fixedregulator@0 {
+        veth: regulator-veth {
                 compatible = "regulator-fixed";
                 regulator-name = "veth";
                 regulator-min-microvolt = <3300000>;
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
index 4adb85e66be3..93762244be7f 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
@@ -31,7 +31,7 @@
 
         wifi_pwrseq: wifi-pwrseq {
                 compatible = "mmc-pwrseq-simple";
-                reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
+                reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
index c318bcbc6ba7..89e6fd547c75 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
@@ -26,7 +26,7 @@
 
         wifi_pwrseq: wifi-pwrseq {
                 compatible = "mmc-pwrseq-simple";
-                reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
+                reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
         };
 };
 
diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
index d8aac4a2d02a..177d21fdeb28 100644
--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
+++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
@@ -86,13 +86,17 @@
                 compatible = "regulator-fixed";
                 regulator-min-microvolt = <3300000>;
                 regulator-max-microvolt = <3300000>;
-                clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
-                clock-names = "slow";
                 regulator-name = "reg_wlan";
                 startup-delay-us = <70000>;
                 gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>;
                 enable-active-high;
         };
+
+        usdhc2_pwrseq: usdhc2_pwrseq {
+                compatible = "mmc-pwrseq-simple";
+                clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
+                clock-names = "ext_clock";
+        };
 };
 
 &adc1 {
@@ -375,6 +379,7 @@
         bus-width = <4>;
         non-removable;
         vmmc-supply = <&reg_wlan>;
+        mmc-pwrseq = <&usdhc2_pwrseq>;
         cap-power-off-card;
         keep-power-in-suspend;
         status = "okay";
diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
index 21973eb55671..f27b3849d3ff 100644
--- a/arch/arm/boot/dts/imx7d-pico.dtsi
+++ b/arch/arm/boot/dts/imx7d-pico.dtsi
@@ -100,6 +100,19 @@
                 regulator-min-microvolt = <1800000>;
                 regulator-max-microvolt = <1800000>;
         };
+
+        usdhc2_pwrseq: usdhc2_pwrseq {
+                compatible = "mmc-pwrseq-simple";
+                clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
+                clock-names = "ext_clock";
+        };
+};
+
+&clks {
+        assigned-clocks = <&clks IMX7D_CLKO2_ROOT_SRC>,
+                          <&clks IMX7D_CLKO2_ROOT_DIV>;
+        assigned-clock-parents = <&clks IMX7D_CKIL>;
+        assigned-clock-rates = <0>, <32768>;
 };
 
 &i2c4 {
@@ -199,12 +212,13 @@
 
 &usdhc2 { /* Wifi SDIO */
         pinctrl-names = "default";
-        pinctrl-0 = <&pinctrl_usdhc2>;
+        pinctrl-0 = <&pinctrl_usdhc2 &pinctrl_wifi_clk>;
         no-1-8-v;
         non-removable;
         keep-power-in-suspend;
         wakeup-source;
         vmmc-supply = <&reg_ap6212>;
+        mmc-pwrseq = <&usdhc2_pwrseq>;
         status = "okay";
 };
 
@@ -301,6 +315,12 @@
 };
 
 &iomuxc_lpsr {
+        pinctrl_wifi_clk: wificlkgrp {
+                fsl,pins = <
+                        MX7D_PAD_LPSR_GPIO1_IO03__CCM_CLKO2     0x7d
+                >;
+        };
+
         pinctrl_wdog: wdoggrp {
                 fsl,pins = <
                         MX7D_PAD_LPSR_GPIO1_IO00__WDOG1_WDOG_B  0x74
diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
index 742d2946b08b..583a5a01642f 100644
--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
@@ -314,8 +314,8 @@
 
 &reg_dldo3 {
         regulator-always-on;
-        regulator-min-microvolt = <2500000>;
-        regulator-max-microvolt = <2500000>;
+        regulator-min-microvolt = <3300000>;
+        regulator-max-microvolt = <3300000>;
         regulator-name = "vcc-pd";
 };
 
diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
index 243a108a940b..fd0053e47a15 100644
--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
+++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
@@ -110,7 +110,7 @@ int __init imx6sx_cpuidle_init(void)
          * except for power up sw2iso which need to be
          * larger than LDO ramp up time.
          */
-        imx_gpc_set_arm_power_up_timing(2, 1);
+        imx_gpc_set_arm_power_up_timing(0xf, 1);
         imx_gpc_set_arm_power_down_timing(1, 1);
 
         return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
diff --git a/arch/arm/mach-mmp/cputype.h b/arch/arm/mach-mmp/cputype.h
index 446edaeb78a7..a96abcf521b4 100644
--- a/arch/arm/mach-mmp/cputype.h
+++ b/arch/arm/mach-mmp/cputype.h
@@ -44,10 +44,12 @@ static inline int cpu_is_pxa910(void)
 #define cpu_is_pxa910() (0)
 #endif
 
-#ifdef CONFIG_CPU_MMP2
+#if defined(CONFIG_CPU_MMP2) || defined(CONFIG_MACH_MMP2_DT)
 static inline int cpu_is_mmp2(void)
 {
-        return (((read_cpuid_id() >> 8) & 0xff) == 0x58);
+        return (((read_cpuid_id() >> 8) & 0xff) == 0x58) &&
+                (((mmp_chip_id & 0xfff) == 0x410) ||
+                 ((mmp_chip_id & 0xfff) == 0x610));
 }
 #else
 #define cpu_is_mmp2()   (0)
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 215df435bfb9..2149b47a0c5a 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -360,14 +360,16 @@ v7_dma_inv_range:
         ALT_UP(W(nop))
 #endif
         mcrne   p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
+        addne   r0, r0, r2
 
         tst     r1, r3
         bic     r1, r1, r3
         mcrne   p15, 0, r1, c7, c14, 1          @ clean & invalidate D / U line
-1:
-        mcr     p15, 0, r0, c7, c6, 1           @ invalidate D / U line
-        add     r0, r0, r2
         cmp     r0, r1
+1:
+        mcrlo   p15, 0, r0, c7, c6, 1           @ invalidate D / U line
+        addlo   r0, r0, r2
+        cmplo   r0, r1
         blo     1b
         dsb     st
         ret     lr
diff --git a/arch/arm/mm/cache-v7m.S b/arch/arm/mm/cache-v7m.S
index 788486e830d3..32aa2a2aa260 100644
--- a/arch/arm/mm/cache-v7m.S
+++ b/arch/arm/mm/cache-v7m.S
@@ -73,9 +73,11 @@
 /*
  * dcimvac: Invalidate data cache line by MVA to PoC
  */
-.macro dcimvac, rt, tmp
-        v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC
+.irp    c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+.macro dcimvac\c, rt, tmp
+        v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC, \c
 .endm
+.endr
 
 /*
  * dccmvau: Clean data cache line by MVA to PoU
@@ -369,14 +371,16 @@ v7m_dma_inv_range:
         tst     r0, r3
         bic     r0, r0, r3
         dccimvacne r0, r3
+        addne   r0, r0, r2
         subne   r3, r2, #1      @ restore r3, corrupted by v7m's dccimvac
         tst     r1, r3
         bic     r1, r1, r3
         dccimvacne r1, r3
-1:
-        dcimvac r0, r3
-        add     r0, r0, r2
         cmp     r0, r1
+1:
+        dcimvaclo r0, r3
+        addlo   r0, r0, r2
+        cmplo   r0, r1
         blo     1b
         dsb     st
         ret     lr
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 661fe48ab78d..78de138aa66d 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -829,7 +829,7 @@ static int __arm_dma_mmap(struct device *dev, struct vm_area_struct *vma,
                  void *cpu_addr, dma_addr_t dma_addr, size_t size,
                  unsigned long attrs)
 {
-        int ret;
+        int ret = -ENXIO;
         unsigned long nr_vma_pages = vma_pages(vma);
         unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
         unsigned long pfn = dma_to_pfn(dev, dma_addr);
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index 81d0efb055c6..19516fbc2c55 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -274,6 +274,13 @@
         .endm
 
 .macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0
+/*
+ * If we are building for big.Little with branch predictor hardening,
+ * we need the processor function tables to remain available after boot.
+ */
+#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+        .section ".rodata"
+#endif
         .type   \name\()_processor_functions, #object
         .align 2
 ENTRY(\name\()_processor_functions)
@@ -309,6 +316,9 @@ ENTRY(\name\()_processor_functions)
         .endif
 
         .size   \name\()_processor_functions, . - \name\()_processor_functions
+#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+        .previous
+#endif
 .endm
 
 .macro define_cache_functions name:req
diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
index b2aa9b32bff2..2c118a6ab358 100644
--- a/arch/arm/probes/kprobes/opt-arm.c
+++ b/arch/arm/probes/kprobes/opt-arm.c
@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
         }
 
         /* Copy arch-dep-instance from template. */
-        memcpy(code, &optprobe_template_entry,
+        memcpy(code, (unsigned char *)optprobe_template_entry,
                         TMPL_END_IDX * sizeof(kprobe_opcode_t));
 
         /* Adjust buffer according to instruction. */
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806-quad.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806-quad.dtsi
index 64632c873888..01ea662afba8 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806-quad.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806-quad.dtsi
@@ -20,28 +20,24 @@
                         compatible = "arm,cortex-a72", "arm,armv8";
                         reg = <0x000>;
                         enable-method = "psci";
-                        cpu-idle-states = <&CPU_SLEEP_0>;
                 };
                 cpu1: cpu@1 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a72", "arm,armv8";
                         reg = <0x001>;
                         enable-method = "psci";
-                        cpu-idle-states = <&CPU_SLEEP_0>;
                 };
                 cpu2: cpu@100 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a72", "arm,armv8";
                         reg = <0x100>;
                         enable-method = "psci";
-                        cpu-idle-states = <&CPU_SLEEP_0>;
                 };
                 cpu3: cpu@101 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a72", "arm,armv8";
                         reg = <0x101>;
                         enable-method = "psci";
-                        cpu-idle-states = <&CPU_SLEEP_0>;
                 };
         };
 };
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index 073610ac0a53..7d94c1fa592a 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -28,33 +28,6 @@
                 method = "smc";
         };
 
-        cpus {
-                #address-cells = <1>;
-                #size-cells = <0>;
-
-                idle_states {
-                        entry_method = "arm,pcsi";
-
-                        CPU_SLEEP_0: cpu-sleep-0 {
-                                compatible = "arm,idle-state";
-                                local-timer-stop;
-                                arm,psci-suspend-param = <0x0010000>;
-                                entry-latency-us = <80>;
-                                exit-latency-us  = <160>;
-                                min-residency-us = <320>;
-                        };
-
-                        CLUSTER_SLEEP_0: cluster-sleep-0 {
-                                compatible = "arm,idle-state";
-                                local-timer-stop;
-                                arm,psci-suspend-param = <0x1010000>;
-                                entry-latency-us = <500>;
-                                exit-latency-us = <1000>;
-                                min-residency-us = <2500>;
-                        };
-                };
-        };
-
         ap806 {
                 #address-cells = <2>;
                 #size-cells = <2>;
diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
index 5d6005c9b097..710c5c3d87d3 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
@@ -16,8 +16,13 @@
         model = "Bananapi BPI-R64";
         compatible = "bananapi,bpi-r64", "mediatek,mt7622";
 
+        aliases {
+                serial0 = &uart0;
+        };
+
         chosen {
-                bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
+                stdout-path = "serial0:115200n8";
+                bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
         };
 
         cpus {
diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
index dcad0869b84c..3f783348c66a 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
@@ -17,8 +17,13 @@
         model = "MediaTek MT7622 RFB1 board";
         compatible = "mediatek,mt7622-rfb1", "mediatek,mt7622";
 
+        aliases {
+                serial0 = &uart0;
+        };
+
         chosen {
-                bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
+                stdout-path = "serial0:115200n8";
+                bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
         };
 
         cpus {
diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
index fe0c875f1d95..14a1028ca3a6 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
@@ -227,16 +227,6 @@
                 #reset-cells = <1>;
         };
 
-        timer: timer@10004000 {
-                compatible = "mediatek,mt7622-timer",
-                             "mediatek,mt6577-timer";
-                reg = <0 0x10004000 0 0x80>;
-                interrupts = <GIC_SPI 152 IRQ_TYPE_LEVEL_LOW>;
-                clocks = <&infracfg CLK_INFRA_APXGPT_PD>,
-                         <&topckgen CLK_TOP_RTC>;
-                clock-names = "system-clk", "rtc-clk";
-        };
-
         scpsys: scpsys@10006000 {
                 compatible = "mediatek,mt7622-scpsys",
                              "syscon";
diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
index d667eee4e6d0..b3def0358177 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
@@ -343,6 +343,12 @@
         };
 };
 
+&gcc {
+        protected-clocks = <GCC_QSPI_CORE_CLK>,
+                           <GCC_QSPI_CORE_CLK_SRC>,
+                           <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
+};
+
 &i2c10 {
         status = "okay";
         clock-frequency = <400000>;
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index b96442960aea..f0a5c9531e8b 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -35,15 +35,6 @@
 #define PCI_IO_SIZE             SZ_16M
 
 /*
- * Log2 of the upper bound of the size of a struct page. Used for sizing
- * the vmemmap region only, does not affect actual memory footprint.
- * We don't use sizeof(struct page) directly since taking its size here
- * requires its definition to be available at this point in the inclusion
- * chain, and it may not be a power of 2 in the first place.
- */
-#define STRUCT_PAGE_MAX_SHIFT   6
-
-/*
  * VMEMMAP_SIZE - allows the whole linear region to be covered by
  *                a struct page array
  */
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 6b2686d54411..29cdc99688f3 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -214,7 +214,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
         }
 
         memcpy((void *)dst, src_start, length);
-        flush_icache_range(dst, dst + length);
+        __flush_icache_range(dst, dst + length);
 
         pgdp = pgd_offset_raw(allocator(mask), dst_addr);
         if (pgd_none(READ_ONCE(*pgdp))) {
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index a3ac26284845..a53704406099 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -429,9 +429,9 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
                                                    prot,
                                                    __builtin_return_address(0));
                 if (addr) {
-                        memset(addr, 0, size);
                         if (!coherent)
                                 __dma_flush_area(page_to_virt(page), iosize);
+                        memset(addr, 0, size);
                 } else {
                         iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
                         dma_release_from_contiguous(dev, page,
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 9b432d9fcada..0340e45655c6 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -610,14 +610,6 @@ void __init mem_init(void)
         BUILD_BUG_ON(TASK_SIZE_32                       > TASK_SIZE_64);
 #endif
 
-#ifdef CONFIG_SPARSEMEM_VMEMMAP
-        /*
-         * Make sure we chose the upper bound of sizeof(struct page)
-         * correctly when sizing the VMEMMAP array.
-         */
-        BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
-#endif
-
         if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
                 extern int sysctl_overcommit_memory;
                 /*
diff --git a/arch/csky/include/asm/mmu_context.h b/arch/csky/include/asm/mmu_context.h
index c410aa4fff1a..b2905c0485a7 100644
--- a/arch/csky/include/asm/mmu_context.h
+++ b/arch/csky/include/asm/mmu_context.h
@@ -16,7 +16,7 @@
 
 static inline void tlbmiss_handler_setup_pgd(unsigned long pgd, bool kernel)
 {
-        pgd &= ~(1<<31);
+        pgd -= PAGE_OFFSET;
         pgd += PHYS_OFFSET;
         pgd |= 1;
         setup_pgd(pgd, kernel);
@@ -29,7 +29,7 @@ static inline void tlbmiss_handler_setup_pgd(unsigned long pgd, bool kernel)
 
 static inline unsigned long tlb_get_pgd(void)
 {
-        return ((get_pgd()|(1<<31)) - PHYS_OFFSET) & ~1;
+        return ((get_pgd() - PHYS_OFFSET) & ~1) + PAGE_OFFSET;
 }
 
 #define cpu_context(cpu, mm)    ((mm)->context.asid[cpu])
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index d047a09d660f..1085385e1f06 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -71,6 +71,13 @@ ifdef CONFIG_MLONGCALLS
 KBUILD_CFLAGS_KERNEL += -mlong-calls
 endif
 
+# Without this, "ld -r" results in .text sections that are too big (> 0x40000)
+# for branches to reach stubs. And multiple .text sections trigger a warning
+# when creating the sysfs module information section.
+ifndef CONFIG_64BIT
+KBUILD_CFLAGS_MODULE += -ffunction-sections
+endif
+
 # select which processor to optimise for
 cflags-$(CONFIG_PA7000)         += -march=1.1 -mschedule=7100
 cflags-$(CONFIG_PA7200)         += -march=1.1 -mschedule=7200
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 39354365f54a..ed9883169190 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -197,7 +197,7 @@ $(obj)/empty.c:
 $(obj)/zImage.coff.lds $(obj)/zImage.ps3.lds : $(obj)/%: $(srctree)/$(src)/%.S
         $(Q)cp $< $@
 
-$(obj)/serial.c: $(obj)/autoconf.h
+$(srctree)/$(src)/serial.c: $(obj)/autoconf.h
 
 $(obj)/autoconf.h: $(obj)/%: $(objtree)/include/generated/%
         $(Q)cp $< $@
diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
index 32dfe6d083f3..9b9d17437373 100644
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -15,7 +15,7 @@
 RELA = 7
 RELACOUNT = 0x6ffffff9
 
-        .text
+        .data
         /* A procedure descriptor used when booting this as a COFF file.
          * When making COFF, this comes first in the link and we're
          * linked at 0x500000.
@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9
         .globl  _zimage_start_opd
 _zimage_start_opd:
         .long   0x500000, 0, 0, 0
+        .text
+        b       _zimage_start
 
 #ifdef __powerpc64__
 .balign 8
diff --git a/arch/powerpc/include/asm/perf_event.h b/arch/powerpc/include/asm/perf_event.h
index 8bf1b6351716..16a49819da9a 100644
--- a/arch/powerpc/include/asm/perf_event.h
+++ b/arch/powerpc/include/asm/perf_event.h
@@ -26,6 +26,8 @@
 #include <asm/ptrace.h>
 #include <asm/reg.h>
 
+#define perf_arch_bpf_user_pt_regs(regs) &regs->user_regs
+
 /*
  * Overload regs->result to specify whether we should use the MSR (result
  * is zero) or the SIAR (result is non zero).
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index a658091a19f9..3712152206f3 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -1,7 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
-generic-y += bpf_perf_event.h
 generic-y += param.h
 generic-y += poll.h
 generic-y += resource.h
diff --git a/arch/powerpc/include/uapi/asm/bpf_perf_event.h b/arch/powerpc/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..b551b741653d
--- /dev/null
+++ b/arch/powerpc/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_BPF_PERF_EVENT_H__
+
+#include <asm/ptrace.h>
+
+typedef struct user_pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index 33b34a58fc62..5b9dce17f0c9 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -372,6 +372,8 @@ void __init find_legacy_serial_ports(void)
 
         /* Now find out if one of these is out firmware console */
         path = of_get_property(of_chosen, "linux,stdout-path", NULL);
+        if (path == NULL)
+                path = of_get_property(of_chosen, "stdout-path", NULL);
         if (path != NULL) {
                 stdout = of_find_node_by_path(path);
                 if (stdout)
@@ -595,8 +597,10 @@ static int __init check_legacy_serial_console(void)
         /* We are getting a weird phandle from OF ... */
         /* ... So use the full path instead */
         name = of_get_property(of_chosen, "linux,stdout-path", NULL);
+        if (name == NULL)
+                name = of_get_property(of_chosen, "stdout-path", NULL);
         if (name == NULL) {
-                DBG(" no linux,stdout-path !\n");
+                DBG(" no stdout-path !\n");
                 return -ENODEV;
         }
         prom_stdout = of_find_node_by_path(name);
diff --git a/arch/powerpc/kernel/msi.c b/arch/powerpc/kernel/msi.c
index dab616a33b8d..f2197654be07 100644
--- a/arch/powerpc/kernel/msi.c
+++ b/arch/powerpc/kernel/msi.c
@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev)
 {
         struct pci_controller *phb = pci_bus_to_host(dev->bus);
 
-        phb->controller_ops.teardown_msi_irqs(dev);
+        /*
+         * We can be called even when arch_setup_msi_irqs() returns -ENOSYS,
+         * so check the pointer again.
+         */
+        if (phb->controller_ops.teardown_msi_irqs)
+                phb->controller_ops.teardown_msi_irqs(dev);
 }
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index afb819f4ca68..714c3480c52d 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -3266,12 +3266,17 @@ long do_syscall_trace_enter(struct pt_regs *regs)
         user_exit();
 
         if (test_thread_flag(TIF_SYSCALL_EMU)) {
-                ptrace_report_syscall(regs);
                 /*
+                 * A nonzero return code from tracehook_report_syscall_entry()
+                 * tells us to prevent the syscall execution, but we are not
+                 * going to execute it anyway.
+                 *
                  * Returning -1 will skip the syscall execution. We want to
                  * avoid clobbering any register also, thus, not 'gotoing'
                  * skip label.
                  */
+                if (tracehook_report_syscall_entry(regs))
+                        ;
                 return -1;
         }
 
diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
index 2b74f8adf4d0..6aa41669ac1a 100644
--- a/arch/powerpc/mm/dump_linuxpagetables.c
+++ b/arch/powerpc/mm/dump_linuxpagetables.c
@@ -19,6 +19,7 @@
 #include <linux/hugetlb.h>
 #include <linux/io.h>
 #include <linux/mm.h>
+#include <linux/highmem.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <asm/fixmap.h>
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 7a9886f98b0c..a5091c034747 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -188,15 +188,20 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
         pr_debug("vmemmap_populate %lx..%lx, node %d\n", start, end, node);
 
         for (; start < end; start += page_size) {
-                void *p;
+                void *p = NULL;
                 int rc;
 
                 if (vmemmap_populated(start, page_size))
                         continue;
 
+                /*
+                 * Allocate from the altmap first if we have one. This may
+                 * fail due to alignment issues when using 16MB hugepages, so
+                 * fall back to system memory if the altmap allocation fail.
+                 */
                 if (altmap)
                         p = altmap_alloc_block_buf(page_size, altmap);
-                else
+                if (!p)
                         p = vmemmap_alloc_block_buf(page_size, node);
                 if (!p)
                         return -ENOMEM;
@@ -255,8 +260,15 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
 {
         unsigned long page_size = 1 << mmu_psize_defs[mmu_vmemmap_psize].shift;
         unsigned long page_order = get_order(page_size);
+        unsigned long alt_start = ~0, alt_end = ~0;
+        unsigned long base_pfn;
 
         start = _ALIGN_DOWN(start, page_size);
+        if (altmap) {
+                alt_start = altmap->base_pfn;
+                alt_end = altmap->base_pfn + altmap->reserve +
+                          altmap->free + altmap->alloc + altmap->align;
+        }
 
         pr_debug("vmemmap_free %lx...%lx\n", start, end);
 
@@ -280,8 +292,9 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
                 page = pfn_to_page(addr >> PAGE_SHIFT);
                 section_base = pfn_to_page(vmemmap_section_start(start));
                 nr_pages = 1 << page_order;
+                base_pfn = PHYS_PFN(addr);
 
-                if (altmap) {
+                if (base_pfn >= alt_start && base_pfn < alt_end) {
                         vmem_altmap_free(altmap, nr_pages);
                 } else if (PageReserved(page)) {
                         /* allocated from bootmem */
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 17482f5de3e2..9393e231cbc2 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -891,6 +891,55 @@ cond_branch:
         return 0;
 }
 
+/* Fix the branch target addresses for subprog calls */
+static int bpf_jit_fixup_subprog_calls(struct bpf_prog *fp, u32 *image,
+                                       struct codegen_context *ctx, u32 *addrs)
+{
+        const struct bpf_insn *insn = fp->insnsi;
+        bool func_addr_fixed;
+        u64 func_addr;
+        u32 tmp_idx;
+        int i, ret;
+
+        for (i = 0; i < fp->len; i++) {
+                /*
+                 * During the extra pass, only the branch target addresses for
+                 * the subprog calls need to be fixed. All other instructions
+                 * can left untouched.
+                 *
+                 * The JITed image length does not change because we already
+                 * ensure that the JITed instruction sequence for these calls
+                 * are of fixed length by padding them with NOPs.
+                 */
+                if (insn[i].code == (BPF_JMP | BPF_CALL) &&
+                    insn[i].src_reg == BPF_PSEUDO_CALL) {
+                        ret = bpf_jit_get_func_addr(fp, &insn[i], true,
+                                                    &func_addr,
+                                                    &func_addr_fixed);
+                        if (ret < 0)
+                                return ret;
+
+                        /*
+                         * Save ctx->idx as this would currently point to the
+                         * end of the JITed image and set it to the offset of
+                         * the instruction sequence corresponding to the
+                         * subprog call temporarily.
+                         */
+                        tmp_idx = ctx->idx;
+                        ctx->idx = addrs[i] / 4;
+                        bpf_jit_emit_func_call_rel(image, ctx, func_addr);
+
+                        /*
+                         * Restore ctx->idx here. This is safe as the length
+                         * of the JITed sequence remains unchanged.
+                         */
+                        ctx->idx = tmp_idx;
+                }
+        }
+
+        return 0;
+}
+
 struct powerpc64_jit_data {
         struct bpf_binary_header *header;
         u32 *addrs;
@@ -989,6 +1038,22 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
 skip_init_ctx:
         code_base = (u32 *)(image + FUNCTION_DESCR_SIZE);
 
+        if (extra_pass) {
+                /*
+                 * Do not touch the prologue and epilogue as they will remain
+                 * unchanged. Only fix the branch target address for subprog
+                 * calls in the body.
+                 *
+                 * This does not change the offsets and lengths of the subprog
+                 * call instruction sequences and hence, the size of the JITed
+                 * image as well.
+                 */
+                bpf_jit_fixup_subprog_calls(fp, code_base, &cgctx, addrs);
+
+                /* There is no need to perform the usual passes. */
+                goto skip_codegen_passes;
+        }
+
         /* Code generation passes 1-2 */
         for (pass = 1; pass < 3; pass++) {
                 /* Now build the prologue, body code & epilogue for real. */
@@ -1002,6 +1067,7 @@ skip_init_ctx:
                                 proglen - (cgctx.idx * 4), cgctx.seen);
         }
 
+skip_codegen_passes:
         if (bpf_jit_enable > 1)
                 /*
                  * Note that we output the base address of the code_base
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 2e4bd32154b5..472b784f01eb 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -140,8 +140,7 @@ config IBMEBUS
           Bus device driver for GX bus based adapters.
 
 config PAPR_SCM
-        depends on PPC_PSERIES && MEMORY_HOTPLUG
-        select LIBNVDIMM
+        depends on PPC_PSERIES && MEMORY_HOTPLUG && LIBNVDIMM
         tristate "Support for the PAPR Storage Class Memory interface"
         help
           Enable access to hypervisor provided storage class memory.
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
index ee9372b65ca5..7d6457ab5d34 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
@@ -55,7 +55,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
         do {
                 rc = plpar_hcall(H_SCM_BIND_MEM, ret, p->drc_index, 0,
                                 p->blocks, BIND_ANY_ADDR, token);
-                token = be64_to_cpu(ret[0]);
+                token = ret[0];
                 cond_resched();
         } while (rc == H_BUSY);
 
@@ -64,7 +64,7 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
                 return -ENXIO;
         }
 
-        p->bound_addr = be64_to_cpu(ret[1]);
+        p->bound_addr = ret[1];
 
         dev_dbg(&p->pdev->dev, "bound drc %x to %pR\n", p->drc_index, &p->res);
 
@@ -82,7 +82,7 @@ static int drc_pmem_unbind(struct papr_scm_priv *p)
         do {
                 rc = plpar_hcall(H_SCM_UNBIND_MEM, ret, p->drc_index,
                                 p->bound_addr, p->blocks, token);
-                token = be64_to_cpu(ret);
+                token = ret[0];
                 cond_resched();
         } while (rc == H_BUSY);
 
@@ -223,6 +223,9 @@ static int papr_scm_nvdimm_init(struct papr_scm_priv *p)
                 goto err;
         }
 
+        if (nvdimm_bus_check_dimm_count(p->bus, 1))
+                goto err;
+
         /* now add the region */
 
         memset(&mapping, 0, sizeof(mapping));
@@ -257,9 +260,12 @@ err:	nvdimm_bus_unregister(p->bus);
 
 static int papr_scm_probe(struct platform_device *pdev)
 {
-        uint32_t drc_index, metadata_size, unit_cap[2];
         struct device_node *dn = pdev->dev.of_node;
+        u32 drc_index, metadata_size;
+        u64 blocks, block_size;
         struct papr_scm_priv *p;
+        const char *uuid_str;
+        u64 uuid[2];
         int rc;
 
         /* check we have all the required DT properties */
@@ -268,8 +274,18 @@ static int papr_scm_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        if (of_property_read_u32_array(dn, "ibm,unit-capacity", unit_cap, 2)) {
-                dev_err(&pdev->dev, "%pOF: missing unit-capacity!\n", dn);
+        if (of_property_read_u64(dn, "ibm,block-size", &block_size)) {
+                dev_err(&pdev->dev, "%pOF: missing block-size!\n", dn);
+                return -ENODEV;
+        }
+
+        if (of_property_read_u64(dn, "ibm,number-of-blocks", &blocks)) {
+                dev_err(&pdev->dev, "%pOF: missing number-of-blocks!\n", dn);
+                return -ENODEV;
+        }
+
+        if (of_property_read_string(dn, "ibm,unit-guid", &uuid_str)) {
+                dev_err(&pdev->dev, "%pOF: missing unit-guid!\n", dn);
                 return -ENODEV;
         }
 
@@ -282,8 +298,13 @@ static int papr_scm_probe(struct platform_device *pdev)
 
         p->dn = dn;
         p->drc_index = drc_index;
-        p->block_size = unit_cap[0];
-        p->blocks     = unit_cap[1];
+        p->block_size = block_size;
+        p->blocks = blocks;
+
+        /* We just need to ensure that set cookies are unique across */
+        uuid_parse(uuid_str, (uuid_t *) uuid);
+        p->nd_set.cookie1 = uuid[0];
+        p->nd_set.cookie2 = uuid[1];
 
         /* might be zero */
         p->metadata_size = metadata_size;
@@ -296,7 +317,7 @@ static int papr_scm_probe(struct platform_device *pdev)
 
         /* setup the resource for the newly bound range */
         p->res.start = p->bound_addr;
-        p->res.end   = p->bound_addr + p->blocks * p->block_size;
+        p->res.end   = p->bound_addr + p->blocks * p->block_size - 1;
         p->res.name  = pdev->name;
         p->res.flags = IORESOURCE_MEM;
 
diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
index 98cb8c802b1a..4f7f235f15f8 100644
--- a/arch/sh/include/asm/io.h
+++ b/arch/sh/include/asm/io.h
@@ -24,6 +24,7 @@
 #define __IO_PREFIX     generic
 #include <asm/io_generic.h>
 #include <asm/io_trapped.h>
+#include <asm-generic/pci_iomap.h>
 #include <mach/mangle-port.h>
 
 #define __raw_writeb(v,a)       (__chk_io_ptr(a), *(volatile u8  __force *)(a) = (v))
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 40d008b0bd3e..05eb016fc41b 100644
--- a/arch/sparc/kernel/iommu.c
+++ b/arch/sparc/kernel/iommu.c
@@ -108,10 +108,9 @@ int iommu_table_init(struct iommu *iommu, int tsbsize,
         /* Allocate and initialize the free area map.  */
         sz = num_tsb_entries / 8;
         sz = (sz + 7UL) & ~7UL;
-        iommu->tbl.map = kmalloc_node(sz, GFP_KERNEL, numa_node);
+        iommu->tbl.map = kzalloc_node(sz, GFP_KERNEL, numa_node);
         if (!iommu->tbl.map)
                 return -ENOMEM;
-        memset(iommu->tbl.map, 0, sz);
 
         iommu_tbl_pool_init(&iommu->tbl, num_tsb_entries, IO_PAGE_SHIFT,
                             (tlb_type != hypervisor ? iommu_flushall : NULL),
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 4c5b3fcbed94..e800ce13cc6e 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -683,6 +683,7 @@ void do_signal32(struct pt_regs * regs)
                                 regs->tpc -= 4;
                                 regs->tnpc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->tpc -= 4;
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 5665261cee37..83953780ca01 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -508,6 +508,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                                 regs->pc -= 4;
                                 regs->npc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->pc -= 4;
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index e9de1803a22e..ca70787efd8e 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -533,6 +533,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                                 regs->tpc -= 4;
                                 regs->tnpc -= 4;
                                 pt_regs_clear_syscall(regs);
+                                /* fall through */
                         case ERESTART_RESTARTBLOCK:
                                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                                 regs->tpc -= 4;
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index f5d7f4134524..75ef499a66e2 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -220,9 +220,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 
 # Avoid indirect branches in kernel to deal with Spectre
 ifdef CONFIG_RETPOLINE
-ifeq ($(RETPOLINE_CFLAGS),)
-  $(error You are building kernel with non-retpoline compiler, please update your compiler.)
-endif
   KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
 endif
 
@@ -307,6 +304,13 @@ ifndef CC_HAVE_ASM_GOTO
         @echo Compiler lacks asm-goto support.
         @exit 1
 endif
+ifdef CONFIG_RETPOLINE
+ifeq ($(RETPOLINE_CFLAGS),)
+        @echo "You are building kernel with non-retpoline compiler." >&2
+        @echo "Please update your compiler." >&2
+        @false
+endif
+endif
 
 archclean:
         $(Q)rm -rf $(objtree)/arch/i386
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index 8b4c5e001157..544ac4fafd11 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -1,3 +1,4 @@
+
 /* -----------------------------------------------------------------------
  *
  *   Copyright 2011 Intel Corporation; author Matt Fleming
@@ -634,37 +635,54 @@ static efi_status_t alloc_e820ext(u32 nr_desc, struct setup_data **e820ext,
         return status;
 }
 
+static efi_status_t allocate_e820(struct boot_params *params,
+                                  struct setup_data **e820ext,
+                                  u32 *e820ext_size)
+{
+        unsigned long map_size, desc_size, buff_size;
+        struct efi_boot_memmap boot_map;
+        efi_memory_desc_t *map;
+        efi_status_t status;
+        __u32 nr_desc;
+
+        boot_map.map            = &map;
+        boot_map.map_size       = &map_size;
+        boot_map.desc_size      = &desc_size;
+        boot_map.desc_ver       = NULL;
+        boot_map.key_ptr        = NULL;
+        boot_map.buff_size      = &buff_size;
+
+        status = efi_get_memory_map(sys_table, &boot_map);
+        if (status != EFI_SUCCESS)
+                return status;
+
+        nr_desc = buff_size / desc_size;
+
+        if (nr_desc > ARRAY_SIZE(params->e820_table)) {
+                u32 nr_e820ext = nr_desc - ARRAY_SIZE(params->e820_table);
+
+                status = alloc_e820ext(nr_e820ext, e820ext, e820ext_size);
+                if (status != EFI_SUCCESS)
+                        return status;
+        }
+
+        return EFI_SUCCESS;
+}
+
 struct exit_boot_struct {
         struct boot_params      *boot_params;
         struct efi_info         *efi;
-        struct setup_data       *e820ext;
-        __u32                   e820ext_size;
 };
 
 static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
                                    struct efi_boot_memmap *map,
                                    void *priv)
 {
-        static bool first = true;
         const char *signature;
         __u32 nr_desc;
         efi_status_t status;
         struct exit_boot_struct *p = priv;
 
-        if (first) {
-                nr_desc = *map->buff_size / *map->desc_size;
-                if (nr_desc > ARRAY_SIZE(p->boot_params->e820_table)) {
-                        u32 nr_e820ext = nr_desc -
-                                        ARRAY_SIZE(p->boot_params->e820_table);
-
-                        status = alloc_e820ext(nr_e820ext, &p->e820ext,
-                                               &p->e820ext_size);
-                        if (status != EFI_SUCCESS)
-                                return status;
-                }
-                first = false;
-        }
-
         signature = efi_is_64bit() ? EFI64_LOADER_SIGNATURE
                                    : EFI32_LOADER_SIGNATURE;
         memcpy(&p->efi->efi_loader_signature, signature, sizeof(__u32));
@@ -687,8 +705,8 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
 {
         unsigned long map_sz, key, desc_size, buff_size;
         efi_memory_desc_t *mem_map;
-        struct setup_data *e820ext;
-        __u32 e820ext_size;
+        struct setup_data *e820ext = NULL;
+        __u32 e820ext_size = 0;
         efi_status_t status;
         __u32 desc_version;
         struct efi_boot_memmap map;
@@ -702,8 +720,10 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
         map.buff_size           = &buff_size;
         priv.boot_params        = boot_params;
         priv.efi                = &boot_params->efi_info;
-        priv.e820ext            = NULL;
-        priv.e820ext_size       = 0;
+
+        status = allocate_e820(boot_params, &e820ext, &e820ext_size);
+        if (status != EFI_SUCCESS)
+                return status;
 
         /* Might as well exit boot services now */
         status = efi_exit_boot_services(sys_table, handle, &map, &priv,
@@ -711,9 +731,6 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
         if (status != EFI_SUCCESS)
                 return status;
 
-        e820ext                 = priv.e820ext;
-        e820ext_size            = priv.e820ext_size;
-
         /* Historic? */
         boot_params->alt_mem_k  = 32 * 1024;
 
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index ce25d84023c0..1f0efdb7b629 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -566,6 +566,7 @@ ENTRY(interrupt_entry)
 
         ret
 END(interrupt_entry)
+_ASM_NOKPROBE(interrupt_entry)
 
 
 /* Interrupt entry/exit. */
@@ -766,6 +767,7 @@ native_irq_return_ldt:
         jmp     native_irq_return_iret
 #endif
 END(common_interrupt)
+_ASM_NOKPROBE(common_interrupt)
 
 /*
  * APIC interrupts.
@@ -780,6 +782,7 @@ ENTRY(\sym)
         call    \do_sym /* rdi points to pt_regs */
         jmp     ret_from_intr
 END(\sym)
+_ASM_NOKPROBE(\sym)
 .endm
 
 /* Make sure APIC interrupt handlers end up in the irqentry section: */
@@ -960,6 +963,7 @@ ENTRY(\sym)
 
         jmp     error_exit
         .endif
+_ASM_NOKPROBE(\sym)
 END(\sym)
 .endm
 
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 141d415a8c80..0624bf2266fd 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -47,7 +47,7 @@ targets += $(vdso_img_sodbg) $(vdso_img-y:%=vdso%.so)
 CPPFLAGS_vdso.lds += -P -C
 
 VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -soname linux-vdso.so.1 --no-undefined \
-                        -z max-page-size=4096 -z common-page-size=4096
+                        -z max-page-size=4096
 
 $(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE
         $(call if_changed,vdso)
@@ -98,7 +98,7 @@ CFLAGS_REMOVE_vvar.o = -pg
 
 CPPFLAGS_vdsox32.lds = $(CPPFLAGS_vdso.lds)
 VDSO_LDFLAGS_vdsox32.lds = -m elf32_x86_64 -soname linux-vdso.so.1 \
-                           -z max-page-size=4096 -z common-page-size=4096
+                           -z max-page-size=4096
 
 # x32-rebranded versions
 vobjx32s-y := $(vobjs-y:.o=-x32.o)
diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
index a07ffd23e4dd..f6f6ef436599 100644
--- a/arch/x86/include/asm/bootparam_utils.h
+++ b/arch/x86/include/asm/bootparam_utils.h
@@ -36,6 +36,7 @@ static void sanitize_boot_params(struct boot_params *boot_params)
          */
         if (boot_params->sentinel) {
                 /* fields in boot_params are left uninitialized, clear them */
+                boot_params->acpi_rsdp_addr = 0;
                 memset(&boot_params->ext_ramdisk_image, 0,
                        (char *)&boot_params->efi_info -
                         (char *)&boot_params->ext_ramdisk_image);
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 40b16b270656..6adf6e6c2933 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -189,7 +189,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src, u8 *real)
         int len = 0, ret;
 
         while (len < RELATIVEJUMP_SIZE) {
-                ret = __copy_instruction(dest + len, src + len, real, &insn);
+                ret = __copy_instruction(dest + len, src + len, real + len, &insn);
                 if (!ret || !can_boost(&insn, src + len))
                         return -EINVAL;
                 len += ret;
diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
index 7476b3b097e1..7138bc7a265c 100644
--- a/arch/x86/platform/efi/early_printk.c
+++ b/arch/x86/platform/efi/early_printk.c
@@ -183,7 +183,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
                         num--;
                 }
 
-                if (efi_x >= si->lfb_width) {
+                if (efi_x + font->width > si->lfb_width) {
                         efi_x = 0;
                         efi_y += font->height;
                 }
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 3a27d31fcda6..97337214bec4 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -638,7 +638,7 @@ static bool bfq_varied_queue_weights_or_active_groups(struct bfq_data *bfqd)
                  bfqd->queue_weights_tree.rb_node->rb_right)
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
                ) ||
-                (bfqd->num_active_groups > 0
+                (bfqd->num_groups_with_pending_reqs > 0
 #endif
                );
 }
@@ -802,7 +802,21 @@ void bfq_weights_tree_remove(struct bfq_data *bfqd,
                          */
                         break;
                 }
-                bfqd->num_active_groups--;
+
+                /*
+                 * The decrement of num_groups_with_pending_reqs is
+                 * not performed immediately upon the deactivation of
+                 * entity, but it is delayed to when it also happens
+                 * that the first leaf descendant bfqq of entity gets
+                 * all its pending requests completed. The following
+                 * instructions perform this delayed decrement, if
+                 * needed. See the comments on
+                 * num_groups_with_pending_reqs for details.
+                 */
+                if (entity->in_groups_with_pending_reqs) {
+                        entity->in_groups_with_pending_reqs = false;
+                        bfqd->num_groups_with_pending_reqs--;
+                }
         }
 }
 
@@ -3529,27 +3543,44 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
          * fact, if there are active groups, then, for condition (i)
          * to become false, it is enough that an active group contains
          * more active processes or sub-groups than some other active
-         * group. We address this issue with the following bi-modal
-         * behavior, implemented in the function
+         * group. More precisely, for condition (i) to hold because of
+         * such a group, it is not even necessary that the group is
+         * (still) active: it is sufficient that, even if the group
+         * has become inactive, some of its descendant processes still
+         * have some request already dispatched but still waiting for
+         * completion. In fact, requests have still to be guaranteed
+         * their share of the throughput even after being
+         * dispatched. In this respect, it is easy to show that, if a
+         * group frequently becomes inactive while still having
+         * in-flight requests, and if, when this happens, the group is
+         * not considered in the calculation of whether the scenario
+         * is asymmetric, then the group may fail to be guaranteed its
+         * fair share of the throughput (basically because idling may
+         * not be performed for the descendant processes of the group,
+         * but it had to be).  We address this issue with the
+         * following bi-modal behavior, implemented in the function
          * bfq_symmetric_scenario().
          *
-         * If there are active groups, then the scenario is tagged as
+         * If there are groups with requests waiting for completion
+         * (as commented above, some of these groups may even be
+         * already inactive), then the scenario is tagged as
          * asymmetric, conservatively, without checking any of the
          * conditions (i) and (ii). So the device is idled for bfqq.
          * This behavior matches also the fact that groups are created
-         * exactly if controlling I/O (to preserve bandwidth and
-         * latency guarantees) is a primary concern.
+         * exactly if controlling I/O is a primary concern (to
+         * preserve bandwidth and latency guarantees).
          *
-         * On the opposite end, if there are no active groups, then
-         * only condition (i) is actually controlled, i.e., provided
-         * that condition (i) holds, idling is not performed,
-         * regardless of whether condition (ii) holds. In other words,
-         * only if condition (i) does not hold, then idling is
-         * allowed, and the device tends to be prevented from queueing
-         * many requests, possibly of several processes. Since there
-         * are no active groups, then, to control condition (i) it is
-         * enough to check whether all active queues have the same
-         * weight.
+         * On the opposite end, if there are no groups with requests
+         * waiting for completion, then only condition (i) is actually
+         * controlled, i.e., provided that condition (i) holds, idling
+         * is not performed, regardless of whether condition (ii)
+         * holds. In other words, only if condition (i) does not hold,
+         * then idling is allowed, and the device tends to be
+         * prevented from queueing many requests, possibly of several
+         * processes. Since there are no groups with requests waiting
+         * for completion, then, to control condition (i) it is enough
+         * to check just whether all the queues with requests waiting
+         * for completion also have the same weight.
          *
          * Not checking condition (ii) evidently exposes bfqq to the
          * risk of getting less throughput than its fair share.
@@ -3607,10 +3638,11 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
          * bfqq is weight-raised is checked explicitly here. More
          * precisely, the compound condition below takes into account
          * also the fact that, even if bfqq is being weight-raised,
-         * the scenario is still symmetric if all active queues happen
-         * to be weight-raised. Actually, we should be even more
-         * precise here, and differentiate between interactive weight
-         * raising and soft real-time weight raising.
+         * the scenario is still symmetric if all queues with requests
+         * waiting for completion happen to be
+         * weight-raised. Actually, we should be even more precise
+         * here, and differentiate between interactive weight raising
+         * and soft real-time weight raising.
          *
          * As a side note, it is worth considering that the above
          * device-idling countermeasures may however fail in the
@@ -5417,7 +5449,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
         bfqd->idle_slice_timer.function = bfq_idle_slice_timer;
 
         bfqd->queue_weights_tree = RB_ROOT;
-        bfqd->num_active_groups = 0;
+        bfqd->num_groups_with_pending_reqs = 0;
 
         INIT_LIST_HEAD(&bfqd->active_list);
         INIT_LIST_HEAD(&bfqd->idle_list);
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index 77651d817ecd..0b02bf302de0 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -196,6 +196,9 @@ struct bfq_entity {
 
         /* flag, set to request a weight, ioprio or ioprio_class change  */
         int prio_changed;
+
+        /* flag, set if the entity is counted in groups_with_pending_reqs */
+        bool in_groups_with_pending_reqs;
 };
 
 struct bfq_group;
@@ -448,10 +451,54 @@ struct bfq_data {
          * bfq_weights_tree_[add|remove] for further details).
          */
         struct rb_root queue_weights_tree;
+
         /*
-         * number of groups with requests still waiting for completion
+         * Number of groups with at least one descendant process that
+         * has at least one request waiting for completion. Note that
+         * this accounts for also requests already dispatched, but not
+         * yet completed. Therefore this number of groups may differ
+         * (be larger) than the number of active groups, as a group is
+         * considered active only if its corresponding entity has
+         * descendant queues with at least one request queued. This
+         * number is used to decide whether a scenario is symmetric.
+         * For a detailed explanation see comments on the computation
+         * of the variable asymmetric_scenario in the function
+         * bfq_better_to_idle().
+         *
+         * However, it is hard to compute this number exactly, for
+         * groups with multiple descendant processes. Consider a group
+         * that is inactive, i.e., that has no descendant process with
+         * pending I/O inside BFQ queues. Then suppose that
+         * num_groups_with_pending_reqs is still accounting for this
+         * group, because the group has descendant processes with some
+         * I/O request still in flight. num_groups_with_pending_reqs
+         * should be decremented when the in-flight request of the
+         * last descendant process is finally completed (assuming that
+         * nothing else has changed for the group in the meantime, in
+         * terms of composition of the group and active/inactive state of child
+         * groups and processes). To accomplish this, an additional
+         * pending-request counter must be added to entities, and must
+         * be updated correctly. To avoid this additional field and operations,
+         * we resort to the following tradeoff between simplicity and
+         * accuracy: for an inactive group that is still counted in
+         * num_groups_with_pending_reqs, we decrement
+         * num_groups_with_pending_reqs when the first descendant
+         * process of the group remains with no request waiting for
+         * completion.
+         *
+         * Even this simpler decrement strategy requires a little
+         * carefulness: to avoid multiple decrements, we flag a group,
+         * more precisely an entity representing a group, as still
+         * counted in num_groups_with_pending_reqs when it becomes
+         * inactive. Then, when the first descendant queue of the
+         * entity remains with no request waiting for completion,
+         * num_groups_with_pending_reqs is decremented, and this flag
+         * is reset. After this flag is reset for the entity,
+         * num_groups_with_pending_reqs won't be decremented any
+         * longer in case a new descendant queue of the entity remains
+         * with no request waiting for completion.
          */
-        unsigned int num_active_groups;
+        unsigned int num_groups_with_pending_reqs;
 
         /*
          * Number of bfq_queues containing requests (including the
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 4b0d5fb69160..63e0f12be7c9 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1012,7 +1012,10 @@ static void __bfq_activate_entity(struct bfq_entity *entity,
                         container_of(entity, struct bfq_group, entity);
                 struct bfq_data *bfqd = bfqg->bfqd;
 
-                bfqd->num_active_groups++;
+                if (!entity->in_groups_with_pending_reqs) {
+                        entity->in_groups_with_pending_reqs = true;
+                        bfqd->num_groups_with_pending_reqs++;
+                }
         }
 #endif
 
diff --git a/block/bio.c b/block/bio.c
index 4f4d9884443b..4d86e90654b2 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1261,7 +1261,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                 if (ret)
                         goto cleanup;
         } else {
-                zero_fill_bio(bio);
+                if (bmd->is_our_pages)
+                        zero_fill_bio(bio);
                 iov_iter_advance(iter, bio->bi_iter.bi_size);
         }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3f91c6e5b17a..6a7566244de3 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1764,7 +1764,7 @@ insert:
         if (bypass_insert)
                 return BLK_STS_RESOURCE;
 
-        blk_mq_sched_insert_request(rq, false, run_queue, false);
+        blk_mq_request_bypass_insert(rq, run_queue);
         return BLK_STS_OK;
 }
 
@@ -1780,7 +1780,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
 
         ret = __blk_mq_try_issue_directly(hctx, rq, cookie, false);
         if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
-                blk_mq_sched_insert_request(rq, false, true, false);
+                blk_mq_request_bypass_insert(rq, true);
         else if (ret != BLK_STS_OK)
                 blk_mq_end_request(rq, ret);
 
@@ -1815,7 +1815,8 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
                 if (ret != BLK_STS_OK) {
                         if (ret == BLK_STS_RESOURCE ||
                                         ret == BLK_STS_DEV_RESOURCE) {
-                                list_add(&rq->queuelist, list);
+                                blk_mq_request_bypass_insert(rq,
+                                                        list_empty(list));
                                 break;
                         }
                         blk_mq_end_request(rq, ret);
diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 13ba2011a306..a327bef07642 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -378,7 +378,7 @@ static struct blk_zone *blk_alloc_zones(int node, unsigned int *nr_zones)
         struct page *page;
         int order;
 
-        for (order = get_order(size); order > 0; order--) {
+        for (order = get_order(size); order >= 0; order--) {
                 page = alloc_pages_node(node, GFP_NOIO | __GFP_ZERO, order);
                 if (page) {
                         *nr_zones = min_t(unsigned int, *nr_zones,
diff --git a/crypto/Kconfig b/crypto/Kconfig
index f7a235db56aa..05c91eb10ca1 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1812,7 +1812,7 @@ config CRYPTO_USER_API_AEAD
           cipher algorithms.
 
 config CRYPTO_STATS
-        bool "Crypto usage statistics for User-space"
+        bool
         help
           This option enables the gathering of crypto stats.
           This will collect:
diff --git a/crypto/cbc.c b/crypto/cbc.c
index b761b1f9c6ca..dd5f332fd566 100644
--- a/crypto/cbc.c
+++ b/crypto/cbc.c
@@ -140,9 +140,8 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
         spawn = skcipher_instance_ctx(inst);
         err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
                                 CRYPTO_ALG_TYPE_MASK);
-        crypto_mod_put(alg);
         if (err)
-                goto err_free_inst;
+                goto err_put_alg;
 
         err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg);
         if (err)
@@ -174,12 +173,15 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
         err = skcipher_register_instance(tmpl, inst);
         if (err)
                 goto err_drop_spawn;
+        crypto_mod_put(alg);
 
 out:
         return err;
 
 err_drop_spawn:
         crypto_drop_spawn(spawn);
+err_put_alg:
+        crypto_mod_put(alg);
 err_free_inst:
         kfree(inst);
         goto out;
diff --git a/crypto/cfb.c b/crypto/cfb.c
index a0d68c09e1b9..20987d0e09d8 100644
--- a/crypto/cfb.c
+++ b/crypto/cfb.c
@@ -286,9 +286,8 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
         spawn = skcipher_instance_ctx(inst);
         err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
                                 CRYPTO_ALG_TYPE_MASK);
-        crypto_mod_put(alg);
         if (err)
-                goto err_free_inst;
+                goto err_put_alg;
 
         err = crypto_inst_setname(skcipher_crypto_instance(inst), "cfb", alg);
         if (err)
@@ -317,12 +316,15 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
         err = skcipher_register_instance(tmpl, inst);
         if (err)
                 goto err_drop_spawn;
+        crypto_mod_put(alg);
 
 out:
         return err;
 
 err_drop_spawn:
         crypto_drop_spawn(spawn);
+err_put_alg:
+        crypto_mod_put(alg);
 err_free_inst:
         kfree(inst);
         goto out;
diff --git a/crypto/pcbc.c b/crypto/pcbc.c
index ef802f6e9642..8aa10144407c 100644
--- a/crypto/pcbc.c
+++ b/crypto/pcbc.c
@@ -244,9 +244,8 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
         spawn = skcipher_instance_ctx(inst);
         err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
                                 CRYPTO_ALG_TYPE_MASK);
-        crypto_mod_put(alg);
         if (err)
-                goto err_free_inst;
+                goto err_put_alg;
 
         err = crypto_inst_setname(skcipher_crypto_instance(inst), "pcbc", alg);
         if (err)
@@ -275,12 +274,15 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
         err = skcipher_register_instance(tmpl, inst);
         if (err)
                 goto err_drop_spawn;
+        crypto_mod_put(alg);
 
 out:
         return err;
 
 err_drop_spawn:
         crypto_drop_spawn(spawn);
+err_put_alg:
+        crypto_mod_put(alg);
 err_free_inst:
         kfree(inst);
         goto out;
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 14d9f5bea015..5912d30020c7 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1308,7 +1308,7 @@ static ssize_t scrub_store(struct device *dev,
         if (nd_desc) {
                 struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
 
-                rc = acpi_nfit_ars_rescan(acpi_desc, 0);
+                rc = acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
         }
         device_unlock(dev);
         if (rc)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index a7f5202a4815..b8c3f9e6af89 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4602,6 +4602,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "SAMSUNG*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "SAMSUNG*MZ7KM*",             NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "ST[1248][0248]0[FH]*",       NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
         /*
diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c
index ad8d483a35cd..ca7d37e2c7be 100644
--- a/drivers/clk/mmp/clk.c
+++ b/drivers/clk/mmp/clk.c
@@ -183,7 +183,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id,
                 pr_err("CLK %d has invalid pointer %p\n", id, clk);
                 return;
         }
-        if (id > unit->nr_clks) {
+        if (id >= unit->nr_clks) {
                 pr_err("CLK %d is invalid\n", id);
                 return;
         }
diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
index 9781b1bf5998..9235a331b588 100644
--- a/drivers/clk/mvebu/cp110-system-controller.c
+++ b/drivers/clk/mvebu/cp110-system-controller.c
@@ -200,11 +200,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec,
         unsigned int idx = clkspec->args[1];
 
         if (type == CP110_CLK_TYPE_CORE) {
-                if (idx > CP110_MAX_CORE_CLOCKS)
+                if (idx >= CP110_MAX_CORE_CLOCKS)
                         return ERR_PTR(-EINVAL);
                 return clk_data->hws[idx];
         } else if (type == CP110_CLK_TYPE_GATABLE) {
-                if (idx > CP110_MAX_GATABLE_CLOCKS)
+                if (idx >= CP110_MAX_GATABLE_CLOCKS)
                         return ERR_PTR(-EINVAL);
                 return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx];
         }
diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
index db9b2471ac40..0a48ed56833b 100644
--- a/drivers/clk/qcom/common.c
+++ b/drivers/clk/qcom/common.c
@@ -191,6 +191,22 @@ int qcom_cc_register_sleep_clk(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(qcom_cc_register_sleep_clk);
 
+/* Drop 'protected-clocks' from the list of clocks to register */
+static void qcom_cc_drop_protected(struct device *dev, struct qcom_cc *cc)
+{
+        struct device_node *np = dev->of_node;
+        struct property *prop;
+        const __be32 *p;
+        u32 i;
+
+        of_property_for_each_u32(np, "protected-clocks", prop, p, i) {
+                if (i >= cc->num_rclks)
+                        continue;
+
+                cc->rclks[i] = NULL;
+        }
+}
+
 static struct clk_hw *qcom_cc_clk_hw_get(struct of_phandle_args *clkspec,
                                          void *data)
 {
@@ -251,6 +267,8 @@ int qcom_cc_really_probe(struct platform_device *pdev,
         cc->rclks = rclks;
         cc->num_rclks = num_clks;
 
+        qcom_cc_drop_protected(dev, cc);
+
         for (i = 0; i < num_clks; i++) {
                 if (!rclks[i])
                         continue;
diff --git a/drivers/clk/qcom/gcc-qcs404.c b/drivers/clk/qcom/gcc-qcs404.c
index ef1b267cb058..64da032bb9ed 100644
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@@ -297,7 +297,7 @@ static struct clk_alpha_pll gpll0_out_main = {
                 .hw.init = &(struct clk_init_data){
                         .name = "gpll0_out_main",
                         .parent_names = (const char *[])
-                                        { "gpll0_sleep_clk_src" },
+                                        { "cxo" },
                         .num_parents = 1,
                         .ops = &clk_alpha_pll_ops,
                 },
diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c
index 9d7d297f0ea8..f65cc0ff76ab 100644
--- a/drivers/clk/zynqmp/clkc.c
+++ b/drivers/clk/zynqmp/clkc.c
@@ -128,7 +128,7 @@ static const struct zynqmp_eemi_ops *eemi_ops;
  */
 static inline int zynqmp_is_valid_clock(u32 clk_id)
 {
-        if (clk_id > clock_max_idx)
+        if (clk_id >= clock_max_idx)
                 return -ENODEV;
 
         return clock[clk_id].valid;
@@ -279,6 +279,9 @@ struct clk_hw *zynqmp_clk_register_fixed_factor(const char *name, u32 clk_id,
         qdata.arg1 = clk_id;
 
         ret = eemi_ops->query_data(qdata, ret_payload);
+        if (ret)
+                return ERR_PTR(ret);
+
         mult = ret_payload[1];
         div = ret_payload[2];
 
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index d0c3e50b39fb..1fc488e90f36 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1059,12 +1059,12 @@ static void dwc_issue_pending(struct dma_chan *chan)
 /*
  * Program FIFO size of channels.
  *
- * By default full FIFO (1024 bytes) is assigned to channel 0. Here we
+ * By default full FIFO (512 bytes) is assigned to channel 0. Here we
  * slice FIFO on equal parts between channels.
  */
 static void idma32_fifo_partition(struct dw_dma *dw)
 {
-        u64 value = IDMA32C_FP_PSIZE_CH0(128) | IDMA32C_FP_PSIZE_CH1(128) |
+        u64 value = IDMA32C_FP_PSIZE_CH0(64) | IDMA32C_FP_PSIZE_CH1(64) |
                     IDMA32C_FP_UPDATE;
         u64 fifo_partition = 0;
 
@@ -1077,7 +1077,7 @@ static void idma32_fifo_partition(struct dw_dma *dw)
         /* Fill FIFO_PARTITION high bits (Channels 2..3, 6..7) */
         fifo_partition |= value << 32;
 
-        /* Program FIFO Partition registers - 128 bytes for each channel */
+        /* Program FIFO Partition registers - 64 bytes per channel */
         idma32_writeq(dw, FIFO_PARTITION1, fifo_partition);
         idma32_writeq(dw, FIFO_PARTITION0, fifo_partition);
 }
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index b4ec2d20e661..cb1b44d78a1f 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
-#include <linux/dmapool.h>
 #include <linux/firmware.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
@@ -33,6 +32,7 @@
 #include <linux/of_address.h>
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
+#include <linux/workqueue.h>
 
 #include <asm/irq.h>
 #include <linux/platform_data/dma-imx-sdma.h>
@@ -376,7 +376,7 @@ struct sdma_channel {
         u32                             shp_addr, per_addr;
         enum dma_status                 status;
         struct imx_dma_data             data;
-        struct dma_pool                 *bd_pool;
+        struct work_struct              terminate_worker;
 };
 
 #define IMX_DMA_SG_LOOP         BIT(0)
@@ -1027,31 +1027,49 @@ static int sdma_disable_channel(struct dma_chan *chan)
 
         return 0;
 }
-
-static int sdma_disable_channel_with_delay(struct dma_chan *chan)
+static void sdma_channel_terminate_work(struct work_struct *work)
 {
-        struct sdma_channel *sdmac = to_sdma_chan(chan);
+        struct sdma_channel *sdmac = container_of(work, struct sdma_channel,
+                                                  terminate_worker);
         unsigned long flags;
         LIST_HEAD(head);
 
-        sdma_disable_channel(chan);
-        spin_lock_irqsave(&sdmac->vc.lock, flags);
-        vchan_get_all_descriptors(&sdmac->vc, &head);
-        sdmac->desc = NULL;
-        spin_unlock_irqrestore(&sdmac->vc.lock, flags);
-        vchan_dma_desc_free_list(&sdmac->vc, &head);
-
         /*
          * According to NXP R&D team a delay of one BD SDMA cost time
          * (maximum is 1ms) should be added after disable of the channel
          * bit, to ensure SDMA core has really been stopped after SDMA
          * clients call .device_terminate_all.
          */
-        mdelay(1);
+        usleep_range(1000, 2000);
+
+        spin_lock_irqsave(&sdmac->vc.lock, flags);
+        vchan_get_all_descriptors(&sdmac->vc, &head);
+        sdmac->desc = NULL;
+        spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+        vchan_dma_desc_free_list(&sdmac->vc, &head);
+}
+
+static int sdma_disable_channel_async(struct dma_chan *chan)
+{
+        struct sdma_channel *sdmac = to_sdma_chan(chan);
+
+        sdma_disable_channel(chan);
+
+        if (sdmac->desc)
+                schedule_work(&sdmac->terminate_worker);
 
         return 0;
 }
 
+static void sdma_channel_synchronize(struct dma_chan *chan)
+{
+        struct sdma_channel *sdmac = to_sdma_chan(chan);
+
+        vchan_synchronize(&sdmac->vc);
+
+        flush_work(&sdmac->terminate_worker);
+}
+
 static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac)
 {
         struct sdma_engine *sdma = sdmac->sdma;
@@ -1192,10 +1210,11 @@ out:
 
 static int sdma_alloc_bd(struct sdma_desc *desc)
 {
+        u32 bd_size = desc->num_bd * sizeof(struct sdma_buffer_descriptor);
         int ret = 0;
 
-        desc->bd = dma_pool_alloc(desc->sdmac->bd_pool, GFP_NOWAIT,
-                                  &desc->bd_phys);
+        desc->bd = dma_zalloc_coherent(NULL, bd_size, &desc->bd_phys,
+                                        GFP_NOWAIT);
         if (!desc->bd) {
                 ret = -ENOMEM;
                 goto out;
@@ -1206,7 +1225,9 @@ out:
 
 static void sdma_free_bd(struct sdma_desc *desc)
 {
-        dma_pool_free(desc->sdmac->bd_pool, desc->bd, desc->bd_phys);
+        u32 bd_size = desc->num_bd * sizeof(struct sdma_buffer_descriptor);
+
+        dma_free_coherent(NULL, bd_size, desc->bd, desc->bd_phys);
 }
 
 static void sdma_desc_free(struct virt_dma_desc *vd)
@@ -1272,10 +1293,6 @@ static int sdma_alloc_chan_resources(struct dma_chan *chan)
         if (ret)
                 goto disable_clk_ahb;
 
-        sdmac->bd_pool = dma_pool_create("bd_pool", chan->device->dev,
-                                sizeof(struct sdma_buffer_descriptor),
-                                32, 0);
-
         return 0;
 
 disable_clk_ahb:
@@ -1290,7 +1307,9 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
         struct sdma_channel *sdmac = to_sdma_chan(chan);
         struct sdma_engine *sdma = sdmac->sdma;
 
-        sdma_disable_channel_with_delay(chan);
+        sdma_disable_channel_async(chan);
+
+        sdma_channel_synchronize(chan);
 
         if (sdmac->event_id0)
                 sdma_event_disable(sdmac, sdmac->event_id0);
@@ -1304,9 +1323,6 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
 
         clk_disable(sdma->clk_ipg);
         clk_disable(sdma->clk_ahb);
-
-        dma_pool_destroy(sdmac->bd_pool);
-        sdmac->bd_pool = NULL;
 }
 
 static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,
@@ -1999,6 +2015,8 @@ static int sdma_probe(struct platform_device *pdev)
 
                 sdmac->channel = i;
                 sdmac->vc.desc_free = sdma_desc_free;
+                INIT_WORK(&sdmac->terminate_worker,
+                                sdma_channel_terminate_work);
                 /*
                  * Add the channel to the DMAC list. Do not add channel 0 though
                  * because we need it internally in the SDMA driver. This also means
@@ -2050,7 +2068,8 @@ static int sdma_probe(struct platform_device *pdev)
         sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg;
         sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic;
         sdma->dma_device.device_config = sdma_config;
-        sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay;
+        sdma->dma_device.device_terminate_all = sdma_disable_channel_async;
+        sdma->dma_device.device_synchronize = sdma_channel_synchronize;
         sdma->dma_device.src_addr_widths = SDMA_DMA_BUSWIDTHS;
         sdma->dma_device.dst_addr_widths = SDMA_DMA_BUSWIDTHS;
         sdma->dma_device.directions = SDMA_DMA_DIRECTIONS;
diff --git a/drivers/dma/ti/cppi41.c b/drivers/dma/ti/cppi41.c
index 1497da367710..e507ec36c0d3 100644
--- a/drivers/dma/ti/cppi41.c
+++ b/drivers/dma/ti/cppi41.c
@@ -723,8 +723,22 @@ static int cppi41_stop_chan(struct dma_chan *chan)
 
         desc_phys = lower_32_bits(c->desc_phys);
         desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
-        if (!cdd->chan_busy[desc_num])
+        if (!cdd->chan_busy[desc_num]) {
+                struct cppi41_channel *cc, *_ct;
+
+                /*
+                 * channels might still be in the pendling list if
+                 * cppi41_dma_issue_pending() is called after
+                 * cppi41_runtime_suspend() is called
+                 */
+                list_for_each_entry_safe(cc, _ct, &cdd->pending, node) {
+                        if (cc != c)
+                                continue;
+                        list_del(&cc->node);
+                        break;
+                }
                 return 0;
+        }
 
         ret = cppi41_tear_down_chan(c);
         if (ret)
diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
index 71d014edd167..2c22836d3ffd 100644
--- a/drivers/gnss/sirf.c
+++ b/drivers/gnss/sirf.c
@@ -168,7 +168,7 @@ static int sirf_set_active(struct sirf_data *data, bool active)
         else
                 timeout = SIRF_HIBERNATE_TIMEOUT;
 
