Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

The BTF conflicts were simple overlapping changes.

The virtio_net conflict was an overlap of a fix of statistics counter,
happening alongisde a move over to a bonafide statistics structure
rather than counting value on the stack.

Signed-off-by: David S. Miller <davem@davemloft.net>

239 files changed, 2004 insertions, 915 deletions

diff --git a/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt b/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
index 252a05c5d976..c8c4b00ecb94 100644
--- a/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
+++ b/Documentation/devicetree/bindings/usb/rockchip,dwc3.txt
@@ -16,7 +16,8 @@ A child node must exist to represent the core DWC3 IP block. The name of
 the node is not important. The content of the node is defined in dwc3.txt.
 
 Phy documentation is provided in the following places:
-Documentation/devicetree/bindings/phy/qcom-dwc3-usb-phy.txt
+Documentation/devicetree/bindings/phy/phy-rockchip-inno-usb2.txt - USB2.0 PHY
+Documentation/devicetree/bindings/phy/phy-rockchip-typec.txt     - Type-C PHY
 
 Example device nodes:
 
diff --git a/Documentation/networking/dpaa2/overview.rst b/Documentation/networking/dpaa2/overview.rst
index 79fede4447d6..d638b5a8aadd 100644
--- a/Documentation/networking/dpaa2/overview.rst
+++ b/Documentation/networking/dpaa2/overview.rst
@@ -1,5 +1,6 @@
 .. include:: <isonum.txt>
 
+=========================================================
 DPAA2 (Data Path Acceleration Architecture Gen2) Overview
 =========================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 38f44389ad99..fbac980d34e1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7095,6 +7095,7 @@ F:	include/uapi/linux/input.h
 F:      include/uapi/linux/input-event-codes.h
 F:      include/linux/input/
 F:      Documentation/devicetree/bindings/input/
+F:      Documentation/devicetree/bindings/serio/
 F:      Documentation/input/
 
 INPUT MULTITOUCH (MT) PROTOCOL
@@ -7984,7 +7985,7 @@ F:	lib/test_kmod.c
 F:      tools/testing/selftests/kmod/
 
 KPROBES
-M:      Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
+M:      Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
 M:      Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 M:      "David S. Miller" <davem@davemloft.net>
 M:      Masami Hiramatsu <mhiramat@kernel.org>
diff --git a/Makefile b/Makefile
index 67d9d20f8564..85f3481a56d6 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Merciless Moray
 
 # *DOCUMENTATION*
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 106a1466518d..746565a876dc 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -48,6 +48,7 @@ saved_pc	.req	lr
  * from those features make this path too inefficient.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         disable_irq_notrace                     @ disable interrupts
@@ -78,6 +79,7 @@ fast_work_pending:
  * call.
  */
 ret_fast_syscall:
+__ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         str     r0, [sp, #S_R0 + S_OFF]!        @ save returned r0
@@ -255,7 +257,7 @@ local_restart:
         tst     r10, #_TIF_SYSCALL_WORK         @ are we tracing syscalls?
         bne     __sys_trace
 
-        invoke_syscall tbl, scno, r10, ret_fast_syscall
+        invoke_syscall tbl, scno, r10, __ret_fast_syscall
 
         add     r1, sp, #S_OFF
 2:      cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 225d1c58d2de..d9c299133111 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -338,6 +338,7 @@ static struct vm_area_struct gate_vma = {
 
 static int __init gate_vma_init(void)
 {
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
         return 0;
 }
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index 39aef4876ed4..04b2f22c2739 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -212,7 +212,7 @@ static DEFINE_MUTEX(ecard_mutex);
  */
 static void ecard_init_pgtables(struct mm_struct *mm)
 {
-        struct vm_area_struct vma;
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, VM_EXEC);
 
         /* We want to set up the page tables for the following mapping:
          *  Virtual     Physical
@@ -237,9 +237,6 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
-        vma.vm_flags = VM_EXEC;
-        vma.vm_mm = mm;
-
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
         flush_tlb_range(&vma, EASI_START, EASI_START + EASI_SIZE);
 }
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index ffdaea7954bb..0ad1cf233470 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -37,7 +37,7 @@ static inline void __tlb_remove_table(void *_table)
 
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
-        struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+        struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
         /*
          * The ASID allocator will either invalidate the ASID or mark
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index f24892a40d2c..c6d80743f4ed 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1351,9 +1351,9 @@ static void __update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
 
 static void update_cpu_capabilities(u16 scope_mask)
 {
-        __update_cpu_capabilities(arm64_features, scope_mask, "detected:");
         __update_cpu_capabilities(arm64_errata, scope_mask,
                                   "enabling workaround for");
+        __update_cpu_capabilities(arm64_features, scope_mask, "detected:");
 }
 
 static int __enable_cpu_capability(void *arg)
@@ -1408,8 +1408,8 @@ __enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
 
 static void __init enable_cpu_capabilities(u16 scope_mask)
 {
-        __enable_cpu_capabilities(arm64_features, scope_mask);
         __enable_cpu_capabilities(arm64_errata, scope_mask);
+        __enable_cpu_capabilities(arm64_features, scope_mask);
 }
 
 /*
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index ecc6818191df..192b3ba07075 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -108,7 +108,6 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
         pte_t orig_pte = huge_ptep_get(ptep);
         bool valid = pte_valid(orig_pte);
         unsigned long i, saddr = addr;
@@ -125,8 +124,10 @@ static pte_t get_clear_flush(struct mm_struct *mm,
                         orig_pte = pte_mkdirty(orig_pte);
         }
 
-        if (valid)
+        if (valid) {
+                struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
                 flush_tlb_range(&vma, saddr, addr);
+        }
         return orig_pte;
 }
 
@@ -145,7 +146,7 @@ static void clear_flush(struct mm_struct *mm,
                              unsigned long pgsize,
                              unsigned long ncontig)
 {
-        struct vm_area_struct vma = { .vm_mm = mm };
+        struct vm_area_struct vma = TLB_FLUSH_VMA(mm, 0);
         unsigned long i, saddr = addr;
 
         for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 325cfb3b858a..9abf8a1e7b25 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -611,11 +611,13 @@ void __init mem_init(void)
         BUILD_BUG_ON(TASK_SIZE_32                       > TASK_SIZE_64);
 #endif
 
+#ifdef CONFIG_SPARSEMEM_VMEMMAP
         /*
          * Make sure we chose the upper bound of sizeof(struct page)
-         * correctly.
+         * correctly when sizing the VMEMMAP array.
          */
         BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT));
+#endif
 
         if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) {
                 extern int sysctl_overcommit_memory;
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 44f0ac0df308..516355a774bf 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -115,12 +115,11 @@ ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned
                 flush_tlb_all();
         } else {
                 /*
-                 * XXX fix me: flush_tlb_range() should take an mm pointer instead of a
-                 * vma pointer.
+                 * flush_tlb_range() takes a vma instead of a mm pointer because
+                 * some architectures want the vm_flags for ITLB/DTLB flush.
                  */
-                struct vm_area_struct vma;
+                struct vm_area_struct vma = TLB_FLUSH_VMA(tlb->mm, 0);
 
-                vma.vm_mm = tlb->mm;
                 /* flush the address range from the tlb: */
                 flush_tlb_range(&vma, start, end);
                 /* now flush the virt. page-table area mapping the address range: */
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index bdb14a369137..3b85c3ecac38 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -116,6 +116,7 @@ ia64_init_addr_space (void)
          */
         vma = vm_area_alloc(current->mm);
         if (vma) {
+                vma_set_anonymous(vma);
                 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
                 vma->vm_end = vma->vm_start + PAGE_SIZE;
                 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
@@ -133,6 +134,7 @@ ia64_init_addr_space (void)
         if (!(current->personality & MMAP_PAGE_ZERO)) {
                 vma = vm_area_alloc(current->mm);
                 if (vma) {
+                        vma_set_anonymous(vma);
                         vma->vm_end = PAGE_SIZE;
                         vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
                         vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO |
@@ -273,7 +275,7 @@ static struct vm_area_struct gate_vma;
 
 static int __init gate_vma_init(void)
 {
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 8c9cbf13d32a..6054d49e608e 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -212,12 +212,6 @@ static int __init bcm47xx_cpu_fixes(void)
                  */
                 if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706)
                         cpu_wait = NULL;
-
-                /*
-                 * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail"
-                 * Enable ExternalSync for sync instruction to take effect
-                 */
-                set_c0_config7(MIPS_CONF7_ES);
                 break;
 #endif
         }
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 0bc270806ec5..ae461d91cd1f 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -681,8 +681,6 @@
 #define MIPS_CONF7_WII          (_ULCAST_(1) << 31)
 
 #define MIPS_CONF7_RPS          (_ULCAST_(1) << 2)
-/* ExternalSync */
-#define MIPS_CONF7_ES           (_ULCAST_(1) << 8)
 
 #define MIPS_CONF7_IAR          (_ULCAST_(1) << 10)
 #define MIPS_CONF7_AR           (_ULCAST_(1) << 16)
@@ -2767,7 +2765,6 @@ __BUILD_SET_C0(status)
 __BUILD_SET_C0(cause)
 __BUILD_SET_C0(config)
 __BUILD_SET_C0(config5)
-__BUILD_SET_C0(config7)
 __BUILD_SET_C0(intcontrol)
 __BUILD_SET_C0(intctl)
 __BUILD_SET_C0(srsmap)
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index ac67828da201..410b263ef5c8 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += module.h
+generic-y += msi.h
 generic-y += preempt.h
 generic-y += rwsem.h
 generic-y += serial.h
diff --git a/arch/sparc/include/asm/msi.h b/arch/sparc/include/asm/msi.h
deleted file mode 100644
index 3c17c1074431..000000000000
--- a/arch/sparc/include/asm/msi.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-/*
- * msi.h:  Defines specific to the MBus - Sbus - Interface.
- *
- * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1996 Eddie C. Dost   (ecd@skynet.be)
- */
-
-#ifndef _SPARC_MSI_H
-#define _SPARC_MSI_H
-
-/*
- * Locations of MSI Registers.
- */
-#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
-
-/*
- * Useful bits in the MSI Registers.
- */
-#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
-
-
-static inline void msi_set_sync(void)
-{
-        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
-                              "andn %%g3, %2, %%g3\n\t"
-                              "sta %%g3, [%0] %1\n\t" : :
-                              "r" (MSI_MBUS_ARBEN),
-                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
-}
-
-#endif /* !(_SPARC_MSI_H) */
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 2ef8cfa9677e..f0eba72aa1ad 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -814,7 +814,7 @@ static void __init get_tick_patch(void)
         }
 }
 
-static void init_tick_ops(struct sparc64_tick_ops *ops)
+static void __init init_tick_ops(struct sparc64_tick_ops *ops)
 {
         unsigned long freq, quotient, tick;
 
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index 1d70c3f6d986..be9cb0065179 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -37,7 +37,6 @@
 #include <asm/mbus.h>
 #include <asm/page.h>
 #include <asm/asi.h>
-#include <asm/msi.h>
 #include <asm/smp.h>
 #include <asm/io.h>
 
@@ -116,6 +115,25 @@ static inline void srmmu_ctxd_set(ctxd_t *ctxp, pgd_t *pgdp)
         set_pte((pte_t *)ctxp, pte);
 }
 
+/*
+ * Locations of MSI Registers.
+ */
+#define MSI_MBUS_ARBEN  0xe0001008      /* MBus Arbiter Enable register */
+
+/*
+ * Useful bits in the MSI Registers.
+ */
+#define MSI_ASYNC_MODE  0x80000000      /* Operate the MSI asynchronously */
+
+static void msi_set_sync(void)
+{
+        __asm__ __volatile__ ("lda [%0] %1, %%g3\n\t"
+                              "andn %%g3, %2, %%g3\n\t"
+                              "sta %%g3, [%0] %1\n\t" : :
+                              "r" (MSI_MBUS_ARBEN),
+                              "i" (ASI_M_CTL), "r" (MSI_ASYNC_MODE) : "g3");
+}
+
 void pmd_set(pmd_t *pmdp, pte_t *ptep)
 {
         unsigned long ptp;      /* Physical address, shifted right by 4 */
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index fa42f895fdde..169c2feda14a 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -106,9 +106,13 @@ define cmd_check_data_rel
         done
 endef
 
+# We need to run two commands under "if_changed", so merge them into a
+# single invocation.
+quiet_cmd_check-and-link-vmlinux = LD      $@
+      cmd_check-and-link-vmlinux = $(cmd_check_data_rel); $(cmd_ld)
+
 $(obj)/vmlinux: $(vmlinux-objs-y) FORCE
-        $(call if_changed,check_data_rel)
-        $(call if_changed,ld)
+        $(call if_changed,check-and-link-vmlinux)
 
 OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
 $(obj)/vmlinux.bin: vmlinux FORCE
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
 
         call    \do_sym
 
-        jmp     error_exit                      /* %ebx: no swapgs flag */
+        jmp     error_exit
         .endif
 END(\sym)
 .endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
         UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
          * for these here too.
          */
 .Lerror_kernelspace:
-        incl    %ebx
         leaq    native_irq_return_iret(%rip), %rcx
         cmpq    %rcx, RIP+8(%rsp)
         je      .Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
 
         /*
          * Pretend that the exception came from user mode: set up pt_regs
-         * as if we faulted immediately after IRET and clear EBX so that
-         * error_exit knows that we will be returning to user mode.
+         * as if we faulted immediately after IRET.
          */
         mov     %rsp, %rdi
         call    fixup_bad_iret
         mov     %rax, %rsp
-        decl    %ebx
         jmp     .Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
         UNWIND_HINT_REGS
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
-        testl   %ebx, %ebx
-        jnz     retint_kernel
+        testb   $3, CS(%rsp)
+        jz      retint_kernel
         jmp     retint_user
 END(error_exit)
 
diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
index 4b98101209a1..d50bb4dc0650 100644
--- a/arch/x86/events/amd/ibs.c
+++ b/arch/x86/events/amd/ibs.c
@@ -579,7 +579,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs)
 {
         struct cpu_perf_ibs *pcpu = this_cpu_ptr(perf_ibs->pcpu);
         struct perf_event *event = pcpu->event;
-        struct hw_perf_event *hwc = &event->hw;
+        struct hw_perf_event *hwc;
         struct perf_sample_data data;
         struct perf_raw_record raw;
         struct pt_regs regs;
@@ -602,6 +602,10 @@ fail:
                 return 0;
         }
 
+        if (WARN_ON_ONCE(!event))
+                goto fail;
+
+        hwc = &event->hw;
         msr = hwc->config_base;
         buf = ibs_data.regs;
         rdmsrl(msr, *buf);
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 707b2a96e516..86f0c15dcc2d 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2997,6 +2997,9 @@ static int intel_pmu_hw_config(struct perf_event *event)
                 }
                 if (x86_pmu.pebs_aliases)
                         x86_pmu.pebs_aliases(event);
+
+                if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
+                        event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY;
         }
 
         if (needs_branch_stack(event)) {
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 8cf03f101938..8dbba77e0518 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1186,16 +1186,20 @@ static void setup_pebs_sample_data(struct perf_event *event,
         }
 
         /*
+         * We must however always use iregs for the unwinder to stay sane; the
+         * record BP,SP,IP can point into thin air when the record is from a
+         * previous PMI context or an (I)RET happend between the record and
+         * PMI.
+         */
+        if (sample_type & PERF_SAMPLE_CALLCHAIN)
+                data->callchain = perf_callchain(event, iregs);
+
+        /*
          * We use the interrupt regs as a base because the PEBS record does not
          * contain a full regs set, specifically it seems to lack segment
          * descriptors, which get used by things like user_mode().
          *
          * In the simple case fix up only the IP for PERF_SAMPLE_IP.
-         *
-         * We must however always use BP,SP from iregs for the unwinder to stay
-         * sane; the record BP,SP can point into thin air when the record is
-         * from a previous PMI context or an (I)RET happend between the record
-         * and PMI.
          */
         *regs = *iregs;
 
@@ -1214,15 +1218,8 @@ static void setup_pebs_sample_data(struct perf_event *event,
                 regs->si = pebs->si;
                 regs->di = pebs->di;
 
-                /*
-                 * Per the above; only set BP,SP if we don't need callchains.
-                 *
-                 * XXX: does this make sense?
-                 */
-                if (!(sample_type & PERF_SAMPLE_CALLCHAIN)) {
-                        regs->bp = pebs->bp;
-                        regs->sp = pebs->sp;
-                }
+                regs->bp = pebs->bp;
+                regs->sp = pebs->sp;
 
 #ifndef CONFIG_X86_32
                 regs->r8 = pebs->r8;
diff --git a/arch/x86/include/asm/qspinlock_paravirt.h b/arch/x86/include/asm/qspinlock_paravirt.h
index 9ef5ee03d2d7..159622ee0674 100644
--- a/arch/x86/include/asm/qspinlock_paravirt.h
+++ b/arch/x86/include/asm/qspinlock_paravirt.h
@@ -43,7 +43,7 @@ asm    (".pushsection .text;"
         "push  %rdx;"
         "mov   $0x1,%eax;"
         "xor   %edx,%edx;"
-        "lock cmpxchg %dl,(%rdi);"
+        LOCK_PREFIX "cmpxchg %dl,(%rdi);"
         "cmp   $0x1,%al;"
         "jne   .slowpath;"
         "pop   %rdx;"
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 2aabd4cb0e3f..adbda5847b14 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -573,6 +573,9 @@ static u32 skx_deadline_rev(void)
         case 0x04: return 0x02000014;
         }
 
+        if (boot_cpu_data.x86_stepping > 4)
+                return 0;
+
         return ~0U;
 }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index d594690d8b95..6b8f11521c41 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -890,7 +890,7 @@ static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache,
         if (cache->nobjs >= min)
                 return 0;
         while (cache->nobjs < ARRAY_SIZE(cache->objects)) {
-                page = (void *)__get_free_page(GFP_KERNEL);
+                page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT);
                 if (!page)
                         return -ENOMEM;
                 cache->objects[cache->nobjs++] = page;
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index 55799873ebe5..8f6cc71e0848 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -1441,8 +1441,8 @@ static void emit_prologue(u8 **pprog, u32 stack_depth)
 
         /* sub esp,STACK_SIZE */
         EMIT2_off32(0x81, 0xEC, STACK_SIZE);
-        /* sub ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 16);
+        /* sub ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xE8, IA32_EBP), SCRATCH_SIZE + 12);
         /* xor ebx,ebx */
         EMIT2(0x31, add_2reg(0xC0, IA32_EBX, IA32_EBX));
 
@@ -1475,8 +1475,8 @@ static void emit_epilogue(u8 **pprog, u32 stack_depth)
         /* mov edx,dword ptr [ebp+off]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX), STACK_VAR(r0[1]));
 
-        /* add ebp,SCRATCH_SIZE+4+12*/
-        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 16);
+        /* add ebp,SCRATCH_SIZE+12*/
+        EMIT3(0x83, add_1reg(0xC0, IA32_EBP), SCRATCH_SIZE + 12);
 
         /* mov ebx,dword ptr [ebp-12]*/
         EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EBX), -12);
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 77873ce700ae..5f2eb3231607 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -417,7 +417,7 @@ static void __init __map_region(efi_memory_desc_t *md, u64 va)
         if (!(md->attribute & EFI_MEMORY_WB))
                 flags |= _PAGE_PCD;
 
-        if (sev_active())
+        if (sev_active() && md->type != EFI_MEMORY_MAPPED_IO)
                 flags |= _PAGE_ENC;
 
         pfn = md->phys_addr >> PAGE_SHIFT;
diff --git a/arch/x86/um/mem_32.c b/arch/x86/um/mem_32.c
index 744afdc18cf3..56c44d865f7b 100644
--- a/arch/x86/um/mem_32.c
+++ b/arch/x86/um/mem_32.c
@@ -16,7 +16,7 @@ static int __init gate_vma_init(void)
         if (!FIXADDR_USER_START)
                 return 0;
 
-        gate_vma.vm_mm = NULL;
+        vma_init(&gate_vma, NULL);
         gate_vma.vm_start = FIXADDR_USER_START;
         gate_vma.vm_end = FIXADDR_USER_END;
         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/block/bio.c b/block/bio.c
index 67eff5eddc49..047c5dca6d90 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -903,25 +903,27 @@ int bio_add_page(struct bio *bio, struct page *page,
 EXPORT_SYMBOL(bio_add_page);
 
 /**
- * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+ * __bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
  * @bio: bio to add pages to
  * @iter: iov iterator describing the region to be mapped
  *
- * Pins as many pages from *iter and appends them to @bio's bvec array. The
+ * Pins pages from *iter and appends them to @bio's bvec array. The
  * pages will have to be released using put_page() when done.
+ * For multi-segment *iter, this function only adds pages from the
+ * the next non-empty segment of the iov iterator.
  */
-int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
 {
-        unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt;
+        unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt, idx;
         struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt;
         struct page **pages = (struct page **)bv;
-        size_t offset, diff;
+        size_t offset;
         ssize_t size;
 
         size = iov_iter_get_pages(iter, pages, LONG_MAX, nr_pages, &offset);
         if (unlikely(size <= 0))
                 return size ? size : -EFAULT;
-        nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
+        idx = nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE;
 
         /*
          * Deep magic below:  We need to walk the pinned pages backwards
@@ -934,21 +936,46 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
         bio->bi_iter.bi_size += size;
         bio->bi_vcnt += nr_pages;
 
-        diff = (nr_pages * PAGE_SIZE - offset) - size;
-        while (nr_pages--) {
-                bv[nr_pages].bv_page = pages[nr_pages];
-                bv[nr_pages].bv_len = PAGE_SIZE;
-                bv[nr_pages].bv_offset = 0;
+        while (idx--) {
+                bv[idx].bv_page = pages[idx];
+                bv[idx].bv_len = PAGE_SIZE;
+                bv[idx].bv_offset = 0;
         }
 
         bv[0].bv_offset += offset;
         bv[0].bv_len -= offset;
-        if (diff)
-                bv[bio->bi_vcnt - 1].bv_len -= diff;
+        bv[nr_pages - 1].bv_len -= nr_pages * PAGE_SIZE - offset - size;
 
         iov_iter_advance(iter, size);
         return 0;
 }
+
+/**
+ * bio_iov_iter_get_pages - pin user or kernel pages and add them to a bio
+ * @bio: bio to add pages to
+ * @iter: iov iterator describing the region to be mapped
+ *
+ * Pins pages from *iter and appends them to @bio's bvec array. The
+ * pages will have to be released using put_page() when done.
+ * The function tries, but does not guarantee, to pin as many pages as
+ * fit into the bio, or are requested in *iter, whatever is smaller.
+ * If MM encounters an error pinning the requested pages, it stops.
+ * Error is returned only if 0 pages could be pinned.
+ */
+int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
+{
+        unsigned short orig_vcnt = bio->bi_vcnt;
+
+        do {
+                int ret = __bio_iov_iter_get_pages(bio, iter);
+
+                if (unlikely(ret))
+                        return bio->bi_vcnt > orig_vcnt ? 0 : ret;
+
+        } while (iov_iter_count(iter) && !bio_full(bio));
+
+        return 0;
+}
 EXPORT_SYMBOL_GPL(bio_iov_iter_get_pages);
 
 static void submit_bio_wait_endio(struct bio *bio)
@@ -1866,6 +1893,7 @@ struct bio *bio_split(struct bio *bio, int sectors,
                 bio_integrity_trim(split);
 
         bio_advance(bio, split->bi_iter.bi_size);
+        bio->bi_iter.bi_done = 0;
 
         if (bio_flagged(bio, BIO_TRACE_COMPLETION))
                 bio_set_flag(split, BIO_TRACE_COMPLETION);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 95919268564b..654b0dc7e001 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -558,10 +558,8 @@ static void __blk_mq_complete_request(struct request *rq)
         bool shared = false;
         int cpu;
 
-        if (cmpxchg(&rq->state, MQ_RQ_IN_FLIGHT, MQ_RQ_COMPLETE) !=
-                        MQ_RQ_IN_FLIGHT)
+        if (!blk_mq_mark_complete(rq))
                 return;
-
         if (rq->internal_tag != -1)
                 blk_mq_sched_completed_request(rq);
 
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index f8fecfec5df9..9706613eecf9 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,6 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
+static bool lpss_iosf_d3_entered;
 
 static void lpss_iosf_enter_d3_state(void)
 {
@@ -921,6 +922,9 @@ static void lpss_iosf_enter_d3_state(void)
 
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
+
+        lpss_iosf_d3_entered = true;
+
 exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
@@ -935,6 +939,11 @@ static void lpss_iosf_exit_d3_state(void)
 
         mutex_lock(&lpss_iosf_mutex);
 
+        if (!lpss_iosf_d3_entered)
+                goto exit;
+
+        lpss_iosf_d3_entered = false;
+
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIOEP, MBI_CR_WRITE,
                         LPSS_IOSF_GPIODEF0, value1, mask1);
 
@@ -944,13 +953,13 @@ static void lpss_iosf_exit_d3_state(void)
         iosf_mbi_modify(LPSS_IOSF_UNIT_LPIO1, MBI_CFG_WRITE,
                         LPSS_IOSF_PMCSR, value2, mask2);
 