-        while (retries-- > 0) {
+        do {
                 sirf_pulse_on_off(data);
                 ret = sirf_wait_for_power_state(data, active, timeout);
                 if (ret < 0) {
@@ -179,9 +179,9 @@ static int sirf_set_active(struct sirf_data *data, bool active)
                 }
 
                 break;
-        }
+        } while (retries--);
 
-        if (retries == 0)
+        if (retries < 0)
                 return -ETIMEDOUT;
 
         return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 104b2e0d893b..b0fc116296cb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -233,7 +233,7 @@ enum amdgpu_kiq_irq {
 
 #define MAX_KIQ_REG_WAIT       5000 /* in usecs, 5ms */
 #define MAX_KIQ_REG_BAILOUT_INTERVAL   5 /* in msecs, 5ms */
-#define MAX_KIQ_REG_TRY 20
+#define MAX_KIQ_REG_TRY 80 /* 20 -> 80 */
 
 int amdgpu_device_ip_set_clockgating_state(void *dev,
                                            enum amd_ip_block_type block_type,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 8816c697b205..387f1cf1dc20 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -330,7 +330,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                         case CHIP_TOPAZ:
                                 if (((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x81)) ||
                                     ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x83)) ||
-                                    ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87))) {
+                                    ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87)) ||
+                                    ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0xD1)) ||
+                                    ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0xD3))) {
                                         info->is_kicker = true;
                                         strcpy(fw_name, "amdgpu/topaz_k_smc.bin");
                                 } else
@@ -351,7 +353,6 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                 if (type == CGS_UCODE_ID_SMU) {
                                         if (((adev->pdev->device == 0x67ef) &&
                                              ((adev->pdev->revision == 0xe0) ||
-                                              (adev->pdev->revision == 0xe2) ||
                                               (adev->pdev->revision == 0xe5))) ||
                                             ((adev->pdev->device == 0x67ff) &&
                                              ((adev->pdev->revision == 0xcf) ||
@@ -359,8 +360,13 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                               (adev->pdev->revision == 0xff)))) {
                                                 info->is_kicker = true;
                                                 strcpy(fw_name, "amdgpu/polaris11_k_smc.bin");
-                                        } else
+                                        } else if ((adev->pdev->device == 0x67ef) &&
+                                                   (adev->pdev->revision == 0xe2)) {
+                                                info->is_kicker = true;
+                                                strcpy(fw_name, "amdgpu/polaris11_k2_smc.bin");
+                                        } else {
                                                 strcpy(fw_name, "amdgpu/polaris11_smc.bin");
+                                        }
                                 } else if (type == CGS_UCODE_ID_SMU_SK) {
                                         strcpy(fw_name, "amdgpu/polaris11_smc_sk.bin");
                                 }
@@ -375,17 +381,35 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                               (adev->pdev->revision == 0xe7) ||
                                               (adev->pdev->revision == 0xef))) ||
                                             ((adev->pdev->device == 0x6fdf) &&
-                                             (adev->pdev->revision == 0xef))) {
+                                             ((adev->pdev->revision == 0xef) ||
+                                              (adev->pdev->revision == 0xff)))) {
                                                 info->is_kicker = true;
                                                 strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
-                                        } else
+                                        } else if ((adev->pdev->device == 0x67df) &&
+                                                   ((adev->pdev->revision == 0xe1) ||
+                                                    (adev->pdev->revision == 0xf7))) {
+                                                info->is_kicker = true;
+                                                strcpy(fw_name, "amdgpu/polaris10_k2_smc.bin");
+                                        } else {
                                                 strcpy(fw_name, "amdgpu/polaris10_smc.bin");
+                                        }
                                 } else if (type == CGS_UCODE_ID_SMU_SK) {
                                         strcpy(fw_name, "amdgpu/polaris10_smc_sk.bin");
                                 }
                                 break;
                         case CHIP_POLARIS12:
-                                strcpy(fw_name, "amdgpu/polaris12_smc.bin");
+                                if (((adev->pdev->device == 0x6987) &&
+                                     ((adev->pdev->revision == 0xc0) ||
+                                      (adev->pdev->revision == 0xc3))) ||
+                                    ((adev->pdev->device == 0x6981) &&
+                                     ((adev->pdev->revision == 0x00) ||
+                                      (adev->pdev->revision == 0x01) ||
+                                      (adev->pdev->revision == 0x10)))) {
+                                        info->is_kicker = true;
+                                        strcpy(fw_name, "amdgpu/polaris12_k_smc.bin");
+                                } else {
+                                        strcpy(fw_name, "amdgpu/polaris12_smc.bin");
+                                }
                                 break;
                         case CHIP_VEGAM:
                                 strcpy(fw_name, "amdgpu/vegam_smc.bin");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 663043c8f0f5..0acc8dee2cb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -124,14 +124,14 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs
                 goto free_chunk;
         }
 
+        mutex_lock(&p->ctx->lock);
+
         /* skip guilty context job */
         if (atomic_read(&p->ctx->guilty) == 1) {
                 ret = -ECANCELED;
                 goto free_chunk;
         }
 
-        mutex_lock(&p->ctx->lock);
-
         /* get chunks */
         chunk_array_user = u64_to_user_ptr(cs->in.chunks);
         if (copy_from_user(chunk_array, chunk_array_user,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index f9b54236102d..95f4c4139fc6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -39,6 +39,7 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] = {
         [AMDGPU_HW_IP_UVD_ENC]  =       1,
         [AMDGPU_HW_IP_VCN_DEC]  =       1,
         [AMDGPU_HW_IP_VCN_ENC]  =       1,
+        [AMDGPU_HW_IP_VCN_JPEG] =       1,
 };
 
 static int amdgput_ctx_total_num_entities(void)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8de55f7f1a3a..74b611e8a1b1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -872,7 +872,13 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6864, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
         {0x1002, 0x6867, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
         {0x1002, 0x6868, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x6869, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x686a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x686b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
         {0x1002, 0x686c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x686d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x686e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+        {0x1002, 0x686f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
         {0x1002, 0x687f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
         /* Vega 12 */
         {0x1002, 0x69A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA12},
@@ -885,6 +891,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x66A1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
         {0x1002, 0x66A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
         {0x1002, 0x66A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
+        {0x1002, 0x66A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
         {0x1002, 0x66A7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
         {0x1002, 0x66AF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA20},
         /* Raven */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 81732a84c2ab..8f3d44e5e787 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -467,9 +467,6 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
         if (!info->return_size || !info->return_pointer)
                 return -EINVAL;
 
-        /* Ensure IB tests are run on ring */
-        flush_delayed_work(&adev->late_init_work);
-
         switch (info->query) {
         case AMDGPU_INFO_ACCEL_WORKING:
                 ui32 = adev->accel_working;
@@ -950,6 +947,9 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
         struct amdgpu_fpriv *fpriv;
         int r, pasid;
 
+        /* Ensure IB tests are run on ring */
+        flush_delayed_work(&adev->late_init_work);
+
         file_priv->driver_priv = NULL;
 
         r = pm_runtime_get_sync(dev->dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 1d3265c97b70..747c068379dc 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -56,6 +56,9 @@ MODULE_FIRMWARE("amdgpu/tonga_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_mc.bin");
 MODULE_FIRMWARE("amdgpu/polaris12_mc.bin");
+MODULE_FIRMWARE("amdgpu/polaris11_k_mc.bin");
+MODULE_FIRMWARE("amdgpu/polaris10_k_mc.bin");
+MODULE_FIRMWARE("amdgpu/polaris12_k_mc.bin");
 
 static const u32 golden_settings_tonga_a11[] =
 {
@@ -224,13 +227,39 @@ static int gmc_v8_0_init_microcode(struct amdgpu_device *adev)
                 chip_name = "tonga";
                 break;
         case CHIP_POLARIS11:
-                chip_name = "polaris11";
+                if (((adev->pdev->device == 0x67ef) &&
+                     ((adev->pdev->revision == 0xe0) ||
+                      (adev->pdev->revision == 0xe5))) ||
+                    ((adev->pdev->device == 0x67ff) &&
+                     ((adev->pdev->revision == 0xcf) ||
+                      (adev->pdev->revision == 0xef) ||
+                      (adev->pdev->revision == 0xff))))
+                        chip_name = "polaris11_k";
+                else if ((adev->pdev->device == 0x67ef) &&
+                         (adev->pdev->revision == 0xe2))
+                        chip_name = "polaris11_k";
+                else
+                        chip_name = "polaris11";
                 break;
         case CHIP_POLARIS10:
-                chip_name = "polaris10";
+                if ((adev->pdev->device == 0x67df) &&
+                    ((adev->pdev->revision == 0xe1) ||
+                     (adev->pdev->revision == 0xf7)))
+                        chip_name = "polaris10_k";
+                else
+                        chip_name = "polaris10";
                 break;
         case CHIP_POLARIS12:
-                chip_name = "polaris12";
+                if (((adev->pdev->device == 0x6987) &&
+                     ((adev->pdev->revision == 0xc0) ||
+                      (adev->pdev->revision == 0xc3))) ||
+                    ((adev->pdev->device == 0x6981) &&
+                     ((adev->pdev->revision == 0x00) ||
+                      (adev->pdev->revision == 0x01) ||
+                      (adev->pdev->revision == 0x10))))
+                        chip_name = "polaris12_k";
+                else
+                        chip_name = "polaris12";
                 break;
         case CHIP_FIJI:
         case CHIP_CARRIZO:
@@ -337,7 +366,7 @@ static int gmc_v8_0_polaris_mc_load_microcode(struct amdgpu_device *adev)
         const struct mc_firmware_header_v1_0 *hdr;
         const __le32 *fw_data = NULL;
         const __le32 *io_mc_regs = NULL;
-        u32 data, vbios_version;
+        u32 data;
         int i, ucode_size, regs_size;
 
         /* Skip MC ucode loading on SR-IOV capable boards.
@@ -348,13 +377,6 @@ static int gmc_v8_0_polaris_mc_load_microcode(struct amdgpu_device *adev)
         if (amdgpu_sriov_bios(adev))
                 return 0;
 
-        WREG32(mmMC_SEQ_IO_DEBUG_INDEX, 0x9F);
-        data = RREG32(mmMC_SEQ_IO_DEBUG_DATA);
-        vbios_version = data & 0xf;
-
-        if (vbios_version == 0)
-                return 0;
-
         if (!adev->gmc.fw)
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
index eae90922fdbe..322e09b5b448 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
@@ -48,6 +48,7 @@ static void vcn_v1_0_set_enc_ring_funcs(struct amdgpu_device *adev);
 static void vcn_v1_0_set_jpeg_ring_funcs(struct amdgpu_device *adev);
 static void vcn_v1_0_set_irq_funcs(struct amdgpu_device *adev);
 static void vcn_v1_0_jpeg_ring_set_patch_ring(struct amdgpu_ring *ring, uint32_t ptr);
+static int vcn_v1_0_set_powergating_state(void *handle, enum amd_powergating_state state);
 
 /**
  * vcn_v1_0_early_init - set function pointers
@@ -222,7 +223,7 @@ static int vcn_v1_0_hw_fini(void *handle)
         struct amdgpu_ring *ring = &adev->vcn.ring_dec;
 
         if (RREG32_SOC15(VCN, 0, mmUVD_STATUS))
-                vcn_v1_0_stop(adev);
+                vcn_v1_0_set_powergating_state(adev, AMD_PG_STATE_GATE);
 
         ring->ready = false;
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index a9f18ea7e354..e4ded890b1cb 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -337,12 +337,19 @@ static const struct kfd_deviceid supported_devices[] = {
         { 0x6864, &vega10_device_info },        /* Vega10 */
         { 0x6867, &vega10_device_info },        /* Vega10 */
         { 0x6868, &vega10_device_info },        /* Vega10 */
+        { 0x6869, &vega10_device_info },        /* Vega10 */
+        { 0x686A, &vega10_device_info },        /* Vega10 */
+        { 0x686B, &vega10_device_info },        /* Vega10 */
         { 0x686C, &vega10_vf_device_info },     /* Vega10  vf*/
+        { 0x686D, &vega10_device_info },        /* Vega10 */
+        { 0x686E, &vega10_device_info },        /* Vega10 */
+        { 0x686F, &vega10_device_info },        /* Vega10 */
         { 0x687F, &vega10_device_info },        /* Vega10 */
         { 0x66a0, &vega20_device_info },        /* Vega20 */
         { 0x66a1, &vega20_device_info },        /* Vega20 */
         { 0x66a2, &vega20_device_info },        /* Vega20 */
         { 0x66a3, &vega20_device_info },        /* Vega20 */
+        { 0x66a4, &vega20_device_info },        /* Vega20 */
         { 0x66a7, &vega20_device_info },        /* Vega20 */
         { 0x66af, &vega20_device_info }         /* Vega20 */
 };
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index ca925200fe09..5a6edf65c9ea 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2554,9 +2554,9 @@ static void fill_audio_info(struct audio_info *audio_info,
 
         cea_revision = drm_connector->display_info.cea_rev;
 
-        strncpy(audio_info->display_name,
+        strscpy(audio_info->display_name,
                 edid_caps->display_name,
-                AUDIO_INFO_DISPLAY_NAME_SIZE_IN_CHARS - 1);
+                AUDIO_INFO_DISPLAY_NAME_SIZE_IN_CHARS);
 
         if (cea_revision >= 3) {
                 audio_info->mode_count = edid_caps->audio_mode_count;
@@ -3042,6 +3042,7 @@ void amdgpu_dm_connector_funcs_reset(struct drm_connector *connector)
                 state->underscan_enable = false;
                 state->underscan_hborder = 0;
                 state->underscan_vborder = 0;
+                state->max_bpc = 8;
 
                 __drm_atomic_helper_connector_reset(connector, &state->base);
         }
@@ -3063,6 +3064,7 @@ amdgpu_dm_connector_atomic_duplicate_state(struct drm_connector *connector)
 
         new_state->freesync_capable = state->freesync_capable;
         new_state->freesync_enable = state->freesync_enable;
+        new_state->max_bpc = state->max_bpc;
 
         return &new_state->base;
 }
@@ -3650,7 +3652,7 @@ amdgpu_dm_create_common_mode(struct drm_encoder *encoder,
         mode->hdisplay = hdisplay;
         mode->vdisplay = vdisplay;
         mode->type &= ~DRM_MODE_TYPE_PREFERRED;
-        strncpy(mode->name, name, DRM_DISPLAY_MODE_LEN);
+        strscpy(mode->name, name, DRM_DISPLAY_MODE_LEN);
 
         return mode;
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index b459867a05b2..a6bcb90e8419 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -2512,6 +2512,8 @@ static void pplib_apply_display_requirements(
                         dc,
                         context->bw.dce.sclk_khz);
 
+        pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
+
         pp_display_cfg->min_engine_clock_deep_sleep_khz
                         = context->bw.dce.sclk_deep_sleep_khz;
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
index 85119c2bdcc8..a2a7e0e94aa6 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
@@ -80,7 +80,9 @@ int phm_enable_dynamic_state_management(struct pp_hwmgr *hwmgr)
         PHM_FUNC_CHECK(hwmgr);
         adev = hwmgr->adev;
 
-        if (smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev)) {
+        /* Skip for suspend/resume case */
+        if (smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev)
+                && adev->in_suspend) {
                 pr_info("dpm has been enabled\n");
                 return 0;
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
index 47ac92369739..0173d0480024 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
@@ -352,6 +352,9 @@ int hwmgr_handle_task(struct pp_hwmgr *hwmgr, enum amd_pp_task task_id,
 
         switch (task_id) {
         case AMD_PP_TASK_DISPLAY_CONFIG_CHANGE:
+                ret = phm_pre_display_configuration_changed(hwmgr);
+                if (ret)
+                        return ret;
                 ret = phm_set_cpu_power_state(hwmgr);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
index 91ffb7bc4ee7..56437866d120 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
@@ -265,8 +265,6 @@ int psm_adjust_power_state_dynamic(struct pp_hwmgr *hwmgr, bool skip,
         if (skip)
                 return 0;
 
-        phm_pre_display_configuration_changed(hwmgr);
-
         phm_display_configuration_changed(hwmgr);
 
         if (hwmgr->ps)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index 88f6b35ea6fe..b61a01f55284 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -3589,8 +3589,10 @@ static int smu7_find_dpm_states_clocks_in_dpm_table(struct pp_hwmgr *hwmgr, cons
         }
 
         if (i >= sclk_table->count) {
-                data->need_update_smu7_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
-                sclk_table->dpm_levels[i-1].value = sclk;
+                if (sclk > sclk_table->dpm_levels[i-1].value) {
+                        data->need_update_smu7_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
+                        sclk_table->dpm_levels[i-1].value = sclk;
+                }
         } else {
         /* TODO: Check SCLK in DAL's minimum clocks
          * in case DeepSleep divider update is required.
@@ -3607,8 +3609,10 @@ static int smu7_find_dpm_states_clocks_in_dpm_table(struct pp_hwmgr *hwmgr, cons
         }
 
         if (i >= mclk_table->count) {
-                data->need_update_smu7_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
-                mclk_table->dpm_levels[i-1].value = mclk;
+                if (mclk > mclk_table->dpm_levels[i-1].value) {
+                        data->need_update_smu7_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
+                        mclk_table->dpm_levels[i-1].value = mclk;
+                }
         }
 
         if (data->display_timing.num_existing_displays != hwmgr->display_config->num_display)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index e2bc6e0c229f..79c86247d0ac 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -3266,8 +3266,10 @@ static int vega10_find_dpm_states_clocks_in_dpm_table(struct pp_hwmgr *hwmgr, co
         }
 
         if (i >= sclk_table->count) {
-                data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
-                sclk_table->dpm_levels[i-1].value = sclk;
+                if (sclk > sclk_table->dpm_levels[i-1].value) {
+                        data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_SCLK;
+                        sclk_table->dpm_levels[i-1].value = sclk;
+                }
         }
 
         for (i = 0; i < mclk_table->count; i++) {
@@ -3276,8 +3278,10 @@ static int vega10_find_dpm_states_clocks_in_dpm_table(struct pp_hwmgr *hwmgr, co
         }
 
         if (i >= mclk_table->count) {
-                data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
-                mclk_table->dpm_levels[i-1].value = mclk;
+                if (mclk > mclk_table->dpm_levels[i-1].value) {
+                        data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_MCLK;
+                        mclk_table->dpm_levels[i-1].value = mclk;
+                }
         }
 
         if (data->display_timing.num_existing_displays != hwmgr->display_config->num_display)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
index b4eadd47f3a4..3b7fce5d7258 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
@@ -130,7 +130,7 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
         data->registry_data.disable_auto_wattman = 1;
         data->registry_data.auto_wattman_debug = 0;
         data->registry_data.auto_wattman_sample_period = 100;
-        data->registry_data.fclk_gfxclk_ratio = 0x3F6CCCCD;
+        data->registry_data.fclk_gfxclk_ratio = 0;
         data->registry_data.auto_wattman_threshold = 50;
         data->registry_data.gfxoff_controlled_by_driver = 1;
         data->gfxoff_allowed = false;
@@ -1660,14 +1660,15 @@ static uint32_t vega20_find_highest_dpm_level(
         return i;
 }
 
-static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
+static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr, uint32_t feature_mask)
 {
         struct vega20_hwmgr *data =
                         (struct vega20_hwmgr *)(hwmgr->backend);
         uint32_t min_freq;
         int ret = 0;
 
-        if (data->smu_features[GNLD_DPM_GFXCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_GFXCLK].enabled &&
+           (feature_mask & FEATURE_DPM_GFXCLK_MASK)) {
                 min_freq = data->dpm_table.gfx_table.dpm_state.soft_min_level;
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
                                         hwmgr, PPSMC_MSG_SetSoftMinByFreq,
@@ -1676,7 +1677,8 @@ static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_UCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_UCLK].enabled &&
+           (feature_mask & FEATURE_DPM_UCLK_MASK)) {
                 min_freq = data->dpm_table.mem_table.dpm_state.soft_min_level;
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
                                         hwmgr, PPSMC_MSG_SetSoftMinByFreq,
@@ -1692,7 +1694,8 @@ static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_UVD].enabled) {
+        if (data->smu_features[GNLD_DPM_UVD].enabled &&
+           (feature_mask & FEATURE_DPM_UVD_MASK)) {
                 min_freq = data->dpm_table.vclk_table.dpm_state.soft_min_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1710,7 +1713,8 @@ static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_VCE].enabled) {
+        if (data->smu_features[GNLD_DPM_VCE].enabled &&
+           (feature_mask & FEATURE_DPM_VCE_MASK)) {
                 min_freq = data->dpm_table.eclk_table.dpm_state.soft_min_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1720,7 +1724,8 @@ static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_SOCCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_SOCCLK].enabled &&
+           (feature_mask & FEATURE_DPM_SOCCLK_MASK)) {
                 min_freq = data->dpm_table.soc_table.dpm_state.soft_min_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1733,14 +1738,15 @@ static int vega20_upload_dpm_min_level(struct pp_hwmgr *hwmgr)
         return ret;
 }
 
-static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr)
+static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr, uint32_t feature_mask)
 {
         struct vega20_hwmgr *data =
                         (struct vega20_hwmgr *)(hwmgr->backend);
         uint32_t max_freq;
         int ret = 0;
 
-        if (data->smu_features[GNLD_DPM_GFXCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_GFXCLK].enabled &&
+           (feature_mask & FEATURE_DPM_GFXCLK_MASK)) {
                 max_freq = data->dpm_table.gfx_table.dpm_state.soft_max_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1750,7 +1756,8 @@ static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_UCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_UCLK].enabled &&
+           (feature_mask & FEATURE_DPM_UCLK_MASK)) {
                 max_freq = data->dpm_table.mem_table.dpm_state.soft_max_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1760,7 +1767,8 @@ static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_UVD].enabled) {
+        if (data->smu_features[GNLD_DPM_UVD].enabled &&
+           (feature_mask & FEATURE_DPM_UVD_MASK)) {
                 max_freq = data->dpm_table.vclk_table.dpm_state.soft_max_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1777,7 +1785,8 @@ static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_VCE].enabled) {
+        if (data->smu_features[GNLD_DPM_VCE].enabled &&
+           (feature_mask & FEATURE_DPM_VCE_MASK)) {
                 max_freq = data->dpm_table.eclk_table.dpm_state.soft_max_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -1787,7 +1796,8 @@ static int vega20_upload_dpm_max_level(struct pp_hwmgr *hwmgr)
                                         return ret);
         }
 
-        if (data->smu_features[GNLD_DPM_SOCCLK].enabled) {
+        if (data->smu_features[GNLD_DPM_SOCCLK].enabled &&
+           (feature_mask & FEATURE_DPM_SOCCLK_MASK)) {
                 max_freq = data->dpm_table.soc_table.dpm_state.soft_max_level;
 
                 PP_ASSERT_WITH_CODE(!(ret = smum_send_msg_to_smc_with_parameter(
@@ -2126,12 +2136,12 @@ static int vega20_force_dpm_highest(struct pp_hwmgr *hwmgr)
                 data->dpm_table.mem_table.dpm_state.soft_max_level =
                 data->dpm_table.mem_table.dpm_levels[soft_level].value;
 
-        ret = vega20_upload_dpm_min_level(hwmgr);
+        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload boot level to highest!",
                         return ret);
 
-        ret = vega20_upload_dpm_max_level(hwmgr);
+        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload dpm max level to highest!",
                         return ret);
@@ -2158,12 +2168,12 @@ static int vega20_force_dpm_lowest(struct pp_hwmgr *hwmgr)
                 data->dpm_table.mem_table.dpm_state.soft_max_level =
                 data->dpm_table.mem_table.dpm_levels[soft_level].value;
 
-        ret = vega20_upload_dpm_min_level(hwmgr);
+        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload boot level to highest!",
                         return ret);
 
-        ret = vega20_upload_dpm_max_level(hwmgr);
+        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload dpm max level to highest!",
                         return ret);
@@ -2176,12 +2186,12 @@ static int vega20_unforce_dpm_levels(struct pp_hwmgr *hwmgr)
 {
         int ret = 0;
 
-        ret = vega20_upload_dpm_min_level(hwmgr);
+        ret = vega20_upload_dpm_min_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload DPM Bootup Levels!",
                         return ret);
 
-        ret = vega20_upload_dpm_max_level(hwmgr);
+        ret = vega20_upload_dpm_max_level(hwmgr, 0xFFFFFFFF);
         PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload DPM Max Levels!",
                         return ret);
@@ -2239,12 +2249,12 @@ static int vega20_force_clock_level(struct pp_hwmgr *hwmgr,
                 data->dpm_table.gfx_table.dpm_state.soft_max_level =
                         data->dpm_table.gfx_table.dpm_levels[soft_max_level].value;
 
-                ret = vega20_upload_dpm_min_level(hwmgr);
+                ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_GFXCLK_MASK);
                 PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload boot level to lowest!",
                         return ret);
 
-                ret = vega20_upload_dpm_max_level(hwmgr);
+                ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_GFXCLK_MASK);
                 PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload dpm max level to highest!",
                         return ret);
@@ -2259,12 +2269,12 @@ static int vega20_force_clock_level(struct pp_hwmgr *hwmgr,
                 data->dpm_table.mem_table.dpm_state.soft_max_level =
                         data->dpm_table.mem_table.dpm_levels[soft_max_level].value;
 
-                ret = vega20_upload_dpm_min_level(hwmgr);
+                ret = vega20_upload_dpm_min_level(hwmgr, FEATURE_DPM_UCLK_MASK);
                 PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload boot level to lowest!",
                         return ret);
 
-                ret = vega20_upload_dpm_max_level(hwmgr);
+                ret = vega20_upload_dpm_max_level(hwmgr, FEATURE_DPM_UCLK_MASK);
                 PP_ASSERT_WITH_CODE(!ret,
                         "Failed to upload dpm max level to highest!",
                         return ret);
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h b/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
index 62f36ba2435b..c1a99dfe4913 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
@@ -386,6 +386,8 @@ typedef uint16_t PPSMC_Result;
 #define PPSMC_MSG_AgmResetPsm                 ((uint16_t) 0x403)
 #define PPSMC_MSG_ReadVftCell                 ((uint16_t) 0x404)
 
+#define PPSMC_MSG_ApplyAvfsCksOffVoltage      ((uint16_t) 0x415)
+
 #define PPSMC_MSG_GFX_CU_PG_ENABLE            ((uint16_t) 0x280)
 #define PPSMC_MSG_GFX_CU_PG_DISABLE           ((uint16_t) 0x281)
 #define PPSMC_MSG_GetCurrPkgPwr               ((uint16_t) 0x282)
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
index 872d3824337b..a1e0ac9ae248 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
@@ -1985,6 +1985,12 @@ int polaris10_thermal_avfs_enable(struct pp_hwmgr *hwmgr)
 
         smum_send_msg_to_smc(hwmgr, PPSMC_MSG_EnableAvfs);
 
+        /* Apply avfs cks-off voltages to avoid the overshoot
+         * when switching to the highest sclk frequency
+         */
+        if (data->apply_avfs_cks_off_voltage)
+                smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ApplyAvfsCksOffVoltage);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
index 99d5e4f98f49..a6edd5df33b0 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
@@ -37,10 +37,13 @@ MODULE_FIRMWARE("amdgpu/fiji_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_smc_sk.bin");
 MODULE_FIRMWARE("amdgpu/polaris10_k_smc.bin");
+MODULE_FIRMWARE("amdgpu/polaris10_k2_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_smc_sk.bin");
 MODULE_FIRMWARE("amdgpu/polaris11_k_smc.bin");
+MODULE_FIRMWARE("amdgpu/polaris11_k2_smc.bin");
 MODULE_FIRMWARE("amdgpu/polaris12_smc.bin");
+MODULE_FIRMWARE("amdgpu/polaris12_k_smc.bin");
 MODULE_FIRMWARE("amdgpu/vegam_smc.bin");
 MODULE_FIRMWARE("amdgpu/vega10_smc.bin");
 MODULE_FIRMWARE("amdgpu/vega10_acg_smc.bin");
diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
index 0cd827e11fa2..de26df0c6044 100644
--- a/drivers/gpu/drm/ast/ast_fb.c
+++ b/drivers/gpu/drm/ast/ast_fb.c
@@ -263,6 +263,7 @@ static void ast_fbdev_destroy(struct drm_device *dev,
 {
         struct ast_framebuffer *afb = &afbdev->afb;
 
+        drm_crtc_force_disable_all(dev);
         drm_fb_helper_unregister_fbi(&afbdev->helper);
 
         if (afb->obj) {
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 680566d97adc..10243965ee7c 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -54,7 +54,7 @@
 #define SN_AUX_ADDR_7_0_REG                     0x76
 #define SN_AUX_LENGTH_REG                       0x77
 #define SN_AUX_CMD_REG                          0x78
-#define  AUX_CMD_SEND                           BIT(1)
+#define  AUX_CMD_SEND                           BIT(0)
 #define  AUX_CMD_REQ(x)                         ((x) << 4)
 #define SN_AUX_RDATA_REG(x)                     (0x79 + (x))
 #define SN_SSC_CONFIG_REG                       0x93
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index dd852a25d375..9d64f874f965 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -71,7 +71,7 @@ MODULE_PARM_DESC(drm_fbdev_overalloc,
 #if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
 static bool drm_leak_fbdev_smem = false;
 module_param_unsafe(drm_leak_fbdev_smem, bool, 0600);
-MODULE_PARM_DESC(fbdev_emulation,
+MODULE_PARM_DESC(drm_leak_fbdev_smem,
                  "Allow unsafe leaking fbdev physical smem address [default=false]");
 #endif
 
diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
index 0c4eb4a9ab31..51e06defc8d8 100644
--- a/drivers/gpu/drm/drm_internal.h
+++ b/drivers/gpu/drm/drm_internal.h
@@ -104,6 +104,8 @@ struct device *drm_sysfs_minor_alloc(struct drm_minor *minor);
 int drm_sysfs_connector_add(struct drm_connector *connector);
 void drm_sysfs_connector_remove(struct drm_connector *connector);
 
+void drm_sysfs_lease_event(struct drm_device *dev);
+
 /* drm_gem.c */
 int drm_gem_init(struct drm_device *dev);
 void drm_gem_destroy(struct drm_device *dev);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 24a177ea5417..c61680ad962d 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -296,7 +296,7 @@ void drm_lease_destroy(struct drm_master *master)
 
         if (master->lessor) {
                 /* Tell the master to check the lessee list */
-                drm_sysfs_hotplug_event(dev);
+                drm_sysfs_lease_event(dev);
                 drm_master_put(&master->lessor);
         }
 
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index b3c1daad1169..ecb7b33002bb 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -301,6 +301,16 @@ void drm_sysfs_connector_remove(struct drm_connector *connector)
         connector->kdev = NULL;
 }
 
+void drm_sysfs_lease_event(struct drm_device *dev)
+{
+        char *event_string = "LEASE=1";
+        char *envp[] = { event_string, NULL };
+
+        DRM_DEBUG("generating lease event\n");
+
+        kobject_uevent_env(&dev->primary->kdev->kobj, KOBJ_CHANGE, envp);
+}
+
 /**
  * drm_sysfs_hotplug_event - generate a DRM uevent
  * @dev: DRM device
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
index 481896fb712a..85e6736f0a32 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
@@ -235,7 +235,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
                 plane->bpp = skl_pixel_formats[fmt].bpp;
                 plane->drm_format = skl_pixel_formats[fmt].drm_format;
         } else {
-                plane->tiled = !!(val & DISPPLANE_TILED);
+                plane->tiled = val & DISPPLANE_TILED;
                 fmt = bdw_format_to_drm(val & DISPPLANE_PIXFORMAT_MASK);
                 plane->bpp = bdw_pixel_formats[fmt].bpp;
                 plane->drm_format = bdw_pixel_formats[fmt].drm_format;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index ffdbbac4400e..47062ee979cf 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1444,6 +1444,7 @@ static int i915_driver_init_hw(struct drm_i915_private *dev_priv)
 
         intel_uncore_sanitize(dev_priv);
 
+        intel_gt_init_workarounds(dev_priv);
         i915_gem_load_init_fences(dev_priv);
 
         /* On the 945G/GM, the chipset reports the MSI capability on the
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 9102571e9692..872a2e159a5f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -67,6 +67,7 @@
 #include "intel_ringbuffer.h"
 #include "intel_uncore.h"
 #include "intel_wopcm.h"
+#include "intel_workarounds.h"
 #include "intel_uc.h"
 
 #include "i915_gem.h"
@@ -1805,6 +1806,7 @@ struct drm_i915_private {
         int dpio_phy_iosf_port[I915_NUM_PHYS_VLV];
 
         struct i915_workarounds workarounds;
+        struct i915_wa_list gt_wa_list;
 
         struct i915_frontbuffer_tracking fb_tracking;
 
@@ -2148,6 +2150,8 @@ struct drm_i915_private {
                 struct delayed_work idle_work;
 
                 ktime_t last_init_time;
+
+                struct i915_vma *scratch;
         } gt;
 
         /* perform PHY state sanity checks? */
@@ -3870,4 +3874,9 @@ static inline int intel_hws_csb_write_index(struct drm_i915_private *i915)
                 return I915_HWS_CSB_WRITE_INDEX;
 }
 
+static inline u32 i915_scratch_offset(const struct drm_i915_private *i915)
+{
+        return i915_ggtt_offset(i915->gt.scratch);
+}
+
 #endif
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0c8aa57ce83b..6ae9a6080cc8 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -5305,7 +5305,7 @@ int i915_gem_init_hw(struct drm_i915_private *dev_priv)
                 }
         }
 
-        intel_gt_workarounds_apply(dev_priv);
+        intel_gt_apply_workarounds(dev_priv);
 
         i915_gem_init_swizzling(dev_priv);
 
@@ -5500,6 +5500,44 @@ err_active:
         goto out_ctx;
 }
 
+static int
+i915_gem_init_scratch(struct drm_i915_private *i915, unsigned int size)
+{
+        struct drm_i915_gem_object *obj;
+        struct i915_vma *vma;
+        int ret;
+
+        obj = i915_gem_object_create_stolen(i915, size);
+        if (!obj)
+                obj = i915_gem_object_create_internal(i915, size);
+        if (IS_ERR(obj)) {
+                DRM_ERROR("Failed to allocate scratch page\n");
+                return PTR_ERR(obj);
+        }
+
+        vma = i915_vma_instance(obj, &i915->ggtt.vm, NULL);
+        if (IS_ERR(vma)) {
+                ret = PTR_ERR(vma);
+                goto err_unref;
+        }
+
+        ret = i915_vma_pin(vma, 0, 0, PIN_GLOBAL | PIN_HIGH);
+        if (ret)
+                goto err_unref;
+
+        i915->gt.scratch = vma;
+        return 0;
+
+err_unref:
+        i915_gem_object_put(obj);
+        return ret;
+}
+
+static void i915_gem_fini_scratch(struct drm_i915_private *i915)
+{
+        i915_vma_unpin_and_release(&i915->gt.scratch, 0);
+}
+
 int i915_gem_init(struct drm_i915_private *dev_priv)
 {
         int ret;
@@ -5546,12 +5584,19 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
                 goto err_unlock;
         }
 
-        ret = i915_gem_contexts_init(dev_priv);
+        ret = i915_gem_init_scratch(dev_priv,
+                                    IS_GEN2(dev_priv) ? SZ_256K : PAGE_SIZE);
         if (ret) {
                 GEM_BUG_ON(ret == -EIO);
                 goto err_ggtt;
         }
 
+        ret = i915_gem_contexts_init(dev_priv);
+        if (ret) {
+                GEM_BUG_ON(ret == -EIO);
+                goto err_scratch;
+        }
+
         ret = intel_engines_init(dev_priv);
         if (ret) {
                 GEM_BUG_ON(ret == -EIO);
@@ -5624,6 +5669,8 @@ err_pm:
 err_context:
         if (ret != -EIO)
                 i915_gem_contexts_fini(dev_priv);
+err_scratch:
+        i915_gem_fini_scratch(dev_priv);
 err_ggtt:
 err_unlock:
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
@@ -5675,8 +5722,11 @@ void i915_gem_fini(struct drm_i915_private *dev_priv)
         intel_uc_fini(dev_priv);
         i915_gem_cleanup_engines(dev_priv);
         i915_gem_contexts_fini(dev_priv);
+        i915_gem_fini_scratch(dev_priv);
         mutex_unlock(&dev_priv->drm.struct_mutex);
 
+        intel_wa_list_free(&dev_priv->gt_wa_list);
+
         intel_cleanup_gt_powersave(dev_priv);
 
         intel_uc_fini_misc(dev_priv);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d4fac09095f8..1aaccbe7e1de 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1268,7 +1268,7 @@ relocate_entry(struct i915_vma *vma,
                 else if (gen >= 4)
                         len = 4;
                 else
-                        len = 6;
+                        len = 3;
 
                 batch = reloc_gpu(eb, vma, len);
                 if (IS_ERR(batch))
@@ -1309,11 +1309,6 @@ relocate_entry(struct i915_vma *vma,
                         *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
                         *batch++ = addr;
                         *batch++ = target_offset;
-
-                        /* And again for good measure (blb/pnv) */
-                        *batch++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
-                        *batch++ = addr;
-                        *batch++ = target_offset;
                 }
 
                 goto out;
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 3eb33e000d6f..db4128d6c09b 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1495,7 +1495,7 @@ static void gem_record_rings(struct i915_gpu_state *error)
                         if (HAS_BROKEN_CS_TLB(i915))
                                 ee->wa_batchbuffer =
                                         i915_error_object_create(i915,
-                                                                 engine->scratch);
+                                                                 i915->gt.scratch);
                         request_record_user_bo(request, ee);
 
                         ee->ctx =
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 217ed3ee1cab..76b5f94ea6cb 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -490,46 +490,6 @@ void intel_engine_setup_common(struct intel_engine_cs *engine)
         intel_engine_init_cmd_parser(engine);
 }
 
-int intel_engine_create_scratch(struct intel_engine_cs *engine,
-                                unsigned int size)
-{
-        struct drm_i915_gem_object *obj;
-        struct i915_vma *vma;
-        int ret;
-
-        WARN_ON(engine->scratch);
-
-        obj = i915_gem_object_create_stolen(engine->i915, size);
-        if (!obj)
-                obj = i915_gem_object_create_internal(engine->i915, size);
-        if (IS_ERR(obj)) {
-                DRM_ERROR("Failed to allocate scratch page\n");
-                return PTR_ERR(obj);
-        }
-
-        vma = i915_vma_instance(obj, &engine->i915->ggtt.vm, NULL);
-        if (IS_ERR(vma)) {
-                ret = PTR_ERR(vma);
-                goto err_unref;
-        }
-
-        ret = i915_vma_pin(vma, 0, 0, PIN_GLOBAL | PIN_HIGH);
-        if (ret)
-                goto err_unref;
-
-        engine->scratch = vma;
-        return 0;
-
-err_unref:
-        i915_gem_object_put(obj);
-        return ret;
-}
-
-void intel_engine_cleanup_scratch(struct intel_engine_cs *engine)
-{
-        i915_vma_unpin_and_release(&engine->scratch, 0);
-}
-
 static void cleanup_status_page(struct intel_engine_cs *engine)
 {
         if (HWS_NEEDS_PHYSICAL(engine->i915)) {
@@ -704,8 +664,6 @@ void intel_engine_cleanup_common(struct intel_engine_cs *engine)
 {
         struct drm_i915_private *i915 = engine->i915;
 
-        intel_engine_cleanup_scratch(engine);
-
         cleanup_status_page(engine);
 
         intel_engine_fini_breadcrumbs(engine);
@@ -720,6 +678,8 @@ void intel_engine_cleanup_common(struct intel_engine_cs *engine)
         __intel_context_unpin(i915->kernel_context, engine);
 
         i915_timeline_fini(&engine->timeline);
+
+        intel_wa_list_free(&engine->wa_list);
 }
 
 u64 intel_engine_get_active_head(const struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 37c94a54efcb..58d1d3d47dd3 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -442,8 +442,13 @@ static u64 execlists_update_context(struct i915_request *rq)
          * may not be visible to the HW prior to the completion of the UC
          * register write and that we may begin execution from the context
          * before its image is complete leading to invalid PD chasing.
+         *
+         * Furthermore, Braswell, at least, wants a full mb to be sure that
+         * the writes are coherent in memory (visible to the GPU) prior to
+         * execution, and not just visible to other CPUs (as is the result of
+         * wmb).
          */
-        wmb();
+        mb();
         return ce->lrc_desc;
 }
 
@@ -1443,9 +1448,10 @@ static int execlists_request_alloc(struct i915_request *request)
 static u32 *
 gen8_emit_flush_coherentl3_wa(struct intel_engine_cs *engine, u32 *batch)
 {
+        /* NB no one else is allowed to scribble over scratch + 256! */
         *batch++ = MI_STORE_REGISTER_MEM_GEN8 | MI_SRM_LRM_GLOBAL_GTT;
         *batch++ = i915_mmio_reg_offset(GEN8_L3SQCREG4);
-        *batch++ = i915_ggtt_offset(engine->scratch) + 256;
+        *batch++ = i915_scratch_offset(engine->i915) + 256;
         *batch++ = 0;
 
         *batch++ = MI_LOAD_REGISTER_IMM(1);
@@ -1459,7 +1465,7 @@ gen8_emit_flush_coherentl3_wa(struct intel_engine_cs *engine, u32 *batch)
 
         *batch++ = MI_LOAD_REGISTER_MEM_GEN8 | MI_SRM_LRM_GLOBAL_GTT;
         *batch++ = i915_mmio_reg_offset(GEN8_L3SQCREG4);
-        *batch++ = i915_ggtt_offset(engine->scratch) + 256;
+        *batch++ = i915_scratch_offset(engine->i915) + 256;
         *batch++ = 0;
 
         return batch;
@@ -1496,7 +1502,7 @@ static u32 *gen8_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch)
                                        PIPE_CONTROL_GLOBAL_GTT_IVB |
                                        PIPE_CONTROL_CS_STALL |
                                        PIPE_CONTROL_QW_WRITE,
-                                       i915_ggtt_offset(engine->scratch) +
+                                       i915_scratch_offset(engine->i915) +
                                        2 * CACHELINE_BYTES);
 
         *batch++ = MI_ARB_ON_OFF | MI_ARB_ENABLE;
@@ -1573,7 +1579,7 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch)
                                                PIPE_CONTROL_GLOBAL_GTT_IVB |
                                                PIPE_CONTROL_CS_STALL |
                                                PIPE_CONTROL_QW_WRITE,
-                                               i915_ggtt_offset(engine->scratch)
+                                               i915_scratch_offset(engine->i915)
                                                + 2 * CACHELINE_BYTES);
         }
 
@@ -1793,6 +1799,8 @@ static bool unexpected_starting_state(struct intel_engine_cs *engine)
 
 static int gen8_init_common_ring(struct intel_engine_cs *engine)
 {
+        intel_engine_apply_workarounds(engine);
+
         intel_mocs_init_engine(engine);
 
         intel_engine_reset_breadcrumbs(engine);
@@ -2139,7 +2147,7 @@ static int gen8_emit_flush_render(struct i915_request *request,
 {
         struct intel_engine_cs *engine = request->engine;
         u32 scratch_addr =
-                i915_ggtt_offset(engine->scratch) + 2 * CACHELINE_BYTES;
+                i915_scratch_offset(engine->i915) + 2 * CACHELINE_BYTES;
         bool vf_flush_wa = false, dc_flush_wa = false;
         u32 *cs, flags = 0;
         int len;
@@ -2476,10 +2484,6 @@ int logical_render_ring_init(struct intel_engine_cs *engine)
         if (ret)
                 return ret;
 
-        ret = intel_engine_create_scratch(engine, PAGE_SIZE);
-        if (ret)
-                goto err_cleanup_common;
-
         ret = intel_init_workaround_bb(engine);
         if (ret) {
                 /*
@@ -2491,11 +2495,9 @@ int logical_render_ring_init(struct intel_engine_cs *engine)
                           ret);
         }
 
-        return 0;
+        intel_engine_init_workarounds(engine);
 
-err_cleanup_common:
-        intel_engine_cleanup_common(engine);
-        return ret;
+        return 0;
 }
 
 int logical_xcs_ring_init(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 187bb0ceb4ac..1f8d2a66c791 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -69,19 +69,28 @@ unsigned int intel_ring_update_space(struct intel_ring *ring)
 static int
 gen2_render_ring_flush(struct i915_request *rq, u32 mode)
 {
+        unsigned int num_store_dw;
         u32 cmd, *cs;
 
         cmd = MI_FLUSH;
-
+        num_store_dw = 0;
         if (mode & EMIT_INVALIDATE)
                 cmd |= MI_READ_FLUSH;
+        if (mode & EMIT_FLUSH)
+                num_store_dw = 4;
 
-        cs = intel_ring_begin(rq, 2);
+        cs = intel_ring_begin(rq, 2 + 3 * num_store_dw);
         if (IS_ERR(cs))
                 return PTR_ERR(cs);
 
         *cs++ = cmd;
-        *cs++ = MI_NOOP;
+        while (num_store_dw--) {
+                *cs++ = MI_STORE_DWORD_IMM | MI_MEM_VIRTUAL;
+                *cs++ = i915_scratch_offset(rq->i915);
+                *cs++ = 0;
+        }
+        *cs++ = MI_FLUSH | MI_NO_WRITE_FLUSH;
+
         intel_ring_advance(rq, cs);
 
         return 0;
@@ -150,8 +159,7 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
          */
         if (mode & EMIT_INVALIDATE) {
                 *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
-                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
-                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = i915_scratch_offset(rq->i915) | PIPE_CONTROL_GLOBAL_GTT;
                 *cs++ = 0;
                 *cs++ = 0;
 
@@ -159,8 +167,7 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
                         *cs++ = MI_FLUSH;
 
                 *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
-                *cs++ = i915_ggtt_offset(rq->engine->scratch) |
-                        PIPE_CONTROL_GLOBAL_GTT;
+                *cs++ = i915_scratch_offset(rq->i915) | PIPE_CONTROL_GLOBAL_GTT;
                 *cs++ = 0;
                 *cs++ = 0;
         }
@@ -212,8 +219,7 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
 static int
 intel_emit_post_sync_nonzero_flush(struct i915_request *rq)
 {
-        u32 scratch_addr =
-                i915_ggtt_offset(rq->engine->scratch) + 2 * CACHELINE_BYTES;
+        u32 scratch_addr = i915_scratch_offset(rq->i915) + 2 * CACHELINE_BYTES;
         u32 *cs;
 
         cs = intel_ring_begin(rq, 6);
@@ -246,8 +252,7 @@ intel_emit_post_sync_nonzero_flush(struct i915_request *rq)
 static int
 gen6_render_ring_flush(struct i915_request *rq, u32 mode)
 {
-        u32 scratch_addr =
-                i915_ggtt_offset(rq->engine->scratch) + 2 * CACHELINE_BYTES;
+        u32 scratch_addr = i915_scratch_offset(rq->i915) + 2 * CACHELINE_BYTES;
         u32 *cs, flags = 0;
         int ret;
 
@@ -316,8 +321,7 @@ gen7_render_ring_cs_stall_wa(struct i915_request *rq)
 static int
 gen7_render_ring_flush(struct i915_request *rq, u32 mode)
 {
-        u32 scratch_addr =
-                i915_ggtt_offset(rq->engine->scratch) + 2 * CACHELINE_BYTES;
+        u32 scratch_addr = i915_scratch_offset(rq->i915) + 2 * CACHELINE_BYTES;
         u32 *cs, flags = 0;
 
         /*
@@ -971,7 +975,7 @@ i965_emit_bb_start(struct i915_request *rq,
 }
 
 /* Just userspace ABI convention to limit the wa batch bo to a resonable size */
-#define I830_BATCH_LIMIT (256*1024)
+#define I830_BATCH_LIMIT SZ_256K
 #define I830_TLB_ENTRIES (2)
 #define I830_WA_SIZE max(I830_TLB_ENTRIES*4096, I830_BATCH_LIMIT)
 static int
@@ -979,7 +983,9 @@ i830_emit_bb_start(struct i915_request *rq,
                    u64 offset, u32 len,
                    unsigned int dispatch_flags)
 {
-        u32 *cs, cs_offset = i915_ggtt_offset(rq->engine->scratch);
+        u32 *cs, cs_offset = i915_scratch_offset(rq->i915);
+
+        GEM_BUG_ON(rq->i915->gt.scratch->size < I830_WA_SIZE);
 
         cs = intel_ring_begin(rq, 6);
         if (IS_ERR(cs))
@@ -1437,7 +1443,6 @@ static int intel_init_ring_buffer(struct intel_engine_cs *engine)
 {
         struct i915_timeline *timeline;
         struct intel_ring *ring;
-        unsigned int size;
         int err;
 
         intel_engine_setup_common(engine);
@@ -1462,21 +1467,12 @@ static int intel_init_ring_buffer(struct intel_engine_cs *engine)
         GEM_BUG_ON(engine->buffer);
         engine->buffer = ring;
 
-        size = PAGE_SIZE;
-        if (HAS_BROKEN_CS_TLB(engine->i915))
-                size = I830_WA_SIZE;
-        err = intel_engine_create_scratch(engine, size);
-        if (err)
-                goto err_unpin;
-
         err = intel_engine_init_common(engine);
         if (err)
-                goto err_scratch;
+                goto err_unpin;
 
         return 0;
 
-err_scratch:
-        intel_engine_cleanup_scratch(engine);
 err_unpin:
         intel_ring_unpin(ring);
 err_ring:
@@ -1550,7 +1546,7 @@ static int flush_pd_dir(struct i915_request *rq)
         /* Stall until the page table load is complete */
         *cs++ = MI_STORE_REGISTER_MEM | MI_SRM_LRM_GLOBAL_GTT;
         *cs++ = i915_mmio_reg_offset(RING_PP_DIR_BASE(engine));
-        *cs++ = i915_ggtt_offset(engine->scratch);
+        *cs++ = i915_scratch_offset(rq->i915);
         *cs++ = MI_NOOP;
 
         intel_ring_advance(rq, cs);
@@ -1659,7 +1655,7 @@ static inline int mi_set_context(struct i915_request *rq, u32 flags)
                         /* Insert a delay before the next switch! */
                         *cs++ = MI_STORE_REGISTER_MEM | MI_SRM_LRM_GLOBAL_GTT;
                         *cs++ = i915_mmio_reg_offset(last_reg);
-                        *cs++ = i915_ggtt_offset(engine->scratch);
+                        *cs++ = i915_scratch_offset(rq->i915);
                         *cs++ = MI_NOOP;
                 }
                 *cs++ = MI_ARB_ON_OFF | MI_ARB_ENABLE;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 2dfa585712c2..767a7192c969 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -15,6 +15,7 @@
 #include "i915_selftest.h"
 #include "i915_timeline.h"
 #include "intel_gpu_commands.h"
+#include "intel_workarounds.h"
 
 struct drm_printer;
 struct i915_sched_attr;
@@ -440,7 +441,7 @@ struct intel_engine_cs {
 
         struct intel_hw_status_page status_page;
         struct i915_ctx_workarounds wa_ctx;
-        struct i915_vma *scratch;
+        struct i915_wa_list wa_list;
 
         u32             irq_keep_mask; /* always keep these interrupts */
         u32             irq_enable_mask; /* bitmask to enable ring interrupt */
@@ -898,10 +899,6 @@ void intel_engine_setup_common(struct intel_engine_cs *engine);
 int intel_engine_init_common(struct intel_engine_cs *engine);
 void intel_engine_cleanup_common(struct intel_engine_cs *engine);
 
-int intel_engine_create_scratch(struct intel_engine_cs *engine,
-                                unsigned int size);
-void intel_engine_cleanup_scratch(struct intel_engine_cs *engine);
-
 int intel_init_render_ring_buffer(struct intel_engine_cs *engine);
 int intel_init_bsd_ring_buffer(struct intel_engine_cs *engine);
 int intel_init_blt_ring_buffer(struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/intel_workarounds.c b/drivers/gpu/drm/i915/intel_workarounds.c
index 4bcdeaf8d98f..6e580891db96 100644
--- a/drivers/gpu/drm/i915/intel_workarounds.c
+++ b/drivers/gpu/drm/i915/intel_workarounds.c
@@ -48,6 +48,20 @@
  * - Public functions to init or apply the given workaround type.
  */
 
+static void wa_init_start(struct i915_wa_list *wal, const char *name)
+{
+        wal->name = name;
+}
+
+static void wa_init_finish(struct i915_wa_list *wal)
+{
+        if (!wal->count)
+                return;
+
+        DRM_DEBUG_DRIVER("Initialized %u %s workarounds\n",
+                         wal->count, wal->name);
+}
+
 static void wa_add(struct drm_i915_private *i915,
                    i915_reg_t reg, const u32 mask, const u32 val)
 {
@@ -580,160 +594,175 @@ int intel_ctx_workarounds_emit(struct i915_request *rq)
         return 0;
 }
 
-static void bdw_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void
+wal_add(struct i915_wa_list *wal, const struct i915_wa *wa)
+{
+        const unsigned int grow = 1 << 4;
+
+        GEM_BUG_ON(!is_power_of_2(grow));
+
+        if (IS_ALIGNED(wal->count, grow)) { /* Either uninitialized or full. */
+                struct i915_wa *list;
+
+                list = kmalloc_array(ALIGN(wal->count + 1, grow), sizeof(*wa),
+                                     GFP_KERNEL);
+                if (!list) {
+                        DRM_ERROR("No space for workaround init!\n");
+                        return;
+                }
+
+                if (wal->list)
+                        memcpy(list, wal->list, sizeof(*wa) * wal->count);
+
+                wal->list = list;
+        }
+
+        wal->list[wal->count++] = *wa;
+}
+
+static void
+wa_masked_en(struct i915_wa_list *wal, i915_reg_t reg, u32 val)
+{
+        struct i915_wa wa = {
+                .reg = reg,
+                .mask = val,
+                .val = _MASKED_BIT_ENABLE(val)
+        };
+
+        wal_add(wal, &wa);
+}
+
+static void
+wa_write_masked_or(struct i915_wa_list *wal, i915_reg_t reg, u32 mask,
+                   u32 val)
 {
+        struct i915_wa wa = {
+                .reg = reg,
+                .mask = mask,
+                .val = val
+        };
+
+        wal_add(wal, &wa);
 }
 
-static void chv_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void
+wa_write(struct i915_wa_list *wal, i915_reg_t reg, u32 val)
 {
+        wa_write_masked_or(wal, reg, ~0, val);
 }
 
-static void gen9_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void
+wa_write_or(struct i915_wa_list *wal, i915_reg_t reg, u32 val)
 {
-        /* WaContextSwitchWithConcurrentTLBInvalidate:skl,bxt,kbl,glk,cfl */
-        I915_WRITE(GEN9_CSFE_CHICKEN1_RCS,
-                   _MASKED_BIT_ENABLE(GEN9_PREEMPT_GPGPU_SYNC_SWITCH_DISABLE));
+        wa_write_masked_or(wal, reg, val, val);
+}
 
-        /* WaEnableLbsSlaRetryTimerDecrement:skl,bxt,kbl,glk,cfl */
-        I915_WRITE(BDW_SCRATCH1, I915_READ(BDW_SCRATCH1) |
-                   GEN9_LBS_SLA_RETRY_TIMER_DECREMENT_ENABLE);
+static void gen9_gt_workarounds_init(struct drm_i915_private *i915)
+{
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
         /* WaDisableKillLogic:bxt,skl,kbl */
-        if (!IS_COFFEELAKE(dev_priv))
-                I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) |
-                           ECOCHK_DIS_TLB);
+        if (!IS_COFFEELAKE(i915))
+                wa_write_or(wal,
+                            GAM_ECOCHK,
+                            ECOCHK_DIS_TLB);
 
-        if (HAS_LLC(dev_priv)) {
+        if (HAS_LLC(i915)) {
                 /* WaCompressedResourceSamplerPbeMediaNewHashMode:skl,kbl
                  *
                  * Must match Display Engine. See
                  * WaCompressedResourceDisplayNewHashMode.
                  */
-                I915_WRITE(MMCD_MISC_CTRL,
-                           I915_READ(MMCD_MISC_CTRL) |
-                           MMCD_PCLA |
-                           MMCD_HOTSPOT_EN);
+                wa_write_or(wal,
+                            MMCD_MISC_CTRL,
+                            MMCD_PCLA | MMCD_HOTSPOT_EN);
         }
 
         /* WaDisableHDCInvalidation:skl,bxt,kbl,cfl */
-        I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) |
-                   BDW_DISABLE_HDC_INVALIDATION);
-
-        /* WaProgramL3SqcReg1DefaultForPerf:bxt,glk */
-        if (IS_GEN9_LP(dev_priv)) {
-                u32 val = I915_READ(GEN8_L3SQCREG1);
-
-                val &= ~L3_PRIO_CREDITS_MASK;
-                val |= L3_GENERAL_PRIO_CREDITS(62) | L3_HIGH_PRIO_CREDITS(2);
-                I915_WRITE(GEN8_L3SQCREG1, val);
-        }
-
-        /* WaOCLCoherentLineFlush:skl,bxt,kbl,cfl */
-        I915_WRITE(GEN8_L3SQCREG4,
-                   I915_READ(GEN8_L3SQCREG4) | GEN8_LQSC_FLUSH_COHERENT_LINES);
-
-        /* WaEnablePreemptionGranularityControlByUMD:skl,bxt,kbl,cfl,[cnl] */
-        I915_WRITE(GEN7_FF_SLICE_CS_CHICKEN1,
-                   _MASKED_BIT_ENABLE(GEN9_FFSC_PERCTX_PREEMPT_CTRL));
+        wa_write_or(wal,
+                    GAM_ECOCHK,
+                    BDW_DISABLE_HDC_INVALIDATION);
 }
 
-static void skl_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void skl_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        gen9_gt_workarounds_apply(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
-        /* WaEnableGapsTsvCreditFix:skl */
-        I915_WRITE(GEN8_GARBCNTL,
-                   I915_READ(GEN8_GARBCNTL) | GEN9_GAPS_TSV_CREDIT_DISABLE);
+        gen9_gt_workarounds_init(i915);
 
         /* WaDisableGafsUnitClkGating:skl */
-        I915_WRITE(GEN7_UCGCTL4,
-                   I915_READ(GEN7_UCGCTL4) | GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
+        wa_write_or(wal,
+                    GEN7_UCGCTL4,
+                    GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
 
         /* WaInPlaceDecompressionHang:skl */
-        if (IS_SKL_REVID(dev_priv, SKL_REVID_H0, REVID_FOREVER))
-                I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA,
-                           I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                           GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
+        if (IS_SKL_REVID(i915, SKL_REVID_H0, REVID_FOREVER))
+                wa_write_or(wal,
+                            GEN9_GAMT_ECO_REG_RW_IA,
+                            GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 }
 
-static void bxt_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void bxt_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        gen9_gt_workarounds_apply(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
-        /* WaDisablePooledEuLoadBalancingFix:bxt */
-        I915_WRITE(FF_SLICE_CS_CHICKEN2,
-                   _MASKED_BIT_ENABLE(GEN9_POOLED_EU_LOAD_BALANCING_FIX_DISABLE));
+        gen9_gt_workarounds_init(i915);
 
         /* WaInPlaceDecompressionHang:bxt */
-        I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA,
-                   I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
+        wa_write_or(wal,
+                    GEN9_GAMT_ECO_REG_RW_IA,
+                    GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 }
 
-static void kbl_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void kbl_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        gen9_gt_workarounds_apply(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
-        /* WaEnableGapsTsvCreditFix:kbl */
-        I915_WRITE(GEN8_GARBCNTL,
-                   I915_READ(GEN8_GARBCNTL) | GEN9_GAPS_TSV_CREDIT_DISABLE);
+        gen9_gt_workarounds_init(i915);
 
         /* WaDisableDynamicCreditSharing:kbl */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
-                I915_WRITE(GAMT_CHKN_BIT_REG,
-                           I915_READ(GAMT_CHKN_BIT_REG) |
-                           GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING);
+        if (IS_KBL_REVID(i915, 0, KBL_REVID_B0))
+                wa_write_or(wal,
+                            GAMT_CHKN_BIT_REG,
+                            GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING);
 
         /* WaDisableGafsUnitClkGating:kbl */
-        I915_WRITE(GEN7_UCGCTL4,
-                   I915_READ(GEN7_UCGCTL4) | GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
+        wa_write_or(wal,
+                    GEN7_UCGCTL4,
+                    GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
 
         /* WaInPlaceDecompressionHang:kbl */
-        I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA,
-                   I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-
-        /* WaKBLVECSSemaphoreWaitPoll:kbl */
-        if (IS_KBL_REVID(dev_priv, KBL_REVID_A0, KBL_REVID_E0)) {
-                struct intel_engine_cs *engine;
-                unsigned int tmp;
-
-                for_each_engine(engine, dev_priv, tmp) {
-                        if (engine->id == RCS)
-                                continue;
-
-                        I915_WRITE(RING_SEMA_WAIT_POLL(engine->mmio_base), 1);
-                }
-        }
+        wa_write_or(wal,
+                    GEN9_GAMT_ECO_REG_RW_IA,
+                    GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 }
 
-static void glk_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void glk_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        gen9_gt_workarounds_apply(dev_priv);
+        gen9_gt_workarounds_init(i915);
 }
 
-static void cfl_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void cfl_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        gen9_gt_workarounds_apply(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
-        /* WaEnableGapsTsvCreditFix:cfl */
-        I915_WRITE(GEN8_GARBCNTL,
-                   I915_READ(GEN8_GARBCNTL) | GEN9_GAPS_TSV_CREDIT_DISABLE);
+        gen9_gt_workarounds_init(i915);
 
         /* WaDisableGafsUnitClkGating:cfl */
-        I915_WRITE(GEN7_UCGCTL4,
-                   I915_READ(GEN7_UCGCTL4) | GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
+        wa_write_or(wal,
+                    GEN7_UCGCTL4,
+                    GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
 
         /* WaInPlaceDecompressionHang:cfl */
-        I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA,
-                   I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
+        wa_write_or(wal,
+                    GEN9_GAMT_ECO_REG_RW_IA,
+                    GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 }
 
 static void wa_init_mcr(struct drm_i915_private *dev_priv)
 {
         const struct sseu_dev_info *sseu = &(INTEL_INFO(dev_priv)->sseu);
-        u32 mcr;
+        struct i915_wa_list *wal = &dev_priv->gt_wa_list;
         u32 mcr_slice_subslice_mask;
 
         /*
@@ -770,8 +799,6 @@ static void wa_init_mcr(struct drm_i915_private *dev_priv)
                 WARN_ON((enabled_mask & disabled_mask) != enabled_mask);
         }
 
-        mcr = I915_READ(GEN8_MCR_SELECTOR);
-
         if (INTEL_GEN(dev_priv) >= 11)
                 mcr_slice_subslice_mask = GEN11_MCR_SLICE_MASK |
                                           GEN11_MCR_SUBSLICE_MASK;
@@ -789,148 +816,170 @@ static void wa_init_mcr(struct drm_i915_private *dev_priv)
          * occasions, such as INSTDONE, where this value is dependent
          * on s/ss combo, the read should be done with read_subslice_reg.
          */
-        mcr &= ~mcr_slice_subslice_mask;
-        mcr |= intel_calculate_mcr_s_ss_select(dev_priv);
-        I915_WRITE(GEN8_MCR_SELECTOR, mcr);
+        wa_write_masked_or(wal,
+                           GEN8_MCR_SELECTOR,
+                           mcr_slice_subslice_mask,
+                           intel_calculate_mcr_s_ss_select(dev_priv));
 }
 
-static void cnl_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void cnl_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        wa_init_mcr(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
+
+        wa_init_mcr(i915);
 
         /* WaDisableI2mCycleOnWRPort:cnl (pre-prod) */
-        if (IS_CNL_REVID(dev_priv, CNL_REVID_B0, CNL_REVID_B0))
-                I915_WRITE(GAMT_CHKN_BIT_REG,
-                           I915_READ(GAMT_CHKN_BIT_REG) |
-                           GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT);
+        if (IS_CNL_REVID(i915, CNL_REVID_B0, CNL_REVID_B0))
+                wa_write_or(wal,
+                            GAMT_CHKN_BIT_REG,
+                            GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT);
 
         /* WaInPlaceDecompressionHang:cnl */
-        I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA,
-                   I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-
-        /* WaEnablePreemptionGranularityControlByUMD:cnl */
-        I915_WRITE(GEN7_FF_SLICE_CS_CHICKEN1,
-                   _MASKED_BIT_ENABLE(GEN9_FFSC_PERCTX_PREEMPT_CTRL));
+        wa_write_or(wal,
+                    GEN9_GAMT_ECO_REG_RW_IA,
+                    GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 }
 
-static void icl_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+static void icl_gt_workarounds_init(struct drm_i915_private *i915)
 {
-        wa_init_mcr(dev_priv);
+        struct i915_wa_list *wal = &i915->gt_wa_list;
 
-        /* This is not an Wa. Enable for better image quality */
-        I915_WRITE(_3D_CHICKEN3,
-                   _MASKED_BIT_ENABLE(_3D_CHICKEN3_AA_LINE_QUALITY_FIX_ENABLE));
+        wa_init_mcr(i915);
 
         /* WaInPlaceDecompressionHang:icl */
-        I915_WRITE(GEN9_GAMT_ECO_REG_RW_IA, I915_READ(GEN9_GAMT_ECO_REG_RW_IA) |
-                                            GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-
-        /* WaPipelineFlushCoherentLines:icl */
-        I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
-                                   GEN8_LQSC_FLUSH_COHERENT_LINES);
-
-        /* Wa_1405543622:icl
-         * Formerly known as WaGAPZPriorityScheme
-         */
-        I915_WRITE(GEN8_GARBCNTL, I915_READ(GEN8_GARBCNTL) |
-                                  GEN11_ARBITRATION_PRIO_ORDER_MASK);
-
-        /* Wa_1604223664:icl
-         * Formerly known as WaL3BankAddressHashing
-         */
-        I915_WRITE(GEN8_GARBCNTL,
-                   (I915_READ(GEN8_GARBCNTL) & ~GEN11_HASH_CTRL_EXCL_MASK) |
-                   GEN11_HASH_CTRL_EXCL_BIT0);
-        I915_WRITE(GEN11_GLBLINVL,
-                   (I915_READ(GEN11_GLBLINVL) & ~GEN11_BANK_HASH_ADDR_EXCL_MASK) |
-                   GEN11_BANK_HASH_ADDR_EXCL_BIT0);
+        wa_write_or(wal,
+                    GEN9_GAMT_ECO_REG_RW_IA,
+                    GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
 