+exit:
         mutex_unlock(&lpss_iosf_mutex);
 }
 
-static int acpi_lpss_suspend(struct device *dev, bool runtime)
+static int acpi_lpss_suspend(struct device *dev, bool wakeup)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
-        bool wakeup = runtime || device_may_wakeup(dev);
         int ret;
 
         if (pdata->dev_desc->flags & LPSS_SAVE_CTX)
@@ -963,14 +972,14 @@ static int acpi_lpss_suspend(struct device *dev, bool runtime)
          * wrong status for devices being about to be powered off. See
          * lpss_iosf_enter_d3_state() for further information.
          */
-        if ((runtime || !pm_suspend_via_firmware()) &&
+        if (acpi_target_system_state() == ACPI_STATE_S0 &&
             lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_enter_d3_state();
 
         return ret;
 }
 
-static int acpi_lpss_resume(struct device *dev, bool runtime)
+static int acpi_lpss_resume(struct device *dev)
 {
         struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
         int ret;
@@ -979,8 +988,7 @@ static int acpi_lpss_resume(struct device *dev, bool runtime)
          * This call is kept first to be in symmetry with
          * acpi_lpss_runtime_suspend() one.
          */
-        if ((runtime || !pm_resume_via_firmware()) &&
-            lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
+        if (lpss_quirks & LPSS_QUIRK_ALWAYS_POWER_ON && iosf_mbi_available())
                 lpss_iosf_exit_d3_state();
 
         ret = acpi_dev_resume(dev);
@@ -1004,12 +1012,12 @@ static int acpi_lpss_suspend_late(struct device *dev)
                 return 0;
 
         ret = pm_generic_suspend_late(dev);
-        return ret ? ret : acpi_lpss_suspend(dev, false);
+        return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
 }
 
 static int acpi_lpss_resume_early(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, false);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_resume_early(dev);
 }
@@ -1024,7 +1032,7 @@ static int acpi_lpss_runtime_suspend(struct device *dev)
 
 static int acpi_lpss_runtime_resume(struct device *dev)
 {
-        int ret = acpi_lpss_resume(dev, true);
+        int ret = acpi_lpss_resume(dev);
 
         return ret ? ret : pm_generic_runtime_resume(dev);
 }
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index bc5f05906bd1..44f35ab3347d 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -497,6 +497,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                         status =
                             acpi_ps_create_op(walk_state, aml_op_start, &op);
                         if (ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by
+                                 * executing it as a control method. However, if we encounter
+                                 * an error while loading the table, we need to keep trying to
+                                 * load the table rather than aborting the table load. Set the
+                                 * status to AE_OK to proceed with the table load.
+                                 */
+                                if ((walk_state->
+                                     parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                    && status == AE_ALREADY_EXISTS) {
+                                        status = AE_OK;
+                                }
                                 if (status == AE_CTRL_PARSE_CONTINUE) {
                                         continue;
                                 }
@@ -694,6 +706,25 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
                             acpi_ps_next_parse_state(walk_state, op, status);
                         if (status == AE_CTRL_PENDING) {
                                 status = AE_OK;
+                        } else
+                            if ((walk_state->
+                                 parse_flags & ACPI_PARSE_MODULE_LEVEL)
+                                && status != AE_CTRL_TRANSFER
+                                && ACPI_FAILURE(status)) {
+                                /*
+                                 * ACPI_PARSE_MODULE_LEVEL flag means that we are currently
+                                 * loading a table by executing it as a control method.
+                                 * However, if we encounter an error while loading the table,
+                                 * we need to keep trying to load the table rather than
+                                 * aborting the table load (setting the status to AE_OK
+                                 * continues the table load). If we get a failure at this
+                                 * point, it means that the dispatcher got an error while
+                                 * processing Op (most likely an AML operand error) or a
+                                 * control method was called from module level and the
+                                 * dispatcher returned AE_CTRL_TRANSFER. In the latter case,
+                                 * leave the status alone, there's nothing wrong with it.
+                                 */
+                                status = AE_OK;
                         }
                 }
 
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 1435d7281c66..6ebcd65d64b6 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -434,14 +434,6 @@ re_probe:
                         goto probe_failed;
         }
 
-        /*
-         * Ensure devices are listed in devices_kset in correct order
-         * It's important to move Dev to the end of devices_kset before
-         * calling .probe, because it could be recursive and parent Dev
-         * should always go first
-         */
-        devices_kset_move_last(dev);
-
         if (dev->bus->probe) {
                 ret = dev->bus->probe(dev);
                 if (ret)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index e07401d3901d..3863c00372bb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -112,12 +112,16 @@ struct nbd_device {
         struct task_struct *task_setup;
 };
 
+#define NBD_CMD_REQUEUED        1
+
 struct nbd_cmd {
         struct nbd_device *nbd;
+        struct mutex lock;
         int index;
         int cookie;
-        struct completion send_complete;
         blk_status_t status;
+        unsigned long flags;
+        u32 cmd_cookie;
 };
 
 #if IS_ENABLED(CONFIG_DEBUG_FS)
@@ -146,6 +150,35 @@ static inline struct device *nbd_to_dev(struct nbd_device *nbd)
         return disk_to_dev(nbd->disk);
 }
 
+static void nbd_requeue_cmd(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+
+        if (!test_and_set_bit(NBD_CMD_REQUEUED, &cmd->flags))
+                blk_mq_requeue_request(req, true);
+}
+
+#define NBD_COOKIE_BITS 32
+
+static u64 nbd_cmd_handle(struct nbd_cmd *cmd)
+{
+        struct request *req = blk_mq_rq_from_pdu(cmd);
+        u32 tag = blk_mq_unique_tag(req);
+        u64 cookie = cmd->cmd_cookie;
+
+        return (cookie << NBD_COOKIE_BITS) | tag;
+}
+
+static u32 nbd_handle_to_tag(u64 handle)
+{
+        return (u32)handle;
+}
+
+static u32 nbd_handle_to_cookie(u64 handle)
+{
+        return (u32)(handle >> NBD_COOKIE_BITS);
+}
+
 static const char *nbdcmd_to_ascii(int cmd)
 {
         switch (cmd) {
@@ -319,6 +352,9 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         config = nbd->config;
 
+        if (!mutex_trylock(&cmd->lock))
+                return BLK_EH_RESET_TIMER;
+
         if (config->num_connections > 1) {
                 dev_err_ratelimited(nbd_to_dev(nbd),
                                     "Connection timed out, retrying (%d/%d alive)\n",
@@ -343,7 +379,8 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
                                         nbd_mark_nsock_dead(nbd, nsock, 1);
                                 mutex_unlock(&nsock->tx_lock);
                         }
-                        blk_mq_requeue_request(req, true);
+                        mutex_unlock(&cmd->lock);
+                        nbd_requeue_cmd(cmd);
                         nbd_config_put(nbd);
                         return BLK_EH_DONE;
                 }
@@ -353,6 +390,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
         }
         set_bit(NBD_TIMEDOUT, &config->runtime_flags);
         cmd->status = BLK_STS_IOERR;
+        mutex_unlock(&cmd->lock);
         sock_shutdown(nbd);
         nbd_config_put(nbd);
 done:
@@ -430,9 +468,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct iov_iter from;
         unsigned long size = blk_rq_bytes(req);
         struct bio *bio;
+        u64 handle;
         u32 type;
         u32 nbd_cmd_flags = 0;
-        u32 tag = blk_mq_unique_tag(req);
         int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
@@ -474,6 +512,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                         goto send_pages;
                 }
                 iov_iter_advance(&from, sent);
+        } else {
+                cmd->cmd_cookie++;
         }
         cmd->index = index;
         cmd->cookie = nsock->cookie;
@@ -482,7 +522,8 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
                 request.len = htonl(size);
         }
-        memcpy(request.handle, &tag, sizeof(tag));
+        handle = nbd_cmd_handle(cmd);
+        memcpy(request.handle, &handle, sizeof(handle));
 
         dev_dbg(nbd_to_dev(nbd), "request %p: sending control (%s@%llu,%uB)\n",
                 req, nbdcmd_to_ascii(type),
@@ -500,6 +541,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 nsock->pending = req;
                                 nsock->sent = sent;
                         }
+                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                         return BLK_STS_RESOURCE;
                 }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
@@ -541,6 +583,7 @@ send_pages:
                                          */
                                         nsock->pending = req;
                                         nsock->sent = sent;
+                                        set_bit(NBD_CMD_REQUEUED, &cmd->flags);
                                         return BLK_STS_RESOURCE;
                                 }
                                 dev_err(disk_to_dev(nbd->disk),
@@ -573,10 +616,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         struct nbd_reply reply;
         struct nbd_cmd *cmd;
         struct request *req = NULL;
+        u64 handle;
         u16 hwq;
         u32 tag;
         struct kvec iov = {.iov_base = &reply, .iov_len = sizeof(reply)};
         struct iov_iter to;
+        int ret = 0;
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
@@ -594,8 +639,8 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-EPROTO);
         }
 
-        memcpy(&tag, reply.handle, sizeof(u32));
-
+        memcpy(&handle, reply.handle, sizeof(handle));
+        tag = nbd_handle_to_tag(handle);
         hwq = blk_mq_unique_tag_to_hwq(tag);
         if (hwq < nbd->tag_set.nr_hw_queues)
                 req = blk_mq_tag_to_rq(nbd->tag_set.tags[hwq],
@@ -606,11 +651,25 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 return ERR_PTR(-ENOENT);
         }
         cmd = blk_mq_rq_to_pdu(req);
+
+        mutex_lock(&cmd->lock);
+        if (cmd->cmd_cookie != nbd_handle_to_cookie(handle)) {
+                dev_err(disk_to_dev(nbd->disk), "Double reply on req %p, cmd_cookie %u, handle cookie %u\n",
+                        req, cmd->cmd_cookie, nbd_handle_to_cookie(handle));
+                ret = -ENOENT;
+                goto out;
+        }
+        if (test_bit(NBD_CMD_REQUEUED, &cmd->flags)) {
+                dev_err(disk_to_dev(nbd->disk), "Raced with timeout on req %p\n",
+                        req);
+                ret = -ENOENT;
+                goto out;
+        }
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
                 cmd->status = BLK_STS_IOERR;
-                return cmd;
+                goto out;
         }
 
         dev_dbg(nbd_to_dev(nbd), "request %p: got reply\n", req);
@@ -635,18 +694,18 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                                 if (nbd_disconnected(config) ||
                                     config->num_connections <= 1) {
                                         cmd->status = BLK_STS_IOERR;
-                                        return cmd;
+                                        goto out;
                                 }
-                                return ERR_PTR(-EIO);
+                                ret = -EIO;
+                                goto out;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
                                 req, bvec.bv_len);
                 }
-        } else {
-                /* See the comment in nbd_queue_rq. */
-                wait_for_completion(&cmd->send_complete);
         }
-        return cmd;
+out:
+        mutex_unlock(&cmd->lock);
+        return ret ? ERR_PTR(ret) : cmd;
 }
 
 static void recv_work(struct work_struct *work)
@@ -805,7 +864,7 @@ again:
          */
         blk_mq_start_request(req);
         if (unlikely(nsock->pending && nsock->pending != req)) {
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
                 goto out;
         }
@@ -818,7 +877,7 @@ again:
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Request send failed, requeueing\n");
                 nbd_mark_nsock_dead(nbd, nsock, 1);
-                blk_mq_requeue_request(req, true);
+                nbd_requeue_cmd(cmd);
                 ret = 0;
         }
 out:
@@ -842,7 +901,8 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * that the server is misbehaving (or there was an error) before we're
          * done sending everything over the wire.
          */
-        init_completion(&cmd->send_complete);
+        mutex_lock(&cmd->lock);
+        clear_bit(NBD_CMD_REQUEUED, &cmd->flags);
 
         /* We can be called directly from the user space process, which means we
          * could possibly have signals pending so our sendmsg will fail.  In
@@ -854,7 +914,7 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                 ret = BLK_STS_IOERR;
         else if (!ret)
                 ret = BLK_STS_OK;
-        complete(&cmd->send_complete);
+        mutex_unlock(&cmd->lock);
 
         return ret;
 }
@@ -1460,6 +1520,8 @@ static int nbd_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(rq);
         cmd->nbd = set->driver_data;
+        cmd->flags = 0;
+        mutex_init(&cmd->lock);
         return 0;
 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index ffeb60d3434c..df66a9dd0aae 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma)
 #endif
         if (vma->vm_flags & VM_SHARED)
                 return shmem_zero_setup(vma);
+        vma_set_anonymous(vma);
         return 0;
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index cd888d4ee605..bd449ad52442 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1895,14 +1895,22 @@ static int
 write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
 {
         size_t bytes;
-        __u32 buf[16];
+        __u32 t, buf[16];
         const char __user *p = buffer;
 
         while (count > 0) {
+                int b, i = 0;
+
                 bytes = min(count, sizeof(buf));
                 if (copy_from_user(&buf, p, bytes))
                         return -EFAULT;
 
+                for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
+                        if (!arch_get_random_int(&t))
+                                break;
+                        buf[i] ^= t;
+                }
+
                 count -= bytes;
                 p += bytes;
 
diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c
index 38b366b00c57..7b70a074095d 100644
--- a/drivers/clk/clk-aspeed.c
+++ b/drivers/clk/clk-aspeed.c
@@ -24,7 +24,7 @@
 #define ASPEED_MPLL_PARAM       0x20
 #define ASPEED_HPLL_PARAM       0x24
 #define  AST2500_HPLL_BYPASS_EN BIT(20)
-#define  AST2400_HPLL_STRAPPED  BIT(18)
+#define  AST2400_HPLL_PROGRAMMED BIT(18)
 #define  AST2400_HPLL_BYPASS_EN BIT(17)
 #define ASPEED_MISC_CTRL        0x2c
 #define  UART_DIV13_EN          BIT(12)
@@ -91,8 +91,8 @@ static const struct aspeed_gate_data aspeed_gates[] = {
         [ASPEED_CLK_GATE_GCLK] =        {  1,  7, "gclk-gate",          NULL,   0 }, /* 2D engine */
         [ASPEED_CLK_GATE_MCLK] =        {  2, -1, "mclk-gate",          "mpll", CLK_IS_CRITICAL }, /* SDRAM */
         [ASPEED_CLK_GATE_VCLK] =        {  3,  6, "vclk-gate",          NULL,   0 }, /* Video Capture */
-        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", 0 }, /* PCIe/PCI */
-        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   0 }, /* DAC */
+        [ASPEED_CLK_GATE_BCLK] =        {  4,  8, "bclk-gate",          "bclk", CLK_IS_CRITICAL }, /* PCIe/PCI */
+        [ASPEED_CLK_GATE_DCLK] =        {  5, -1, "dclk-gate",          NULL,   CLK_IS_CRITICAL }, /* DAC */
         [ASPEED_CLK_GATE_REFCLK] =      {  6, -1, "refclk-gate",        "clkin", CLK_IS_CRITICAL },
         [ASPEED_CLK_GATE_USBPORT2CLK] = {  7,  3, "usb-port2-gate",     NULL,   0 }, /* USB2.0 Host port 2 */
         [ASPEED_CLK_GATE_LCLK] =        {  8,  5, "lclk-gate",          NULL,   0 }, /* LPC */
@@ -212,9 +212,22 @@ static int aspeed_clk_is_enabled(struct clk_hw *hw)
 {
         struct aspeed_clk_gate *gate = to_aspeed_clk_gate(hw);
         u32 clk = BIT(gate->clock_idx);
+        u32 rst = BIT(gate->reset_idx);
         u32 enval = (gate->flags & CLK_GATE_SET_TO_DISABLE) ? 0 : clk;
         u32 reg;
 
+        /*
+         * If the IP is in reset, treat the clock as not enabled,
+         * this happens with some clocks such as the USB one when
+         * coming from cold reset. Without this, aspeed_clk_enable()
+         * will fail to lift the reset.
+         */
+        if (gate->reset_idx >= 0) {
+                regmap_read(gate->map, ASPEED_RESET_CTRL, &reg);
+                if (reg & rst)
+                        return 0;
+        }
+
         regmap_read(gate->map, ASPEED_CLK_STOP_CTRL, &reg);
 
         return ((reg & clk) == enval) ? 1 : 0;
@@ -565,29 +578,45 @@ builtin_platform_driver(aspeed_clk_driver);
 static void __init aspeed_ast2400_cc(struct regmap *map)
 {
         struct clk_hw *hw;
-        u32 val, freq, div;
+        u32 val, div, clkin, hpll;
+        const u16 hpll_rates[][4] = {
+                {384, 360, 336, 408},
+                {400, 375, 350, 425},
+        };
+        int rate;
 
         /*
          * CLKIN is the crystal oscillator, 24, 48 or 25MHz selected by
          * strapping
          */
         regmap_read(map, ASPEED_STRAP, &val);
-        if (val & CLKIN_25MHZ_EN)
-                freq = 25000000;
-        else if (val & AST2400_CLK_SOURCE_SEL)
-                freq = 48000000;
-        else
-                freq = 24000000;
-        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, freq);
-        pr_debug("clkin @%u MHz\n", freq / 1000000);
+        rate = (val >> 8) & 3;
+        if (val & CLKIN_25MHZ_EN) {
+                clkin = 25000000;
+                hpll = hpll_rates[1][rate];
+        } else if (val & AST2400_CLK_SOURCE_SEL) {
+                clkin = 48000000;
+                hpll = hpll_rates[0][rate];
+        } else {
+                clkin = 24000000;
+                hpll = hpll_rates[0][rate];
+        }
+        hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, clkin);
+        pr_debug("clkin @%u MHz\n", clkin / 1000000);
 
         /*
          * High-speed PLL clock derived from the crystal. This the CPU clock,
-         * and we assume that it is enabled
+         * and we assume that it is enabled. It can be configured through the
+         * HPLL_PARAM register, or set to a specified frequency by strapping.
          */
         regmap_read(map, ASPEED_HPLL_PARAM, &val);
-        WARN(val & AST2400_HPLL_STRAPPED, "hpll is strapped not configured");
-        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = aspeed_ast2400_calc_pll("hpll", val);
+        if (val & AST2400_HPLL_PROGRAMMED)
+                hw = aspeed_ast2400_calc_pll("hpll", val);
+        else
+                hw = clk_hw_register_fixed_rate(NULL, "hpll", "clkin", 0,
+                                hpll * 1000000);
+
+        aspeed_clk_data->hws[ASPEED_CLK_HPLL] = hw;
 
         /*
          * Strap bits 11:10 define the CPU/AHB clock frequency ratio (aka HCLK)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 9760b526ca31..e2ed078abd90 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -24,7 +24,6 @@
 #include <linux/pm_runtime.h>
 #include <linux/sched.h>
 #include <linux/clkdev.h>
-#include <linux/stringify.h>
 
 #include "clk.h"
 
@@ -2559,7 +2558,7 @@ static const struct {
         unsigned long flag;
         const char *name;
 } clk_flags[] = {
-#define ENTRY(f) { f, __stringify(f) }
+#define ENTRY(f) { f, #f }
         ENTRY(CLK_SET_RATE_GATE),
         ENTRY(CLK_SET_PARENT_GATE),
         ENTRY(CLK_SET_RATE_PARENT),
diff --git a/drivers/clk/meson/clk-audio-divider.c b/drivers/clk/meson/clk-audio-divider.c
index 58f546e04807..e4cf96ba704e 100644
--- a/drivers/clk/meson/clk-audio-divider.c
+++ b/drivers/clk/meson/clk-audio-divider.c
@@ -51,7 +51,7 @@ static unsigned long audio_divider_recalc_rate(struct clk_hw *hw,
         struct meson_clk_audio_div_data *adiv = meson_clk_audio_div_data(clk);
         unsigned long divider;
 
-        divider = meson_parm_read(clk->map, &adiv->div);
+        divider = meson_parm_read(clk->map, &adiv->div) + 1;
 
         return DIV_ROUND_UP_ULL((u64)parent_rate, divider);
 }
diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
index 240658404367..177fffb9ebef 100644
--- a/drivers/clk/meson/gxbb.c
+++ b/drivers/clk/meson/gxbb.c
@@ -498,6 +498,7 @@ static struct clk_regmap gxbb_fclk_div2 = {
                 .ops = &clk_regmap_gate_ops,
                 .parent_names = (const char *[]){ "fclk_div2_div" },
                 .num_parents = 1,
+                .flags = CLK_IS_CRITICAL,
         },
 };
 
diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
index 6860bd5a37c5..44e4e27eddad 100644
--- a/drivers/clk/mvebu/armada-37xx-periph.c
+++ b/drivers/clk/mvebu/armada-37xx-periph.c
@@ -35,6 +35,7 @@
 #define CLK_SEL         0x10
 #define CLK_DIS         0x14
 
+#define  ARMADA_37XX_DVFS_LOAD_1 1
 #define LOAD_LEVEL_NR   4
 
 #define ARMADA_37XX_NB_L0L1     0x18
@@ -507,6 +508,40 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
         return -EINVAL;
 }
 
+/*
+ * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+ * respectively) to L0 frequency (1.2 Ghz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+ * might start operating at L0 before the voltage is stabilized,
+ * leading to CPU stalls.
+ *
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+ * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
+ * 2. Sleep 20ms for stabling VDD voltage
+ * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
+ */
+static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
+{
+        unsigned int cur_level;
+
+        if (rate != 1200 * 1000 * 1000)
+                return;
+
+        regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+        cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+        if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
+                return;
+
+        regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+                           ARMADA_37XX_NB_CPU_LOAD_MASK,
+                           ARMADA_37XX_DVFS_LOAD_1);
+        msleep(20);
+}
+
 static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                                unsigned long parent_rate)
 {
@@ -537,6 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
                          */
                         reg = ARMADA_37XX_NB_CPU_LOAD;
                         mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+                        clk_pm_cpu_set_rate_wa(rate, base);
+
                         regmap_update_bits(base, reg, mask, load_level);
 
                         return rate;
diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
index 9f35b3fe1d97..ff8d66fd94e6 100644
--- a/drivers/clk/qcom/gcc-msm8996.c
+++ b/drivers/clk/qcom/gcc-msm8996.c
@@ -2781,6 +2781,7 @@ static struct clk_branch gcc_ufs_rx_cfg_clk = {
 
 static struct clk_branch gcc_ufs_tx_symbol_0_clk = {
         .halt_reg = 0x75018,
+        .halt_check = BRANCH_HALT_SKIP,
         .clkr = {
                 .enable_reg = 0x75018,
                 .enable_mask = BIT(0),
diff --git a/drivers/clk/qcom/mmcc-msm8996.c b/drivers/clk/qcom/mmcc-msm8996.c
index 1a25ee4f3658..4b20d1b67a1b 100644
--- a/drivers/clk/qcom/mmcc-msm8996.c
+++ b/drivers/clk/qcom/mmcc-msm8996.c
@@ -2910,6 +2910,7 @@ static struct gdsc mmagic_bimc_gdsc = {
                 .name = "mmagic_bimc",
         },
         .pwrsts = PWRSTS_OFF_ON,
+        .flags = ALWAYS_ON,
 };
 
 static struct gdsc mmagic_video_gdsc = {
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 3c3971256130..d4ed0022b0dd 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -311,12 +311,20 @@ static DEFINE_MUTEX(intel_pstate_limits_lock);
 
 #ifdef CONFIG_ACPI
 
-static bool intel_pstate_get_ppc_enable_status(void)
+static bool intel_pstate_acpi_pm_profile_server(void)
 {
         if (acpi_gbl_FADT.preferred_profile == PM_ENTERPRISE_SERVER ||
             acpi_gbl_FADT.preferred_profile == PM_PERFORMANCE_SERVER)
                 return true;
 
+        return false;
+}
+
+static bool intel_pstate_get_ppc_enable_status(void)
+{
+        if (intel_pstate_acpi_pm_profile_server())
+                return true;
+
         return acpi_ppc;
 }
 
@@ -459,6 +467,11 @@ static inline void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *pol
 static inline void intel_pstate_exit_perf_limits(struct cpufreq_policy *policy)
 {
 }
+
+static inline bool intel_pstate_acpi_pm_profile_server(void)
+{
+        return false;
+}
 #endif
 
 static inline void update_turbo_state(void)
@@ -1841,7 +1854,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
                 intel_pstate_hwp_enable(cpu);
 
                 id = x86_match_cpu(intel_pstate_hwp_boost_ids);
-                if (id)
+                if (id && intel_pstate_acpi_pm_profile_server())
                         hwp_boost = true;
         }
 
diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
index 29389accf3e9..efc9a7ae4857 100644
--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
+++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
@@ -183,6 +183,7 @@ static struct platform_driver qcom_cpufreq_kryo_driver = {
 static const struct of_device_id qcom_cpufreq_kryo_match_list[] __initconst = {
         { .compatible = "qcom,apq8096", },
         { .compatible = "qcom,msm8996", },
+        {}
 };
 
 /*
diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
index d3cf9502e7e7..58faeb1cef63 100644
--- a/drivers/gpio/gpio-uniphier.c
+++ b/drivers/gpio/gpio-uniphier.c
@@ -181,7 +181,11 @@ static int uniphier_gpio_to_irq(struct gpio_chip *chip, unsigned int offset)
         fwspec.fwnode = of_node_to_fwnode(chip->parent->of_node);
         fwspec.param_count = 2;
         fwspec.param[0] = offset - UNIPHIER_GPIO_IRQ_OFFSET;
-        fwspec.param[1] = IRQ_TYPE_NONE;
+        /*
+         * IRQ_TYPE_NONE is rejected by the parent irq domain. Set LEVEL_HIGH
+         * temporarily. Anyway, ->irq_set_type() will override it later.
+         */
+        fwspec.param[1] = IRQ_TYPE_LEVEL_HIGH;
 
         return irq_create_fwspec_mapping(&fwspec);
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 28d968088131..53a14ee8ad6d 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -64,7 +64,8 @@ static void of_gpio_flags_quirks(struct device_node *np,
          * Note that active low is the default.
          */
         if (IS_ENABLED(CONFIG_REGULATOR) &&
-            (of_device_is_compatible(np, "reg-fixed-voltage") ||
+            (of_device_is_compatible(np, "regulator-fixed") ||
+             of_device_is_compatible(np, "reg-fixed-voltage") ||
              of_device_is_compatible(np, "regulator-gpio"))) {
                 /*
                  * The regulator GPIO handles are specified such that the
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 52f3b91d14fd..71e1aa54f774 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -652,6 +652,7 @@ enum intel_sbi_destination {
 #define QUIRK_BACKLIGHT_PRESENT (1<<3)
 #define QUIRK_PIN_SWIZZLED_PAGES (1<<5)
 #define QUIRK_INCREASE_T12_DELAY (1<<6)
+#define QUIRK_INCREASE_DDI_DISABLED_TIME (1<<7)
 
 struct intel_fbdev;
 struct intel_fbc_work;
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index f4a8598a2d39..fed26d6e4e27 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1782,15 +1782,24 @@ void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state)
         I915_WRITE(TRANS_DDI_FUNC_CTL(cpu_transcoder), temp);
 }
 
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-                                       enum transcoder cpu_transcoder)
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        enum transcoder cpu_transcoder = crtc_state->cpu_transcoder;
         i915_reg_t reg = TRANS_DDI_FUNC_CTL(cpu_transcoder);
         uint32_t val = I915_READ(reg);
 
         val &= ~(TRANS_DDI_FUNC_ENABLE | TRANS_DDI_PORT_MASK | TRANS_DDI_DP_VC_PAYLOAD_ALLOC);
         val |= TRANS_DDI_PORT_NONE;
         I915_WRITE(reg, val);
+
+        if (dev_priv->quirks & QUIRK_INCREASE_DDI_DISABLED_TIME &&
+            intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) {
+                DRM_DEBUG_KMS("Quirk Increase DDI disabled time\n");
+                /* Quirk time at 100ms for reliable operation */
+                msleep(100);
+        }
 }
 
 int intel_ddi_toggle_hdcp_signalling(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2cc6faa1daa8..dec0d60921bf 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5809,7 +5809,7 @@ static void haswell_crtc_disable(struct intel_crtc_state *old_crtc_state,
                 intel_ddi_set_vc_payload_alloc(intel_crtc->config, false);
 
         if (!transcoder_is_dsi(cpu_transcoder))
-                intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder);
+                intel_ddi_disable_transcoder_func(old_crtc_state);
 
         if (INTEL_GEN(dev_priv) >= 9)
                 skylake_scaler_disable(intel_crtc);
@@ -14646,6 +14646,18 @@ static void quirk_increase_t12_delay(struct drm_device *dev)
         DRM_INFO("Applying T12 delay quirk\n");
 }
 