         /* WaModifyGamTlbPartitioning:icl */
-        I915_WRITE(GEN11_GACB_PERF_CTRL,
-                   (I915_READ(GEN11_GACB_PERF_CTRL) & ~GEN11_HASH_CTRL_MASK) |
-                   GEN11_HASH_CTRL_BIT0 | GEN11_HASH_CTRL_BIT4);
-
-        /* Wa_1405733216:icl
-         * Formerly known as WaDisableCleanEvicts
-         */
-        I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
-                                   GEN11_LQSC_CLEAN_EVICT_DISABLE);
+        wa_write_masked_or(wal,
+                           GEN11_GACB_PERF_CTRL,
+                           GEN11_HASH_CTRL_MASK,
+                           GEN11_HASH_CTRL_BIT0 | GEN11_HASH_CTRL_BIT4);
 
         /* Wa_1405766107:icl
          * Formerly known as WaCL2SFHalfMaxAlloc
          */
-        I915_WRITE(GEN11_LSN_UNSLCVC, I915_READ(GEN11_LSN_UNSLCVC) |
-                                      GEN11_LSN_UNSLCVC_GAFS_HALF_SF_MAXALLOC |
-                                      GEN11_LSN_UNSLCVC_GAFS_HALF_CL2_MAXALLOC);
+        wa_write_or(wal,
+                    GEN11_LSN_UNSLCVC,
+                    GEN11_LSN_UNSLCVC_GAFS_HALF_SF_MAXALLOC |
+                    GEN11_LSN_UNSLCVC_GAFS_HALF_CL2_MAXALLOC);
 
         /* Wa_220166154:icl
          * Formerly known as WaDisCtxReload
          */
-        I915_WRITE(GAMW_ECO_DEV_RW_IA_REG, I915_READ(GAMW_ECO_DEV_RW_IA_REG) |
-                                           GAMW_ECO_DEV_CTX_RELOAD_DISABLE);
+        wa_write_or(wal,
+                    GEN8_GAMW_ECO_DEV_RW_IA,
+                    GAMW_ECO_DEV_CTX_RELOAD_DISABLE);
 
         /* Wa_1405779004:icl (pre-prod) */
-        if (IS_ICL_REVID(dev_priv, ICL_REVID_A0, ICL_REVID_A0))
-                I915_WRITE(SLICE_UNIT_LEVEL_CLKGATE,
-                           I915_READ(SLICE_UNIT_LEVEL_CLKGATE) |
-                           MSCUNIT_CLKGATE_DIS);
+        if (IS_ICL_REVID(i915, ICL_REVID_A0, ICL_REVID_A0))
+                wa_write_or(wal,
+                            SLICE_UNIT_LEVEL_CLKGATE,
+                            MSCUNIT_CLKGATE_DIS);
 
         /* Wa_1406680159:icl */
-        I915_WRITE(SUBSLICE_UNIT_LEVEL_CLKGATE,
-                   I915_READ(SUBSLICE_UNIT_LEVEL_CLKGATE) |
-                   GWUNIT_CLKGATE_DIS);
-
-        /* Wa_1604302699:icl */
-        I915_WRITE(GEN10_L3_CHICKEN_MODE_REGISTER,
-                   I915_READ(GEN10_L3_CHICKEN_MODE_REGISTER) |
-                   GEN11_I2M_WRITE_DISABLE);
+        wa_write_or(wal,
+                    SUBSLICE_UNIT_LEVEL_CLKGATE,
+                    GWUNIT_CLKGATE_DIS);
 
         /* Wa_1406838659:icl (pre-prod) */
-        if (IS_ICL_REVID(dev_priv, ICL_REVID_A0, ICL_REVID_B0))
-                I915_WRITE(INF_UNIT_LEVEL_CLKGATE,
-                           I915_READ(INF_UNIT_LEVEL_CLKGATE) |
-                           CGPSF_CLKGATE_DIS);
-
-        /* WaForwardProgressSoftReset:icl */
-        I915_WRITE(GEN10_SCRATCH_LNCF2,
-                   I915_READ(GEN10_SCRATCH_LNCF2) |
-                   PMFLUSHDONE_LNICRSDROP |
-                   PMFLUSH_GAPL3UNBLOCK |
-                   PMFLUSHDONE_LNEBLK);
+        if (IS_ICL_REVID(i915, ICL_REVID_A0, ICL_REVID_B0))
+                wa_write_or(wal,
+                            INF_UNIT_LEVEL_CLKGATE,
+                            CGPSF_CLKGATE_DIS);
 
         /* Wa_1406463099:icl
          * Formerly known as WaGamTlbPendError
          */
-        I915_WRITE(GAMT_CHKN_BIT_REG,
-                   I915_READ(GAMT_CHKN_BIT_REG) |
-                   GAMT_CHKN_DISABLE_L3_COH_PIPE);
+        wa_write_or(wal,
+                    GAMT_CHKN_BIT_REG,
+                    GAMT_CHKN_DISABLE_L3_COH_PIPE);
 }
 
-void intel_gt_workarounds_apply(struct drm_i915_private *dev_priv)
+void intel_gt_init_workarounds(struct drm_i915_private *i915)
 {
-        if (INTEL_GEN(dev_priv) < 8)
+        struct i915_wa_list *wal = &i915->gt_wa_list;
+
+        wa_init_start(wal, "GT");
+
+        if (INTEL_GEN(i915) < 8)
                 return;
-        else if (IS_BROADWELL(dev_priv))
-                bdw_gt_workarounds_apply(dev_priv);
-        else if (IS_CHERRYVIEW(dev_priv))
-                chv_gt_workarounds_apply(dev_priv);
-        else if (IS_SKYLAKE(dev_priv))
-                skl_gt_workarounds_apply(dev_priv);
-        else if (IS_BROXTON(dev_priv))
-                bxt_gt_workarounds_apply(dev_priv);
-        else if (IS_KABYLAKE(dev_priv))
-                kbl_gt_workarounds_apply(dev_priv);
-        else if (IS_GEMINILAKE(dev_priv))
-                glk_gt_workarounds_apply(dev_priv);
-        else if (IS_COFFEELAKE(dev_priv))
-                cfl_gt_workarounds_apply(dev_priv);
-        else if (IS_CANNONLAKE(dev_priv))
-                cnl_gt_workarounds_apply(dev_priv);
-        else if (IS_ICELAKE(dev_priv))
-                icl_gt_workarounds_apply(dev_priv);
+        else if (IS_BROADWELL(i915))
+                return;
+        else if (IS_CHERRYVIEW(i915))
+                return;
+        else if (IS_SKYLAKE(i915))
+                skl_gt_workarounds_init(i915);
+        else if (IS_BROXTON(i915))
+                bxt_gt_workarounds_init(i915);
+        else if (IS_KABYLAKE(i915))
+                kbl_gt_workarounds_init(i915);
+        else if (IS_GEMINILAKE(i915))
+                glk_gt_workarounds_init(i915);
+        else if (IS_COFFEELAKE(i915))
+                cfl_gt_workarounds_init(i915);
+        else if (IS_CANNONLAKE(i915))
+                cnl_gt_workarounds_init(i915);
+        else if (IS_ICELAKE(i915))
+                icl_gt_workarounds_init(i915);
         else
-                MISSING_CASE(INTEL_GEN(dev_priv));
+                MISSING_CASE(INTEL_GEN(i915));
+
+        wa_init_finish(wal);
+}
+
+static enum forcewake_domains
+wal_get_fw_for_rmw(struct drm_i915_private *dev_priv,
+                   const struct i915_wa_list *wal)
+{
+        enum forcewake_domains fw = 0;
+        struct i915_wa *wa;
+        unsigned int i;
+
+        for (i = 0, wa = wal->list; i < wal->count; i++, wa++)
+                fw |= intel_uncore_forcewake_for_reg(dev_priv,
+                                                     wa->reg,
+                                                     FW_REG_READ |
+                                                     FW_REG_WRITE);
+
+        return fw;
+}
+
+static void
+wa_list_apply(struct drm_i915_private *dev_priv, const struct i915_wa_list *wal)
+{
+        enum forcewake_domains fw;
+        unsigned long flags;
+        struct i915_wa *wa;
+        unsigned int i;
+
+        if (!wal->count)
+                return;
+
+        fw = wal_get_fw_for_rmw(dev_priv, wal);
+
+        spin_lock_irqsave(&dev_priv->uncore.lock, flags);
+        intel_uncore_forcewake_get__locked(dev_priv, fw);
+
+        for (i = 0, wa = wal->list; i < wal->count; i++, wa++) {
+                u32 val = I915_READ_FW(wa->reg);
+
+                val &= ~wa->mask;
+                val |= wa->val;
+
+                I915_WRITE_FW(wa->reg, val);
+        }
+
+        intel_uncore_forcewake_put__locked(dev_priv, fw);
+        spin_unlock_irqrestore(&dev_priv->uncore.lock, flags);
+
+        DRM_DEBUG_DRIVER("Applied %u %s workarounds\n", wal->count, wal->name);
+}
+
+void intel_gt_apply_workarounds(struct drm_i915_private *dev_priv)
+{
+        wa_list_apply(dev_priv, &dev_priv->gt_wa_list);
 }
 
 struct whitelist {
@@ -1077,6 +1126,146 @@ void intel_whitelist_workarounds_apply(struct intel_engine_cs *engine)
         whitelist_apply(engine, whitelist_build(engine, &w));
 }
 
+static void rcs_engine_wa_init(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *i915 = engine->i915;
+        struct i915_wa_list *wal = &engine->wa_list;
+
+        if (IS_ICELAKE(i915)) {
+                /* This is not an Wa. Enable for better image quality */
+                wa_masked_en(wal,
+                             _3D_CHICKEN3,
+                             _3D_CHICKEN3_AA_LINE_QUALITY_FIX_ENABLE);
+
+                /* WaPipelineFlushCoherentLines:icl */
+                wa_write_or(wal,
+                            GEN8_L3SQCREG4,
+                            GEN8_LQSC_FLUSH_COHERENT_LINES);
+
+                /*
+                 * Wa_1405543622:icl
+                 * Formerly known as WaGAPZPriorityScheme
+                 */
+                wa_write_or(wal,
+                            GEN8_GARBCNTL,
+                            GEN11_ARBITRATION_PRIO_ORDER_MASK);
+
+                /*
+                 * Wa_1604223664:icl
+                 * Formerly known as WaL3BankAddressHashing
+                 */
+                wa_write_masked_or(wal,
+                                   GEN8_GARBCNTL,
+                                   GEN11_HASH_CTRL_EXCL_MASK,
+                                   GEN11_HASH_CTRL_EXCL_BIT0);
+                wa_write_masked_or(wal,
+                                   GEN11_GLBLINVL,
+                                   GEN11_BANK_HASH_ADDR_EXCL_MASK,
+                                   GEN11_BANK_HASH_ADDR_EXCL_BIT0);
+
+                /*
+                 * Wa_1405733216:icl
+                 * Formerly known as WaDisableCleanEvicts
+                 */
+                wa_write_or(wal,
+                            GEN8_L3SQCREG4,
+                            GEN11_LQSC_CLEAN_EVICT_DISABLE);
+
+                /* Wa_1604302699:icl */
+                wa_write_or(wal,
+                            GEN10_L3_CHICKEN_MODE_REGISTER,
+                            GEN11_I2M_WRITE_DISABLE);
+
+                /* WaForwardProgressSoftReset:icl */
+                wa_write_or(wal,
+                            GEN10_SCRATCH_LNCF2,
+                            PMFLUSHDONE_LNICRSDROP |
+                            PMFLUSH_GAPL3UNBLOCK |
+                            PMFLUSHDONE_LNEBLK);
+        }
+
+        if (IS_GEN9(i915) || IS_CANNONLAKE(i915)) {
+                /* WaEnablePreemptionGranularityControlByUMD:skl,bxt,kbl,cfl,cnl */
+                wa_masked_en(wal,
+                             GEN7_FF_SLICE_CS_CHICKEN1,
+                             GEN9_FFSC_PERCTX_PREEMPT_CTRL);
+        }
+
+        if (IS_SKYLAKE(i915) || IS_KABYLAKE(i915) || IS_COFFEELAKE(i915)) {
+                /* WaEnableGapsTsvCreditFix:skl,kbl,cfl */
+                wa_write_or(wal,
+                            GEN8_GARBCNTL,
+                            GEN9_GAPS_TSV_CREDIT_DISABLE);
+        }
+
+        if (IS_BROXTON(i915)) {
+                /* WaDisablePooledEuLoadBalancingFix:bxt */
+                wa_masked_en(wal,
+                             FF_SLICE_CS_CHICKEN2,
+                             GEN9_POOLED_EU_LOAD_BALANCING_FIX_DISABLE);
+        }
+
+        if (IS_GEN9(i915)) {
+                /* WaContextSwitchWithConcurrentTLBInvalidate:skl,bxt,kbl,glk,cfl */
+                wa_masked_en(wal,
+                             GEN9_CSFE_CHICKEN1_RCS,
+                             GEN9_PREEMPT_GPGPU_SYNC_SWITCH_DISABLE);
+
+                /* WaEnableLbsSlaRetryTimerDecrement:skl,bxt,kbl,glk,cfl */
+                wa_write_or(wal,
+                            BDW_SCRATCH1,
+                            GEN9_LBS_SLA_RETRY_TIMER_DECREMENT_ENABLE);
+
+                /* WaProgramL3SqcReg1DefaultForPerf:bxt,glk */
+                if (IS_GEN9_LP(i915))
+                        wa_write_masked_or(wal,
+                                           GEN8_L3SQCREG1,
+                                           L3_PRIO_CREDITS_MASK,
+                                           L3_GENERAL_PRIO_CREDITS(62) |
+                                           L3_HIGH_PRIO_CREDITS(2));
+
+                /* WaOCLCoherentLineFlush:skl,bxt,kbl,cfl */
+                wa_write_or(wal,
+                            GEN8_L3SQCREG4,
+                            GEN8_LQSC_FLUSH_COHERENT_LINES);
+        }
+}
+
+static void xcs_engine_wa_init(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *i915 = engine->i915;
+        struct i915_wa_list *wal = &engine->wa_list;
+
+        /* WaKBLVECSSemaphoreWaitPoll:kbl */
+        if (IS_KBL_REVID(i915, KBL_REVID_A0, KBL_REVID_E0)) {
+                wa_write(wal,
+                         RING_SEMA_WAIT_POLL(engine->mmio_base),
+                         1);
+        }
+}
+
+void intel_engine_init_workarounds(struct intel_engine_cs *engine)
+{
+        struct i915_wa_list *wal = &engine->wa_list;
+
+        if (GEM_WARN_ON(INTEL_GEN(engine->i915) < 8))
+                return;
+
+        wa_init_start(wal, engine->name);
+
+        if (engine->id == RCS)
+                rcs_engine_wa_init(engine);
+        else
+                xcs_engine_wa_init(engine);
+
+        wa_init_finish(wal);
+}
+
+void intel_engine_apply_workarounds(struct intel_engine_cs *engine)
+{
+        wa_list_apply(engine->i915, &engine->wa_list);
+}
+
 #if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)
 #include "selftests/intel_workarounds.c"
 #endif
diff --git a/drivers/gpu/drm/i915/intel_workarounds.h b/drivers/gpu/drm/i915/intel_workarounds.h
index b11d0623e626..979695a53964 100644
--- a/drivers/gpu/drm/i915/intel_workarounds.h
+++ b/drivers/gpu/drm/i915/intel_workarounds.h
@@ -7,11 +7,35 @@
 #ifndef _I915_WORKAROUNDS_H_
 #define _I915_WORKAROUNDS_H_
 
+#include <linux/slab.h>
+
+struct i915_wa {
+        i915_reg_t        reg;
+        u32               mask;
+        u32               val;
+};
+
+struct i915_wa_list {
+        const char      *name;
+        struct i915_wa  *list;
+        unsigned int    count;
+};
+
+static inline void intel_wa_list_free(struct i915_wa_list *wal)
+{
+        kfree(wal->list);
+        memset(wal, 0, sizeof(*wal));
+}
+
 int intel_ctx_workarounds_init(struct drm_i915_private *dev_priv);
 int intel_ctx_workarounds_emit(struct i915_request *rq);
 
-void intel_gt_workarounds_apply(struct drm_i915_private *dev_priv);
+void intel_gt_init_workarounds(struct drm_i915_private *dev_priv);
+void intel_gt_apply_workarounds(struct drm_i915_private *dev_priv);
 
 void intel_whitelist_workarounds_apply(struct intel_engine_cs *engine);
 
+void intel_engine_init_workarounds(struct intel_engine_cs *engine);
+void intel_engine_apply_workarounds(struct intel_engine_cs *engine);
+
 #endif
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 66df1b177959..27b507eb4a99 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -818,10 +818,13 @@ static int mtk_dsi_create_conn_enc(struct drm_device *drm, struct mtk_dsi *dsi)
         dsi->encoder.possible_crtcs = 1;
 
         /* If there's a bridge, attach to it and let it create the connector */
-        ret = drm_bridge_attach(&dsi->encoder, dsi->bridge, NULL);
-        if (ret) {
-                DRM_ERROR("Failed to attach bridge to drm\n");
-
+        if (dsi->bridge) {
+                ret = drm_bridge_attach(&dsi->encoder, dsi->bridge, NULL);
+                if (ret) {
+                        DRM_ERROR("Failed to attach bridge to drm\n");
+                        goto err_encoder_cleanup;
+                }
+        } else {
                 /* Otherwise create our own connector and attach to a panel */
                 ret = mtk_dsi_create_connector(drm, dsi);
                 if (ret)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index d4530d60767b..ca169f013a14 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -1594,7 +1594,6 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane,
                                 NULL);
 
         drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
-        plane->crtc = crtc;
 
         /* save user friendly CRTC name for later */
         snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
index 96cdf06e7da2..d31d8281424e 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
@@ -488,8 +488,6 @@ static void dpu_encoder_destroy(struct drm_encoder *drm_enc)
 
         drm_encoder_cleanup(drm_enc);
         mutex_destroy(&dpu_enc->enc_lock);
-
-        kfree(dpu_enc);
 }
 
 void dpu_encoder_helper_split_config(
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c
index bfcd165e96df..d743e7ca6a3c 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c
@@ -216,7 +216,7 @@ static const struct dpu_format dpu_format_map[] = {
         INTERLEAVED_RGB_FMT(XBGR8888,
                 COLOR_8BIT, COLOR_8BIT, COLOR_8BIT, COLOR_8BIT,
                 C2_R_Cr, C0_G_Y, C1_B_Cb, C3_ALPHA, 4,
-                true, 4, 0,
+                false, 4, 0,
                 DPU_FETCH_LINEAR, 1),
 
         INTERLEAVED_RGB_FMT(RGBA8888,
diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
index 4c03f0b7343e..41bec570c518 100644
--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
@@ -39,6 +39,8 @@
 #define DSI_PIXEL_PLL_CLK               1
 #define NUM_PROVIDED_CLKS               2
 
+#define VCO_REF_CLK_RATE                19200000
+
 struct dsi_pll_regs {
         u32 pll_prop_gain_rate;
         u32 pll_lockdet_rate;
@@ -316,7 +318,7 @@ static int dsi_pll_10nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
             parent_rate);
 
         pll_10nm->vco_current_rate = rate;
-        pll_10nm->vco_ref_clk_rate = parent_rate;
+        pll_10nm->vco_ref_clk_rate = VCO_REF_CLK_RATE;
 
         dsi_pll_setup_config(pll_10nm);
 
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index c79659ca5706..adbdce3aeda0 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -332,6 +332,12 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
                 goto fail;
         }
 
+        ret = msm_hdmi_hpd_enable(hdmi->connector);
+        if (ret < 0) {
+                DRM_DEV_ERROR(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
+                goto fail;
+        }
+
         encoder->bridge = hdmi->bridge;
 
         priv->bridges[priv->num_bridges++]       = hdmi->bridge;
@@ -571,7 +577,7 @@ static int msm_hdmi_bind(struct device *dev, struct device *master, void *data)
 {
         struct drm_device *drm = dev_get_drvdata(master);
         struct msm_drm_private *priv = drm->dev_private;
-        static struct hdmi_platform_config *hdmi_cfg;
+        struct hdmi_platform_config *hdmi_cfg;
         struct hdmi *hdmi;
         struct device_node *of_node = dev->of_node;
         int i, err;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
index accc9a61611d..5c5df6ab2a57 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
@@ -245,6 +245,7 @@ void msm_hdmi_bridge_destroy(struct drm_bridge *bridge);
 
 void msm_hdmi_connector_irq(struct drm_connector *connector);
 struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi);
+int msm_hdmi_hpd_enable(struct drm_connector *connector);
 
 /*
  * i2c adapter for ddc:
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index e9c9a0af508e..30e908dfded7 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -167,8 +167,9 @@ static void enable_hpd_clocks(struct hdmi *hdmi, bool enable)
         }
 }
 
-static int hpd_enable(struct hdmi_connector *hdmi_connector)
+int msm_hdmi_hpd_enable(struct drm_connector *connector)
 {
+        struct hdmi_connector *hdmi_connector = to_hdmi_connector(connector);
         struct hdmi *hdmi = hdmi_connector->hdmi;
         const struct hdmi_platform_config *config = hdmi->config;
         struct device *dev = &hdmi->pdev->dev;
@@ -450,7 +451,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
 {
         struct drm_connector *connector = NULL;
         struct hdmi_connector *hdmi_connector;
-        int ret;
 
         hdmi_connector = kzalloc(sizeof(*hdmi_connector), GFP_KERNEL);
         if (!hdmi_connector)
@@ -471,12 +471,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
         connector->interlace_allowed = 0;
         connector->doublescan_allowed = 0;
 
-        ret = hpd_enable(hdmi_connector);
-        if (ret) {
-                dev_err(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
-                return ERR_PTR(ret);
-        }
-
         drm_connector_attach_encoder(connector, hdmi->encoder);
 
         return connector;
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 4bcdeca7479d..2088a20eb270 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -34,7 +34,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev,
                 if (!new_crtc_state->active)
                         continue;
 
+                if (drm_crtc_vblank_get(crtc))
+                        continue;
+
                 kms->funcs->wait_for_crtc_commit_done(kms, crtc);
+
+                drm_crtc_vblank_put(crtc);
         }
 }
 
diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
index f0da0d3c8a80..d756436c1fcd 100644
--- a/drivers/gpu/drm/msm/msm_debugfs.c
+++ b/drivers/gpu/drm/msm/msm_debugfs.c
@@ -84,7 +84,7 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
 
         ret = mutex_lock_interruptible(&dev->struct_mutex);
         if (ret)
-                return ret;
+                goto free_priv;
 
         pm_runtime_get_sync(&gpu->pdev->dev);
         show_priv->state = gpu->funcs->gpu_state_get(gpu);
@@ -94,13 +94,20 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
 
         if (IS_ERR(show_priv->state)) {
                 ret = PTR_ERR(show_priv->state);
-                kfree(show_priv);
-                return ret;
+                goto free_priv;
         }
 
         show_priv->dev = dev;
 
-        return single_open(file, msm_gpu_show, show_priv);
+        ret = single_open(file, msm_gpu_show, show_priv);
+        if (ret)
+                goto free_priv;
+
+        return 0;
+
+free_priv:
+        kfree(show_priv);
+        return ret;
 }
 
 static const struct file_operations msm_gpu_fops = {
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 4904d0d41409..dcff812c63d0 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -553,17 +553,18 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
                         kthread_run(kthread_worker_fn,
                                 &priv->disp_thread[i].worker,
                                 "crtc_commit:%d", priv->disp_thread[i].crtc_id);
-                ret = sched_setscheduler(priv->disp_thread[i].thread,
-                                                        SCHED_FIFO, &param);
-                if (ret)
-                        pr_warn("display thread priority update failed: %d\n",
-                                                                        ret);
-
                 if (IS_ERR(priv->disp_thread[i].thread)) {
                         dev_err(dev, "failed to create crtc_commit kthread\n");
                         priv->disp_thread[i].thread = NULL;
+                        goto err_msm_uninit;
                 }
 
+                ret = sched_setscheduler(priv->disp_thread[i].thread,
+                                         SCHED_FIFO, &param);
+                if (ret)
+                        dev_warn(dev, "disp_thread set priority failed: %d\n",
+                                 ret);
+
                 /* initialize event thread */
                 priv->event_thread[i].crtc_id = priv->crtcs[i]->base.id;
                 kthread_init_worker(&priv->event_thread[i].worker);
@@ -572,6 +573,12 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
                         kthread_run(kthread_worker_fn,
                                 &priv->event_thread[i].worker,
                                 "crtc_event:%d", priv->event_thread[i].crtc_id);
+                if (IS_ERR(priv->event_thread[i].thread)) {
+                        dev_err(dev, "failed to create crtc_event kthread\n");
+                        priv->event_thread[i].thread = NULL;
+                        goto err_msm_uninit;
+                }
+
                 /**
                  * event thread should also run at same priority as disp_thread
                  * because it is handling frame_done events. A lower priority
@@ -580,34 +587,10 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
                  * failure at crtc commit level.
                  */
                 ret = sched_setscheduler(priv->event_thread[i].thread,
-                                                        SCHED_FIFO, &param);
+                                         SCHED_FIFO, &param);
                 if (ret)
-                        pr_warn("display event thread priority update failed: %d\n",
-                                                                        ret);
-
-                if (IS_ERR(priv->event_thread[i].thread)) {
-                        dev_err(dev, "failed to create crtc_event kthread\n");
-                        priv->event_thread[i].thread = NULL;
-                }
-
-                if ((!priv->disp_thread[i].thread) ||
-                                !priv->event_thread[i].thread) {
-                        /* clean up previously created threads if any */
-                        for ( ; i >= 0; i--) {
-                                if (priv->disp_thread[i].thread) {
-                                        kthread_stop(
-                                                priv->disp_thread[i].thread);
-                                        priv->disp_thread[i].thread = NULL;
-                                }
-
-                                if (priv->event_thread[i].thread) {
-                                        kthread_stop(
-                                                priv->event_thread[i].thread);
-                                        priv->event_thread[i].thread = NULL;
-                                }
-                        }
-                        goto err_msm_uninit;
-                }
+                        dev_warn(dev, "event_thread set priority failed:%d\n",
+                                 ret);
         }
 
         ret = drm_vblank_init(ddev, priv->num_crtcs);
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 7a7923e6220d..6942604ad9a8 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -317,6 +317,9 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
         uint32_t *ptr;
         int ret = 0;
 
+        if (!nr_relocs)
+                return 0;
+
         if (offset % 4) {
                 DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset);
                 return -EINVAL;
@@ -410,7 +413,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         struct msm_file_private *ctx = file->driver_priv;
         struct msm_gem_submit *submit;
         struct msm_gpu *gpu = priv->gpu;
-        struct dma_fence *in_fence = NULL;
         struct sync_file *sync_file = NULL;
         struct msm_gpu_submitqueue *queue;
         struct msm_ringbuffer *ring;
@@ -443,6 +445,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         ring = gpu->rb[queue->prio];
 
         if (args->flags & MSM_SUBMIT_FENCE_FD_IN) {
+                struct dma_fence *in_fence;
+
                 in_fence = sync_file_get_fence(args->fence_fd);
 
                 if (!in_fence)
@@ -452,11 +456,13 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                  * Wait if the fence is from a foreign context, or if the fence
                  * array contains any fence from a foreign context.
                  */
-                if (!dma_fence_match_context(in_fence, ring->fctx->context)) {
+                ret = 0;
+                if (!dma_fence_match_context(in_fence, ring->fctx->context))
                         ret = dma_fence_wait(in_fence, true);
-                        if (ret)
-                                return ret;
-                }
+
+                dma_fence_put(in_fence);
+                if (ret)
+                        return ret;
         }
 
         ret = mutex_lock_interruptible(&dev->struct_mutex);
@@ -582,8 +588,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         }
 
 out:
-        if (in_fence)
-                dma_fence_put(in_fence);
         submit_cleanup(submit);
         if (ret)
                 msm_gem_submit_free(submit);
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 11aac8337066..2b7c8946adba 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -345,6 +345,10 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
 {
         struct msm_gpu_state *state;
 
+        /* Check if the target supports capturing crash state */
+        if (!gpu->funcs->gpu_state_get)
+                return;
+
         /* Only save one crash state at a time */
         if (gpu->crashstate)
                 return;
@@ -434,10 +438,9 @@ static void recover_worker(struct work_struct *work)
         if (submit) {
                 struct task_struct *task;
 
-                rcu_read_lock();
-                task = pid_task(submit->pid, PIDTYPE_PID);
+                task = get_pid_task(submit->pid, PIDTYPE_PID);
                 if (task) {
-                        comm = kstrdup(task->comm, GFP_ATOMIC);
+                        comm = kstrdup(task->comm, GFP_KERNEL);
 
                         /*
                          * So slightly annoying, in other paths like
@@ -450,10 +453,10 @@ static void recover_worker(struct work_struct *work)
                          * about the submit going away.
                          */
                         mutex_unlock(&dev->struct_mutex);
-                        cmd = kstrdup_quotable_cmdline(task, GFP_ATOMIC);
+                        cmd = kstrdup_quotable_cmdline(task, GFP_KERNEL);
+                        put_task_struct(task);
                         mutex_lock(&dev->struct_mutex);
                 }
-                rcu_read_unlock();
 
                 if (comm && cmd) {
                         dev_err(dev->dev, "%s: offending task: %s (%s)\n",
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index b23d33622f37..2a90aa4caec0 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -66,7 +66,7 @@ static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova,
 //      pm_runtime_get_sync(mmu->dev);
         ret = iommu_map_sg(iommu->domain, iova, sgt->sgl, sgt->nents, prot);
 //      pm_runtime_put_sync(mmu->dev);
-        WARN_ON(ret < 0);
+        WARN_ON(!ret);
 
         return (ret == len) ? 0 : -EINVAL;
 }
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index cca933458439..0c2c8d2c631f 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -316,10 +316,11 @@ static void snapshot_buf(struct msm_rd_state *rd,
                 uint64_t iova, uint32_t size)
 {
         struct msm_gem_object *obj = submit->bos[idx].obj;
+        unsigned offset = 0;
         const char *buf;
 
         if (iova) {
-                buf += iova - submit->bos[idx].iova;
+                offset = iova - submit->bos[idx].iova;
         } else {
                 iova = submit->bos[idx].iova;
                 size = obj->base.size;
@@ -340,6 +341,8 @@ static void snapshot_buf(struct msm_rd_state *rd,
         if (IS_ERR(buf))
                 return;
 
+        buf += offset;
+
         rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size);
 
         msm_gem_put_vaddr(&obj->base);
diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 6cbbae3f438b..db1bf7f88c1f 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -198,6 +198,22 @@ nv50_dmac_create(struct nvif_device *device, struct nvif_object *disp,
 /******************************************************************************
  * EVO channel helpers
  *****************************************************************************/
+static void
+evo_flush(struct nv50_dmac *dmac)
+{
+        /* Push buffer fetches are not coherent with BAR1, we need to ensure
+         * writes have been flushed right through to VRAM before writing PUT.
+         */
+        if (dmac->push.type & NVIF_MEM_VRAM) {
+                struct nvif_device *device = dmac->base.device;
+                nvif_wr32(&device->object, 0x070000, 0x00000001);
+                nvif_msec(device, 2000,
+                        if (!(nvif_rd32(&device->object, 0x070000) & 0x00000002))
+                                break;
+                );
+        }
+}
+
 u32 *
 evo_wait(struct nv50_dmac *evoc, int nr)
 {
@@ -208,6 +224,7 @@ evo_wait(struct nv50_dmac *evoc, int nr)
         mutex_lock(&dmac->lock);
         if (put + nr >= (PAGE_SIZE / 4) - 8) {
                 dmac->ptr[put] = 0x20000000;
+                evo_flush(dmac);
 
                 nvif_wr32(&dmac->base.user, 0x0000, 0x00000000);
                 if (nvif_msec(device, 2000,
@@ -230,17 +247,7 @@ evo_kick(u32 *push, struct nv50_dmac *evoc)
 {
         struct nv50_dmac *dmac = evoc;
 
-        /* Push buffer fetches are not coherent with BAR1, we need to ensure
-         * writes have been flushed right through to VRAM before writing PUT.
-         */
-        if (dmac->push.type & NVIF_MEM_VRAM) {
-                struct nvif_device *device = dmac->base.device;
-                nvif_wr32(&device->object, 0x070000, 0x00000001);
-                nvif_msec(device, 2000,
-                        if (!(nvif_rd32(&device->object, 0x070000) & 0x00000002))
-                                break;
-                );
-        }
+        evo_flush(dmac);
 
         nvif_wr32(&dmac->base.user, 0x0000, (push - dmac->ptr) << 2);
         mutex_unlock(&dmac->lock);
@@ -1264,6 +1271,7 @@ nv50_mstm_del(struct nv50_mstm **pmstm)
 {
         struct nv50_mstm *mstm = *pmstm;
         if (mstm) {
+                drm_dp_mst_topology_mgr_destroy(&mstm->mgr);
                 kfree(*pmstm);
                 *pmstm = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 2b2baf6e0e0d..d2928d43f29a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -1171,10 +1171,16 @@ nouveau_platform_device_create(const struct nvkm_device_tegra_func *func,
                 goto err_free;
         }
 
+        err = nouveau_drm_device_init(drm);
+        if (err)
+                goto err_put;
+
         platform_set_drvdata(pdev, drm);
 
         return drm;
 
+err_put:
+        drm_dev_put(drm);
 err_free:
         nvkm_device_del(pdevice);
 
diff --git a/drivers/gpu/drm/omapdrm/displays/panel-dpi.c b/drivers/gpu/drm/omapdrm/displays/panel-dpi.c
index 1f8161b041be..465120809eb3 100644
--- a/drivers/gpu/drm/omapdrm/displays/panel-dpi.c
+++ b/drivers/gpu/drm/omapdrm/displays/panel-dpi.c
@@ -177,6 +177,7 @@ static int panel_dpi_probe(struct platform_device *pdev)
         dssdev->type = OMAP_DISPLAY_TYPE_DPI;
         dssdev->owner = THIS_MODULE;
         dssdev->of_ports = BIT(0);
+        drm_bus_flags_from_videomode(&ddata->vm, &dssdev->bus_flags);
 
         omapdss_display_init(dssdev);
         omapdss_device_register(dssdev);
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 0a485c5b982e..00a9c2ab9e6c 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -5418,9 +5418,15 @@ static int dsi_probe(struct platform_device *pdev)
                 dsi->num_lanes_supported = 3;
         }
 
+        r = of_platform_populate(dev->of_node, NULL, NULL, dev);
+        if (r) {
+                DSSERR("Failed to populate DSI child devices: %d\n", r);
+                goto err_pm_disable;
+        }
+
         r = dsi_init_output(dsi);
         if (r)
-                goto err_pm_disable;
+                goto err_of_depopulate;
 
         r = dsi_probe_of(dsi);
         if (r) {
@@ -5428,22 +5434,16 @@ static int dsi_probe(struct platform_device *pdev)
                 goto err_uninit_output;
         }
 
-        r = of_platform_populate(dev->of_node, NULL, NULL, dev);
-        if (r) {
-                DSSERR("Failed to populate DSI child devices: %d\n", r);
-                goto err_uninit_output;
-        }
-
         r = component_add(&pdev->dev, &dsi_component_ops);
         if (r)
-                goto err_of_depopulate;
+                goto err_uninit_output;
 
         return 0;
 
-err_of_depopulate:
-        of_platform_depopulate(dev);
 err_uninit_output:
         dsi_uninit_output(dsi);
+err_of_depopulate:
+        of_platform_depopulate(dev);
 err_pm_disable:
         pm_runtime_disable(dev);
         return r;
diff --git a/drivers/gpu/drm/omapdrm/dss/omapdss.h b/drivers/gpu/drm/omapdrm/dss/omapdss.h
index 1f698a95a94a..33e15cb77efa 100644
--- a/drivers/gpu/drm/omapdrm/dss/omapdss.h
+++ b/drivers/gpu/drm/omapdrm/dss/omapdss.h
@@ -432,7 +432,7 @@ struct omap_dss_device {
         const struct omap_dss_driver *driver;
         const struct omap_dss_device_ops *ops;
         unsigned long ops_flags;
-        unsigned long bus_flags;
+        u32 bus_flags;
 
         /* helper variable for driver suspend/resume */
         bool activate_after_resume;
diff --git a/drivers/gpu/drm/omapdrm/omap_encoder.c b/drivers/gpu/drm/omapdrm/omap_encoder.c
index 452e625f6ce3..933ebc9f9faa 100644
--- a/drivers/gpu/drm/omapdrm/omap_encoder.c
+++ b/drivers/gpu/drm/omapdrm/omap_encoder.c
@@ -52,17 +52,44 @@ static const struct drm_encoder_funcs omap_encoder_funcs = {
         .destroy = omap_encoder_destroy,
 };
 
+static void omap_encoder_hdmi_mode_set(struct drm_encoder *encoder,
+                                       struct drm_display_mode *adjusted_mode)
+{
+        struct drm_device *dev = encoder->dev;
+        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
+        struct omap_dss_device *dssdev = omap_encoder->output;
+        struct drm_connector *connector;
+        bool hdmi_mode;
+
+        hdmi_mode = false;
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                if (connector->encoder == encoder) {
+                        hdmi_mode = omap_connector_get_hdmi_mode(connector);
+                        break;
+                }
+        }
+
+        if (dssdev->ops->hdmi.set_hdmi_mode)
+                dssdev->ops->hdmi.set_hdmi_mode(dssdev, hdmi_mode);
+
+        if (hdmi_mode && dssdev->ops->hdmi.set_infoframe) {
+                struct hdmi_avi_infoframe avi;
+                int r;
+
+                r = drm_hdmi_avi_infoframe_from_display_mode(&avi, adjusted_mode,
+                                                             false);
+                if (r == 0)
+                        dssdev->ops->hdmi.set_infoframe(dssdev, &avi);
+        }
+}
+
 static void omap_encoder_mode_set(struct drm_encoder *encoder,
                                   struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode)
 {
-        struct drm_device *dev = encoder->dev;
         struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_connector *connector;
         struct omap_dss_device *dssdev;
         struct videomode vm = { 0 };
-        bool hdmi_mode;
-        int r;
 
         drm_display_mode_to_videomode(adjusted_mode, &vm);
 
@@ -112,27 +139,8 @@ static void omap_encoder_mode_set(struct drm_encoder *encoder,
         }
 
         /* Set the HDMI mode and HDMI infoframe if applicable. */
-        hdmi_mode = false;
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->encoder == encoder) {
-                        hdmi_mode = omap_connector_get_hdmi_mode(connector);
-                        break;
-                }
-        }
-
-        dssdev = omap_encoder->output;
-
-        if (dssdev->ops->hdmi.set_hdmi_mode)
-                dssdev->ops->hdmi.set_hdmi_mode(dssdev, hdmi_mode);
-
-        if (hdmi_mode && dssdev->ops->hdmi.set_infoframe) {
-                struct hdmi_avi_infoframe avi;
-
-                r = drm_hdmi_avi_infoframe_from_display_mode(&avi, adjusted_mode,
-                                                             false);
-                if (r == 0)
-                        dssdev->ops->hdmi.set_infoframe(dssdev, &avi);
-        }
+        if (omap_encoder->output->output_type == OMAP_DISPLAY_TYPE_HDMI)
+                omap_encoder_hdmi_mode_set(encoder, adjusted_mode);
 }
 
 static void omap_encoder_disable(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
index 941f35233b1f..5864cb452c5c 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
@@ -448,11 +448,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
         return 0;
 }
 
-static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
-{
-        rockchip_drm_platform_remove(pdev);
-}
-
 static const struct of_device_id rockchip_drm_dt_ids[] = {
         { .compatible = "rockchip,display-subsystem", },
         { /* sentinel */ },
@@ -462,7 +457,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
 static struct platform_driver rockchip_drm_platform_driver = {
         .probe = rockchip_drm_platform_probe,
         .remove = rockchip_drm_platform_remove,
-        .shutdown = rockchip_drm_platform_shutdown,
         .driver = {
                 .name = "rockchip-drm",
                 .of_match_table = rockchip_drm_dt_ids,
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ba80150d1052..895d77d799e4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -492,8 +492,10 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         if (!fbo)
                 return -ENOMEM;
 
-        ttm_bo_get(bo);
         fbo->base = *bo;
+        fbo->base.mem.placement |= TTM_PL_FLAG_NO_EVICT;
+
+        ttm_bo_get(bo);
         fbo->bo = bo;
 
         /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 61a84b958d67..d7a2dfb8ee9b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -49,6 +49,8 @@
 
 #define VMWGFX_REPO "In Tree"
 
+#define VMWGFX_VALIDATION_MEM_GRAN (16*PAGE_SIZE)
+
 
 /**
  * Fully encoded drm commands. Might move to vmw_drm.h
@@ -918,7 +920,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 spin_unlock(&dev_priv->cap_lock);
         }
 
-
+        vmw_validation_mem_init_ttm(dev_priv, VMWGFX_VALIDATION_MEM_GRAN);
         ret = vmw_kms_init(dev_priv);
         if (unlikely(ret != 0))
                 goto out_no_kms;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 59f614225bcd..aca974b14b55 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -606,6 +606,9 @@ struct vmw_private {
 
         struct vmw_cmdbuf_man *cman;
         DECLARE_BITMAP(irqthread_pending, VMW_IRQTHREAD_MAX);
+
+        /* Validation memory reservation */
+        struct vmw_validation_mem vvm;
 };
 
 static inline struct vmw_surface *vmw_res_to_srf(struct vmw_resource *res)
@@ -846,6 +849,8 @@ extern int vmw_ttm_global_init(struct vmw_private *dev_priv);
 extern void vmw_ttm_global_release(struct vmw_private *dev_priv);
 extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
 
+extern void vmw_validation_mem_init_ttm(struct vmw_private *dev_priv,
+                                        size_t gran);
 /**
  * TTM buffer object driver - vmwgfx_ttm_buffer.c
  */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 5a6b70ba137a..f2d13a72c05d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1738,7 +1738,6 @@ static int vmw_cmd_check_define_gmrfb(struct vmw_private *dev_priv,
                                       void *buf)
 {
         struct vmw_buffer_object *vmw_bo;
-        int ret;
 
         struct {
                 uint32_t header;
@@ -1748,7 +1747,6 @@ static int vmw_cmd_check_define_gmrfb(struct vmw_private *dev_priv,
         return vmw_translate_guest_ptr(dev_priv, sw_context,
                                        &cmd->body.ptr,
                                        &vmw_bo);
-        return ret;
 }
 
 
@@ -3837,6 +3835,8 @@ int vmw_execbuf_process(struct drm_file *file_priv,
         struct sync_file *sync_file = NULL;
         DECLARE_VAL_CONTEXT(val_ctx, &sw_context->res_ht, 1);
 
+        vmw_validation_set_val_mem(&val_ctx, &dev_priv->vvm);
+
         if (flags & DRM_VMW_EXECBUF_FLAG_EXPORT_FENCE_FD) {
                 out_fence_fd = get_unused_fd_flags(O_CLOEXEC);
                 if (out_fence_fd < 0) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
index 7b1e5a5cbd2c..f88247046721 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
@@ -96,3 +96,39 @@ void vmw_ttm_global_release(struct vmw_private *dev_priv)
         drm_global_item_unref(&dev_priv->bo_global_ref.ref);
         drm_global_item_unref(&dev_priv->mem_global_ref);
 }
+
+/* struct vmw_validation_mem callback */
+static int vmw_vmt_reserve(struct vmw_validation_mem *m, size_t size)
+{
+        static struct ttm_operation_ctx ctx = {.interruptible = false,
+                                               .no_wait_gpu = false};
+        struct vmw_private *dev_priv = container_of(m, struct vmw_private, vvm);
+
+        return ttm_mem_global_alloc(vmw_mem_glob(dev_priv), size, &ctx);
+}
+
+/* struct vmw_validation_mem callback */
+static void vmw_vmt_unreserve(struct vmw_validation_mem *m, size_t size)
+{
+        struct vmw_private *dev_priv = container_of(m, struct vmw_private, vvm);
+
+        return ttm_mem_global_free(vmw_mem_glob(dev_priv), size);
+}
+
+/**
+ * vmw_validation_mem_init_ttm - Interface the validation memory tracker
+ * to ttm.
+ * @dev_priv: Pointer to struct vmw_private. The reason we choose a vmw private
+ * rather than a struct vmw_validation_mem is to make sure assumption in the
+ * callbacks that struct vmw_private derives from struct vmw_validation_mem
+ * holds true.
+ * @gran: The recommended allocation granularity
+ */
+void vmw_validation_mem_init_ttm(struct vmw_private *dev_priv, size_t gran)
+{
+        struct vmw_validation_mem *vvm = &dev_priv->vvm;
+
+        vvm->reserve_mem = vmw_vmt_reserve;
+        vvm->unreserve_mem = vmw_vmt_unreserve;
+        vvm->gran = gran;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
index 184025fa938e..f116f092e00b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
@@ -104,11 +104,25 @@ void *vmw_validation_mem_alloc(struct vmw_validation_context *ctx,
                 return NULL;
 
         if (ctx->mem_size_left < size) {
-                struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                struct page *page;
 
+                if (ctx->vm && ctx->vm_size_left < PAGE_SIZE) {
+                        int ret = ctx->vm->reserve_mem(ctx->vm, ctx->vm->gran);
+
+                        if (ret)
+                                return NULL;
+
+                        ctx->vm_size_left += ctx->vm->gran;
+                        ctx->total_mem += ctx->vm->gran;
+                }
+
+                page = alloc_page(GFP_KERNEL | __GFP_ZERO);
                 if (!page)
                         return NULL;
 
+                if (ctx->vm)
+                        ctx->vm_size_left -= PAGE_SIZE;
+
                 list_add_tail(&page->lru, &ctx->page_list);
                 ctx->page_address = page_address(page);
                 ctx->mem_size_left = PAGE_SIZE;
@@ -138,6 +152,11 @@ static void vmw_validation_mem_free(struct vmw_validation_context *ctx)
         }
 
         ctx->mem_size_left = 0;
+        if (ctx->vm && ctx->total_mem) {
+                ctx->vm->unreserve_mem(ctx->vm, ctx->total_mem);
+                ctx->total_mem = 0;
+                ctx->vm_size_left = 0;
+        }
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
index b57e3292c386..3b396fea40d7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
@@ -34,6 +34,21 @@
 #include <drm/ttm/ttm_execbuf_util.h>
 
 /**
+ * struct vmw_validation_mem - Custom interface to provide memory reservations
+ * for the validation code.
+ * @reserve_mem: Callback to reserve memory
+ * @unreserve_mem: Callback to unreserve memory
+ * @gran: Reservation granularity. Contains a hint how much memory should
+ * be reserved in each call to @reserve_mem(). A slow implementation may want
+ * reservation to be done in large batches.
+ */
+struct vmw_validation_mem {
+        int (*reserve_mem)(struct vmw_validation_mem *m, size_t size);
+        void (*unreserve_mem)(struct vmw_validation_mem *m, size_t size);
+        size_t gran;
+};
+
+/**
  * struct vmw_validation_context - Per command submission validation context
  * @ht: Hash table used to find resource- or buffer object duplicates
  * @resource_list: List head for resource validation metadata
@@ -47,6 +62,10 @@
  * buffer objects
  * @mem_size_left: Free memory left in the last page in @page_list
  * @page_address: Kernel virtual address of the last page in @page_list
+ * @vm: A pointer to the memory reservation interface or NULL if no
+ * memory reservation is needed.
+ * @vm_size_left: Amount of reserved memory that so far has not been allocated.
+ * @total_mem: Amount of reserved memory.
  */
 struct vmw_validation_context {
         struct drm_open_hash *ht;
@@ -59,6 +78,9 @@ struct vmw_validation_context {
         unsigned int merge_dups;
         unsigned int mem_size_left;
         u8 *page_address;
+        struct vmw_validation_mem *vm;
+        size_t vm_size_left;
+        size_t total_mem;
 };
 
 struct vmw_buffer_object;
@@ -102,6 +124,21 @@ vmw_validation_has_bos(struct vmw_validation_context *ctx)
 }
 
 /**
+ * vmw_validation_set_val_mem - Register a validation mem object for
+ * validation memory reservation
+ * @ctx: The validation context
+ * @vm: Pointer to a struct vmw_validation_mem
+ *
+ * Must be set before the first attempt to allocate validation memory.
+ */
+static inline void
+vmw_validation_set_val_mem(struct vmw_validation_context *ctx,
+                           struct vmw_validation_mem *vm)
+{
+        ctx->vm = vm;
+}
+
+/**
  * vmw_validation_set_ht - Register a hash table for duplicate finding
  * @ctx: The validation context
  * @ht: Pointer to a hash table to use for duplicate finding
diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
index b372854cf38d..704049e62d58 100644
--- a/drivers/hid/hid-hyperv.c
+++ b/drivers/hid/hid-hyperv.c
@@ -309,7 +309,7 @@ static void mousevsc_on_receive(struct hv_device *device,
                 hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
                                  input_dev->input_buf, len, 1);
 
-                pm_wakeup_event(&input_dev->device->device, 0);
+                pm_wakeup_hard_event(&input_dev->device->device);
 
                 break;
         default:
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index ed35c9a9a110..27519eb8ee63 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -17,6 +17,9 @@
 #ifndef HID_IDS_H_FILE
 #define HID_IDS_H_FILE
 
+#define USB_VENDOR_ID_258A              0x258a
+#define USB_DEVICE_ID_258A_6A88         0x6a88
+
 #define USB_VENDOR_ID_3M                0x0596
 #define USB_DEVICE_ID_3M1968            0x0500
 #define USB_DEVICE_ID_3M2256            0x0502
@@ -941,6 +944,10 @@
 #define USB_VENDOR_ID_REALTEK           0x0bda
 #define USB_DEVICE_ID_REALTEK_READER    0x0152
 
+#define USB_VENDOR_ID_RETROUSB          0xf000
+#define USB_DEVICE_ID_RETROUSB_SNES_RETROPAD    0x0003
+#define USB_DEVICE_ID_RETROUSB_SNES_RETROPORT   0x00f1
+
 #define USB_VENDOR_ID_ROCCAT            0x1e7d
 #define USB_DEVICE_ID_ROCCAT_ARVO       0x30d4
 #define USB_DEVICE_ID_ROCCAT_ISKU       0x319c
diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
index 1882a4ab0f29..98b059d79bc8 100644
--- a/drivers/hid/hid-ite.c
+++ b/drivers/hid/hid-ite.c
@@ -42,6 +42,7 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
 
 static const struct hid_device_id ite_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ite_devices);
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index c85a79986b6a..94088c0ed68a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -137,6 +137,8 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER), HID_QUIRK_NO_INIT_REPORTS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
         { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
         { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 6277597d3d58..edd34c167a9b 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -435,61 +435,16 @@ void vmbus_free_channels(void)
         }
 }
 
-/*
- * vmbus_process_offer - Process the offer by creating a channel/device
- * associated with this offer
- */
-static void vmbus_process_offer(struct vmbus_channel *newchannel)
+/* Note: the function can run concurrently for primary/sub channels. */
+static void vmbus_add_channel_work(struct work_struct *work)
 {
-        struct vmbus_channel *channel;
-        bool fnew = true;
+        struct vmbus_channel *newchannel =
+                container_of(work, struct vmbus_channel, add_channel_work);
+        struct vmbus_channel *primary_channel = newchannel->primary_channel;
         unsigned long flags;
         u16 dev_type;
         int ret;
 
-        /* Make sure this is a new offer */
-        mutex_lock(&vmbus_connection.channel_mutex);
-
-        /*
-         * Now that we have acquired the channel_mutex,
-         * we can release the potentially racing rescind thread.
-         */
-        atomic_dec(&vmbus_connection.offer_in_progress);
-
-        list_for_each_entry(channel, &vmbus_connection.chn_list, listentry) {
-                if (!uuid_le_cmp(channel->offermsg.offer.if_type,
-                        newchannel->offermsg.offer.if_type) &&
-                        !uuid_le_cmp(channel->offermsg.offer.if_instance,
-                                newchannel->offermsg.offer.if_instance)) {
-                        fnew = false;
-                        break;
-                }
-        }
-
-        if (fnew)
-                list_add_tail(&newchannel->listentry,
-                              &vmbus_connection.chn_list);
-
-        mutex_unlock(&vmbus_connection.channel_mutex);
-
-        if (!fnew) {
-                /*
-                 * Check to see if this is a sub-channel.
-                 */
-                if (newchannel->offermsg.offer.sub_channel_index != 0) {
-                        /*
-                         * Process the sub-channel.
-                         */
-                        newchannel->primary_channel = channel;
-                        spin_lock_irqsave(&channel->lock, flags);
-                        list_add_tail(&newchannel->sc_list, &channel->sc_list);
-                        channel->num_sc++;
-                        spin_unlock_irqrestore(&channel->lock, flags);
-                } else {
-                        goto err_free_chan;
-                }
-        }
-
         dev_type = hv_get_dev_type(newchannel);
 
         init_vp_index(newchannel, dev_type);
@@ -507,27 +462,26 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
         /*
          * This state is used to indicate a successful open
          * so that when we do close the channel normally, we
-         * can cleanup properly
+         * can cleanup properly.
          */
         newchannel->state = CHANNEL_OPEN_STATE;
 
-        if (!fnew) {
-                struct hv_device *dev
-                        = newchannel->primary_channel->device_obj;
+        if (primary_channel != NULL) {
+                /* newchannel is a sub-channel. */
+                struct hv_device *dev = primary_channel->device_obj;
 
                 if (vmbus_add_channel_kobj(dev, newchannel))
-                        goto err_free_chan;
+                        goto err_deq_chan;
+
+                if (primary_channel->sc_creation_callback != NULL)
+                        primary_channel->sc_creation_callback(newchannel);
 
-                if (channel->sc_creation_callback != NULL)
-                        channel->sc_creation_callback(newchannel);
                 newchannel->probe_done = true;
                 return;
         }
 
         /*
-         * Start the process of binding this offer to the driver
-         * We need to set the DeviceObject field before calling
-         * vmbus_child_dev_add()
+         * Start the process of binding the primary channel to the driver
          */
         newchannel->device_obj = vmbus_device_create(
                 &newchannel->offermsg.offer.if_type,
@@ -556,13 +510,28 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
 
 err_deq_chan:
         mutex_lock(&vmbus_connection.channel_mutex);
-        list_del(&newchannel->listentry);
+
+        /*
+         * We need to set the flag, otherwise
+         * vmbus_onoffer_rescind() can be blocked.
+         */
+        newchannel->probe_done = true;
+
+        if (primary_channel == NULL) {
+                list_del(&newchannel->listentry);
+        } else {
+                spin_lock_irqsave(&primary_channel->lock, flags);
+                list_del(&newchannel->sc_list);
+                spin_unlock_irqrestore(&primary_channel->lock, flags);
+        }
+
         mutex_unlock(&vmbus_connection.channel_mutex);
 
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
-                                         percpu_channel_deq, newchannel, true);
+                                         percpu_channel_deq,
+                                         newchannel, true);
         } else {
                 percpu_channel_deq(newchannel);
                 put_cpu();
@@ -570,14 +539,104 @@ err_deq_chan:
 
         vmbus_release_relid(newchannel->offermsg.child_relid);
 
-err_free_chan:
         free_channel(newchannel);
 }
 
 /*
+ * vmbus_process_offer - Process the offer by creating a channel/device
+ * associated with this offer
+ */
+static void vmbus_process_offer(struct vmbus_channel *newchannel)
+{
+        struct vmbus_channel *channel;
+        struct workqueue_struct *wq;
+        unsigned long flags;
+        bool fnew = true;
+
+        mutex_lock(&vmbus_connection.channel_mutex);
+
+        /*
+         * Now that we have acquired the channel_mutex,
+         * we can release the potentially racing rescind thread.
+         */
+        atomic_dec(&vmbus_connection.offer_in_progress);
+
+        list_for_each_entry(channel, &vmbus_connection.chn_list, listentry) {
+                if (!uuid_le_cmp(channel->offermsg.offer.if_type,
+                                 newchannel->offermsg.offer.if_type) &&
+                    !uuid_le_cmp(channel->offermsg.offer.if_instance,
+                                 newchannel->offermsg.offer.if_instance)) {
+                        fnew = false;
+                        break;
+                }
+        }
+
+        if (fnew)
+                list_add_tail(&newchannel->listentry,
+                              &vmbus_connection.chn_list);
+        else {
+                /*
+                 * Check to see if this is a valid sub-channel.
+                 */
+                if (newchannel->offermsg.offer.sub_channel_index == 0) {
+                        mutex_unlock(&vmbus_connection.channel_mutex);
+                        /*
+                         * Don't call free_channel(), because newchannel->kobj
+                         * is not initialized yet.
+                         */
+                        kfree(newchannel);
+                        WARN_ON_ONCE(1);
+                        return;
+                }
+                /*
+                 * Process the sub-channel.
+                 */
+                newchannel->primary_channel = channel;
+                spin_lock_irqsave(&channel->lock, flags);
+                list_add_tail(&newchannel->sc_list, &channel->sc_list);
+                spin_unlock_irqrestore(&channel->lock, flags);
+        }
+
+        mutex_unlock(&vmbus_connection.channel_mutex);
+
+        /*
+         * vmbus_process_offer() mustn't call channel->sc_creation_callback()
+         * directly for sub-channels, because sc_creation_callback() ->
+         * vmbus_open() may never get the host's response to the
+         * OPEN_CHANNEL message (the host may rescind a channel at any time,
+         * e.g. in the case of hot removing a NIC), and vmbus_onoffer_rescind()
+         * may not wake up the vmbus_open() as it's blocked due to a non-zero
+         * vmbus_connection.offer_in_progress, and finally we have a deadlock.
+         *
+         * The above is also true for primary channels, if the related device
+         * drivers use sync probing mode by default.
+         *
+         * And, usually the handling of primary channels and sub-channels can
+         * depend on each other, so we should offload them to different
+         * workqueues to avoid possible deadlock, e.g. in sync-probing mode,
+         * NIC1's netvsc_subchan_work() can race with NIC2's netvsc_probe() ->
+         * rtnl_lock(), and causes deadlock: the former gets the rtnl_lock
+         * and waits for all the sub-channels to appear, but the latter
+         * can't get the rtnl_lock and this blocks the handling of
+         * sub-channels.
+         */
+        INIT_WORK(&newchannel->add_channel_work, vmbus_add_channel_work);
+        wq = fnew ? vmbus_connection.handle_primary_chan_wq :
+                    vmbus_connection.handle_sub_chan_wq;
+        queue_work(wq, &newchannel->add_channel_work);
+}
+
+/*
  * We use this state to statically distribute the channel interrupt load.
  */
 static int next_numa_node_id;
+/*
+ * init_vp_index() accesses global variables like next_numa_node_id, and
+ * it can run concurrently for primary channels and sub-channels: see
+ * vmbus_process_offer(), so we need the lock to protect the global
+ * variables.
+ */
+static DEFINE_SPINLOCK(bind_channel_to_cpu_lock);
 
 /*
  * Starting with Win8, we can statically distribute the incoming
@@ -613,6 +672,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
                 return;
         }
 
+        spin_lock(&bind_channel_to_cpu_lock);
+
         /*
          * Based on the channel affinity policy, we will assign the NUMA
          * nodes.
@@ -695,6 +756,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
         channel->target_cpu = cur_cpu;
         channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
 
+        spin_unlock(&bind_channel_to_cpu_lock);
+
         free_cpumask_var(available_mask);
 }
 
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index f4d08c8ac7f8..4fe117b761ce 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -190,6 +190,20 @@ int vmbus_connect(void)
                 goto cleanup;
         }
 
+        vmbus_connection.handle_primary_chan_wq =
+                create_workqueue("hv_pri_chan");
+        if (!vmbus_connection.handle_primary_chan_wq) {
+                ret = -ENOMEM;
+                goto cleanup;
+        }
+
+        vmbus_connection.handle_sub_chan_wq =
+                create_workqueue("hv_sub_chan");
+        if (!vmbus_connection.handle_sub_chan_wq) {
+                ret = -ENOMEM;
+                goto cleanup;
+        }
+
         INIT_LIST_HEAD(&vmbus_connection.chn_msg_list);
         spin_lock_init(&vmbus_connection.channelmsg_lock);
 
@@ -280,10 +294,14 @@ void vmbus_disconnect(void)
          */
         vmbus_initiate_unload(false);
 
-        if (vmbus_connection.work_queue) {
-                drain_workqueue(vmbus_connection.work_queue);
+        if (vmbus_connection.handle_sub_chan_wq)
+                destroy_workqueue(vmbus_connection.handle_sub_chan_wq);
+
+        if (vmbus_connection.handle_primary_chan_wq)
+                destroy_workqueue(vmbus_connection.handle_primary_chan_wq);
+
+        if (vmbus_connection.work_queue)
                 destroy_workqueue(vmbus_connection.work_queue);
-        }
 
         if (vmbus_connection.int_page) {
                 free_pages((unsigned long)vmbus_connection.int_page, 0);
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 72eaba3d50fc..87d3d7da78f8 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -335,7 +335,14 @@ struct vmbus_connection {
         struct list_head chn_list;
         struct mutex channel_mutex;
 
+        /*
+         * An offer message is handled first on the work_queue, and then
+         * is further handled on handle_primary_chan_wq or
+         * handle_sub_chan_wq.
+         */
         struct workqueue_struct *work_queue;
+        struct workqueue_struct *handle_primary_chan_wq;
+        struct workqueue_struct *handle_sub_chan_wq;
 };
 
 
diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
index 8e60048a33f8..51d34959709b 100644
--- a/drivers/i2c/busses/i2c-axxia.c
+++ b/drivers/i2c/busses/i2c-axxia.c
@@ -74,8 +74,7 @@
                                  MST_STATUS_ND)
 #define   MST_STATUS_ERR        (MST_STATUS_NAK | \
                                  MST_STATUS_AL  | \
-                                 MST_STATUS_IP  | \
-                                 MST_STATUS_TSS)
+                                 MST_STATUS_IP)
 #define MST_TX_BYTES_XFRD       0x50
 #define MST_RX_BYTES_XFRD       0x54
 #define SCL_HIGH_PERIOD         0x80
@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev)
                          */
                         if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) {
                                 idev->msg_err = -EPROTO;
-                                i2c_int_disable(idev, ~0);
+                                i2c_int_disable(idev, ~MST_STATUS_TSS);
                                 complete(&idev->msg_complete);
                                 break;
                         }
@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
 
         if (status & MST_STATUS_SCC) {
                 /* Stop completed */
-                i2c_int_disable(idev, ~0);
+                i2c_int_disable(idev, ~MST_STATUS_TSS);
                 complete(&idev->msg_complete);
         } else if (status & MST_STATUS_SNS) {
                 /* Transfer done */
-                i2c_int_disable(idev, ~0);
+                i2c_int_disable(idev, ~MST_STATUS_TSS);
                 if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
                         axxia_i2c_empty_rx_fifo(idev);
                 complete(&idev->msg_complete);
+        } else if (status & MST_STATUS_TSS) {
+                /* Transfer timeout */
+                idev->msg_err = -ETIMEDOUT;
+                i2c_int_disable(idev, ~MST_STATUS_TSS);
+                complete(&idev->msg_complete);
         } else if (unlikely(status & MST_STATUS_ERR)) {
                 /* Transfer error */
                 i2c_int_disable(idev, ~0);
@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
         u32 rx_xfer, tx_xfer;
         u32 addr_1, addr_2;
         unsigned long time_left;
+        unsigned int wt_value;
 
         idev->msg = msg;
         idev->msg_xfrd = 0;
-        idev->msg_err = 0;
         reinit_completion(&idev->msg_complete);
 
         if (i2c_m_ten(msg)) {
@@ -383,9 +387,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
         else if (axxia_i2c_fill_tx_fifo(idev) != 0)
                 int_mask |= MST_STATUS_TFL;
 
+        wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL));
+        /* Disable wait timer temporarly */
+        writel(wt_value, idev->base + WAIT_TIMER_CONTROL);
+        /* Check if timeout error happened */
+        if (idev->msg_err)
+                goto out;
+
         /* Start manual mode */
         writel(CMD_MANUAL, idev->base + MST_COMMAND);
 
+        writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL);
+
         i2c_int_enable(idev, int_mask);
 
         time_left = wait_for_completion_timeout(&idev->msg_complete,
@@ -396,13 +409,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
         if (readl(idev->base + MST_COMMAND) & CMD_BUSY)
                 dev_warn(idev->dev, "busy after xfer\n");
 
-        if (time_left == 0)
+        if (time_left == 0) {
                 idev->msg_err = -ETIMEDOUT;
-
-        if (idev->msg_err == -ETIMEDOUT)
                 i2c_recover_bus(&idev->adapter);
+                axxia_i2c_init(idev);
+        }
 
-        if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO)
+out:
+        if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO &&
+                        idev->msg_err != -ETIMEDOUT)
                 axxia_i2c_init(idev);
 
         return idev->msg_err;
@@ -410,7 +425,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
 
 static int axxia_i2c_stop(struct axxia_i2c_dev *idev)
 {
-        u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC;
+        u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS;
         unsigned long time_left;
 
         reinit_completion(&idev->msg_complete);
@@ -437,6 +452,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
         int i;
         int ret = 0;
 
+        idev->msg_err = 0;
+        i2c_int_enable(idev, MST_STATUS_TSS);
+
         for (i = 0; ret == 0 && i < num; ++i)
                 ret = axxia_i2c_xfer_msg(idev, &msgs[i]);
 
diff --git a/drivers/i2c/busses/i2c-nvidia-gpu.c b/drivers/i2c/busses/i2c-nvidia-gpu.c
index 8822357bca0c..e99c3bb58351 100644
--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
+++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
@@ -89,7 +89,7 @@ static int gpu_i2c_check_status(struct gpu_i2c_dev *i2cd)
 
         if (time_is_before_jiffies(target)) {
                 dev_err(i2cd->dev, "i2c timeout error %x\n", val);
-                return -ETIME;
+                return -ETIMEDOUT;
         }
 
         val = readl(i2cd->regs + I2C_MST_CNTL);
@@ -97,9 +97,9 @@ static int gpu_i2c_check_status(struct gpu_i2c_dev *i2cd)
         case I2C_MST_CNTL_STATUS_OKAY:
                 return 0;
         case I2C_MST_CNTL_STATUS_NO_ACK:
-                return -EIO;
+                return -ENXIO;
         case I2C_MST_CNTL_STATUS_TIMEOUT:
-                return -ETIME;
+                return -ETIMEDOUT;
         default:
                 return 0;
         }
@@ -218,6 +218,7 @@ stop:
 
 static const struct i2c_adapter_quirks gpu_i2c_quirks = {
         .max_read_len = 4,
+        .max_comb_2nd_msg_len = 4,
         .flags = I2C_AQ_COMB_WRITE_THEN_READ,
 };
 