+/*
+ * GeminiLake NUC HDMI outputs require additional off time
+ * this allows the onboard retimer to correctly sync to signal
+ */
+static void quirk_increase_ddi_disabled_time(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = to_i915(dev);
+
+        dev_priv->quirks |= QUIRK_INCREASE_DDI_DISABLED_TIME;
+        DRM_INFO("Applying Increase DDI Disabled quirk\n");
+}
+
 struct intel_quirk {
         int device;
         int subsystem_vendor;
@@ -14732,6 +14744,13 @@ static struct intel_quirk intel_quirks[] = {
 
         /* Toshiba Satellite P50-C-18C */
         { 0x191B, 0x1179, 0xF840, quirk_increase_t12_delay },
+
+        /* GeminiLake NUC */
+        { 0x3185, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+        { 0x3184, 0x8086, 0x2072, quirk_increase_ddi_disabled_time },
+        /* ASRock ITX*/
+        { 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
+        { 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0361130500a6..b8eefbffc77d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1388,8 +1388,7 @@ void hsw_fdi_link_train(struct intel_crtc *crtc,
 void intel_ddi_init(struct drm_i915_private *dev_priv, enum port port);
 bool intel_ddi_get_hw_state(struct intel_encoder *encoder, enum pipe *pipe);
 void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state);
-void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv,
-                                       enum transcoder cpu_transcoder);
+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state);
 void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state);
 void intel_ddi_disable_pipe_clock(const  struct intel_crtc_state *crtc_state);
 struct intel_encoder *
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 56dd7a9a8e25..dd5312b02a8d 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -612,6 +612,9 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 return PTR_ERR(imx_ldb->regmap);
         }
 
+        /* disable LDB by resetting the control register to POR default */
+        regmap_write(imx_ldb->regmap, IOMUXC_GPR2, 0);
+
         imx_ldb->dev = dev;
 
         if (of_id)
@@ -652,14 +655,14 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 if (ret || i < 0 || i > 1)
                         return -EINVAL;
 
+                if (!of_device_is_available(child))
+                        continue;
+
                 if (dual && i > 0) {
                         dev_warn(dev, "dual-channel mode, ignoring second output\n");
                         continue;
                 }
 
-                if (!of_device_is_available(child))
-                        continue;
-
                 channel = &imx_ldb->channel[i];
                 channel->ldb = imx_ldb;
                 channel->chno = i;
diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
index caa05b0702e1..5450a2db1219 100644
--- a/drivers/gpu/ipu-v3/ipu-csi.c
+++ b/drivers/gpu/ipu-v3/ipu-csi.c
@@ -339,7 +339,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
                 break;
         case V4L2_MBUS_BT656:
                 csicfg->ext_vsync = 0;
-                if (V4L2_FIELD_HAS_BOTH(mbus_fmt->field))
+                if (V4L2_FIELD_HAS_BOTH(mbus_fmt->field) ||
+                    mbus_fmt->field == V4L2_FIELD_ALTERNATE)
                         csicfg->clk_mode = IPU_CSI_CLK_MODE_CCIR656_INTERLACED;
                 else
                         csicfg->clk_mode = IPU_CSI_CLK_MODE_CCIR656_PROGRESSIVE;
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 75d6ab177055..7379043711df 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -237,12 +237,16 @@ static void i2c_davinci_calc_clk_dividers(struct davinci_i2c_dev *dev)
         /*
          * It's not always possible to have 1 to 2 ratio when d=7, so fall back
          * to minimal possible clkh in this case.
+         *
+         * Note:
+         * CLKH is not allowed to be 0, in this case I2C clock is not generated
+         * at all
          */
-        if (clk >= clkl + d) {
+        if (clk > clkl + d) {
                 clkh = clk - clkl - d;
                 clkl -= d;
         } else {
-                clkh = 0;
+                clkh = 1;
                 clkl = clk - (d << 1);
         }
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 0207e194f84b..498c5e891649 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -368,6 +368,7 @@ static int i2c_imx_dma_xfer(struct imx_i2c_struct *i2c_imx,
                 goto err_desc;
         }
 
+        reinit_completion(&dma->cmd_complete);
         txdesc->callback = i2c_imx_dma_callback;
         txdesc->callback_param = i2c_imx;
         if (dma_submit_error(dmaengine_submit(txdesc))) {
@@ -622,7 +623,6 @@ static int i2c_imx_dma_write(struct imx_i2c_struct *i2c_imx,
          * The first byte must be transmitted by the CPU.
          */
         imx_i2c_write_reg(i2c_8bit_addr_from_msg(msgs), i2c_imx, IMX_I2C_I2DR);
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -681,7 +681,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
         if (result)
                 return result;
 
-        reinit_completion(&i2c_imx->dma->cmd_complete);
         time_left = wait_for_completion_timeout(
                                 &i2c_imx->dma->cmd_complete,
                                 msecs_to_jiffies(DMA_TIMEOUT));
@@ -1010,7 +1009,7 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
         i2c_imx->pinctrl_pins_gpio = pinctrl_lookup_state(i2c_imx->pinctrl,
                         "gpio");
         rinfo->sda_gpiod = devm_gpiod_get(&pdev->dev, "sda", GPIOD_IN);
-        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH);
+        rinfo->scl_gpiod = devm_gpiod_get(&pdev->dev, "scl", GPIOD_OUT_HIGH_OPEN_DRAIN);
 
         if (PTR_ERR(rinfo->sda_gpiod) == -EPROBE_DEFER ||
             PTR_ERR(rinfo->scl_gpiod) == -EPROBE_DEFER) {
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 5e310efd9446..3c1c817f6968 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -32,6 +32,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 
 /* register offsets */
@@ -111,8 +112,9 @@
 #define ID_ARBLOST      (1 << 3)
 #define ID_NACK         (1 << 4)
 /* persistent flags */
+#define ID_P_NO_RXDMA   (1 << 30) /* HW forbids RXDMA sometimes */
 #define ID_P_PM_BLOCKED (1 << 31)
-#define ID_P_MASK       ID_P_PM_BLOCKED
+#define ID_P_MASK       (ID_P_PM_BLOCKED | ID_P_NO_RXDMA)
 
 enum rcar_i2c_type {
         I2C_RCAR_GEN1,
@@ -141,6 +143,8 @@ struct rcar_i2c_priv {
         struct dma_chan *dma_rx;
         struct scatterlist sg;
         enum dma_data_direction dma_direction;
+
+        struct reset_control *rstc;
 };
 
 #define rcar_i2c_priv_to_dev(p)         ((p)->adap.dev.parent)
@@ -370,6 +374,11 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
                          sg_dma_len(&priv->sg), priv->dma_direction);
 
+        /* Gen3 can only do one RXDMA per transfer and we just completed it */
+        if (priv->devtype == I2C_RCAR_GEN3 &&
+            priv->dma_direction == DMA_FROM_DEVICE)
+                priv->flags |= ID_P_NO_RXDMA;
+
         priv->dma_direction = DMA_NONE;
 }
 
@@ -407,8 +416,9 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         unsigned char *buf;
         int len;
 
-        /* Do not use DMA if it's not available or for messages < 8 bytes */
-        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE))
+        /* Do various checks to see if DMA is feasible at all */
+        if (IS_ERR(chan) || msg->len < 8 || !(msg->flags & I2C_M_DMA_SAFE) ||
+            (read && priv->flags & ID_P_NO_RXDMA))
                 return;
 
         if (read) {
@@ -739,6 +749,25 @@ static void rcar_i2c_release_dma(struct rcar_i2c_priv *priv)
         }
 }
 
+/* I2C is a special case, we need to poll the status of a reset */
+static int rcar_i2c_do_reset(struct rcar_i2c_priv *priv)
+{
+        int i, ret;
+
+        ret = reset_control_reset(priv->rstc);
+        if (ret)
+                return ret;
+
+        for (i = 0; i < LOOP_TIMEOUT; i++) {
+                ret = reset_control_status(priv->rstc);
+                if (ret == 0)
+                        return 0;
+                udelay(1);
+        }
+
+        return -ETIMEDOUT;
+}
+
 static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
                                 struct i2c_msg *msgs,
                                 int num)
@@ -750,6 +779,16 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
 
         pm_runtime_get_sync(dev);
 
+        /* Gen3 needs a reset before allowing RXDMA once */
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->flags |= ID_P_NO_RXDMA;
+                if (!IS_ERR(priv->rstc)) {
+                        ret = rcar_i2c_do_reset(priv);
+                        if (ret == 0)
+                                priv->flags &= ~ID_P_NO_RXDMA;
+                }
+        }
+
         rcar_i2c_init(priv);
 
         ret = rcar_i2c_bus_barrier(priv);
@@ -920,6 +959,15 @@ static int rcar_i2c_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out_pm_put;
 
+        if (priv->devtype == I2C_RCAR_GEN3) {
+                priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+                if (!IS_ERR(priv->rstc)) {
+                        ret = reset_control_status(priv->rstc);
+                        if (ret < 0)
+                                priv->rstc = ERR_PTR(-ENOTSUPP);
+                }
+        }
+
         /* Stay always active when multi-master to keep arbitration working */
         if (of_property_read_bool(dev->of_node, "multi-master"))
                 priv->flags |= ID_P_PM_BLOCKED;
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 301285c54603..15c95aaa484c 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -624,7 +624,7 @@ static int i2c_check_addr_busy(struct i2c_adapter *adapter, int addr)
 static void i2c_adapter_lock_bus(struct i2c_adapter *adapter,
                                  unsigned int flags)
 {
-        rt_mutex_lock(&adapter->bus_lock);
+        rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
 }
 
 /**
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 300ab4b672e4..29646aa6132e 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -144,7 +144,7 @@ static void i2c_mux_lock_bus(struct i2c_adapter *adapter, unsigned int flags)
         struct i2c_mux_priv *priv = adapter->algo_data;
         struct i2c_adapter *parent = priv->muxc->parent;
 
-        rt_mutex_lock(&parent->mux_lock);
+        rt_mutex_lock_nested(&parent->mux_lock, i2c_adapter_depth(adapter));
         if (!(flags & I2C_LOCK_ROOT_ADAPTER))
                 return;
         i2c_lock_bus(parent, flags);
@@ -181,7 +181,7 @@ static void i2c_parent_lock_bus(struct i2c_adapter *adapter,
         struct i2c_mux_priv *priv = adapter->algo_data;
         struct i2c_adapter *parent = priv->muxc->parent;
 
-        rt_mutex_lock(&parent->mux_lock);
+        rt_mutex_lock_nested(&parent->mux_lock, i2c_adapter_depth(adapter));
         i2c_lock_bus(parent, flags);
 }
 
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 1f9cd7d8b7ad..f5ae24865355 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1346,6 +1346,8 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0611", 0 },
         { "ELAN0612", 0 },
         { "ELAN0618", 0 },
+        { "ELAN061D", 0 },
+        { "ELAN0622", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index b353d494ad40..136f6e7bf797 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -527,6 +527,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
                 },
         },
+        {
+                /* Lenovo LaVie Z */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 75f781c11e89..de4e6e5bf304 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -293,9 +293,10 @@ static void mxcmci_swap_buffers(struct mmc_data *data)
         int i;
 
         for_each_sg(data->sg, sg, data->sg_len, i) {
-                void *buf = kmap_atomic(sg_page(sg) + sg->offset;
+                void *buf = kmap_atomic(sg_page(sg) + sg->offset);
                 buffer_swap32(buf, sg->length);
                 kunmap_atomic(buf);
+        }
 }
 #else
 static inline void mxcmci_swap_buffers(struct mmc_data *data) {}
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9a2ea3c1f949..a764a83f99da 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1717,6 +1717,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                 goto err_upper_unlink;
         }
 
+        bond->nest_level = dev_get_nest_level(bond_dev) + 1;
+
         /* If the mode uses primary, then the following is handled by
          * bond_change_active_slave().
          */
@@ -1764,7 +1766,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
         if (bond_mode_can_use_xmit_hash(bond))
                 bond_update_slave_arr(bond, NULL);
 
-        bond->nest_level = dev_get_nest_level(bond_dev);
 
         netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n",
                     slave_dev->name,
@@ -3415,6 +3416,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
         }
 }
 
+static int bond_get_nest_level(struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+
+        return bond->nest_level;
+}
+
 static void bond_get_stats(struct net_device *bond_dev,
                            struct rtnl_link_stats64 *stats)
 {
@@ -3423,7 +3431,7 @@ static void bond_get_stats(struct net_device *bond_dev,
         struct list_head *iter;
         struct slave *slave;
 
-        spin_lock(&bond->stats_lock);
+        spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev));
         memcpy(stats, &bond->bond_stats, sizeof(*stats));
 
         rcu_read_lock();
@@ -4228,6 +4236,7 @@ static const struct net_device_ops bond_netdev_ops = {
         .ndo_neigh_setup        = bond_neigh_setup,
         .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
+        .ndo_get_lock_subclass  = bond_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_setup      = bond_netpoll_setup,
         .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
@@ -4726,6 +4735,7 @@ static int bond_init(struct net_device *bond_dev)
         if (!bond->wq)
                 return -ENOMEM;
 
+        bond->nest_level = SINGLE_DEPTH_NESTING;
         netdev_lockdep_set_classes(bond_dev);
 
         list_add_tail(&bond->bond_list, &bn->dev_list);
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 12ff0020ecd6..b7dfd4109d24 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1072,6 +1072,7 @@ static void ems_usb_disconnect(struct usb_interface *intf)
                 usb_free_urb(dev->intr_urb);
 
                 kfree(dev->intr_in_buffer);
+                kfree(dev->tx_msg_buffer);
         }
 }
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index a80767d3c405..0b5a2c31f395 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2617,7 +2617,6 @@ static const struct mv88e6xxx_ops mv88e6085_ops = {
         .rmu_disable = mv88e6085_g1_rmu_disable,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6095_ops = {
@@ -2783,6 +2782,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
 };
 
@@ -2964,7 +2964,6 @@ static const struct mv88e6xxx_ops mv88e6175_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
-        .serdes_power = mv88e6341_serdes_power,
 };
 
 static const struct mv88e6xxx_ops mv88e6176_ops = {
@@ -3346,6 +3345,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .serdes_power = mv88e6341_serdes_power,
         .gpio_ops = &mv88e6352_gpio_ops,
         .avb_ops = &mv88e6390_avb_ops,
         .ptp_ops = &mv88e6352_ptp_ops,
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 1b9d3130af4d..17f12c18d225 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -333,6 +333,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
 
         memset(&io_sq->desc_addr, 0x0, sizeof(io_sq->desc_addr));
 
+        io_sq->dma_addr_bits = ena_dev->dma_addr_bits;
         io_sq->desc_entry_size =
                 (io_sq->direction == ENA_COM_IO_QUEUE_DIRECTION_TX) ?
                 sizeof(struct ena_eth_io_tx_desc) :
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 4b5d625de8f0..8a3a60bb2688 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1111,14 +1111,14 @@ static void xgbe_phy_adjust_link(struct xgbe_prv_data *pdata)
 
                 if (pdata->tx_pause != pdata->phy.tx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_tx_flow_control(pdata);
                         pdata->tx_pause = pdata->phy.tx_pause;
+                        pdata->hw_if.config_tx_flow_control(pdata);
                 }
 
                 if (pdata->rx_pause != pdata->phy.rx_pause) {
                         new_state = 1;
-                        pdata->hw_if.config_rx_flow_control(pdata);
                         pdata->rx_pause = pdata->phy.rx_pause;
+                        pdata->hw_if.config_rx_flow_control(pdata);
                 }
 
                 /* Speed support */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 674997d30cfd..0f7ce71205e6 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3073,6 +3073,7 @@ static void cxgb_del_udp_tunnel(struct net_device *netdev,
 
                 adapter->geneve_port = 0;
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A, 0);
+                break;
         default:
                 return;
         }
@@ -3158,6 +3159,7 @@ static void cxgb_add_udp_tunnel(struct net_device *netdev,
 
                 t4_write_reg(adapter, MPS_RX_GENEVE_TYPE_A,
                              GENEVE_V(be16_to_cpu(ti->port)) | GENEVE_EN_F);
+                break;
         default:
                 return;
         }
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 90c645b8538e..60641e202534 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2047,28 +2047,42 @@ static int enic_stop(struct net_device *netdev)
         return 0;
 }
 
+static int _enic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        bool running = netif_running(netdev);
+        int err = 0;
+
+        ASSERT_RTNL();
+        if (running) {
+                err = enic_stop(netdev);
+                if (err)
+                        return err;
+        }
+
+        netdev->mtu = new_mtu;
+
+        if (running) {
+                err = enic_open(netdev);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
 static int enic_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct enic *enic = netdev_priv(netdev);
-        int running = netif_running(netdev);
 
         if (enic_is_dynamic(enic) || enic_is_sriov_vf(enic))
                 return -EOPNOTSUPP;
 
-        if (running)
-                enic_stop(netdev);
-
-        netdev->mtu = new_mtu;
-
         if (netdev->mtu > enic->port_mtu)
                 netdev_warn(netdev,
-                        "interface MTU (%d) set higher than port MTU (%d)\n",
-                        netdev->mtu, enic->port_mtu);
+                            "interface MTU (%d) set higher than port MTU (%d)\n",
+                            netdev->mtu, enic->port_mtu);
 
-        if (running)
-                enic_open(netdev);
-
-        return 0;
+        return _enic_change_mtu(netdev, new_mtu);
 }
 
 static void enic_change_mtu_work(struct work_struct *work)
@@ -2076,47 +2090,9 @@ static void enic_change_mtu_work(struct work_struct *work)
         struct enic *enic = container_of(work, struct enic, change_mtu_work);
         struct net_device *netdev = enic->netdev;
         int new_mtu = vnic_dev_mtu(enic->vdev);
-        int err;
-        unsigned int i;
-
-        new_mtu = max_t(int, ENIC_MIN_MTU, min_t(int, ENIC_MAX_MTU, new_mtu));
 
         rtnl_lock();
-
-        /* Stop RQ */
-        del_timer_sync(&enic->notify_timer);
-
-        for (i = 0; i < enic->rq_count; i++)
-                napi_disable(&enic->napi[i]);
-
-        vnic_intr_mask(&enic->intr[0]);
-        enic_synchronize_irqs(enic);
-        err = vnic_rq_disable(&enic->rq[0]);
-        if (err) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to disable RQ.\n");
-                return;
-        }
-        vnic_rq_clean(&enic->rq[0], enic_free_rq_buf);
-        vnic_cq_clean(&enic->cq[0]);
-        vnic_intr_clean(&enic->intr[0]);
-
-        /* Fill RQ with new_mtu-sized buffers */
-        netdev->mtu = new_mtu;
-        vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf);
-        /* Need at least one buffer on ring to get going */
-        if (vnic_rq_desc_used(&enic->rq[0]) == 0) {
-                rtnl_unlock();
-                netdev_err(netdev, "Unable to alloc receive buffers.\n");
-                return;
-        }
-
-        /* Start RQ */
-        vnic_rq_enable(&enic->rq[0]);
-        napi_enable(&enic->napi[0]);
-        vnic_intr_unmask(&enic->intr[0]);
-        enic_notify_timer_start(enic);
-
+        (void)_enic_change_mtu(netdev, new_mtu);
         rtnl_unlock();
 
         netdev_info(netdev, "interface MTU set as %d\n", netdev->mtu);
@@ -2916,7 +2892,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          */
 
         enic->port_mtu = enic->config.mtu;
-        (void)enic_change_mtu(netdev, enic->port_mtu);
 
         err = enic_set_mac_addr(netdev, enic->mac_addr);
         if (err) {
@@ -3006,6 +2981,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* MTU range: 68 - 9000 */
         netdev->min_mtu = ENIC_MIN_MTU;
         netdev->max_mtu = ENIC_MAX_MTU;
+        netdev->mtu     = enic->port_mtu;
 
         err = register_netdev(netdev);
         if (err) {
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
index 5b122728dcb4..09e9da10b786 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
@@ -983,6 +983,7 @@ static int nic_dev_init(struct pci_dev *pdev)
         hinic_hwdev_cb_register(nic_dev->hwdev, HINIC_MGMT_MSG_CMD_LINK_STATUS,
                                 nic_dev, link_status_event_handler);
 
+        SET_NETDEV_DEV(netdev, &pdev->dev);
         err = register_netdev(netdev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to register netdev\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 86bc9ac99586..e33afa8d2417 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -1172,6 +1172,8 @@ static int mlx5e_trust_initialize(struct mlx5e_priv *priv)
         struct mlx5_core_dev *mdev = priv->mdev;
         int err;
 
+        priv->dcbx_dp.trust_state = MLX5_QPTS_TRUST_PCP;
+
         if (!MLX5_DSCP_SUPPORTED(mdev))
                 return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index de2827ad0e67..a2fb21ca5767 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3754,7 +3754,8 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
 
         if (!reset) {
                 params->sw_mtu = new_mtu;
-                set_mtu_cb(priv);
+                if (set_mtu_cb)
+                        set_mtu_cb(priv);
                 netdev->mtu = params->sw_mtu;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index dd01ad4c0b54..40dba9e8af92 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1696,7 +1696,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_VPORT_MANAGER(dev))
+        if (!MLX5_ESWITCH_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1765,7 +1765,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
+        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index af3bb2f7a504..b7c21eb21a21 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -76,6 +76,7 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
                 void *ppriv)
 {
         struct mlx5e_priv *priv  = mlx5i_epriv(netdev);
+        u16 max_mtu;
 
         /* priv init */
         priv->mdev        = mdev;
@@ -84,6 +85,9 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
         priv->ppriv       = ppriv;
         mutex_init(&priv->state_lock);
 
+        mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
+        netdev->mtu = max_mtu;
+
         mlx5e_build_nic_params(mdev, &priv->channels.params,
                                profile->max_nch(mdev), netdev->mtu);
         mlx5i_build_nic_params(mdev, &priv->channels.params);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index 1decf3a1cad3..e57d23746585 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -80,7 +80,7 @@ nfp_flower_repr_get_type_and_port(struct nfp_app *app, u32 port_id, u8 *port)
                         return NFP_REPR_TYPE_VF;
         }
 
-        return NFP_FLOWER_CMSG_PORT_TYPE_UNSPEC;
+        return __NFP_REPR_TYPE_MAX;
 }
 
 static struct net_device *
@@ -91,6 +91,8 @@ nfp_flower_repr_get(struct nfp_app *app, u32 port_id)
         u8 port = 0;
 
         repr_type = nfp_flower_repr_get_type_and_port(app, port_id, &port);
+        if (repr_type > NFP_REPR_TYPE_MAX)
+                return NULL;
 
         reprs = rcu_dereference(app->reprs[repr_type]);
         if (!reprs)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index d9e60cfd8a85..9d104a05044d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -53,7 +53,7 @@
 #include "dwmac1000.h"
 #include "hwif.h"
 
-#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x)
+#define STMMAC_ALIGN(x)         __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
 #define TSO_MAX_BUFF_SIZE       (SZ_16K - 1)
 
 /* Module parameters */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 8d375e51a526..6a393b16a1fc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         /* Enable pci device */
-        ret = pcim_enable_device(pdev);
+        ret = pci_enable_device(pdev);
         if (ret) {
                 dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
                         __func__);
@@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
 static void stmmac_pci_remove(struct pci_dev *pdev)
 {
         stmmac_dvr_remove(&pdev->dev);
+        pci_disable_device(pdev);
 }
 
-static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume);
+static int stmmac_pci_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        ret = stmmac_suspend(dev);
+        if (ret)
+                return ret;
+
+        ret = pci_save_state(pdev);
+        if (ret)
+                return ret;
+
+        pci_disable_device(pdev);
+        pci_wake_from_d3(pdev, true);
+        return 0;
+}
+
+static int stmmac_pci_resume(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        int ret;
+
+        pci_restore_state(pdev);
+        pci_set_power_state(pdev, PCI_D0);
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        pci_set_master(pdev);
+
+        return stmmac_resume(dev);
+}
+
+static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume);
 
 /* synthetic ID, no official vendor */
 #define PCI_VENDOR_ID_STMMAC 0x700
diff --git a/drivers/net/netdevsim/devlink.c b/drivers/net/netdevsim/devlink.c
index ba663e5af168..5135fc371f01 100644
--- a/drivers/net/netdevsim/devlink.c
+++ b/drivers/net/netdevsim/devlink.c
@@ -207,6 +207,7 @@ void nsim_devlink_teardown(struct netdevsim *ns)
                 struct net *net = nsim_to_net(ns);
                 bool *reg_devlink = net_generic(net, nsim_devlink_id);
 
+                devlink_resources_unregister(ns->devlink, NULL);
                 devlink_unregister(ns->devlink);
                 devlink_free(ns->devlink);
                 ns->devlink = NULL;
diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
index 0831b7142df7..0c5b68e7da51 100644
--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
+++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
@@ -218,7 +218,7 @@ out:
 
 static int mdio_mux_iproc_remove(struct platform_device *pdev)
 {
-        struct iproc_mdiomux_desc *md = dev_get_platdata(&pdev->dev);
+        struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev);
 
         mdio_mux_uninit(md->mux_handle);
         mdiobus_unregister(md->mii_bus);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index ac25981ee4d5..4662fa0381f9 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1242,6 +1242,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
                         mod_timer(&dev->stat_monitor,
                                   jiffies + STAT_UPDATE_TIMER);
                 }
+
+                tasklet_schedule(&dev->bh);
         }
 
         return ret;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 45928b5b8d97..4fffa6988087 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1785,7 +1785,8 @@ brcmf_pcie_prepare_fw_request(struct brcmf_pciedev_info *devinfo)
         fwreq->items[BRCMF_PCIE_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;
         fwreq->items[BRCMF_PCIE_FW_NVRAM].flags = BRCMF_FW_REQF_OPTIONAL;
-        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus);
+        /* NVRAM reserves PCI domain 0 for Broadcom's SDK faked bus */
+        fwreq->domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
         fwreq->bus_nr = devinfo->pdev->bus->number;
 
         return fwreq;
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index e20c30b29c03..c8ea63d02619 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -178,6 +178,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl9260_killer_2ac_cfg = {
+        .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
@@ -267,6 +278,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = {
         .soc_latency = 5000,
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+};
+
 const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
         .fw_name_pre = IWL9000A_FW_PRE,
@@ -327,6 +366,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = {
         .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
+        .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+        .fw_name_pre = IWL9000A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        IWL_DEVICE_9000,
+        .ht_params = &iwl9000_ht_params,
+        .nvm_ver = IWL9000_NVM_VERSION,
+        .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+        .integrated = true,
+        .soc_latency = 5000,
+        .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
 MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c503b26793f6..84a816809723 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -551,6 +551,7 @@ extern const struct iwl_cfg iwl8275_2ac_cfg;
 extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl9160_2ac_cfg;
 extern const struct iwl_cfg iwl9260_2ac_cfg;
+extern const struct iwl_cfg iwl9260_killer_2ac_cfg;
 extern const struct iwl_cfg iwl9270_2ac_cfg;
 extern const struct iwl_cfg iwl9460_2ac_cfg;
 extern const struct iwl_cfg iwl9560_2ac_cfg;
@@ -558,10 +559,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 38234bda9017..8520523b91b4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -545,6 +545,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -554,6 +557,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
@@ -578,6 +582,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
@@ -604,6 +610,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -630,6 +638,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)},
+        {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
         {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
@@ -656,6 +666,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -682,6 +694,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -708,6 +722,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -743,6 +759,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -771,6 +789,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -797,6 +817,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
         {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 4d88aa394273..799cba4624a5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -87,6 +87,7 @@ struct netfront_cb {
 /* IRQ name is queue name with "-tx" or "-rx" appended */
 #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3)
 