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 4aa7dde876f3..254e6219e538 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -779,6 +779,11 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
         pm_runtime_get_sync(dev);
 
+        /* Check bus state before init otherwise bus busy info will be lost */
+        ret = rcar_i2c_bus_barrier(priv);
+        if (ret < 0)
+                goto out;
+
         /* Gen3 needs a reset before allowing RXDMA once */
         if (priv->devtype == I2C_RCAR_GEN3) {
                 priv->flags |= ID_P_NO_RXDMA;
@@ -791,10 +796,6 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
         rcar_i2c_init(priv);
 
-        ret = rcar_i2c_bus_barrier(priv);
-        if (ret < 0)
-                goto out;
-
         for (i = 0; i < num; i++)
                 rcar_i2c_request_dma(priv, msgs + i);
 
diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
index 7e9a2bbf5ddc..ff3f4553648f 100644
--- a/drivers/i2c/busses/i2c-scmi.c
+++ b/drivers/i2c/busses/i2c-scmi.c
@@ -367,6 +367,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
 {
         struct acpi_smbus_cmi *smbus_cmi;
         const struct acpi_device_id *id;
+        int ret;
 
         smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
         if (!smbus_cmi)
@@ -388,8 +389,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
         acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
                             acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
 
-        if (smbus_cmi->cap_info == 0)
+        if (smbus_cmi->cap_info == 0) {
+                ret = -ENODEV;
                 goto err;
+        }
 
         snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
                 "SMBus CMI adapter %s",
@@ -400,7 +403,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
         smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
         smbus_cmi->adapter.dev.parent = &device->dev;
 
-        if (i2c_add_adapter(&smbus_cmi->adapter)) {
+        ret = i2c_add_adapter(&smbus_cmi->adapter);
+        if (ret) {
                 dev_err(&device->dev, "Couldn't register adapter!\n");
                 goto err;
         }
@@ -410,7 +414,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
 err:
         kfree(smbus_cmi);
         device->driver_data = NULL;
-        return -EIO;
+        return ret;
 }
 
 static int acpi_smbus_cmi_remove(struct acpi_device *device)
diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
index dd384743dbbd..03da4a539a2f 100644
--- a/drivers/i2c/busses/i2c-uniphier-f.c
+++ b/drivers/i2c/busses/i2c-uniphier-f.c
@@ -173,8 +173,6 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
                 "interrupt: enabled_irqs=%04x, irq_status=%04x\n",
                 priv->enabled_irqs, irq_status);
 
-        uniphier_fi2c_clear_irqs(priv, irq_status);
-
         if (irq_status & UNIPHIER_FI2C_INT_STOP)
                 goto complete;
 
@@ -214,7 +212,13 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
 
         if (irq_status & (UNIPHIER_FI2C_INT_RF | UNIPHIER_FI2C_INT_RB)) {
                 uniphier_fi2c_drain_rxfifo(priv);
-                if (!priv->len)
+                /*
+                 * If the number of bytes to read is multiple of the FIFO size
+                 * (msg->len == 8, 16, 24, ...), the INT_RF bit is set a little
+                 * earlier than INT_RB. We wait for INT_RB to confirm the
+                 * completion of the current message.
+                 */
+                if (!priv->len && (irq_status & UNIPHIER_FI2C_INT_RB))
                         goto data_done;
 
                 if (unlikely(priv->flags & UNIPHIER_FI2C_MANUAL_NACK)) {
@@ -253,12 +257,20 @@ complete:
         }
 
 handled:
+        /*
+         * This controller makes a pause while any bit of the IRQ status is
+         * asserted. Clear the asserted bit to kick the controller just before
+         * exiting the handler.
+         */
+        uniphier_fi2c_clear_irqs(priv, irq_status);
+
         spin_unlock(&priv->lock);
 
         return IRQ_HANDLED;
 }
 
-static void uniphier_fi2c_tx_init(struct uniphier_fi2c_priv *priv, u16 addr)
+static void uniphier_fi2c_tx_init(struct uniphier_fi2c_priv *priv, u16 addr,
+                                  bool repeat)
 {
         priv->enabled_irqs |= UNIPHIER_FI2C_INT_TE;
         uniphier_fi2c_set_irqs(priv);
@@ -268,8 +280,12 @@ static void uniphier_fi2c_tx_init(struct uniphier_fi2c_priv *priv, u16 addr)
         /* set slave address */
         writel(UNIPHIER_FI2C_DTTX_CMD | addr << 1,
                priv->membase + UNIPHIER_FI2C_DTTX);
-        /* first chunk of data */
-        uniphier_fi2c_fill_txfifo(priv, true);
+        /*
+         * First chunk of data. For a repeated START condition, do not write
+         * data to the TX fifo here to avoid the timing issue.
+         */
+        if (!repeat)
+                uniphier_fi2c_fill_txfifo(priv, true);
 }
 
 static void uniphier_fi2c_rx_init(struct uniphier_fi2c_priv *priv, u16 addr)
@@ -350,7 +366,7 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
         if (is_read)
                 uniphier_fi2c_rx_init(priv, msg->addr);
         else
-                uniphier_fi2c_tx_init(priv, msg->addr);
+                uniphier_fi2c_tx_init(priv, msg->addr, repeat);
 
         dev_dbg(&adap->dev, "start condition\n");
         /*
@@ -502,9 +518,26 @@ static void uniphier_fi2c_hw_init(struct uniphier_fi2c_priv *priv)
 
         uniphier_fi2c_reset(priv);
 
+        /*
+         *  Standard-mode: tLOW + tHIGH = 10 us
+         *  Fast-mode:     tLOW + tHIGH = 2.5 us
+         */
         writel(cyc, priv->membase + UNIPHIER_FI2C_CYC);
-        writel(cyc / 2, priv->membase + UNIPHIER_FI2C_LCTL);
+        /*
+         *  Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us, tBUF = 4.7 us
+         *  Fast-mode:     tLOW = 1.3 us, tHIGH = 0.6 us, tBUF = 1.3 us
+         * "tLow/tHIGH = 5/4" meets both.
+         */
+        writel(cyc * 5 / 9, priv->membase + UNIPHIER_FI2C_LCTL);
+        /*
+         *  Standard-mode: tHD;STA = 4.0 us, tSU;STA = 4.7 us, tSU;STO = 4.0 us
+         *  Fast-mode:     tHD;STA = 0.6 us, tSU;STA = 0.6 us, tSU;STO = 0.6 us
+         */
         writel(cyc / 2, priv->membase + UNIPHIER_FI2C_SSUT);
+        /*
+         *  Standard-mode: tSU;DAT = 250 ns
+         *  Fast-mode:     tSU;DAT = 100 ns
+         */
         writel(cyc / 16, priv->membase + UNIPHIER_FI2C_DSUT);
 
         uniphier_fi2c_prepare_operation(priv);
diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
index 454f914ae66d..c488e558aef7 100644
--- a/drivers/i2c/busses/i2c-uniphier.c
+++ b/drivers/i2c/busses/i2c-uniphier.c
@@ -320,7 +320,13 @@ static void uniphier_i2c_hw_init(struct uniphier_i2c_priv *priv)
 
         uniphier_i2c_reset(priv, true);
 
-        writel((cyc / 2 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
+        /*
+         * Bit30-16: clock cycles of tLOW.
+         *  Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us
+         *  Fast-mode:     tLOW = 1.3 us, tHIGH = 0.6 us
+         * "tLow/tHIGH = 5/4" meets both.
+         */
+        writel((cyc * 5 / 9 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
 
         uniphier_i2c_reset(priv, false);
 }
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 45c997430332..4c8c7a620d08 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -614,18 +614,7 @@ static int ide_drivers_show(struct seq_file *s, void *p)
         return 0;
 }
 
-static int ide_drivers_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, &ide_drivers_show, NULL);
-}
-
-static const struct file_operations ide_drivers_operations = {
-        .owner          = THIS_MODULE,
-        .open           = ide_drivers_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(ide_drivers);
 
 void proc_ide_create(void)
 {
@@ -634,7 +623,7 @@ void proc_ide_create(void)
         if (!proc_ide_root)
                 return;
 
-        proc_create("drivers", 0, proc_ide_root, &ide_drivers_operations);
+        proc_create("drivers", 0, proc_ide_root, &ide_drivers_fops);
 }
 
 void proc_ide_destroy(void)
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index c5b902b86b44..203ed4adc04a 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
         struct device_node *root = of_find_node_by_path("/");
         const char *model = of_get_property(root, "model", NULL);
 
+        of_node_put(root);
         /* Get cable type from device-tree. */
         if (cable && !strncmp(cable, "80-", 3)) {
                 /* Some drives fail to detect 80c cable in PowerBook */
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index 25d43c8f1c2a..558de0b9895c 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -267,6 +267,9 @@ is_upper_ndev_bond_master_filter(struct ib_device *ib_dev, u8 port,
         struct net_device *cookie_ndev = cookie;
         bool match = false;
 
+        if (!rdma_ndev)
+                return false;
+
         rcu_read_lock();
         if (netif_is_bond_master(cookie_ndev) &&
             rdma_is_upper_dev_rcu(rdma_ndev, cookie_ndev))
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 9b20479dc710..7e6d70936c63 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -12500,7 +12500,8 @@ static int init_cntrs(struct hfi1_devdata *dd)
         }
 
         /* allocate space for the counter values */
-        dd->cntrs = kcalloc(dd->ndevcntrs, sizeof(u64), GFP_KERNEL);
+        dd->cntrs = kcalloc(dd->ndevcntrs + num_driver_cntrs, sizeof(u64),
+                            GFP_KERNEL);
         if (!dd->cntrs)
                 goto bail;
 
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 1401b6ea4a28..2b882347d0c2 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -155,6 +155,8 @@ struct hfi1_ib_stats {
 extern struct hfi1_ib_stats hfi1_stats;
 extern const struct pci_error_handlers hfi1_pci_err_handler;
 
+extern int num_driver_cntrs;
+
 /*
  * First-cut criterion for "device is active" is
  * two thousand dwords combined Tx, Rx traffic per
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index 6f3bc4dab858..1a016248039f 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -340,6 +340,13 @@ int hfi1_setup_wqe(struct rvt_qp *qp, struct rvt_swqe *wqe, bool *call_send)
         default:
                 break;
         }
+
+        /*
+         * System latency between send and schedule is large enough that
+         * forcing call_send to true for piothreshold packets is necessary.
+         */
+        if (wqe->length <= piothreshold)
+                *call_send = true;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 48e11e510358..a365089a9305 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1479,7 +1479,7 @@ static const char * const driver_cntr_names[] = {
 static DEFINE_MUTEX(cntr_names_lock); /* protects the *_cntr_names bufers */
 static const char **dev_cntr_names;
 static const char **port_cntr_names;
-static int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
+int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
 static int num_dev_cntrs;
 static int num_port_cntrs;
 static int cntr_names_initialized;
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 61aab7c0c513..45c421c87100 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1066,7 +1066,9 @@ static int devx_umem_get(struct mlx5_ib_dev *dev, struct ib_ucontext *ucontext,
 
         err = uverbs_get_flags32(&access, attrs,
                                  MLX5_IB_ATTR_DEVX_UMEM_REG_ACCESS,
-                                 IB_ACCESS_SUPPORTED);
+                                 IB_ACCESS_LOCAL_WRITE |
+                                 IB_ACCESS_REMOTE_WRITE |
+                                 IB_ACCESS_REMOTE_READ);
         if (err)
                 return err;
 
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 2cc3d69ab6f6..4dc6cc640ce0 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -506,14 +506,13 @@ void mlx5_ib_free_implicit_mr(struct mlx5_ib_mr *imr)
 static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                         u64 io_virt, size_t bcnt, u32 *bytes_mapped)
 {
+        int npages = 0, current_seq, page_shift, ret, np;
+        bool implicit = false;
         struct ib_umem_odp *odp_mr = to_ib_umem_odp(mr->umem);
         u64 access_mask = ODP_READ_ALLOWED_BIT;
-        int npages = 0, page_shift, np;
         u64 start_idx, page_mask;
         struct ib_umem_odp *odp;
-        int current_seq;
         size_t size;
-        int ret;
 
         if (!odp_mr->page_list) {
                 odp = implicit_mr_get_data(mr, io_virt, bcnt);
@@ -521,7 +520,7 @@ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
                 if (IS_ERR(odp))
                         return PTR_ERR(odp);
                 mr = odp->private;
-
+                implicit = true;
         } else {
                 odp = odp_mr;
         }
@@ -600,7 +599,7 @@ next_mr:
 
 out:
         if (ret == -EAGAIN) {
-                if (mr->parent || !odp->dying) {
+                if (implicit || !odp->dying) {
                         unsigned long timeout =
                                 msecs_to_jiffies(MMU_NOTIFIER_TIMEOUT);
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index d4b9db487b16..cfc8b94527b9 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -480,18 +480,18 @@ static const u8 xboxone_hori_init[] = {
 };
 
 /*
- * This packet is required for some of the PDP pads to start
+ * This packet is required for most (all?) of the PDP pads to start
  * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4).
+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
  */
 static const u8 xboxone_pdp_init1[] = {
         0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
 };
 
 /*
- * This packet is required for some of the PDP pads to start
+ * This packet is required for most (all?) of the PDP pads to start
  * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4).
+ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
  */
 static const u8 xboxone_pdp_init2[] = {
         0x06, 0x20, 0x00, 0x02, 0x01, 0x00
@@ -527,12 +527,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
         XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1),
-        XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2),
+        XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+        XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
         XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 7e75835e220f..850bb259c20e 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -841,7 +841,7 @@ static int atkbd_select_set(struct atkbd *atkbd, int target_set, int allow_extra
         if (param[0] != 3) {
                 param[0] = 2;
                 if (ps2_command(ps2dev, param, ATKBD_CMD_SSCANSET))
-                return 2;
+                        return 2;
         }
 
         ps2_command(ps2dev, param, ATKBD_CMD_SETALL_MBR);
diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index 81be6f781f0b..d56001181598 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -493,7 +493,8 @@ static int cros_ec_keyb_register_bs(struct cros_ec_keyb *ckdev)
         for (i = 0; i < ARRAY_SIZE(cros_ec_keyb_bs); i++) {
                 const struct cros_ec_bs_map *map = &cros_ec_keyb_bs[i];
 
-                if (buttons & BIT(map->bit))
+                if ((map->ev_type == EV_KEY && (buttons & BIT(map->bit))) ||
+                    (map->ev_type == EV_SW && (switches & BIT(map->bit))))
                         input_set_capability(idev, map->ev_type, map->code);
         }
 
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index f51ae09596ef..403452ef00e6 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -407,7 +407,7 @@ matrix_keypad_parse_dt(struct device *dev)
         struct matrix_keypad_platform_data *pdata;
         struct device_node *np = dev->of_node;
         unsigned int *gpios;
-        int i, nrow, ncol;
+        int ret, i, nrow, ncol;
 
         if (!np) {
                 dev_err(dev, "device lacks DT data\n");
@@ -452,12 +452,19 @@ matrix_keypad_parse_dt(struct device *dev)
                 return ERR_PTR(-ENOMEM);
         }
 
-        for (i = 0; i < pdata->num_row_gpios; i++)
-                gpios[i] = of_get_named_gpio(np, "row-gpios", i);
+        for (i = 0; i < nrow; i++) {
+                ret = of_get_named_gpio(np, "row-gpios", i);
+                if (ret < 0)
+                        return ERR_PTR(ret);
+                gpios[i] = ret;
+        }
 
-        for (i = 0; i < pdata->num_col_gpios; i++)
-                gpios[pdata->num_row_gpios + i] =
-                        of_get_named_gpio(np, "col-gpios", i);
+        for (i = 0; i < ncol; i++) {
+                ret = of_get_named_gpio(np, "col-gpios", i);
+                if (ret < 0)
+                        return ERR_PTR(ret);
+                gpios[nrow + i] = ret;
+        }
 
         pdata->row_gpios = gpios;
         pdata->col_gpios = &gpios[pdata->num_row_gpios];
@@ -484,10 +491,8 @@ static int matrix_keypad_probe(struct platform_device *pdev)
         pdata = dev_get_platdata(&pdev->dev);
         if (!pdata) {
                 pdata = matrix_keypad_parse_dt(&pdev->dev);
-                if (IS_ERR(pdata)) {
-                        dev_err(&pdev->dev, "no platform data defined\n");
+                if (IS_ERR(pdata))
                         return PTR_ERR(pdata);
-                }
         } else if (!pdata->keymap_data) {
                 dev_err(&pdev->dev, "no keymap data defined\n");
                 return -EINVAL;
diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 46406345742b..a7dc286f406c 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -60,8 +60,18 @@
 
 /* OMAP4 values */
 #define OMAP4_VAL_IRQDISABLE            0x0
-#define OMAP4_VAL_DEBOUNCINGTIME        0x7
-#define OMAP4_VAL_PVT                   0x7
+
+/*
+ * Errata i689: If a key is released for a time shorter than debounce time,
+ * the keyboard will idle and never detect the key release. The workaround
+ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
+ * "26.4.6.2 Keyboard Controller Timer" for more information.
+ */
+#define OMAP4_KEYPAD_PTV_DIV_128        0x6
+#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv)     \
+        ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
+#define OMAP4_VAL_DEBOUNCINGTIME_16MS                                   \
+        OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
 
 enum {
         KBD_REVISION_OMAP4 = 0,
@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
 
         kbd_writel(keypad_data, OMAP4_KBD_CTRL,
                         OMAP4_DEF_CTRL_NOSOFTMODE |
-                        (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
+                        (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
         kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
-                        OMAP4_VAL_DEBOUNCINGTIME);
+                        OMAP4_VAL_DEBOUNCINGTIME_16MS);
         /* clear pending interrupts */
         kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
                          kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index b0f9d19b3410..a94b6494e71a 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1348,6 +1348,9 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0618", 0 },
         { "ELAN061C", 0 },
         { "ELAN061D", 0 },
+        { "ELAN061E", 0 },
+        { "ELAN0620", 0 },
+        { "ELAN0621", 0 },
         { "ELAN0622", 0 },
         { "ELAN1000", 0 },
         { }
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 5e85f3cca867..2bd5bb11c8ba 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -170,6 +170,7 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0048", /* X1 Carbon 3 */
         "LEN0046", /* X250 */
         "LEN004a", /* W541 */
+        "LEN005b", /* P50 */
         "LEN0071", /* T480 */
         "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
         "LEN0073", /* X1 Carbon G5 (Elantech) */
@@ -177,6 +178,7 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0096", /* X280 */
         "LEN0097", /* X280 -> ALPS trackpoint */
         "LEN200f", /* T450s */
+        "SYN3221", /* HP 15-ay000 */
         NULL
 };
 
diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
index 47a0e81a2989..a8b9be3e28db 100644
--- a/drivers/input/serio/hyperv-keyboard.c
+++ b/drivers/input/serio/hyperv-keyboard.c
@@ -177,7 +177,7 @@ static void hv_kbd_on_receive(struct hv_device *hv_dev,
                  * state because the Enter-UP can trigger a wakeup at once.
                  */
                 if (!(info & IS_BREAK))
-                        pm_wakeup_event(&hv_dev->device, 0);
+                        pm_wakeup_hard_event(&hv_dev->device);
 
                 break;
 
diff --git a/drivers/input/touchscreen/migor_ts.c b/drivers/input/touchscreen/migor_ts.c
index 02fb11985819..42d3fd7e04d7 100644
--- a/drivers/input/touchscreen/migor_ts.c
+++ b/drivers/input/touchscreen/migor_ts.c
@@ -1,23 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Touch Screen driver for Renesas MIGO-R Platform
  *
  * Copyright (c) 2008 Magnus Damm
  * Copyright (c) 2007 Ujjwal Pande <ujjwal@kenati.com>,
  *  Kenati Technologies Pvt Ltd.
- *
- * This file is free software; you can redistribute it and/or
- * modify it under the terms of the GNU  General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- * You should have received a copy of the GNU General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
index b71673911aac..11ff32c68025 100644
--- a/drivers/input/touchscreen/st1232.c
+++ b/drivers/input/touchscreen/st1232.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * ST1232 Touchscreen Controller Driver
  *
@@ -7,15 +8,6 @@
  * Using code from:
  *  - android.git.kernel.org: projects/kernel/common.git: synaptics_i2c_rmi.c
  *      Copyright (C) 2007 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/delay.h>
@@ -295,4 +287,4 @@ module_i2c_driver(st1232_ts_driver);
 
 MODULE_AUTHOR("Tony SIM <chinyeow.sim.xt@renesas.com>");
 MODULE_DESCRIPTION("SITRONIX ST1232 Touchscreen Controller Driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 5936de71883f..6fc93834da44 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -930,6 +930,10 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
         bool dirty_flag;
         *result = true;
 
+        if (from_cblock(cmd->cache_blocks) == 0)
+                /* Nothing to do */
+                return 0;
+
         r = dm_bitset_cursor_begin(&cmd->dirty_info, cmd->dirty_root,
                                    from_cblock(cmd->cache_blocks), &cmd->dirty_cursor);
         if (r) {
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 0bd8d498b3b9..dadd9696340c 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -195,7 +195,7 @@ static void throttle_unlock(struct throttle *t)
 struct dm_thin_new_mapping;
 
 /*
- * The pool runs in 4 modes.  Ordered in degraded order for comparisons.
+ * The pool runs in various modes.  Ordered in degraded order for comparisons.
  */
 enum pool_mode {
         PM_WRITE,               /* metadata may be changed */
@@ -282,9 +282,38 @@ struct pool {
         mempool_t mapping_pool;
 };
 
-static enum pool_mode get_pool_mode(struct pool *pool);
 static void metadata_operation_failed(struct pool *pool, const char *op, int r);
 
+static enum pool_mode get_pool_mode(struct pool *pool)
+{
+        return pool->pf.mode;
+}
+
+static void notify_of_pool_mode_change(struct pool *pool)
+{
+        const char *descs[] = {
+                "write",
+                "out-of-data-space",
+                "read-only",
+                "read-only",
+                "fail"
+        };
+        const char *extra_desc = NULL;
+        enum pool_mode mode = get_pool_mode(pool);
+
+        if (mode == PM_OUT_OF_DATA_SPACE) {
+                if (!pool->pf.error_if_no_space)
+                        extra_desc = " (queue IO)";
+                else
+                        extra_desc = " (error IO)";
+        }
+
+        dm_table_event(pool->ti->table);
+        DMINFO("%s: switching pool to %s%s mode",
+               dm_device_name(pool->pool_md),
+               descs[(int)mode], extra_desc ? : "");
+}
+
 /*
  * Target context for a pool.
  */
@@ -2351,8 +2380,6 @@ static void do_waker(struct work_struct *ws)
         queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
 }
 
-static void notify_of_pool_mode_change_to_oods(struct pool *pool);
-
 /*
  * We're holding onto IO to allow userland time to react.  After the
  * timeout either the pool will have been resized (and thus back in
@@ -2365,7 +2392,7 @@ static void do_no_space_timeout(struct work_struct *ws)
 
         if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space) {
                 pool->pf.error_if_no_space = true;
-                notify_of_pool_mode_change_to_oods(pool);
+                notify_of_pool_mode_change(pool);
                 error_retry_list_with_code(pool, BLK_STS_NOSPC);
         }
 }
@@ -2433,26 +2460,6 @@ static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
 
 /*----------------------------------------------------------------*/
 
-static enum pool_mode get_pool_mode(struct pool *pool)
-{
-        return pool->pf.mode;
-}
-
-static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
-{
-        dm_table_event(pool->ti->table);
-        DMINFO("%s: switching pool to %s mode",
-               dm_device_name(pool->pool_md), new_mode);
-}
-
-static void notify_of_pool_mode_change_to_oods(struct pool *pool)
-{
-        if (!pool->pf.error_if_no_space)
-                notify_of_pool_mode_change(pool, "out-of-data-space (queue IO)");
-        else
-                notify_of_pool_mode_change(pool, "out-of-data-space (error IO)");
-}
-
 static bool passdown_enabled(struct pool_c *pt)
 {
         return pt->adjusted_pf.discard_passdown;
@@ -2501,8 +2508,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 
         switch (new_mode) {
         case PM_FAIL:
-                if (old_mode != new_mode)
-                        notify_of_pool_mode_change(pool, "failure");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_fail;
                 pool->process_discard = process_bio_fail;
@@ -2516,8 +2521,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
 
         case PM_OUT_OF_METADATA_SPACE:
         case PM_READ_ONLY:
-                if (!is_read_only_pool_mode(old_mode))
-                        notify_of_pool_mode_change(pool, "read-only");
                 dm_pool_metadata_read_only(pool->pmd);
                 pool->process_bio = process_bio_read_only;
                 pool->process_discard = process_bio_success;
@@ -2538,8 +2541,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                  * alarming rate.  Adjust your low water mark if you're
                  * frequently seeing this mode.
                  */
-                if (old_mode != new_mode)
-                        notify_of_pool_mode_change_to_oods(pool);
                 pool->out_of_data_space = true;
                 pool->process_bio = process_bio_read_only;
                 pool->process_discard = process_discard_bio;
@@ -2552,8 +2553,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                 break;
 
         case PM_WRITE:
-                if (old_mode != new_mode)
-                        notify_of_pool_mode_change(pool, "write");
                 if (old_mode == PM_OUT_OF_DATA_SPACE)
                         cancel_delayed_work_sync(&pool->no_space_timeout);
                 pool->out_of_data_space = false;
@@ -2573,6 +2572,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
          * doesn't cause an unexpected mode transition on resume.
          */
         pt->adjusted_pf.mode = new_mode;
+
+        if (old_mode != new_mode)
+                notify_of_pool_mode_change(pool);
 }
 
 static void abort_transaction(struct pool *pool)
@@ -4023,7 +4025,7 @@ static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 20, 0},
+        .version = {1, 21, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -4397,7 +4399,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 20, 0},
+        .version = {1, 21, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
index 981154e59461..6af5babe6837 100644
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -20,7 +20,6 @@ struct dmz_bioctx {
         struct dm_zone          *zone;
         struct bio              *bio;
         refcount_t              ref;
-        blk_status_t            status;
 };
 
 /*
@@ -78,65 +77,66 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status)
 {
         struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
 
-        if (bioctx->status == BLK_STS_OK && status != BLK_STS_OK)
-                bioctx->status = status;
-        bio_endio(bio);
+        if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK)
+                bio->bi_status = status;
+
+        if (refcount_dec_and_test(&bioctx->ref)) {
+                struct dm_zone *zone = bioctx->zone;
+
+                if (zone) {
+                        if (bio->bi_status != BLK_STS_OK &&
+                            bio_op(bio) == REQ_OP_WRITE &&
+                            dmz_is_seq(zone))
+                                set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
+                        dmz_deactivate_zone(zone);
+                }
+                bio_endio(bio);
+        }
 }
 
 /*
- * Partial clone read BIO completion callback. This terminates the
+ * Completion callback for an internally cloned target BIO. This terminates the
  * target BIO when there are no more references to its context.
  */
-static void dmz_read_bio_end_io(struct bio *bio)
+static void dmz_clone_endio(struct bio *clone)
 {
-        struct dmz_bioctx *bioctx = bio->bi_private;
-        blk_status_t status = bio->bi_status;
+        struct dmz_bioctx *bioctx = clone->bi_private;
+        blk_status_t status = clone->bi_status;
 
-        bio_put(bio);
+        bio_put(clone);
         dmz_bio_endio(bioctx->bio, status);
 }
 
 /*
- * Issue a BIO to a zone. The BIO may only partially process the
+ * Issue a clone of a target BIO. The clone may only partially process the
  * original target BIO.
  */
-static int dmz_submit_read_bio(struct dmz_target *dmz, struct dm_zone *zone,
-                               struct bio *bio, sector_t chunk_block,
-                               unsigned int nr_blocks)
+static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
+                          struct bio *bio, sector_t chunk_block,
+                          unsigned int nr_blocks)
 {
         struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
-        sector_t sector;
         struct bio *clone;
 
-        /* BIO remap sector */
-        sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
-
-        /* If the read is not partial, there is no need to clone the BIO */
-        if (nr_blocks == dmz_bio_blocks(bio)) {
-                /* Setup and submit the BIO */
-                bio->bi_iter.bi_sector = sector;
-                refcount_inc(&bioctx->ref);
-                generic_make_request(bio);
-                return 0;
-        }
-
-        /* Partial BIO: we need to clone the BIO */
         clone = bio_clone_fast(bio, GFP_NOIO, &dmz->bio_set);
         if (!clone)
                 return -ENOMEM;
 
-        /* Setup the clone */
-        clone->bi_iter.bi_sector = sector;
+        bio_set_dev(clone, dmz->dev->bdev);
+        clone->bi_iter.bi_sector =
+                dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
         clone->bi_iter.bi_size = dmz_blk2sect(nr_blocks) << SECTOR_SHIFT;
-        clone->bi_end_io = dmz_read_bio_end_io;
+        clone->bi_end_io = dmz_clone_endio;
         clone->bi_private = bioctx;
 
         bio_advance(bio, clone->bi_iter.bi_size);
 
-        /* Submit the clone */
         refcount_inc(&bioctx->ref);
         generic_make_request(clone);
 
+        if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
+                zone->wp_block += nr_blocks;
+
         return 0;
 }
 
@@ -214,7 +214,7 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
                 if (nr_blocks) {
                         /* Valid blocks found: read them */
                         nr_blocks = min_t(unsigned int, nr_blocks, end_block - chunk_block);
-                        ret = dmz_submit_read_bio(dmz, rzone, bio, chunk_block, nr_blocks);
+                        ret = dmz_submit_bio(dmz, rzone, bio, chunk_block, nr_blocks);
                         if (ret)
                                 return ret;
                         chunk_block += nr_blocks;
@@ -229,25 +229,6 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
 }
 
 /*
- * Issue a write BIO to a zone.
- */
-static void dmz_submit_write_bio(struct dmz_target *dmz, struct dm_zone *zone,
-                                 struct bio *bio, sector_t chunk_block,
-                                 unsigned int nr_blocks)
-{
-        struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
-
-        /* Setup and submit the BIO */
-        bio_set_dev(bio, dmz->dev->bdev);
-        bio->bi_iter.bi_sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
-        refcount_inc(&bioctx->ref);
-        generic_make_request(bio);
-
-        if (dmz_is_seq(zone))
-                zone->wp_block += nr_blocks;
-}
-
-/*
  * Write blocks directly in a data zone, at the write pointer.
  * If a buffer zone is assigned, invalidate the blocks written
  * in place.
@@ -265,7 +246,9 @@ static int dmz_handle_direct_write(struct dmz_target *dmz,
                 return -EROFS;
 
         /* Submit write */
-        dmz_submit_write_bio(dmz, zone, bio, chunk_block, nr_blocks);
+        ret = dmz_submit_bio(dmz, zone, bio, chunk_block, nr_blocks);
+        if (ret)
+                return ret;
 
         /*
          * Validate the blocks in the data zone and invalidate
@@ -301,7 +284,9 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
                 return -EROFS;
 
         /* Submit write */
-        dmz_submit_write_bio(dmz, bzone, bio, chunk_block, nr_blocks);
+        ret = dmz_submit_bio(dmz, bzone, bio, chunk_block, nr_blocks);
+        if (ret)
+                return ret;
 
         /*
          * Validate the blocks in the buffer zone
@@ -600,7 +585,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
         bioctx->zone = NULL;
         bioctx->bio = bio;
         refcount_set(&bioctx->ref, 1);
-        bioctx->status = BLK_STS_OK;
 
         /* Set the BIO pending in the flush list */
         if (!nr_sectors && bio_op(bio) == REQ_OP_WRITE) {
@@ -624,35 +608,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
 }
 
 /*
- * Completed target BIO processing.
- */
-static int dmz_end_io(struct dm_target *ti, struct bio *bio, blk_status_t *error)
-{
-        struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
-
-        if (bioctx->status == BLK_STS_OK && *error)
-                bioctx->status = *error;
-
-        if (!refcount_dec_and_test(&bioctx->ref))
-                return DM_ENDIO_INCOMPLETE;
-
-        /* Done */
-        bio->bi_status = bioctx->status;
-
-        if (bioctx->zone) {
-                struct dm_zone *zone = bioctx->zone;
-
-                if (*error && bio_op(bio) == REQ_OP_WRITE) {
-                        if (dmz_is_seq(zone))
-                                set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
-                }
-                dmz_deactivate_zone(zone);
-        }
-
-        return DM_ENDIO_DONE;
-}
-
-/*
  * Get zoned device information.
  */
 static int dmz_get_zoned_device(struct dm_target *ti, char *path)
@@ -946,7 +901,6 @@ static struct target_type dmz_type = {
         .ctr             = dmz_ctr,
         .dtr             = dmz_dtr,
         .map             = dmz_map,
-        .end_io          = dmz_end_io,
         .io_hints        = dmz_io_hints,
         .prepare_ioctl   = dmz_prepare_ioctl,
         .postsuspend     = dmz_suspend,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index c510179a7f84..63a7c416b224 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1593,6 +1593,8 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                 return ret;
         }
 
+        blk_queue_split(md->queue, &bio);
+
         init_clone_info(&ci, md, map, bio);
 
         if (bio->bi_opf & REQ_PREFLUSH) {
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 8add62a18293..102eb35fcf3f 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -110,6 +110,19 @@ config MEDIA_CONTROLLER_DVB
 
           This is currently experimental.
 
+config MEDIA_CONTROLLER_REQUEST_API
+        bool "Enable Media controller Request API (EXPERIMENTAL)"
+        depends on MEDIA_CONTROLLER && STAGING_MEDIA
+        default n
+        ---help---
+          DO NOT ENABLE THIS OPTION UNLESS YOU KNOW WHAT YOU'RE DOING.
+
+          This option enables the Request API for the Media controller and V4L2
+          interfaces. It is currently needed by a few stateless codec drivers.
+
+          There is currently no intention to provide API or ABI stability for
+          this new API as of yet.
+
 #
 # Video4Linux support
 #       Only enables if one of the V4L2 types (ATV, webcam, radio) is selected
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 975ff5669f72..8ff8722cb6b1 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -947,7 +947,7 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
         }
         atomic_dec(&q->owned_by_drv_count);
 
-        if (vb->req_obj.req) {
+        if (state != VB2_BUF_STATE_QUEUED && vb->req_obj.req) {
                 /* This is not supported at the moment */
                 WARN_ON(state == VB2_BUF_STATE_REQUEUEING);
                 media_request_object_unbind(&vb->req_obj);
@@ -1359,8 +1359,12 @@ static void vb2_req_release(struct media_request_object *obj)
 {
         struct vb2_buffer *vb = container_of(obj, struct vb2_buffer, req_obj);
 
-        if (vb->state == VB2_BUF_STATE_IN_REQUEST)
+        if (vb->state == VB2_BUF_STATE_IN_REQUEST) {
                 vb->state = VB2_BUF_STATE_DEQUEUED;
+                if (vb->request)
+                        media_request_put(vb->request);
+                vb->request = NULL;
+        }
 }
 
 static const struct media_request_object_ops vb2_core_req_ops = {
@@ -1528,6 +1532,18 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb,
                         return ret;
 
                 vb->state = VB2_BUF_STATE_IN_REQUEST;
+
+                /*
+                 * Increment the refcount and store the request.
+                 * The request refcount is decremented again when the
+                 * buffer is dequeued. This is to prevent vb2_buffer_done()
+                 * from freeing the request from interrupt context, which can
+                 * happen if the application closed the request fd after
+                 * queueing the request.
+                 */
+                media_request_get(req);
+                vb->request = req;
+
                 /* Fill buffer information for the userspace */
                 if (pb) {
                         call_void_bufop(q, copy_timestamp, vb, pb);
@@ -1749,10 +1765,6 @@ static void __vb2_dqbuf(struct vb2_buffer *vb)
                         call_void_memop(vb, unmap_dmabuf, vb->planes[i].mem_priv);
                         vb->planes[i].dbuf_mapped = 0;
                 }
-        if (vb->req_obj.req) {
-                media_request_object_unbind(&vb->req_obj);
-                media_request_object_put(&vb->req_obj);
-        }
         call_void_bufop(q, init_buffer, vb);
 }
 
@@ -1797,6 +1809,14 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb,
         /* go back to dequeued state */
         __vb2_dqbuf(vb);
 
+        if (WARN_ON(vb->req_obj.req)) {
+                media_request_object_unbind(&vb->req_obj);
+                media_request_object_put(&vb->req_obj);
+        }
+        if (vb->request)
+                media_request_put(vb->request);
+        vb->request = NULL;
+
         dprintk(2, "dqbuf of buffer %d, with state %d\n",
                         vb->index, vb->state);
 
@@ -1903,6 +1923,14 @@ static void __vb2_queue_cancel(struct vb2_queue *q)
                         vb->prepared = false;
                 }
                 __vb2_dqbuf(vb);
+
+                if (vb->req_obj.req) {
+                        media_request_object_unbind(&vb->req_obj);
+                        media_request_object_put(&vb->req_obj);
+                }
+                if (vb->request)
+                        media_request_put(vb->request);
+                vb->request = NULL;
         }
 }
 
@@ -1940,10 +1968,8 @@ int vb2_core_streamon(struct vb2_queue *q, unsigned int type)
                 if (ret)
                         return ret;
                 ret = vb2_start_streaming(q);
-                if (ret) {
-                        __vb2_queue_cancel(q);
+                if (ret)
                         return ret;
-                }
         }
 
         q->streaming = 1;
diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
index a17033ab2c22..1d35aeabfd85 100644
--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
+++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
@@ -333,10 +333,10 @@ static int vb2_fill_vb2_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b
 }
 
 static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
-                                    struct v4l2_buffer *b,
-                                    const char *opname,
+                                    struct v4l2_buffer *b, bool is_prepare,
                                     struct media_request **p_req)
 {
+        const char *opname = is_prepare ? "prepare_buf" : "qbuf";
         struct media_request *req;
         struct vb2_v4l2_buffer *vbuf;
         struct vb2_buffer *vb;
@@ -378,6 +378,9 @@ static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct media_device *md
                         return ret;
         }
 
+        if (is_prepare)
+                return 0;
+
         if (!(b->flags & V4L2_BUF_FLAG_REQUEST_FD)) {
                 if (q->uses_requests) {
                         dprintk(1, "%s: queue uses requests\n", opname);
@@ -631,8 +634,10 @@ static void fill_buf_caps(struct vb2_queue *q, u32 *caps)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_USERPTR;
         if (q->io_modes & VB2_DMABUF)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_DMABUF;
+#ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
         if (q->supports_requests)
                 *caps |= V4L2_BUF_CAP_SUPPORTS_REQUESTS;
+#endif
 }
 
 int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
@@ -657,7 +662,7 @@ int vb2_prepare_buf(struct vb2_queue *q, struct media_device *mdev,
         if (b->flags & V4L2_BUF_FLAG_REQUEST_FD)
                 return -EINVAL;
 
-        ret = vb2_queue_or_prepare_buf(q, mdev, b, "prepare_buf", NULL);
+        ret = vb2_queue_or_prepare_buf(q, mdev, b, true, NULL);
 
         return ret ? ret : vb2_core_prepare_buf(q, b->index, b);
 }
@@ -729,7 +734,7 @@ int vb2_qbuf(struct vb2_queue *q, struct media_device *mdev,
                 return -EBUSY;
         }
 
-        ret = vb2_queue_or_prepare_buf(q, mdev, b, "qbuf", &req);
+        ret = vb2_queue_or_prepare_buf(q, mdev, b, false, &req);
         if (ret)
                 return ret;
         ret = vb2_core_qbuf(q, b->index, b, req);
diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
index 6d4b2eec67b4..29836c1a40e9 100644
--- a/drivers/media/dvb-frontends/dvb-pll.c
+++ b/drivers/media/dvb-frontends/dvb-pll.c
@@ -80,8 +80,8 @@ struct dvb_pll_desc {
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt7579 = {
         .name  = "Thomson dtt7579",
-        .min   = 177000000,
-        .max   = 858000000,
+        .min   = 177 * MHz,
+        .max   = 858 * MHz,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0xb4, 0x03 },
         .count = 4,
@@ -102,8 +102,8 @@ static void thomson_dtt759x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt759x = {
         .name  = "Thomson dtt759x",
-        .min   = 177000000,
-        .max   = 896000000,
+        .min   = 177 * MHz,
+        .max   = 896 * MHz,
         .set   = thomson_dtt759x_bw,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0x84, 0x03 },
@@ -126,8 +126,8 @@ static void thomson_dtt7520x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
         .name  = "Thomson dtt7520x",
-        .min   = 185000000,
-        .max   = 900000000,
+        .min   = 185 * MHz,
+        .max   = 900 * MHz,
         .set   = thomson_dtt7520x_bw,
         .iffreq = 36166667,
         .count = 7,
@@ -144,8 +144,8 @@ static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
 
 static const struct dvb_pll_desc dvb_pll_lg_z201 = {
         .name  = "LG z201",
-        .min   = 174000000,
-        .max   = 862000000,
+        .min   = 174 * MHz,
+        .max   = 862 * MHz,
         .iffreq= 36166667,
         .sleepdata = (u8[]){ 2, 0xbc, 0x03 },
         .count = 5,
@@ -160,8 +160,8 @@ static const struct dvb_pll_desc dvb_pll_lg_z201 = {
 
 static const struct dvb_pll_desc dvb_pll_unknown_1 = {
         .name  = "unknown 1", /* used by dntv live dvb-t */
-        .min   = 174000000,
-        .max   = 862000000,
+        .min   = 174 * MHz,
+        .max   = 862 * MHz,
         .iffreq= 36166667,
         .count = 9,
         .entries = {
@@ -182,8 +182,8 @@ static const struct dvb_pll_desc dvb_pll_unknown_1 = {
  */
 static const struct dvb_pll_desc dvb_pll_tua6010xs = {
         .name  = "Infineon TUA6010XS",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36125000,
         .count = 3,
         .entries = {
@@ -196,8 +196,8 @@ static const struct dvb_pll_desc dvb_pll_tua6010xs = {
 /* Panasonic env57h1xd5 (some Philips PLL ?) */
 static const struct dvb_pll_desc dvb_pll_env57h1xd5 = {
         .name  = "Panasonic ENV57H1XD5",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36125000,
         .count = 4,
         .entries = {
@@ -220,8 +220,8 @@ static void tda665x_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tda665x = {
         .name  = "Philips TDA6650/TDA6651",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .set   = tda665x_bw,
         .iffreq= 36166667,
         .initdata = (u8[]){ 4, 0x0b, 0xf5, 0x85, 0xab },
@@ -254,8 +254,8 @@ static void tua6034_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tua6034 = {
         .name  = "Infineon TUA6034",
-        .min   =  44250000,
-        .max   = 858000000,
+        .min   = 44250 * kHz,
+        .max   = 858 * MHz,
         .iffreq= 36166667,
         .count = 3,
         .set   = tua6034_bw,
@@ -278,8 +278,8 @@ static void tded4_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_tded4 = {
         .name = "ALPS TDED4",
-        .min = 47000000,
-        .max = 863000000,
+        .min =  47 * MHz,
+        .max = 863 * MHz,
         .iffreq= 36166667,
         .set   = tded4_bw,
         .count = 4,
@@ -296,8 +296,8 @@ static const struct dvb_pll_desc dvb_pll_tded4 = {
  */
 static const struct dvb_pll_desc dvb_pll_tdhu2 = {
         .name = "ALPS TDHU2",
-        .min = 54000000,
-        .max = 864000000,
+        .min =  54 * MHz,
+        .max = 864 * MHz,
         .iffreq= 44000000,
         .count = 4,
         .entries = {
@@ -313,8 +313,8 @@ static const struct dvb_pll_desc dvb_pll_tdhu2 = {
  */
 static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
         .name = "Samsung TBMV30111IN / TBMV30712IN1",
-        .min = 54000000,
-        .max = 860000000,
+        .min =  54 * MHz,
+        .max = 860 * MHz,
         .iffreq= 44000000,
         .count = 6,
         .entries = {
@@ -332,8 +332,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
  */
 static const struct dvb_pll_desc dvb_pll_philips_sd1878_tda8261 = {
         .name  = "Philips SD1878",
-        .min   =  950000,
-        .max   = 2150000,
+        .min   =  950 * MHz,
+        .max   = 2150 * MHz,
         .iffreq= 249, /* zero-IF, offset 249 is to round up */
         .count = 4,
         .entries = {
@@ -398,8 +398,8 @@ static void opera1_bw(struct dvb_frontend *fe, u8 *buf)
 
 static const struct dvb_pll_desc dvb_pll_opera1 = {
         .name  = "Opera Tuner",
-        .min   =  900000,
-        .max   = 2250000,
+        .min   =  900 * MHz,
+        .max   = 2250 * MHz,
         .initdata = (u8[]){ 4, 0x08, 0xe5, 0xe1, 0x00 },
         .initdata2 = (u8[]){ 4, 0x08, 0xe5, 0xe5, 0x00 },
         .iffreq= 0,
@@ -445,8 +445,8 @@ static void samsung_dtos403ih102a_set(struct dvb_frontend *fe, u8 *buf)
 /* unknown pll used in Samsung DTOS403IH102A DVB-C tuner */
 static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
         .name   = "Samsung DTOS403IH102A",
-        .min    =  44250000,
-        .max    = 858000000,
+        .min    = 44250 * kHz,
+        .max    = 858 * MHz,
         .iffreq =  36125000,
         .count  = 8,
         .set    = samsung_dtos403ih102a_set,
@@ -465,8 +465,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
 /* Samsung TDTC9251DH0 DVB-T NIM, as used on AirStar 2 */
 static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
         .name   = "Samsung TDTC9251DH0",
-        .min    =  48000000,
-        .max    = 863000000,
+        .min    =  48 * MHz,
+        .max    = 863 * MHz,
         .iffreq =  36166667,
         .count  = 3,
         .entries = {
@@ -479,8 +479,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
 /* Samsung TBDU18132 DVB-S NIM with TSA5059 PLL, used in SkyStar2 DVB-S 2.3 */
 static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
         .name = "Samsung TBDU18132",
-        .min    =  950000,
-        .max    = 2150000, /* guesses */
+        .min    =  950 * MHz,
+        .max    = 2150 * MHz, /* guesses */
         .iffreq = 0,
         .count = 2,
         .entries = {
@@ -500,8 +500,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
 /* Samsung TBMU24112 DVB-S NIM with SL1935 zero-IF tuner */
 static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
         .name = "Samsung TBMU24112",
-        .min    =  950000,
-        .max    = 2150000, /* guesses */
+        .min    =  950 * MHz,
+        .max    = 2150 * MHz, /* guesses */
         .iffreq = 0,
         .count = 2,
         .entries = {
@@ -521,8 +521,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
  * 822 - 862   1  *  0   0   1   0   0   0   0x88 */
 static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
         .name = "ALPS TDEE4",
-        .min    =  47000000,
-        .max    = 862000000,
+        .min    =  47 * MHz,
+        .max    = 862 * MHz,
         .iffreq =  36125000,
         .count = 4,
         .entries = {
@@ -537,8 +537,8 @@ static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
 /* CP cur. 50uA, AGC takeover: 103dBuV, PORT3 on */
 static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
         .name   = "Infineon TUA6034 ISDB-T (Friio)",
-        .min    =  90000000,
-        .max    = 770000000,
+        .min    =  90 * MHz,
+        .max    = 770 * MHz,
         .iffreq =  57000000,
         .initdata = (u8[]){ 4, 0x9a, 0x50, 0xb2, 0x08 },
         .sleepdata = (u8[]){ 4, 0x9a, 0x70, 0xb3, 0x0b },
@@ -553,8 +553,8 @@ static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
 /* Philips TDA6651 ISDB-T, used in Earthsoft PT1 */
 static const struct dvb_pll_desc dvb_pll_tda665x_earth_pt1 = {
         .name   = "Philips TDA6651 ISDB-T (EarthSoft PT1)",
-        .min    =  90000000,
-        .max    = 770000000,
+        .min    =  90 * MHz,
+        .max    = 770 * MHz,
         .iffreq =  57000000,
         .initdata = (u8[]){ 5, 0x0e, 0x7f, 0xc1, 0x80, 0x80 },
         .count = 10,
@@ -610,9 +610,6 @@ static int dvb_pll_configure(struct dvb_frontend *fe, u8 *buf,
         u32 div;
         int i;
 
-        if (frequency && (frequency < desc->min || frequency > desc->max))
-                return -EINVAL;
-
         for (i = 0; i < desc->count; i++) {
                 if (frequency > desc->entries[i].limit)
                         continue;
@@ -799,7 +796,6 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
         struct dvb_pll_priv *priv = NULL;
         int ret;
         const struct dvb_pll_desc *desc;
-        struct dtv_frontend_properties *c = &fe->dtv_property_cache;
 
         b1 = kmalloc(1, GFP_KERNEL);
         if (!b1)
@@ -845,18 +841,12 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
 
         strncpy(fe->ops.tuner_ops.info.name, desc->name,
                 sizeof(fe->ops.tuner_ops.info.name));
-        switch (c->delivery_system) {
-        case SYS_DVBS:
-        case SYS_DVBS2:
-        case SYS_TURBO:
-        case SYS_ISDBS:
-                fe->ops.tuner_ops.info.frequency_min_hz = desc->min * kHz;
-                fe->ops.tuner_ops.info.frequency_max_hz = desc->max * kHz;
-                break;
-        default:
-                fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
-                fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
-        }
+
+        fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
+        fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
+
+        dprintk("%s tuner, frequency range: %u...%u\n",
+                desc->name, desc->min, desc->max);
 
         if (!desc->initdata)
                 fe->ops.tuner_ops.init = NULL;
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index bed24372e61f..b8ec88612df7 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -381,10 +381,14 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 static long media_device_request_alloc(struct media_device *mdev,
                                        int *alloc_fd)
 {
+#ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
         if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
                 return -ENOTTY;
 
         return media_request_alloc(mdev, alloc_fd);
+#else
+        return -ENOTTY;
+#endif
 }
 
 static long copy_arg_from_user(void *karg, void __user *uarg, unsigned int cmd)
diff --git a/drivers/media/media-request.c b/drivers/media/media-request.c
index 4e9db1fed697..c71a34ae6383 100644
--- a/drivers/media/media-request.c
+++ b/drivers/media/media-request.c
@@ -238,6 +238,9 @@ static const struct file_operations request_fops = {
         .owner = THIS_MODULE,
         .poll = media_request_poll,
         .unlocked_ioctl = media_request_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = media_request_ioctl,
+#endif /* CONFIG_COMPAT */
         .release = media_request_close,
 };
 
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index b292cff26c86..13fb69c58967 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -304,7 +304,8 @@ restart:
                 for (; p < p_out + sz; p++) {
                         u32 copy;
 
-                        p = memchr(p, magic[ctx->comp_magic_cnt], sz);
+                        p = memchr(p, magic[ctx->comp_magic_cnt],
+                                   p_out + sz - p);
                         if (!p) {
                                 ctx->comp_magic_cnt = 0;
                                 break;
@@ -996,11 +997,18 @@ static int vicodec_start_streaming(struct vb2_queue *q,
 
         q_data->sequence = 0;
 
-        if (!V4L2_TYPE_IS_OUTPUT(q->type))
+        if (!V4L2_TYPE_IS_OUTPUT(q->type)) {
+                if (!ctx->is_enc) {
+                        state->width = q_data->width;
+                        state->height = q_data->height;
+                }
                 return 0;
+        }
 
-        state->width = q_data->width;
-        state->height = q_data->height;
+        if (ctx->is_enc) {
+                state->width = q_data->width;
+                state->height = q_data->height;
+        }
         state->ref_frame.width = state->ref_frame.height = 0;
         state->ref_frame.luma = kvmalloc(size + 2 * size / chroma_div,
                                          GFP_KERNEL);
diff --git a/drivers/media/platform/vivid/vivid-sdr-cap.c b/drivers/media/platform/vivid/vivid-sdr-cap.c
index dcdc80e272c2..9acc709b0740 100644
--- a/drivers/media/platform/vivid/vivid-sdr-cap.c
+++ b/drivers/media/platform/vivid/vivid-sdr-cap.c
@@ -276,8 +276,6 @@ static int sdr_cap_start_streaming(struct vb2_queue *vq, unsigned count)
 
                 list_for_each_entry_safe(buf, tmp, &dev->sdr_cap_active, list) {
                         list_del(&buf->list);
-                        v4l2_ctrl_request_complete(buf->vb.vb2_buf.req_obj.req,
-                                                   &dev->ctrl_hdl_sdr_cap);
                         vb2_buffer_done(&buf->vb.vb2_buf,
                                         VB2_BUF_STATE_QUEUED);
                 }
diff --git a/drivers/media/platform/vivid/vivid-vbi-cap.c b/drivers/media/platform/vivid/vivid-vbi-cap.c
index 903cebeb5ce5..d666271bdaed 100644
--- a/drivers/media/platform/vivid/vivid-vbi-cap.c
+++ b/drivers/media/platform/vivid/vivid-vbi-cap.c
@@ -204,8 +204,6 @@ static int vbi_cap_start_streaming(struct vb2_queue *vq, unsigned count)
 
                 list_for_each_entry_safe(buf, tmp, &dev->vbi_cap_active, list) {
                         list_del(&buf->list);
-                        v4l2_ctrl_request_complete(buf->vb.vb2_buf.req_obj.req,
-                                                   &dev->ctrl_hdl_vbi_cap);
                         vb2_buffer_done(&buf->vb.vb2_buf,
                                         VB2_BUF_STATE_QUEUED);
                 }
diff --git a/drivers/media/platform/vivid/vivid-vbi-out.c b/drivers/media/platform/vivid/vivid-vbi-out.c
index 9357c07e30d6..cd56476902a2 100644
--- a/drivers/media/platform/vivid/vivid-vbi-out.c
+++ b/drivers/media/platform/vivid/vivid-vbi-out.c
@@ -96,8 +96,6 @@ static int vbi_out_start_streaming(struct vb2_queue *vq, unsigned count)
 
                 list_for_each_entry_safe(buf, tmp, &dev->vbi_out_active, list) {
                         list_del(&buf->list);
-                        v4l2_ctrl_request_complete(buf->vb.vb2_buf.req_obj.req,
-                                                   &dev->ctrl_hdl_vbi_out);
                         vb2_buffer_done(&buf->vb.vb2_buf,
                                         VB2_BUF_STATE_QUEUED);
                 }
diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
index 9c8e8be81ce3..673772cd17d6 100644
--- a/drivers/media/platform/vivid/vivid-vid-cap.c
+++ b/drivers/media/platform/vivid/vivid-vid-cap.c
@@ -243,8 +243,6 @@ static int vid_cap_start_streaming(struct vb2_queue *vq, unsigned count)
 
                 list_for_each_entry_safe(buf, tmp, &dev->vid_cap_active, list) {
                         list_del(&buf->list);
-                        v4l2_ctrl_request_complete(buf->vb.vb2_buf.req_obj.req,
-                                                   &dev->ctrl_hdl_vid_cap);
                         vb2_buffer_done(&buf->vb.vb2_buf,
                                         VB2_BUF_STATE_QUEUED);
                 }
diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
index aaf13f03d5d4..628eae154ee7 100644
--- a/drivers/media/platform/vivid/vivid-vid-out.c
+++ b/drivers/media/platform/vivid/vivid-vid-out.c
@@ -162,8 +162,6 @@ static int vid_out_start_streaming(struct vb2_queue *vq, unsigned count)
 
                 list_for_each_entry_safe(buf, tmp, &dev->vid_out_active, list) {
                         list_del(&buf->list);
-                        v4l2_ctrl_request_complete(buf->vb.vb2_buf.req_obj.req,
-                                                   &dev->ctrl_hdl_vid_out);
                         vb2_buffer_done(&buf->vb.vb2_buf,
                                         VB2_BUF_STATE_QUEUED);
                 }
diff --git a/drivers/media/platform/vsp1/vsp1_lif.c b/drivers/media/platform/vsp1/vsp1_lif.c
index 0b18f0bd7419..8b0a26335d70 100644
--- a/drivers/media/platform/vsp1/vsp1_lif.c
+++ b/drivers/media/platform/vsp1/vsp1_lif.c
@@ -95,7 +95,7 @@ static void lif_configure_stream(struct vsp1_entity *entity,
         format = vsp1_entity_get_pad_format(&lif->entity, lif->entity.config,
                                             LIF_PAD_SOURCE);
 
-        switch (entity->vsp1->version & VI6_IP_VERSION_SOC_MASK) {
+        switch (entity->vsp1->version & VI6_IP_VERSION_MODEL_MASK) {
         case VI6_IP_VERSION_MODEL_VSPD_GEN2:
         case VI6_IP_VERSION_MODEL_VSPD_V2H:
                 hbth = 1536;
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index fce9d6f4b7c9..3137f5d89d80 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -426,10 +426,10 @@ void gspca_frame_add(struct gspca_dev *gspca_dev,
 
         /* append the packet to the frame buffer */
         if (len > 0) {
-                if (gspca_dev->image_len + len > gspca_dev->pixfmt.sizeimage) {
+                if (gspca_dev->image_len + len > PAGE_ALIGN(gspca_dev->pixfmt.sizeimage)) {
                         gspca_err(gspca_dev, "frame overflow %d > %d\n",
                                   gspca_dev->image_len + len,
-                                  gspca_dev->pixfmt.sizeimage);
+                                  PAGE_ALIGN(gspca_dev->pixfmt.sizeimage));
                         packet_type = DISCARD_PACKET;
                 } else {
 /* !! image is NULL only when last pkt is LAST or DISCARD
@@ -1297,18 +1297,19 @@ static int gspca_queue_setup(struct vb2_queue *vq,
                              unsigned int sizes[], struct device *alloc_devs[])
 {
         struct gspca_dev *gspca_dev = vb2_get_drv_priv(vq);
+        unsigned int size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
 
         if (*nplanes)
-                return sizes[0] < gspca_dev->pixfmt.sizeimage ? -EINVAL : 0;
+                return sizes[0] < size ? -EINVAL : 0;
         *nplanes = 1;
-        sizes[0] = gspca_dev->pixfmt.sizeimage;
+        sizes[0] = size;
         return 0;
 }
 
 static int gspca_buffer_prepare(struct vb2_buffer *vb)
 {
         struct gspca_dev *gspca_dev = vb2_get_drv_priv(vb->vb2_queue);
-        unsigned long size = gspca_dev->pixfmt.sizeimage;
+        unsigned long size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
 
         if (vb2_plane_size(vb, 0) < size) {
                 gspca_err(gspca_dev, "buffer too small (%lu < %lu)\n",
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 5f2b033a7a42..10b8d94edbef 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1563,7 +1563,7 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
         u64 offset;
         s64 val;
 
-        switch (ctrl->type) {
+        switch ((u32)ctrl->type) {
         case V4L2_CTRL_TYPE_INTEGER:
                 return ROUND_TO_RANGE(ptr.p_s32[idx], u32, ctrl);
         case V4L2_CTRL_TYPE_INTEGER64:
@@ -2232,7 +2232,7 @@ static struct v4l2_ctrl *v4l2_ctrl_new(struct v4l2_ctrl_handler *hdl,
         is_array = nr_of_dims > 0;
 
         /* Prefill elem_size for all types handled by std_type_ops */
-        switch (type) {
+        switch ((u32)type) {
         case V4L2_CTRL_TYPE_INTEGER64:
                 elem_size = sizeof(s64);
                 break;
diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
index 8f9d6964173e..b99a194ce5a4 100644
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -263,6 +263,11 @@ static const struct file_operations fops = {
 #endif
 };
 
+static void cros_ec_class_release(struct device *dev)
+{
+        kfree(to_cros_ec_dev(dev));
+}
+
 static void cros_ec_sensors_register(struct cros_ec_dev *ec)
 {
         /*
@@ -395,7 +400,7 @@ static int ec_device_probe(struct platform_device *pdev)
         int retval = -ENOMEM;
         struct device *dev = &pdev->dev;
         struct cros_ec_platform *ec_platform = dev_get_platdata(dev);
-        struct cros_ec_dev *ec = devm_kzalloc(dev, sizeof(*ec), GFP_KERNEL);
+        struct cros_ec_dev *ec = kzalloc(sizeof(*ec), GFP_KERNEL);
 
         if (!ec)
                 return retval;
@@ -417,6 +422,7 @@ static int ec_device_probe(struct platform_device *pdev)
         ec->class_dev.devt = MKDEV(ec_major, pdev->id);
         ec->class_dev.class = &cros_class;
         ec->class_dev.parent = dev;
+        ec->class_dev.release = cros_ec_class_release;
 
         retval = dev_set_name(&ec->class_dev, "%s", ec_platform->ec_name);
         if (retval) {
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index c35b5b08bb33..111934838da2 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -472,7 +472,7 @@ out:
 static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
                                struct mmc_blk_ioc_data *idata)
 {
-        struct mmc_command cmd = {};
+        struct mmc_command cmd = {}, sbc = {};
         struct mmc_data data = {};
         struct mmc_request mrq = {};
         struct scatterlist sg;
@@ -550,10 +550,15 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
         }
 
         if (idata->rpmb) {
-                err = mmc_set_blockcount(card, data.blocks,
-                        idata->ic.write_flag & (1 << 31));
-                if (err)
-                        return err;
+                sbc.opcode = MMC_SET_BLOCK_COUNT;
+                /*
+                 * We don't do any blockcount validation because the max size
+                 * may be increased by a future standard. We just copy the
+                 * 'Reliable Write' bit here.
+                 */
+                sbc.arg = data.blocks | (idata->ic.write_flag & BIT(31));
+                sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
+                mrq.sbc = &sbc;
         }
 
         if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_SANITIZE_START) &&
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index adf32682f27a..c60a7625b1fa 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -104,6 +104,7 @@ struct mmc_omap_slot {
         unsigned int            vdd;
         u16                     saved_con;
         u16                     bus_mode;
+        u16                     power_mode;
         unsigned int            fclk_freq;
 
         struct tasklet_struct   cover_tasklet;
@@ -1157,7 +1158,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         struct mmc_omap_slot *slot = mmc_priv(mmc);
         struct mmc_omap_host *host = slot->host;
         int i, dsor;
-        int clk_enabled;
+        int clk_enabled, init_stream;
 
         mmc_omap_select_slot(slot, 0);
 
@@ -1167,6 +1168,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 slot->vdd = ios->vdd;
 
         clk_enabled = 0;
+        init_stream = 0;
         switch (ios->power_mode) {
         case MMC_POWER_OFF:
                 mmc_omap_set_power(slot, 0, ios->vdd);
@@ -1174,13 +1176,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         case MMC_POWER_UP:
                 /* Cannot touch dsor yet, just power up MMC */
                 mmc_omap_set_power(slot, 1, ios->vdd);
+                slot->power_mode = ios->power_mode;
                 goto exit;
         case MMC_POWER_ON:
                 mmc_omap_fclk_enable(host, 1);
                 clk_enabled = 1;
                 dsor |= 1 << 11;
+                if (slot->power_mode != MMC_POWER_ON)
+                        init_stream = 1;
                 break;
         }
+        slot->power_mode = ios->power_mode;
 
         if (slot->bus_mode != ios->bus_mode) {
                 if (slot->pdata->set_bus_mode != NULL)
@@ -1196,7 +1202,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         for (i = 0; i < 2; i++)
                 OMAP_MMC_WRITE(host, CON, dsor);
         slot->saved_con = dsor;
-        if (ios->power_mode == MMC_POWER_ON) {
+        if (init_stream) {
                 /* worst case at 400kHz, 80 cycles makes 200 microsecs */
                 int usecs = 250;
 
@@ -1234,6 +1240,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id)
         slot->host = host;
         slot->mmc = mmc;
         slot->id = id;
+        slot->power_mode = MMC_POWER_UNDEFINED;
         slot->pdata = &host->pdata->slots[id];
 
         host->slots[id] = slot;
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 88347ce78f23..d264391616f9 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -288,9 +288,9 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
         struct device *dev = omap_host->dev;
         struct mmc_ios *ios = &mmc->ios;
         u32 start_window = 0, max_window = 0;
+        bool dcrc_was_enabled = false;
         u8 cur_match, prev_match = 0;
         u32 length = 0, max_len = 0;
-        u32 ier = host->ier;
         u32 phase_delay = 0;
         int ret = 0;
         u32 reg;
@@ -317,9 +317,10 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
          * during the tuning procedure. So disable it during the
          * tuning procedure.
          */
-        ier &= ~SDHCI_INT_DATA_CRC;
-        sdhci_writel(host, ier, SDHCI_INT_ENABLE);
-        sdhci_writel(host, ier, SDHCI_SIGNAL_ENABLE);
+        if (host->ier & SDHCI_INT_DATA_CRC) {
+                host->ier &= ~SDHCI_INT_DATA_CRC;
+                dcrc_was_enabled = true;
+        }
 
         while (phase_delay <= MAX_PHASE_DELAY) {
                 sdhci_omap_set_dll(omap_host, phase_delay);
@@ -366,6 +367,9 @@ tuning_error:
 
 ret:
         sdhci_reset(host, SDHCI_RESET_CMD | SDHCI_RESET_DATA);
+        /* Reenable forbidden interrupt */
+        if (dcrc_was_enabled)
+                host->ier |= SDHCI_INT_DATA_CRC;
         sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
         sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
         return ret;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 99bdae53fa2e..451b08a818a9 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -216,8 +216,12 @@ void sdhci_reset(struct sdhci_host *host, u8 mask)
         timeout = ktime_add_ms(ktime_get(), 100);
 
         /* hw clears the bit when it's done */
-        while (sdhci_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
-                if (ktime_after(ktime_get(), timeout)) {
+        while (1) {
+                bool timedout = ktime_after(ktime_get(), timeout);
+
+                if (!(sdhci_readb(host, SDHCI_SOFTWARE_RESET) & mask))
+                        break;
+                if (timedout) {
                         pr_err("%s: Reset 0x%x never completed.\n",
                                 mmc_hostname(host->mmc), (int)mask);
                         sdhci_dumpregs(host);
@@ -1608,9 +1612,13 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
 