+static DECLARE_WAIT_QUEUE_HEAD(module_load_q);
 static DECLARE_WAIT_QUEUE_HEAD(module_unload_q);
 
 struct netfront_stats {
@@ -1331,6 +1332,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netif_carrier_off(netdev);
 
         xenbus_switch_state(dev, XenbusStateInitialising);
+        wait_event(module_load_q,
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateClosed &&
+                           xenbus_read_driver_state(dev->otherend) !=
+                           XenbusStateUnknown);
         return netdev;
 
  exit:
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 903eb4545e26..f7efe5a58cc7 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -539,14 +539,18 @@ static struct nvmf_transport_ops *nvmf_lookup_transport(
 /*
  * For something we're not in a state to send to the device the default action
  * is to busy it and retry it after the controller state is recovered.  However,
- * anything marked for failfast or nvme multipath is immediately failed.
+ * if the controller is deleting or if anything is marked for failfast or
+ * nvme multipath it is immediately failed.
  *
  * Note: commands used to initialize the controller will be marked for failfast.
  * Note: nvme cli/ioctl commands are marked for failfast.
  */
-blk_status_t nvmf_fail_nonready_command(struct request *rq)
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq)
 {
-        if (!blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+        if (ctrl->state != NVME_CTRL_DELETING &&
+            ctrl->state != NVME_CTRL_DEAD &&
+            !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
                 return BLK_STS_RESOURCE;
         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index e1818a27aa2d..aa2fdb2a2e8f 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -162,7 +162,8 @@ void nvmf_unregister_transport(struct nvmf_transport_ops *ops);
 void nvmf_free_options(struct nvmf_ctrl_options *opts);
 int nvmf_get_address(struct nvme_ctrl *ctrl, char *buf, int size);
 bool nvmf_should_reconnect(struct nvme_ctrl *ctrl);
-blk_status_t nvmf_fail_nonready_command(struct request *rq);
+blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+                struct request *rq);
 bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
                 bool queue_live);
 
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 41d45a1b5c62..9bac912173ba 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2272,7 +2272,7 @@ nvme_fc_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE ||
             !nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         ret = nvme_setup_cmd(ns, rq, sqe);
         if (ret)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 518c5b09038c..66ec5985c9f3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1639,7 +1639,7 @@ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         WARN_ON_ONCE(rq->tag < 0);
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, rq, queue_ready))
-                return nvmf_fail_nonready_command(rq);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, rq);
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index d3f3b3ec4d1a..ebea1373d1b7 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -282,6 +282,7 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
 {
         struct nvmet_ns *ns = to_nvmet_ns(item);
         struct nvmet_subsys *subsys = ns->subsys;
+        size_t len;
         int ret;
 
         mutex_lock(&subsys->lock);
@@ -289,10 +290,14 @@ static ssize_t nvmet_ns_device_path_store(struct config_item *item,
         if (ns->enabled)
                 goto out_unlock;
 
-        kfree(ns->device_path);
+        ret = -EINVAL;
+        len = strcspn(page, "\n");
+        if (!len)
+                goto out_unlock;
 
+        kfree(ns->device_path);
         ret = -ENOMEM;
-        ns->device_path = kstrndup(page, strcspn(page, "\n"), GFP_KERNEL);
+        ns->device_path = kstrndup(page, len, GFP_KERNEL);
         if (!ns->device_path)
                 goto out_unlock;
 
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 74d4b785d2da..9838103f2d62 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -339,7 +339,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
                 goto out_unlock;
 
         ret = nvmet_bdev_ns_enable(ns);
-        if (ret)
+        if (ret == -ENOTBLK)
                 ret = nvmet_file_ns_enable(ns);
         if (ret)
                 goto out_unlock;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 408279cb6f2c..29b4b236afd8 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -58,8 +58,8 @@ struct nvmet_fc_ls_iod {
         struct work_struct              work;
 } __aligned(sizeof(unsigned long long));
 
+/* desired maximum for a single sequence - if sg list allows it */
 #define NVMET_FC_MAX_SEQ_LENGTH         (256 * 1024)
-#define NVMET_FC_MAX_XFR_SGENTS         (NVMET_FC_MAX_SEQ_LENGTH / PAGE_SIZE)
 
 enum nvmet_fcp_datadir {
         NVMET_FCP_NODATA,
@@ -74,6 +74,7 @@ struct nvmet_fc_fcp_iod {
         struct nvme_fc_cmd_iu           cmdiubuf;
         struct nvme_fc_ersp_iu          rspiubuf;
         dma_addr_t                      rspdma;
+        struct scatterlist              *next_sg;
         struct scatterlist              *data_sg;
         int                             data_sg_cnt;
         u32                             offset;
@@ -1025,8 +1026,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
         INIT_LIST_HEAD(&newrec->assoc_list);
         kref_init(&newrec->ref);
         ida_init(&newrec->assoc_cnt);
-        newrec->max_sg_cnt = min_t(u32, NVMET_FC_MAX_XFR_SGENTS,
-                                        template->max_sgl_segments);
+        newrec->max_sg_cnt = template->max_sgl_segments;
 
         ret = nvmet_fc_alloc_ls_iodlist(newrec);
         if (ret) {
@@ -1722,6 +1722,7 @@ nvmet_fc_alloc_tgt_pgs(struct nvmet_fc_fcp_iod *fod)
                                 ((fod->io_dir == NVMET_FCP_WRITE) ?
                                         DMA_FROM_DEVICE : DMA_TO_DEVICE));
                                 /* note: write from initiator perspective */
+        fod->next_sg = fod->data_sg;
 
         return 0;
 
@@ -1866,24 +1867,49 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                                 struct nvmet_fc_fcp_iod *fod, u8 op)
 {
         struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
+        struct scatterlist *sg = fod->next_sg;
         unsigned long flags;
-        u32 tlen;
+        u32 remaininglen = fod->req.transfer_len - fod->offset;
+        u32 tlen = 0;
         int ret;
 
         fcpreq->op = op;
         fcpreq->offset = fod->offset;
         fcpreq->timeout = NVME_FC_TGTOP_TIMEOUT_SEC;
 
-        tlen = min_t(u32, tgtport->max_sg_cnt * PAGE_SIZE,
-                        (fod->req.transfer_len - fod->offset));
+        /*
+         * for next sequence:
+         *  break at a sg element boundary
+         *  attempt to keep sequence length capped at
+         *    NVMET_FC_MAX_SEQ_LENGTH but allow sequence to
+         *    be longer if a single sg element is larger
+         *    than that amount. This is done to avoid creating
+         *    a new sg list to use for the tgtport api.
+         */
+        fcpreq->sg = sg;
+        fcpreq->sg_cnt = 0;
+        while (tlen < remaininglen &&
+               fcpreq->sg_cnt < tgtport->max_sg_cnt &&
+               tlen + sg_dma_len(sg) < NVMET_FC_MAX_SEQ_LENGTH) {
+                fcpreq->sg_cnt++;
+                tlen += sg_dma_len(sg);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen && fcpreq->sg_cnt == 0) {
+                fcpreq->sg_cnt++;
+                tlen += min_t(u32, sg_dma_len(sg), remaininglen);
+                sg = sg_next(sg);
+        }
+        if (tlen < remaininglen)
+                fod->next_sg = sg;
+        else
+                fod->next_sg = NULL;
+
         fcpreq->transfer_length = tlen;
         fcpreq->transferred_length = 0;
         fcpreq->fcp_error = 0;
         fcpreq->rsplen = 0;
 
-        fcpreq->sg = &fod->data_sg[fod->offset / PAGE_SIZE];
-        fcpreq->sg_cnt = DIV_ROUND_UP(tlen, PAGE_SIZE);
-
         /*
          * If the last READDATA request: check if LLDD supports
          * combined xfr with response.
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d8d91f04bd7e..ae7586b8be07 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -162,7 +162,7 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx,
         blk_status_t ret;
 
         if (!nvmf_check_ready(&queue->ctrl->ctrl, req, queue_ready))
-                return nvmf_fail_nonready_command(req);
+                return nvmf_fail_nonready_command(&queue->ctrl->ctrl, req);
 
         ret = nvme_setup_cmd(ns, req, &iod->cmd);
         if (ret)
diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
index f7ce0cb0b0b7..f02e334beb45 100644
--- a/drivers/pci/pcie/err.c
+++ b/drivers/pci/pcie/err.c
@@ -295,6 +295,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
 
         parent = udev->subordinate;
         pci_lock_rescan_remove();
+        pci_dev_get(dev);
         list_for_each_entry_safe_reverse(pdev, temp, &parent->devices,
                                          bus_list) {
                 pci_dev_get(pdev);
@@ -328,6 +329,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
                 pci_info(dev, "Device recovery from fatal error failed\n");
         }
 
+        pci_dev_put(dev);
         pci_unlock_rescan_remove();
 }
 
diff --git a/drivers/phy/broadcom/phy-brcm-usb-init.c b/drivers/phy/broadcom/phy-brcm-usb-init.c
index 1b7febc43da9..29d2c3b1913a 100644
--- a/drivers/phy/broadcom/phy-brcm-usb-init.c
+++ b/drivers/phy/broadcom/phy-brcm-usb-init.c
@@ -962,6 +962,10 @@ void brcm_usb_init_xhci(struct brcm_usb_init_params *params)
 {
         void __iomem *ctrl = params->ctrl_regs;
 
+        USB_CTRL_UNSET(ctrl, USB30_PCTL, PHY3_IDDQ_OVERRIDE);
+        /* 1 millisecond - for USB clocks to settle down */
+        usleep_range(1000, 2000);
+
         if (BRCM_ID(params->family_id) == 0x7366) {
                 /*
                  * The PHY3_SOFT_RESETB bits default to the wrong state.
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 23705e1a0023..0075fb0bef8c 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -182,13 +182,13 @@ static void phy_mdm6600_status(struct work_struct *work)
         ddata = container_of(work, struct phy_mdm6600, status_work.work);
         dev = ddata->dev;
 
-        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_CMD_LINES,
+        error = gpiod_get_array_value_cansleep(PHY_MDM6600_NR_STATUS_LINES,
                                                ddata->status_gpios->desc,
                                                values);
         if (error)
                 return;
 
-        for (i = 0; i < PHY_MDM6600_NR_CMD_LINES; i++) {
+        for (i = 0; i < PHY_MDM6600_NR_STATUS_LINES; i++) {
                 val |= values[i] << i;
                 dev_dbg(ddata->dev, "XXX %s: i: %i values[i]: %i val: %i\n",
                         __func__, i, values[i], val);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index d6093838f5f2..c972cc2b3d5b 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -284,11 +284,11 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] "
                                           "rejected.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 /*
@@ -297,10 +297,10 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
                  */
                 if (conn->session->fast_abort) {
                         iscsi_conn_printk(KERN_INFO, conn,
-                                          "task [op %x/%x itt "
+                                          "task [op %x itt "
                                           "0x%x/0x%x] fast abort.\n",
-                                          task->hdr->opcode, opcode,
-                                          task->itt, task->hdr_itt);
+                                          opcode, task->itt,
+                                          task->hdr_itt);
                         return -EACCES;
                 }
                 break;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 89a4999fa631..c8731568f9c4 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2141,6 +2141,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                 msleep(1000);
 
         qla24xx_disable_vp(vha);
+        qla2x00_wait_for_sess_deletion(vha);
 
         vha->flags.delete_progress = 1;
 
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f68eb6096559..2660a48d918a 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -214,6 +214,7 @@ void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
 int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
 int qla24xx_async_abort_cmd(srb_t *);
 int qla24xx_post_relogin_work(struct scsi_qla_host *vha);
+void qla2x00_wait_for_sess_deletion(scsi_qla_host_t *);
 
 /*
  * Global Functions in qla_mid.c source file.
diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
index 2c35b0b2baa0..7a3744006419 100644
--- a/drivers/scsi/qla2xxx/qla_gs.c
+++ b/drivers/scsi/qla2xxx/qla_gs.c
@@ -3708,6 +3708,10 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
         return rval;
 
 done_free_sp:
+        spin_lock_irqsave(&vha->hw->vport_slock, flags);
+        list_del(&sp->elem);
+        spin_unlock_irqrestore(&vha->hw->vport_slock, flags);
+
         if (sp->u.iocb_cmd.u.ctarg.req) {
                 dma_free_coherent(&vha->hw->pdev->dev,
                         sizeof(struct ct_sns_pkt),
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index db0e3279e07a..1b19b954bbae 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1489,11 +1489,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
         wait_for_completion(&tm_iocb->u.tmf.comp);
 
-        rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ?
-            QLA_SUCCESS : QLA_FUNCTION_FAILED;
+        rval = tm_iocb->u.tmf.data;
 
-        if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) {
-                ql_dbg(ql_dbg_taskm, vha, 0x8030,
+        if (rval != QLA_SUCCESS) {
+                ql_log(ql_log_warn, vha, 0x8030,
                     "TM IOCB failed (%x).\n", rval);
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 37ae0f6d8ae5..59fd5a9dfeb8 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -222,6 +222,8 @@ qla2xxx_get_qpair_sp(struct qla_qpair *qpair, fc_port_t *fcport, gfp_t flag)
         sp->fcport = fcport;
         sp->iocbs = 1;
         sp->vha = qpair->vha;
+        INIT_LIST_HEAD(&sp->elem);
+
 done:
         if (!sp)
                 QLA_QPAIR_MARK_NOT_BUSY(qpair);
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 9fa5a2557f2c..7756106d4555 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -631,6 +631,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
         unsigned long   flags;
         fc_port_t       *fcport = NULL;
 
+        if (!vha->hw->flags.fw_started)
+                return;
+
         /* Setup to process RIO completion. */
         handle_cnt = 0;
         if (IS_CNA_CAPABLE(ha))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 7e875f575229..f0ec13d48bf3 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -4220,6 +4220,9 @@ qla25xx_init_req_que(struct scsi_qla_host *vha, struct req_que *req)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d3,
             "Entered %s.\n", __func__);
 
@@ -4289,6 +4292,9 @@ qla25xx_init_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp)
         mbx_cmd_t *mcp = &mc;
         struct qla_hw_data *ha = vha->hw;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10d6,
             "Entered %s.\n", __func__);
 
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index f6f0a759a7c2..aa727d07b702 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -152,11 +152,18 @@ int
 qla24xx_disable_vp(scsi_qla_host_t *vha)
 {
         unsigned long flags;
-        int ret;
+        int ret = QLA_SUCCESS;
+        fc_port_t *fcport;
+
+        if (vha->hw->flags.fw_started)
+                ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
 
-        ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL);
         atomic_set(&vha->loop_state, LOOP_DOWN);
         atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
+        list_for_each_entry(fcport, &vha->vp_fcports, list)
+                fcport->logout_on_delete = 0;
+
+        qla2x00_mark_all_devices_lost(vha, 0);
 
         /* Remove port id from vp target map */
         spin_lock_irqsave(&vha->hw->hardware_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 9f309e572be4..1fbd16c8c9a7 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -303,6 +303,7 @@ static void qla2x00_free_device(scsi_qla_host_t *);
 static int qla2xxx_map_queues(struct Scsi_Host *shost);
 static void qla2x00_destroy_deferred_work(struct qla_hw_data *);
 
+
 struct scsi_host_template qla2xxx_driver_template = {
         .module                 = THIS_MODULE,
         .name                   = QLA2XXX_DRIVER_NAME,
@@ -1147,7 +1148,7 @@ static inline int test_fcport_count(scsi_qla_host_t *vha)
  * qla2x00_wait_for_sess_deletion can only be called from remove_one.
  * it has dependency on UNLOADING flag to stop device discovery
  */
-static void
+void
 qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
 {
         qla2x00_mark_all_devices_lost(vha, 0);
@@ -3603,6 +3604,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         base_vha = pci_get_drvdata(pdev);
         ha = base_vha->hw;
+        ql_log(ql_log_info, base_vha, 0xb079,
+            "Removing driver\n");
 
         /* Indicate device removal to prevent future board_disable and wait
          * until any pending board_disable has completed. */
@@ -3625,6 +3628,21 @@ qla2x00_remove_one(struct pci_dev *pdev)
         }
         qla2x00_wait_for_hba_ready(base_vha);
 
+        if (IS_QLA25XX(ha) || IS_QLA2031(ha) || IS_QLA27XX(ha)) {
+                if (ha->flags.fw_started)
+                        qla2x00_abort_isp_cleanup(base_vha);
+        } else if (!IS_QLAFX00(ha)) {
+                if (IS_QLA8031(ha)) {
+                        ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
+                            "Clearing fcoe driver presence.\n");
+                        if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
+                                ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
+                                    "Error while clearing DRV-Presence.\n");
+                }
+
+                qla2x00_try_to_stop_firmware(base_vha);
+        }
+
         qla2x00_wait_for_sess_deletion(base_vha);
 
         /*
@@ -3648,14 +3666,6 @@ qla2x00_remove_one(struct pci_dev *pdev)
 
         qla2x00_delete_all_vps(ha, base_vha);
 
-        if (IS_QLA8031(ha)) {
-                ql_dbg(ql_dbg_p3p, base_vha, 0xb07e,
-                    "Clearing fcoe driver presence.\n");
-                if (qla83xx_clear_drv_presence(base_vha) != QLA_SUCCESS)
-                        ql_dbg(ql_dbg_p3p, base_vha, 0xb079,
-                            "Error while clearing DRV-Presence.\n");
-        }
-
         qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16);
 
         qla2x00_dfs_remove(base_vha);
@@ -3715,24 +3725,6 @@ qla2x00_free_device(scsi_qla_host_t *vha)
                 qla2x00_stop_timer(vha);
 
         qla25xx_delete_queues(vha);
-
-        if (ha->flags.fce_enabled)
-                qla2x00_disable_fce_trace(vha, NULL, NULL);
-
-        if (ha->eft)
-                qla2x00_disable_eft_trace(vha);
-
-        if (IS_QLA25XX(ha) ||  IS_QLA2031(ha) || IS_QLA27XX(ha)) {
-                if (ha->flags.fw_started)
-                        qla2x00_abort_isp_cleanup(vha);
-        } else {
-                if (ha->flags.fw_started) {
-                        /* Stop currently executing firmware. */
-                        qla2x00_try_to_stop_firmware(vha);
-                        ha->flags.fw_started = 0;
-                }
-        }
-
         vha->flags.online = 0;
 
         /* turn-off interrupts on the card */
@@ -6028,8 +6020,9 @@ qla2x00_do_dpc(void *data)
                                 set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
                 }
 
-                if (test_and_clear_bit(ISP_ABORT_NEEDED,
-                                                &base_vha->dpc_flags)) {
+                if (test_and_clear_bit
+                    (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+                    !test_bit(UNLOADING, &base_vha->dpc_flags)) {
 
                         ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
                             "ISP abort scheduled.\n");
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 04458eb19d38..4499c787165f 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -1880,6 +1880,9 @@ qla24xx_beacon_off(struct scsi_qla_host *vha)
         if (IS_P3P_TYPE(ha))
                 return QLA_SUCCESS;
 
+        if (!ha->flags.fw_started)
+                return QLA_SUCCESS;
+
         ha->beacon_blink_led = 0;
 
         if (IS_QLA2031(ha) || IS_QLA27XX(ha))
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 8932ae81a15a..2715cdaa669c 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -296,6 +296,20 @@ enum blk_eh_timer_return scsi_times_out(struct request *req)
                 rtn = host->hostt->eh_timed_out(scmd);
 
         if (rtn == BLK_EH_DONE) {
+                /*
+                 * For blk-mq, we must set the request state to complete now
+                 * before sending the request to the scsi error handler. This
+                 * will prevent a use-after-free in the event the LLD manages
+                 * to complete the request before the error handler finishes
+                 * processing this timed out request.
+                 *
+                 * If the request was already completed, then the LLD beat the
+                 * time out handler from transferring the request to the scsi
+                 * error handler. In that case we can return immediately as no
+                 * further action is required.
+                 */
+                if (req->q->mq_ops && !blk_mq_mark_complete(req))
+                        return rtn;
                 if (scsi_abort_command(scmd) != SUCCESS) {
                         set_host_byte(scmd, DID_TIME_OUT);
                         scsi_eh_scmd_add(scmd);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cd2fdac000c9..ba9ba0e04f42 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1741,15 +1741,11 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
          *
          * With scsi-mq enabled, there are a fixed number of preallocated
          * requests equal in number to shost->can_queue.  If all of the
-         * preallocated requests are already in use, then using GFP_ATOMIC with
-         * blk_get_request() will return -EWOULDBLOCK, whereas using GFP_KERNEL
-         * will cause blk_get_request() to sleep until an active command
-         * completes, freeing up a request.  Neither option is ideal, but
-         * GFP_KERNEL is the better choice to prevent userspace from getting an
-         * unexpected EWOULDBLOCK.
-         *
-         * With scsi-mq disabled, blk_get_request() with GFP_KERNEL usually
-         * does not sleep except under memory pressure.
+         * preallocated requests are already in use, then blk_get_request()
+         * will sleep until an active command completes, freeing up a request.
+         * Although waiting in an asynchronous interface is less than ideal, we
+         * do not want to use BLK_MQ_REQ_NOWAIT here because userspace might
+         * not expect an EWOULDBLOCK from this condition.
          */
         rq = blk_get_request(q, hp->dxfer_direction == SG_DXFER_TO_DEV ?
                         REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
@@ -2185,6 +2181,7 @@ sg_add_sfp(Sg_device * sdp)
         write_lock_irqsave(&sdp->sfd_lock, iflags);
         if (atomic_read(&sdp->detaching)) {
                 write_unlock_irqrestore(&sdp->sfd_lock, iflags);
+                kfree(sfp);
                 return ERR_PTR(-ENODEV);
         }
         list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index a1a0025b59e0..d5d33e12e952 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -402,6 +402,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
                         fput(asma->file);
                         goto out;
                 }
+        } else {
+                vma_set_anonymous(vma);
         }
 
         if (vma->vm_file)
diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
index 0ecffab52ec2..abdaf7cf8162 100644
--- a/drivers/staging/ks7010/ks_hostif.c
+++ b/drivers/staging/ks7010/ks_hostif.c
@@ -1842,15 +1842,15 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
         memset(set_address, 0, NIC_MAX_MCAST_LIST * ETH_ALEN);
 
         if (dev->flags & IFF_PROMISC) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_PROMISC);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_PROMISC);
                 goto spin_unlock;
         }
 
         if ((netdev_mc_count(dev) > NIC_MAX_MCAST_LIST) ||
             (dev->flags & IFF_ALLMULTI)) {
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCASTALL);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCASTALL);
                 goto spin_unlock;
         }
 
@@ -1866,8 +1866,8 @@ void hostif_sme_multicast_set(struct ks_wlan_private *priv)
                                                ETH_ALEN * mc_count);
         } else {
                 priv->sme_i.sme_flag |= SME_MULTICAST;
-                hostif_mib_set_request_bool(priv, LOCAL_MULTICAST_FILTER,
-                                            MCAST_FILTER_MCAST);
+                hostif_mib_set_request_int(priv, LOCAL_MULTICAST_FILTER,
+                                           MCAST_FILTER_MCAST);
         }
 
 spin_unlock:
diff --git a/drivers/staging/rtl8188eu/Kconfig b/drivers/staging/rtl8188eu/Kconfig
index 673fdce25530..ff7832798a77 100644
--- a/drivers/staging/rtl8188eu/Kconfig
+++ b/drivers/staging/rtl8188eu/Kconfig
@@ -7,7 +7,6 @@ config R8188EU
         select LIB80211
         select LIB80211_CRYPT_WEP
         select LIB80211_CRYPT_CCMP
-        select LIB80211_CRYPT_TKIP
         ---help---
         This option adds the Realtek RTL8188EU USB device such as TP-Link TL-WN725N.
         If built as a module, it will be called r8188eu.
diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
index 05936a45eb93..c6857a5be12a 100644
--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
@@ -23,7 +23,6 @@
 #include <mon.h>
 #include <wifi.h>
 #include <linux/vmalloc.h>
-#include <net/lib80211.h>
 
 #define ETHERNET_HEADER_SIZE    14      /*  Ethernet Header Length */
 #define LLC_HEADER_SIZE                 6       /*  LLC Header Length */
@@ -221,20 +220,31 @@ u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
 static int recvframe_chkmic(struct adapter *adapter,
                             struct recv_frame *precvframe)
 {
-        int res = _SUCCESS;
-        struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
-        struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta);
+        int     i, res = _SUCCESS;
+        u32     datalen;
+        u8      miccode[8];
+        u8      bmic_err = false, brpt_micerror = true;
+        u8      *pframe, *payload, *pframemic;
+        u8      *mickey;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib   *prxattrib = &precvframe->attrib;
+        struct  security_priv   *psecuritypriv = &adapter->securitypriv;
+
+        struct mlme_ext_priv    *pmlmeext = &adapter->mlmeextpriv;
+        struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
+
+        stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
 
         if (prxattrib->encrypt == _TKIP_) {
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: prxattrib->encrypt==_TKIP_\n", __func__));
+                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                         ("\n %s: da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                          __func__, prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                          prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5]));
+
+                /* calculate mic code */
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        struct sk_buff *skb = precvframe->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        void *crypto_private = NULL;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &adapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv) {
                                         res = _FAIL;
@@ -243,58 +253,115 @@ static int recvframe_chkmic(struct adapter *adapter,
                                         DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
+
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+                                         ("\n %s: bcmc key\n", __func__));
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                mickey = &stainfo->dot11tkiprxmickey.skey[0];
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n %s: unicast key\n", __func__));
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        /* icv_len included the mic code */
+                        datalen = precvframe->pkt->len-prxattrib->hdrlen -
+                                  prxattrib->iv_len-prxattrib->icv_len-8;
+                        pframe = precvframe->pkt->data;
+                        payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
-                        memmove(pframe + iv_len, pframe, prxattrib->hdrlen);
+                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
+                        rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
+                                           (unsigned char)prxattrib->priority); /* care the length of the data */
 