         /* Wait max 20 ms */
         timeout = ktime_add_ms(ktime_get(), 20);
-        while (!((clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
-                & SDHCI_CLOCK_INT_STABLE)) {
-                if (ktime_after(ktime_get(), timeout)) {
+        while (1) {
+                bool timedout = ktime_after(ktime_get(), timeout);
+
+                clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+                if (clk & SDHCI_CLOCK_INT_STABLE)
+                        break;
+                if (timedout) {
                         pr_err("%s: Internal clock never stabilised.\n",
                                mmc_hostname(host->mmc));
                         sdhci_dumpregs(host);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index f43fb2f958a5..93dfcef8afc4 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2086,6 +2086,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
                    aggregator->aggregator_identifier);
 
         /* Tell the partner that this port is not suitable for aggregation */
+        port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
+        port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
+        port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
         port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
         __update_lacpdu_from_port(port);
         ad_lacpdu_send(port);
diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
index 65f10fec25b3..0b3e51f248c2 100644
--- a/drivers/net/dsa/mv88e6060.c
+++ b/drivers/net/dsa/mv88e6060.c
@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
         /* Reset the switch. */
         REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
                   GLOBAL_ATU_CONTROL_SWRESET |
-                  GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
-                  GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
+                  GLOBAL_ATU_CONTROL_LEARNDIS);
 
         /* Wait up to one second for reset to complete. */
         timeout = jiffies + 1 * HZ;
@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
          */
         REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
 
-        /* Enable automatic address learning, set the address
-         * database size to 1024 entries, and set the default aging
-         * time to 5 minutes.
+        /* Disable automatic address learning.
          */
         REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
-                  GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
-                  GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
+                  GLOBAL_ATU_CONTROL_LEARNDIS);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index f02592f43fe3..a7e853fa43c2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -674,7 +674,7 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
 
                 rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
 
-                is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
+                is_rx_check_sum_enabled = (rxd_wb->type >> 19) & 0x3U;
 
                 pkt_type = 0xFFU & (rxd_wb->type >> 4);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index d4c300117529..5d21c14853ac 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5162,6 +5162,7 @@ static int bnxt_hwrm_get_rings(struct bnxt *bp)
                 cp = le16_to_cpu(resp->alloc_cmpl_rings);
                 stats = le16_to_cpu(resp->alloc_stat_ctx);
                 cp = min_t(u16, cp, stats);
+                hw_resc->resv_irqs = cp;
                 if (bp->flags & BNXT_FLAG_CHIP_P5) {
                         int rx = hw_resc->resv_rx_rings;
                         int tx = hw_resc->resv_tx_rings;
@@ -5175,7 +5176,7 @@ static int bnxt_hwrm_get_rings(struct bnxt *bp)
                                 hw_resc->resv_rx_rings = rx;
                                 hw_resc->resv_tx_rings = tx;
                         }
-                        cp = le16_to_cpu(resp->alloc_msix);
+                        hw_resc->resv_irqs = le16_to_cpu(resp->alloc_msix);
                         hw_resc->resv_hw_ring_grps = rx;
                 }
                 hw_resc->resv_cp_rings = cp;
@@ -5353,7 +5354,7 @@ static int bnxt_hwrm_reserve_rings(struct bnxt *bp, int tx, int rx, int grp,
                 return bnxt_hwrm_reserve_vf_rings(bp, tx, rx, grp, cp, vnic);
 }
 
-static int bnxt_cp_rings_in_use(struct bnxt *bp)
+static int bnxt_nq_rings_in_use(struct bnxt *bp)
 {
         int cp = bp->cp_nr_rings;
         int ulp_msix, ulp_base;
@@ -5368,10 +5369,22 @@ static int bnxt_cp_rings_in_use(struct bnxt *bp)
         return cp;
 }
 
+static int bnxt_cp_rings_in_use(struct bnxt *bp)
+{
+        int cp;
+
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                return bnxt_nq_rings_in_use(bp);
+
+        cp = bp->tx_nr_rings + bp->rx_nr_rings;
+        return cp;
+}
+
 static bool bnxt_need_reserve_rings(struct bnxt *bp)
 {
         struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
         int cp = bnxt_cp_rings_in_use(bp);
+        int nq = bnxt_nq_rings_in_use(bp);
         int rx = bp->rx_nr_rings;
         int vnic = 1, grp = rx;
 
@@ -5387,7 +5400,7 @@ static bool bnxt_need_reserve_rings(struct bnxt *bp)
                 rx <<= 1;
         if (BNXT_NEW_RM(bp) &&
             (hw_resc->resv_rx_rings != rx || hw_resc->resv_cp_rings != cp ||
-             hw_resc->resv_vnics != vnic ||
+             hw_resc->resv_irqs < nq || hw_resc->resv_vnics != vnic ||
              (hw_resc->resv_hw_ring_grps != grp &&
               !(bp->flags & BNXT_FLAG_CHIP_P5))))
                 return true;
@@ -5397,7 +5410,7 @@ static bool bnxt_need_reserve_rings(struct bnxt *bp)
 static int __bnxt_reserve_rings(struct bnxt *bp)
 {
         struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
-        int cp = bnxt_cp_rings_in_use(bp);
+        int cp = bnxt_nq_rings_in_use(bp);
         int tx = bp->tx_nr_rings;
         int rx = bp->rx_nr_rings;
         int grp, rx_rings, rc;
@@ -5422,7 +5435,7 @@ static int __bnxt_reserve_rings(struct bnxt *bp)
         tx = hw_resc->resv_tx_rings;
         if (BNXT_NEW_RM(bp)) {
                 rx = hw_resc->resv_rx_rings;
-                cp = hw_resc->resv_cp_rings;
+                cp = hw_resc->resv_irqs;
                 grp = hw_resc->resv_hw_ring_grps;
                 vnic = hw_resc->resv_vnics;
         }
@@ -6292,6 +6305,8 @@ hwrm_func_qcaps_exit:
         return rc;
 }
 
+static int bnxt_hwrm_queue_qportcfg(struct bnxt *bp);
+
 static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
 {
         int rc;
@@ -6299,6 +6314,11 @@ static int bnxt_hwrm_func_qcaps(struct bnxt *bp)
         rc = __bnxt_hwrm_func_qcaps(bp);
         if (rc)
                 return rc;
+        rc = bnxt_hwrm_queue_qportcfg(bp);
+        if (rc) {
+                netdev_err(bp->dev, "hwrm query qportcfg failure rc: %d\n", rc);
+                return rc;
+        }
         if (bp->hwrm_spec_code >= 0x10803) {
                 rc = bnxt_alloc_ctx_mem(bp);
                 if (rc)
@@ -7026,7 +7046,12 @@ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp)
 
 unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp)
 {
-        return bp->hw_resc.max_cp_rings - bnxt_get_ulp_msix_num(bp);
+        unsigned int cp = bp->hw_resc.max_cp_rings;
+
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                cp -= bnxt_get_ulp_msix_num(bp);
+
+        return cp;
 }
 
 static unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
@@ -7048,7 +7073,9 @@ int bnxt_get_avail_msix(struct bnxt *bp, int num)
         int total_req = bp->cp_nr_rings + num;
         int max_idx, avail_msix;
 
-        max_idx = min_t(int, bp->total_irqs, max_cp);
+        max_idx = bp->total_irqs;
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                max_idx = min_t(int, bp->total_irqs, max_cp);
         avail_msix = max_idx - bp->cp_nr_rings;
         if (!BNXT_NEW_RM(bp) || avail_msix >= num)
                 return avail_msix;
@@ -7066,7 +7093,7 @@ static int bnxt_get_num_msix(struct bnxt *bp)
         if (!BNXT_NEW_RM(bp))
                 return bnxt_get_max_func_irqs(bp);
 
-        return bnxt_cp_rings_in_use(bp);
+        return bnxt_nq_rings_in_use(bp);
 }
 
 static int bnxt_init_msix(struct bnxt *bp)
@@ -7794,6 +7821,7 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up)
 
                 rc = bnxt_hwrm_func_resc_qcaps(bp, true);
                 hw_resc->resv_cp_rings = 0;
+                hw_resc->resv_irqs = 0;
                 hw_resc->resv_tx_rings = 0;
                 hw_resc->resv_rx_rings = 0;
                 hw_resc->resv_hw_ring_grps = 0;
@@ -9799,13 +9827,16 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
                                 int *max_cp)
 {
         struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
-        int max_ring_grps = 0;
+        int max_ring_grps = 0, max_irq;
 
         *max_tx = hw_resc->max_tx_rings;
         *max_rx = hw_resc->max_rx_rings;
-        *max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
-                        hw_resc->max_irqs - bnxt_get_ulp_msix_num(bp));
-        *max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs);
+        *max_cp = bnxt_get_max_func_cp_rings_for_en(bp);
+        max_irq = min_t(int, bnxt_get_max_func_irqs(bp) -
+                        bnxt_get_ulp_msix_num(bp),
+                        bnxt_get_max_func_stat_ctxs(bp));
+        if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+                *max_cp = min_t(int, *max_cp, max_irq);
         max_ring_grps = hw_resc->max_hw_ring_grps;
         if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
                 *max_cp -= 1;
@@ -9813,6 +9844,11 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
         }
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 *max_rx >>= 1;
+        if (bp->flags & BNXT_FLAG_CHIP_P5) {
+                bnxt_trim_rings(bp, max_rx, max_tx, *max_cp, false);
+                /* On P5 chips, max_cp output param should be available NQs */
+                *max_cp = max_irq;
+        }
         *max_rx = min_t(int, *max_rx, max_ring_grps);
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 9e99d4ab3e06..3030931ccaf8 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -928,6 +928,7 @@ struct bnxt_hw_resc {
         u16     min_stat_ctxs;
         u16     max_stat_ctxs;
         u16     max_irqs;
+        u16     resv_irqs;
 };
 
 #if defined(CONFIG_BNXT_SRIOV)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index b59b382d34f9..0a3097baafde 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -168,7 +168,7 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
         if (BNXT_NEW_RM(bp)) {
                 struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
 
-                avail_msix = hw_resc->resv_cp_rings - bp->cp_nr_rings;
+                avail_msix = hw_resc->resv_irqs - bp->cp_nr_rings;
                 edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
         }
         bnxt_fill_msix_vecs(bp, ent);
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
index 4c3925af53bc..abe5d0dac851 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
@@ -111,7 +111,7 @@ static const char oct_stats_strings[][ETH_GSTRING_LEN] = {
         "mac_tx_one_collision",
         "mac_tx_multi_collision",
         "mac_tx_max_collision_fail",
-        "mac_tx_max_deferal_fail",
+        "mac_tx_max_deferral_fail",
         "mac_tx_fifo_err",
         "mac_tx_runts",
 
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
index ea9859e028d4..de61060721c4 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
@@ -349,13 +349,15 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct,
         struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
         struct sk_buff *skb = sc->ctxptr;
         struct net_device *ndev = skb->dev;
+        u32 iq_no;
 
         dma_unmap_single(&oct->pci_dev->dev, sc->dmadptr,
                          sc->datasize, DMA_TO_DEVICE);
         dev_kfree_skb_any(skb);
+        iq_no = sc->iq_no;
         octeon_free_soft_command(oct, sc);
 
-        if (octnet_iq_is_full(oct, sc->iq_no))
+        if (octnet_iq_is_full(oct, iq_no))
                 return;
 
         if (netif_queue_stopped(ndev))
diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index c415ac67cb7b..e80fedb27cee 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -2786,7 +2786,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
         if (!muram_node) {
                 dev_err(&of_dev->dev, "%s: could not find MURAM node\n",
                         __func__);
-                goto fman_node_put;
+                goto fman_free;
         }
 
         err = of_address_to_resource(muram_node, 0,
@@ -2795,11 +2795,10 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
                 of_node_put(muram_node);
                 dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n",
                         __func__, err);
-                goto fman_node_put;
+                goto fman_free;
         }
 
         of_node_put(muram_node);
-        of_node_put(fm_node);
 
         err = devm_request_irq(&of_dev->dev, irq, fman_irq, IRQF_SHARED,
                                "fman", fman);
diff --git a/drivers/net/ethernet/ibm/emac/emac.h b/drivers/net/ethernet/ibm/emac/emac.h
index e2f80cca9bed..0d2de6f67676 100644
--- a/drivers/net/ethernet/ibm/emac/emac.h
+++ b/drivers/net/ethernet/ibm/emac/emac.h
@@ -231,7 +231,7 @@ struct emac_regs {
 #define EMAC_STACR_PHYE                 0x00004000
 #define EMAC_STACR_STAC_MASK            0x00003000
 #define EMAC_STACR_STAC_READ            0x00001000
-#define EMAC_STACR_STAC_WRITE           0x00000800
+#define EMAC_STACR_STAC_WRITE           0x00002000
 #define EMAC_STACR_OPBC_MASK            0x00000C00
 #define EMAC_STACR_OPBC_50              0x00000000
 #define EMAC_STACR_OPBC_66              0x00000400
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index c0203a0d5e3b..ed50b8dee44f 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1859,7 +1859,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
 
         if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
             adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
-                netdev_notify_peers(netdev);
+                call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
 
         netif_carrier_on(netdev);
 
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 7a37a37e3fb3..125ea99418df 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -4375,8 +4375,27 @@ static void mvpp2_phylink_validate(struct net_device *dev,
                                    unsigned long *supported,
                                    struct phylink_link_state *state)
 {
+        struct mvpp2_port *port = netdev_priv(dev);
         __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
 
+        /* Invalid combinations */
+        switch (state->interface) {
+        case PHY_INTERFACE_MODE_10GKR:
+        case PHY_INTERFACE_MODE_XAUI:
+                if (port->gop_id != 0)
+                        goto empty_set;
+                break;
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+                if (port->gop_id == 0)
+                        goto empty_set;
+                break;
+        default:
+                break;
+        }
+
         phylink_set(mask, Autoneg);
         phylink_set_port_modes(mask);
         phylink_set(mask, Pause);
@@ -4384,6 +4403,8 @@ static void mvpp2_phylink_validate(struct net_device *dev,
 
         switch (state->interface) {
         case PHY_INTERFACE_MODE_10GKR:
+        case PHY_INTERFACE_MODE_XAUI:
+        case PHY_INTERFACE_MODE_NA:
                 phylink_set(mask, 10000baseCR_Full);
                 phylink_set(mask, 10000baseSR_Full);
                 phylink_set(mask, 10000baseLR_Full);
@@ -4391,7 +4412,11 @@ static void mvpp2_phylink_validate(struct net_device *dev,
                 phylink_set(mask, 10000baseER_Full);
                 phylink_set(mask, 10000baseKR_Full);
                 /* Fall-through */
-        default:
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+        case PHY_INTERFACE_MODE_SGMII:
                 phylink_set(mask, 10baseT_Half);
                 phylink_set(mask, 10baseT_Full);
                 phylink_set(mask, 100baseT_Half);
@@ -4403,11 +4428,18 @@ static void mvpp2_phylink_validate(struct net_device *dev,
                 phylink_set(mask, 1000baseT_Full);
                 phylink_set(mask, 1000baseX_Full);
                 phylink_set(mask, 2500baseX_Full);
+                break;
+        default:
+                goto empty_set;
         }
 
         bitmap_and(supported, supported, mask, __ETHTOOL_LINK_MODE_MASK_NBITS);
         bitmap_and(state->advertising, state->advertising, mask,
                    __ETHTOOL_LINK_MODE_MASK_NBITS);
+        return;
+
+empty_set:
+        bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
 }
 
 static void mvpp22_xlg_link_state(struct mvpp2_port *port,
diff --git a/drivers/net/ethernet/mellanox/mlx4/Kconfig b/drivers/net/ethernet/mellanox/mlx4/Kconfig
index 36054e6fb9d3..f200b8c420d5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx4/Kconfig
@@ -5,7 +5,7 @@
 config MLX4_EN
         tristate "Mellanox Technologies 1/10/40Gbit Ethernet support"
         depends on MAY_USE_DEVLINK
-        depends on PCI
+        depends on PCI && NETDEVICES && ETHERNET && INET
         select MLX4_CORE
         imply PTP_1588_CLOCK
         ---help---
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index f11b45001cad..d290f0787dfb 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1084,8 +1084,8 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
 
         tx_pause = !!(pause->tx_pause);
         rx_pause = !!(pause->rx_pause);
-        rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause);
-        tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause);
+        rx_ppp = (tx_pause || rx_pause) ? 0 : priv->prof->rx_ppp;
+        tx_ppp = (tx_pause || rx_pause) ? 0 : priv->prof->tx_ppp;
 
         err = mlx4_SET_PORT_general(mdev->dev, priv->port,
                                     priv->rx_skb_size + ETH_FCS_LEN,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index b744cd49a785..6b88881b8e35 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3493,8 +3493,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 dev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM;
         }
 
-        /* MTU range: 46 - hw-specific max */
-        dev->min_mtu = MLX4_EN_MIN_MTU;
+        /* MTU range: 68 - hw-specific max */
+        dev->min_mtu = ETH_MIN_MTU;
         dev->max_mtu = priv->max_mtu;
 
         mdev->pndev[port] = dev;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 485d856546c6..8137454e2534 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -161,7 +161,6 @@
 #define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
                                   ETH_HLEN + PREAMBLE_LEN)
 
-#define MLX4_EN_MIN_MTU         46
 /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple
  * headers. (For example: ETH_P_8021Q and ETH_P_8021AD).
  */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 16985ca3248d..624eed345b5d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -724,9 +724,9 @@ static u32 mlx5e_get_fcs(const struct sk_buff *skb)
         return __get_unaligned_cpu32(fcs_bytes);
 }
 
-static u8 get_ip_proto(struct sk_buff *skb, __be16 proto)
+static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
 {
-        void *ip_p = skb->data + sizeof(struct ethhdr);
+        void *ip_p = skb->data + network_depth;
 
         return (proto == htons(ETH_P_IP)) ? ((struct iphdr *)ip_p)->protocol :
                                             ((struct ipv6hdr *)ip_p)->nexthdr;
@@ -755,7 +755,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                 goto csum_unnecessary;
 
         if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
-                if (unlikely(get_ip_proto(skb, proto) == IPPROTO_SCTP))
+                if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
                         goto csum_unnecessary;
 
                 skb->ip_summed = CHECKSUM_COMPLETE;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
index ad06d9969bc1..5c13674439f1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
@@ -560,7 +560,7 @@ static void mlxsw_sp_nve_mc_list_ip_del(struct mlxsw_sp *mlxsw_sp,
 
         mc_record = mlxsw_sp_nve_mc_record_find(mc_list, proto, addr,
                                                 &mc_entry);
-        if (WARN_ON(!mc_record))
+        if (!mc_record)
                 return;
 
         mlxsw_sp_nve_mc_record_entry_del(mc_record, mc_entry);
@@ -647,7 +647,7 @@ void mlxsw_sp_nve_flood_ip_del(struct mlxsw_sp *mlxsw_sp,
 
         key.fid_index = mlxsw_sp_fid_index(fid);
         mc_list = mlxsw_sp_nve_mc_list_find(mlxsw_sp, &key);
-        if (WARN_ON(!mc_list))
+        if (!mc_list)
                 return;
 
         mlxsw_sp_nve_fid_flood_index_clear(fid, mc_list);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 9e9bb57134f2..6ebf99cc3154 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1275,15 +1275,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp,
 {
         u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN;
         enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt;
-        struct net_device *ipip_ul_dev;
 
         if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto)
                 return false;
 
-        ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev);
         return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip,
-                                                 ul_tb_id, ipip_entry) &&
-               (!ipip_ul_dev || ipip_ul_dev == ul_dev);
+                                                 ul_tb_id, ipip_entry);
 }
 
 /* Given decap parameters, find the corresponding IPIP entry. */
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 739a51f0a366..50080c60a279 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -296,7 +296,13 @@ static bool
 mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port *
                                     bridge_port)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(bridge_port->dev);
+        struct net_device *dev = bridge_port->dev;
+        struct mlxsw_sp *mlxsw_sp;
+
+        if (is_vlan_dev(dev))
+                mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev));
+        else
+                mlxsw_sp = mlxsw_sp_lower_get(dev);
 
         /* In case ports were pulled from out of a bridged LAG, then
          * it's possible the reference count isn't zero, yet the bridge
@@ -2109,7 +2115,7 @@ mlxsw_sp_bridge_8021d_port_leave(struct mlxsw_sp_bridge_device *bridge_device,
 
         vid = is_vlan_dev(dev) ? vlan_dev_vlan_id(dev) : 1;
         mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
-        if (WARN_ON(!mlxsw_sp_port_vlan))
+        if (!mlxsw_sp_port_vlan)
                 return;
 
         mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan);
@@ -2134,8 +2140,10 @@ mlxsw_sp_bridge_8021d_vxlan_join(struct mlxsw_sp_bridge_device *bridge_device,
         if (!fid)
                 return -EINVAL;
 
-        if (mlxsw_sp_fid_vni_is_set(fid))
-                return -EINVAL;
+        if (mlxsw_sp_fid_vni_is_set(fid)) {
+                err = -EINVAL;
+                goto err_vni_exists;
+        }
 
         err = mlxsw_sp_nve_fid_enable(mlxsw_sp, fid, &params, extack);
         if (err)
@@ -2149,6 +2157,7 @@ mlxsw_sp_bridge_8021d_vxlan_join(struct mlxsw_sp_bridge_device *bridge_device,
         return 0;
 
 err_nve_fid_enable:
+err_vni_exists:
         mlxsw_sp_fid_put(fid);
         return err;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 29c95423ab64..2f49eb75f3cc 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -476,16 +476,16 @@ nfp_flower_add_offload(struct nfp_app *app, struct net_device *netdev,
         if (err)
                 goto err_destroy_flow;
 
-        err = nfp_flower_xmit_flow(netdev, flow_pay,
-                                   NFP_FLOWER_CMSG_TYPE_FLOW_ADD);
-        if (err)
-                goto err_destroy_flow;
-
         flow_pay->tc_flower_cookie = flow->cookie;
         err = rhashtable_insert_fast(&priv->flow_table, &flow_pay->fl_node,
                                      nfp_flower_table_params);
         if (err)
-                goto err_destroy_flow;
+                goto err_release_metadata;
+
+        err = nfp_flower_xmit_flow(netdev, flow_pay,
+                                   NFP_FLOWER_CMSG_TYPE_FLOW_ADD);
+        if (err)
+                goto err_remove_rhash;
 
         port->tc_offload_cnt++;
 
@@ -494,6 +494,12 @@ nfp_flower_add_offload(struct nfp_app *app, struct net_device *netdev,
 
         return 0;
 
+err_remove_rhash:
+        WARN_ON_ONCE(rhashtable_remove_fast(&priv->flow_table,
+                                            &flow_pay->fl_node,
+                                            nfp_flower_table_params));
+err_release_metadata:
+        nfp_modify_flow_metadata(app, flow_pay);
 err_destroy_flow:
         kfree(flow_pay->action_data);
         kfree(flow_pay->mask_data);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 81045dfa1cd8..44f6e4873aad 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -571,6 +571,7 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance)
         struct cp_private *cp;
         int handled = 0;
         u16 status;
+        u16 mask;
 
         if (unlikely(dev == NULL))
                 return IRQ_NONE;
@@ -578,6 +579,10 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance)
 
         spin_lock(&cp->lock);
 
+        mask = cpr16(IntrMask);
+        if (!mask)
+                goto out_unlock;
+
         status = cpr16(IntrStatus);
         if (!status || (status == 0xFFFF))
                 goto out_unlock;
diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
index 6732f5cbde08..7c7cd9d94bcc 100644
--- a/drivers/net/ethernet/socionext/sni_ave.c
+++ b/drivers/net/ethernet/socionext/sni_ave.c
@@ -185,8 +185,8 @@
                                  NETIF_MSG_TX_ERR)
 
 /* Parameter for descriptor */
-#define AVE_NR_TXDESC           32      /* Tx descriptor */
-#define AVE_NR_RXDESC           64      /* Rx descriptor */
+#define AVE_NR_TXDESC           64      /* Tx descriptor */
+#define AVE_NR_RXDESC           256     /* Rx descriptor */
 
 #define AVE_DESC_OFS_CMDSTS     0
 #define AVE_DESC_OFS_ADDRL      4
@@ -194,6 +194,7 @@
 
 /* Parameter for ethernet frame */
 #define AVE_MAX_ETHFRAME        1518
+#define AVE_FRAME_HEADROOM      2
 
 /* Parameter for interrupt */
 #define AVE_INTM_COUNT          20
@@ -576,12 +577,13 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
 
         skb = priv->rx.desc[entry].skbs;
         if (!skb) {
-                skb = netdev_alloc_skb_ip_align(ndev,
-                                                AVE_MAX_ETHFRAME);
+                skb = netdev_alloc_skb(ndev, AVE_MAX_ETHFRAME);
                 if (!skb) {
                         netdev_err(ndev, "can't allocate skb for Rx\n");
                         return -ENOMEM;
                 }
+                skb->data += AVE_FRAME_HEADROOM;
+                skb->tail += AVE_FRAME_HEADROOM;
         }
 
         /* set disable to cmdsts */
@@ -594,12 +596,12 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
          * - Rx buffer begins with 2 byte headroom, and data will be put from
          *   (buffer + 2).
          * To satisfy this, specify the address to put back the buffer
-         * pointer advanced by NET_IP_ALIGN by netdev_alloc_skb_ip_align(),
-         * and expand the map size by NET_IP_ALIGN.
+         * pointer advanced by AVE_FRAME_HEADROOM, and expand the map size
+         * by AVE_FRAME_HEADROOM.
          */
         ret = ave_dma_map(ndev, &priv->rx.desc[entry],
-                          skb->data - NET_IP_ALIGN,
-                          AVE_MAX_ETHFRAME + NET_IP_ALIGN,
+                          skb->data - AVE_FRAME_HEADROOM,
+                          AVE_MAX_ETHFRAME + AVE_FRAME_HEADROOM,
                           DMA_FROM_DEVICE, &paddr);
         if (ret) {
                 netdev_err(ndev, "can't map skb for Rx\n");
@@ -1689,9 +1691,10 @@ static int ave_probe(struct platform_device *pdev)
                  pdev->name, pdev->id);
 
         /* Register as a NAPI supported driver */
-        netif_napi_add(ndev, &priv->napi_rx, ave_napi_poll_rx, priv->rx.ndesc);
+        netif_napi_add(ndev, &priv->napi_rx, ave_napi_poll_rx,
+                       NAPI_POLL_WEIGHT);
         netif_tx_napi_add(ndev, &priv->napi_tx, ave_napi_poll_tx,
-                          priv->tx.ndesc);
+                          NAPI_POLL_WEIGHT);
 
         platform_set_drvdata(pdev, ndev);
 
@@ -1913,5 +1916,6 @@ static struct platform_driver ave_driver = {
 };
 module_platform_driver(ave_driver);
 
+MODULE_AUTHOR("Kunihiko Hayashi <hayashi.kunihiko@socionext.com>");
 MODULE_DESCRIPTION("Socionext UniPhier AVE ethernet driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 076a8be18d67..5551fead8f66 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2550,12 +2550,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
                         netdev_warn(priv->dev, "PTP init failed\n");
         }
 
-#ifdef CONFIG_DEBUG_FS
-        ret = stmmac_init_fs(dev);
-        if (ret < 0)
-                netdev_warn(priv->dev, "%s: failed debugFS registration\n",
-                            __func__);
-#endif
         priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
 
         if (priv->use_riwt) {
@@ -2756,10 +2750,6 @@ static int stmmac_release(struct net_device *dev)
 
         netif_carrier_off(dev);
 
-#ifdef CONFIG_DEBUG_FS
-        stmmac_exit_fs(dev);
-#endif
-
         stmmac_release_ptp(priv);
 
         return 0;
@@ -3899,6 +3889,9 @@ static int stmmac_sysfs_ring_read(struct seq_file *seq, void *v)
         u32 tx_count = priv->plat->tx_queues_to_use;
         u32 queue;
 
+        if ((dev->flags & IFF_UP) == 0)
+                return 0;
+
         for (queue = 0; queue < rx_count; queue++) {
                 struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
 
@@ -4397,6 +4390,13 @@ int stmmac_dvr_probe(struct device *device,
                 goto error_netdev_register;
         }
 
+#ifdef CONFIG_DEBUG_FS
+        ret = stmmac_init_fs(ndev);
+        if (ret < 0)
+                netdev_warn(priv->dev, "%s: failed debugFS registration\n",
+                            __func__);
+#endif
+
         return ret;
 
 error_netdev_register:
@@ -4432,6 +4432,9 @@ int stmmac_dvr_remove(struct device *dev)
 
         netdev_info(priv->dev, "%s: removing driver", __func__);
 
+#ifdef CONFIG_DEBUG_FS
+        stmmac_exit_fs(ndev);
+#endif
         stmmac_stop_all_dma(priv);
 
         stmmac_mac_set(priv, priv->ioaddr, false);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index fc8d5f1ee1ad..0da3d36b283b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -608,7 +608,7 @@ static int macvlan_open(struct net_device *dev)
                 goto hash_add;
         }
 
-        err = -EBUSY;
+        err = -EADDRINUSE;
         if (macvlan_addr_busy(vlan->port, dev->dev_addr))
                 goto out;
 
@@ -706,7 +706,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
         } else {
                 /* Rehash and update the device filters */
                 if (macvlan_addr_busy(vlan->port, addr))
-                        return -EBUSY;
+                        return -EADDRINUSE;
 
                 if (!macvlan_passthru(port)) {
                         err = dev_uc_add(lowerdev, addr);
@@ -747,6 +747,9 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p)
                 return dev_set_mac_address(vlan->lowerdev, addr);
         }
 
+        if (macvlan_addr_busy(vlan->port, addr->sa_data))
+                return -EADDRINUSE;
+
         return macvlan_sync_address(dev, addr->sa_data);
 }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 23ee3967c166..18e92c19c5ab 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1880,20 +1880,17 @@ EXPORT_SYMBOL(genphy_loopback);
 
 static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
-                               PHY_10BT_FEATURES);
-
         switch (max_speed) {
-        default:
-                return -ENOTSUPP;
-        case SPEED_1000:
-                phydev->supported |= PHY_1000BT_FEATURES;
+        case SPEED_10:
+                phydev->supported &= ~PHY_100BT_FEATURES;
                 /* fall through */
         case SPEED_100:
-                phydev->supported |= PHY_100BT_FEATURES;
-                /* fall through */
-        case SPEED_10:
-                phydev->supported |= PHY_10BT_FEATURES;
+                phydev->supported &= ~PHY_1000BT_FEATURES;
+                break;
+        case SPEED_1000:
+                break;
+        default:
+                return -ENOTSUPP;
         }
 
         return 0;
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 83060fb349f4..ad9db652874d 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -162,7 +162,7 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
         /* 1000Base-PX or 1000Base-BX10 */
         if ((id->base.e_base_px || id->base.e_base_bx10) &&
             br_min <= 1300 && br_max >= 1200)
-                phylink_set(support, 1000baseX_Full);
+                phylink_set(modes, 1000baseX_Full);
 
         /* For active or passive cables, select the link modes
          * based on the bit rates and the cable compliance bytes.
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e244f5d7512a..005020042be9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2293,9 +2293,9 @@ static void tun_setup(struct net_device *dev)
 static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
                         struct netlink_ext_ack *extack)
 {
-        if (!data)
-                return 0;
-        return -EINVAL;
+        NL_SET_ERR_MSG(extack,
+                       "tun/tap creation via rtnetlink is not supported.");
+        return -EOPNOTSUPP;
 }
 
 static size_t tun_get_size(const struct net_device *dev)
@@ -2385,6 +2385,7 @@ static int tun_xdp_one(struct tun_struct *tun,
                        struct tun_file *tfile,
                        struct xdp_buff *xdp, int *flush)
 {
+        unsigned int datasize = xdp->data_end - xdp->data;
         struct tun_xdp_hdr *hdr = xdp->data_hard_start;
         struct virtio_net_hdr *gso = &hdr->gso;
         struct tun_pcpu_stats *stats;
@@ -2461,7 +2462,7 @@ build:
         stats = get_cpu_ptr(tun->pcpu_stats);
         u64_stats_update_begin(&stats->syncp);
         stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        stats->rx_bytes += datasize;
         u64_stats_update_end(&stats->syncp);
         put_cpu_ptr(stats);
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index cecfd77c9f3c..ea672145f6a6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -365,7 +365,8 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx)
 static struct sk_buff *page_to_skb(struct virtnet_info *vi,
                                    struct receive_queue *rq,
                                    struct page *page, unsigned int offset,
-                                   unsigned int len, unsigned int truesize)
+                                   unsigned int len, unsigned int truesize,
+                                   bool hdr_valid)
 {
         struct sk_buff *skb;
         struct virtio_net_hdr_mrg_rxbuf *hdr;
@@ -387,7 +388,8 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
         else
                 hdr_padded_len = sizeof(struct padded_vnet_hdr);
 
-        memcpy(hdr, p, hdr_len);
+        if (hdr_valid)
+                memcpy(hdr, p, hdr_len);
 
         len -= hdr_len;
         offset += hdr_padded_len;
@@ -739,7 +741,8 @@ static struct sk_buff *receive_big(struct net_device *dev,
                                    struct virtnet_rq_stats *stats)
 {
         struct page *page = buf;
-        struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE);
+        struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len,
+                                          PAGE_SIZE, true);
 
         stats->bytes += len - vi->hdr_len;
         if (unlikely(!skb))
@@ -842,7 +845,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                                 rcu_read_unlock();
                                 put_page(page);
                                 head_skb = page_to_skb(vi, rq, xdp_page,
-                                                       offset, len, PAGE_SIZE);
+                                                       offset, len,
+                                                       PAGE_SIZE, false);
                                 return head_skb;
                         }
                         break;
@@ -898,7 +902,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                 goto err_skb;
         }
 
-        head_skb = page_to_skb(vi, rq, page, offset, len, truesize);
+        head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog);
         curr_skb = head_skb;
 
         if (unlikely(!curr_skb))
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index aa8058264d5b..d1464e3e1be2 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2884,6 +2884,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 
         wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
 
+        tasklet_hrtimer_init(&data->beacon_timer,
+                             mac80211_hwsim_beacon,
+                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+
         err = ieee80211_register_hw(hw);
         if (err < 0) {
                 pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
@@ -2908,10 +2912,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                     data->debugfs,
                                     data, &hwsim_simulate_radar);
 
-        tasklet_hrtimer_init(&data->beacon_timer,
-                             mac80211_hwsim_beacon,
-                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
-
         spin_lock_bh(&hwsim_radio_lock);
         err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
                                      hwsim_rht_params);
@@ -3703,16 +3703,16 @@ static int __init init_mac80211_hwsim(void)
         if (err)
                 goto out_unregister_pernet;
 
+        err = hwsim_init_netlink();
+        if (err)
+                goto out_unregister_driver;
+
         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
         if (IS_ERR(hwsim_class)) {
                 err = PTR_ERR(hwsim_class);
-                goto out_unregister_driver;
+                goto out_exit_netlink;
         }
 
-        err = hwsim_init_netlink();
-        if (err < 0)
-                goto out_unregister_driver;
-
         for (i = 0; i < radios; i++) {
                 struct hwsim_new_radio_params param = { 0 };
 
@@ -3818,6 +3818,8 @@ out_free_mon:
         free_netdev(hwsim_mon);
 out_free_radios:
         mac80211_hwsim_free();
+out_exit_netlink:
+        hwsim_exit_netlink();
 out_unregister_driver:
         platform_driver_unregister(&mac80211_hwsim_driver);
 out_unregister_pernet:
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 182258f64417..d0c621b32f72 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -111,6 +111,8 @@ resource_size_t nd_pmem_available_dpa(struct nd_region *nd_region,
                 struct nd_mapping *nd_mapping, resource_size_t *overlap);
 resource_size_t nd_blk_available_dpa(struct nd_region *nd_region);
 resource_size_t nd_region_available_dpa(struct nd_region *nd_region);
+int nd_region_conflict(struct nd_region *nd_region, resource_size_t start,
+                resource_size_t size);
 resource_size_t nvdimm_allocated_dpa(struct nvdimm_drvdata *ndd,
                 struct nd_label_id *label_id);
 int alias_dpa_busy(struct device *dev, void *data);
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 24c64090169e..6f22272e8d80 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -649,14 +649,47 @@ static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
                         ALIGN_DOWN(phys, nd_pfn->align));
 }
 
+/*
+ * Check if pmem collides with 'System RAM', or other regions when
+ * section aligned.  Trim it accordingly.
+ */
+static void trim_pfn_device(struct nd_pfn *nd_pfn, u32 *start_pad, u32 *end_trunc)
+{
+        struct nd_namespace_common *ndns = nd_pfn->ndns;
+        struct nd_namespace_io *nsio = to_nd_namespace_io(&ndns->dev);
+        struct nd_region *nd_region = to_nd_region(nd_pfn->dev.parent);
+        const resource_size_t start = nsio->res.start;
+        const resource_size_t end = start + resource_size(&nsio->res);
+        resource_size_t adjust, size;
+
+        *start_pad = 0;
+        *end_trunc = 0;
+
+        adjust = start - PHYS_SECTION_ALIGN_DOWN(start);
+        size = resource_size(&nsio->res) + adjust;
+        if (region_intersects(start - adjust, size, IORESOURCE_SYSTEM_RAM,
+                                IORES_DESC_NONE) == REGION_MIXED
+                        || nd_region_conflict(nd_region, start - adjust, size))
+                *start_pad = PHYS_SECTION_ALIGN_UP(start) - start;
+
+        /* Now check that end of the range does not collide. */
+        adjust = PHYS_SECTION_ALIGN_UP(end) - end;
+        size = resource_size(&nsio->res) + adjust;
+        if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
+                                IORES_DESC_NONE) == REGION_MIXED
+                        || !IS_ALIGNED(end, nd_pfn->align)
+                        || nd_region_conflict(nd_region, start, size + adjust))
+                *end_trunc = end - phys_pmem_align_down(nd_pfn, end);
+}
+
 static int nd_pfn_init(struct nd_pfn *nd_pfn)
 {
         u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
         struct nd_namespace_common *ndns = nd_pfn->ndns;
-        u32 start_pad = 0, end_trunc = 0;
+        struct nd_namespace_io *nsio = to_nd_namespace_io(&ndns->dev);
         resource_size_t start, size;
-        struct nd_namespace_io *nsio;
         struct nd_region *nd_region;
+        u32 start_pad, end_trunc;
         struct nd_pfn_sb *pfn_sb;
         unsigned long npfns;
         phys_addr_t offset;
@@ -688,30 +721,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
 
         memset(pfn_sb, 0, sizeof(*pfn_sb));
 
-        /*
-         * Check if pmem collides with 'System RAM' when section aligned and
-         * trim it accordingly
-         */
-        nsio = to_nd_namespace_io(&ndns->dev);
-        start = PHYS_SECTION_ALIGN_DOWN(nsio->res.start);
-        size = resource_size(&nsio->res);
-        if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
-                                IORES_DESC_NONE) == REGION_MIXED) {
-                start = nsio->res.start;
-                start_pad = PHYS_SECTION_ALIGN_UP(start) - start;
-        }
-
-        start = nsio->res.start;
-        size = PHYS_SECTION_ALIGN_UP(start + size) - start;
-        if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
-                                IORES_DESC_NONE) == REGION_MIXED
-                        || !IS_ALIGNED(start + resource_size(&nsio->res),
-                                nd_pfn->align)) {
-                size = resource_size(&nsio->res);
-                end_trunc = start + size - phys_pmem_align_down(nd_pfn,
-                                start + size);
-        }
-
+        trim_pfn_device(nd_pfn, &start_pad, &end_trunc);
         if (start_pad + end_trunc)
                 dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
                                 dev_name(&ndns->dev), start_pad + end_trunc);
@@ -722,7 +732,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
          * implementation will limit the pfns advertised through
          * ->direct_access() to those that are included in the memmap.
          */
-        start += start_pad;
+        start = nsio->res.start + start_pad;
         size = resource_size(&nsio->res);
         npfns = PFN_SECTION_ALIGN_UP((size - start_pad - end_trunc - SZ_8K)
                         / PAGE_SIZE);
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index 174a418cb171..e7377f1028ef 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -1184,6 +1184,47 @@ int nvdimm_has_cache(struct nd_region *nd_region)
 }
 EXPORT_SYMBOL_GPL(nvdimm_has_cache);
 
+struct conflict_context {
+        struct nd_region *nd_region;
+        resource_size_t start, size;
+};
+
+static int region_conflict(struct device *dev, void *data)
+{
+        struct nd_region *nd_region;
+        struct conflict_context *ctx = data;
+        resource_size_t res_end, region_end, region_start;
+
+        if (!is_memory(dev))
+                return 0;
+
+        nd_region = to_nd_region(dev);
+        if (nd_region == ctx->nd_region)
+                return 0;
+
+        res_end = ctx->start + ctx->size;
+        region_start = nd_region->ndr_start;
+        region_end = region_start + nd_region->ndr_size;
+        if (ctx->start >= region_start && ctx->start < region_end)
+                return -EBUSY;
+        if (res_end > region_start && res_end <= region_end)
+                return -EBUSY;
+        return 0;
+}
+
+int nd_region_conflict(struct nd_region *nd_region, resource_size_t start,
+                resource_size_t size)
+{
+        struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nd_region->dev);
+        struct conflict_context ctx = {
+                .nd_region = nd_region,
+                .start = start,
+                .size = size,
+        };
+
+        return device_for_each_child(&nvdimm_bus->dev, &ctx, region_conflict);
+}
+
 void __exit nd_region_devs_exit(void)
 {
         ida_destroy(&region_ida);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 3cf1b773158e..962012135b62 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -831,6 +831,8 @@ static int nvme_submit_user_cmd(struct request_queue *q,
 static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 {
         struct nvme_ctrl *ctrl = rq->end_io_data;
+        unsigned long flags;
+        bool startka = false;
 
         blk_mq_free_request(rq);
 
@@ -841,7 +843,13 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
                 return;
         }
 
-        schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
+        spin_lock_irqsave(&ctrl->lock, flags);
+        if (ctrl->state == NVME_CTRL_LIVE ||
+            ctrl->state == NVME_CTRL_CONNECTING)
+                startka = true;
+        spin_unlock_irqrestore(&ctrl->lock, flags);
+        if (startka)
+                schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 3f7971d3706d..583086dd9cb9 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -529,6 +529,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
 {
         struct nvmet_rdma_rsp *rsp =
                 container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
+        struct nvmet_rdma_queue *queue = cq->cq_context;
 
         nvmet_rdma_release_rsp(rsp);
 
@@ -536,7 +537,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
                      wc->status != IB_WC_WR_FLUSH_ERR)) {
                 pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
                         wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
-                nvmet_rdma_error_comp(rsp->queue);
+                nvmet_rdma_error_comp(queue);
         }
 }
 
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index dcb29cb76dc6..f78860ce884b 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -895,7 +895,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
         struct pcie_link_state *link;
         int blacklist = !!pcie_aspm_sanity_check(pdev);
 
-        if (!aspm_support_enabled || aspm_disabled)
+        if (!aspm_support_enabled)
                 return;
 
         if (pdev->link_state)
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 53d449076dee..ea87d739f534 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -191,7 +191,8 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
                 case PIN_CONFIG_BIAS_DISABLE:
                         dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
 
-                        meson_calc_reg_and_bit(bank, pin, REG_PULL, &reg, &bit);
+                        meson_calc_reg_and_bit(bank, pin, REG_PULLEN, &reg,
+                                               &bit);
                         ret = regmap_update_bits(pc->reg_pullen, reg,
                                                  BIT(bit), 0);
                         if (ret)
diff --git a/drivers/pinctrl/qcom/pinctrl-sdm660.c b/drivers/pinctrl/qcom/pinctrl-sdm660.c
index 6838b38555a1..1bfb0ae6b387 100644
--- a/drivers/pinctrl/qcom/pinctrl-sdm660.c
+++ b/drivers/pinctrl/qcom/pinctrl-sdm660.c
@@ -33,7 +33,7 @@ enum {
         }
 
 
-#define PINGROUP(id, base, f1, f2, f3, f4, f5, f6, f7, f8, f9)  \
+#define PINGROUP(id, _tile, f1, f2, f3, f4, f5, f6, f7, f8, f9) \
         {                                               \
                 .name = "gpio" #id,                     \
                 .pins = gpio##id##_pins,                \
@@ -51,11 +51,12 @@ enum {
                         msm_mux_##f9                    \
                 },                                      \
                 .nfuncs = 10,                           \
-                .ctl_reg = base + REG_SIZE * id,        \
-                .io_reg = base + 0x4 + REG_SIZE * id,           \
-                .intr_cfg_reg = base + 0x8 + REG_SIZE * id,             \
-                .intr_status_reg = base + 0xc + REG_SIZE * id,  \
-                .intr_target_reg = base + 0x8 + REG_SIZE * id,  \
+                .ctl_reg = REG_SIZE * id,               \
+                .io_reg = 0x4 + REG_SIZE * id,          \
+                .intr_cfg_reg = 0x8 + REG_SIZE * id,    \
+                .intr_status_reg = 0xc + REG_SIZE * id, \
+                .intr_target_reg = 0x8 + REG_SIZE * id, \
+                .tile = _tile,                  \
                 .mux_bit = 2,                   \
                 .pull_bit = 0,                  \
                 .drv_bit = 6,                   \
@@ -82,6 +83,7 @@ enum {
                 .intr_cfg_reg = 0,                      \
                 .intr_status_reg = 0,                   \
                 .intr_target_reg = 0,                   \
+                .tile = NORTH,                          \
                 .mux_bit = -1,                          \
                 .pull_bit = pull,                       \
                 .drv_bit = drv,                         \
@@ -1397,13 +1399,13 @@ static const struct msm_pingroup sdm660_groups[] = {
         PINGROUP(111, SOUTH, _, _, _, _, _, _, _, _, _),
         PINGROUP(112, SOUTH, _, _, _, _, _, _, _, _, _),
         PINGROUP(113, SOUTH, _, _, _, _, _, _, _, _, _),
-        SDC_QDSD_PINGROUP(sdc1_clk, 0x99a000, 13, 6),
-        SDC_QDSD_PINGROUP(sdc1_cmd, 0x99a000, 11, 3),
-        SDC_QDSD_PINGROUP(sdc1_data, 0x99a000, 9, 0),
-        SDC_QDSD_PINGROUP(sdc2_clk, 0x99b000, 14, 6),
-        SDC_QDSD_PINGROUP(sdc2_cmd, 0x99b000, 11, 3),
-        SDC_QDSD_PINGROUP(sdc2_data, 0x99b000, 9, 0),
-        SDC_QDSD_PINGROUP(sdc1_rclk, 0x99a000, 15, 0),
+        SDC_QDSD_PINGROUP(sdc1_clk, 0x9a000, 13, 6),
+        SDC_QDSD_PINGROUP(sdc1_cmd, 0x9a000, 11, 3),
+        SDC_QDSD_PINGROUP(sdc1_data, 0x9a000, 9, 0),
+        SDC_QDSD_PINGROUP(sdc2_clk, 0x9b000, 14, 6),
+        SDC_QDSD_PINGROUP(sdc2_cmd, 0x9b000, 11, 3),
+        SDC_QDSD_PINGROUP(sdc2_data, 0x9b000, 9, 0),
+        SDC_QDSD_PINGROUP(sdc1_rclk, 0x9a000, 15, 0),
 };
 
 static const struct msm_pinctrl_soc_data sdm660_pinctrl = {
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
index 6624499eae72..4ada80317a3b 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
@@ -568,7 +568,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 11),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 1)),  /* PH_EINT11 */
+                  SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 11)), /* PH_EINT11 */
 };
 
 static const struct sunxi_pinctrl_desc sun8i_a83t_pinctrl_data = {
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 97b6f197f007..c9c57b4a0b71 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -56,6 +56,7 @@ struct virtio_ccw_device {
         unsigned int revision; /* Transport revision */
         wait_queue_head_t wait_q;
         spinlock_t lock;
+        struct mutex io_lock; /* Serializes I/O requests */
         struct list_head virtqueues;
         unsigned long indicators;
         unsigned long indicators2;
@@ -296,6 +297,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
         unsigned long flags;
         int flag = intparm & VIRTIO_CCW_INTPARM_MASK;
 
+        mutex_lock(&vcdev->io_lock);
         do {
                 spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags);
                 ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0);
@@ -308,7 +310,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
                 cpu_relax();
         } while (ret == -EBUSY);
         wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0);
-        return ret ? ret : vcdev->err;
+        ret = ret ? ret : vcdev->err;
+        mutex_unlock(&vcdev->io_lock);
+        return ret;
 }
 
 static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
@@ -828,6 +832,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
         int ret;
         struct ccw1 *ccw;
         void *config_area;
+        unsigned long flags;
 
         ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
         if (!ccw)
@@ -846,11 +851,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
         if (ret)
                 goto out_free;
 
+        spin_lock_irqsave(&vcdev->lock, flags);
         memcpy(vcdev->config, config_area, offset + len);
-        if (buf)
-                memcpy(buf, &vcdev->config[offset], len);
         if (vcdev->config_ready < offset + len)
                 vcdev->config_ready = offset + len;
+        spin_unlock_irqrestore(&vcdev->lock, flags);
+        if (buf)
+                memcpy(buf, config_area + offset, len);
 
 out_free:
         kfree(config_area);
@@ -864,6 +871,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
         struct ccw1 *ccw;
         void *config_area;
+        unsigned long flags;
 
         ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
         if (!ccw)
@@ -876,9 +884,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
         /* Make sure we don't overwrite fields. */
         if (vcdev->config_ready < offset)
                 virtio_ccw_get_config(vdev, 0, NULL, offset);
+        spin_lock_irqsave(&vcdev->lock, flags);
         memcpy(&vcdev->config[offset], buf, len);
         /* Write the config area to the host. */
         memcpy(config_area, vcdev->config, sizeof(vcdev->config));
+        spin_unlock_irqrestore(&vcdev->lock, flags);
         ccw->cmd_code = CCW_CMD_WRITE_CONF;
         ccw->flags = 0;
         ccw->count = offset + len;
@@ -1247,6 +1257,7 @@ static int virtio_ccw_online(struct ccw_device *cdev)
         init_waitqueue_head(&vcdev->wait_q);
         INIT_LIST_HEAD(&vcdev->virtqueues);
         spin_lock_init(&vcdev->lock);
+        mutex_init(&vcdev->io_lock);
 
         spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
         dev_set_drvdata(&cdev->dev, vcdev);
diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
index 5c8ed7350a04..a36e4cf1841d 100644
--- a/drivers/sbus/char/display7seg.c
+++ b/drivers/sbus/char/display7seg.c
@@ -220,6 +220,7 @@ static int d7s_probe(struct platform_device *op)
         dev_set_drvdata(&op->dev, p);
         d7s_device = p;
         err = 0;
+        of_node_put(opts);
 
 out:
         return err;
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 56e962a01493..b8481927bfe4 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
                         for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
                                 pchild->mon_type[len] = ENVCTRL_NOMON;
                         }
+                        of_node_put(root_node);
                         return;
                 }
+                of_node_put(root_node);
         }
 
         /* Get the monitor channels. */
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 93c66ebad907..f78d2e5c1471 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
 failed:
                 ISCSI_DBG_EH(session,
                              "failing session reset: Could not log back into "
-                             "%s, %s [age %d]\n", session->targetname,
-                             conn->persistent_address, session->age);
+                             "%s [age %d]\n", session->targetname,
+                             session->age);
                 spin_unlock_bh(&session->frwd_lock);
                 mutex_unlock(&session->eh_mutex);
                 return FAILED;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 20fa6785a0e2..68d62d55a3a5 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -167,7 +167,11 @@ lpfc_config_port_prep(struct lpfc_hba *phba)
                        sizeof(phba->wwpn));
         }
 
-        phba->sli3_options = 0x0;
+        /*
+         * Clear all option bits except LPFC_SLI3_BG_ENABLED,
+         * which was already set in lpfc_get_cfgparam()
+         */
+        phba->sli3_options &= (uint32_t)LPFC_SLI3_BG_ENABLED;
 
         /* Setup and issue mailbox READ REV command */
         lpfc_read_rev(phba, pmb);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 783a1540cfbe..b9e5cd79931a 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -4965,7 +4965,6 @@ lpfc_sli_config_port(struct lpfc_hba *phba, int sli_mode)
                 phba->sli3_options &= ~(LPFC_SLI3_NPIV_ENABLED |
                                         LPFC_SLI3_HBQ_ENABLED |
                                         LPFC_SLI3_CRP_ENABLED |
-                                        LPFC_SLI3_BG_ENABLED |
                                         LPFC_SLI3_DSS_ENABLED);
                 if (rc != MBX_SUCCESS) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index f03dc03a42c3..8f88348ebe42 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -446,7 +446,6 @@ struct storvsc_device {
 
         bool     destroy;
         bool     drain_notify;
-        bool     open_sub_channel;
         atomic_t num_outstanding_req;
         struct Scsi_Host *host;
 
@@ -636,33 +635,38 @@ get_in_err:
 static void handle_sc_creation(struct vmbus_channel *new_sc)
 {
         struct hv_device *device = new_sc->primary_channel->device_obj;
+        struct device *dev = &device->device;
         struct storvsc_device *stor_device;
         struct vmstorage_channel_properties props;
+        int ret;
 
         stor_device = get_out_stor_device(device);
         if (!stor_device)
                 return;
 
-        if (stor_device->open_sub_channel == false)
-                return;
-
         memset(&props, 0, sizeof(struct vmstorage_channel_properties));
 
-        vmbus_open(new_sc,
-                   storvsc_ringbuffer_size,
-                   storvsc_ringbuffer_size,
-                   (void *)&props,
-                   sizeof(struct vmstorage_channel_properties),
-                   storvsc_on_channel_callback, new_sc);
+        ret = vmbus_open(new_sc,
+                         storvsc_ringbuffer_size,
+                         storvsc_ringbuffer_size,
+                         (void *)&props,
+                         sizeof(struct vmstorage_channel_properties),
+                         storvsc_on_channel_callback, new_sc);
 
-        if (new_sc->state == CHANNEL_OPENED_STATE) {
-                stor_device->stor_chns[new_sc->target_cpu] = new_sc;
-                cpumask_set_cpu(new_sc->target_cpu, &stor_device->alloced_cpus);
+        /* In case vmbus_open() fails, we don't use the sub-channel. */
+        if (ret != 0) {
+                dev_err(dev, "Failed to open sub-channel: err=%d\n", ret);
+                return;
         }
+
+        /* Add the sub-channel to the array of available channels. */
+        stor_device->stor_chns[new_sc->target_cpu] = new_sc;
+        cpumask_set_cpu(new_sc->target_cpu, &stor_device->alloced_cpus);
 }
 
 static void  handle_multichannel_storage(struct hv_device *device, int max_chns)
 {
+        struct device *dev = &device->device;
         struct storvsc_device *stor_device;
         int num_cpus = num_online_cpus();
         int num_sc;
@@ -679,22 +683,12 @@ static void  handle_multichannel_storage(struct hv_device *device, int max_chns)
         request = &stor_device->init_request;
         vstor_packet = &request->vstor_packet;
 
-        stor_device->open_sub_channel = true;
         /*
          * Establish a handler for dealing with subchannels.
          */
         vmbus_set_sc_create_callback(device->channel, handle_sc_creation);
 
         /*
-         * Check to see if sub-channels have already been created. This
-         * can happen when this driver is re-loaded after unloading.
-         */
-
-        if (vmbus_are_subchannels_present(device->channel))
-                return;
-
-        stor_device->open_sub_channel = false;
-        /*
          * Request the host to create sub-channels.
          */
         memset(request, 0, sizeof(struct storvsc_cmd_request));
@@ -710,23 +704,29 @@ static void  handle_multichannel_storage(struct hv_device *device, int max_chns)
                                VM_PKT_DATA_INBAND,
                                VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
 
-        if (ret != 0)
+        if (ret != 0) {
+                dev_err(dev, "Failed to create sub-channel: err=%d\n", ret);
                 return;
+        }
 
         t = wait_for_completion_timeout(&request->wait_event, 10*HZ);
-        if (t == 0)
+        if (t == 0) {
+                dev_err(dev, "Failed to create sub-channel: timed out\n");
                 return;
+        }
 
         if (vstor_packet->operation != VSTOR_OPERATION_COMPLETE_IO ||
-            vstor_packet->status != 0)
+            vstor_packet->status != 0) {
+                dev_err(dev, "Failed to create sub-channel: op=%d, sts=%d\n",
+                        vstor_packet->operation, vstor_packet->status);
                 return;
+        }
 
         /*
-         * Now that we created the sub-channels, invoke the check; this
-         * may trigger the callback.
+         * We need to do nothing here, because vmbus_process_offer()
+         * invokes channel->sc_creation_callback, which will open and use
+         * the sub-channel(s).
          */
-        stor_device->open_sub_channel = true;
-        vmbus_are_subchannels_present(device->channel);
 }
 
 static void cache_wwn(struct storvsc_device *stor_device,
@@ -1794,7 +1794,6 @@ static int storvsc_probe(struct hv_device *device,
         }
 
         stor_device->destroy = false;
-        stor_device->open_sub_channel = false;
         init_waitqueue_head(&stor_device->waiting_to_drain);
         stor_device->device = device;
         stor_device->host = host;
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 6e491023fdd8..0d6b2a88fc8e 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -1202,8 +1202,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
 
 static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
 {
-        pvscsi_shutdown_intr(adapter);
-
         if (adapter->workqueue)
                 destroy_workqueue(adapter->workqueue);
 
@@ -1534,6 +1532,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 out_reset_adapter:
         ll_adapter_reset(adapter);
 out_release_resources:
+        pvscsi_shutdown_intr(adapter);
         pvscsi_release_resources(adapter);
         scsi_host_put(host);
 out_disable_device:
@@ -1542,6 +1541,7 @@ out_disable_device:
         return error;
 
 out_release_resources_and_disable:
+        pvscsi_shutdown_intr(adapter);
         pvscsi_release_resources(adapter);
         goto out_disable_device;
 }
diff --git a/drivers/staging/media/sunxi/cedrus/Kconfig b/drivers/staging/media/sunxi/cedrus/Kconfig
index a7a34e89c42d..3252efa422f9 100644
--- a/drivers/staging/media/sunxi/cedrus/Kconfig
+++ b/drivers/staging/media/sunxi/cedrus/Kconfig
@@ -3,6 +3,7 @@ config VIDEO_SUNXI_CEDRUS
         depends on VIDEO_DEV && VIDEO_V4L2 && MEDIA_CONTROLLER
         depends on HAS_DMA
         depends on OF
+        depends on MEDIA_CONTROLLER_REQUEST_API
         select SUNXI_SRAM
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
diff --git a/drivers/staging/media/sunxi/cedrus/TODO b/drivers/staging/media/sunxi/cedrus/TODO
index ec277ece47af..a951b3fd1ea1 100644
--- a/drivers/staging/media/sunxi/cedrus/TODO
+++ b/drivers/staging/media/sunxi/cedrus/TODO
@@ -5,3 +5,8 @@ Before this stateless decoder driver can leave the staging area:
 * Userspace support for the Request API needs to be reviewed;
 * Another stateless decoder driver should be submitted;
 * At least one stateless encoder driver should be submitted.
+* When queueing a request containing references to I frames, the
+  refcount of the memory for those I frames needs to be incremented
+  and decremented when the request is completed. This will likely
+  require some help from vb2. The driver should fail the request
+  if the memory/buffer is gone.
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
index 32adbcbe6175..07520a2ce179 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
@@ -255,10 +255,10 @@ int cedrus_hw_probe(struct cedrus_dev *dev)
 
         res = platform_get_resource(dev->pdev, IORESOURCE_MEM, 0);
         dev->base = devm_ioremap_resource(dev->dev, res);
-        if (!dev->base) {
+        if (IS_ERR(dev->base)) {
                 v4l2_err(&dev->v4l2_dev, "Failed to map registers\n");
 
-                ret = -ENOMEM;
+                ret = PTR_ERR(dev->base);
                 goto err_sram;
         }
 
diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c
index 9d156efbc9ed..4d473f008aa4 100644
--- a/drivers/staging/rtl8712/mlme_linux.c
+++ b/drivers/staging/rtl8712/mlme_linux.c
@@ -146,7 +146,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
                 p = buff;
                 p += sprintf(p, "ASSOCINFO(ReqIEs=");
                 len = sec_ie[1] + 2;
-                len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
+                len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
                 for (i = 0; i < len; i++)
                         p += sprintf(p, "%02x", sec_ie[i]);
                 p += sprintf(p, ")");
diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c
index a7374006a9fb..986a1d526918 100644
--- a/drivers/staging/rtl8712/rtl871x_mlme.c
+++ b/drivers/staging/rtl8712/rtl871x_mlme.c
@@ -1346,7 +1346,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
                      u8 *out_ie, uint in_len)
 {
         u8 authmode = 0, match;
-        u8 sec_ie[255], uncst_oui[4], bkup_ie[255];
+        u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
         u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
         uint ielength, cnt, remove_cnt;
         int iEntry;
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index 69c7abc0e3a5..8445d516c93d 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -1565,7 +1565,7 @@ unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
         if (pstat->aid > 0) {
                 DBG_871X("  old AID %d\n", pstat->aid);
         } else {
-                for (pstat->aid = 1; pstat->aid < NUM_STA; pstat->aid++)
+                for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
                                 break;
 
diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
index 92f67d40f2e9..d7105d01859a 100644
--- a/drivers/thermal/armada_thermal.c
+++ b/drivers/thermal/armada_thermal.c
@@ -357,7 +357,7 @@ static int armada_get_temp_legacy(struct thermal_zone_device *thermal,
         int ret;
 
         /* Valid check */
-        if (armada_is_valid(priv)) {
+        if (!armada_is_valid(priv)) {
                 dev_err(priv->dev,
                         "Temperature sensor reading not valid\n");
                 return -EIO;
@@ -395,7 +395,7 @@ unlock_mutex:
         return ret;
 }
 
-static struct thermal_zone_of_device_ops of_ops = {
+static const struct thermal_zone_of_device_ops of_ops = {
         .get_temp = armada_get_temp,
 };
 
@@ -526,23 +526,21 @@ static int armada_thermal_probe_legacy(struct platform_device *pdev,
 
         /* First memory region points towards the status register */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res)
-                return -EIO;
-
-        /*
-         * Edit the resource start address and length to map over all the
-         * registers, instead of pointing at them one by one.
-         */
-        res->start -= data->syscon_status_off;
-        res->end = res->start + max(data->syscon_status_off,
-                                    max(data->syscon_control0_off,
-                                        data->syscon_control1_off)) +
-                   sizeof(unsigned int) - 1;
-
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
                 return PTR_ERR(base);
 
+        /*
+         * Fix up from the old individual DT register specification to
+         * cover all the registers.  We do this by adjusting the ioremap()
+         * result, which should be fine as ioremap() deals with pages.
+         * However, validate that we do not cross a page boundary while
+         * making this adjustment.
+         */
+        if (((unsigned long)base & ~PAGE_MASK) < data->syscon_status_off)
+                return -EINVAL;
+        base -= data->syscon_status_off;
+
         priv->syscon = devm_regmap_init_mmio(&pdev->dev, base,
                                              &armada_thermal_regmap_config);
         if (IS_ERR(priv->syscon))
diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
index 23ad4f9f2143..b9d90f0ed504 100644
--- a/drivers/thermal/broadcom/bcm2835_thermal.c
+++ b/drivers/thermal/broadcom/bcm2835_thermal.c
@@ -1,17 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Driver for Broadcom BCM2835 SoC temperature sensor
  *
  * Copyright (C) 2016 Martin Sperl
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/clk.h>
diff --git a/drivers/thermal/broadcom/brcmstb_thermal.c b/drivers/thermal/broadcom/brcmstb_thermal.c
index 1919f91fa756..e8b1570cc388 100644
--- a/drivers/thermal/broadcom/brcmstb_thermal.c
+++ b/drivers/thermal/broadcom/brcmstb_thermal.c
@@ -299,7 +299,7 @@ static int brcmstb_set_trips(void *data, int low, int high)
         return 0;
 }
 
-static struct thermal_zone_of_device_ops of_ops = {
+static const struct thermal_zone_of_device_ops of_ops = {
         .get_temp       = brcmstb_get_temp,
         .set_trips      = brcmstb_set_trips,
 };
diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
index c4111a98f1a7..2d26ae80e202 100644
--- a/drivers/thermal/hisi_thermal.c
+++ b/drivers/thermal/hisi_thermal.c
@@ -424,7 +424,7 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data)
         struct platform_device *pdev = data->pdev;
         struct device *dev = &pdev->dev;
 
-        data->nr_sensors = 2;
+        data->nr_sensors = 1;
 
         data->sensor = devm_kzalloc(dev, sizeof(*data->sensor) *
                                     data->nr_sensors, GFP_KERNEL);
@@ -589,7 +589,7 @@ static int hisi_thermal_probe(struct platform_device *pdev)
                         return ret;
                 }
 
-                ret = platform_get_irq_byname(pdev, sensor->irq_name);
+                ret = platform_get_irq(pdev, 0);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/thermal/st/stm_thermal.c b/drivers/thermal/st/stm_thermal.c
index 47623da0f91b..bbd73c5a4a4e 100644
--- a/drivers/thermal/st/stm_thermal.c
+++ b/drivers/thermal/st/stm_thermal.c
@@ -241,8 +241,8 @@ static int stm_thermal_read_factory_settings(struct stm_thermal_sensor *sensor)
                 sensor->t0 = TS1_T0_VAL1;
 
         /* Retrieve fmt0 and put it on Hz */
-        sensor->fmt0 = ADJUST * readl_relaxed(sensor->base + DTS_T0VALR1_OFFSET)
-                                              & TS1_FMT0_MASK;
+        sensor->fmt0 = ADJUST * (readl_relaxed(sensor->base +
+                                 DTS_T0VALR1_OFFSET) & TS1_FMT0_MASK);
 
         /* Retrieve ramp coefficient */
         sensor->ramp_coeff = readl_relaxed(sensor->base + DTS_RAMPVALR_OFFSET) &
@@ -532,6 +532,10 @@ static int stm_thermal_prepare(struct stm_thermal_sensor *sensor)
         if (ret)
                 return ret;
 
+        ret = stm_thermal_read_factory_settings(sensor);
+        if (ret)
+                goto thermal_unprepare;
+
         ret = stm_thermal_calibration(sensor);
         if (ret)
                 goto thermal_unprepare;
@@ -636,10 +640,6 @@ static int stm_thermal_probe(struct platform_device *pdev)
         /* Populate sensor */
         sensor->base = base;
 