-                        skb_pull(skb, iv_len);
-                        skb_trim(skb, skb->len - icv_len);
+                        pframemic = payload+datalen;
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
+                        bmic_err = false;
+
+                        for (i = 0; i < 8; i++) {
+                                if (miccode[i] != *(pframemic+i)) {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("%s: miccode[%d](%02x)!=*(pframemic+%d)(%02x) ",
+                                                  __func__, i, miccode[i], i, *(pframemic + i)));
+                                        bmic_err = true;
+                                }
                         }
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        if (bmic_err) {
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-8), *(pframemic-7), *(pframemic-6),
+                                         *(pframemic-5), *(pframemic-4), *(pframemic-3),
+                                         *(pframemic-2), *(pframemic-1)));
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+                                         *(pframemic-16), *(pframemic-15), *(pframemic-14),
+                                         *(pframemic-13), *(pframemic-12), *(pframemic-11),
+                                         *(pframemic-10), *(pframemic-9)));
+                                {
+                                        uint i;
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                                 ("\n ======demp packet (len=%d)======\n",
+                                                 precvframe->pkt->len));
+                                        for (i = 0; i < precvframe->pkt->len; i += 8) {
+                                                RT_TRACE(_module_rtl871x_recv_c_,
+                                                         _drv_err_,
+                                                         ("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
+                                                         *(precvframe->pkt->data+i),
+                                                         *(precvframe->pkt->data+i+1),
+                                                         *(precvframe->pkt->data+i+2),
+                                                         *(precvframe->pkt->data+i+3),
+                                                         *(precvframe->pkt->data+i+4),
+                                                         *(precvframe->pkt->data+i+5),
+                                                         *(precvframe->pkt->data+i+6),
+                                                         *(precvframe->pkt->data+i+7)));
+                                        }
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n ====== demp packet end [len=%d]======\n",
+                                                 precvframe->pkt->len));
+                                        RT_TRACE(_module_rtl871x_recv_c_,
+                                                 _drv_err_,
+                                                 ("\n hrdlen=%d,\n",
+                                                 prxattrib->hdrlen));
+                                }
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
+                                         ("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
+                                         prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
+                                         prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey));
+
+                                /*  double check key_index for some timing issue , */
+                                /*  cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */
+                                if ((IS_MCAST(prxattrib->ra) == true)  && (prxattrib->key_index != pmlmeinfo->key_index))
+                                        brpt_micerror = false;
+
+                                if ((prxattrib->bdecrypted) && (brpt_micerror)) {
+                                        rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra));
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                } else {
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
+                                        DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
+                                }
+                                res = _FAIL;
+                        } else {
+                                /* mic checked ok */
+                                if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) {
+                                        psecuritypriv->bcheck_grpkey = true;
+                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true"));
+                                }
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
                                  ("%s: rtw_get_stainfo==NULL!!!\n", __func__));
                 }
+
+                skb_trim(precvframe->pkt, precvframe->pkt->len - 8);
         }
 
 exit:
+
         return res;
 }
 
diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
index bfe0b217e679..67a2490f055e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_security.c
+++ b/drivers/staging/rtl8188eu/core/rtw_security.c
@@ -650,71 +650,71 @@ u32	rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
         return res;
 }
 
+/* The hlen isn't include the IV */
 u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
-{
-        struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib;
-        u32 res = _SUCCESS;
+{                                                                                                                                       /*  exclude ICV */
+        u16 pnl;
+        u32 pnh;
+        u8   rc4key[16];
+        u8   ttkey[16];
+        u8      crc[4];
+        struct arc4context mycontext;
+        int                     length;
+
+        u8      *pframe, *payload, *iv, *prwskey;
+        union pn48 dot11txpn;
+        struct  sta_info                *stainfo;
+        struct  rx_pkt_attrib    *prxattrib = &((struct recv_frame *)precvframe)->attrib;
+        struct  security_priv   *psecuritypriv = &padapter->securitypriv;
+        u32             res = _SUCCESS;
+
+
+        pframe = (unsigned char *)((struct recv_frame *)precvframe)->pkt->data;
 
         /* 4 start to decrypt recvframe */
         if (prxattrib->encrypt == _TKIP_) {
-                struct sta_info *stainfo = rtw_get_stainfo(&padapter->stapriv, prxattrib->ta);
-
+                stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]);
                 if (stainfo) {
-                        int key_idx;
-                        const int iv_len = 8, icv_len = 4, key_length = 32;
-                        void *crypto_private = NULL;
-                        struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
-                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
-                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
-                        struct security_priv *psecuritypriv = &padapter->securitypriv;
-
                         if (IS_MCAST(prxattrib->ra)) {
                                 if (!psecuritypriv->binstallGrpkey) {
                                         res = _FAIL;
                                         DBG_88E("%s:rx bc/mc packets, but didn't install group key!!!!!!!!!!\n", __func__);
                                         goto exit;
                                 }
-                                key_idx = prxattrib->key_index;
-                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
-                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
+                                prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
                         } else {
-                                key_idx = 0;
-                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
-                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("%s: stainfo!= NULL!!!\n", __func__));
+                                prwskey = &stainfo->dot118021x_UncstKey.skey[0];
                         }
 
-                        if (!crypto_ops) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        iv = pframe+prxattrib->hdrlen;
+                        payload = pframe+prxattrib->iv_len+prxattrib->hdrlen;
+                        length = ((struct recv_frame *)precvframe)->pkt->len-prxattrib->hdrlen-prxattrib->iv_len;
 
-                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
-                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
+                        GET_TKIP_PN(iv, dot11txpn);
 
-                        crypto_private = crypto_ops->init(key_idx);
-                        if (!crypto_private) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
-                        if (crypto_ops->decrypt_mpdu(skb, prxattrib->hdrlen, crypto_private)) {
-                                res = _FAIL;
-                                goto exit_lib80211_tkip;
-                        }
+                        pnl = (u16)(dot11txpn.val);
+                        pnh = (u32)(dot11txpn.val>>16);
 
-                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
-                        skb_push(skb, iv_len);
-                        skb_put(skb, icv_len);
+                        phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], pnh);
+                        phase2(&rc4key[0], prwskey, (unsigned short *)&ttkey[0], pnl);
 
-                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
-                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
+                        /* 4 decrypt payload include icv */
 
-exit_lib80211_tkip:
-                        if (crypto_ops && crypto_private)
-                                crypto_ops->deinit(crypto_private);
+                        arcfour_init(&mycontext, rc4key, 16);
+                        arcfour_encrypt(&mycontext, payload, payload, length);
+
+                        *((__le32 *)crc) = getcrc32(payload, length-4);
+
+                        if (crc[3] != payload[length-1] ||
+                            crc[2] != payload[length-2] ||
+                            crc[1] != payload[length-3] ||
+                            crc[0] != payload[length-4]) {
+                                RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+                                         ("rtw_wep_decrypt:icv error crc (%4ph)!=payload (%4ph)\n",
+                                         &crc, &payload[length-4]));
+                                res = _FAIL;
+                        }
                 } else {
                         RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
                         res = _FAIL;
diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
index a61bc41b82d7..947c79532e10 100644
--- a/drivers/staging/speakup/speakup_soft.c
+++ b/drivers/staging/speakup/speakup_soft.c
@@ -198,11 +198,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         int chars_sent = 0;
         char __user *cp;
         char *init;
+        size_t bytes_per_ch = unicode ? 3 : 1;
         u16 ch;
         int empty;
         unsigned long flags;
         DEFINE_WAIT(wait);
 
+        if (count < bytes_per_ch)
+                return -EINVAL;
+
         spin_lock_irqsave(&speakup_info.spinlock, flags);
         while (1) {
                 prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
@@ -228,7 +232,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
         init = get_initstring();
 
         /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
-        while (chars_sent <= count - 3) {
+        while (chars_sent <= count - bytes_per_ch) {
                 if (speakup_info.flushing) {
                         speakup_info.flushing = 0;
                         ch = '\x18';
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index 514986b57c2d..25eb3891e34b 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -652,6 +652,7 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         struct iscsi_param *param;
         u32 mrdsl, mbl;
         u32 max_npdu, max_iso_npdu;
+        u32 max_iso_payload;
 
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(MAXBURSTLENGTH,
@@ -670,8 +671,10 @@ static int cxgbit_set_iso_npdu(struct cxgbit_sock *csk)
         mrdsl = conn_ops->MaxRecvDataSegmentLength;
         max_npdu = mbl / mrdsl;
 
-        max_iso_npdu = CXGBIT_MAX_ISO_PAYLOAD /
-                        (ISCSI_HDR_LEN + mrdsl +
+        max_iso_payload = rounddown(CXGBIT_MAX_ISO_PAYLOAD, csk->emss);
+
+        max_iso_npdu = max_iso_payload /
+                       (ISCSI_HDR_LEN + mrdsl +
                         cxgbit_digest_len[csk->submode]);
 
         csk->max_iso_npdu = min(max_npdu, max_iso_npdu);
@@ -741,6 +744,9 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
         if (conn_ops->MaxRecvDataSegmentLength > cdev->mdsl)
                 conn_ops->MaxRecvDataSegmentLength = cdev->mdsl;
 
+        if (cxgbit_set_digest(csk))
+                return -1;
+
         if (conn->login->leading_connection) {
                 param = iscsi_find_param_from_key(ERRORRECOVERYLEVEL,
                                                   conn->param_list);
@@ -764,7 +770,7 @@ static int cxgbit_set_params(struct iscsi_conn *conn)
                         if (is_t5(cdev->lldi.adapter_type))
                                 goto enable_ddp;
                         else
-                                goto enable_digest;
+                                return 0;
                 }
 
                 if (test_bit(CDEV_ISO_ENABLE, &cdev->flags)) {
@@ -781,10 +787,6 @@ enable_ddp:
                 }
         }
 
-enable_digest:
-        if (cxgbit_set_digest(csk))
-                return -1;
-
         return 0;
 }
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 785f0ed037f7..ee34e9046f7e 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -3,6 +3,7 @@ config USB_CHIPIDEA
         depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
         select EXTCON
         select RESET_CONTROLLER
+        select USB_ULPI_BUS
         help
           Say Y here if your system has a dual role high speed USB
           controller based on ChipIdea silicon IP. It supports:
@@ -38,12 +39,4 @@ config USB_CHIPIDEA_HOST
         help
           Say Y here to enable host controller functionality of the
           ChipIdea driver.
-
-config USB_CHIPIDEA_ULPI
-        bool "ChipIdea ULPI PHY support"
-        depends on USB_ULPI_BUS=y || USB_ULPI_BUS=USB_CHIPIDEA
-        help
-          Say Y here if you have a ULPI PHY attached to your ChipIdea
-          controller.
-
 endif
diff --git a/drivers/usb/chipidea/Makefile b/drivers/usb/chipidea/Makefile
index e3d5e728fa53..12df94f78f72 100644
--- a/drivers/usb/chipidea/Makefile
+++ b/drivers/usb/chipidea/Makefile
@@ -1,11 +1,10 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_USB_CHIPIDEA)              += ci_hdrc.o
 
-ci_hdrc-y                               := core.o otg.o debug.o
+ci_hdrc-y                               := core.o otg.o debug.o ulpi.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_UDC)      += udc.o
 ci_hdrc-$(CONFIG_USB_CHIPIDEA_HOST)     += host.o
 ci_hdrc-$(CONFIG_USB_OTG_FSM)           += otg_fsm.o
-ci_hdrc-$(CONFIG_USB_CHIPIDEA_ULPI)     += ulpi.o
 
 # Glue/Bridge layers go here
 
diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
index 0bf244d50544..6a2cc5cd0281 100644
--- a/drivers/usb/chipidea/ci.h
+++ b/drivers/usb/chipidea/ci.h
@@ -240,10 +240,8 @@ struct ci_hdrc {
 
         struct ci_hdrc_platform_data    *platdata;
         int                             vbus_active;
-#ifdef CONFIG_USB_CHIPIDEA_ULPI
         struct ulpi                     *ulpi;
         struct ulpi_ops                 ulpi_ops;
-#endif
         struct phy                      *phy;
         /* old usb_phy interface */
         struct usb_phy                  *usb_phy;
@@ -426,15 +424,9 @@ static inline bool ci_otg_is_fsm_mode(struct ci_hdrc *ci)
 #endif
 }
 
-#if IS_ENABLED(CONFIG_USB_CHIPIDEA_ULPI)
 int ci_ulpi_init(struct ci_hdrc *ci);
 void ci_ulpi_exit(struct ci_hdrc *ci);
 int ci_ulpi_resume(struct ci_hdrc *ci);
-#else
-static inline int ci_ulpi_init(struct ci_hdrc *ci) { return 0; }
-static inline void ci_ulpi_exit(struct ci_hdrc *ci) { }
-static inline int ci_ulpi_resume(struct ci_hdrc *ci) { return 0; }
-#endif
 
 u32 hw_read_intr_enable(struct ci_hdrc *ci);
 
diff --git a/drivers/usb/chipidea/ulpi.c b/drivers/usb/chipidea/ulpi.c
index 6da42dcd2888..dfec07e8ae1d 100644
--- a/drivers/usb/chipidea/ulpi.c
+++ b/drivers/usb/chipidea/ulpi.c
@@ -95,6 +95,9 @@ int ci_ulpi_resume(struct ci_hdrc *ci)
 {
         int cnt = 100000;
 
+        if (ci->platdata->phy_mode != USBPHY_INTERFACE_MODE_ULPI)
+                return 0;
+
         while (cnt-- > 0) {
                 if (hw_read(ci, OP_ULPI_VIEWPORT, ULPI_SYNC_STATE))
                         return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 998b32d0167e..75c4623ad779 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1831,6 +1831,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
         .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
         },
+        { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
 
         { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
         .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index fcae521df29b..1fb266809966 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1142,10 +1142,14 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
                 if (!udev || udev->state == USB_STATE_NOTATTACHED) {
                         /* Tell hub_wq to disconnect the device or
-                         * check for a new connection
+                         * check for a new connection or over current condition.
+                         * Based on USB2.0 Spec Section 11.12.5,
+                         * C_PORT_OVER_CURRENT could be set while
+                         * PORT_OVER_CURRENT is not. So check for any of them.
                          */
                         if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
-                            (portstatus & USB_PORT_STAT_OVERCURRENT))
+                            (portstatus & USB_PORT_STAT_OVERCURRENT) ||
+                            (portchange & USB_PORT_STAT_C_OVERCURRENT))
                                 set_bit(port1, hub->change_bits);
 
                 } else if (portstatus & USB_PORT_STAT_ENABLE) {
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index a0f82cca2d9a..cefc99ae69b2 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3430,7 +3430,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_in[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DIEPCTL(idx));
@@ -3476,7 +3476,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
         for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                 hs_ep = hsotg->eps_out[idx];
                 /* Proceed only unmasked ISOC EPs */
-                if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                         continue;
 
                 epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
@@ -3650,7 +3650,7 @@ irq_retry:
                 for (idx = 1; idx < hsotg->num_of_eps; idx++) {
                         hs_ep = hsotg->eps_out[idx];
                         /* Proceed only unmasked ISOC EPs */
-                        if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
+                        if ((BIT(idx) & ~daintmsk) || !hs_ep->isochronous)
                                 continue;
 
                         epctrl = dwc2_readl(hsotg->regs + DOEPCTL(idx));
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index b1104be3429c..6e2cdd7b93d4 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -2665,34 +2665,35 @@ static int dwc2_alloc_split_dma_aligned_buf(struct dwc2_hsotg *hsotg,
 
 #define DWC2_USB_DMA_ALIGN 4
 
-struct dma_aligned_buffer {
-        void *kmalloc_ptr;
-        void *old_xfer_buffer;
-        u8 data[0];
-};
-
 static void dwc2_free_dma_aligned_buffer(struct urb *urb)
 {
-        struct dma_aligned_buffer *temp;
+        void *stored_xfer_buffer;
+        size_t length;
 
         if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
                 return;
 
-        temp = container_of(urb->transfer_buffer,
-                            struct dma_aligned_buffer, data);
+        /* Restore urb->transfer_buffer from the end of the allocated area */
+        memcpy(&stored_xfer_buffer, urb->transfer_buffer +
+               urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
 
-        if (usb_urb_dir_in(urb))
-                memcpy(temp->old_xfer_buffer, temp->data,
-                       urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->old_xfer_buffer;
-        kfree(temp->kmalloc_ptr);
+        if (usb_urb_dir_in(urb)) {
+                if (usb_pipeisoc(urb->pipe))
+                        length = urb->transfer_buffer_length;
+                else
+                        length = urb->actual_length;
+
+                memcpy(stored_xfer_buffer, urb->transfer_buffer, length);
+        }
+        kfree(urb->transfer_buffer);
+        urb->transfer_buffer = stored_xfer_buffer;
 
         urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
 }
 
 static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
 {
-        struct dma_aligned_buffer *temp, *kmalloc_ptr;
+        void *kmalloc_ptr;
         size_t kmalloc_size;
 
         if (urb->num_sgs || urb->sg ||
@@ -2700,22 +2701,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
             !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
                 return 0;
 
-        /* Allocate a buffer with enough padding for alignment */
+        /*
+         * Allocate a buffer with enough padding for original transfer_buffer
+         * pointer. This allocation is guaranteed to be aligned properly for
+         * DMA
+         */
         kmalloc_size = urb->transfer_buffer_length +
-                sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
+                sizeof(urb->transfer_buffer);
 
         kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
         if (!kmalloc_ptr)
                 return -ENOMEM;
 
-        /* Position our struct dma_aligned_buffer such that data is aligned */
-        temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
-        temp->kmalloc_ptr = kmalloc_ptr;
-        temp->old_xfer_buffer = urb->transfer_buffer;
+        /*
+         * Position value of original urb->transfer_buffer pointer to the end
+         * of allocation for later referencing
+         */
+        memcpy(kmalloc_ptr + urb->transfer_buffer_length,
+               &urb->transfer_buffer, sizeof(urb->transfer_buffer));
+
         if (usb_urb_dir_out(urb))
-                memcpy(temp->data, urb->transfer_buffer,
+                memcpy(kmalloc_ptr, urb->transfer_buffer,
                        urb->transfer_buffer_length);
-        urb->transfer_buffer = temp->data;
+        urb->transfer_buffer = kmalloc_ptr;
 
         urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
 
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index ed7f05cf4906..8ce10caf3e19 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1231,7 +1231,10 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
          * avoid interrupt storms we'll wait before retrying if we've got
          * several NAKs. If we didn't do this we'd retry directly from the
          * interrupt handler and could end up quickly getting another
-         * interrupt (another NAK), which we'd retry.
+         * interrupt (another NAK), which we'd retry. Note that we do not
+         * delay retries for IN parts of control requests, as those are expected
+         * to complete fairly quickly, and if we delay them we risk confusing
+         * the device and cause it issue STALL.
          *
          * Note that in DMA mode software only gets involved to re-send NAKed
          * transfers for split transactions, so we only need to apply this
@@ -1244,7 +1247,9 @@ static void dwc2_hc_nak_intr(struct dwc2_hsotg *hsotg,
                         qtd->error_count = 0;
                 qtd->complete_split = 0;
                 qtd->num_naks++;
-                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY;
+                qtd->qh->want_wait = qtd->num_naks >= DWC2_NAKS_BEFORE_DELAY &&
+                                !(chan->ep_type == USB_ENDPOINT_XFER_CONTROL &&
+                                  chan->ep_is_in);
                 dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_NAK);
                 goto handle_nak_done;
         }
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index c77ff50a88a2..8efde178eef4 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -973,15 +973,12 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 ret = dwc3_ep0_start_trans(dep);
         } else if (IS_ALIGNED(req->request.length, dep->endpoint.maxpacket) &&
                    req->request.length && req->request.zero) {
-                u32     maxpacket;
 
                 ret = usb_gadget_map_request_by_dev(dwc->sysdev,
                                 &req->request, dep->number);
                 if (ret)
                         return;
 
-                maxpacket = dep->endpoint.maxpacket;
-
                 /* prepare normal TRB */
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                          req->request.length,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d2fa071c21b1..b8a15840b4ff 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1819,7 +1819,6 @@ unknown:
                 if (cdev->use_os_string && cdev->os_desc_config &&
                     (ctrl->bRequestType & USB_TYPE_VENDOR) &&
                     ctrl->bRequest == cdev->b_vendor_code) {
-                        struct usb_request              *req;
                         struct usb_configuration        *os_desc_cfg;
                         u8                              *buf;
                         int                             interface;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 33e2030503fa..3ada83d81bda 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3263,7 +3263,7 @@ static int ffs_func_setup(struct usb_function *f,
         __ffs_event_add(ffs, FUNCTIONFS_SETUP);
         spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
 
-        return USB_GADGET_DELAYED_STATUS;
+        return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
 }
 
 static bool ffs_func_req_match(struct usb_function *f,
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index d2dc1f00180b..d582921f7257 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -438,14 +438,14 @@ static struct usb_descriptor_header *hs_audio_desc[] = {
 };
 
 struct cntrl_cur_lay3 {
-        __u32   dCUR;
+        __le32  dCUR;
 };
 
 struct cntrl_range_lay3 {
-        __u16   wNumSubRanges;
-        __u32   dMIN;
-        __u32   dMAX;
-        __u32   dRES;
+        __le16  wNumSubRanges;
+        __le32  dMIN;
+        __le32  dMAX;
+        __le32  dRES;
 } __packed;
 
 static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
@@ -559,13 +559,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
         if (!agdev->out_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc);
         if (!agdev->in_ep) {
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
-                return ret;
+                return -ENODEV;
         }
 
         agdev->in_ep_maxpsize = max_t(u16,
@@ -703,9 +703,9 @@ in_rq_cur(struct usb_function *fn, const struct usb_ctrlrequest *cr)
                 memset(&c, 0, sizeof(struct cntrl_cur_lay3));
 
                 if (entity_id == USB_IN_CLK_ID)
-                        c.dCUR = p_srate;
+                        c.dCUR = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        c.dCUR = c_srate;
+                        c.dCUR = cpu_to_le32(c_srate);
 
                 value = min_t(unsigned, w_length, sizeof c);
                 memcpy(req->buf, &c, value);
@@ -742,15 +742,15 @@ in_rq_range(struct usb_function *fn, const struct usb_ctrlrequest *cr)
 
         if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) {
                 if (entity_id == USB_IN_CLK_ID)
-                        r.dMIN = p_srate;
+                        r.dMIN = cpu_to_le32(p_srate);
                 else if (entity_id == USB_OUT_CLK_ID)
-                        r.dMIN = c_srate;
+                        r.dMIN = cpu_to_le32(c_srate);
                 else
                         return -EOPNOTSUPP;
 
                 r.dMAX = r.dMIN;
                 r.dRES = 0;
-                r.wNumSubRanges = 1;
+                r.wNumSubRanges = cpu_to_le16(1);
 
                 value = min_t(unsigned, w_length, sizeof r);
                 memcpy(req->buf, &r, value);
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index a72295c953bb..fb5ed97572e5 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -32,9 +32,6 @@ struct uac_req {
 struct uac_rtd_params {
         struct snd_uac_chip *uac; /* parent chip */
         bool ep_enabled; /* if the ep is enabled */
-        /* Size of the ring buffer */
-        size_t dma_bytes;
-        unsigned char *dma_area;
 
         struct snd_pcm_substream *ss;
 
@@ -43,8 +40,6 @@ struct uac_rtd_params {
 
         void *rbuf;
 
-        size_t period_size;
-
         unsigned max_psize;     /* MaxPacketSize of endpoint */
         struct uac_req *ureq;
 
@@ -84,12 +79,12 @@ static const struct snd_pcm_hardware uac_pcm_hardware = {
 static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 {
         unsigned pending;
-        unsigned long flags;
+        unsigned long flags, flags2;
         unsigned int hw_ptr;
-        bool update_alsa = false;
         int status = req->status;
         struct uac_req *ur = req->context;
         struct snd_pcm_substream *substream;
+        struct snd_pcm_runtime *runtime;
         struct uac_rtd_params *prm = ur->pp;
         struct snd_uac_chip *uac = prm->uac;
 
@@ -111,6 +106,14 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
         if (!substream)
                 goto exit;
 
+        snd_pcm_stream_lock_irqsave(substream, flags2);
+
+        runtime = substream->runtime;
+        if (!runtime || !snd_pcm_running(substream)) {
+                snd_pcm_stream_unlock_irqrestore(substream, flags2);
+                goto exit;
+        }
+
         spin_lock_irqsave(&prm->lock, flags);
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
@@ -137,43 +140,46 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
                 req->actual = req->length;
         }
 
-        pending = prm->hw_ptr % prm->period_size;
-        pending += req->actual;
-        if (pending >= prm->period_size)
-                update_alsa = true;
-
         hw_ptr = prm->hw_ptr;
-        prm->hw_ptr = (prm->hw_ptr + req->actual) % prm->dma_bytes;
 
         spin_unlock_irqrestore(&prm->lock, flags);
 
         /* Pack USB load in ALSA ring buffer */
-        pending = prm->dma_bytes - hw_ptr;
+        pending = runtime->dma_bytes - hw_ptr;
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, pending);
-                        memcpy(req->buf + pending, prm->dma_area,
+                        memcpy(req->buf, runtime->dma_area + hw_ptr, pending);
+                        memcpy(req->buf + pending, runtime->dma_area,
                                req->actual - pending);
                 } else {
-                        memcpy(req->buf, prm->dma_area + hw_ptr, req->actual);
+                        memcpy(req->buf, runtime->dma_area + hw_ptr,
+                               req->actual);
                 }
         } else {
                 if (unlikely(pending < req->actual)) {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, pending);
-                        memcpy(prm->dma_area, req->buf + pending,
+                        memcpy(runtime->dma_area + hw_ptr, req->buf, pending);
+                        memcpy(runtime->dma_area, req->buf + pending,
                                req->actual - pending);
                 } else {
-                        memcpy(prm->dma_area + hw_ptr, req->buf, req->actual);
+                        memcpy(runtime->dma_area + hw_ptr, req->buf,
+                               req->actual);
                 }
         }
 
+        spin_lock_irqsave(&prm->lock, flags);
+        /* update hw_ptr after data is copied to memory */
+        prm->hw_ptr = (hw_ptr + req->actual) % runtime->dma_bytes;
+        hw_ptr = prm->hw_ptr;
+        spin_unlock_irqrestore(&prm->lock, flags);
+        snd_pcm_stream_unlock_irqrestore(substream, flags2);
+
+        if ((hw_ptr % snd_pcm_lib_period_bytes(substream)) < req->actual)
+                snd_pcm_period_elapsed(substream);
+
 exit:
         if (usb_ep_queue(ep, req, GFP_ATOMIC))
                 dev_err(uac->card->dev, "%d Error!\n", __LINE__);
-
-        if (update_alsa)
-                snd_pcm_period_elapsed(substream);
 }
 
 static int uac_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
@@ -236,40 +242,12 @@ static snd_pcm_uframes_t uac_pcm_pointer(struct snd_pcm_substream *substream)
 static int uac_pcm_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *hw_params)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-        int err;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        err = snd_pcm_lib_malloc_pages(substream,
+        return snd_pcm_lib_malloc_pages(substream,
                                         params_buffer_bytes(hw_params));
-        if (err >= 0) {
-                prm->dma_bytes = substream->runtime->dma_bytes;
-                prm->dma_area = substream->runtime->dma_area;
-                prm->period_size = params_period_bytes(hw_params);
-        }
-
-        return err;
 }
 
 static int uac_pcm_hw_free(struct snd_pcm_substream *substream)
 {
-        struct snd_uac_chip *uac = snd_pcm_substream_chip(substream);
-        struct uac_rtd_params *prm;
-
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                prm = &uac->p_prm;
-        else
-                prm = &uac->c_prm;
-
-        prm->dma_area = NULL;
-        prm->dma_bytes = 0;
-        prm->period_size = 0;
-
         return snd_pcm_lib_free_pages(substream);
 }
 