-        ret = stm_thermal_read_factory_settings(sensor);
-        if (ret)
-                return ret;
-
         sensor->clk = devm_clk_get(&pdev->dev, "pclk");
         if (IS_ERR(sensor->clk)) {
                 dev_err(&pdev->dev, "%s: failed to fetch PCLK clock\n",
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index dd5e1cede2b5..c3f933d10295 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -213,17 +213,17 @@ static int mtk8250_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, data);
 
-        pm_runtime_enable(&pdev->dev);
-        if (!pm_runtime_enabled(&pdev->dev)) {
-                err = mtk8250_runtime_resume(&pdev->dev);
-                if (err)
-                        return err;
-        }
+        err = mtk8250_runtime_resume(&pdev->dev);
+        if (err)
+                return err;
 
         data->line = serial8250_register_8250_port(&uart);
         if (data->line < 0)
                 return data->line;
 
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
         return 0;
 }
 
@@ -234,13 +234,11 @@ static int mtk8250_remove(struct platform_device *pdev)
         pm_runtime_get_sync(&pdev->dev);
 
         serial8250_unregister_port(data->line);
+        mtk8250_runtime_suspend(&pdev->dev);
 
         pm_runtime_disable(&pdev->dev);
         pm_runtime_put_noidle(&pdev->dev);
 
-        if (!pm_runtime_status_suspended(&pdev->dev))
-                mtk8250_runtime_suspend(&pdev->dev);
-
         return 0;
 }
 
diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
index baeeeaec3f03..6fb312e7af71 100644
--- a/drivers/tty/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c
@@ -233,7 +233,7 @@ static void kgdboc_put_char(u8 chr)
 static int param_set_kgdboc_var(const char *kmessage,
                                 const struct kernel_param *kp)
 {
-        int len = strlen(kmessage);
+        size_t len = strlen(kmessage);
 
         if (len >= MAX_CONFIG_LEN) {
                 pr_err("config string too long\n");
@@ -254,7 +254,7 @@ static int param_set_kgdboc_var(const char *kmessage,
 
         strcpy(config, kmessage);
         /* Chop out \n char as a result of echo */
-        if (config[len - 1] == '\n')
+        if (len && config[len - 1] == '\n')
                 config[len - 1] = '\0';
 
         if (configured == 1)
diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
index 70a4ea4eaa6e..990376576970 100644
--- a/drivers/tty/serial/suncore.c
+++ b/drivers/tty/serial/suncore.c
@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
                 mode = of_get_property(dp, mode_prop, NULL);
                 if (!mode)
                         mode = "9600,8,n,1,-";
+                of_node_put(dp);
         }
 
         cflag = CREAD | HUPCL | CLOCAL;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index ee80dfbd5442..687250ec8032 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1373,7 +1373,13 @@ err_release_lock:
         return ERR_PTR(retval);
 }
 
-static void tty_free_termios(struct tty_struct *tty)
+/**
+ * tty_save_termios() - save tty termios data in driver table
+ * @tty: tty whose termios data to save
+ *
+ * Locking: Caller guarantees serialisation with tty_init_termios().
+ */
+void tty_save_termios(struct tty_struct *tty)
 {
         struct ktermios *tp;
         int idx = tty->index;
@@ -1392,6 +1398,7 @@ static void tty_free_termios(struct tty_struct *tty)
         }
         *tp = tty->termios;
 }
+EXPORT_SYMBOL_GPL(tty_save_termios);
 
 /**
  *      tty_flush_works         -       flush all works of a tty/pty pair
@@ -1491,7 +1498,7 @@ static void release_tty(struct tty_struct *tty, int idx)
         WARN_ON(!mutex_is_locked(&tty_mutex));
         if (tty->ops->shutdown)
                 tty->ops->shutdown(tty);
-        tty_free_termios(tty);
+        tty_save_termios(tty);
         tty_driver_remove_tty(tty->driver, tty);
         tty->port->itty = NULL;
         if (tty->link)
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index cb6075096a5b..044c3cbdcfa4 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -633,7 +633,8 @@ void tty_port_close(struct tty_port *port, struct tty_struct *tty,
         if (tty_port_close_start(port, tty, filp) == 0)
                 return;
         tty_port_shutdown(port, tty);
-        set_bit(TTY_IO_ERROR, &tty->flags);
+        if (!port->console)
+                set_bit(TTY_IO_ERROR, &tty->flags);
         tty_port_close_end(port, tty);
         tty_port_tty_set(port, NULL);
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 0f9381b69a3b..f76b2e0aba9d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2251,7 +2251,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
                 /* descriptor may appear anywhere in config */
                 err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
                                 le16_to_cpu(udev->config[0].desc.wTotalLength),
-                                USB_DT_OTG, (void **) &desc);
+                                USB_DT_OTG, (void **) &desc, sizeof(*desc));
                 if (err || !(desc->bmAttributes & USB_OTG_HNP))
                         return 0;
 
@@ -5163,7 +5163,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
 /* Handle notifying userspace about hub over-current events */
 static void port_over_current_notify(struct usb_port *port_dev)
 {
-        static char *envp[] = { NULL, NULL, NULL };
+        char *envp[3];
         struct device *hub_dev;
         char *port_dev_path;
 
@@ -5187,6 +5187,7 @@ static void port_over_current_notify(struct usb_port *port_dev)
         if (!envp[1])
                 goto exit;
 
+        envp[2] = NULL;
         kobject_uevent_env(&hub_dev->kobj, KOBJ_CHANGE, envp);
 
         kfree(envp[1]);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0690fcff0ea2..514c5214ddb2 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -333,6 +333,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Midiman M-Audio Keystation 88es */
         { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* SanDisk Ultra Fit and Ultra Flair */
+        { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
+        { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
+
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 79d8bd7a612e..4ebfbd737905 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
  */
 
 int __usb_get_extra_descriptor(char *buffer, unsigned size,
-                               unsigned char type, void **ptr)
+                               unsigned char type, void **ptr, size_t minsize)
 {
         struct usb_descriptor_header *header;
 
         while (size >= sizeof(struct usb_descriptor_header)) {
                 header = (struct usb_descriptor_header *)buffer;
 
-                if (header->bLength < 2) {
+                if (header->bLength < 2 || header->bLength > size) {
                         printk(KERN_ERR
                                 "%s: bogus descriptor, type %d length %d\n",
                                 usbcore_name,
@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
                         return -1;
                 }
 
-                if (header->bDescriptorType == type) {
+                if (header->bDescriptorType == type && header->bLength >= minsize) {
                         *ptr = header;
                         return 0;
                 }
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 684d6f074c3a..09a8ebd95588 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -640,7 +640,7 @@ static int hwahc_security_create(struct hwahc *hwahc)
         top = itr + itr_size;
         result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
                         le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
-                        USB_DT_SECURITY, (void **) &secd);
+                        USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
         if (result == -1) {
                 dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
                 return 0;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index a9515265db4d..a9ec7051f286 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -139,6 +139,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  pdev->device == 0x43bb))
                 xhci->quirks |= XHCI_SUSPEND_DELAY;
 
+        if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+            (pdev->device == 0x15e0 || pdev->device == 0x15e1))
+                xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
+
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c928dbbff881..dae3be1b9c8f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -968,6 +968,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
         unsigned int            delay = XHCI_MAX_HALT_USEC;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
         u32                     command;
+        u32                     res;
 
         if (!hcd->state)
                 return 0;
@@ -1021,11 +1022,28 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
         command = readl(&xhci->op_regs->command);
         command |= CMD_CSS;
         writel(command, &xhci->op_regs->command);
+        xhci->broken_suspend = 0;
         if (xhci_handshake(&xhci->op_regs->status,
                                 STS_SAVE, 0, 10 * 1000)) {
-                xhci_warn(xhci, "WARN: xHC save state timeout\n");
-                spin_unlock_irq(&xhci->lock);
-                return -ETIMEDOUT;
+        /*
+         * AMD SNPS xHC 3.0 occasionally does not clear the
+         * SSS bit of USBSTS and when driver tries to poll
+         * to see if the xHC clears BIT(8) which never happens
+         * and driver assumes that controller is not responding
+         * and times out. To workaround this, its good to check
+         * if SRE and HCE bits are not set (as per xhci
+         * Section 5.4.2) and bypass the timeout.
+         */
+                res = readl(&xhci->op_regs->status);
+                if ((xhci->quirks & XHCI_SNPS_BROKEN_SUSPEND) &&
+                    (((res & STS_SRE) == 0) &&
+                                ((res & STS_HCE) == 0))) {
+                        xhci->broken_suspend = 1;
+                } else {
+                        xhci_warn(xhci, "WARN: xHC save state timeout\n");
+                        spin_unlock_irq(&xhci->lock);
+                        return -ETIMEDOUT;
+                }
         }
         spin_unlock_irq(&xhci->lock);
 
@@ -1078,7 +1096,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
         set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
 
         spin_lock_irq(&xhci->lock);
-        if (xhci->quirks & XHCI_RESET_ON_RESUME)
+        if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend)
                 hibernated = true;
 
         if (!hibernated) {
@@ -4496,6 +4514,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
 {
         unsigned long long timeout_ns;
 
+        /* Prevent U1 if service interval is shorter than U1 exit latency */
+        if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+                if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
+                        dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
+                        return USB3_LPM_DISABLED;
+                }
+        }
+
         if (xhci->quirks & XHCI_INTEL_HOST)
                 timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
         else
@@ -4552,6 +4578,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
 {
         unsigned long long timeout_ns;
 
+        /* Prevent U2 if service interval is shorter than U2 exit latency */
+        if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+                if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
+                        dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
+                        return USB3_LPM_DISABLED;
+                }
+        }
+
         if (xhci->quirks & XHCI_INTEL_HOST)
                 timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
         else
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 260b259b72bc..c3515bad5dbb 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1850,6 +1850,7 @@ struct xhci_hcd {
 #define XHCI_ZERO_64B_REGS      BIT_ULL(32)
 #define XHCI_DEFAULT_PM_RUNTIME_ALLOW   BIT_ULL(33)
 #define XHCI_RESET_PLL_ON_DISCONNECT    BIT_ULL(34)
+#define XHCI_SNPS_BROKEN_SUSPEND    BIT_ULL(35)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
@@ -1879,6 +1880,8 @@ struct xhci_hcd {
         void                    *dbc;
         /* platform-specific data -- must come last */
         unsigned long           priv[0] __aligned(sizeof(s64));
+        /* Broken Suspend flag for SNPS Suspend resume issue */
+        u8                      broken_suspend;
 };
 
 /* Platform specific overrides to generic XHCI hc_driver ops */
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 85b48c6ddc7e..39ca31b4de46 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -51,6 +51,7 @@ static const struct usb_device_id appledisplay_table[] = {
         { APPLEDISPLAY_DEVICE(0x921c) },
         { APPLEDISPLAY_DEVICE(0x921d) },
         { APPLEDISPLAY_DEVICE(0x9222) },
+        { APPLEDISPLAY_DEVICE(0x9226) },
         { APPLEDISPLAY_DEVICE(0x9236) },
 
         /* Terminating entry */
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 17940589c647..7d289302ff6c 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -101,7 +101,6 @@ static int usb_console_setup(struct console *co, char *options)
                 cflag |= PARENB;
                 break;
         }
-        co->cflag = cflag;
 
         /*
          * no need to check the index here: if the index is wrong, console
@@ -164,6 +163,7 @@ static int usb_console_setup(struct console *co, char *options)
                         serial->type->set_termios(tty, port, &dummy);
 
                         tty_port_tty_set(&port->port, NULL);
+                        tty_save_termios(tty);
                         tty_kref_put(tty);
                 }
                 tty_port_set_initialized(&port->port, 1);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3a5f81a66d34..6b98d8e3a5bf 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -944,10 +944,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d,
                 if (msg->iova <= vq_msg->iova &&
                     msg->iova + msg->size - 1 >= vq_msg->iova &&
                     vq_msg->type == VHOST_IOTLB_MISS) {
-                        mutex_lock(&node->vq->mutex);
                         vhost_poll_queue(&node->vq->poll);
-                        mutex_unlock(&node->vq->mutex);
-
                         list_del(&node->node);
                         kfree(node);
                 }
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 34bc3ab40c6d..98ed5be132c6 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -15,6 +15,7 @@
 #include <net/sock.h>
 #include <linux/virtio_vsock.h>
 #include <linux/vhost.h>
+#include <linux/hashtable.h>
 
 #include <net/af_vsock.h>
 #include "vhost.h"
@@ -27,14 +28,14 @@ enum {
 
 /* Used to track all the vhost_vsock instances on the system. */
 static DEFINE_SPINLOCK(vhost_vsock_lock);
-static LIST_HEAD(vhost_vsock_list);
+static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8);
 
 struct vhost_vsock {
         struct vhost_dev dev;
         struct vhost_virtqueue vqs[2];
 
-        /* Link to global vhost_vsock_list, protected by vhost_vsock_lock */
-        struct list_head list;
+        /* Link to global vhost_vsock_hash, writes use vhost_vsock_lock */
+        struct hlist_node hash;
 
         struct vhost_work send_pkt_work;
         spinlock_t send_pkt_list_lock;
@@ -50,11 +51,14 @@ static u32 vhost_transport_get_local_cid(void)
         return VHOST_VSOCK_DEFAULT_HOST_CID;
 }
 
-static struct vhost_vsock *__vhost_vsock_get(u32 guest_cid)
+/* Callers that dereference the return value must hold vhost_vsock_lock or the
+ * RCU read lock.
+ */
+static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
 {
         struct vhost_vsock *vsock;
 
-        list_for_each_entry(vsock, &vhost_vsock_list, list) {
+        hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) {
                 u32 other_cid = vsock->guest_cid;
 
                 /* Skip instances that have no CID yet */
@@ -69,17 +73,6 @@ static struct vhost_vsock *__vhost_vsock_get(u32 guest_cid)
         return NULL;
 }
 
-static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
-{
-        struct vhost_vsock *vsock;
-
-        spin_lock_bh(&vhost_vsock_lock);
-        vsock = __vhost_vsock_get(guest_cid);
-        spin_unlock_bh(&vhost_vsock_lock);
-
-        return vsock;
-}
-
 static void
 vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
                             struct vhost_virtqueue *vq)
@@ -210,9 +203,12 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         struct vhost_vsock *vsock;
         int len = pkt->len;
 
+        rcu_read_lock();
+
         /* Find the vhost_vsock according to guest context id  */
         vsock = vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid));
         if (!vsock) {
+                rcu_read_unlock();
                 virtio_transport_free_pkt(pkt);
                 return -ENODEV;
         }
@@ -225,6 +221,8 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         spin_unlock_bh(&vsock->send_pkt_list_lock);
 
         vhost_work_queue(&vsock->dev, &vsock->send_pkt_work);
+
+        rcu_read_unlock();
         return len;
 }
 
@@ -234,12 +232,15 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
         struct vhost_vsock *vsock;
         struct virtio_vsock_pkt *pkt, *n;
         int cnt = 0;
+        int ret = -ENODEV;
         LIST_HEAD(freeme);
 
+        rcu_read_lock();
+
         /* Find the vhost_vsock according to guest context id  */
         vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
         if (!vsock)
-                return -ENODEV;
+                goto out;
 
         spin_lock_bh(&vsock->send_pkt_list_lock);
         list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
@@ -265,7 +266,10 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
                         vhost_poll_queue(&tx_vq->poll);
         }
 
-        return 0;
+        ret = 0;
+out:
+        rcu_read_unlock();
+        return ret;
 }
 
 static struct virtio_vsock_pkt *
@@ -533,10 +537,6 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
         spin_lock_init(&vsock->send_pkt_list_lock);
         INIT_LIST_HEAD(&vsock->send_pkt_list);
         vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work);
-
-        spin_lock_bh(&vhost_vsock_lock);
-        list_add_tail(&vsock->list, &vhost_vsock_list);
-        spin_unlock_bh(&vhost_vsock_lock);
         return 0;
 
 out:
@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
          * executing.
          */
 
-        if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
-                sock_set_flag(sk, SOCK_DONE);
-                vsk->peer_shutdown = SHUTDOWN_MASK;
-                sk->sk_state = SS_UNCONNECTED;
-                sk->sk_err = ECONNRESET;
-                sk->sk_error_report(sk);
-        }
+        /* If the peer is still valid, no need to reset connection */
+        if (vhost_vsock_get(vsk->remote_addr.svm_cid))
+                return;
+
+        /* If the close timeout is pending, let it expire.  This avoids races
+         * with the timeout callback.
+         */
+        if (vsk->close_work_scheduled)
+                return;
+
+        sock_set_flag(sk, SOCK_DONE);
+        vsk->peer_shutdown = SHUTDOWN_MASK;
+        sk->sk_state = SS_UNCONNECTED;
+        sk->sk_err = ECONNRESET;
+        sk->sk_error_report(sk);
 }
 
 static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
@@ -577,9 +585,13 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
         struct vhost_vsock *vsock = file->private_data;
 
         spin_lock_bh(&vhost_vsock_lock);
-        list_del(&vsock->list);
+        if (vsock->guest_cid)
+                hash_del_rcu(&vsock->hash);
         spin_unlock_bh(&vhost_vsock_lock);
 
+        /* Wait for other CPUs to finish using vsock */
+        synchronize_rcu();
+
         /* Iterating over all connections for all CIDs to find orphans is
          * inefficient.  Room for improvement here. */
         vsock_for_each_connected_socket(vhost_vsock_reset_orphans);
@@ -620,12 +632,17 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
 
         /* Refuse if CID is already in use */
         spin_lock_bh(&vhost_vsock_lock);
-        other = __vhost_vsock_get(guest_cid);
+        other = vhost_vsock_get(guest_cid);
         if (other && other != vsock) {
                 spin_unlock_bh(&vhost_vsock_lock);
                 return -EADDRINUSE;
         }
+
+        if (vsock->guest_cid)
+                hash_del_rcu(&vsock->hash);
+
         vsock->guest_cid = guest_cid;
+        hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
         spin_unlock_bh(&vhost_vsock_lock);
 
         return 0;
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 678b27063198..f9ef0673a083 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -562,7 +562,30 @@ static int pwm_backlight_probe(struct platform_device *pdev)
                 goto err_alloc;
         }
 
-        if (!data->levels) {
+        if (data->levels) {
+                /*
+                 * For the DT case, only when brightness levels is defined
+                 * data->levels is filled. For the non-DT case, data->levels
+                 * can come from platform data, however is not usual.
+                 */
+                for (i = 0; i <= data->max_brightness; i++) {
+                        if (data->levels[i] > pb->scale)
+                                pb->scale = data->levels[i];
+
+                        pb->levels = data->levels;
+                }
+        } else if (!data->max_brightness) {
+                /*
+                 * If no brightness levels are provided and max_brightness is
+                 * not set, use the default brightness table. For the DT case,
+                 * max_brightness is set to 0 when brightness levels is not
+                 * specified. For the non-DT case, max_brightness is usually
+                 * set to some value.
+                 */
+
+                /* Get the PWM period (in nanoseconds) */
+                pwm_get_state(pb->pwm, &state);
+
                 ret = pwm_backlight_brightness_default(&pdev->dev, data,
                                                        state.period);
                 if (ret < 0) {
@@ -570,13 +593,19 @@ static int pwm_backlight_probe(struct platform_device *pdev)
                                 "failed to setup default brightness table\n");
                         goto err_alloc;
                 }
-        }
 
-        for (i = 0; i <= data->max_brightness; i++) {
-                if (data->levels[i] > pb->scale)
-                        pb->scale = data->levels[i];
+                for (i = 0; i <= data->max_brightness; i++) {
+                        if (data->levels[i] > pb->scale)
+                                pb->scale = data->levels[i];
 
-                pb->levels = data->levels;
+                        pb->levels = data->levels;
+                }
+        } else {
+                /*
+                 * That only happens for the non-DT case, where platform data
+                 * sets the max_brightness value.
+                 */
+                pb->scale = data->max_brightness;
         }
 
         pb->lth_brightness = data->lth_brightness * (state.period / pb->scale);
diff --git a/fs/aio.c b/fs/aio.c
index 97f983592925..aac9659381d2 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -45,6 +45,7 @@
 
 #include <asm/kmap_types.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 
 #include "internal.h"
 
@@ -1038,6 +1039,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
         if (!table || id >= table->nr)
                 goto out;
 
+        id = array_index_nospec(id, table->nr);
         ctx = rcu_dereference(table->table[id]);
         if (ctx && ctx->user_id == ctx_id) {
                 if (percpu_ref_tryget_live(&ctx->users))
diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
index efcf89a8ba44..1a4e2b101ef2 100644
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -389,13 +389,11 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
 
         /*
          * Here we don't really care about alignment since extent allocator can
-         * handle it.  We care more about the size, as if one block group is
-         * larger than maximum size, it's must be some obvious corruption.
+         * handle it.  We care more about the size.
          */
-        if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) {
+        if (key->offset == 0) {
                 block_group_err(fs_info, leaf, slot,
-                        "invalid block group size, have %llu expect (0, %llu]",
-                                key->offset, BTRFS_MAX_DATA_CHUNK_SIZE);
+                                "invalid block group size 0");
                 return -EUCLEAN;
         }
 
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index b5ecd6f50360..4e9a7cc488da 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -563,8 +563,8 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
                 seq_puts(m, ",noacl");
 #endif
 
-        if (fsopt->flags & CEPH_MOUNT_OPT_NOCOPYFROM)
-                seq_puts(m, ",nocopyfrom");
+        if ((fsopt->flags & CEPH_MOUNT_OPT_NOCOPYFROM) == 0)
+                seq_puts(m, ",copyfrom");
 
         if (fsopt->mds_namespace)
                 seq_show_option(m, "mds_namespace", fsopt->mds_namespace);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index c005a5400f2e..79a265ba9200 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -42,7 +42,9 @@
 #define CEPH_MOUNT_OPT_NOQUOTADF       (1<<13) /* no root dir quota in statfs */
 #define CEPH_MOUNT_OPT_NOCOPYFROM      (1<<14) /* don't use RADOS 'copy-from' op */
 
-#define CEPH_MOUNT_OPT_DEFAULT    CEPH_MOUNT_OPT_DCACHE
+#define CEPH_MOUNT_OPT_DEFAULT                  \
+        (CEPH_MOUNT_OPT_DCACHE |                \
+         CEPH_MOUNT_OPT_NOCOPYFROM)
 
 #define ceph_set_mount_opt(fsc, opt) \
         (fsc)->mount_options->flags |= CEPH_MOUNT_OPT_##opt;
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index abcd78e332fe..85dadb93c992 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -133,7 +133,7 @@ config CIFS_XATTR
 
 config CIFS_POSIX
         bool "CIFS POSIX Extensions"
-        depends on CIFS_XATTR
+        depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
         help
           Enabling this option will cause the cifs client to attempt to
           negotiate a newer dialect with servers, such as Samba 3.0.5
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 3713d22b95a7..907e85d65bb4 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -174,7 +174,7 @@ cifs_bp_rename_retry:
 
                 cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
                 memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
-                full_path[dfsplen] = '\\';
+                full_path[dfsplen] = dirsep;
                 for (i = 0; i < pplen-1; i++)
                         if (full_path[dfsplen+1+i] == '/')
                                 full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 74c33d5fafc8..c9bc56b1baac 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2541,14 +2541,13 @@ static int
 cifs_resend_wdata(struct cifs_writedata *wdata, struct list_head *wdata_list,
         struct cifs_aio_ctx *ctx)
 {
-        int wait_retry = 0;
         unsigned int wsize, credits;
         int rc;
         struct TCP_Server_Info *server =
                 tlink_tcon(wdata->cfile->tlink)->ses->server;
 
         /*
-         * Try to resend this wdata, waiting for credits up to 3 seconds.
+         * Wait for credits to resend this wdata.
          * Note: we are attempting to resend the whole wdata not in segments
          */
         do {
@@ -2556,19 +2555,13 @@ cifs_resend_wdata(struct cifs_writedata *wdata, struct list_head *wdata_list,
                         server, wdata->bytes, &wsize, &credits);
 
                 if (rc)
-                        break;
+                        goto out;
 
                 if (wsize < wdata->bytes) {
                         add_credits_and_wake_if(server, credits, 0);
                         msleep(1000);
-                        wait_retry++;
                 }
-        } while (wsize < wdata->bytes && wait_retry < 3);
-
-        if (wsize < wdata->bytes) {
-                rc = -EBUSY;
-                goto out;
-        }
+        } while (wsize < wdata->bytes);
 
         rc = -EAGAIN;
         while (rc == -EAGAIN) {
@@ -3234,14 +3227,13 @@ static int cifs_resend_rdata(struct cifs_readdata *rdata,
                         struct list_head *rdata_list,
                         struct cifs_aio_ctx *ctx)
 {
-        int wait_retry = 0;
         unsigned int rsize, credits;
         int rc;
         struct TCP_Server_Info *server =
                 tlink_tcon(rdata->cfile->tlink)->ses->server;
 
         /*
-         * Try to resend this rdata, waiting for credits up to 3 seconds.
+         * Wait for credits to resend this rdata.
          * Note: we are attempting to resend the whole rdata not in segments
          */
         do {
@@ -3249,24 +3241,13 @@ static int cifs_resend_rdata(struct cifs_readdata *rdata,
                                                 &rsize, &credits);
 
                 if (rc)
-                        break;
+                        goto out;
 
                 if (rsize < rdata->bytes) {
                         add_credits_and_wake_if(server, credits, 0);
                         msleep(1000);
-                        wait_retry++;
                 }
-        } while (rsize < rdata->bytes && wait_retry < 3);
-
-        /*
-         * If we can't find enough credits to send this rdata
-         * release the rdata and return failure, this will pass
-         * whatever I/O amount we have finished to VFS.
-         */
-        if (rsize < rdata->bytes) {
-                rc = -EBUSY;
-                goto out;
-        }
+        } while (rsize < rdata->bytes);
 
         rc = -EAGAIN;
         while (rc == -EAGAIN) {
diff --git a/fs/dax.c b/fs/dax.c
index 9bcce89ea18e..48132eca3761 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -232,6 +232,34 @@ static void *get_unlocked_entry(struct xa_state *xas)
         }
 }
 
+/*
+ * The only thing keeping the address space around is the i_pages lock
+ * (it's cycled in clear_inode() after removing the entries from i_pages)
+ * After we call xas_unlock_irq(), we cannot touch xas->xa.
+ */
+static void wait_entry_unlocked(struct xa_state *xas, void *entry)
+{
+        struct wait_exceptional_entry_queue ewait;
+        wait_queue_head_t *wq;
+
+        init_wait(&ewait.wait);
+        ewait.wait.func = wake_exceptional_entry_func;
+
+        wq = dax_entry_waitqueue(xas, entry, &ewait.key);
+        prepare_to_wait_exclusive(wq, &ewait.wait, TASK_UNINTERRUPTIBLE);
+        xas_unlock_irq(xas);
+        schedule();
+        finish_wait(wq, &ewait.wait);
+
+        /*
+         * Entry lock waits are exclusive. Wake up the next waiter since
+         * we aren't sure we will acquire the entry lock and thus wake
+         * the next waiter up on unlock.
+         */
+        if (waitqueue_active(wq))
+                __wake_up(wq, TASK_NORMAL, 1, &ewait.key);
+}
+
 static void put_unlocked_entry(struct xa_state *xas, void *entry)
 {
         /* If we were the only waiter woken, wake the next one */
@@ -351,21 +379,21 @@ static struct page *dax_busy_page(void *entry)
  * @page: The page whose entry we want to lock
  *
  * Context: Process context.
- * Return: %true if the entry was locked or does not need to be locked.
+ * Return: A cookie to pass to dax_unlock_page() or 0 if the entry could
+ * not be locked.
  */
-bool dax_lock_mapping_entry(struct page *page)
+dax_entry_t dax_lock_page(struct page *page)
 {
         XA_STATE(xas, NULL, 0);
         void *entry;
-        bool locked;
 
         /* Ensure page->mapping isn't freed while we look at it */
         rcu_read_lock();
         for (;;) {
                 struct address_space *mapping = READ_ONCE(page->mapping);
 
-                locked = false;
-                if (!dax_mapping(mapping))
+                entry = NULL;
+                if (!mapping || !dax_mapping(mapping))
                         break;
 
                 /*
@@ -375,7 +403,7 @@ bool dax_lock_mapping_entry(struct page *page)
                  * otherwise we would not have a valid pfn_to_page()
                  * translation.
                  */
-                locked = true;
+                entry = (void *)~0UL;
                 if (S_ISCHR(mapping->host->i_mode))
                         break;
 
@@ -389,9 +417,7 @@ bool dax_lock_mapping_entry(struct page *page)
                 entry = xas_load(&xas);
                 if (dax_is_locked(entry)) {
                         rcu_read_unlock();
-                        entry = get_unlocked_entry(&xas);
-                        xas_unlock_irq(&xas);
-                        put_unlocked_entry(&xas, entry);
+                        wait_entry_unlocked(&xas, entry);
                         rcu_read_lock();
                         continue;
                 }
@@ -400,23 +426,18 @@ bool dax_lock_mapping_entry(struct page *page)
                 break;
         }
         rcu_read_unlock();
-        return locked;
+        return (dax_entry_t)entry;
 }
 
-void dax_unlock_mapping_entry(struct page *page)
+void dax_unlock_page(struct page *page, dax_entry_t cookie)
 {
         struct address_space *mapping = page->mapping;
         XA_STATE(xas, &mapping->i_pages, page->index);
-        void *entry;
 
         if (S_ISCHR(mapping->host->i_mode))
                 return;
 
-        rcu_read_lock();
-        entry = xas_load(&xas);
-        rcu_read_unlock();
-        entry = dax_make_entry(page_to_pfn_t(page), dax_is_pmd_entry(entry));
-        dax_unlock_entry(&xas, entry);
+        dax_unlock_entry(&xas, (void *)cookie);
 }
 
 /*
diff --git a/fs/exec.c b/fs/exec.c
index acc3a5536384..fc281b738a98 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -62,7 +62,6 @@
 #include <linux/oom.h>
 #include <linux/compat.h>
 #include <linux/vmalloc.h>
-#include <linux/freezer.h>
 
 #include <linux/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1084,7 +1083,7 @@ static int de_thread(struct task_struct *tsk)
         while (sig->notify_count) {
                 __set_current_state(TASK_KILLABLE);
                 spin_unlock_irq(lock);
-                freezable_schedule();
+                schedule();
                 if (unlikely(__fatal_signal_pending(tsk)))
                         goto killed;
                 spin_lock_irq(lock);
@@ -1112,7 +1111,7 @@ static int de_thread(struct task_struct *tsk)
                         __set_current_state(TASK_KILLABLE);
                         write_unlock_irq(&tasklist_lock);
                         cgroup_threadgroup_change_end(tsk);
-                        freezable_schedule();
+                        schedule();
                         if (unlikely(__fatal_signal_pending(tsk)))
                                 goto killed;
                 }
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 47395b0c3b35..e909678afa2d 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1119,8 +1119,10 @@ static int fuse_permission(struct inode *inode, int mask)
         if (fc->default_permissions ||
             ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
                 struct fuse_inode *fi = get_fuse_inode(inode);
+                u32 perm_mask = STATX_MODE | STATX_UID | STATX_GID;
 
-                if (time_before64(fi->i_time, get_jiffies_64())) {
+                if (perm_mask & READ_ONCE(fi->inval_mask) ||
+                    time_before64(fi->i_time, get_jiffies_64())) {
                         refreshed = true;
 
                         err = fuse_perm_getattr(inode, mask);
@@ -1241,7 +1243,7 @@ static int fuse_dir_open(struct inode *inode, struct file *file)
 
 static int fuse_dir_release(struct inode *inode, struct file *file)
 {
-        fuse_release_common(file, FUSE_RELEASEDIR);
+        fuse_release_common(file, true);
 
         return 0;
 }
@@ -1249,7 +1251,25 @@ static int fuse_dir_release(struct inode *inode, struct file *file)
 static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,
                           int datasync)
 {
-        return fuse_fsync_common(file, start, end, datasync, 1);
+        struct inode *inode = file->f_mapping->host;
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        int err;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
+        if (fc->no_fsyncdir)
+                return 0;
+
+        inode_lock(inode);
+        err = fuse_fsync_common(file, start, end, datasync, FUSE_FSYNCDIR);
+        if (err == -ENOSYS) {
+                fc->no_fsyncdir = 1;
+                err = 0;
+        }
+        inode_unlock(inode);
+
+        return err;
 }
 
 static long fuse_dir_ioctl(struct file *file, unsigned int cmd,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index b52f9baaa3e7..ffaffe18352a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -89,12 +89,12 @@ static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
         iput(req->misc.release.inode);
 }
 
-static void fuse_file_put(struct fuse_file *ff, bool sync)
+static void fuse_file_put(struct fuse_file *ff, bool sync, bool isdir)
 {
         if (refcount_dec_and_test(&ff->count)) {
                 struct fuse_req *req = ff->reserved_req;
 
-                if (ff->fc->no_open) {
+                if (ff->fc->no_open && !isdir) {
                         /*
                          * Drop the release request when client does not
                          * implement 'open'
@@ -247,10 +247,11 @@ static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
         req->in.args[0].value = inarg;
 }
 
-void fuse_release_common(struct file *file, int opcode)
+void fuse_release_common(struct file *file, bool isdir)
 {
         struct fuse_file *ff = file->private_data;
         struct fuse_req *req = ff->reserved_req;
+        int opcode = isdir ? FUSE_RELEASEDIR : FUSE_RELEASE;
 
         fuse_prepare_release(ff, file->f_flags, opcode);
 
@@ -272,7 +273,7 @@ void fuse_release_common(struct file *file, int opcode)
          * synchronous RELEASE is allowed (and desirable) in this case
          * because the server can be trusted not to screw up.
          */
-        fuse_file_put(ff, ff->fc->destroy_req != NULL);
+        fuse_file_put(ff, ff->fc->destroy_req != NULL, isdir);
 }
 
 static int fuse_open(struct inode *inode, struct file *file)
@@ -288,7 +289,7 @@ static int fuse_release(struct inode *inode, struct file *file)
         if (fc->writeback_cache)
                 write_inode_now(inode, 1);
 
-        fuse_release_common(file, FUSE_RELEASE);
+        fuse_release_common(file, false);
 
         /* return value is ignored by VFS */
         return 0;
@@ -302,7 +303,7 @@ void fuse_sync_release(struct fuse_file *ff, int flags)
          * iput(NULL) is a no-op and since the refcount is 1 and everything's
          * synchronous, we are fine with not doing igrab() here"
          */
-        fuse_file_put(ff, true);
+        fuse_file_put(ff, true, false);
 }
 EXPORT_SYMBOL_GPL(fuse_sync_release);
 
@@ -441,13 +442,30 @@ static int fuse_flush(struct file *file, fl_owner_t id)
 }
 
 int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
-                      int datasync, int isdir)
+                      int datasync, int opcode)
 {
         struct inode *inode = file->f_mapping->host;
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_file *ff = file->private_data;
         FUSE_ARGS(args);
         struct fuse_fsync_in inarg;
+
+        memset(&inarg, 0, sizeof(inarg));
+        inarg.fh = ff->fh;
+        inarg.fsync_flags = datasync ? 1 : 0;
+        args.in.h.opcode = opcode;
+        args.in.h.nodeid = get_node_id(inode);
+        args.in.numargs = 1;
+        args.in.args[0].size = sizeof(inarg);
+        args.in.args[0].value = &inarg;
+        return fuse_simple_request(fc, &args);
+}
+
+static int fuse_fsync(struct file *file, loff_t start, loff_t end,
+                      int datasync)
+{
+        struct inode *inode = file->f_mapping->host;
+        struct fuse_conn *fc = get_fuse_conn(inode);
         int err;
 
         if (is_bad_inode(inode))
@@ -479,34 +497,18 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
         if (err)
                 goto out;
 
-        if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
+        if (fc->no_fsync)
                 goto out;
 
-        memset(&inarg, 0, sizeof(inarg));
-        inarg.fh = ff->fh;
-        inarg.fsync_flags = datasync ? 1 : 0;
-        args.in.h.opcode = isdir ? FUSE_FSYNCDIR : FUSE_FSYNC;
-        args.in.h.nodeid = get_node_id(inode);
-        args.in.numargs = 1;
-        args.in.args[0].size = sizeof(inarg);
-        args.in.args[0].value = &inarg;
-        err = fuse_simple_request(fc, &args);
+        err = fuse_fsync_common(file, start, end, datasync, FUSE_FSYNC);
         if (err == -ENOSYS) {
-                if (isdir)
-                        fc->no_fsyncdir = 1;
-                else
-                        fc->no_fsync = 1;
+                fc->no_fsync = 1;
                 err = 0;
         }
 out:
         inode_unlock(inode);
-        return err;
-}
 
-static int fuse_fsync(struct file *file, loff_t start, loff_t end,
-                      int datasync)
-{
-        return fuse_fsync_common(file, start, end, datasync, 0);
+        return err;
 }
 
 void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
@@ -807,7 +809,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
                 put_page(page);
         }
         if (req->ff)
-                fuse_file_put(req->ff, false);
+                fuse_file_put(req->ff, false, false);
 }
 
 static void fuse_send_readpages(struct fuse_req *req, struct file *file)
@@ -1460,7 +1462,7 @@ static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
                 __free_page(req->pages[i]);
 
         if (req->ff)
-                fuse_file_put(req->ff, false);
+                fuse_file_put(req->ff, false, false);
 }
 
 static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
@@ -1619,7 +1621,7 @@ int fuse_write_inode(struct inode *inode, struct writeback_control *wbc)
         ff = __fuse_write_file_get(fc, fi);
         err = fuse_flush_times(inode, ff);
         if (ff)
-                fuse_file_put(ff, 0);
+                fuse_file_put(ff, false, false);
 
         return err;
 }
@@ -1940,7 +1942,7 @@ static int fuse_writepages(struct address_space *mapping,
                 err = 0;
         }
         if (data.ff)
-                fuse_file_put(data.ff, false);
+                fuse_file_put(data.ff, false, false);
 
         kfree(data.orig_pages);
 out:
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index e9f712e81c7d..2f2c92e6f8cb 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -822,13 +822,13 @@ void fuse_sync_release(struct fuse_file *ff, int flags);
 /**
  * Send RELEASE or RELEASEDIR request
  */
-void fuse_release_common(struct file *file, int opcode);
+void fuse_release_common(struct file *file, bool isdir);
 
 /**
  * Send FSYNC or FSYNCDIR request
  */
 int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
-                      int datasync, int isdir);
+                      int datasync, int opcode);
 
 /**
  * Notify poll wakeup
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 0b94b23b02d4..568abed20eb2 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -115,7 +115,7 @@ static void fuse_i_callback(struct rcu_head *head)
 static void fuse_destroy_inode(struct inode *inode)
 {
         struct fuse_inode *fi = get_fuse_inode(inode);
-        if (S_ISREG(inode->i_mode)) {
+        if (S_ISREG(inode->i_mode) && !is_bad_inode(inode)) {
                 WARN_ON(!list_empty(&fi->write_files));
                 WARN_ON(!list_empty(&fi->queued_writes));
         }
@@ -1068,6 +1068,7 @@ void fuse_dev_free(struct fuse_dev *fud)
 
                 fuse_conn_put(fc);
         }
+        kfree(fud->pq.processing);
         kfree(fud);
 }
 EXPORT_SYMBOL_GPL(fuse_dev_free);
diff --git a/fs/iomap.c b/fs/iomap.c
index 3ffb776fbebe..5bc172f3dfe8 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,6 +116,12 @@ iomap_page_create(struct inode *inode, struct page *page)
         atomic_set(&iop->read_count, 0);
         atomic_set(&iop->write_count, 0);
         bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+
+        /*
+         * migrate_page_move_mapping() assumes that pages with private data have
+         * their count elevated by 1.
+         */
+        get_page(page);
         set_page_private(page, (unsigned long)iop);
         SetPagePrivate(page);
         return iop;
@@ -132,6 +138,7 @@ iomap_page_release(struct page *page)
         WARN_ON_ONCE(atomic_read(&iop->write_count));
         ClearPagePrivate(page);
         set_page_private(page, 0);
+        put_page(page);
         kfree(iop);
 }
 
@@ -1877,15 +1884,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
-
-                        /*
-                         * Splicing to pipes can fail on a full pipe. We have to
-                         * swallow this to make it look like a short IO
-                         * otherwise the higher splice layers will completely
-                         * mishandle the error and stop moving data.
-                         */
-                        if (ret == -EFAULT)
-                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index aa12c3063bae..33824a0a57bf 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -98,8 +98,11 @@ struct nfs_direct_req {
         struct pnfs_ds_commit_info ds_cinfo;    /* Storage for cinfo */
         struct work_struct      work;
         int                     flags;
+        /* for write */
 #define NFS_ODIRECT_DO_COMMIT           (1)     /* an unstable reply was received */
 #define NFS_ODIRECT_RESCHED_WRITES      (2)     /* write verification failed */
+        /* for read */
+#define NFS_ODIRECT_SHOULD_DIRTY        (3)     /* dirty user-space page after read */
         struct nfs_writeverf    verf;           /* unstable write verifier */
 };
 
@@ -412,7 +415,8 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
                 struct nfs_page *req = nfs_list_entry(hdr->pages.next);
                 struct page *page = req->wb_page;
 
-                if (!PageCompound(page) && bytes < hdr->good_bytes)
+                if (!PageCompound(page) && bytes < hdr->good_bytes &&
+                    (dreq->flags == NFS_ODIRECT_SHOULD_DIRTY))
                         set_page_dirty(page);
                 bytes += req->wb_bytes;
                 nfs_list_remove_request(req);
@@ -587,6 +591,9 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
         if (!is_sync_kiocb(iocb))
                 dreq->iocb = iocb;
 
+        if (iter_is_iovec(iter))
+                dreq->flags = NFS_ODIRECT_SHOULD_DIRTY;
+
         nfs_start_io_direct(inode);
 
         NFS_I(inode)->read_io += count;
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 74b36ed883ca..310d7500f665 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1733,7 +1733,8 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
         if (fh)
                 hdr->args.fh = fh;
 
-        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+        if (vers == 4 &&
+                !nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
                 goto out_failed;
 
         /*
@@ -1798,7 +1799,8 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         if (fh)
                 hdr->args.fh = fh;
 
-        if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+        if (vers == 4 &&
+                !nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
                 goto out_failed;
 
         /*
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index c6289147c787..82c129bfe58d 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -651,6 +651,18 @@ static int ovl_symlink(struct inode *dir, struct dentry *dentry,
         return ovl_create_object(dentry, S_IFLNK, 0, link);
 }
 
+static int ovl_set_link_redirect(struct dentry *dentry)
+{
+        const struct cred *old_cred;
+        int err;
+
+        old_cred = ovl_override_creds(dentry->d_sb);
+        err = ovl_set_redirect(dentry, false);
+        revert_creds(old_cred);
+
+        return err;
+}
+
 static int ovl_link(struct dentry *old, struct inode *newdir,
                     struct dentry *new)
 {
@@ -670,7 +682,7 @@ static int ovl_link(struct dentry *old, struct inode *newdir,
                 goto out_drop_write;
 
         if (ovl_is_metacopy_dentry(old)) {
-                err = ovl_set_redirect(old, false);
+                err = ovl_set_link_redirect(old);
                 if (err)
                         goto out_drop_write;
         }
diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
index 8fa37cd7818a..54e5d17d7f3e 100644
--- a/fs/overlayfs/export.c
+++ b/fs/overlayfs/export.c
@@ -754,9 +754,8 @@ static struct dentry *ovl_lower_fh_to_d(struct super_block *sb,
                 goto out;
         }
 
-        /* Otherwise, get a connected non-upper dir or disconnected non-dir */
-        if (d_is_dir(origin.dentry) &&
-            (origin.dentry->d_flags & DCACHE_DISCONNECTED)) {
+        /* Find origin.dentry again with ovl_acceptable() layer check */
+        if (d_is_dir(origin.dentry)) {
                 dput(origin.dentry);
                 origin.dentry = NULL;
                 err = ovl_check_origin_fh(ofs, fh, true, NULL, &stack);
@@ -769,6 +768,7 @@ static struct dentry *ovl_lower_fh_to_d(struct super_block *sb,
                         goto out_err;
         }
 
+        /* Get a connected non-upper dir or disconnected non-dir */
         dentry = ovl_get_dentry(sb, NULL, &origin, index);
 
 out:
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 6bcc9dedc342..3b7ed5d2279c 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -286,22 +286,13 @@ int ovl_permission(struct inode *inode, int mask)
         if (err)
                 return err;
 
-        /* No need to do any access on underlying for special files */
-        if (special_file(realinode->i_mode))
-                return 0;
-
-        /* No need to access underlying for execute */
-        mask &= ~MAY_EXEC;
-        if ((mask & (MAY_READ | MAY_WRITE)) == 0)
-                return 0;
-
-        /* Lower files get copied up, so turn write access into read */
-        if (!upperinode && mask & MAY_WRITE) {
+        old_cred = ovl_override_creds(inode->i_sb);
+        if (!upperinode &&
+            !special_file(realinode->i_mode) && mask & MAY_WRITE) {
                 mask &= ~(MAY_WRITE | MAY_APPEND);
+                /* Make sure mounter can read file for copy up later */
                 mask |= MAY_READ;
         }
-
-        old_cred = ovl_override_creds(inode->i_sb);
         err = inode_permission(realinode, mask);
         revert_creds(old_cred);
 
diff --git a/fs/read_write.c b/fs/read_write.c
index 4dae0399c75a..58f30537c47a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1956,7 +1956,7 @@ loff_t do_clone_file_range(struct file *file_in, loff_t pos_in,
         struct inode *inode_out = file_inode(file_out);
         loff_t ret;
 
-        WARN_ON_ONCE(remap_flags);
+        WARN_ON_ONCE(remap_flags & REMAP_FILE_DEDUP);
 
         if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
                 return -EISDIR;
diff --git a/fs/splice.c b/fs/splice.c
index 3553f1956508..de2ede048473 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -945,11 +945,16 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
         sd->flags &= ~SPLICE_F_NONBLOCK;
         more = sd->flags & SPLICE_F_MORE;
 
+        WARN_ON_ONCE(pipe->nrbufs != 0);
+
         while (len) {
                 size_t read_len;
                 loff_t pos = sd->pos, prev_pos = pos;
 
-                ret = do_splice_to(in, &pos, pipe, len, flags);
+                /* Don't try to read more the pipe has space for. */
+                read_len = min_t(size_t, len,
+                                 (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT);
+                ret = do_splice_to(in, &pos, pipe, read_len, flags);
                 if (unlikely(ret <= 0))
                         goto out_release;
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index cd58939dc977..7a85e609fc27 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1566,7 +1566,6 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
                 cond_resched();
 
                 BUG_ON(!vma_can_userfault(vma));
-                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
                 /*
                  * Nothing to do: this vma is already registered into this
@@ -1575,6 +1574,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
                 if (!vma->vm_userfaultfd_ctx.ctx)
                         goto skip;
 
+                WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
                 if (vma->vm_start > start)
                         start = vma->vm_start;
                 vma_end = min(end, vma->vm_end);
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 34c6d7bd4d18..bbdae2b4559f 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -330,7 +330,7 @@ xfs_btree_sblock_verify_crc(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(block->bb_u.s.bb_lsn)))
-                        return __this_address;
+                        return false;
                 return xfs_buf_verify_cksum(bp, XFS_BTREE_SBLOCK_CRC_OFF);
         }
 
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 404e581f1ea1..1ee8c5539fa4 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1126,9 +1126,9 @@ xfs_free_file_space(
          * page could be mmap'd and iomap_zero_range doesn't do that for us.
          * Writeback of the eof page will do this, albeit clumsily.
          */
-        if (offset + len >= XFS_ISIZE(ip) && ((offset + len) & PAGE_MASK)) {
+        if (offset + len >= XFS_ISIZE(ip) && offset_in_page(offset + len) > 0) {
                 error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
-                                (offset + len) & ~PAGE_MASK, LLONG_MAX);
+                                round_down(offset + len, PAGE_SIZE), LLONG_MAX);
         }
 
         return error;
diff --git a/fs/xfs/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c
index 73a1d77ec187..3091e4bc04ef 100644
--- a/fs/xfs/xfs_qm_bhv.c
+++ b/fs/xfs/xfs_qm_bhv.c
@@ -40,7 +40,7 @@ xfs_fill_statvfs_from_dquot(
                 statp->f_files = limit;
                 statp->f_ffree =
                         (statp->f_files > dqp->q_res_icount) ?
-                         (statp->f_ffree - dqp->q_res_icount) : 0;
+                         (statp->f_files - dqp->q_res_icount) : 0;
         }
 }
 
diff --git a/include/asm-generic/fixmap.h b/include/asm-generic/fixmap.h
index 827e4d3bbc7a..8cc7b09c1bc7 100644
--- a/include/asm-generic/fixmap.h
+++ b/include/asm-generic/fixmap.h
@@ -16,6 +16,7 @@
 #define __ASM_GENERIC_FIXMAP_H
 
 #include <linux/bug.h>
+#include <linux/mm_types.h>
 
 #define __fix_to_virt(x)        (FIXADDR_TOP - ((x) << PAGE_SHIFT))
 #define __virt_to_fix(x)        ((FIXADDR_TOP - ((x)&PAGE_MASK)) >> PAGE_SHIFT)
diff --git a/include/linux/dax.h b/include/linux/dax.h
index 450b28db9533..0dd316a74a29 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -7,6 +7,8 @@
 #include <linux/radix-tree.h>
 #include <asm/pgtable.h>
 
+typedef unsigned long dax_entry_t;
+
 struct iomap_ops;
 struct dax_device;
 struct dax_operations {
@@ -88,8 +90,8 @@ int dax_writeback_mapping_range(struct address_space *mapping,
                 struct block_device *bdev, struct writeback_control *wbc);
 
 struct page *dax_layout_busy_page(struct address_space *mapping);
-bool dax_lock_mapping_entry(struct page *page);
-void dax_unlock_mapping_entry(struct page *page);
+dax_entry_t dax_lock_page(struct page *page);
+void dax_unlock_page(struct page *page, dax_entry_t cookie);
 #else
 static inline bool bdev_dax_supported(struct block_device *bdev,
                 int blocksize)
@@ -122,14 +124,14 @@ static inline int dax_writeback_mapping_range(struct address_space *mapping,
         return -EOPNOTSUPP;
 }
 
-static inline bool dax_lock_mapping_entry(struct page *page)
+static inline dax_entry_t dax_lock_page(struct page *page)
 {
         if (IS_DAX(page->mapping->host))
-                return true;
-        return false;
+                return ~0UL;
+        return 0;
 }
 
-static inline void dax_unlock_mapping_entry(struct page *page)
+static inline void dax_unlock_page(struct page *page, dax_entry_t cookie)
 {
 }
 #endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 448dcc448f1f..795ff0b869bb 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -449,6 +449,13 @@ struct sock_reuseport;
         offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1
 #define bpf_ctx_range_till(TYPE, MEMBER1, MEMBER2)                              \
         offsetof(TYPE, MEMBER1) ... offsetofend(TYPE, MEMBER2) - 1
+#if BITS_PER_LONG == 64
+# define bpf_ctx_range_ptr(TYPE, MEMBER)                                        \
+        offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1
+#else
+# define bpf_ctx_range_ptr(TYPE, MEMBER)                                        \
+        offsetof(TYPE, MEMBER) ... offsetof(TYPE, MEMBER) + 8 - 1
+#endif /* BITS_PER_LONG == 64 */
 
 #define bpf_target_off(TYPE, MEMBER, SIZE, PTR_SIZE)                            \
         ({                                                                      \
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 76f8db0b0e71..0705164f928c 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -510,18 +510,22 @@ alloc_pages(gfp_t gfp_mask, unsigned int order)
 }
 extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
                         struct vm_area_struct *vma, unsigned long addr,
-                        int node);
+                        int node, bool hugepage);
+#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
+        alloc_pages_vma(gfp_mask, order, vma, addr, numa_node_id(), true)
 #else
 #define alloc_pages(gfp_mask, order) \
                 alloc_pages_node(numa_node_id(), gfp_mask, order)
-#define alloc_pages_vma(gfp_mask, order, vma, addr, node)\
+#define alloc_pages_vma(gfp_mask, order, vma, addr, node, false)\
+        alloc_pages(gfp_mask, order)
+#define alloc_hugepage_vma(gfp_mask, vma, addr, order) \
         alloc_pages(gfp_mask, order)
 #endif
 #define alloc_page(gfp_mask) alloc_pages(gfp_mask, 0)
 #define alloc_page_vma(gfp_mask, vma, addr)                     \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id())
+        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id(), false)
 #define alloc_page_vma_node(gfp_mask, vma, addr, node)          \
-        alloc_pages_vma(gfp_mask, 0, vma, addr, node)
+        alloc_pages_vma(gfp_mask, 0, vma, addr, node, false)
 
 extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
 extern unsigned long get_zeroed_page(gfp_t gfp_mask);
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index b3e24368930a..14131b6fae68 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -905,6 +905,13 @@ struct vmbus_channel {
 
         bool probe_done;
 
+        /*
+         * We must offload the handling of the primary/sub channels
+         * from the single-threaded vmbus_connection.work_queue to
+         * two different workqueue, otherwise we can block
+         * vmbus_connection.work_queue and hang: see vmbus_process_offer().
+         */
+        struct work_struct add_channel_work;
 };
 
 static inline bool is_hvsock_channel(const struct vmbus_channel *c)
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index bac395f1d00a..5228c62af416 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -139,8 +139,6 @@ struct mempolicy *mpol_shared_policy_lookup(struct shared_policy *sp,
 struct mempolicy *get_task_policy(struct task_struct *p);
 struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
                 unsigned long addr);
-struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
-                                                unsigned long addr);
 bool vma_policy_mof(struct vm_area_struct *vma);
 
 extern void numa_default_policy(void);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 5ed8f6292a53..2c471a2c43fa 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -206,6 +206,11 @@ struct page {
 #endif
 } _struct_page_alignment;
 
+/*
+ * Used for sizing the vmemmap region on some architectures
+ */
+#define STRUCT_PAGE_MAX_SHIFT   (order_base_2(sizeof(struct page)))
+
 #define PAGE_FRAG_CACHE_MAX_SIZE        __ALIGN_MASK(32768, ~PAGE_MASK)
 #define PAGE_FRAG_CACHE_MAX_ORDER       get_order(PAGE_FRAG_CACHE_MAX_SIZE)
 
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 847705a6d0ec..db023a92f3a4 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -783,6 +783,12 @@ void memory_present(int nid, unsigned long start, unsigned long end);
 static inline void memory_present(int nid, unsigned long start, unsigned long end) {}
 #endif
 
+#if defined(CONFIG_SPARSEMEM)
+void memblocks_present(void);
+#else
+static inline void memblocks_present(void) {}
+#endif
+
 #ifdef CONFIG_HAVE_MEMORYLESS_NODES
 int local_memory_node(int node_id);
 #else
diff --git a/include/linux/sfp.h b/include/linux/sfp.h
index d37518e89db2..d9d9de3fcf8e 100644
--- a/include/linux/sfp.h
+++ b/include/linux/sfp.h
@@ -224,7 +224,7 @@ struct sfp_eeprom_ext {
  *
  * See the SFF-8472 specification and related documents for the definition
  * of these structure members. This can be obtained from
- * ftp://ftp.seagate.com/sff
+ * https://www.snia.org/technology-communities/sff/specifications
  */
 struct sfp_eeprom_id {
         struct sfp_eeprom_base base;
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 43106ffa6788..2ec128060239 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -72,7 +72,6 @@ xdr_buf_init(struct xdr_buf *buf, void *start, size_t len)
         buf->head[0].iov_base = start;
         buf->head[0].iov_len = len;
         buf->tail[0].iov_len = 0;
-        buf->bvec = NULL;
         buf->pages = NULL;
         buf->page_len = 0;
         buf->flags = 0;
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 414db2bce715..392138fe59b6 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -556,6 +556,7 @@ extern struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx);
 extern void tty_release_struct(struct tty_struct *tty, int idx);
 extern int tty_release(struct inode *inode, struct file *filp);
 extern void tty_init_termios(struct tty_struct *tty);
+extern void tty_save_termios(struct tty_struct *tty);
 extern int tty_standard_install(struct tty_driver *driver,
                 struct tty_struct *tty);
 
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4cdd515a4385..5e49e82c4368 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -407,11 +407,11 @@ struct usb_host_bos {
 };
 
 int __usb_get_extra_descriptor(char *buffer, unsigned size,
-        unsigned char type, void **ptr);
+        unsigned char type, void **ptr, size_t min);
 #define usb_get_extra_descriptor(ifpoint, type, ptr) \
                                 __usb_get_extra_descriptor((ifpoint)->extra, \
                                 (ifpoint)->extralen, \
-                                type, (void **)ptr)
+                                type, (void **)ptr, sizeof(**(ptr)))
 
 /* ----------------------------------------------------------------------- */
 
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index 564892e19f8c..f492e21c4aa2 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -554,6 +554,60 @@ static inline void *xa_cmpxchg(struct xarray *xa, unsigned long index,
 }
 
 /**
+ * xa_cmpxchg_bh() - Conditionally replace an entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @old: Old value to test against.
+ * @entry: New value to place in array.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_cmpxchg() except it disables softirqs
+ * while holding the array lock.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.  May sleep if the @gfp flags permit.
+ * Return: The old value at this index or xa_err() if an error happened.
+ */
+static inline void *xa_cmpxchg_bh(struct xarray *xa, unsigned long index,
+                        void *old, void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_bh(xa);
+        curr = __xa_cmpxchg(xa, index, old, entry, gfp);
+        xa_unlock_bh(xa);
+
+        return curr;
+}
+
+/**
+ * xa_cmpxchg_irq() - Conditionally replace an entry in the XArray.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @old: Old value to test against.
+ * @entry: New value to place in array.
+ * @gfp: Memory allocation flags.
+ *
+ * This function is like calling xa_cmpxchg() except it disables interrupts
+ * while holding the array lock.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.  May sleep if the @gfp flags permit.
+ * Return: The old value at this index or xa_err() if an error happened.
+ */
+static inline void *xa_cmpxchg_irq(struct xarray *xa, unsigned long index,
+                        void *old, void *entry, gfp_t gfp)
+{
+        void *curr;
+
+        xa_lock_irq(xa);
+        curr = __xa_cmpxchg(xa, index, old, entry, gfp);
+        xa_unlock_irq(xa);
+
+        return curr;
+}
+
+/**
  * xa_insert() - Store this entry in the XArray unless another entry is
  *                      already present.
  * @xa: XArray.
diff --git a/include/media/media-request.h b/include/media/media-request.h
index 0ce75c35131f..bd36d7431698 100644
--- a/include/media/media-request.h
+++ b/include/media/media-request.h
@@ -68,7 +68,7 @@ struct media_request {
         unsigned int access_count;
         struct list_head objects;
         unsigned int num_incomplete_objects;
-        struct wait_queue_head poll_wait;
+        wait_queue_head_t poll_wait;
         spinlock_t lock;
 };
 
diff --git a/include/media/mpeg2-ctrls.h b/include/media/mpeg2-ctrls.h
new file mode 100644
index 000000000000..d21f40edc09e
--- /dev/null
+++ b/include/media/mpeg2-ctrls.h
@@ -0,0 +1,86 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * These are the MPEG2 state controls for use with stateless MPEG-2
+ * codec drivers.
+ *
+ * It turns out that these structs are not stable yet and will undergo
+ * more changes. So keep them private until they are stable and ready to
+ * become part of the official public API.
+ */
+
+#ifndef _MPEG2_CTRLS_H_
+#define _MPEG2_CTRLS_H_
+
+#define V4L2_CID_MPEG_VIDEO_MPEG2_SLICE_PARAMS          (V4L2_CID_MPEG_BASE+250)
+#define V4L2_CID_MPEG_VIDEO_MPEG2_QUANTIZATION          (V4L2_CID_MPEG_BASE+251)
+
+/* enum v4l2_ctrl_type type values */
+#define V4L2_CTRL_TYPE_MPEG2_SLICE_PARAMS 0x0103
+#define V4L2_CTRL_TYPE_MPEG2_QUANTIZATION 0x0104
+
+#define V4L2_MPEG2_PICTURE_CODING_TYPE_I        1
+#define V4L2_MPEG2_PICTURE_CODING_TYPE_P        2
+#define V4L2_MPEG2_PICTURE_CODING_TYPE_B        3
+#define V4L2_MPEG2_PICTURE_CODING_TYPE_D        4
+
+struct v4l2_mpeg2_sequence {
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Sequence header */
+        __u16   horizontal_size;
+        __u16   vertical_size;
+        __u32   vbv_buffer_size;
+
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Sequence extension */
+        __u8    profile_and_level_indication;
+        __u8    progressive_sequence;
+        __u8    chroma_format;
+        __u8    pad;
+};
+
+struct v4l2_mpeg2_picture {
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Picture header */
+        __u8    picture_coding_type;
+
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Picture coding extension */
+        __u8    f_code[2][2];
+        __u8    intra_dc_precision;
+        __u8    picture_structure;
+        __u8    top_field_first;
+        __u8    frame_pred_frame_dct;
+        __u8    concealment_motion_vectors;
+        __u8    q_scale_type;
+        __u8    intra_vlc_format;
+        __u8    alternate_scan;
+        __u8    repeat_first_field;
+        __u8    progressive_frame;
+        __u8    pad;
+};
+
+struct v4l2_ctrl_mpeg2_slice_params {
+        __u32   bit_size;
+        __u32   data_bit_offset;
+
+        struct v4l2_mpeg2_sequence sequence;
+        struct v4l2_mpeg2_picture picture;
+
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Slice */
+        __u8    quantiser_scale_code;
+
+        __u8    backward_ref_index;
+        __u8    forward_ref_index;
+        __u8    pad;
+};
+
+struct v4l2_ctrl_mpeg2_quantization {
+        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Quant matrix extension */
+        __u8    load_intra_quantiser_matrix;
+        __u8    load_non_intra_quantiser_matrix;
+        __u8    load_chroma_intra_quantiser_matrix;
+        __u8    load_chroma_non_intra_quantiser_matrix;
+
+        __u8    intra_quantiser_matrix[64];
+        __u8    non_intra_quantiser_matrix[64];
+        __u8    chroma_intra_quantiser_matrix[64];
+        __u8    chroma_non_intra_quantiser_matrix[64];
+};
+
+#endif
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index 83ce0593b275..d63cf227b0ab 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -22,6 +22,12 @@
 #include <linux/videodev2.h>
 #include <media/media-request.h>
 
+/*
+ * Include the mpeg2 stateless codec compound control definitions.
+ * This will move to the public headers once this API is fully stable.
+ */
+#include <media/mpeg2-ctrls.h>
+
 /* forward references */
 struct file;
 struct v4l2_ctrl_handler;
diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
index e86981d615ae..4a737b2c610b 100644
--- a/include/media/videobuf2-core.h
+++ b/include/media/videobuf2-core.h
@@ -239,6 +239,7 @@ struct vb2_queue;
  * @num_planes:         number of planes in the buffer
  *                      on an internal driver queue.
  * @timestamp:          frame timestamp in ns.
+ * @request:            the request this buffer is associated with.
  * @req_obj:            used to bind this buffer to a request. This
  *                      request object has a refcount.
  */
@@ -249,6 +250,7 @@ struct vb2_buffer {
         unsigned int            memory;
         unsigned int            num_planes;
         u64                     timestamp;
+        struct media_request    *request;
         struct media_request_object     req_obj;
 
         /* private: internal use only
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index f58b384aa6c9..665990c7dec8 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -454,6 +454,7 @@ static inline int neigh_hh_bridge(struct hh_cache *hh, struct sk_buff *skb)
 
 static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb)
 {
+        unsigned int hh_alen = 0;
         unsigned int seq;
         unsigned int hh_len;
 
@@ -461,16 +462,33 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb
                 seq = read_seqbegin(&hh->hh_lock);
                 hh_len = hh->hh_len;
                 if (likely(hh_len <= HH_DATA_MOD)) {
-                        /* this is inlined by gcc */
-                        memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);
+                        hh_alen = HH_DATA_MOD;
+
+                        /* skb_push() would proceed silently if we have room for
+                         * the unaligned size but not for the aligned size:
+                         * check headroom explicitly.
+                         */
+                        if (likely(skb_headroom(skb) >= HH_DATA_MOD)) {
+                                /* this is inlined by gcc */
+                                memcpy(skb->data - HH_DATA_MOD, hh->hh_data,
+                                       HH_DATA_MOD);
+                        }
                 } else {
-                        unsigned int hh_alen = HH_DATA_ALIGN(hh_len);
+                        hh_alen = HH_DATA_ALIGN(hh_len);
 
-                        memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
+                        if (likely(skb_headroom(skb) >= hh_alen)) {
+                                memcpy(skb->data - hh_alen, hh->hh_data,
+                                       hh_alen);
+                        }
                 }
         } while (read_seqretry(&hh->hh_lock, seq));
 
-        skb_push(skb, hh_len);
+        if (WARN_ON_ONCE(skb_headroom(skb) < hh_alen)) {
+                kfree_skb(skb);
+                return NET_XMIT_DROP;
+        }
+
+        __skb_push(skb, hh_len);
         return dev_queue_xmit(skb);
 }
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index ab9242e51d9e..2abbc15824af 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -620,4 +620,9 @@ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
         return false;
 }
 
+static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
+{
+        return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index a11f93790476..feada358d872 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -2075,6 +2075,8 @@ struct sctp_association {
 
         __u64 abandoned_unsent[SCTP_PR_INDEX(MAX) + 1];
         __u64 abandoned_sent[SCTP_PR_INDEX(MAX) + 1];
+
+        struct rcu_head rcu;
 };
 
 
diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h
index 2dd37cada7c0..888a833d3b00 100644
--- a/include/sound/pcm_params.h
+++ b/include/sound/pcm_params.h
@@ -254,11 +254,13 @@ static inline int snd_interval_empty(const struct snd_interval *i)
 static inline int snd_interval_single(const struct snd_interval *i)
 {
         return (i->min == i->max || 
-                (i->min + 1 == i->max && i->openmax));
+                (i->min + 1 == i->max && (i->openmin || i->openmax)));
 }
 
 static inline int snd_interval_value(const struct snd_interval *i)
 {
+        if (i->openmin && !i->openmax)
+                return i->max;
         return i->min;
 }
 