@@ -595,15 +573,15 @@ int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
         if (err < 0)
                 goto snd_fail;
 
-        strcpy(pcm->name, pcm_name);
+        strlcpy(pcm->name, pcm_name, sizeof(pcm->name));
         pcm->private_data = uac;
         uac->pcm = pcm;
 
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &uac_pcm_ops);
         snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &uac_pcm_ops);
 
-        strcpy(card->driver, card_name);
-        strcpy(card->shortname, card_name);
+        strlcpy(card->driver, card_name, sizeof(card->driver));
+        strlcpy(card->shortname, card_name, sizeof(card->shortname));
         sprintf(card->longname, "%s %i", card_name, card->dev->id);
 
         snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_CONTINUOUS,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
index 20ffb03ff6ac..e2927fb083cf 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
@@ -108,6 +108,13 @@ void ast_vhub_ep0_handle_setup(struct ast_vhub_ep *ep)
         /* Check our state, cancel pending requests if needed */
         if (ep->ep0.state != ep0_state_token) {
                 EPDBG(ep, "wrong state\n");
+                ast_vhub_nuke(ep, -EIO);
+
+                /*
+                 * Accept the packet regardless, this seems to happen
+                 * when stalling a SETUP packet that has an OUT data
+                 * phase.
+                 */
                 ast_vhub_nuke(ep, 0);
                 goto stall;
         }
@@ -212,6 +219,8 @@ static void ast_vhub_ep0_do_send(struct ast_vhub_ep *ep,
         if (chunk && req->req.buf)
                 memcpy(ep->buf, req->req.buf + req->req.actual, chunk);
 
+        vhub_dma_workaround(ep->buf);
+
         /* Remember chunk size and trigger send */
         reg = VHUB_EP0_SET_TX_LEN(chunk);
         writel(reg, ep->ep0.ctlstat);
@@ -224,7 +233,7 @@ static void ast_vhub_ep0_rx_prime(struct ast_vhub_ep *ep)
         EPVDBG(ep, "rx prime\n");
 
         /* Prime endpoint for receiving data */
-        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat + AST_VHUB_EP0_CTRL);
+        writel(VHUB_EP0_RX_BUFF_RDY, ep->ep0.ctlstat);
 }
 
 static void ast_vhub_ep0_do_receive(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
index 80c9feac5147..5939eb1e97f2 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
@@ -66,11 +66,16 @@ static void ast_vhub_epn_kick(struct ast_vhub_ep *ep, struct ast_vhub_req *req)
         if (!req->req.dma) {
 
                 /* For IN transfers, copy data over first */
-                if (ep->epn.is_in)
+                if (ep->epn.is_in) {
                         memcpy(ep->buf, req->req.buf + act, chunk);
+                        vhub_dma_workaround(ep->buf);
+                }
                 writel(ep->buf_dma, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
-        } else
+        } else {
+                if (ep->epn.is_in)
+                        vhub_dma_workaround(req->req.buf);
                 writel(req->req.dma + act, ep->epn.regs + AST_VHUB_EP_DESC_BASE);
+        }
 
         /* Start DMA */
         req->active = true;
@@ -161,6 +166,7 @@ static inline unsigned int ast_vhub_count_free_descs(struct ast_vhub_ep *ep)
 static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                                    struct ast_vhub_req *req)
 {
+        struct ast_vhub_desc *desc = NULL;
         unsigned int act = req->act_count;
         unsigned int len = req->req.length;
         unsigned int chunk;
@@ -177,7 +183,6 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
 
         /* While we can create descriptors */
         while (ast_vhub_count_free_descs(ep) && req->last_desc < 0) {
-                struct ast_vhub_desc *desc;
                 unsigned int d_num;
 
                 /* Grab next free descriptor */
@@ -227,6 +232,9 @@ static void ast_vhub_epn_kick_desc(struct ast_vhub_ep *ep,
                 req->act_count = act = act + chunk;
         }
 
+        if (likely(desc))
+                vhub_dma_workaround(desc);
+
         /* Tell HW about new descriptors */
         writel(VHUB_EP_DMA_SET_CPU_WPTR(ep->epn.d_next),
                ep->epn.regs + AST_VHUB_EP_DESC_STATUS);
diff --git a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
index 2b040257bc1f..4ed03d33a5a9 100644
--- a/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
+++ b/drivers/usb/gadget/udc/aspeed-vhub/vhub.h
@@ -462,6 +462,39 @@ enum std_req_rc {
 #define DDBG(d, fmt, ...)       do { } while(0)
 #endif
 
+static inline void vhub_dma_workaround(void *addr)
+{
+        /*
+         * This works around a confirmed HW issue with the Aspeed chip.
+         *
+         * The core uses a different bus to memory than the AHB going to
+         * the USB device controller. Due to the latter having a higher
+         * priority than the core for arbitration on that bus, it's
+         * possible for an MMIO to the device, followed by a DMA by the
+         * device from memory to all be performed and services before
+         * a previous store to memory gets completed.
+         *
+         * This the following scenario can happen:
+         *
+         *    - Driver writes to a DMA descriptor (Mbus)
+         *    - Driver writes to the MMIO register to start the DMA (AHB)
+         *    - The gadget sees the second write and sends a read of the
+         *      descriptor to the memory controller (Mbus)
+         *    - The gadget hits memory before the descriptor write
+         *      causing it to read an obsolete value.
+         *
+         * Thankfully the problem is limited to the USB gadget device, other
+         * masters in the SoC all have a lower priority than the core, thus
+         * ensuring that the store by the core arrives first.
+         *
+         * The workaround consists of using a dummy read of the memory before
+         * doing the MMIO writes. This will ensure that the previous writes
+         * have been "pushed out".
+         */
+        mb();
+        (void)__raw_readl((void __iomem *)addr);
+}
+
 /* core.c */
 void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
                    int status);
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index a3ecce62662b..11e25a3f4f1f 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -832,11 +832,11 @@ static void init_controller(struct r8a66597 *r8a66597)
 
                 r8a66597_bset(r8a66597, XCKE, SYSCFG0);
 
-                msleep(3);
+                mdelay(3);
 
                 r8a66597_bset(r8a66597, PLLC, SYSCFG0);
 
-                msleep(1);
+                mdelay(1);
 
                 r8a66597_bset(r8a66597, SCKE, SYSCFG0);
 
@@ -1190,7 +1190,7 @@ __acquires(r8a66597->lock)
         r8a66597->ep0_req->length = 2;
         /* AV: what happens if we get called again before that gets through? */
         spin_unlock(&r8a66597->lock);
-        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
+        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
         spin_lock(&r8a66597->lock);
 }
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2f4850f25e82..68e6132aa8b2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3051,6 +3051,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
         if (!list_empty(&ep->ring->td_list)) {
                 dev_err(&udev->dev, "EP not empty, refuse reset\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
+                xhci_free_command(xhci, cfg_cmd);
                 goto cleanup;
         }
         xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0);
diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index 900875f326d7..f7c96d209eda 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -861,6 +861,7 @@ int usb_otg_start(struct platform_device *pdev)
         if (pdata->init && pdata->init(pdev) != 0)
                 return -EINVAL;
 
+#ifdef CONFIG_PPC32
         if (pdata->big_endian_mmio) {
                 _fsl_readl = _fsl_readl_be;
                 _fsl_writel = _fsl_writel_be;
@@ -868,6 +869,7 @@ int usb_otg_start(struct platform_device *pdev)
                 _fsl_readl = _fsl_readl_le;
                 _fsl_writel = _fsl_writel_le;
         }
+#endif
 
         /* request irq */
         p_otg->irq = platform_get_irq(pdev, 0);
@@ -958,7 +960,7 @@ int usb_otg_start(struct platform_device *pdev)
 /*
  * state file in sysfs
  */
-static int show_fsl_usb2_otg_state(struct device *dev,
+static ssize_t show_fsl_usb2_otg_state(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
         struct otg_fsm *fsm = &fsl_otg_dev->fsm;
diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
index 150f43668bec..d1d20252bad8 100644
--- a/drivers/usb/typec/tcpm.c
+++ b/drivers/usb/typec/tcpm.c
@@ -2140,7 +2140,7 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
                          * PPS APDO. Again skip the first sink PDO as this will
                          * always be 5V 3A.
                          */
-                        for (j = i; j < port->nr_snk_pdo; j++) {
+                        for (j = 1; j < port->nr_snk_pdo; j++) {
                                 pdo = port->snk_pdo[j];
 
                                 switch (pdo_type(pdo)) {
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 6b237e3f4983..3988c0914322 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -513,7 +513,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info,
         tell_host(vb, vb->inflate_vq);
 
         /* balloon's page migration 2nd step -- deflate "page" */
+        spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
         balloon_page_delete(page);
+        spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags);
         vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE;
         set_page_pfns(vb, vb->pfns, page);
         tell_host(vb, vb->deflate_vq);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0dd87aaeb39a..aba25414231a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -221,7 +221,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
 
         ret = bio_iov_iter_get_pages(&bio, iter);
         if (unlikely(ret))
-                return ret;
+                goto out;
         ret = bio.bi_iter.bi_size;
 
         if (iov_iter_rw(iter) == READ) {
@@ -250,12 +250,13 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
                 put_page(bvec->bv_page);
         }
 
-        if (vecs != inline_vecs)
-                kfree(vecs);
-
         if (unlikely(bio.bi_status))
                 ret = blk_status_to_errno(bio.bi_status);
 
+out:
+        if (vecs != inline_vecs)
+                kfree(vecs);
+
         bio_uninit(&bio);
 
         return ret;
diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
index d9f001078e08..4a717d400807 100644
--- a/fs/cachefiles/bind.c
+++ b/fs/cachefiles/bind.c
@@ -218,7 +218,8 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache)
                            "%s",
                            fsdef->dentry->d_sb->s_id);
 
-        fscache_object_init(&fsdef->fscache, NULL, &cache->cache);
+        fscache_object_init(&fsdef->fscache, &fscache_fsdef_index,
+                            &cache->cache);
 
         ret = fscache_add_cache(&cache->cache, &fsdef->fscache, cache->tag);
         if (ret < 0)
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index ab0bbe93b398..af2b17b21b94 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -186,12 +186,12 @@ try_again:
          * need to wait for it to be destroyed */
 wait_for_old_object:
         trace_cachefiles_wait_active(object, dentry, xobject);
+        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
 
         if (fscache_object_is_live(&xobject->fscache)) {
                 pr_err("\n");
                 pr_err("Error: Unexpected object collision\n");
                 cachefiles_printk_object(object, xobject);
-                BUG();
         }
         atomic_inc(&xobject->usage);
         write_unlock(&cache->active_lock);
@@ -248,7 +248,6 @@ wait_for_old_object:
         goto try_again;
 
 requeue:
-        clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
         cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_timeo);
         _leave(" = -ETIMEDOUT");
         return -ETIMEDOUT;
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 5082c8a49686..40f7595aad10 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -27,6 +27,7 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
         struct cachefiles_one_read *monitor =
                 container_of(wait, struct cachefiles_one_read, monitor);
         struct cachefiles_object *object;
+        struct fscache_retrieval *op = monitor->op;
         struct wait_bit_key *key = _key;
         struct page *page = wait->private;
 
@@ -51,16 +52,22 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
         list_del(&wait->entry);
 
         /* move onto the action list and queue for FS-Cache thread pool */
-        ASSERT(monitor->op);
+        ASSERT(op);
 
-        object = container_of(monitor->op->op.object,
-                              struct cachefiles_object, fscache);
+        /* We need to temporarily bump the usage count as we don't own a ref
+         * here otherwise cachefiles_read_copier() may free the op between the
+         * monitor being enqueued on the op->to_do list and the op getting
+         * enqueued on the work queue.
+         */
+        fscache_get_retrieval(op);
 
+        object = container_of(op->op.object, struct cachefiles_object, fscache);
         spin_lock(&object->work_lock);
-        list_add_tail(&monitor->op_link, &monitor->op->to_do);
+        list_add_tail(&monitor->op_link, &op->to_do);
         spin_unlock(&object->work_lock);
 
-        fscache_enqueue_retrieval(monitor->op);
+        fscache_enqueue_retrieval(op);
+        fscache_put_retrieval(op);
         return 0;
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index 72e961a62adb..bdd0eacefdf5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -293,6 +293,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         bprm->vma = vma = vm_area_alloc(mm);
         if (!vma)
                 return -ENOMEM;
+        vma_set_anonymous(vma);
 
         if (down_write_killable(&mm->mmap_sem)) {
                 err = -EINTR;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index e68cefe08261..aa52d87985aa 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -368,6 +368,8 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
 
         ext4_lock_group(sb, block_group);
+        if (buffer_verified(bh))
+                goto verified;
         if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
                         desc, bh))) {
                 ext4_unlock_group(sb, block_group);
@@ -386,6 +388,7 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
         }
         set_buffer_verified(bh);
+verified:
         ext4_unlock_group(sb, block_group);
         return 0;
 }
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index fb83750c1a14..f336cbc6e932 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -90,6 +90,8 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
                 return -EFSCORRUPTED;
 
         ext4_lock_group(sb, block_group);
+        if (buffer_verified(bh))
+                goto verified;
         blk = ext4_inode_bitmap(sb, desc);
         if (!ext4_inode_bitmap_csum_verify(sb, block_group, desc, bh,
                                            EXT4_INODES_PER_GROUP(sb) / 8)) {
@@ -101,6 +103,7 @@ static int ext4_validate_inode_bitmap(struct super_block *sb,
                 return -EFSBADCRC;
         }
         set_buffer_verified(bh);
+verified:
         ext4_unlock_group(sb, block_group);
         return 0;
 }
@@ -1385,7 +1388,10 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
                             ext4_itable_unused_count(sb, gdp)),
                             sbi->s_inodes_per_block);
 
-        if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
+        if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
+            ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
+                               ext4_itable_unused_count(sb, gdp)) <
+                              EXT4_FIRST_INO(sb)))) {
                 ext4_error(sb, "Something is wrong with group %u: "
                            "used itable blocks: %d; "
                            "itable unused count: %u",
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index e55a8bc870bd..3543fe80a3c4 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -682,6 +682,10 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
                 goto convert;
         }
 
+        ret = ext4_journal_get_write_access(handle, iloc.bh);
+        if (ret)
+                goto out;
+
         flags |= AOP_FLAG_NOFS;
 
         page = grab_cache_page_write_begin(mapping, 0, flags);
@@ -710,7 +714,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
 out_up_read:
         up_read(&EXT4_I(inode)->xattr_sem);
 out:
-        if (handle)
+        if (handle && (ret != 1))
                 ext4_journal_stop(handle);
         brelse(iloc.bh);
         return ret;
@@ -752,6 +756,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 
         ext4_write_unlock_xattr(inode, &no_expand);
         brelse(iloc.bh);
+        mark_inode_dirty(inode);
 out:
         return copied;
 }
@@ -898,7 +903,6 @@ retry_journal:
                 goto out;
         }
 
-
         page = grab_cache_page_write_begin(mapping, 0, flags);
         if (!page) {
                 ret = -ENOMEM;
@@ -916,6 +920,9 @@ retry_journal:
                 if (ret < 0)
                         goto out_release_page;
         }
+        ret = ext4_journal_get_write_access(handle, iloc.bh);
+        if (ret)
+                goto out_release_page;
 
         up_read(&EXT4_I(inode)->xattr_sem);
         *pagep = page;
@@ -936,7 +943,6 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
                                   unsigned len, unsigned copied,
                                   struct page *page)
 {
-        int i_size_changed = 0;
         int ret;
 
         ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
@@ -954,10 +960,8 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
          * But it's important to update i_size while still holding page lock:
          * page writeout could otherwise come in and zero beyond i_size.
          */
-        if (pos+copied > inode->i_size) {
+        if (pos+copied > inode->i_size)
                 i_size_write(inode, pos+copied);
-                i_size_changed = 1;
-        }
         unlock_page(page);
         put_page(page);
 
@@ -967,8 +971,7 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
          * ordering of page lock and transaction start for journaling
          * filesystems.
          */
-        if (i_size_changed)
-                mark_inode_dirty(inode);
+        mark_inode_dirty(inode);
 
         return copied;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7d6c10017bdf..4efe77286ecd 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1389,9 +1389,10 @@ static int ext4_write_end(struct file *file,
         loff_t old_size = inode->i_size;
         int ret = 0, ret2;
         int i_size_changed = 0;
+        int inline_data = ext4_has_inline_data(inode);
 
         trace_ext4_write_end(inode, pos, len, copied);
-        if (ext4_has_inline_data(inode)) {
+        if (inline_data) {
                 ret = ext4_write_inline_data_end(inode, pos, len,
                                                  copied, page);
                 if (ret < 0) {
@@ -1419,7 +1420,7 @@ static int ext4_write_end(struct file *file,
          * ordering of page lock and transaction start for journaling
          * filesystems.
          */
-        if (i_size_changed)
+        if (i_size_changed || inline_data)
                 ext4_mark_inode_dirty(handle, inode);
 
         if (pos + len > inode->i_size && ext4_can_truncate(inode))
@@ -1493,6 +1494,7 @@ static int ext4_journalled_write_end(struct file *file,
         int partial = 0;
         unsigned from, to;
         int size_changed = 0;
+        int inline_data = ext4_has_inline_data(inode);
 
         trace_ext4_journalled_write_end(inode, pos, len, copied);
         from = pos & (PAGE_SIZE - 1);
@@ -1500,7 +1502,7 @@ static int ext4_journalled_write_end(struct file *file,
 
         BUG_ON(!ext4_handle_valid(handle));
 
-        if (ext4_has_inline_data(inode)) {
+        if (inline_data) {
                 ret = ext4_write_inline_data_end(inode, pos, len,
                                                  copied, page);
                 if (ret < 0) {
@@ -1531,7 +1533,7 @@ static int ext4_journalled_write_end(struct file *file,
         if (old_size < pos)
                 pagecache_isize_extended(inode, old_size, pos);
 
-        if (size_changed) {
+        if (size_changed || inline_data) {
                 ret2 = ext4_mark_inode_dirty(handle, inode);
                 if (!ret)
                         ret = ret2;
@@ -2028,11 +2030,7 @@ static int __ext4_journalled_writepage(struct page *page,
         }
 
         if (inline_data) {
-                BUFFER_TRACE(inode_bh, "get write access");
-                ret = ext4_journal_get_write_access(handle, inode_bh);
-
-                err = ext4_handle_dirty_metadata(handle, inode, inode_bh);
-
+                ret = ext4_mark_inode_dirty(handle, inode);
         } else {
                 ret = ext4_walk_page_buffers(handle, page_bufs, 0, len, NULL,
                                              do_journal_get_write_access);
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index 27b9a76a0dfa..638ad4743477 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -186,11 +186,8 @@ static int kmmpd(void *data)
                         goto exit_thread;
                 }
 
-                if (sb_rdonly(sb)) {
-                        ext4_warning(sb, "kmmpd being stopped since filesystem "
-                                     "has been remounted as readonly.");
-                        goto exit_thread;
-                }
+                if (sb_rdonly(sb))
+                        break;
 
                 diff = jiffies - last_update_time;
                 if (diff < mmp_update_interval * HZ)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ba2396a7bd04..b7f7922061be 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2342,7 +2342,7 @@ static int ext4_check_descriptors(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
         ext4_fsblk_t last_block;
-        ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
+        ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0);
         ext4_fsblk_t block_bitmap;
         ext4_fsblk_t inode_bitmap;
         ext4_fsblk_t inode_table;
@@ -3141,14 +3141,8 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb)
                 if (!gdp)
                         continue;
 
-                if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
-                        continue;
-                if (group != 0)
+                if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
                         break;
-                ext4_error(sb, "Inode table for bg 0 marked as "
-                           "needing zeroing");
-                if (sb_rdonly(sb))
-                        return ngroups;
         }
 
         return group;
@@ -4085,14 +4079,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                         goto failed_mount2;
                 }
         }
+        sbi->s_gdb_count = db_count;
         if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
                 ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
                 ret = -EFSCORRUPTED;
                 goto failed_mount2;
         }
 
-        sbi->s_gdb_count = db_count;
-
         timer_setup(&sbi->s_err_report, print_daily_error_info, 0);
 
         /* Register extent status tree shrinker */
@@ -5213,6 +5206,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 
                         if (sbi->s_journal)
                                 ext4_mark_recovery_complete(sb, es);
+                        if (sbi->s_mmp_tsk)
+                                kthread_stop(sbi->s_mmp_tsk);
                 } else {
                         /* Make sure we can mount this feature set readwrite */
                         if (ext4_has_feature_readonly(sb) ||
diff --git a/fs/fscache/cache.c b/fs/fscache/cache.c
index c184c5a356ff..cdcb376ef8df 100644
--- a/fs/fscache/cache.c
+++ b/fs/fscache/cache.c
@@ -220,6 +220,7 @@ int fscache_add_cache(struct fscache_cache *cache,
 {
         struct fscache_cache_tag *tag;
 
+        ASSERTCMP(ifsdef->cookie, ==, &fscache_fsdef_index);
         BUG_ON(!cache->ops);
         BUG_ON(!ifsdef);
 
@@ -248,7 +249,6 @@ int fscache_add_cache(struct fscache_cache *cache,
         if (!cache->kobj)
                 goto error;
 
-        ifsdef->cookie = &fscache_fsdef_index;
         ifsdef->cache = cache;
         cache->fsdef = ifsdef;
 
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 97137d7ec5ee..83bfe04456b6 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -516,6 +516,7 @@ static int fscache_alloc_object(struct fscache_cache *cache,
                 goto error;
         }
 
+        ASSERTCMP(object->cookie, ==, cookie);
         fscache_stat(&fscache_n_object_alloc);
 
         object->debug_id = atomic_inc_return(&fscache_object_debug_id);
@@ -571,6 +572,8 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
 
         _enter("{%s},{OBJ%x}", cookie->def->name, object->debug_id);
 
+        ASSERTCMP(object->cookie, ==, cookie);
+
         spin_lock(&cookie->lock);
 
         /* there may be multiple initial creations of this object, but we only
@@ -610,9 +613,7 @@ static int fscache_attach_object(struct fscache_cookie *cookie,
                 spin_unlock(&cache->object_list_lock);
         }
 
-        /* attach to the cookie */
-        object->cookie = cookie;
-        fscache_cookie_get(cookie, fscache_cookie_get_attach_object);
+        /* Attach to the cookie.  The object already has a ref on it. */
         hlist_add_head(&object->cookie_link, &cookie->backing_objects);
 
         fscache_objlist_add(object);
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 20e0d0a4dc8c..9edc920f651f 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -327,6 +327,7 @@ void fscache_object_init(struct fscache_object *object,
         object->store_limit_l = 0;
         object->cache = cache;
         object->cookie = cookie;
+        fscache_cookie_get(cookie, fscache_cookie_get_attach_object);
         object->parent = NULL;
 #ifdef CONFIG_FSCACHE_OBJECT_LIST
         RB_CLEAR_NODE(&object->objlist_link);
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index e30c5975ea58..8d265790374c 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -70,7 +70,8 @@ void fscache_enqueue_operation(struct fscache_operation *op)
         ASSERT(op->processor != NULL);
         ASSERT(fscache_object_is_available(op->object));
         ASSERTCMP(atomic_read(&op->usage), >, 0);
-        ASSERTCMP(op->state, ==, FSCACHE_OP_ST_IN_PROGRESS);
+        ASSERTIFCMP(op->state != FSCACHE_OP_ST_IN_PROGRESS,
+                    op->state, ==,  FSCACHE_OP_ST_CANCELLED);
 
         fscache_stat(&fscache_n_op_enqueue);
         switch (op->flags & FSCACHE_OP_TYPE) {
@@ -499,7 +500,8 @@ void fscache_put_operation(struct fscache_operation *op)
         struct fscache_cache *cache;
 
         _enter("{OBJ%x OP%x,%d}",
-               op->object->debug_id, op->debug_id, atomic_read(&op->usage));
+               op->object ? op->object->debug_id : 0,
+               op->debug_id, atomic_read(&op->usage));
 
         ASSERTCMP(atomic_read(&op->usage), >, 0);
 
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index d508c7844681..40d4c66c7751 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -411,6 +411,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
         bool truncate_op = (lend == LLONG_MAX);
 
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, current->mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pagevec_init(&pvec);
         next = start;
@@ -595,6 +596,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
          * as input to create an allocation policy.
          */
         memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+        vma_init(&pseudo_vma, mm);
         pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
         pseudo_vma.vm_file = file;
 
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2751476e6b6e..f098b9f1c396 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
         }
 
         if (compressed) {
+                if (!msblk->stream)
+                        goto read_failure;
                 length = squashfs_decompress(msblk, bh, b, offset, length,
                         output);
                 if (length < 0)
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 23813c078cc9..0839efa720b3 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer,
 
         TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset);
 
+        if (unlikely(length < 0))
+                return -EIO;
+
         while (length) {
                 entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0);
                 if (entry->error) {
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 13d80947bf9e..f1c1430ae721 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -194,7 +194,11 @@ static long long read_indexes(struct super_block *sb, int n,
                 }
 
                 for (i = 0; i < blocks; i++) {
-                        int size = le32_to_cpu(blist[i]);
+                        int size = squashfs_block_size(blist[i]);
+                        if (size < 0) {
+                                err = size;
+                                goto failure;
+                        }
                         block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size);
                 }
                 n -= blocks;
@@ -367,7 +371,24 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
                         sizeof(size));
         if (res < 0)
                 return res;
-        return le32_to_cpu(size);
+        return squashfs_block_size(size);
+}
+
+void squashfs_fill_page(struct page *page, struct squashfs_cache_entry *buffer, int offset, int avail)
+{
+        int copied;
+        void *pageaddr;
+
+        pageaddr = kmap_atomic(page);
+        copied = squashfs_copy_data(pageaddr, buffer, offset, avail);
+        memset(pageaddr + copied, 0, PAGE_SIZE - copied);
+        kunmap_atomic(pageaddr);
+
+        flush_dcache_page(page);
+        if (copied == avail)
+                SetPageUptodate(page);
+        else
+                SetPageError(page);
 }
 
 /* Copy data into page cache  */
@@ -376,7 +397,6 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
 {
         struct inode *inode = page->mapping->host;
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        void *pageaddr;
         int i, mask = (1 << (msblk->block_log - PAGE_SHIFT)) - 1;
         int start_index = page->index & ~mask, end_index = start_index | mask;
 
@@ -402,12 +422,7 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
                 if (PageUptodate(push_page))
                         goto skip_page;
 
-                pageaddr = kmap_atomic(push_page);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(push_page);
-                SetPageUptodate(push_page);
+                squashfs_fill_page(push_page, buffer, offset, avail);
 skip_page:
                 unlock_page(push_page);
                 if (i != page->index)
@@ -416,10 +431,9 @@ skip_page:
 }
 