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 538546edbfbd..c7f3321fbe43 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -760,8 +760,10 @@ __SYSCALL(__NR_rseq, sys_rseq)
 #define __NR_ftruncate __NR3264_ftruncate
 #define __NR_lseek __NR3264_lseek
 #define __NR_sendfile __NR3264_sendfile
+#if defined(__ARCH_WANT_NEW_STAT) || defined(__ARCH_WANT_STAT64)
 #define __NR_newfstatat __NR3264_fstatat
 #define __NR_fstat __NR3264_fstat
+#endif
 #define __NR_mmap __NR3264_mmap
 #define __NR_fadvise64 __NR3264_fadvise64
 #ifdef __NR3264_stat
@@ -776,8 +778,10 @@ __SYSCALL(__NR_rseq, sys_rseq)
 #define __NR_ftruncate64 __NR3264_ftruncate
 #define __NR_llseek __NR3264_lseek
 #define __NR_sendfile64 __NR3264_sendfile
+#if defined(__ARCH_WANT_NEW_STAT) || defined(__ARCH_WANT_STAT64)
 #define __NR_fstatat64 __NR3264_fstatat
 #define __NR_fstat64 __NR3264_fstat
+#endif
 #define __NR_mmap2 __NR3264_mmap
 #define __NR_fadvise64_64 __NR3264_fadvise64
 #ifdef __NR3264_stat
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 852dc17ab47a..72c453a8bf50 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2170,7 +2170,7 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
- * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 flags)
  *      Description
  *              Look for TCP socket matching *tuple*, optionally in a child
  *              network namespace *netns*. The return value must be checked,
@@ -2187,12 +2187,14 @@ union bpf_attr {
  *              **sizeof**\ (*tuple*\ **->ipv6**)
  *                      Look for an IPv6 socket.
  *
- *              If the *netns* is zero, then the socket lookup table in the
- *              netns associated with the *ctx* will be used. For the TC hooks,
- *              this in the netns of the device in the skb. For socket hooks,
- *              this in the netns of the socket. If *netns* is non-zero, then
- *              it specifies the ID of the netns relative to the netns
- *              associated with the *ctx*.
+ *              If the *netns* is a negative signed 32-bit integer, then the
+ *              socket lookup table in the netns associated with the *ctx* will
+ *              will be used. For the TC hooks, this is the netns of the device
+ *              in the skb. For socket hooks, this is the netns of the socket.
+ *              If *netns* is any other signed 32-bit value greater than or
+ *              equal to zero then it specifies the ID of the netns relative to
+ *              the netns associated with the *ctx*. *netns* values beyond the
+ *              range of 32-bit integers are reserved for future use.
  *
  *              All values for *flags* are reserved for future usage, and must
  *              be left at zero.
@@ -2201,8 +2203,10 @@ union bpf_attr {
  *              **CONFIG_NET** configuration option.
  *      Return
  *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *              For sockets with reuseport option, the *struct bpf_sock*
+ *              result is from reuse->socks[] using the hash of the tuple.
  *
- * struct bpf_sock *bpf_sk_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ * struct bpf_sock *bpf_sk_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 flags)
  *      Description
  *              Look for UDP socket matching *tuple*, optionally in a child
  *              network namespace *netns*. The return value must be checked,
@@ -2219,12 +2223,14 @@ union bpf_attr {
  *              **sizeof**\ (*tuple*\ **->ipv6**)
  *                      Look for an IPv6 socket.
  *
- *              If the *netns* is zero, then the socket lookup table in the
- *              netns associated with the *ctx* will be used. For the TC hooks,
- *              this in the netns of the device in the skb. For socket hooks,
- *              this in the netns of the socket. If *netns* is non-zero, then
- *              it specifies the ID of the netns relative to the netns
- *              associated with the *ctx*.
+ *              If the *netns* is a negative signed 32-bit integer, then the
+ *              socket lookup table in the netns associated with the *ctx* will
+ *              will be used. For the TC hooks, this is the netns of the device
+ *              in the skb. For socket hooks, this is the netns of the socket.
+ *              If *netns* is any other signed 32-bit value greater than or
+ *              equal to zero then it specifies the ID of the netns relative to
+ *              the netns associated with the *ctx*. *netns* values beyond the
+ *              range of 32-bit integers are reserved for future use.
  *
  *              All values for *flags* are reserved for future usage, and must
  *              be left at zero.
@@ -2233,6 +2239,8 @@ union bpf_attr {
  *              **CONFIG_NET** configuration option.
  *      Return
  *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *              For sockets with reuseport option, the *struct bpf_sock*
+ *              result is from reuse->socks[] using the hash of the tuple.
  *
  * int bpf_sk_release(struct bpf_sock *sk)
  *      Description
@@ -2405,6 +2413,9 @@ enum bpf_func_id {
 /* BPF_FUNC_perf_event_output for sk_buff input context. */
 #define BPF_F_CTXLEN_MASK               (0xfffffULL << 32)
 
+/* Current network namespace */
+#define BPF_F_CURRENT_NETNS             (-1L)
+
 /* Mode for BPF_FUNC_skb_adjust_room helper. */
 enum bpf_adj_room_mode {
         BPF_ADJ_ROOM_NET,
@@ -2422,6 +2433,12 @@ enum bpf_lwt_encap_mode {
         BPF_LWT_ENCAP_SEG6_INLINE
 };
 
+#define __bpf_md_ptr(type, name)        \
+union {                                 \
+        type name;                      \
+        __u64 :64;                      \
+} __attribute__((aligned(8)))
+
 /* user accessible mirror of in-kernel sk_buff.
  * new fields can only be added to the end of this structure
  */
@@ -2456,7 +2473,7 @@ struct __sk_buff {
         /* ... here. */
 
         __u32 data_meta;
-        struct bpf_flow_keys *flow_keys;
+        __bpf_md_ptr(struct bpf_flow_keys *, flow_keys);
 };
 
 struct bpf_tunnel_key {
@@ -2572,8 +2589,8 @@ enum sk_action {
  * be added to the end of this structure
  */
 struct sk_msg_md {
-        void *data;
-        void *data_end;
+        __bpf_md_ptr(void *, data);
+        __bpf_md_ptr(void *, data_end);
 
         __u32 family;
         __u32 remote_ip4;       /* Stored in network byte order */
@@ -2589,8 +2606,9 @@ struct sk_reuseport_md {
          * Start of directly accessible data. It begins from
          * the tcp/udp header.
          */
-        void *data;
-        void *data_end;         /* End of directly accessible data */
+        __bpf_md_ptr(void *, data);
+        /* End of directly accessible data */
+        __bpf_md_ptr(void *, data_end);
         /*
          * Total length of packet (starting from the tcp/udp header).
          * Note that the directly accessible bytes (data_end - data)
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 3eb5a4c3d60a..ae366b87426a 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -752,6 +752,15 @@
 
 #define ABS_MISC                0x28
 
+/*
+ * 0x2e is reserved and should not be used in input drivers.
+ * It was used by HID as ABS_MISC+6 and userspace needs to detect if
+ * the next ABS_* event is correct or is just ABS_MISC + n.
+ * We define here ABS_RESERVED so userspace can rely on it and detect
+ * the situation described above.
+ */
+#define ABS_RESERVED            0x2e
+
 #define ABS_MT_SLOT             0x2f    /* MT slot being modified */
 #define ABS_MT_TOUCH_MAJOR      0x30    /* Major axis of touching ellipse */
 #define ABS_MT_TOUCH_MINOR      0x31    /* Minor axis (omit if circular) */
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 998983a6e6b7..3dcfc6148f99 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -404,9 +404,6 @@ enum v4l2_mpeg_video_multi_slice_mode {
 #define V4L2_CID_MPEG_VIDEO_MV_V_SEARCH_RANGE           (V4L2_CID_MPEG_BASE+228)
 #define V4L2_CID_MPEG_VIDEO_FORCE_KEY_FRAME             (V4L2_CID_MPEG_BASE+229)
 
-#define V4L2_CID_MPEG_VIDEO_MPEG2_SLICE_PARAMS          (V4L2_CID_MPEG_BASE+250)
-#define V4L2_CID_MPEG_VIDEO_MPEG2_QUANTIZATION          (V4L2_CID_MPEG_BASE+251)
-
 #define V4L2_CID_MPEG_VIDEO_H263_I_FRAME_QP             (V4L2_CID_MPEG_BASE+300)
 #define V4L2_CID_MPEG_VIDEO_H263_P_FRAME_QP             (V4L2_CID_MPEG_BASE+301)
 #define V4L2_CID_MPEG_VIDEO_H263_B_FRAME_QP             (V4L2_CID_MPEG_BASE+302)
@@ -1097,69 +1094,4 @@ enum v4l2_detect_md_mode {
 #define V4L2_CID_DETECT_MD_THRESHOLD_GRID       (V4L2_CID_DETECT_CLASS_BASE + 3)
 #define V4L2_CID_DETECT_MD_REGION_GRID          (V4L2_CID_DETECT_CLASS_BASE + 4)
 
-#define V4L2_MPEG2_PICTURE_CODING_TYPE_I        1
-#define V4L2_MPEG2_PICTURE_CODING_TYPE_P        2
-#define V4L2_MPEG2_PICTURE_CODING_TYPE_B        3
-#define V4L2_MPEG2_PICTURE_CODING_TYPE_D        4
-
-struct v4l2_mpeg2_sequence {
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Sequence header */
-        __u16   horizontal_size;
-        __u16   vertical_size;
-        __u32   vbv_buffer_size;
-
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Sequence extension */
-        __u8    profile_and_level_indication;
-        __u8    progressive_sequence;
-        __u8    chroma_format;
-        __u8    pad;
-};
-
-struct v4l2_mpeg2_picture {
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Picture header */
-        __u8    picture_coding_type;
-
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Picture coding extension */
-        __u8    f_code[2][2];
-        __u8    intra_dc_precision;
-        __u8    picture_structure;
-        __u8    top_field_first;
-        __u8    frame_pred_frame_dct;
-        __u8    concealment_motion_vectors;
-        __u8    q_scale_type;
-        __u8    intra_vlc_format;
-        __u8    alternate_scan;
-        __u8    repeat_first_field;
-        __u8    progressive_frame;
-        __u8    pad;
-};
-
-struct v4l2_ctrl_mpeg2_slice_params {
-        __u32   bit_size;
-        __u32   data_bit_offset;
-
-        struct v4l2_mpeg2_sequence sequence;
-        struct v4l2_mpeg2_picture picture;
-
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Slice */
-        __u8    quantiser_scale_code;
-
-        __u8    backward_ref_index;
-        __u8    forward_ref_index;
-        __u8    pad;
-};
-
-struct v4l2_ctrl_mpeg2_quantization {
-        /* ISO/IEC 13818-2, ITU-T Rec. H.262: Quant matrix extension */
-        __u8    load_intra_quantiser_matrix;
-        __u8    load_non_intra_quantiser_matrix;
-        __u8    load_chroma_intra_quantiser_matrix;
-        __u8    load_chroma_non_intra_quantiser_matrix;
-
-        __u8    intra_quantiser_matrix[64];
-        __u8    non_intra_quantiser_matrix[64];
-        __u8    chroma_intra_quantiser_matrix[64];
-        __u8    chroma_non_intra_quantiser_matrix[64];
-};
-
 #endif
diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
index c8e8ff810190..2ba2ad0e23fb 100644
--- a/include/uapi/linux/videodev2.h
+++ b/include/uapi/linux/videodev2.h
@@ -1622,8 +1622,6 @@ struct v4l2_ext_control {
                 __u8 __user *p_u8;
                 __u16 __user *p_u16;
                 __u32 __user *p_u32;
-                struct v4l2_ctrl_mpeg2_slice_params __user *p_mpeg2_slice_params;
-                struct v4l2_ctrl_mpeg2_quantization __user *p_mpeg2_quantization;
                 void __user *ptr;
         };
 } __attribute__ ((packed));
@@ -1669,8 +1667,6 @@ enum v4l2_ctrl_type {
         V4L2_CTRL_TYPE_U8            = 0x0100,
         V4L2_CTRL_TYPE_U16           = 0x0101,
         V4L2_CTRL_TYPE_U32           = 0x0102,
-        V4L2_CTRL_TYPE_MPEG2_SLICE_PARAMS = 0x0103,
-        V4L2_CTRL_TYPE_MPEG2_QUANTIZATION = 0x0104,
 };
 
 /*  Used in the VIDIOC_QUERYCTRL ioctl for querying controls */
diff --git a/init/Kconfig b/init/Kconfig
index cf5b5a0dcbc2..ed9352513c32 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -515,8 +515,8 @@ config PSI_DEFAULT_DISABLED
         depends on PSI
         help
           If set, pressure stall information tracking will be disabled
-          per default but can be enabled through passing psi_enable=1
-          on the kernel commandline during boot.
+          per default but can be enabled through passing psi=1 on the
+          kernel commandline during boot.
 
 endmenu # "CPU/Task time and stats accounting"
 
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index ee4c82667d65..4da543d6bea2 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5,6 +5,7 @@
 #include <uapi/linux/types.h>
 #include <linux/seq_file.h>
 #include <linux/compiler.h>
+#include <linux/ctype.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/anon_inodes.h>
@@ -426,6 +427,30 @@ static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
                 offset < btf->hdr.str_len;
 }
 
+/* Only C-style identifier is permitted. This can be relaxed if
+ * necessary.
+ */
+static bool btf_name_valid_identifier(const struct btf *btf, u32 offset)
+{
+        /* offset must be valid */
+        const char *src = &btf->strings[offset];
+        const char *src_limit;
+
+        if (!isalpha(*src) && *src != '_')
+                return false;
+
+        /* set a limit on identifier length */
+        src_limit = src + KSYM_NAME_LEN;
+        src++;
+        while (*src && src < src_limit) {
+                if (!isalnum(*src) && *src != '_')
+                        return false;
+                src++;
+        }
+
+        return !*src;
+}
+
 static const char *btf_name_by_offset(const struct btf *btf, u32 offset)
 {
         if (!offset)
@@ -1143,6 +1168,22 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env,
                 return -EINVAL;
         }
 
+        /* typedef type must have a valid name, and other ref types,
+         * volatile, const, restrict, should have a null name.
+         */
+        if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) {
+                if (!t->name_off ||
+                    !btf_name_valid_identifier(env->btf, t->name_off)) {
+                        btf_verifier_log_type(env, t, "Invalid name");
+                        return -EINVAL;
+                }
+        } else {
+                if (t->name_off) {
+                        btf_verifier_log_type(env, t, "Invalid name");
+                        return -EINVAL;
+                }
+        }
+
         btf_verifier_log_type(env, t, NULL);
 
         return 0;
@@ -1300,6 +1341,13 @@ static s32 btf_fwd_check_meta(struct btf_verifier_env *env,
                 return -EINVAL;
         }
 
+        /* fwd type must have a valid name */
+        if (!t->name_off ||
+            !btf_name_valid_identifier(env->btf, t->name_off)) {
+                btf_verifier_log_type(env, t, "Invalid name");
+                return -EINVAL;
+        }
+
         btf_verifier_log_type(env, t, NULL);
 
         return 0;
@@ -1356,6 +1404,12 @@ static s32 btf_array_check_meta(struct btf_verifier_env *env,
                 return -EINVAL;
         }
 
+        /* array type should not have a name */
+        if (t->name_off) {
+                btf_verifier_log_type(env, t, "Invalid name");
+                return -EINVAL;
+        }
+
         if (btf_type_vlen(t)) {
                 btf_verifier_log_type(env, t, "vlen != 0");
                 return -EINVAL;
@@ -1532,6 +1586,13 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                 return -EINVAL;
         }
 
+        /* struct type either no name or a valid one */
+        if (t->name_off &&
+            !btf_name_valid_identifier(env->btf, t->name_off)) {
+                btf_verifier_log_type(env, t, "Invalid name");
+                return -EINVAL;
+        }
+
         btf_verifier_log_type(env, t, NULL);
 
         last_offset = 0;
@@ -1543,6 +1604,12 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /* struct member either no name or a valid one */
+                if (member->name_off &&
+                    !btf_name_valid_identifier(btf, member->name_off)) {
+                        btf_verifier_log_member(env, t, member, "Invalid name");
+                        return -EINVAL;
+                }
                 /* A member cannot be in type void */
                 if (!member->type || !BTF_TYPE_ID_VALID(member->type)) {
                         btf_verifier_log_member(env, t, member,
@@ -1730,6 +1797,13 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
                 return -EINVAL;
         }
 
+        /* enum type either no name or a valid one */
+        if (t->name_off &&
+            !btf_name_valid_identifier(env->btf, t->name_off)) {
+                btf_verifier_log_type(env, t, "Invalid name");
+                return -EINVAL;
+        }
+
         btf_verifier_log_type(env, t, NULL);
 
         for (i = 0; i < nr_enums; i++) {
@@ -1739,6 +1813,14 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /* enum member must have a valid name */
+                if (!enums[i].name_off ||
+                    !btf_name_valid_identifier(btf, enums[i].name_off)) {
+                        btf_verifier_log_type(env, t, "Invalid name");
+                        return -EINVAL;
+                }
+
+
                 btf_verifier_log(env, "\t%s val=%d\n",
                                  btf_name_by_offset(btf, enums[i].name_off),
                                  enums[i].val);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6dd419550aba..fc760d00a38c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -175,6 +175,7 @@ struct bpf_verifier_stack_elem {
 
 #define BPF_COMPLEXITY_LIMIT_INSNS      131072
 #define BPF_COMPLEXITY_LIMIT_STACK      1024
+#define BPF_COMPLEXITY_LIMIT_STATES     64
 
 #define BPF_MAP_PTR_UNPRIV      1UL
 #define BPF_MAP_PTR_POISON      ((void *)((0xeB9FUL << 1) +     \
@@ -3751,6 +3752,79 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate,
         }
 }
 
+/* compute branch direction of the expression "if (reg opcode val) goto target;"
+ * and return:
+ *  1 - branch will be taken and "goto target" will be executed
+ *  0 - branch will not be taken and fall-through to next insn
+ * -1 - unknown. Example: "if (reg < 5)" is unknown when register value range [0,10]
+ */
+static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode)
+{
+        if (__is_pointer_value(false, reg))
+                return -1;
+
+        switch (opcode) {
+        case BPF_JEQ:
+                if (tnum_is_const(reg->var_off))
+                        return !!tnum_equals_const(reg->var_off, val);
+                break;
+        case BPF_JNE:
+                if (tnum_is_const(reg->var_off))
+                        return !tnum_equals_const(reg->var_off, val);
+                break;
+        case BPF_JGT:
+                if (reg->umin_value > val)
+                        return 1;
+                else if (reg->umax_value <= val)
+                        return 0;
+                break;
+        case BPF_JSGT:
+                if (reg->smin_value > (s64)val)
+                        return 1;
+                else if (reg->smax_value < (s64)val)
+                        return 0;
+                break;
+        case BPF_JLT:
+                if (reg->umax_value < val)
+                        return 1;
+                else if (reg->umin_value >= val)
+                        return 0;
+                break;
+        case BPF_JSLT:
+                if (reg->smax_value < (s64)val)
+                        return 1;
+                else if (reg->smin_value >= (s64)val)
+                        return 0;
+                break;
+        case BPF_JGE:
+                if (reg->umin_value >= val)
+                        return 1;
+                else if (reg->umax_value < val)
+                        return 0;
+                break;
+        case BPF_JSGE:
+                if (reg->smin_value >= (s64)val)
+                        return 1;
+                else if (reg->smax_value < (s64)val)
+                        return 0;
+                break;
+        case BPF_JLE:
+                if (reg->umax_value <= val)
+                        return 1;
+                else if (reg->umin_value > val)
+                        return 0;
+                break;
+        case BPF_JSLE:
+                if (reg->smax_value <= (s64)val)
+                        return 1;
+                else if (reg->smin_value > (s64)val)
+                        return 0;
+                break;
+        }
+
+        return -1;
+}
+
 /* Adjusts the register min/max values in the case that the dst_reg is the
  * variable register that we are working on, and src_reg is a constant or we're
  * simply doing a BPF_K check.
@@ -4152,21 +4226,15 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
 
         dst_reg = &regs[insn->dst_reg];
 
-        /* detect if R == 0 where R was initialized to zero earlier */
-        if (BPF_SRC(insn->code) == BPF_K &&
-            (opcode == BPF_JEQ || opcode == BPF_JNE) &&
-            dst_reg->type == SCALAR_VALUE &&
-            tnum_is_const(dst_reg->var_off)) {
-                if ((opcode == BPF_JEQ && dst_reg->var_off.value == insn->imm) ||
-                    (opcode == BPF_JNE && dst_reg->var_off.value != insn->imm)) {
-                        /* if (imm == imm) goto pc+off;
-                         * only follow the goto, ignore fall-through
-                         */
+        if (BPF_SRC(insn->code) == BPF_K) {
+                int pred = is_branch_taken(dst_reg, insn->imm, opcode);
+
+                if (pred == 1) {
+                         /* only follow the goto, ignore fall-through */
                         *insn_idx += insn->off;
                         return 0;
-                } else {
-                        /* if (imm != imm) goto pc+off;
-                         * only follow fall-through branch, since
+                } else if (pred == 0) {
+                        /* only follow fall-through branch, since
                          * that's where the program will go
                          */
                         return 0;
@@ -4980,7 +5048,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
         struct bpf_verifier_state_list *new_sl;
         struct bpf_verifier_state_list *sl;
         struct bpf_verifier_state *cur = env->cur_state, *new;
-        int i, j, err;
+        int i, j, err, states_cnt = 0;
 
         sl = env->explored_states[insn_idx];
         if (!sl)
@@ -5007,8 +5075,12 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
                         return 1;
                 }
                 sl = sl->next;
+                states_cnt++;
         }
 
+        if (!env->allow_ptr_leaks && states_cnt > BPF_COMPLEXITY_LIMIT_STATES)
+                return 0;
+
         /* there were no equivalent states, remember current one.
          * technically the current state is not proven to be safe yet,
          * but it will either reach outer most bpf_exit (which means it's safe)
@@ -5148,6 +5220,9 @@ static int do_check(struct bpf_verifier_env *env)
                         goto process_bpf_exit;
                 }
 
+                if (signal_pending(current))
+                        return -EAGAIN;
+
                 if (need_resched())
                         cond_resched();
 
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 322e97bbb437..abbd8da9ac21 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -572,7 +572,9 @@ static void put_uprobe(struct uprobe *uprobe)
                  * gets called, we don't get a chance to remove uprobe from
                  * delayed_uprobe_list from remove_breakpoint(). Do it here.
                  */
+                mutex_lock(&delayed_uprobe_lock);
                 delayed_uprobe_remove(uprobe, NULL);
+                mutex_unlock(&delayed_uprobe_lock);
                 kfree(uprobe);
         }
 }
diff --git a/kernel/stackleak.c b/kernel/stackleak.c
index 08cb57eed389..b193a59fc05b 100644
--- a/kernel/stackleak.c
+++ b/kernel/stackleak.c
@@ -104,7 +104,7 @@ asmlinkage void notrace stackleak_erase(void)
 }
 NOKPROBE_SYMBOL(stackleak_erase);
 
-void __used stackleak_track_stack(void)
+void __used notrace stackleak_track_stack(void)
 {
         /*
          * N.B. stackleak_erase() fills the kernel stack with the poison value,
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 77734451cb05..e23eb9fc77aa 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5460,6 +5460,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops)
         if (ops->flags & FTRACE_OPS_FL_ENABLED)
                 ftrace_shutdown(ops, 0);
         ops->flags |= FTRACE_OPS_FL_DELETED;
+        ftrace_free_filter(ops);
         mutex_unlock(&ftrace_lock);
 }
 
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 84a65173b1e9..5574e862de8d 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -570,11 +570,13 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
                 }
         }
 
+        kfree(op_stack);
+        kfree(inverts);
         return prog;
 out_free:
         kfree(op_stack);
-        kfree(prog_stack);
         kfree(inverts);
+        kfree(prog_stack);
         return ERR_PTR(ret);
 }
 
@@ -1718,6 +1720,7 @@ static int create_filter(struct trace_event_call *call,
         err = process_preds(call, filter_string, *filterp, pe);
         if (err && set_str)
                 append_filter_err(pe, *filterp);
+        create_filter_finish(pe);
 
         return err;
 }
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 2152d1e530cb..cd12ecb66eb9 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -732,8 +732,10 @@ int set_trigger_filter(char *filter_str,
 
         /* The filter is for the 'trigger' event, not the triggered event */
         ret = create_event_filter(file->event_call, filter_str, false, &filter);
-        if (ret)
-                goto out;
+        /*
+         * If create_event_filter() fails, filter still needs to be freed.
+         * Which the calling code will do with data->filter.
+         */
  assign:
         tmp = rcu_access_pointer(data->filter);
 
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 1106bb6aa01e..14d51548bea6 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -784,11 +784,11 @@ void *__radix_tree_lookup(const struct radix_tree_root *root,
         while (radix_tree_is_internal_node(node)) {
                 unsigned offset;
 
-                if (node == RADIX_TREE_RETRY)
-                        goto restart;
                 parent = entry_to_node(node);
                 offset = radix_tree_descend(parent, &node, index);
                 slot = parent->slots + offset;
+                if (node == RADIX_TREE_RETRY)
+                        goto restart;
                 if (parent->shift == 0)
                         break;
         }
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 0598e86af8fc..4676c0a1eeca 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -28,23 +28,28 @@ void xa_dump(const struct xarray *xa) { }
 } while (0)
 #endif
 
+static void *xa_mk_index(unsigned long index)
+{
+        return xa_mk_value(index & LONG_MAX);
+}
+
 static void *xa_store_index(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
-        return xa_store(xa, index, xa_mk_value(index & LONG_MAX), gfp);
+        return xa_store(xa, index, xa_mk_index(index), gfp);
 }
 
 static void xa_alloc_index(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
         u32 id = 0;
 
-        XA_BUG_ON(xa, xa_alloc(xa, &id, UINT_MAX, xa_mk_value(index & LONG_MAX),
+        XA_BUG_ON(xa, xa_alloc(xa, &id, UINT_MAX, xa_mk_index(index),
                                 gfp) != 0);
         XA_BUG_ON(xa, id != index);
 }
 
 static void xa_erase_index(struct xarray *xa, unsigned long index)
 {
-        XA_BUG_ON(xa, xa_erase(xa, index) != xa_mk_value(index & LONG_MAX));
+        XA_BUG_ON(xa, xa_erase(xa, index) != xa_mk_index(index));
         XA_BUG_ON(xa, xa_load(xa, index) != NULL);
 }
 
@@ -118,7 +123,7 @@ static noinline void check_xas_retry(struct xarray *xa)
 
         xas_set(&xas, 0);
         xas_for_each(&xas, entry, ULONG_MAX) {
-                xas_store(&xas, xa_mk_value(xas.xa_index));
+                xas_store(&xas, xa_mk_index(xas.xa_index));
         }
         xas_unlock(&xas);
 
@@ -196,7 +201,7 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                 XA_BUG_ON(xa, xa_store_index(xa, index + 2, GFP_KERNEL));
                 xa_set_mark(xa, index + 2, XA_MARK_1);
                 XA_BUG_ON(xa, xa_store_index(xa, next, GFP_KERNEL));
-                xa_store_order(xa, index, order, xa_mk_value(index),
+                xa_store_order(xa, index, order, xa_mk_index(index),
                                 GFP_KERNEL);
                 for (i = base; i < next; i++) {
                         XA_STATE(xas, xa, i);
@@ -405,7 +410,7 @@ static noinline void check_xas_erase(struct xarray *xa)
                         xas_set(&xas, j);
                         do {
                                 xas_lock(&xas);
-                                xas_store(&xas, xa_mk_value(j));
+                                xas_store(&xas, xa_mk_index(j));
                                 xas_unlock(&xas);
                         } while (xas_nomem(&xas, GFP_KERNEL));
                 }
@@ -423,7 +428,7 @@ static noinline void check_xas_erase(struct xarray *xa)
                 xas_set(&xas, 0);
                 j = i;
                 xas_for_each(&xas, entry, ULONG_MAX) {
-                        XA_BUG_ON(xa, entry != xa_mk_value(j));
+                        XA_BUG_ON(xa, entry != xa_mk_index(j));
                         xas_store(&xas, NULL);
                         j++;
                 }
@@ -440,17 +445,17 @@ static noinline void check_multi_store_1(struct xarray *xa, unsigned long index,
         unsigned long min = index & ~((1UL << order) - 1);
         unsigned long max = min + (1UL << order);
 
-        xa_store_order(xa, index, order, xa_mk_value(index), GFP_KERNEL);
-        XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_value(index));
-        XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_value(index));
+        xa_store_order(xa, index, order, xa_mk_index(index), GFP_KERNEL);
+        XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_index(index));
+        XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_index(index));
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
         XA_BUG_ON(xa, xa_load(xa, min - 1) != NULL);
 
         xas_lock(&xas);
-        XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(min)) != xa_mk_value(index));
+        XA_BUG_ON(xa, xas_store(&xas, xa_mk_index(min)) != xa_mk_index(index));
         xas_unlock(&xas);
-        XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_value(min));
-        XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_value(min));
+        XA_BUG_ON(xa, xa_load(xa, min) != xa_mk_index(min));
+        XA_BUG_ON(xa, xa_load(xa, max - 1) != xa_mk_index(min));
         XA_BUG_ON(xa, xa_load(xa, max) != NULL);
         XA_BUG_ON(xa, xa_load(xa, min - 1) != NULL);
 
@@ -471,6 +476,32 @@ static noinline void check_multi_store_2(struct xarray *xa, unsigned long index,
         xas_unlock(&xas);
         XA_BUG_ON(xa, !xa_empty(xa));
 }
+
+static noinline void check_multi_store_3(struct xarray *xa, unsigned long index,
+                unsigned int order)
+{
+        XA_STATE(xas, xa, 0);
+        void *entry;
+        int n = 0;
+
+        xa_store_order(xa, index, order, xa_mk_index(index), GFP_KERNEL);
+
+        xas_lock(&xas);
+        xas_for_each(&xas, entry, ULONG_MAX) {
+                XA_BUG_ON(xa, entry != xa_mk_index(index));
+                n++;
+        }
+        XA_BUG_ON(xa, n != 1);
+        xas_set(&xas, index + 1);
+        xas_for_each(&xas, entry, ULONG_MAX) {
+                XA_BUG_ON(xa, entry != xa_mk_index(index));
+                n++;
+        }
+        XA_BUG_ON(xa, n != 2);
+        xas_unlock(&xas);
+
+        xa_destroy(xa);
+}
 #endif
 
 static noinline void check_multi_store(struct xarray *xa)
@@ -523,15 +554,15 @@ static noinline void check_multi_store(struct xarray *xa)
 
         for (i = 0; i < max_order; i++) {
                 for (j = 0; j < max_order; j++) {
-                        xa_store_order(xa, 0, i, xa_mk_value(i), GFP_KERNEL);
-                        xa_store_order(xa, 0, j, xa_mk_value(j), GFP_KERNEL);
+                        xa_store_order(xa, 0, i, xa_mk_index(i), GFP_KERNEL);
+                        xa_store_order(xa, 0, j, xa_mk_index(j), GFP_KERNEL);
 
                         for (k = 0; k < max_order; k++) {
                                 void *entry = xa_load(xa, (1UL << k) - 1);
                                 if ((i < k) && (j < k))
                                         XA_BUG_ON(xa, entry != NULL);
                                 else
-                                        XA_BUG_ON(xa, entry != xa_mk_value(j));
+                                        XA_BUG_ON(xa, entry != xa_mk_index(j));
                         }
 
                         xa_erase(xa, 0);
@@ -545,6 +576,11 @@ static noinline void check_multi_store(struct xarray *xa)
                 check_multi_store_1(xa, (1UL << i) + 1, i);
         }
         check_multi_store_2(xa, 4095, 9);
+
+        for (i = 1; i < 20; i++) {
+                check_multi_store_3(xa, 0, i);
+                check_multi_store_3(xa, 1UL << i, i);
+        }
 #endif
 }
 
@@ -587,16 +623,25 @@ static noinline void check_xa_alloc(void)
         xa_destroy(&xa0);
 
         id = 0xfffffffeU;
-        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_value(0),
+        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_index(id),
                                 GFP_KERNEL) != 0);
         XA_BUG_ON(&xa0, id != 0xfffffffeU);
-        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_value(0),
+        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_index(id),
                                 GFP_KERNEL) != 0);
         XA_BUG_ON(&xa0, id != 0xffffffffU);
-        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_value(0),
+        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, UINT_MAX, xa_mk_index(id),
                                 GFP_KERNEL) != -ENOSPC);
         XA_BUG_ON(&xa0, id != 0xffffffffU);
         xa_destroy(&xa0);
+
+        id = 10;
+        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, 5, xa_mk_index(id),
+                                GFP_KERNEL) != -ENOSPC);
+        XA_BUG_ON(&xa0, xa_store_index(&xa0, 3, GFP_KERNEL) != 0);
+        XA_BUG_ON(&xa0, xa_alloc(&xa0, &id, 5, xa_mk_index(id),
+                                GFP_KERNEL) != -ENOSPC);
+        xa_erase_index(&xa0, 3);
+        XA_BUG_ON(&xa0, !xa_empty(&xa0));
 }
 
 static noinline void __check_store_iter(struct xarray *xa, unsigned long start,
@@ -610,11 +655,11 @@ retry:
         xas_lock(&xas);
         xas_for_each_conflict(&xas, entry) {
                 XA_BUG_ON(xa, !xa_is_value(entry));
-                XA_BUG_ON(xa, entry < xa_mk_value(start));
-                XA_BUG_ON(xa, entry > xa_mk_value(start + (1UL << order) - 1));
+                XA_BUG_ON(xa, entry < xa_mk_index(start));
+                XA_BUG_ON(xa, entry > xa_mk_index(start + (1UL << order) - 1));
                 count++;
         }
-        xas_store(&xas, xa_mk_value(start));
+        xas_store(&xas, xa_mk_index(start));
         xas_unlock(&xas);
         if (xas_nomem(&xas, GFP_KERNEL)) {
                 count = 0;
@@ -622,9 +667,9 @@ retry:
         }
         XA_BUG_ON(xa, xas_error(&xas));
         XA_BUG_ON(xa, count != present);
-        XA_BUG_ON(xa, xa_load(xa, start) != xa_mk_value(start));
+        XA_BUG_ON(xa, xa_load(xa, start) != xa_mk_index(start));
         XA_BUG_ON(xa, xa_load(xa, start + (1UL << order) - 1) !=
-                        xa_mk_value(start));
+                        xa_mk_index(start));
         xa_erase_index(xa, start);
 }
 
@@ -703,7 +748,7 @@ static noinline void check_multi_find_2(struct xarray *xa)
                 for (j = 0; j < index; j++) {
                         XA_STATE(xas, xa, j + index);
                         xa_store_index(xa, index - 1, GFP_KERNEL);
-                        xa_store_order(xa, index, i, xa_mk_value(index),
+                        xa_store_order(xa, index, i, xa_mk_index(index),
                                         GFP_KERNEL);
                         rcu_read_lock();
                         xas_for_each(&xas, entry, ULONG_MAX) {
@@ -778,7 +823,7 @@ static noinline void check_find_2(struct xarray *xa)
                 j = 0;
                 index = 0;
                 xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
-                        XA_BUG_ON(xa, xa_mk_value(index) != entry);
+                        XA_BUG_ON(xa, xa_mk_index(index) != entry);
                         XA_BUG_ON(xa, index != j++);
                 }
         }
@@ -786,10 +831,34 @@ static noinline void check_find_2(struct xarray *xa)
         xa_destroy(xa);
 }
 
+static noinline void check_find_3(struct xarray *xa)
+{
+        XA_STATE(xas, xa, 0);
+        unsigned long i, j, k;
+        void *entry;
+
+        for (i = 0; i < 100; i++) {
+                for (j = 0; j < 100; j++) {
+                        for (k = 0; k < 100; k++) {
+                                xas_set(&xas, j);
+                                xas_for_each_marked(&xas, entry, k, XA_MARK_0)
+                                        ;
+                                if (j > k)
+                                        XA_BUG_ON(xa,
+                                                xas.xa_node != XAS_RESTART);
+                        }
+                }
+                xa_store_index(xa, i, GFP_KERNEL);
+                xa_set_mark(xa, i, XA_MARK_0);
+        }
+        xa_destroy(xa);
+}
+
 static noinline void check_find(struct xarray *xa)
 {
         check_find_1(xa);
         check_find_2(xa);
+        check_find_3(xa);
         check_multi_find(xa);
         check_multi_find_2(xa);
 }
@@ -829,11 +898,11 @@ static noinline void check_find_entry(struct xarray *xa)
                         for (index = 0; index < (1UL << (order + 5));
                              index += (1UL << order)) {
                                 xa_store_order(xa, index, order,
-                                                xa_mk_value(index), GFP_KERNEL);
+                                                xa_mk_index(index), GFP_KERNEL);
                                 XA_BUG_ON(xa, xa_load(xa, index) !=
-                                                xa_mk_value(index));
+                                                xa_mk_index(index));
                                 XA_BUG_ON(xa, xa_find_entry(xa,
-                                                xa_mk_value(index)) != index);
+                                                xa_mk_index(index)) != index);
                         }
                         XA_BUG_ON(xa, xa_find_entry(xa, xa) != -1);
                         xa_destroy(xa);
@@ -844,7 +913,7 @@ static noinline void check_find_entry(struct xarray *xa)
         XA_BUG_ON(xa, xa_find_entry(xa, xa) != -1);
         xa_store_index(xa, ULONG_MAX, GFP_KERNEL);
         XA_BUG_ON(xa, xa_find_entry(xa, xa) != -1);
-        XA_BUG_ON(xa, xa_find_entry(xa, xa_mk_value(LONG_MAX)) != -1);
+        XA_BUG_ON(xa, xa_find_entry(xa, xa_mk_index(ULONG_MAX)) != -1);
         xa_erase_index(xa, ULONG_MAX);
         XA_BUG_ON(xa, !xa_empty(xa));
 }
@@ -864,7 +933,7 @@ static noinline void check_move_small(struct xarray *xa, unsigned long idx)
                         XA_BUG_ON(xa, xas.xa_node == XAS_RESTART);
                 XA_BUG_ON(xa, xas.xa_index != i);
                 if (i == 0 || i == idx)
-                        XA_BUG_ON(xa, entry != xa_mk_value(i));
+                        XA_BUG_ON(xa, entry != xa_mk_index(i));
                 else
                         XA_BUG_ON(xa, entry != NULL);
         }
@@ -878,7 +947,7 @@ static noinline void check_move_small(struct xarray *xa, unsigned long idx)
                         XA_BUG_ON(xa, xas.xa_node == XAS_RESTART);
                 XA_BUG_ON(xa, xas.xa_index != i);
                 if (i == 0 || i == idx)
-                        XA_BUG_ON(xa, entry != xa_mk_value(i));
+                        XA_BUG_ON(xa, entry != xa_mk_index(i));
                 else
                         XA_BUG_ON(xa, entry != NULL);
         } while (i > 0);
@@ -909,7 +978,7 @@ static noinline void check_move(struct xarray *xa)
         do {
                 void *entry = xas_prev(&xas);
                 i--;
-                XA_BUG_ON(xa, entry != xa_mk_value(i));
+                XA_BUG_ON(xa, entry != xa_mk_index(i));
                 XA_BUG_ON(xa, i != xas.xa_index);
         } while (i != 0);
 
@@ -918,7 +987,7 @@ static noinline void check_move(struct xarray *xa)
 
         do {
                 void *entry = xas_next(&xas);
-                XA_BUG_ON(xa, entry != xa_mk_value(i));
+                XA_BUG_ON(xa, entry != xa_mk_index(i));
                 XA_BUG_ON(xa, i != xas.xa_index);
                 i++;
         } while (i < (1 << 16));
@@ -934,7 +1003,7 @@ static noinline void check_move(struct xarray *xa)
                 void *entry = xas_prev(&xas);
                 i--;
                 if ((i < (1 << 8)) || (i >= (1 << 15)))
-                        XA_BUG_ON(xa, entry != xa_mk_value(i));
+                        XA_BUG_ON(xa, entry != xa_mk_index(i));
                 else
                         XA_BUG_ON(xa, entry != NULL);
                 XA_BUG_ON(xa, i != xas.xa_index);
@@ -946,7 +1015,7 @@ static noinline void check_move(struct xarray *xa)
         do {
                 void *entry = xas_next(&xas);
                 if ((i < (1 << 8)) || (i >= (1 << 15)))
-                        XA_BUG_ON(xa, entry != xa_mk_value(i));
+                        XA_BUG_ON(xa, entry != xa_mk_index(i));
                 else
                         XA_BUG_ON(xa, entry != NULL);
                 XA_BUG_ON(xa, i != xas.xa_index);
@@ -976,7 +1045,7 @@ static noinline void xa_store_many_order(struct xarray *xa,
                 if (xas_error(&xas))
                         goto unlock;
                 for (i = 0; i < (1U << order); i++) {
-                        XA_BUG_ON(xa, xas_store(&xas, xa_mk_value(index + i)));
+                        XA_BUG_ON(xa, xas_store(&xas, xa_mk_index(index + i)));
                         xas_next(&xas);
                 }
 unlock:
@@ -1031,9 +1100,9 @@ static noinline void check_create_range_4(struct xarray *xa,
                 if (xas_error(&xas))
                         goto unlock;
                 for (i = 0; i < (1UL << order); i++) {
-                        void *old = xas_store(&xas, xa_mk_value(base + i));
+                        void *old = xas_store(&xas, xa_mk_index(base + i));
                         if (xas.xa_index == index)
-                                XA_BUG_ON(xa, old != xa_mk_value(base + i));
+                                XA_BUG_ON(xa, old != xa_mk_index(base + i));
                         else
                                 XA_BUG_ON(xa, old != NULL);
                         xas_next(&xas);
@@ -1085,10 +1154,10 @@ static noinline void __check_store_range(struct xarray *xa, unsigned long first,
                 unsigned long last)
 {
 #ifdef CONFIG_XARRAY_MULTI
-        xa_store_range(xa, first, last, xa_mk_value(first), GFP_KERNEL);
+        xa_store_range(xa, first, last, xa_mk_index(first), GFP_KERNEL);
 
-        XA_BUG_ON(xa, xa_load(xa, first) != xa_mk_value(first));
-        XA_BUG_ON(xa, xa_load(xa, last) != xa_mk_value(first));
+        XA_BUG_ON(xa, xa_load(xa, first) != xa_mk_index(first));
+        XA_BUG_ON(xa, xa_load(xa, last) != xa_mk_index(first));
         XA_BUG_ON(xa, xa_load(xa, first - 1) != NULL);
         XA_BUG_ON(xa, xa_load(xa, last + 1) != NULL);
 
@@ -1195,7 +1264,7 @@ static noinline void check_account(struct xarray *xa)
                 XA_BUG_ON(xa, xas.xa_node->nr_values != 0);
                 rcu_read_unlock();
 
-                xa_store_order(xa, 1 << order, order, xa_mk_value(1 << order),
+                xa_store_order(xa, 1 << order, order, xa_mk_index(1UL << order),
                                 GFP_KERNEL);
                 XA_BUG_ON(xa, xas.xa_node->count != xas.xa_node->nr_values * 2);
 
diff --git a/lib/xarray.c b/lib/xarray.c
index bbacca576593..5f3f9311de89 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -1131,7 +1131,7 @@ void *xas_find_marked(struct xa_state *xas, unsigned long max, xa_mark_t mark)
                 entry = xa_head(xas->xa);
                 xas->xa_node = NULL;
                 if (xas->xa_index > max_index(entry))
-                        goto bounds;
+                        goto out;
                 if (!xa_is_node(entry)) {
                         if (xa_marked(xas->xa, mark))
                                 return entry;
@@ -1180,11 +1180,9 @@ void *xas_find_marked(struct xa_state *xas, unsigned long max, xa_mark_t mark)
         }
 
 out:
-        if (!max)
+        if (xas->xa_index > max)
                 goto max;
-bounds:
-        xas->xa_node = XAS_BOUNDS;
-        return NULL;
+        return set_bounds(xas);
 max:
         xas->xa_node = XAS_RESTART;
         return NULL;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 622cced74fd9..5da55b38b1b7 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -629,40 +629,30 @@ release:
  *          available
  * never: never stall for any thp allocation
  */
-static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma, unsigned long addr)
+static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma)
 {
         const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE);
-        gfp_t this_node = 0;
-
-#ifdef CONFIG_NUMA
-        struct mempolicy *pol;
-        /*
-         * __GFP_THISNODE is used only when __GFP_DIRECT_RECLAIM is not
-         * specified, to express a general desire to stay on the current
-         * node for optimistic allocation attempts. If the defrag mode
-         * and/or madvise hint requires the direct reclaim then we prefer
-         * to fallback to other node rather than node reclaim because that
-         * can lead to excessive reclaim even though there is free memory
-         * on other nodes. We expect that NUMA preferences are specified
-         * by memory policies.
-         */
-        pol = get_vma_policy(vma, addr);
-        if (pol->mode != MPOL_BIND)
-                this_node = __GFP_THISNODE;
-        mpol_cond_put(pol);
-#endif
 
+        /* Always do synchronous compaction */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
                 return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY);
+
+        /* Kick kcompactd and fail quickly */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM | this_node;
+                return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM;
+
+        /* Synchronous compaction if madvised, otherwise kick kcompactd */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                                                             __GFP_KSWAPD_RECLAIM | this_node);
+                return GFP_TRANSHUGE_LIGHT |
+                        (vma_madvised ? __GFP_DIRECT_RECLAIM :
+                                        __GFP_KSWAPD_RECLAIM);
+
+        /* Only do synchronous compaction if madvised */
         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
-                return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
-                                                             this_node);
-        return GFP_TRANSHUGE_LIGHT | this_node;
+                return GFP_TRANSHUGE_LIGHT |
+                       (vma_madvised ? __GFP_DIRECT_RECLAIM : 0);
+
+        return GFP_TRANSHUGE_LIGHT;
 }
 
 /* Caller must hold page table lock. */
@@ -734,8 +724,8 @@ vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                         pte_free(vma->vm_mm, pgtable);
                 return ret;
         }
-        gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
-        page = alloc_pages_vma(gfp, HPAGE_PMD_ORDER, vma, haddr, numa_node_id());
+        gfp = alloc_hugepage_direct_gfpmask(vma);
+        page = alloc_hugepage_vma(gfp, vma, haddr, HPAGE_PMD_ORDER);
         if (unlikely(!page)) {
                 count_vm_event(THP_FAULT_FALLBACK);
                 return VM_FAULT_FALLBACK;
@@ -1305,9 +1295,8 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd)
 alloc:
         if (transparent_hugepage_enabled(vma) &&
             !transparent_hugepage_debug_cow()) {
-                huge_gfp = alloc_hugepage_direct_gfpmask(vma, haddr);
-                new_page = alloc_pages_vma(huge_gfp, HPAGE_PMD_ORDER, vma,
-                                haddr, numa_node_id());
+                huge_gfp = alloc_hugepage_direct_gfpmask(vma);
+                new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
         } else
                 new_page = NULL;
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 705a3e9cc910..a80832487981 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1248,10 +1248,11 @@ void free_huge_page(struct page *page)
                 (struct hugepage_subpool *)page_private(page);
         bool restore_reserve;
 
-        set_page_private(page, 0);
-        page->mapping = NULL;
         VM_BUG_ON_PAGE(page_count(page), page);
         VM_BUG_ON_PAGE(page_mapcount(page), page);
+
+        set_page_private(page, 0);
+        page->mapping = NULL;
         restore_reserve = PagePrivate(page);
         ClearPagePrivate(page);
 
diff --git a/mm/memblock.c b/mm/memblock.c
index 9a2d5ae81ae1..81ae63ca78d0 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1727,7 +1727,7 @@ static int __init_memblock memblock_search(struct memblock_type *type, phys_addr
         return -1;
 }
 
-bool __init memblock_is_reserved(phys_addr_t addr)
+bool __init_memblock memblock_is_reserved(phys_addr_t addr)
 {
         return memblock_search(&memblock.reserved, addr) != -1;
 }
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 0cd3de3550f0..7c72f2a95785 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1161,6 +1161,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
         LIST_HEAD(tokill);
         int rc = -EBUSY;
         loff_t start;
+        dax_entry_t cookie;
 
         /*
          * Prevent the inode from being freed while we are interrogating
@@ -1169,7 +1170,8 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
          * also prevents changes to the mapping of this pfn until
          * poison signaling is complete.
          */
-        if (!dax_lock_mapping_entry(page))
+        cookie = dax_lock_page(page);
+        if (!cookie)
                 goto out;
 
         if (hwpoison_filter(page)) {
@@ -1220,7 +1222,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
         kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags);
         rc = 0;
 unlock:
-        dax_unlock_mapping_entry(page);
+        dax_unlock_page(page, cookie);
 out:
         /* drop pgmap ref acquired in caller */
         put_dev_pagemap(pgmap);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5837a067124d..d4496d9d34f5 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1116,8 +1116,8 @@ static struct page *new_page(struct page *page, unsigned long start)
         } else if (PageTransHuge(page)) {
                 struct page *thp;
 
-                thp = alloc_pages_vma(GFP_TRANSHUGE, HPAGE_PMD_ORDER, vma,
-                                address, numa_node_id());
+                thp = alloc_hugepage_vma(GFP_TRANSHUGE, vma, address,
+                                         HPAGE_PMD_ORDER);
                 if (!thp)
                         return NULL;
                 prep_transhuge_page(thp);
@@ -1662,7 +1662,7 @@ struct mempolicy *__get_vma_policy(struct vm_area_struct *vma,
  * freeing by another task.  It is the caller's responsibility to free the
  * extra reference for shared policies.
  */
-struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
+static struct mempolicy *get_vma_policy(struct vm_area_struct *vma,
                                                 unsigned long addr)
 {
         struct mempolicy *pol = __get_vma_policy(vma, addr);
@@ -2011,6 +2011,7 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
  *      @vma:  Pointer to VMA or NULL if not available.
  *      @addr: Virtual Address of the allocation. Must be inside the VMA.
  *      @node: Which node to prefer for allocation (modulo policy).
+ *      @hugepage: for hugepages try only the preferred node if possible
  *
  *      This function allocates a page from the kernel page pool and applies
  *      a NUMA policy associated with the VMA or the current process.
@@ -2021,7 +2022,7 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
  */
 struct page *
 alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
-                unsigned long addr, int node)
+                unsigned long addr, int node, bool hugepage)
 {
         struct mempolicy *pol;
         struct page *page;
@@ -2039,6 +2040,31 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
                 goto out;
         }
 
+        if (unlikely(IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hugepage)) {
+                int hpage_node = node;
+
+                /*
+                 * For hugepage allocation and non-interleave policy which
+                 * allows the current node (or other explicitly preferred
+                 * node) we only try to allocate from the current/preferred
+                 * node and don't fall back to other nodes, as the cost of
+                 * remote accesses would likely offset THP benefits.
+                 *
+                 * If the policy is interleave, or does not allow the current
+                 * node in its nodemask, we allocate the standard way.
+                 */
+                if (pol->mode == MPOL_PREFERRED && !(pol->flags & MPOL_F_LOCAL))
+                        hpage_node = pol->v.preferred_node;
+
+                nmask = policy_nodemask(gfp, pol);
+                if (!nmask || node_isset(hpage_node, *nmask)) {
+                        mpol_cond_put(pol);
+                        page = __alloc_pages_node(hpage_node,
+                                                gfp | __GFP_THISNODE, order);
+                        goto out;
+                }
+        }
+
         nmask = policy_nodemask(gfp, pol);
         preferred_nid = policy_node(gfp, pol, node);
         page = __alloc_pages_nodemask(gfp, order, preferred_nid, nmask);
diff --git a/mm/shmem.c b/mm/shmem.c
index cddc72ac44d8..5d07e0b1352f 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -661,9 +661,7 @@ static int shmem_free_swap(struct address_space *mapping,
 {
         void *old;
 
-        xa_lock_irq(&mapping->i_pages);
-        old = __xa_cmpxchg(&mapping->i_pages, index, radswap, NULL, 0);
-        xa_unlock_irq(&mapping->i_pages);
+        old = xa_cmpxchg_irq(&mapping->i_pages, index, radswap, NULL, 0);
         if (old != radswap)
                 return -ENOENT;
         free_swap_and_cache(radix_to_swp_entry(radswap));
@@ -1439,7 +1437,7 @@ static struct page *shmem_alloc_hugepage(gfp_t gfp,
 
         shmem_pseudo_vma_init(&pvma, info, hindex);
         page = alloc_pages_vma(gfp | __GFP_COMP | __GFP_NORETRY | __GFP_NOWARN,
-                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id());
+                        HPAGE_PMD_ORDER, &pvma, 0, numa_node_id(), true);
         shmem_pseudo_vma_destroy(&pvma);
         if (page)
                 prep_transhuge_page(page);
diff --git a/mm/sparse.c b/mm/sparse.c
index 33307fc05c4d..3abc8cc50201 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -240,6 +240,22 @@ void __init memory_present(int nid, unsigned long start, unsigned long end)
 }
 
 /*
+ * Mark all memblocks as present using memory_present(). This is a
+ * convienence function that is useful for a number of arches
+ * to mark all of the systems memory as present during initialization.
+ */
+void __init memblocks_present(void)
+{
+        struct memblock_region *reg;
+
+        for_each_memblock(memory, reg) {
+                memory_present(memblock_get_region_node(reg),
+                               memblock_region_memory_base_pfn(reg),
+                               memblock_region_memory_end_pfn(reg));
+        }
+}
+
+/*
  * Subtle, we encode the real pfn into the mem_map such that
  * the identity pfn - section_mem_map will return the actual
  * physical page frame number.
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index c89c22c49015..25001913d03b 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -28,12 +28,13 @@ static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
         return ret;
 }
 
-static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
+static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *ret,
+                        u32 *time)
 {
         struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 };
         enum bpf_cgroup_storage_type stype;
         u64 time_start, time_spent = 0;
-        u32 ret = 0, i;
+        u32 i;
 
         for_each_cgroup_storage_type(stype) {
                 storage[stype] = bpf_cgroup_storage_alloc(prog, stype);
@@ -49,7 +50,7 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
                 repeat = 1;
         time_start = ktime_get_ns();
         for (i = 0; i < repeat; i++) {
-                ret = bpf_test_run_one(prog, ctx, storage);
+                *ret = bpf_test_run_one(prog, ctx, storage);
                 if (need_resched()) {
                         if (signal_pending(current))
                                 break;
@@ -65,7 +66,7 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
         for_each_cgroup_storage_type(stype)
                 bpf_cgroup_storage_free(storage[stype]);
 
-        return ret;
+        return 0;
 }
 
 static int bpf_test_finish(const union bpf_attr *kattr,
@@ -165,7 +166,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
                 __skb_push(skb, hh_len);
         if (is_direct_pkt_access)
                 bpf_compute_data_pointers(skb);
-        retval = bpf_test_run(prog, skb, repeat, &duration);
+        ret = bpf_test_run(prog, skb, repeat, &retval, &duration);
+        if (ret) {
+                kfree_skb(skb);
+                kfree(sk);
+                return ret;
+        }
         if (!is_l2) {
                 if (skb_headroom(skb) < hh_len) {
                         int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
@@ -212,11 +218,14 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
         rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0);
         xdp.rxq = &rxqueue->xdp_rxq;
 
-        retval = bpf_test_run(prog, &xdp, repeat, &duration);
+        ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration);
+        if (ret)
+                goto out;
         if (xdp.data != data + XDP_PACKET_HEADROOM + NET_IP_ALIGN ||
             xdp.data_end != xdp.data + size)
                 size = xdp.data_end - xdp.data;
         ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration);
+out:
         kfree(data);
         return ret;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index ddc551f24ba2..722d50dbf8a4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2175,6 +2175,20 @@ static bool remove_xps_queue_cpu(struct net_device *dev,
         return active;
 }
 
+static void reset_xps_maps(struct net_device *dev,
+                           struct xps_dev_maps *dev_maps,
+                           bool is_rxqs_map)
+{
+        if (is_rxqs_map) {
+                static_key_slow_dec_cpuslocked(&xps_rxqs_needed);
+                RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
+        } else {
+                RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
+        }
+        static_key_slow_dec_cpuslocked(&xps_needed);
+        kfree_rcu(dev_maps, rcu);
+}
+
 static void clean_xps_maps(struct net_device *dev, const unsigned long *mask,
                            struct xps_dev_maps *dev_maps, unsigned int nr_ids,
                            u16 offset, u16 count, bool is_rxqs_map)
@@ -2186,18 +2200,15 @@ static void clean_xps_maps(struct net_device *dev, const unsigned long *mask,
              j < nr_ids;)
                 active |= remove_xps_queue_cpu(dev, dev_maps, j, offset,
                                                count);
-        if (!active) {
-                if (is_rxqs_map) {
-                        RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
-                } else {
-                        RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
+        if (!active)
+                reset_xps_maps(dev, dev_maps, is_rxqs_map);
 
-                        for (i = offset + (count - 1); count--; i--)
-                                netdev_queue_numa_node_write(
-                                        netdev_get_tx_queue(dev, i),
-                                                        NUMA_NO_NODE);
+        if (!is_rxqs_map) {
+                for (i = offset + (count - 1); count--; i--) {
+                        netdev_queue_numa_node_write(
+                                netdev_get_tx_queue(dev, i),
+                                NUMA_NO_NODE);
                 }
-                kfree_rcu(dev_maps, rcu);
         }
 }
 
@@ -2234,10 +2245,6 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset,
                        false);
 
 out_no_maps:
-        if (static_key_enabled(&xps_rxqs_needed))
-                static_key_slow_dec_cpuslocked(&xps_rxqs_needed);
-
-        static_key_slow_dec_cpuslocked(&xps_needed);
         mutex_unlock(&xps_map_mutex);
         cpus_read_unlock();
 }
@@ -2355,9 +2362,12 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask,
         if (!new_dev_maps)
                 goto out_no_new_maps;
 
-        static_key_slow_inc_cpuslocked(&xps_needed);
-        if (is_rxqs_map)
-                static_key_slow_inc_cpuslocked(&xps_rxqs_needed);
+        if (!dev_maps) {
+                /* Increment static keys at most once per type */
+                static_key_slow_inc_cpuslocked(&xps_needed);
+                if (is_rxqs_map)
+                        static_key_slow_inc_cpuslocked(&xps_rxqs_needed);
+        }
 
         for (j = -1; j = netif_attrmask_next(j, possible_mask, nr_ids),
              j < nr_ids;) {
@@ -2455,13 +2465,8 @@ out_no_new_maps:
         }
 
         /* free map if not active */
-        if (!active) {
-                if (is_rxqs_map)
-                        RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
-                else
-                        RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
-                kfree_rcu(dev_maps, rcu);
-        }
+        if (!active)
+                reset_xps_maps(dev, dev_maps, is_rxqs_map);
 
 out_no_maps:
         mutex_unlock(&xps_map_mutex);
@@ -5009,7 +5014,7 @@ static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemallo
                 struct net_device *orig_dev = skb->dev;
                 struct packet_type *pt_prev = NULL;
 
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 __netif_receive_skb_core(skb, pfmemalloc, &pt_prev);
                 if (!pt_prev)
                         continue;
@@ -5165,7 +5170,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
         INIT_LIST_HEAD(&sublist);
         list_for_each_entry_safe(skb, next, head, list) {
                 net_timestamp_check(netdev_tstamp_prequeue, skb);
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 if (!skb_defer_rx_timestamp(skb))
                         list_add_tail(&skb->list, &sublist);
         }
@@ -5176,7 +5181,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
                 rcu_read_lock();
                 list_for_each_entry_safe(skb, next, head, list) {
                         xdp_prog = rcu_dereference(skb->dev->xdp_prog);
-                        list_del(&skb->list);
+                        skb_list_del_init(skb);
                         if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
                                 list_add_tail(&skb->list, &sublist);
                 }
@@ -5195,7 +5200,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
 
                         if (cpu >= 0) {
                                 /* Will be handled, remove from list */
-                                list_del(&skb->list);
+                                skb_list_del_init(skb);
                                 enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
                         }
                 }
@@ -6204,8 +6209,8 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
         napi->skb = NULL;
         napi->poll = poll;
         if (weight > NAPI_POLL_WEIGHT)
-                pr_err_once("netif_napi_add() called with weight %d on device %s\n",
-                            weight, dev->name);
+                netdev_err_once(dev, "%s() called with weight %d\n", __func__,
+                                weight);
         napi->weight = weight;
         list_add(&napi->dev_list, &dev->napi_list);
         napi->dev = dev;
diff --git a/net/core/filter.c b/net/core/filter.c
index 9a1327eb25fa..8d2c629501e2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4890,22 +4890,23 @@ bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
         struct net *net;
 
         family = len == sizeof(tuple->ipv4) ? AF_INET : AF_INET6;
-        if (unlikely(family == AF_UNSPEC || netns_id > U32_MAX || flags))
+        if (unlikely(family == AF_UNSPEC || flags ||
+                     !((s32)netns_id < 0 || netns_id <= S32_MAX)))
                 goto out;
 
         if (skb->dev)
                 caller_net = dev_net(skb->dev);
         else
                 caller_net = sock_net(skb->sk);
-        if (netns_id) {
+        if ((s32)netns_id < 0) {
+                net = caller_net;
+                sk = sk_lookup(net, tuple, skb, family, proto);
+        } else {
                 net = get_net_ns_by_id(caller_net, netns_id);
                 if (unlikely(!net))
                         goto out;
                 sk = sk_lookup(net, tuple, skb, family, proto);
                 put_net(net);
-        } else {
-                net = caller_net;
-                sk = sk_lookup(net, tuple, skb, family, proto);
         }
 
         if (sk)
@@ -5435,8 +5436,8 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type
                 if (size != size_default)
                         return false;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
-                if (size != sizeof(struct bpf_flow_keys *))
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
+                if (size != sizeof(__u64))
                         return false;
                 break;
         default:
@@ -5464,7 +5465,7 @@ static bool sk_filter_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data):
         case bpf_ctx_range(struct __sk_buff, data_meta):
         case bpf_ctx_range(struct __sk_buff, data_end):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
                 return false;
         }
@@ -5489,7 +5490,7 @@ static bool cg_skb_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         case bpf_ctx_range(struct __sk_buff, data):
         case bpf_ctx_range(struct __sk_buff, data_end):
@@ -5530,7 +5531,7 @@ static bool lwt_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         }
 
@@ -5756,7 +5757,7 @@ static bool tc_cls_act_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
                 return false;
         }
@@ -5958,7 +5959,7 @@ static bool sk_skb_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         }
 
@@ -6039,7 +6040,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 info->reg_type = PTR_TO_FLOW_KEYS;
                 break;
         case bpf_ctx_range(struct __sk_buff, tc_classid):
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 33d9227a8b80..7819f7804eeb 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3800,6 +3800,9 @@ int ndo_dflt_fdb_dump(struct sk_buff *skb,
 {
         int err;
 
+        if (dev->type != ARPHRD_ETHER)
+                return -EINVAL;
+
         netif_addr_lock_bh(dev);
         err = nlmsg_populate_fdb(skb, cb, dev, idx, &dev->uc);
         if (err)
diff --git a/net/dsa/master.c b/net/dsa/master.c
index c90ee3227dea..5e8c9bef78bd 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -158,8 +158,31 @@ static void dsa_master_ethtool_teardown(struct net_device *dev)
         cpu_dp->orig_ethtool_ops = NULL;
 }
 
+static ssize_t tagging_show(struct device *d, struct device_attribute *attr,
+                            char *buf)
+{
+        struct net_device *dev = to_net_dev(d);
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+
+        return sprintf(buf, "%s\n",
+                       dsa_tag_protocol_to_str(cpu_dp->tag_ops));
+}
+static DEVICE_ATTR_RO(tagging);
+
+static struct attribute *dsa_slave_attrs[] = {
+        &dev_attr_tagging.attr,
+        NULL
+};
+
+static const struct attribute_group dsa_group = {
+        .name   = "dsa",
+        .attrs  = dsa_slave_attrs,
+};
+
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
+        int ret;
+
         /* If we use a tagging format that doesn't have an ethertype
          * field, make sure that all packets from this point on get
          * sent to the tag format's receive function.
@@ -168,11 +191,20 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 
         dev->dsa_ptr = cpu_dp;
 
-        return dsa_master_ethtool_setup(dev);
+        ret = dsa_master_ethtool_setup(dev);
+        if (ret)
+                return ret;
+
+        ret = sysfs_create_group(&dev->dev.kobj, &dsa_group);
+        if (ret)
+                dsa_master_ethtool_teardown(dev);
+
+        return ret;
 }
 
 void dsa_master_teardown(struct net_device *dev)
 {
+        sysfs_remove_group(&dev->dev.kobj, &dsa_group);
         dsa_master_ethtool_teardown(dev);
 
         dev->dsa_ptr = NULL;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 7d0c19e7edcf..aec78f5aca72 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1058,27 +1058,6 @@ static struct device_type dsa_type = {
         .name   = "dsa",
 };
 
-static ssize_t tagging_show(struct device *d, struct device_attribute *attr,
-                            char *buf)
-{
-        struct net_device *dev = to_net_dev(d);
-        struct dsa_port *dp = dsa_slave_to_port(dev);
-
-        return sprintf(buf, "%s\n",
-                       dsa_tag_protocol_to_str(dp->cpu_dp->tag_ops));
-}
-static DEVICE_ATTR_RO(tagging);
-
-static struct attribute *dsa_slave_attrs[] = {
-        &dev_attr_tagging.attr,
-        NULL
-};
-
-static const struct attribute_group dsa_group = {
-        .name   = "dsa",
-        .attrs  = dsa_slave_attrs,
-};
-
 static void dsa_slave_phylink_validate(struct net_device *dev,
                                        unsigned long *supported,
                                        struct phylink_link_state *state)
@@ -1374,14 +1353,8 @@ int dsa_slave_create(struct dsa_port *port)
                 goto out_phy;
         }
 
-        ret = sysfs_create_group(&slave_dev->dev.kobj, &dsa_group);
-        if (ret)
-                goto out_unreg;
-
         return 0;
 
-out_unreg:
-        unregister_netdev(slave_dev);
 out_phy:
         rtnl_lock();
         phylink_disconnect_phy(p->dp->pl);
@@ -1405,7 +1378,6 @@ void dsa_slave_destroy(struct net_device *slave_dev)
         rtnl_unlock();
 
         dsa_slave_notify(slave_dev, DSA_PORT_UNREGISTER);
-        sysfs_remove_group(&slave_dev->dev.kobj, &dsa_group);
         unregister_netdev(slave_dev);
         phylink_destroy(dp->pl);
         free_percpu(p->stats64);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index d6ee343fdb86..aa0b22697998 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -515,6 +515,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
         struct rb_node *rbn;
         int len;
         int ihlen;
+        int delta;
         int err;
         u8 ecn;
 
@@ -556,10 +557,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
         if (len > 65535)
                 goto out_oversize;
 
+        delta = - head->truesize;
+
         /* Head of list must not be cloned. */
         if (skb_unclone(head, GFP_ATOMIC))
                 goto out_nomem;
 
+        delta += head->truesize;
+        if (delta)
+                add_frag_mem_limit(qp->q.net, delta);
+
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 35a786c0aaa0..e609b08c9df4 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -547,7 +547,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk,
         list_for_each_entry_safe(skb, next, head, list) {
                 struct dst_entry *dst;
 
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 /* if ingress device is enslaved to an L3 master device pass the
                  * skb to its handler for processing
                  */
@@ -594,7 +594,7 @@ void ip_list_rcv(struct list_head *head, struct packet_type *pt,
                 struct net_device *dev = skb->dev;
                 struct net *net = dev_net(dev);
 
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 skb = ip_rcv_core(skb, net);
                 if (skb == NULL)
                         continue;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3f510cad0b3e..d1676d8a6ed7 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1904,7 +1904,9 @@ static int tso_fragment(struct sock *sk, enum tcp_queue tcp_queue,
  * This algorithm is from John Heffner.
  */
 static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
-                                 bool *is_cwnd_limited, u32 max_segs)
+                                 bool *is_cwnd_limited,
+                                 bool *is_rwnd_limited,
+                                 u32 max_segs)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 age, send_win, cong_win, limit, in_flight;
@@ -1912,9 +1914,6 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
         struct sk_buff *head;
         int win_divisor;
 
-        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
-                goto send_now;
-
         if (icsk->icsk_ca_state >= TCP_CA_Recovery)
                 goto send_now;
 
@@ -1973,10 +1972,27 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
         if (age < (tp->srtt_us >> 4))
                 goto send_now;
 
-        /* Ok, it looks like it is advisable to defer. */
+        /* Ok, it looks like it is advisable to defer.
+         * Three cases are tracked :
+         * 1) We are cwnd-limited
+         * 2) We are rwnd-limited
+         * 3) We are application limited.
+         */
+        if (cong_win < send_win) {
+                if (cong_win <= skb->len) {
+                        *is_cwnd_limited = true;
+                        return true;
+                }
+        } else {
+                if (send_win <= skb->len) {
+                        *is_rwnd_limited = true;
+                        return true;
+                }
+        }
 
-        if (cong_win < send_win && cong_win <= skb->len)
-                *is_cwnd_limited = true;
+        /* If this packet won't get more data, do not wait. */
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+                goto send_now;
 
         return true;
 
@@ -2356,7 +2372,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 } else {
                         if (!push_one &&
                             tcp_tso_should_defer(sk, skb, &is_cwnd_limited,
-                                                 max_segs))
+                                                 &is_rwnd_limited, max_segs))
                                 break;
                 }
 
@@ -2494,15 +2510,18 @@ void tcp_send_loss_probe(struct sock *sk)
                 goto rearm_timer;
         }
         skb = skb_rb_last(&sk->tcp_rtx_queue);
+        if (unlikely(!skb)) {
+                WARN_ONCE(tp->packets_out,
+                          "invalid inflight: %u state %u cwnd %u mss %d\n",
+                          tp->packets_out, sk->sk_state, tp->snd_cwnd, mss);
+                inet_csk(sk)->icsk_pending = 0;
+                return;
+        }
 
         /* At most one outstanding TLP retransmission. */
         if (tp->tlp_high_seq)
                 goto rearm_timer;
 
-        /* Retransmit last segment. */
-        if (WARN_ON(!skb))
-                goto rearm_timer;
-
         if (skb_still_in_host_queue(sk, skb))
                 goto rearm_timer;
 
@@ -2920,7 +2939,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
                 TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
                 trace_tcp_retransmit_skb(sk, skb);
         } else if (err != -EBUSY) {
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
+                NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs);
         }
         return err;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 091c53925e4d..f87dbc78b6bc 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -378,7 +378,7 @@ static void tcp_probe_timer(struct sock *sk)
                         return;
         }
 
-        if (icsk->icsk_probes_out > max_probes) {
+        if (icsk->icsk_probes_out >= max_probes) {
 abort:          tcp_write_err(sk);
         } else {
                 /* Only send another probe if we didn't close things up. */
@@ -484,11 +484,12 @@ void tcp_retransmit_timer(struct sock *sk)
                 goto out_reset_timer;
         }
 
+        __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
         if (tcp_write_timeout(sk))
                 goto out;
 
         if (icsk->icsk_retransmits == 0) {
-                int mib_idx;
+                int mib_idx = 0;
 
                 if (icsk->icsk_ca_state == TCP_CA_Recovery) {
                         if (tcp_is_sack(tp))
@@ -503,10 +504,9 @@ void tcp_retransmit_timer(struct sock *sk)
                                 mib_idx = LINUX_MIB_TCPSACKFAILURES;
                         else
                                 mib_idx = LINUX_MIB_TCPRENOFAILURES;
-                } else {
-                        mib_idx = LINUX_MIB_TCPTIMEOUTS;
                 }
-                __NET_INC_STATS(sock_net(sk), mib_idx);
+                if (mib_idx)
+                        __NET_INC_STATS(sock_net(sk), mib_idx);
         }
 
         tcp_enter_loss(sk);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 96577e742afd..c1d85830c906 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -95,7 +95,7 @@ static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
         list_for_each_entry_safe(skb, next, head, list) {
                 struct dst_entry *dst;
 
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 /* if ingress device is enslaved to an L3 master device pass the
                  * skb to its handler for processing
                  */
@@ -296,7 +296,7 @@ void ipv6_list_rcv(struct list_head *head, struct packet_type *pt,
                 struct net_device *dev = skb->dev;
                 struct net *net = dev_net(dev);
 
-                list_del(&skb->list);
+                skb_list_del_init(skb);
                 skb = ip6_rcv_core(skb, dev, net);
                 if (skb == NULL)
                         continue;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 827a3f5ff3bb..fcd3c66ded16 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -195,37 +195,37 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         const struct ipv6_pinfo *np = inet6_sk(sk);
         struct in6_addr *first_hop = &fl6->daddr;
         struct dst_entry *dst = skb_dst(skb);
+        unsigned int head_room;
         struct ipv6hdr *hdr;
         u8  proto = fl6->flowi6_proto;
         int seg_len = skb->len;
         int hlimit = -1;
         u32 mtu;
 
-        if (opt) {
-                unsigned int head_room;
+        head_room = sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
+        if (opt)
+                head_room += opt->opt_nflen + opt->opt_flen;
 
-                /* First: exthdrs may take lots of space (~8K for now)
-                   MAX_HEADER is not enough.
-                 */
-                head_room = opt->opt_nflen + opt->opt_flen;
-                seg_len += head_room;
-                head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
-
-                if (skb_headroom(skb) < head_room) {
-                        struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
-                        if (!skb2) {
-                                IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                              IPSTATS_MIB_OUTDISCARDS);
-                                kfree_skb(skb);
-                                return -ENOBUFS;
-                        }
-                        if (skb->sk)
-                                skb_set_owner_w(skb2, skb->sk);
-                        consume_skb(skb);
-                        skb = skb2;
+        if (unlikely(skb_headroom(skb) < head_room)) {
+                struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
+                if (!skb2) {
+                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+                                      IPSTATS_MIB_OUTDISCARDS);
+                        kfree_skb(skb);
+                        return -ENOBUFS;
                 }
+                if (skb->sk)
+                        skb_set_owner_w(skb2, skb->sk);
+                consume_skb(skb);
+                skb = skb2;
+        }
+
+        if (opt) {
+                seg_len += opt->opt_nflen + opt->opt_flen;
+
                 if (opt->opt_flen)
                         ipv6_push_frag_opts(skb, opt, &proto);
+
                 if (opt->opt_nflen)
                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
                                              &fl6->saddr);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index d219979c3e52..181da2c40f9a 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -341,7 +341,7 @@ static bool
 nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev,  struct net_device *dev)
 {
         struct sk_buff *fp, *head = fq->q.fragments;
-        int    payload_len;
+        int    payload_len, delta;
         u8 ecn;
 
         inet_frag_kill(&fq->q);
@@ -363,10 +363,16 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev,  struct net_devic
                 return false;
         }
 
+        delta = - head->truesize;
+
         /* Head of list must not be cloned. */
         if (skb_unclone(head, GFP_ATOMIC))
                 return false;
 
+        delta += head->truesize;
+        if (delta)
+                add_frag_mem_limit(fq->q.net, delta);
+
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 5c3c92713096..aa26c45486d9 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -281,7 +281,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
 {
         struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
         struct sk_buff *fp, *head = fq->q.fragments;
-        int    payload_len;
+        int    payload_len, delta;
         unsigned int nhoff;
         int sum_truesize;
         u8 ecn;
@@ -322,10 +322,16 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         if (payload_len > IPV6_MAXPLEN)
                 goto out_oversize;
 
+        delta = - head->truesize;
+
         /* Head of list must not be cloned. */
         if (skb_unclone(head, GFP_ATOMIC))
                 goto out_oom;
 
+        delta += head->truesize;
+        if (delta)
+                add_frag_mem_limit(fq->q.net, delta);
+
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index a8854dd3e9c5..8181ee7e1e27 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -347,6 +347,7 @@ static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
                 struct ipv6hdr *hdr = ipv6_hdr(skb);
                 struct flowi6 fl6;
 
+                memset(&fl6, 0, sizeof(fl6));
                 fl6.daddr = hdr->daddr;
                 fl6.saddr = hdr->saddr;
                 fl6.flowlabel = ip6_flowinfo(hdr);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 51622333d460..818aa0060349 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2891,7 +2891,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
 
         len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
               beacon->proberesp_ies_len + beacon->assocresp_ies_len +
-              beacon->probe_resp_len;
+              beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
 
         new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
         if (!new_beacon)
@@ -2934,8 +2934,9 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
                 memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
                 pos += beacon->probe_resp_len;
         }
-        if (beacon->ftm_responder)
-                new_beacon->ftm_responder = beacon->ftm_responder;
+
+        /* might copy -1, meaning no changes requested */
+        new_beacon->ftm_responder = beacon->ftm_responder;
         if (beacon->lci) {
                 new_beacon->lci_len = beacon->lci_len;
                 new_beacon->lci = pos;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5836ddeac9e3..5f3c81e705c7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1015,6 +1015,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         if (local->open_count == 0)
                 ieee80211_clear_tx_pending(local);
 
+        sdata->vif.bss_conf.beacon_int = 0;
+
         /*
          * If the interface goes down while suspended, presumably because
          * the device was unplugged and that happens before our resume,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d2bc8d57c87e..bcf5ffc1567a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2766,6 +2766,7 @@ static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sta_info *sta;
+        bool result = true;
 
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
@@ -2778,15 +2779,18 @@ static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(sdata, bssid);
         if (!sta) {
                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
-                return false;
+                result = false;
+                goto out;
         }
         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
-                return false;
+                result = false;
+                goto out;
         }
-        mutex_unlock(&sdata->local->sta_mtx);
 
-        return true;
+out:
+        mutex_unlock(&sdata->local->sta_mtx);
+        return result;
 }
 
 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3bd3b5769797..428f7ad5f9b5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1403,6 +1403,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
                 return RX_CONTINUE;
 
         if (ieee80211_is_ctl(hdr->frame_control) ||
+            ieee80211_is_nullfunc(hdr->frame_control) ||
             ieee80211_is_qos_nullfunc(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1))
                 return RX_CONTINUE;
@@ -3063,7 +3064,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         cfg80211_sta_opmode_change_notify(sdata->dev,
                                                           rx->sta->addr,
                                                           &sta_opmode,
-                                                          GFP_KERNEL);
+                                                          GFP_ATOMIC);
                         goto handled;
                 }
                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
@@ -3100,7 +3101,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         cfg80211_sta_opmode_change_notify(sdata->dev,
                                                           rx->sta->addr,
                                                           &sta_opmode,
-                                                          GFP_KERNEL);
+                                                          GFP_ATOMIC);
                         goto handled;
                 }
                 default:
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index aa4afbf0abaf..a794ca729000 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -964,6 +964,8 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw,
                         /* Track when last TDLS packet was ACKed */
                         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
                                 sta->status_stats.last_tdls_pkt_time = jiffies;
+                } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                        return;
                 } else {
                         ieee80211_lost_packet(sta, info);
                 }
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e0ccee23fbcd..1f536ba573b4 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -439,8 +439,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
                 info->hw_queue = tx->sdata->vif.cab_queue;
 
-        /* no stations in PS mode */
-        if (!atomic_read(&ps->num_sta_ps))
+        /* no stations in PS mode and no buffered packets */
+        if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index a4660c48ff01..cd94f925495a 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1166,7 +1166,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
                                 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                         if (err) {
                                 net_warn_ratelimited("openvswitch: zone: %u "
-                                        "execeeds conntrack limit\n",
+                                        "exceeds conntrack limit\n",
                                         info->zone.id);
                                 return err;
                         }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 37c9b8f0e10f..ec8ec55e0fe8 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -85,7 +85,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                                int ovr, int bind, bool rtnl_held,
                                struct netlink_ext_ack *extack)
 {
-        int ret = 0, err;
+        int ret = 0, tcfp_result = TC_ACT_OK, err, size;
         struct nlattr *tb[TCA_POLICE_MAX + 1];
         struct tc_police *parm;
         struct tcf_police *police;
@@ -93,7 +93,6 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         struct tc_action_net *tn = net_generic(net, police_net_id);
         struct tcf_police_params *new;
         bool exists = false;
-        int size;
 
         if (nla == NULL)
                 return -EINVAL;
@@ -160,6 +159,16 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                 goto failure;
         }
 
+        if (tb[TCA_POLICE_RESULT]) {
+                tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
+                if (TC_ACT_EXT_CMP(tcfp_result, TC_ACT_GOTO_CHAIN)) {
+                        NL_SET_ERR_MSG(extack,
+                                       "goto chain not allowed on fallback");
+                        err = -EINVAL;
+                        goto failure;
+                }
+        }
+
         new = kzalloc(sizeof(*new), GFP_KERNEL);
         if (unlikely(!new)) {
                 err = -ENOMEM;
@@ -167,6 +176,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         }
 
         /* No failure allowed after this point */
+        new->tcfp_result = tcfp_result;
         new->tcfp_mtu = parm->mtu;
         if (!new->tcfp_mtu) {
                 new->tcfp_mtu = ~0;
@@ -196,16 +206,6 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
         if (tb[TCA_POLICE_AVRATE])
                 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
 
-        if (tb[TCA_POLICE_RESULT]) {
-                new->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
-                if (TC_ACT_EXT_CMP(new->tcfp_result, TC_ACT_GOTO_CHAIN)) {
-                        NL_SET_ERR_MSG(extack,
-                                       "goto chain not allowed on fallback");
-                        err = -EINVAL;
-                        goto failure;
-                }
-        }
-
         spin_lock_bh(&police->tcf_lock);
         spin_lock_bh(&police->tcfp_lock);
         police->tcfp_t_c = ktime_get_ns();
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index c6c327874abc..71312d7bd8f4 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1238,18 +1238,16 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         if (err)
                 goto errout_idr;
 
-        if (!tc_skip_sw(fnew->flags)) {
-                if (!fold && fl_lookup(fnew->mask, &fnew->mkey)) {
-                        err = -EEXIST;
-                        goto errout_mask;
-                }
-
-                err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node,
-                                             fnew->mask->filter_ht_params);
-                if (err)
-                        goto errout_mask;
+        if (!fold && fl_lookup(fnew->mask, &fnew->mkey)) {
+                err = -EEXIST;
+                goto errout_mask;
         }
 
+        err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node,
+                                     fnew->mask->filter_ht_params);
+        if (err)
+                goto errout_mask;
+
         if (!tc_skip_hw(fnew->flags)) {
                 err = fl_hw_replace_filter(tp, fnew, extack);
                 if (err)
@@ -1303,9 +1301,8 @@ static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
         struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f = arg;
 
-        if (!tc_skip_sw(f->flags))
-                rhashtable_remove_fast(&f->mask->ht, &f->ht_node,
-                                       f->mask->filter_ht_params);
+        rhashtable_remove_fast(&f->mask->ht, &f->ht_node,
+                               f->mask->filter_ht_params);
         __fl_delete(tp, f, extack);
         *last = list_empty(&head->masks);
         return 0;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 2c38e3d07924..22cd46a60057 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -431,6 +431,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         int count = 1;
         int rc = NET_XMIT_SUCCESS;
 
+        /* Do not fool qdisc_drop_all() */
+        skb->prev = NULL;
+
         /* Random duplication */
         if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
                 ++count;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 6a28b96e779e..914750b819b2 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -118,9 +118,6 @@ static struct sctp_association *sctp_association_init(
         asoc->flowlabel = sp->flowlabel;
         asoc->dscp = sp->dscp;
 
-        /* Initialize default path MTU. */
-        asoc->pathmtu = sp->pathmtu;
-
         /* Set association default SACK delay */
         asoc->sackdelay = msecs_to_jiffies(sp->sackdelay);
         asoc->sackfreq = sp->sackfreq;
@@ -252,6 +249,10 @@ static struct sctp_association *sctp_association_init(
                              0, gfp))
                 goto fail_init;
 
+        /* Initialize default path MTU. */
+        asoc->pathmtu = sp->pathmtu;
+        sctp_assoc_update_frag_point(asoc);
+
         /* Assume that peer would support both address types unless we are
          * told otherwise.
          */
@@ -434,7 +435,7 @@ static void sctp_association_destroy(struct sctp_association *asoc)
 
         WARN_ON(atomic_read(&asoc->rmem_alloc));
 
-        kfree(asoc);
+        kfree_rcu(asoc, rcu);
         SCTP_DBG_OBJCNT_DEC(assoc);
 }
 
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index ce8087846f05..d2048de86e7c 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -191,6 +191,12 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
          * the packet
          */
         max_data = asoc->frag_point;
+        if (unlikely(!max_data)) {
+                max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk),
+                                               sctp_datachk_len(&asoc->stream));
+                pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)",
+                                    __func__, asoc, max_data);
+        }
 
         /* If the the peer requested that we authenticate DATA chunks
          * we need to account for bundling of the AUTH chunks along with
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 4a4fd1971255..f4ac6c592e13 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2462,6 +2462,9 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
                              asoc->c.sinit_max_instreams, gfp))
                 goto clean_up;
 
+        /* Update frag_point when stream_interleave may get changed. */
+        sctp_assoc_update_frag_point(asoc);
+
         if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
                 goto clean_up;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index bf618d1b41fd..b8cebd5a87e5 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3324,8 +3324,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
                 __u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) :
                                  sizeof(struct sctp_data_chunk);
 
-                min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT,
-                                           datasize);
+                min_len = sctp_min_frag_point(sp, datasize);
                 max_len = SCTP_MAX_CHUNK_LEN - datasize;
 
                 if (val < min_len || val > max_len)
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 5d3f252659f1..ba765473d1f0 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1791,6 +1791,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp)
         for (i=0; i < rqstp->rq_enc_pages_num; i++)
                 __free_page(rqstp->rq_enc_pages[i]);
         kfree(rqstp->rq_enc_pages);
+        rqstp->rq_release_snd_buf = NULL;
 }
 
 static int
@@ -1799,6 +1800,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
         struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
         int first, last, i;
 
+        if (rqstp->rq_release_snd_buf)
+                rqstp->rq_release_snd_buf(rqstp);
+
         if (snd_buf->page_len == 0) {
                 rqstp->rq_enc_pages_num = 0;
                 return 0;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index ae3b8145da35..c6782aa47525 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1915,6 +1915,13 @@ call_connect_status(struct rpc_task *task)
         struct rpc_clnt *clnt = task->tk_client;
         int status = task->tk_status;
 
+        /* Check if the task was already transmitted */
+        if (!test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate)) {
+                xprt_end_transmit(task);
+                task->tk_action = call_transmit_status;
+                return;
+        }
+
         dprint_status(task);
 
         trace_rpc_connect_status(task);
@@ -2302,6 +2309,7 @@ out_retry:
         task->tk_status = 0;
         /* Note: rpc_verify_header() may have freed the RPC slot */
         if (task->tk_rqstp == req) {
+                xdr_free_bvec(&req->rq_rcv_buf);
                 req->rq_reply_bytes_recvd = req->rq_rcv_buf.len = 0;
                 if (task->tk_client->cl_discrtry)
                         xprt_conditional_disconnect(req->rq_xprt,
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 86bea4520c4d..ce927002862a 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -826,8 +826,15 @@ void xprt_connect(struct rpc_task *task)
                         return;
                 if (xprt_test_and_set_connecting(xprt))
                         return;
-                xprt->stat.connect_start = jiffies;
-                xprt->ops->connect(xprt, task);
+                /* Race breaker */
+                if (!xprt_connected(xprt)) {
+                        xprt->stat.connect_start = jiffies;
+                        xprt->ops->connect(xprt, task);
+                } else {
+                        xprt_clear_connecting(xprt);
+                        task->tk_status = 0;
+                        rpc_wake_up_queued_task(&xprt->pending, task);
+                }
         }
         xprt_release_write(xprt, task);
 }
@@ -1623,6 +1630,8 @@ xprt_request_init(struct rpc_task *task)
         req->rq_snd_buf.buflen = 0;
         req->rq_rcv_buf.len = 0;
         req->rq_rcv_buf.buflen = 0;
+        req->rq_snd_buf.bvec = NULL;
+        req->rq_rcv_buf.bvec = NULL;
         req->rq_release_snd_buf = NULL;
         xprt_reset_majortimeo(req);
         dprintk("RPC: %5u reserved req %p xid %08x\n", task->tk_pid,
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ae77c71c1f64..8a5e823e0b33 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -330,18 +330,16 @@ xs_alloc_sparse_pages(struct xdr_buf *buf, size_t want, gfp_t gfp)
 {
         size_t i,n;
 
-        if (!(buf->flags & XDRBUF_SPARSE_PAGES))
+        if (!want || !(buf->flags & XDRBUF_SPARSE_PAGES))
                 return want;
-        if (want > buf->page_len)
-                want = buf->page_len;
         n = (buf->page_base + want + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < n; i++) {
                 if (buf->pages[i])
                         continue;
                 buf->bvec[i].bv_page = buf->pages[i] = alloc_page(gfp);
                 if (!buf->pages[i]) {
-                        buf->page_len = (i * PAGE_SIZE) - buf->page_base;
-                        return buf->page_len;
+                        i *= PAGE_SIZE;
+                        return i > buf->page_base ? i - buf->page_base : 0;
                 }
         }
         return want;
@@ -378,8 +376,8 @@ static ssize_t
 xs_read_discard(struct socket *sock, struct msghdr *msg, int flags,
                 size_t count)
 {
-        struct kvec kvec = { 0 };
-        return xs_read_kvec(sock, msg, flags | MSG_TRUNC, &kvec, count, 0);
+        iov_iter_discard(&msg->msg_iter, READ, count);
+        return sock_recvmsg(sock, msg, flags);
 }
 
 static ssize_t
@@ -398,16 +396,17 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                 if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
                         goto out;
                 if (ret != want)
-                        goto eagain;
+                        goto out;
                 seek = 0;
         } else {
                 seek -= buf->head[0].iov_len;
                 offset += buf->head[0].iov_len;
         }
-        if (seek < buf->page_len) {
-                want = xs_alloc_sparse_pages(buf,
-                                min_t(size_t, count - offset, buf->page_len),
-                                GFP_NOWAIT);
+
+        want = xs_alloc_sparse_pages(buf,
+                        min_t(size_t, count - offset, buf->page_len),
+                        GFP_NOWAIT);
+        if (seek < want) {
                 ret = xs_read_bvec(sock, msg, flags, buf->bvec,
                                 xdr_buf_pagecount(buf),
                                 want + buf->page_base,
@@ -418,12 +417,13 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                 if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
                         goto out;
                 if (ret != want)
-                        goto eagain;
+                        goto out;
                 seek = 0;
         } else {
-                seek -= buf->page_len;
-                offset += buf->page_len;
+                seek -= want;
+                offset += want;
         }
+
         if (seek < buf->tail[0].iov_len) {
                 want = min_t(size_t, count - offset, buf->tail[0].iov_len);
                 ret = xs_read_kvec(sock, msg, flags, &buf->tail[0], want, seek);
@@ -433,17 +433,13 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                 if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
                         goto out;
                 if (ret != want)
-                        goto eagain;
+                        goto out;
         } else
                 offset += buf->tail[0].iov_len;
         ret = -EMSGSIZE;
-        msg->msg_flags |= MSG_TRUNC;
 out:
         *read = offset - seek_init;
         return ret;
-eagain:
-        ret = -EAGAIN;
-        goto out;
 sock_err:
         offset += seek;
         goto out;
@@ -486,19 +482,20 @@ xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg,
         if (transport->recv.offset == transport->recv.len) {
                 if (xs_read_stream_request_done(transport))
                         msg->msg_flags |= MSG_EOR;
-                return transport->recv.copied;
+                return read;
         }
 
         switch (ret) {
+        default:
+                break;
+        case -EFAULT:
         case -EMSGSIZE:
-                return transport->recv.copied;
+                msg->msg_flags |= MSG_TRUNC;
+                return read;
         case 0:
                 return -ESHUTDOWN;
-        default:
-                if (ret < 0)
-                        return ret;
         }
-        return -EAGAIN;
+        return ret < 0 ? ret : read;
 }
 
 static size_t
@@ -537,7 +534,7 @@ xs_read_stream_call(struct sock_xprt *transport, struct msghdr *msg, int flags)
 
         ret = xs_read_stream_request(transport, msg, flags, req);
         if (msg->msg_flags & (MSG_EOR|MSG_TRUNC))
-                xprt_complete_bc_request(req, ret);
+                xprt_complete_bc_request(req, transport->recv.copied);
 
         return ret;
 }
@@ -570,7 +567,7 @@ xs_read_stream_reply(struct sock_xprt *transport, struct msghdr *msg, int flags)
 
         spin_lock(&xprt->queue_lock);
         if (msg->msg_flags & (MSG_EOR|MSG_TRUNC))
-                xprt_complete_rqst(req->rq_task, ret);
+                xprt_complete_rqst(req->rq_task, transport->recv.copied);
         xprt_unpin_rqst(req);
 out:
         spin_unlock(&xprt->queue_lock);
@@ -591,10 +588,8 @@ xs_read_stream(struct sock_xprt *transport, int flags)
                 if (ret <= 0)
                         goto out_err;
                 transport->recv.offset = ret;
-                if (ret != want) {
-                        ret = -EAGAIN;
-                        goto out_err;
-                }
+                if (transport->recv.offset != want)
+                        return transport->recv.offset;
                 transport->recv.len = be32_to_cpu(transport->recv.fraghdr) &
                         RPC_FRAGMENT_SIZE_MASK;
                 transport->recv.offset -= sizeof(transport->recv.fraghdr);
@@ -602,6 +597,9 @@ xs_read_stream(struct sock_xprt *transport, int flags)
         }
 
         switch (be32_to_cpu(transport->recv.calldir)) {
+        default:
+                msg.msg_flags |= MSG_TRUNC;
+                break;
         case RPC_CALL:
                 ret = xs_read_stream_call(transport, &msg, flags);
                 break;
@@ -616,6 +614,9 @@ xs_read_stream(struct sock_xprt *transport, int flags)
                 goto out_err;
         read += ret;
         if (transport->recv.offset < transport->recv.len) {
+                if (!(msg.msg_flags & MSG_TRUNC))
+                        return read;
+                msg.msg_flags = 0;
                 ret = xs_read_discard(transport->sock, &msg, flags,
                                 transport->recv.len - transport->recv.offset);
                 if (ret <= 0)
@@ -623,7 +624,7 @@ xs_read_stream(struct sock_xprt *transport, int flags)
                 transport->recv.offset += ret;
                 read += ret;
                 if (transport->recv.offset != transport->recv.len)
-                        return -EAGAIN;
+                        return read;
         }
         if (xs_read_stream_request_done(transport)) {
                 trace_xs_stream_read_request(transport);
@@ -633,13 +634,7 @@ xs_read_stream(struct sock_xprt *transport, int flags)
         transport->recv.len = 0;
         return read;
 out_err:
-        switch (ret) {
-        case 0:
-        case -ESHUTDOWN:
-                xprt_force_disconnect(&transport->xprt);
-                return -ESHUTDOWN;
-        }
-        return ret;
+        return ret != 0 ? ret : -ESHUTDOWN;
 }
 
 static void xs_stream_data_receive(struct sock_xprt *transport)
@@ -648,12 +643,12 @@ static void xs_stream_data_receive(struct sock_xprt *transport)
         ssize_t ret = 0;
 
         mutex_lock(&transport->recv_mutex);
+        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         if (transport->sock == NULL)
                 goto out;
-        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         for (;;) {
                 ret = xs_read_stream(transport, MSG_DONTWAIT);
-                if (ret <= 0)
+                if (ret < 0)
                         break;
                 read += ret;
                 cond_resched();
@@ -1345,10 +1340,10 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
         int err;
 
         mutex_lock(&transport->recv_mutex);
+        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         sk = transport->inet;
         if (sk == NULL)
                 goto out;
-        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         for (;;) {
                 skb = skb_recv_udp(sk, 0, 1, &err);
                 if (skb == NULL)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 12b3edf70a7b..1615e503f8e3 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -272,11 +272,11 @@ void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 
         p1 = (u8*)(ht_capa);
         p2 = (u8*)(ht_capa_mask);
-        for (i = 0; i<sizeof(*ht_capa); i++)
+        for (i = 0; i < sizeof(*ht_capa); i++)
                 p1[i] &= p2[i];
 }
 
-/*  Do a logical ht_capa &= ht_capa_mask.  */
+/*  Do a logical vht_capa &= vht_capa_mask.  */
 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                                 const struct ieee80211_vht_cap *vht_capa_mask)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 744b5851bbf9..8d763725498c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7870,6 +7870,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         }
 
         memset(&params, 0, sizeof(params));
+        params.beacon_csa.ftm_responder = -1;
 
         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index d536b07582f8..f741d8376a46 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -642,11 +642,15 @@ static bool cfg80211_is_all_idle(void)
          * All devices must be idle as otherwise if you are actively
          * scanning some new beacon hints could be learned and would
          * count as new regulatory hints.
+         * Also if there is any other active beaconing interface we
+         * need not issue a disconnect hint and reset any info such
+         * as chan dfs state, etc.
          */
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
                         wdev_lock(wdev);
-                        if (wdev->conn || wdev->current_bss)
+                        if (wdev->conn || wdev->current_bss ||
+                            cfg80211_beaconing_iface_active(wdev))
                                 is_all_idle = false;
                         wdev_unlock(wdev);
                 }
@@ -1171,6 +1175,8 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
                                   rdev->wiphy.ht_capa_mod_mask);
+        cfg80211_oper_and_vht_capa(&connect->vht_capa_mask,
+                                   rdev->wiphy.vht_capa_mod_mask);
 
         if (connkeys && connkeys->def >= 0) {
                 int idx;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ef14d80ca03e..d473bd135da8 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1421,6 +1421,8 @@ size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
                                                           ies[pos + ext],
                                                           ext == 2))
                                         pos = skip_ie(ies, ielen, pos);
+                                else
+                                        break;
                         }
                 } else {
                         pos = skip_ie(ies, ielen, pos);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index d49aa79b7997..5121729b8b63 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
         }
 
         len = *skb->data;
-        needed = 1 + (len >> 4) + (len & 0x0f);
+        needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
 
         if (!pskb_may_pull(skb, needed)) {
                 /* packet is too short to hold the addresses it claims
@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr,
         sk_for_each(s, &x25_list)
                 if ((!strcmp(addr->x25_addr,
                         x25_sk(s)->source_addr.x25_addr) ||
-                                !strcmp(addr->x25_addr,
+                                !strcmp(x25_sk(s)->source_addr.x25_addr,
                                         null_x25_address.x25_addr)) &&
                                         s->sk_state == TCP_LISTEN) {
                         /*
@@ -688,11 +688,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
-        len = strlen(addr->sx25_addr.x25_addr);
-        for (i = 0; i < len; i++) {
-                if (!isdigit(addr->sx25_addr.x25_addr[i])) {
-                        rc = -EINVAL;
-                        goto out;
+        /* check for the null_x25_address */
+        if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
+
+                len = strlen(addr->sx25_addr.x25_addr);
+                for (i = 0; i < len; i++) {
+                        if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+                                rc = -EINVAL;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 3c12cae32001..afb26221d8a8 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -142,6 +142,15 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                         sk->sk_state_change(sk);
                 break;
         }
+        case X25_CALL_REQUEST:
+                /* call collision */
+                x25->causediag.cause      = 0x01;
+                x25->causediag.diagnostic = 0x48;
+
+                x25_write_internal(sk, X25_CLEAR_REQUEST);
+                x25_disconnect(sk, EISCONN, 0x01, 0x48);
+                break;
+
         case X25_CLEAR_REQUEST:
                 if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
                         goto out_clear;
diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
index 8081b6cf67d2..34414c6efad6 100755
--- a/scripts/checkstack.pl
+++ b/scripts/checkstack.pl
@@ -47,8 +47,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
         $xs     = "[0-9a-f ]";  # hex character or space
         $funcre = qr/^$x* <(.*)>:$/;
         if ($arch eq 'aarch64') {
-                #ffffffc0006325cc:       a9bb7bfd        stp     x29, x30, [sp,#-80]!
-                $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o;
+                #ffffffc0006325cc:       a9bb7bfd        stp     x29, x30, [sp, #-80]!
+                $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
         } elsif ($arch eq 'arm') {
                 #c0008ffc:      e24dd064        sub     sp, sp, #100    ; 0x64
                 $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
index 2f48da98b5d4..dbd37460c573 100644
--- a/scripts/gcc-plugins/stackleak_plugin.c
+++ b/scripts/gcc-plugins/stackleak_plugin.c
@@ -363,10 +363,12 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
                                                 PASS_POS_INSERT_BEFORE);
 
         /*
-         * The stackleak_cleanup pass should be executed after the
-         * "reload" pass, when the stack frame size is final.
+         * The stackleak_cleanup pass should be executed before the "*free_cfg"
+         * pass. It's the moment when the stack frame size is already final,
+         * function prologues and epilogues are generated, and the
+         * machine-dependent code transformations are not done.
          */
-        PASS_INFO(stackleak_cleanup, "reload", 1, PASS_POS_INSERT_AFTER);
+        PASS_INFO(stackleak_cleanup, "*free_cfg", 1, PASS_POS_INSERT_BEFORE);
 
         if (!plugin_default_version_check(version, &gcc_version)) {
                 error(G_("incompatible gcc/plugin versions"));
diff --git a/scripts/spdxcheck.py b/scripts/spdxcheck.py
index 5056fb3b897d..e559c6294c39 100755
--- a/scripts/spdxcheck.py
+++ b/scripts/spdxcheck.py
@@ -168,6 +168,7 @@ class id_parser(object):
         self.curline = 0
         try:
             for line in fd:
+                line = line.decode(locale.getpreferredencoding(False), errors='ignore')
                 self.curline += 1
                 if self.curline > maxlines:
                     break
@@ -249,12 +250,13 @@ if __name__ == '__main__':
 
     try:
         if len(args.path) and args.path[0] == '-':
-            parser.parse_lines(sys.stdin, args.maxlines, '-')
+            stdin = os.fdopen(sys.stdin.fileno(), 'rb')
+            parser.parse_lines(stdin, args.maxlines, '-')
         else:
             if args.path:
                 for p in args.path:
                     if os.path.isfile(p):
-                        parser.parse_lines(open(p), args.maxlines, p)
+                        parser.parse_lines(open(p, 'rb'), args.maxlines, p)
                     elif os.path.isdir(p):
                         scan_git_subtree(repo.head.reference.commit.tree, p)
                     else:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 66c90f486af9..818dff1de545 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -36,6 +36,7 @@
 #include <sound/timer.h>
 #include <sound/minors.h>
 #include <linux/uio.h>
+#include <linux/delay.h>
 
 #include "pcm_local.h"
 
@@ -91,12 +92,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
  * and this may lead to a deadlock when the code path takes read sem
  * twice (e.g. one in snd_pcm_action_nonatomic() and another in
  * snd_pcm_stream_lock()).  As a (suboptimal) workaround, let writer to
- * spin until it gets the lock.
+ * sleep until all the readers are completed without blocking by writer.
  */
-static inline void down_write_nonblock(struct rw_semaphore *lock)
+static inline void down_write_nonfifo(struct rw_semaphore *lock)
 {
         while (!down_write_trylock(lock))
-                cond_resched();
+                msleep(1);
 }
 
 #define PCM_LOCK_DEFAULT        0
@@ -1967,7 +1968,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
                 res = -ENOMEM;
                 goto _nolock;
         }
-        down_write_nonblock(&snd_pcm_link_rwsem);
+        down_write_nonfifo(&snd_pcm_link_rwsem);
         write_lock_irq(&snd_pcm_link_rwlock);
         if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
             substream->runtime->status->state != substream1->runtime->status->state ||
@@ -2014,7 +2015,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
         struct snd_pcm_substream *s;
         int res = 0;
 
-        down_write_nonblock(&snd_pcm_link_rwsem);
+        down_write_nonfifo(&snd_pcm_link_rwsem);
         write_lock_irq(&snd_pcm_link_rwlock);
         if (!snd_pcm_stream_linked(substream)) {
                 res = -EALREADY;
@@ -2369,7 +2370,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream)
 
 static void pcm_release_private(struct snd_pcm_substream *substream)
 {
-        snd_pcm_unlink(substream);
+        if (snd_pcm_stream_linked(substream))
+                snd_pcm_unlink(substream);
 }
 
 void snd_pcm_release_substream(struct snd_pcm_substream *substream)
diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
index 64c3cb0fb926..654a50319198 100644
--- a/sound/firewire/fireface/ff-protocol-ff400.c
+++ b/sound/firewire/fireface/ff-protocol-ff400.c
@@ -30,7 +30,7 @@ static int ff400_get_clock(struct snd_ff *ff, unsigned int *rate,
         int err;
 
         err = snd_fw_transaction(ff->unit, TCODE_READ_QUADLET_REQUEST,
-                                 FF400_SYNC_STATUS, &reg, sizeof(reg), 0);
+                                 FF400_CLOCK_CONFIG, &reg, sizeof(reg), 0);
         if (err < 0)
                 return err;
         data = le32_to_cpu(reg);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 0bbdf1a01e76..76f03abd15ab 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2498,6 +2498,10 @@ static const struct pci_device_id azx_ids[] = {
         /* AMD Hudson */
         { PCI_DEVICE(0x1022, 0x780d),
           .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+        /* AMD Stoney */
+        { PCI_DEVICE(0x1022, 0x157a),
+          .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+                         AZX_DCAPS_PM_RUNTIME },
         /* AMD Raven */
         { PCI_DEVICE(0x1022, 0x15e3),
           .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 06f93032d0cc..15021c839372 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
                 { 0x19, 0x21a11010 }, /* dock mic */
                 { }
         };
+        /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
+         * the speaker output becomes too low by some reason on Thinkpads with
+         * ALC298 codec
+         */
+        static hda_nid_t preferred_pairs[] = {
+                0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
+                0
+        };
         struct alc_spec *spec = codec->spec;
 
         if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->gen.preferred_dacs = preferred_pairs;
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
                 snd_hda_apply_pincfgs(codec, pincfgs);
         } else if (action == HDA_FIXUP_ACT_INIT) {
@@ -5510,6 +5519,10 @@ enum {
         ALC221_FIXUP_HP_HEADSET_MIC,
         ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
         ALC295_FIXUP_HP_AUTO_MUTE,
+        ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
+        ALC294_FIXUP_ASUS_MIC,
+        ALC294_FIXUP_ASUS_HEADSET_MIC,
+        ALC294_FIXUP_ASUS_SPK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6382,11 +6395,52 @@ static const struct hda_fixup alc269_fixups[] = {
         [ALC285_FIXUP_LENOVO_HEADPHONE_NOISE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc285_fixup_invalidate_dacs,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_THINKPAD_ACPI
         },
         [ALC295_FIXUP_HP_AUTO_MUTE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_auto_mute_via_amp,
         },
+        [ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MIC
+        },
+        [ALC294_FIXUP_ASUS_MIC] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x13, 0x90a60160 }, /* use as internal mic */
+                        { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
+        [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
+        [ALC294_FIXUP_ASUS_SPK] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        /* Set EAPD high */
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x40 },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x8800 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6401,7 +6455,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
         SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
         SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+        SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+        SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
         SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
@@ -6525,6 +6583,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+        SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK),
         SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
@@ -7065,6 +7124,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x19, 0x04a11040},
                 {0x21, 0x04211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x17, 0x90170110},
+                {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
@@ -7128,6 +7191,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
         SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC292_STANDARD_PINS,
                 {0x13, 0x90a60140}),
+        SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_MIC,
+                {0x14, 0x90170110},
+                {0x1b, 0x90a70130},
+                {0x21, 0x04211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
+                {0x12, 0x90a60130},
+                {0x17, 0x90170110},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC295_STANDARD_PINS,
                 {0x17, 0x21014020},
@@ -7200,6 +7271,37 @@ static void alc269_fill_coef(struct hda_codec *codec)
         alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
 
+static void alc294_hp_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        int i, val;
+
+        if (!hp_pin)
+                return;
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+        msleep(100);
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+
+        /* Wait for depop procedure finish  */
+        val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        for (i = 0; i < 20 && val & 0x0080; i++) {
+                msleep(50);
+                val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        }
+        /* Set HP depop to auto mode */
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+        msleep(50);
+}
+
 /*
  */
 static int patch_alc269(struct hda_codec *codec)
@@ -7325,6 +7427,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC294;
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
+                alc294_hp_init(codec);
                 break;
         case 0x10ec0300:
                 spec->codec_variant = ALC269_TYPE_ALC300;
@@ -7336,6 +7439,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC700;
                 spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
+                alc294_hp_init(codec);
                 break;
 
         }
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 2bfe4e80a6b9..a105947eaf55 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf,
 
  __error:
         if (chip) {
+                /* chip->active is inside the chip->card object,
+                 * decrement before memory is possibly returned.
+                 */
+                atomic_dec(&chip->active);
                 if (!chip->num_interfaces)
                         snd_card_free(chip->card);
-                atomic_dec(&chip->active);
         }
         mutex_unlock(&register_mutex);
         return err;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 8a945ece9869..6623cafc94f2 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
+        case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
         case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
         case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
         case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
index 55bc512a1831..e4e6e2b3fd84 100644
--- a/tools/bpf/bpftool/btf_dumper.c
+++ b/tools/bpf/bpftool/btf_dumper.c
@@ -32,7 +32,7 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
 }
 
 static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
-                               const void *data)
+                               __u8 bit_offset, const void *data)
 {
         int actual_type_id;
 
@@ -40,7 +40,7 @@ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
         if (actual_type_id < 0)
                 return actual_type_id;
 
-        return btf_dumper_do_type(d, actual_type_id, 0, data);
+        return btf_dumper_do_type(d, actual_type_id, bit_offset, data);
 }
 
 static void btf_dumper_enum(const void *data, json_writer_t *jw)
@@ -237,7 +237,7 @@ static int btf_dumper_do_type(const struct btf_dumper *d, __u32 type_id,
         case BTF_KIND_VOLATILE:
         case BTF_KIND_CONST:
         case BTF_KIND_RESTRICT:
-                return btf_dumper_modifier(d, type_id, data);
+                return btf_dumper_modifier(d, type_id, bit_offset, data);
         default:
                 jsonw_printf(d->jw, "(unsupported-kind");
                 return -EINVAL;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 852dc17ab47a..72c453a8bf50 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2170,7 +2170,7 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
- * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 flags)
  *      Description
  *              Look for TCP socket matching *tuple*, optionally in a child
  *              network namespace *netns*. The return value must be checked,
@@ -2187,12 +2187,14 @@ union bpf_attr {
  *              **sizeof**\ (*tuple*\ **->ipv6**)
  *                      Look for an IPv6 socket.
  *
- *              If the *netns* is zero, then the socket lookup table in the
- *              netns associated with the *ctx* will be used. For the TC hooks,
- *              this in the netns of the device in the skb. For socket hooks,
- *              this in the netns of the socket. If *netns* is non-zero, then
- *              it specifies the ID of the netns relative to the netns
- *              associated with the *ctx*.
+ *              If the *netns* is a negative signed 32-bit integer, then the
+ *              socket lookup table in the netns associated with the *ctx* will
+ *              will be used. For the TC hooks, this is the netns of the device
+ *              in the skb. For socket hooks, this is the netns of the socket.
+ *              If *netns* is any other signed 32-bit value greater than or
+ *              equal to zero then it specifies the ID of the netns relative to
+ *              the netns associated with the *ctx*. *netns* values beyond the
+ *              range of 32-bit integers are reserved for future use.
  *
  *              All values for *flags* are reserved for future usage, and must
  *              be left at zero.
@@ -2201,8 +2203,10 @@ union bpf_attr {
  *              **CONFIG_NET** configuration option.
  *      Return
  *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *              For sockets with reuseport option, the *struct bpf_sock*
+ *              result is from reuse->socks[] using the hash of the tuple.
  *
- * struct bpf_sock *bpf_sk_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u32 netns, u64 flags)
+ * struct bpf_sock *bpf_sk_lookup_udp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 flags)
  *      Description
  *              Look for UDP socket matching *tuple*, optionally in a child
  *              network namespace *netns*. The return value must be checked,
@@ -2219,12 +2223,14 @@ union bpf_attr {
  *              **sizeof**\ (*tuple*\ **->ipv6**)
  *                      Look for an IPv6 socket.
  *
- *              If the *netns* is zero, then the socket lookup table in the
- *              netns associated with the *ctx* will be used. For the TC hooks,
- *              this in the netns of the device in the skb. For socket hooks,
- *              this in the netns of the socket. If *netns* is non-zero, then
- *              it specifies the ID of the netns relative to the netns
- *              associated with the *ctx*.
+ *              If the *netns* is a negative signed 32-bit integer, then the
+ *              socket lookup table in the netns associated with the *ctx* will
+ *              will be used. For the TC hooks, this is the netns of the device
+ *              in the skb. For socket hooks, this is the netns of the socket.
+ *              If *netns* is any other signed 32-bit value greater than or
+ *              equal to zero then it specifies the ID of the netns relative to
+ *              the netns associated with the *ctx*. *netns* values beyond the
+ *              range of 32-bit integers are reserved for future use.
  *
  *              All values for *flags* are reserved for future usage, and must
  *              be left at zero.
@@ -2233,6 +2239,8 @@ union bpf_attr {
  *              **CONFIG_NET** configuration option.
  *      Return
  *              Pointer to *struct bpf_sock*, or NULL in case of failure.
+ *              For sockets with reuseport option, the *struct bpf_sock*
+ *              result is from reuse->socks[] using the hash of the tuple.
  *
  * int bpf_sk_release(struct bpf_sock *sk)
  *      Description
@@ -2405,6 +2413,9 @@ enum bpf_func_id {
 /* BPF_FUNC_perf_event_output for sk_buff input context. */
 #define BPF_F_CTXLEN_MASK               (0xfffffULL << 32)
 
+/* Current network namespace */
+#define BPF_F_CURRENT_NETNS             (-1L)
+
 /* Mode for BPF_FUNC_skb_adjust_room helper. */
 enum bpf_adj_room_mode {
         BPF_ADJ_ROOM_NET,
@@ -2422,6 +2433,12 @@ enum bpf_lwt_encap_mode {
         BPF_LWT_ENCAP_SEG6_INLINE
 };
 
+#define __bpf_md_ptr(type, name)        \
+union {                                 \
+        type name;                      \
+        __u64 :64;                      \
+} __attribute__((aligned(8)))
+
 /* user accessible mirror of in-kernel sk_buff.
  * new fields can only be added to the end of this structure
  */
@@ -2456,7 +2473,7 @@ struct __sk_buff {
         /* ... here. */
 
         __u32 data_meta;
-        struct bpf_flow_keys *flow_keys;
+        __bpf_md_ptr(struct bpf_flow_keys *, flow_keys);
 };
 
 struct bpf_tunnel_key {
@@ -2572,8 +2589,8 @@ enum sk_action {
  * be added to the end of this structure
  */
 struct sk_msg_md {
-        void *data;
-        void *data_end;
+        __bpf_md_ptr(void *, data);
+        __bpf_md_ptr(void *, data_end);
 
         __u32 family;
         __u32 remote_ip4;       /* Stored in network byte order */
@@ -2589,8 +2606,9 @@ struct sk_reuseport_md {
          * Start of directly accessible data. It begins from
          * the tcp/udp header.
          */
-        void *data;
-        void *data_end;         /* End of directly accessible data */
+        __bpf_md_ptr(void *, data);
+        /* End of directly accessible data */
+        __bpf_md_ptr(void *, data_end);
         /*
          * Total length of packet (starting from the tcp/udp header).
          * Note that the directly accessible bytes (data_end - data)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 01ec04bf91b5..6c16ac36d482 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -15,6 +15,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/workqueue.h>
 #include <linux/libnvdimm.h>
+#include <linux/genalloc.h>
 #include <linux/vmalloc.h>
 #include <linux/device.h>
 #include <linux/module.h>
@@ -215,6 +216,8 @@ struct nfit_test {
 
 static struct workqueue_struct *nfit_wq;
 
+static struct gen_pool *nfit_pool;
+
 static struct nfit_test *to_nfit_test(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -1132,6 +1135,9 @@ static void release_nfit_res(void *data)
         list_del(&nfit_res->list);
         spin_unlock(&nfit_test_lock);
 
+        if (resource_size(&nfit_res->res) >= DIMM_SIZE)
+                gen_pool_free(nfit_pool, nfit_res->res.start,
+                                resource_size(&nfit_res->res));
         vfree(nfit_res->buf);
         kfree(nfit_res);
 }
@@ -1144,7 +1150,7 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
                         GFP_KERNEL);
         int rc;
 
-        if (!buf || !nfit_res)
+        if (!buf || !nfit_res || !*dma)
                 goto err;
         rc = devm_add_action(dev, release_nfit_res, nfit_res);
         if (rc)
@@ -1164,6 +1170,8 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
 
         return nfit_res->buf;
  err:
+        if (*dma && size >= DIMM_SIZE)
+                gen_pool_free(nfit_pool, *dma, size);
         if (buf)
                 vfree(buf);
         kfree(nfit_res);
@@ -1172,9 +1180,16 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
 
 static void *test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma)
 {
+        struct genpool_data_align data = {
+                .align = SZ_128M,
+        };
         void *buf = vmalloc(size);
 
-        *dma = (unsigned long) buf;
+        if (size >= DIMM_SIZE)
+                *dma = gen_pool_alloc_algo(nfit_pool, size,
+                                gen_pool_first_fit_align, &data);
+        else
+                *dma = (unsigned long) buf;
         return __test_alloc(t, size, dma, buf);
 }
 
@@ -2839,6 +2854,17 @@ static __init int nfit_test_init(void)
                 goto err_register;
         }
 
+        nfit_pool = gen_pool_create(ilog2(SZ_4M), NUMA_NO_NODE);
+        if (!nfit_pool) {
+                rc = -ENOMEM;
+                goto err_register;
+        }
+
+        if (gen_pool_add(nfit_pool, SZ_4G, SZ_4G, NUMA_NO_NODE)) {
+                rc = -ENOMEM;
+                goto err_register;
+        }
+
         for (i = 0; i < NUM_NFITS; i++) {
                 struct nfit_test *nfit_test;
                 struct platform_device *pdev;
@@ -2894,6 +2920,9 @@ static __init int nfit_test_init(void)
         return 0;
 
  err_register:
+        if (nfit_pool)
+                gen_pool_destroy(nfit_pool);
+
         destroy_workqueue(nfit_wq);
         for (i = 0; i < NUM_NFITS; i++)
                 if (instances[i])
@@ -2917,6 +2946,8 @@ static __exit void nfit_test_exit(void)
         platform_driver_unregister(&nfit_test_driver);
         nfit_test_teardown();
 
+        gen_pool_destroy(nfit_pool);
+
         for (i = 0; i < NUM_NFITS; i++)
                 put_device(&instances[i]->pdev.dev);
         class_destroy(nfit_test_dimm);
diff --git a/tools/testing/radix-tree/Makefile b/tools/testing/radix-tree/Makefile
index acf1afa01c5b..397d6b612502 100644
--- a/tools/testing/radix-tree/Makefile
+++ b/tools/testing/radix-tree/Makefile
@@ -7,6 +7,7 @@ LDLIBS+= -lpthread -lurcu
 TARGETS = main idr-test multiorder xarray
 CORE_OFILES := xarray.o radix-tree.o idr.o linux.o test.o find_bit.o bitmap.o
 OFILES = main.o $(CORE_OFILES) regression1.o regression2.o regression3.o \
+         regression4.o \
          tag_check.o multiorder.o idr-test.o iteration_check.o benchmark.o
 
 ifndef SHIFT
diff --git a/tools/testing/radix-tree/main.c b/tools/testing/radix-tree/main.c
index 77a44c54998f..7a22d6e3732e 100644
--- a/tools/testing/radix-tree/main.c
+++ b/tools/testing/radix-tree/main.c
@@ -308,6 +308,7 @@ int main(int argc, char **argv)
         regression1_test();
         regression2_test();
         regression3_test();
+        regression4_test();
         iteration_test(0, 10 + 90 * long_run);
         iteration_test(7, 10 + 90 * long_run);
         single_thread_tests(long_run);
diff --git a/tools/testing/radix-tree/regression.h b/tools/testing/radix-tree/regression.h
index 3c8a1584e9ee..135145af18b7 100644
--- a/tools/testing/radix-tree/regression.h
+++ b/tools/testing/radix-tree/regression.h
@@ -5,5 +5,6 @@
 void regression1_test(void);
 void regression2_test(void);
 void regression3_test(void);
+void regression4_test(void);
 
 #endif
diff --git a/tools/testing/radix-tree/regression4.c b/tools/testing/radix-tree/regression4.c
new file mode 100644
index 000000000000..cf4e5aba6b08
--- /dev/null
+++ b/tools/testing/radix-tree/regression4.c
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/kernel.h>
+#include <linux/gfp.h>
+#include <linux/slab.h>
+#include <linux/radix-tree.h>
+#include <linux/rcupdate.h>
+#include <stdlib.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <assert.h>
+
+#include "regression.h"
+
+static pthread_barrier_t worker_barrier;
+static int obj0, obj1;
+static RADIX_TREE(mt_tree, GFP_KERNEL);
+
+static void *reader_fn(void *arg)
+{
+        int i;
+        void *entry;
+
+        rcu_register_thread();
+        pthread_barrier_wait(&worker_barrier);
+
+        for (i = 0; i < 1000000; i++) {
+                rcu_read_lock();
+                entry = radix_tree_lookup(&mt_tree, 0);
+                rcu_read_unlock();
+                if (entry != &obj0) {
+                        printf("iteration %d bad entry = %p\n", i, entry);
+                        abort();
+                }
+        }
+
+        rcu_unregister_thread();
+
+        return NULL;
+}
+
+static void *writer_fn(void *arg)
+{
+        int i;
+
+        rcu_register_thread();
+        pthread_barrier_wait(&worker_barrier);
+
+        for (i = 0; i < 1000000; i++) {
+                radix_tree_insert(&mt_tree, 1, &obj1);
+                radix_tree_delete(&mt_tree, 1);
+        }
+
+        rcu_unregister_thread();
+
+        return NULL;
+}
+
+void regression4_test(void)
+{
+        pthread_t reader, writer;
+
+        printv(1, "regression test 4 starting\n");
+
+        radix_tree_insert(&mt_tree, 0, &obj0);
+        pthread_barrier_init(&worker_barrier, NULL, 2);
+
+        if (pthread_create(&reader, NULL, reader_fn, NULL) ||
+            pthread_create(&writer, NULL, writer_fn, NULL)) {
+                perror("pthread_create");
+                exit(1);
+        }
+
+        if (pthread_join(reader, NULL) || pthread_join(writer, NULL)) {
+                perror("pthread_join");
+                exit(1);
+        }
+
+        printv(1, "regression test 4 passed\n");
+}
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index 686e57ce40f4..efb6c13ab0de 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -154,12 +154,12 @@ static unsigned long long (*bpf_skb_ancestor_cgroup_id)(void *ctx, int level) =
         (void *) BPF_FUNC_skb_ancestor_cgroup_id;
 static struct bpf_sock *(*bpf_sk_lookup_tcp)(void *ctx,
                                              struct bpf_sock_tuple *tuple,
-                                             int size, unsigned int netns_id,
+                                             int size, unsigned long long netns_id,
                                              unsigned long long flags) =
         (void *) BPF_FUNC_sk_lookup_tcp;
 static struct bpf_sock *(*bpf_sk_lookup_udp)(void *ctx,
                                              struct bpf_sock_tuple *tuple,
-                                             int size, unsigned int netns_id,
+                                             int size, unsigned long long netns_id,
                                              unsigned long long flags) =
         (void *) BPF_FUNC_sk_lookup_udp;
 static int (*bpf_sk_release)(struct bpf_sock *sk) =
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index f42b3396d622..38e1cbaaffdb 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -432,11 +432,11 @@ static struct btf_raw_test raw_tests[] = {
                 /* const void* */       /* [3] */
                 BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
                 /* typedef const void * const_void_ptr */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
-                /* struct A { */        /* [4] */
+                BTF_TYPEDEF_ENC(NAME_TBD, 3),   /* [4] */
+                /* struct A { */        /* [5] */
                 BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), sizeof(void *)),
                 /* const_void_ptr m; */
-                BTF_MEMBER_ENC(NAME_TBD, 3, 0),
+                BTF_MEMBER_ENC(NAME_TBD, 4, 0),
                 /* } */
                 BTF_END_RAW,
         },
@@ -494,10 +494,10 @@ static struct btf_raw_test raw_tests[] = {
                 BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 0),
                 /* const void* */       /* [3] */
                 BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
-                /* typedef const void * const_void_ptr */       /* [4] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
-                /* const_void_ptr[4] */ /* [5] */
-                BTF_TYPE_ARRAY_ENC(3, 1, 4),
+                /* typedef const void * const_void_ptr */
+                BTF_TYPEDEF_ENC(NAME_TBD, 3),   /* [4] */
+                /* const_void_ptr[4] */
+                BTF_TYPE_ARRAY_ENC(4, 1, 4),    /* [5] */
                 BTF_END_RAW,
         },
         .str_sec = "\0const_void_ptr",
@@ -1293,6 +1293,367 @@ static struct btf_raw_test raw_tests[] = {
 },
 
 {
+        .descr = "typedef (invalid name, name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
+                BTF_TYPEDEF_ENC(0, 1),                          /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__int",
+        .str_sec_size = sizeof("\0__int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "typedef_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "typedef (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
+                BTF_TYPEDEF_ENC(NAME_TBD, 1),                   /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__!int",
+        .str_sec_size = sizeof("\0__!int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "typedef_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "ptr type (invalid name, name_off <> 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1),      /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__int",
+        .str_sec_size = sizeof("\0__int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "ptr_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "volatile type (invalid name, name_off <> 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 1), /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__int",
+        .str_sec_size = sizeof("\0__int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "volatile_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "const type (invalid name, name_off <> 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 1),    /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__int",
+        .str_sec_size = sizeof("\0__int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "const_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "restrict type (invalid name, name_off <> 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1),   /* [2] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_RESTRICT, 0, 0), 2), /* [3] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__int",
+        .str_sec_size = sizeof("\0__int"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "restrict_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "fwd type (invalid name, name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0),   /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__skb",
+        .str_sec_size = sizeof("\0__skb"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "fwd_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "fwd type (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0),      /* [2] */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__!skb",
+        .str_sec_size = sizeof("\0__!skb"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "fwd_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "array type (invalid name, name_off <> 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_ARRAY, 0, 0), 0),    /* [2] */
+                BTF_ARRAY_ENC(1, 1, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0__skb",
+        .str_sec_size = sizeof("\0__skb"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "struct type (name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0,
+                             BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4),   /* [2] */
+                BTF_MEMBER_ENC(NAME_TBD, 1, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A",
+        .str_sec_size = sizeof("\0A"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+},
+
+{
+        .descr = "struct type (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4),   /* [2] */
+                BTF_MEMBER_ENC(NAME_TBD, 1, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A!\0B",
+        .str_sec_size = sizeof("\0A!\0B"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "struct member (name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0,
+                             BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4),   /* [2] */
+                BTF_MEMBER_ENC(NAME_TBD, 1, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A",
+        .str_sec_size = sizeof("\0A"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+},
+
+{
+        .descr = "struct member (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4),   /* [2] */
+                BTF_MEMBER_ENC(NAME_TBD, 1, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A\0B*",
+        .str_sec_size = sizeof("\0A\0B*"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "enum type (name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0,
+                             BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
+                             sizeof(int)),                              /* [2] */
+                BTF_ENUM_ENC(NAME_TBD, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A\0B",
+        .str_sec_size = sizeof("\0A\0B"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "enum_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+},
+
+{
+        .descr = "enum type (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(NAME_TBD,
+                             BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
+                             sizeof(int)),                              /* [2] */
+                BTF_ENUM_ENC(NAME_TBD, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A!\0B",
+        .str_sec_size = sizeof("\0A!\0B"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "enum_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "enum member (invalid name, name_off = 0)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0,
+                             BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
+                             sizeof(int)),                              /* [2] */
+                BTF_ENUM_ENC(0, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "enum_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+
+{
+        .descr = "enum member (invalid name, invalid identifier)",
+        .raw_types = {
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),          /* [1] */
+                BTF_TYPE_ENC(0,
+                             BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
+                             sizeof(int)),                              /* [2] */
+                BTF_ENUM_ENC(NAME_TBD, 0),
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A!",
+        .str_sec_size = sizeof("\0A!"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "enum_type_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid name",
+},
+{
         .descr = "arraymap invalid btf key (a bit field)",
         .raw_types = {
                 /* int */                               /* [1] */
diff --git a/tools/testing/selftests/bpf/test_sk_lookup_kern.c b/tools/testing/selftests/bpf/test_sk_lookup_kern.c
index b745bdc08c2b..e21cd736c196 100644
--- a/tools/testing/selftests/bpf/test_sk_lookup_kern.c
+++ b/tools/testing/selftests/bpf/test_sk_lookup_kern.c
@@ -72,7 +72,7 @@ int bpf_sk_lookup_test0(struct __sk_buff *skb)
                 return TC_ACT_SHOT;
 
         tuple_len = ipv4 ? sizeof(tuple->ipv4) : sizeof(tuple->ipv6);
-        sk = bpf_sk_lookup_tcp(skb, tuple, tuple_len, 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, tuple, tuple_len, BPF_F_CURRENT_NETNS, 0);
         if (sk)
                 bpf_sk_release(sk);
         return sk ? TC_ACT_OK : TC_ACT_UNSPEC;
@@ -84,7 +84,7 @@ int bpf_sk_lookup_test1(struct __sk_buff *skb)
         struct bpf_sock_tuple tuple = {};
         struct bpf_sock *sk;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         if (sk)
                 bpf_sk_release(sk);
         return 0;
@@ -97,7 +97,7 @@ int bpf_sk_lookup_uaf(struct __sk_buff *skb)
         struct bpf_sock *sk;
         __u32 family = 0;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         if (sk) {
                 bpf_sk_release(sk);
                 family = sk->family;
@@ -112,7 +112,7 @@ int bpf_sk_lookup_modptr(struct __sk_buff *skb)
         struct bpf_sock *sk;
         __u32 family;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         if (sk) {
                 sk += 1;
                 bpf_sk_release(sk);
@@ -127,7 +127,7 @@ int bpf_sk_lookup_modptr_or_null(struct __sk_buff *skb)
         struct bpf_sock *sk;
         __u32 family;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         sk += 1;
         if (sk)
                 bpf_sk_release(sk);
@@ -139,7 +139,7 @@ int bpf_sk_lookup_test2(struct __sk_buff *skb)
 {
         struct bpf_sock_tuple tuple = {};
 
-        bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         return 0;
 }
 
@@ -149,7 +149,7 @@ int bpf_sk_lookup_test3(struct __sk_buff *skb)
         struct bpf_sock_tuple tuple = {};
         struct bpf_sock *sk;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         bpf_sk_release(sk);
         bpf_sk_release(sk);
         return 0;
@@ -161,7 +161,7 @@ int bpf_sk_lookup_test4(struct __sk_buff *skb)
         struct bpf_sock_tuple tuple = {};
         struct bpf_sock *sk;
 
-        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        sk = bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
         bpf_sk_release(sk);
         return 0;
 }
@@ -169,7 +169,7 @@ int bpf_sk_lookup_test4(struct __sk_buff *skb)
 void lookup_no_release(struct __sk_buff *skb)
 {
         struct bpf_sock_tuple tuple = {};
-        bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), 0, 0);
+        bpf_sk_lookup_tcp(skb, &tuple, sizeof(tuple), BPF_F_CURRENT_NETNS, 0);
 }
 
 SEC("fail_no_release_subcall")
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 550b7e46bf4a..df6f751cc1e8 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -8576,7 +8576,7 @@ static struct bpf_test tests[] = {
                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
                 },
                 .fixup_map_hash_8b = { 4 },
-                .errstr = "R0 invalid mem access 'inv'",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -10547,7 +10547,7 @@ static struct bpf_test tests[] = {
                 "check deducing bounds from const, 5",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
-                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
                         BPF_EXIT_INSN(),
                 },
@@ -14230,7 +14230,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
 
         reject_from_alignment = fd_prog < 0 &&
                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
-                                strstr(bpf_vlog, "Unknown alignment.");
+                                strstr(bpf_vlog, "misaligned");
 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
         if (reject_from_alignment) {
                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index e1473234968d..c9a2abf8be1b 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -2731,9 +2731,14 @@ TEST(syscall_restart)
         ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
         ASSERT_EQ(true, WIFSTOPPED(status));
         ASSERT_EQ(SIGSTOP, WSTOPSIG(status));
-        /* Verify signal delivery came from parent now. */
         ASSERT_EQ(0, ptrace(PTRACE_GETSIGINFO, child_pid, NULL, &info));
-        EXPECT_EQ(getpid(), info.si_pid);
+        /*
+         * There is no siginfo on SIGSTOP any more, so we can't verify
+         * signal delivery came from parent now (getpid() == info.si_pid).
+         * https://lkml.kernel.org/r/CAGXu5jJaZAOzP1qFz66tYrtbuywqb+UN2SOA1VLHpCCOiYvYeg@mail.gmail.com
+         * At least verify the SIGSTOP via PTRACE_GETSIGINFO.
+         */
+        EXPECT_EQ(SIGSTOP, info.si_signo);
 
         /* Restart nanosleep with SIGCONT, which triggers restart_syscall. */
         ASSERT_EQ(0, kill(child_pid, SIGCONT));