 /* Read datablock stored packed inside a fragment (tail-end packed block) */
-static int squashfs_readpage_fragment(struct page *page)
+static int squashfs_readpage_fragment(struct page *page, int expected)
 {
         struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
                 squashfs_i(inode)->fragment_block,
                 squashfs_i(inode)->fragment_size);
@@ -430,23 +444,16 @@ static int squashfs_readpage_fragment(struct page *page)
                         squashfs_i(inode)->fragment_block,
                         squashfs_i(inode)->fragment_size);
         else
-                squashfs_copy_cache(page, buffer, i_size_read(inode) &
-                        (msblk->block_size - 1),
+                squashfs_copy_cache(page, buffer, expected,
                         squashfs_i(inode)->fragment_offset);
 
         squashfs_cache_put(buffer);
         return res;
 }
 
-static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+static int squashfs_readpage_sparse(struct page *page, int expected)
 {
-        struct inode *inode = page->mapping->host;
-        struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-        int bytes = index == file_end ?
-                        (i_size_read(inode) & (msblk->block_size - 1)) :
-                         msblk->block_size;
-
-        squashfs_copy_cache(page, NULL, bytes, 0);
+        squashfs_copy_cache(page, NULL, expected, 0);
         return 0;
 }
 
@@ -456,6 +463,9 @@ static int squashfs_readpage(struct file *file, struct page *page)
         struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
         int index = page->index >> (msblk->block_log - PAGE_SHIFT);
         int file_end = i_size_read(inode) >> msblk->block_log;
+        int expected = index == file_end ?
+                        (i_size_read(inode) & (msblk->block_size - 1)) :
+                         msblk->block_size;
         int res;
         void *pageaddr;
 
@@ -474,11 +484,11 @@ static int squashfs_readpage(struct file *file, struct page *page)
                         goto error_out;
 
                 if (bsize == 0)
-                        res = squashfs_readpage_sparse(page, index, file_end);
+                        res = squashfs_readpage_sparse(page, expected);
                 else
-                        res = squashfs_readpage_block(page, block, bsize);
+                        res = squashfs_readpage_block(page, block, bsize, expected);
         } else
-                res = squashfs_readpage_fragment(page);
+                res = squashfs_readpage_fragment(page, expected);
 
         if (!res)
                 return 0;
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index f2310d2a2019..a9ba8d96776a 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -20,7 +20,7 @@
 #include "squashfs.h"
 
 /* Read separately compressed datablock and memcopy into page cache */
-int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *page, u64 block, int bsize, int expected)
 {
         struct inode *i = page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
@@ -31,7 +31,7 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
                 ERROR("Unable to read page, block %llx, size %x\n", block,
                         bsize);
         else
-                squashfs_copy_cache(page, buffer, buffer->length, 0);
+                squashfs_copy_cache(page, buffer, expected, 0);
 
         squashfs_cache_put(buffer);
         return res;
diff --git a/fs/squashfs/file_direct.c b/fs/squashfs/file_direct.c
index cb485d8e0e91..80db1b86a27c 100644
--- a/fs/squashfs/file_direct.c
+++ b/fs/squashfs/file_direct.c
@@ -21,10 +21,11 @@
 #include "page_actor.h"
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page);
+        int pages, struct page **page, int bytes);
 
 /* Read separately compressed datablock directly into page cache */
-int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *target_page, u64 block, int bsize,
+        int expected)
 
 {
         struct inode *inode = target_page->mapping->host;
@@ -83,7 +84,7 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
                  * using an intermediate buffer.
                  */
                 res = squashfs_read_cache(target_page, block, bsize, pages,
-                                                                page);
+                                                        page, expected);
                 if (res < 0)
                         goto mark_errored;
 
@@ -95,6 +96,11 @@ int squashfs_readpage_block(struct page *target_page, u64 block, int bsize)
         if (res < 0)
                 goto mark_errored;
 
+        if (res != expected) {
+                res = -EIO;
+                goto mark_errored;
+        }
+
         /* Last page may have trailing bytes not filled */
         bytes = res % PAGE_SIZE;
         if (bytes) {
@@ -138,13 +144,12 @@ out:
 
 
 static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
-        int pages, struct page **page)
+        int pages, struct page **page, int bytes)
 {
         struct inode *i = target_page->mapping->host;
         struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
                                                  block, bsize);
-        int bytes = buffer->length, res = buffer->error, n, offset = 0;
-        void *pageaddr;
+        int res = buffer->error, n, offset = 0;
 
         if (res) {
                 ERROR("Unable to read page, block %llx, size %x\n", block,
@@ -159,12 +164,7 @@ static int squashfs_read_cache(struct page *target_page, u64 block, int bsize,
                 if (page[n] == NULL)
                         continue;
 
-                pageaddr = kmap_atomic(page[n]);
-                squashfs_copy_data(pageaddr, buffer, offset, avail);
-                memset(pageaddr + avail, 0, PAGE_SIZE - avail);
-                kunmap_atomic(pageaddr);
-                flush_dcache_page(page[n]);
-                SetPageUptodate(page[n]);
+                squashfs_fill_page(page[n], buffer, offset, avail);
                 unlock_page(page[n]);
                 if (page[n] != target_page)
                         put_page(page[n]);
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 0ed6edbc5c71..0681feab4a84 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                                 u64 *fragment_block)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
-        int block = SQUASHFS_FRAGMENT_INDEX(fragment);
-        int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
-        u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+        int block, offset, size;
         struct squashfs_fragment_entry fragment_entry;
-        int size;
+        u64 start_block;
+
+        if (fragment >= msblk->fragments)
+                return -EIO;
+        block = SQUASHFS_FRAGMENT_INDEX(fragment);
+        offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+        start_block = le64_to_cpu(msblk->fragment_index[block]);
 
         size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
                                         &offset, sizeof(fragment_entry));
@@ -61,9 +66,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                 return size;
 
         *fragment_block = le64_to_cpu(fragment_entry.start_block);
-        size = le32_to_cpu(fragment_entry.size);
-
-        return size;
+        return squashfs_block_size(fragment_entry.size);
 }
 
 
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 887d6d270080..f89f8a74c6ce 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -67,11 +67,12 @@ extern __le64 *squashfs_read_fragment_index_table(struct super_block *,
                                 u64, u64, unsigned int);
 
 /* file.c */
+void squashfs_fill_page(struct page *, struct squashfs_cache_entry *, int, int);
 void squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
                                 int);
 
 /* file_xxx.c */
-extern int squashfs_readpage_block(struct page *, u64, int);
+extern int squashfs_readpage_block(struct page *, u64, int, int);
 
 /* id.c */
 extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 24d12fd14177..4e6853f084d0 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -129,6 +129,12 @@
 
 #define SQUASHFS_COMPRESSED_BLOCK(B)    (!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK))
 
+static inline int squashfs_block_size(__le32 raw)
+{
+        u32 size = le32_to_cpu(raw);
+        return (size >> 25) ? -EIO : size;
+}
+
 /*
  * Inode number ops.  Inodes consist of a compressed block number, and an
  * uncompressed offset within that block
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 1da565cb50c3..ef69c31947bf 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
         unsigned short                          block_log;
         long long                               bytes_used;
         unsigned int                            inodes;
+        unsigned int                            fragments;
         int                                     xattr_ids;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 8a73b97217c8..40e657386fa5 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
         msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
         msblk->inodes = le32_to_cpu(sblk->inodes);
+        msblk->fragments = le32_to_cpu(sblk->fragments);
         flags = le16_to_cpu(sblk->flags);
 
         TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
         TRACE("Block size %d\n", msblk->block_size);
         TRACE("Number of inodes %d\n", msblk->inodes);
-        TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+        TRACE("Number of fragments %d\n", msblk->fragments);
         TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
         TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
         TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -272,7 +273,7 @@ allocate_id_index_table:
         sb->s_export_op = &squashfs_export_ops;
 
 handle_fragments:
-        fragments = le32_to_cpu(sblk->fragments);
+        fragments = msblk->fragments;
         if (fragments == 0)
                 goto check_directory_table;
 
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index eef466260d43..75dbdc14c45f 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -223,12 +223,13 @@ xfs_alloc_get_rec(
         error = xfs_btree_get_rec(cur, &rec, stat);
         if (error || !(*stat))
                 return error;
-        if (rec->alloc.ar_blockcount == 0)
-                goto out_bad_rec;
 
         *bno = be32_to_cpu(rec->alloc.ar_startblock);
         *len = be32_to_cpu(rec->alloc.ar_blockcount);
 
+        if (*len == 0)
+                goto out_bad_rec;
+
         /* check for valid extent range, including overflow */
         if (!xfs_verify_agbno(mp, agno, *bno))
                 goto out_bad_rec;
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index 33dc34655ac3..30d1d60f1d46 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -731,7 +731,8 @@ xfs_inode_validate_extsize(
         if ((hint_flag || inherit_flag) && extsize == 0)
                 return __this_address;
 
-        if (!(hint_flag || inherit_flag) && extsize != 0)
+        /* free inodes get flags set to zero but extsize remains */
+        if (mode && !(hint_flag || inherit_flag) && extsize != 0)
                 return __this_address;
 
         if (extsize_bytes % blocksize_bytes)
@@ -777,7 +778,8 @@ xfs_inode_validate_cowextsize(
         if (hint_flag && cowextsize == 0)
                 return __this_address;
 
-        if (!hint_flag && cowextsize != 0)
+        /* free inodes get flags set to zero but cowextsize remains */
+        if (mode && !hint_flag && cowextsize != 0)
                 return __this_address;
 
         if (hint_flag && rt_flag)
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index e3147eb74222..ca3f2c2edd85 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -287,6 +287,20 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues);
 
 void blk_mq_quiesce_queue_nowait(struct request_queue *q);
 
+/**
+ * blk_mq_mark_complete() - Set request state to complete
+ * @rq: request to set to complete state
+ *
+ * Returns true if request state was successfully set to complete. If
+ * successful, the caller is responsibile for seeing this request is ended, as
+ * blk_mq_complete_request will not work again.
+ */
+static inline bool blk_mq_mark_complete(struct request *rq)
+{
+        return cmpxchg(&rq->state, MQ_RQ_IN_FLIGHT, MQ_RQ_COMPLETE) ==
+                        MQ_RQ_IN_FLIGHT;
+}
+
 /*
  * Driver command data is immediately after the request. So subtract request
  * size to get back to the original request, add request size to get the PDU.
diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h
index e6c0448ebcc7..31c865d1842e 100644
--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start(void)
 
 static inline void delayacct_blkio_end(struct task_struct *p)
 {
-        if (current->delays)
+        if (p->delays)
                 __delayacct_blkio_end(p);
         delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index 7094718b653b..ffcc7724ca21 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -11,6 +11,7 @@
 
 #include <linux/fcntl.h>
 #include <linux/wait.h>
+#include <linux/err.h>
 
 /*
  * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d3a3842316b8..68a5121694ef 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -452,6 +452,23 @@ struct vm_operations_struct {
                                           unsigned long addr);
 };
 
+static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
+{
+        static const struct vm_operations_struct dummy_vm_ops = {};
+
+        vma->vm_mm = mm;
+        vma->vm_ops = &dummy_vm_ops;
+        INIT_LIST_HEAD(&vma->anon_vma_chain);
+}
+
+static inline void vma_set_anonymous(struct vm_area_struct *vma)
+{
+        vma->vm_ops = NULL;
+}
+
+/* flush_tlb_range() takes a vma, not a mm, and can care about flags */
+#define TLB_FLUSH_VMA(mm,flags) { .vm_mm = (mm), .vm_flags = (flags) }
+
 struct mmu_gather;
 struct inode;
 
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 1fa12887ec02..87f6db437e4a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1130,6 +1130,7 @@ extern void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct
 extern struct perf_callchain_entry *
 get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
                    u32 max_stack, bool crosstask, bool add_mark);
+extern struct perf_callchain_entry *perf_callchain(struct perf_event *event, struct pt_regs *regs);
 extern int get_callchain_buffers(int max_stack);
 extern void put_callchain_buffers(void);
 
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index b72ebdff0b77..003d09ab308d 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -165,6 +165,7 @@ void ring_buffer_record_enable(struct ring_buffer *buffer);
 void ring_buffer_record_off(struct ring_buffer *buffer);
 void ring_buffer_record_on(struct ring_buffer *buffer);
 int ring_buffer_record_is_on(struct ring_buffer *buffer);
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer);
 void ring_buffer_record_disable_cpu(struct ring_buffer *buffer, int cpu);
 void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu);
 
diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
index 1b92a28dd672..6fd615a0eea9 100644
--- a/include/linux/rtmutex.h
+++ b/include/linux/rtmutex.h
@@ -106,7 +106,14 @@ static inline int rt_mutex_is_locked(struct rt_mutex *lock)
 extern void __rt_mutex_init(struct rt_mutex *lock, const char *name, struct lock_class_key *key);
 extern void rt_mutex_destroy(struct rt_mutex *lock);
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+extern void rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass);
+#define rt_mutex_lock(lock) rt_mutex_lock_nested(lock, 0)
+#else
 extern void rt_mutex_lock(struct rt_mutex *lock);
+#define rt_mutex_lock_nested(lock, subclass) rt_mutex_lock(lock)
+#endif
+
 extern int rt_mutex_lock_interruptible(struct rt_mutex *lock);
 extern int rt_mutex_timed_lock(struct rt_mutex *lock,
                                struct hrtimer_sleeper *timeout);
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index b8e288a1f740..eeb787b1c53c 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -143,6 +143,8 @@ enum perf_event_sample_format {
         PERF_SAMPLE_PHYS_ADDR                   = 1U << 19,
 
         PERF_SAMPLE_MAX = 1U << 20,             /* non-ABI */
+
+        __PERF_SAMPLE_CALLCHAIN_EARLY           = 1ULL << 63,
 };
 
 /*
diff --git a/ipc/sem.c b/ipc/sem.c
index 29c0347ef11d..00ef2f743a62 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2119,7 +2119,7 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
         }
 
         do {
-                queue.status = -EINTR;
+                WRITE_ONCE(queue.status, -EINTR);
                 queue.sleeper = current;
 
                 __set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ceb1c4596c51..80d672a11088 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1279,8 +1279,12 @@ static void show_special(struct audit_context *context, int *call_panic)
                 break;
         case AUDIT_KERN_MODULE:
                 audit_log_format(ab, "name=");
-                audit_log_untrustedstring(ab, context->module.name);
-                kfree(context->module.name);
+                if (context->module.name) {
+                        audit_log_untrustedstring(ab, context->module.name);
+                        kfree(context->module.name);
+                } else
+                        audit_log_format(ab, "(null)");
+
                 break;
         }
         audit_log_end(ab);
@@ -2411,8 +2415,9 @@ void __audit_log_kern_module(char *name)
 {
         struct audit_context *context = audit_context();
 
-        context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
-        strcpy(context->module.name, name);
+        context->module.name = kstrdup(name, GFP_KERNEL);
+        if (!context->module.name)
+                audit_log_lost("out of memory in __audit_log_kern_module");
         context->type = AUDIT_KERN_MODULE;
 }
 
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 544e58f5f642..2aa55d030c77 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -378,7 +378,7 @@ static int array_map_check_btf(const struct bpf_map *map, const struct btf *btf,
                 return -EINVAL;
 
         value_type = btf_type_id_size(btf, &btf_value_id, &value_size);
-        if (!value_type || value_size > map->value_size)
+        if (!value_type || value_size != map->value_size)
                 return -EINVAL;
 
         return 0;
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 9704934252b3..2590700237c1 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1519,9 +1519,9 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 {
         bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION;
         const struct btf_member *member;
+        u32 meta_needed, last_offset;
         struct btf *btf = env->btf;
         u32 struct_size = t->size;
-        u32 meta_needed;
         u16 i;
 
         meta_needed = btf_type_vlen(t) * sizeof(*member);
@@ -1534,6 +1534,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
 
         btf_verifier_log_type(env, t, NULL);
 
+        last_offset = 0;
         for_each_member(i, t, member) {
                 if (!btf_name_offset_valid(btf, member->name_off)) {
                         btf_verifier_log_member(env, t, member,
@@ -1555,6 +1556,16 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                         return -EINVAL;
                 }
 
+                /*
+                 * ">" instead of ">=" because the last member could be
+                 * "char a[0];"
+                 */
+                if (last_offset > member->offset) {
+                        btf_verifier_log_member(env, t, member,
+                                                "Invalid member bits_offset");
+                        return -EINVAL;
+                }
+
                 if (BITS_ROUNDUP_BYTES(member->offset) > struct_size) {
                         btf_verifier_log_member(env, t, member,
                                                 "Memmber bits_offset exceeds its struct size");
@@ -1562,6 +1573,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
                 }
 
                 btf_verifier_log_member(env, t, member, NULL);
+                last_offset = member->offset;
         }
 
         return meta_needed;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 8f0434a9951a..eec2d5fb676b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6343,7 +6343,7 @@ static u64 perf_virt_to_phys(u64 virt)
 
 static struct perf_callchain_entry __empty_callchain = { .nr = 0, };
 
-static struct perf_callchain_entry *
+struct perf_callchain_entry *
 perf_callchain(struct perf_event *event, struct pt_regs *regs)
 {
         bool kernel = !event->attr.exclude_callchain_kernel;
@@ -6382,7 +6382,9 @@ void perf_prepare_sample(struct perf_event_header *header,
         if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                 int size = 1;
 
-                data->callchain = perf_callchain(event, regs);
+                if (!(sample_type & __PERF_SAMPLE_CALLCHAIN_EARLY))
+                        data->callchain = perf_callchain(event, regs);
+
                 size += data->callchain->nr;
 
                 header->size += size * sizeof(u64);
@@ -7335,6 +7337,10 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
                                      struct file *file, unsigned long offset,
                                      unsigned long size)
 {
+        /* d_inode(NULL) won't be equal to any mapped user-space file */
+        if (!filter->path.dentry)
+                return false;
+
         if (d_inode(filter->path.dentry) != file_inode(file))
                 return false;
 
diff --git a/kernel/fork.c b/kernel/fork.c
index a191c05e757d..1b27babc4c78 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -312,10 +312,8 @@ struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
 {
         struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 
-        if (vma) {
-                vma->vm_mm = mm;
-                INIT_LIST_HEAD(&vma->anon_vma_chain);
-        }
+        if (vma)
+                vma_init(vma, mm);
         return vma;
 }
 
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 750cb8082694..486dedbd9af5 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -325,8 +325,14 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data),
         task = create->result;
         if (!IS_ERR(task)) {
                 static const struct sched_param param = { .sched_priority = 0 };
+                char name[TASK_COMM_LEN];
 
-                vsnprintf(task->comm, sizeof(task->comm), namefmt, args);
+                /*
+                 * task is already visible to other tasks, so updating
+                 * COMM must be protected.
+                 */
+                vsnprintf(name, sizeof(name), namefmt, args);
+                set_task_comm(task, name);
                 /*
                  * root may have changed our (kthreadd's) priority or CPU mask.
                  * The kernel thread should not inherit these properties.
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 4f014be7a4b8..2823d4163a37 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1465,6 +1465,29 @@ rt_mutex_fastunlock(struct rt_mutex *lock,
                 rt_mutex_postunlock(&wake_q);
 }
 
+static inline void __rt_mutex_lock(struct rt_mutex *lock, unsigned int subclass)
+{
+        might_sleep();
+
+        mutex_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
+        rt_mutex_fastlock(lock, TASK_UNINTERRUPTIBLE, rt_mutex_slowlock);
+}
+
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+/**
+ * rt_mutex_lock_nested - lock a rt_mutex
+ *
+ * @lock: the rt_mutex to be locked
+ * @subclass: the lockdep subclass
+ */
+void __sched rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass)
+{
+        __rt_mutex_lock(lock, subclass);
+}
+EXPORT_SYMBOL_GPL(rt_mutex_lock_nested);
+#endif
+
+#ifndef CONFIG_DEBUG_LOCK_ALLOC
 /**
  * rt_mutex_lock - lock a rt_mutex
  *
@@ -1472,12 +1495,10 @@ rt_mutex_fastunlock(struct rt_mutex *lock,
  */
 void __sched rt_mutex_lock(struct rt_mutex *lock)
 {
-        might_sleep();
-
-        mutex_acquire(&lock->dep_map, 0, 0, _RET_IP_);
-        rt_mutex_fastlock(lock, TASK_UNINTERRUPTIBLE, rt_mutex_slowlock);
+        __rt_mutex_lock(lock, 0);
 }
 EXPORT_SYMBOL_GPL(rt_mutex_lock);
+#endif
 
 /**
  * rt_mutex_lock_interruptible - lock a rt_mutex interruptible
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 5857267a4af5..38283363da06 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -176,10 +176,27 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
         unsigned long pfn, pgoff, order;
         pgprot_t pgprot = PAGE_KERNEL;
         int error, nid, is_ram;
+        struct dev_pagemap *conflict_pgmap;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
                 - align_start;
+        align_end = align_start + align_size - 1;
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_start), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        conflict_pgmap = get_dev_pagemap(PHYS_PFN(align_end), NULL);
+        if (conflict_pgmap) {
+                dev_WARN(dev, "Conflicting mapping in same section\n");
+                put_dev_pagemap(conflict_pgmap);
+                return ERR_PTR(-ENOMEM);
+        }
+
         is_ram = region_intersects(align_start, align_size,
                 IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);
 
@@ -199,7 +216,6 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
 
         mutex_lock(&pgmap_lock);
         error = 0;
-        align_end = align_start + align_size - 1;
 
         foreach_order_pgoff(res, order, pgoff) {
                 error = __radix_tree_insert(&pgmap_radix,
@@ -305,7 +321,7 @@ EXPORT_SYMBOL_GPL(get_dev_pagemap);
 
 #ifdef CONFIG_DEV_PAGEMAP_OPS
 DEFINE_STATIC_KEY_FALSE(devmap_managed_key);
-EXPORT_SYMBOL_GPL(devmap_managed_key);
+EXPORT_SYMBOL(devmap_managed_key);
 static atomic_t devmap_enable;
 
 /*
@@ -346,5 +362,5 @@ void __put_devmap_managed_page(struct page *page)
         } else if (!count)
                 __put_page(page);
 }
-EXPORT_SYMBOL_GPL(__put_devmap_managed_page);
+EXPORT_SYMBOL(__put_devmap_managed_page);
 #endif /* CONFIG_DEV_PAGEMAP_OPS */
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 10c7b51c0d1f..b5fbdde6afa9 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2090,8 +2090,14 @@ retry:
         sub_rq_bw(&next_task->dl, &rq->dl);
         set_task_cpu(next_task, later_rq->cpu);
         add_rq_bw(&next_task->dl, &later_rq->dl);
+
+        /*
+         * Update the later_rq clock here, because the clock is used
+         * by the cpufreq_update_util() inside __add_running_bw().
+         */
+        update_rq_clock(later_rq);
         add_running_bw(&next_task->dl, &later_rq->dl);
-        activate_task(later_rq, next_task, 0);
+        activate_task(later_rq, next_task, ENQUEUE_NOCLOCK);
         ret = 1;
 
         resched_curr(later_rq);
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 572567078b60..eaaec8364f96 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -836,6 +836,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                  * can be time-consuming. Try to avoid it when possible.
                  */
                 raw_spin_lock(&rt_rq->rt_runtime_lock);
+                if (!sched_feat(RT_RUNTIME_SHARE) && rt_rq->rt_runtime != RUNTIME_INF)
+                        rt_rq->rt_runtime = rt_b->rt_runtime;
                 skip = !rt_rq->rt_time && !rt_rq->rt_nr_running;
                 raw_spin_unlock(&rt_rq->rt_runtime_lock);
                 if (skip)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 05a831427bc7..56a0fed30c0a 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -47,7 +47,7 @@ static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
         if (!cpumask_test_cpu(cpu, sched_domain_span(sd))) {
                 printk(KERN_ERR "ERROR: domain->span does not contain CPU%d\n", cpu);
         }
-        if (!cpumask_test_cpu(cpu, sched_group_span(group))) {
+        if (group && !cpumask_test_cpu(cpu, sched_group_span(group))) {
                 printk(KERN_ERR "ERROR: domain->groups does not contain CPU%d\n", cpu);
         }
 
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 1ff523dae6e2..e190d1ef3a23 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -260,6 +260,15 @@ retry:
         err = 0;
         __cpu_stop_queue_work(stopper1, work1, &wakeq);
         __cpu_stop_queue_work(stopper2, work2, &wakeq);
+        /*
+         * The waking up of stopper threads has to happen
+         * in the same scheduling context as the queueing.
+         * Otherwise, there is a possibility of one of the
+         * above stoppers being woken up by another CPU,
+         * and preempting us. This will cause us to n ot
+         * wake up the other stopper forever.
+         */
+        preempt_disable();
 unlock:
         raw_spin_unlock(&stopper2->lock);
         raw_spin_unlock_irq(&stopper1->lock);
@@ -271,7 +280,6 @@ unlock:
         }
 
         if (!err) {
-                preempt_disable();
                 wake_up_q(&wakeq);
                 preempt_enable();
         }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 6a46af21765c..0b0b688ea166 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3227,6 +3227,22 @@ int ring_buffer_record_is_on(struct ring_buffer *buffer)
 }
 
 /**
+ * ring_buffer_record_is_set_on - return true if the ring buffer is set writable
+ * @buffer: The ring buffer to see if write is set enabled
+ *
+ * Returns true if the ring buffer is set writable by ring_buffer_record_on().
+ * Note that this does NOT mean it is in a writable state.
+ *
+ * It may return true when the ring buffer has been disabled by
+ * ring_buffer_record_disable(), as that is a temporary disabling of
+ * the ring buffer.
+ */
+int ring_buffer_record_is_set_on(struct ring_buffer *buffer)
+{
+        return !(atomic_read(&buffer->record_disabled) & RB_BUFFER_OFF);
+}
+
+/**
  * ring_buffer_record_disable_cpu - stop all writes into the cpu_buffer
  * @buffer: The ring buffer to stop writes to.
  * @cpu: The CPU buffer to stop
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 87cf25171fb8..823687997b01 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1373,6 +1373,12 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
 
         arch_spin_lock(&tr->max_lock);
 
+        /* Inherit the recordable setting from trace_buffer */
+        if (ring_buffer_record_is_set_on(tr->trace_buffer.buffer))
+                ring_buffer_record_on(tr->max_buffer.buffer);
+        else
+                ring_buffer_record_off(tr->max_buffer.buffer);
+
         swap(tr->trace_buffer.buffer, tr->max_buffer.buffer);
 
         __update_max_tr(tr, tsk, cpu);
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index d18249683682..5dea177cef53 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -679,6 +679,8 @@ event_trigger_callback(struct event_command *cmd_ops,
                 goto out_free;
 
  out_reg:
+        /* Up the trigger_data count to make sure reg doesn't free it on failure */
+        event_trigger_init(trigger_ops, trigger_data);
         ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
         /*
          * The above returns on success the # of functions enabled,
@@ -686,11 +688,13 @@ event_trigger_callback(struct event_command *cmd_ops,
          * Consider no functions a failure too.
          */
         if (!ret) {
+                cmd_ops->unreg(glob, trigger_ops, trigger_data, file);
                 ret = -ENOENT;
-                goto out_free;
-        } else if (ret < 0)
-                goto out_free;
-        ret = 0;
+        } else if (ret > 0)
+                ret = 0;
+
+        /* Down the counter of trigger_data or free it if not used anymore */
+        event_trigger_free(trigger_ops, trigger_data);
  out:
         return ret;
 
@@ -1416,6 +1420,9 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
                 goto out;
         }
 
+        /* Up the trigger_data count to make sure nothing frees it on failure */
+        event_trigger_init(trigger_ops, trigger_data);
+
         if (trigger) {
                 number = strsep(&trigger, ":");
 
@@ -1466,6 +1473,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
                 goto out_disable;
         /* Just return zero, not the number of enabled functions */
         ret = 0;
+        event_trigger_free(trigger_ops, trigger_data);
  out:
         return ret;
 
@@ -1476,7 +1484,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
  out_free:
         if (cmd_ops->set_filter)
                 cmd_ops->set_filter(NULL, trigger_data, NULL);
-        kfree(trigger_data);
+        event_trigger_free(trigger_ops, trigger_data);
         kfree(enable_data);
         goto out;
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 21f718472942..6b71860f3998 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -400,11 +400,10 @@ static struct trace_kprobe *find_trace_kprobe(const char *event,
 static int
 enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
 {
+        struct event_file_link *link = NULL;
         int ret = 0;
 
         if (file) {
-                struct event_file_link *link;
-
                 link = kmalloc(sizeof(*link), GFP_KERNEL);
                 if (!link) {
                         ret = -ENOMEM;
@@ -424,6 +423,18 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
                 else
                         ret = enable_kprobe(&tk->rp.kp);
         }
+
+        if (ret) {
+                if (file) {
+                        /* Notice the if is true on not WARN() */
+                        if (!WARN_ON_ONCE(!link))
+                                list_del_rcu(&link->list);
+                        kfree(link);
+                        tk->tp.flags &= ~TP_FLAG_TRACE;
+                } else {
+                        tk->tp.flags &= ~TP_FLAG_PROFILE;
+                }
+        }
  out:
         return ret;
 }
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index c253c1b46c6b..befb127507c0 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -5,7 +5,7 @@ if HAVE_ARCH_KASAN
 
 config KASAN
         bool "KASan: runtime memory debugger"
-        depends on SLUB || (SLAB && !DEBUG_SLAB)
+        depends on (SLUB && SYSFS) || (SLAB && !DEBUG_SLAB)
         select SLUB_DEBUG if SLUB
         select CONSTRUCTORS
         select STACKDEPOT
diff --git a/mm/memory.c b/mm/memory.c
index 7206a634270b..dab1511294ad 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1417,11 +1417,9 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
         do {
                 next = pmd_addr_end(addr, end);
                 if (is_swap_pmd(*pmd) || pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
-                        if (next - addr != HPAGE_PMD_SIZE) {
-                                VM_BUG_ON_VMA(vma_is_anonymous(vma) &&
-                                    !rwsem_is_locked(&tlb->mm->mmap_sem), vma);
+                        if (next - addr != HPAGE_PMD_SIZE)
                                 __split_huge_pmd(vma, pmd, addr, false, NULL);
-                        } else if (zap_huge_pmd(tlb, vma, pmd, addr))
+                        else if (zap_huge_pmd(tlb, vma, pmd, addr))
                                 goto next;
                         /* fall through */
                 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9ac49ef17b4e..01f1a14facc4 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2505,6 +2505,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
+                vma_init(&pvma, NULL);
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
 
diff --git a/mm/mmap.c b/mm/mmap.c
index ff1944d8d458..17bbf4d3e24f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1778,6 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
+        } else {
+                vma_set_anonymous(vma);
         }
 
         vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -2983,6 +2985,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla
                 return -ENOMEM;
         }
 
+        vma_set_anonymous(vma);
         vma->vm_start = addr;
         vma->vm_end = addr + len;
         vma->vm_pgoff = pgoff;
diff --git a/mm/nommu.c b/mm/nommu.c
index 1d22fdbf7d7c..9fc9e43335b6 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1145,6 +1145,8 @@ static int do_mmap_private(struct vm_area_struct *vma,
                 if (ret < len)
                         memset(base + ret, 0, len - ret);
 
+        } else {
+                vma_set_anonymous(vma);
         }
 
         return 0;
diff --git a/mm/shmem.c b/mm/shmem.c
index 2cab84403055..41b9bbf24e16 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1421,6 +1421,7 @@ static void shmem_pseudo_vma_init(struct vm_area_struct *vma,
 {
         /* Create a pseudo vma that just contains the policy */
         memset(vma, 0, sizeof(*vma));
+        vma_init(vma, NULL);
         /* Bias interleave by inode number to distribute better across nodes */
         vma->vm_pgoff = index + info->vfs_inode.i_ino;
         vma->vm_policy = mpol_shared_policy_lookup(&info->policy, index);
diff --git a/mm/zswap.c b/mm/zswap.c
index 7d34e69507e3..cd91fd9d96b8 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1026,6 +1026,15 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
                         ret = -ENOMEM;
                         goto reject;
                 }
+
+                /* A second zswap_is_full() check after
+                 * zswap_shrink() to make sure it's now
+                 * under the max_pool_percent
+                 */
+                if (zswap_is_full()) {
+                        ret = -ENOMEM;
+                        goto reject;
+                }
         }
 
         /* allocate entry */
diff --git a/net/core/dev.c b/net/core/dev.c
index 38b0c414d780..36e994519488 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7607,16 +7607,19 @@ int dev_change_tx_queue_len(struct net_device *dev, unsigned long new_len)
                 dev->tx_queue_len = new_len;
                 res = call_netdevice_notifiers(NETDEV_CHANGE_TX_QUEUE_LEN, dev);
                 res = notifier_to_errno(res);
-                if (res) {
-                        netdev_err(dev,
-                                   "refused to change device tx_queue_len\n");
-                        dev->tx_queue_len = orig_len;
-                        return res;
-                }
-                return dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
+                res = dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
         }
 
         return 0;
+
+err_rollback:
+        netdev_err(dev, "refused to change device tx_queue_len\n");
+        dev->tx_queue_len = orig_len;
+        return res;
 }
 
 /**
diff --git a/net/core/filter.c b/net/core/filter.c
index 104d560946da..7509bb7f0694 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1712,24 +1712,26 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
            u32, offset, void *, to, u32, len, u32, start_header)
 {
+        u8 *end = skb_tail_pointer(skb);
+        u8 *net = skb_network_header(skb);
+        u8 *mac = skb_mac_header(skb);
         u8 *ptr;
 
-        if (unlikely(offset > 0xffff || len > skb_headlen(skb)))
+        if (unlikely(offset > 0xffff || len > (end - mac)))
                 goto err_clear;
 
         switch (start_header) {
         case BPF_HDR_START_MAC:
-                ptr = skb_mac_header(skb) + offset;
+                ptr = mac + offset;
                 break;
         case BPF_HDR_START_NET:
-                ptr = skb_network_header(skb) + offset;
+                ptr = net + offset;
                 break;
         default:
                 goto err_clear;
         }
 
-        if (likely(ptr >= skb_mac_header(skb) &&
-                   ptr + len <= skb_tail_pointer(skb))) {
+        if (likely(ptr >= mac && ptr + len <= end)) {
                 memcpy(to, ptr, len);
                 return 0;
         }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index e7e626fb87bb..e45098593dc0 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -217,7 +217,7 @@ static int bpf_parse_prog(struct nlattr *attr, struct bpf_lwt_prog *prog,
         if (!tb[LWT_BPF_PROG_FD] || !tb[LWT_BPF_PROG_NAME])
                 return -EINVAL;
 
-        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_KERNEL);
+        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_ATOMIC);
         if (!prog->name)
                 return -ENOMEM;
 
diff --git a/net/core/xdp.c b/net/core/xdp.c
index 57285383ed00..c013b836006b 100644
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -348,7 +348,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct,
                 rcu_read_lock();
                 /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */
                 xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
-                xa->zc_alloc->free(xa->zc_alloc, handle);
+                if (!WARN_ON_ONCE(!xa))
+                        xa->zc_alloc->free(xa->zc_alloc, handle);
                 rcu_read_unlock();
         default:
                 /* Not possible, checked in xdp_rxq_info_reg_mem_model() */
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 71536c435132..1ba3bde96b55 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1248,6 +1248,9 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_detach(slave_dev);
 
         rtnl_lock();
@@ -1261,6 +1264,9 @@ int dsa_slave_resume(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_attach(slave_dev);
 
         rtnl_lock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e46cdd310e5f..2998b0e47d4b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -292,19 +292,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
                 return ip_hdr(skb)->daddr;
 
         in_dev = __in_dev_get_rcu(dev);
-        BUG_ON(!in_dev);
 
         net = dev_net(dev);
 
         scope = RT_SCOPE_UNIVERSE;
         if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+                bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
                 struct flowi4 fl4 = {
                         .flowi4_iif = LOOPBACK_IFINDEX,
                         .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
                         .daddr = ip_hdr(skb)->saddr,
                         .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
                         .flowi4_scope = scope,
-                        .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
+                        .flowi4_mark = vmark ? skb->mark : 0,
                 };
                 if (!fib_lookup(net, &fl4, &res, 0))
                         return FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index bae9096821be..cf75f8944b05 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1387,7 +1387,8 @@ static void ip_mc_hash_remove(struct in_device *in_dev,
 /*
  *      A socket has joined a multicast group on device dev.
  */
-void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, unsigned int mode)
+static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
+                              unsigned int mode)
 {
         struct ip_mc_list *im;
 #ifdef CONFIG_IP_MULTICAST
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index d3162baca9f1..ccd140e4082d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -158,9 +158,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 {
         struct inet_frag_queue *q;
 
-        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
-                return NULL;
-
         q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
         if (!q)
                 return NULL;
@@ -205,6 +202,9 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
         struct inet_frag_queue *fq;
 
+        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+                return NULL;
+
         rcu_read_lock();
 
         fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e..d14d741fb05e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ found:
                 int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
                 if (i < next->len) {
+                        int delta = -next->truesize;
+
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
                         if (!pskb_pull(next, i))
                                 goto err;
+                        delta += next->truesize;
+                        if (delta)
+                                add_frag_mem_limit(qp->q.net, delta);
                         next->ip_defrag_offset += i;
                         qp->q.meat -= i;
                         if (next->ip_summed != CHECKSUM_UNNECESSARY)
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 3b5f45b9e81e..13d34427ca3d 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -358,6 +358,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
         /* Reduce delayed ACKs by rounding up cwnd to the next even number. */
         cwnd = (cwnd + 1) & ~1U;
 
+        /* Ensure gain cycling gets inflight above BDP even for small BDPs. */
+        if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT)
+                cwnd += 2;
+
         return cwnd;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3d6156f07a8d..715d541b52dd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -247,8 +247,15 @@ static void tcp_ecn_queue_cwr(struct tcp_sock *tp)
 
 static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (tcp_hdr(skb)->cwr)
+        if (tcp_hdr(skb)->cwr) {
                 tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+
+                /* If the sender is telling us it has entered CWR, then its
+                 * cwnd may be very low (even just 1 packet), so we should ACK
+                 * immediately.
+                 */
+                tcp_enter_quickack_mode((struct sock *)tp, 2);
+        }
 }
 
 static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 97513f35bcc5..88a7579c23bd 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -669,8 +669,10 @@ skip_cow:
 
         sg_init_table(sg, nfrags);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
-        if (unlikely(ret < 0))
+        if (unlikely(ret < 0)) {
+                kfree(tmp);
                 goto out;
+        }
 
         skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index b7f28deddaea..c72ae3a4fe09 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -480,10 +480,6 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 goto tx_err_dst_release;
         }
 
-        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
-        skb_dst_set(skb, dst);
-        skb->dev = skb_dst(skb)->dev;
-
         mtu = dst_mtu(dst);
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst_update_pmtu(skb, mtu);
@@ -498,9 +494,14 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                                   htonl(mtu));
                 }
 
-                return -EMSGSIZE;
+                err = -EMSGSIZE;
+                goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
+        skb->dev = skb_dst(skb)->dev;
+
         err = dst_output(t->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0) {
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f6ac7693d2cc..505bf36474ba 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
 #include <linux/hash.h>
 #include <linux/genetlink.h>
 #include <linux/net_namespace.h>
+#include <linux/nospec.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
 
         if (protocol < 0 || protocol >= MAX_LINKS)
                 return -EPROTONOSUPPORT;
+        protocol = array_index_nospec(protocol, MAX_LINKS);
 
         netlink_lock_table();
 #ifdef CONFIG_MODULES
@@ -1009,6 +1011,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         return err;
         }
 
+        if (nlk->ngroups == 0)
+                groups = 0;
+        else
+                groups &= (1ULL << nlk->ngroups) - 1;
+
         bound = nlk->bound;
         if (bound) {
                 /* Ensure nlk->portid is up-to-date. */
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index b891a91577f8..c038e021a591 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -211,6 +211,7 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
         if (!meter)
                 return ERR_PTR(-ENOMEM);
 
+        meter->id = nla_get_u32(a[OVS_METER_ATTR_ID]);
         meter->used = div_u64(ktime_get_ns(), 1000 * 1000);
         meter->kbps = a[OVS_METER_ATTR_KBPS] ? 1 : 0;
         meter->keep_stats = !a[OVS_METER_ATTR_CLEAR];
@@ -280,6 +281,10 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
         u32 meter_id;
         bool failed;
 
+        if (!a[OVS_METER_ATTR_ID]) {
+                return -ENODEV;
+        }
+
         meter = dp_meter_create(a);
         if (IS_ERR_OR_NULL(meter))
                 return PTR_ERR(meter);
@@ -298,11 +303,6 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        if (!a[OVS_METER_ATTR_ID]) {
-                err = -ENODEV;
-                goto exit_unlock;
-        }
-
         meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
 
         /* Cannot fail after this. */
diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
index 48332a6ed738..d152e48ea371 100644
--- a/net/rds/ib_frmr.c
+++ b/net/rds/ib_frmr.c
@@ -344,6 +344,11 @@ struct rds_ib_mr *rds_ib_reg_frmr(struct rds_ib_device *rds_ibdev,
         struct rds_ib_frmr *frmr;
         int ret;
 
+        if (!ic) {
+                /* TODO: Add FRWR support for RDS_GET_MR using proxy qp*/
+                return ERR_PTR(-EOPNOTSUPP);
+        }
+
         do {
                 if (ibmr)
                         rds_ib_free_frmr(ibmr, true);
diff --git a/net/rds/ib_mr.h b/net/rds/ib_mr.h
index f440ace584c8..5da12c248431 100644
--- a/net/rds/ib_mr.h
+++ b/net/rds/ib_mr.h
@@ -117,7 +117,8 @@ void rds6_ib_get_mr_info(struct rds_ib_device *rds_ibdev,
                          struct rds6_info_rdma_connection *iinfo6);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret);
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn);
 void rds_ib_sync_mr(void *trans_private, int dir);
 void rds_ib_free_mr(void *trans_private, int invalidate);
 void rds_ib_flush_mrs(void);
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 99ccafb90410..63c8d107adcf 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -549,11 +549,12 @@ void rds_ib_flush_mrs(void)
 }
 
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret)
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn)
 {
         struct rds_ib_device *rds_ibdev;
         struct rds_ib_mr *ibmr = NULL;
-        struct rds_ib_connection *ic = rs->rs_conn->c_transport_data;
+        struct rds_ib_connection *ic = NULL;
         int ret;
 
         rds_ibdev = rds_ib_get_device(rs->rs_bound_addr.s6_addr32[3]);
@@ -562,6 +563,9 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 goto out;
         }
 
+        if (conn)
+                ic = conn->c_transport_data;
+
         if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
                 ret = -ENODEV;
                 goto out;
@@ -571,17 +575,18 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 ibmr = rds_ib_reg_frmr(rds_ibdev, ic, sg, nents, key_ret);
         else
                 ibmr = rds_ib_reg_fmr(rds_ibdev, sg, nents, key_ret);
-        if (ibmr)
-                rds_ibdev = NULL;
-
- out:
-        if (!ibmr)
+        if (IS_ERR(ibmr)) {
+                ret = PTR_ERR(ibmr);
                 pr_warn("RDS/IB: rds_ib_get_mr failed (errno=%d)\n", ret);
+        } else {
+                return ibmr;
+        }
 
+ out:
         if (rds_ibdev)
                 rds_ib_dev_put(rds_ibdev);
 
-        return ibmr;
+        return ERR_PTR(ret);
 }
 
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *pool)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 7b3998026825..98237feb607a 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -170,7 +170,8 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 }
 
 static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
-                                u64 *cookie_ret, struct rds_mr **mr_ret)
+                          u64 *cookie_ret, struct rds_mr **mr_ret,
+                          struct rds_conn_path *cp)
 {
         struct rds_mr *mr = NULL, *found;
         unsigned int nr_pages;
@@ -269,7 +270,8 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
          * Note that dma_map() implies that pending writes are
          * flushed to RAM, so no dma_sync is needed here. */
         trans_private = rs->rs_transport->get_mr(sg, nents, rs,
-                                                 &mr->r_key);
+                                                 &mr->r_key,
+                                                 cp ? cp->cp_conn : NULL);
 
         if (IS_ERR(trans_private)) {
                 for (i = 0 ; i < nents; i++)
@@ -330,7 +332,7 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen)
                            sizeof(struct rds_get_mr_args)))
                 return -EFAULT;
 
-        return __rds_rdma_map(rs, &args, NULL, NULL);
+        return __rds_rdma_map(rs, &args, NULL, NULL, NULL);
 }
 
 int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
@@ -354,7 +356,7 @@ int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
         new_args.cookie_addr = args.cookie_addr;
         new_args.flags = args.flags;
 
-        return __rds_rdma_map(rs, &new_args, NULL, NULL);
+        return __rds_rdma_map(rs, &new_args, NULL, NULL, NULL);
 }
 
 /*
@@ -782,7 +784,8 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
             rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
-        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->rdma.op_rdma_mr);
+        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie,
+                              &rm->rdma.op_rdma_mr, rm->m_conn_path);
 }
 
 /*
diff --git a/net/rds/rds.h b/net/rds/rds.h
index ff537bb11411..c4dcf654d8fe 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -470,6 +470,8 @@ struct rds_message {
                         struct scatterlist      *op_sg;
                 } data;
         };
+
+        struct rds_conn_path *m_conn_path;
 };
 
 /*
@@ -551,7 +553,8 @@ struct rds_transport {
                                         unsigned int avail);
         void (*exit)(void);
         void *(*get_mr)(struct scatterlist *sg, unsigned long nr_sg,
-                        struct rds_sock *rs, u32 *key_ret);
+                        struct rds_sock *rs, u32 *key_ret,
+                        struct rds_connection *conn);
         void (*sync_mr)(void *trans_private, int direction);
         void (*free_mr)(void *trans_private, int invalidate);
         void (*flush_mrs)(void);
diff --git a/net/rds/send.c b/net/rds/send.c
index 36a5dba56a43..57b3d5a8b2db 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1255,6 +1255,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 rs->rs_conn = conn;
         }
 
+        if (conn->c_trans->t_mp_capable)
+                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
+        else
+                cpath = &conn->c_path[0];
+
+        rm->m_conn_path = cpath;
+
         /* Parse any control messages the user may have included. */
         ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
         if (ret) {
@@ -1278,11 +1285,6 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 goto out;
         }
 
-        if (conn->c_trans->t_mp_capable)
-                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
-        else
-                cpath = &conn->c_path[0];
-
         if (rds_destroy_pending(conn)) {
                 ret = -EAGAIN;
                 goto out;
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index a9a9be5519b9..9d1e298b784c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -116,9 +116,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
                 while (*pp) {
                         parent = *pp;
                         xcall = rb_entry(parent, struct rxrpc_call, sock_node);
-                        if (user_call_ID < call->user_call_ID)
+                        if (user_call_ID < xcall->user_call_ID)
                                 pp = &(*pp)->rb_left;
-                        else if (user_call_ID > call->user_call_ID)
+                        else if (user_call_ID > xcall->user_call_ID)
                                 pp = &(*pp)->rb_right;
                         else
                                 goto id_in_use;
diff --git a/net/socket.c b/net/socket.c
index 475247e347ae..b91949168a87 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
 #include <linux/magic.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2529,6 +2530,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 
         if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
+        call = array_index_nospec(call, SYS_SENDMMSG + 1);
 
         len = nargs[call];
         if (len > sizeof(a))
@@ -2695,7 +2697,8 @@ EXPORT_SYMBOL(sock_unregister);
 
 bool sock_is_registered(int family)
 {
-        return family < NPROTO && rcu_access_pointer(net_families[family]);
+        return family < NPROTO &&
+                rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
 }
 
 static int __init sock_init(void)
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 52ecaf770642..8a64b150be54 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -250,7 +250,7 @@ static inline bool xskq_full_desc(struct xsk_queue *q)
 
 static inline bool xskq_empty_desc(struct xsk_queue *q)
 {
-        return xskq_nb_free(q, q->prod_tail, 1) == q->nentries;
+        return xskq_nb_free(q, q->prod_tail, q->nentries) == q->nentries;
 }
 
 void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 69f06f879091..3110c3fbee20 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2215,6 +2215,9 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
 
+        if (IS_ERR(dst))
+                dst_release(dst_orig);
+
         return dst;
 }
 EXPORT_SYMBOL(xfrm_lookup_route);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5553724b5fcc..4791aa8b8185 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1057,10 +1057,12 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
 {
         struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
 
-        if (nlsk)
-                return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
-        else
-                return -1;
+        if (!nlsk) {
+                kfree_skb(skb);
+                return -EPIPE;
+        }
+
+        return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
 }
 
 static inline unsigned int xfrm_spdinfo_msgsize(void)
@@ -1711,9 +1713,11 @@ static inline unsigned int userpolicy_type_attrsize(void)
 #ifdef CONFIG_XFRM_SUB_POLICY
 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
 {
-        struct xfrm_userpolicy_type upt = {
-                .type = type,
-        };
+        struct xfrm_userpolicy_type upt;
+
+        /* Sadly there are two holes in struct xfrm_userpolicy_type */
+        memset(&upt, 0, sizeof(upt));
+        upt.type = type;
 
         return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
 }
diff --git a/tools/include/uapi/linux/btf.h b/tools/include/uapi/linux/btf.h
index 0b5ddbe135a4..972265f32871 100644
--- a/tools/include/uapi/linux/btf.h
+++ b/tools/include/uapi/linux/btf.h
@@ -76,7 +76,7 @@ struct btf_type {
  */
 #define BTF_INT_ENCODING(VAL)   (((VAL) & 0x0f000000) >> 24)
 #define BTF_INT_OFFSET(VAL)     (((VAL  & 0x00ff0000)) >> 16)
-#define BTF_INT_BITS(VAL)       ((VAL)  & 0x0000ffff)
+#define BTF_INT_BITS(VAL)       ((VAL)  & 0x000000ff)
 
 /* Attributes stored in the BTF_INT_ENCODING */
 #define BTF_INT_SIGNED  (1 << 0)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 03161be094b4..1622a309f169 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2,7 +2,6 @@
 /* Copyright (c) 2018 Facebook */
 
 #include <stdlib.h>
-#include <stdint.h>
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
@@ -32,17 +31,25 @@ struct btf {
         struct btf_type **types;
         const char *strings;
         void *nohdr_data;
-        uint32_t nr_types;
-        uint32_t types_size;
-        uint32_t data_size;
+        __u32 nr_types;
+        __u32 types_size;
+        __u32 data_size;
         int fd;
 };
 
+static const char *btf_name_by_offset(const struct btf *btf, __u32 offset)
+{
+        if (offset < btf->hdr->str_len)
+                return &btf->strings[offset];
+        else
+                return NULL;
+}
+
 static int btf_add_type(struct btf *btf, struct btf_type *t)
 {
         if (btf->types_size - btf->nr_types < 2) {
                 struct btf_type **new_types;
-                u32 expand_by, new_size;
+                __u32 expand_by, new_size;
 
                 if (btf->types_size == BTF_MAX_NR_TYPES)
                         return -E2BIG;
@@ -69,7 +76,7 @@ static int btf_add_type(struct btf *btf, struct btf_type *t)
 static int btf_parse_hdr(struct btf *btf, btf_print_fn_t err_log)
 {
         const struct btf_header *hdr = btf->hdr;
-        u32 meta_left;
+        __u32 meta_left;
 
         if (btf->data_size < sizeof(struct btf_header)) {
                 elog("BTF header not found\n");
@@ -148,7 +155,7 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
 
         while (next_type < end_type) {
                 struct btf_type *t = next_type;
-                uint16_t vlen = BTF_INFO_VLEN(t->info);
+                __u16 vlen = BTF_INFO_VLEN(t->info);
                 int err;
 
                 next_type += sizeof(*t);
@@ -187,6 +194,14 @@ static int btf_parse_type_sec(struct btf *btf, btf_print_fn_t err_log)
         return 0;
 }
 
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 type_id)
+{
+        if (type_id > btf->nr_types)
+                return NULL;
+
+        return btf->types[type_id];
+}
+
 static bool btf_type_is_void(const struct btf_type *t)
 {
         return t == &btf_void || BTF_INFO_KIND(t->info) == BTF_KIND_FWD;
@@ -197,7 +212,7 @@ static bool btf_type_is_void_or_null(const struct btf_type *t)
         return !t || btf_type_is_void(t);
 }
 
-static int64_t btf_type_size(const struct btf_type *t)
+static __s64 btf_type_size(const struct btf_type *t)
 {
         switch (BTF_INFO_KIND(t->info)) {
         case BTF_KIND_INT:
@@ -214,12 +229,12 @@ static int64_t btf_type_size(const struct btf_type *t)
 
 #define MAX_RESOLVE_DEPTH 32
 
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id)
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id)
 {
         const struct btf_array *array;
         const struct btf_type *t;
-        uint32_t nelems = 1;
-        int64_t size = -1;
+        __u32 nelems = 1;
+        __s64 size = -1;
         int i;
 
         t = btf__type_by_id(btf, type_id);
@@ -279,9 +294,9 @@ int btf__resolve_type(const struct btf *btf, __u32 type_id)
         return type_id;
 }
 
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name)
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name)
 {
-        uint32_t i;
+        __u32 i;
 
         if (!strcmp(type_name, "void"))
                 return 0;
@@ -310,10 +325,9 @@ void btf__free(struct btf *btf)
         free(btf);
 }
 
-struct btf *btf__new(uint8_t *data, uint32_t size,
-                     btf_print_fn_t err_log)
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log)
 {
-        uint32_t log_buf_size = 0;
+        __u32 log_buf_size = 0;
         char *log_buf = NULL;
         struct btf *btf;
         int err;
diff --git a/tools/lib/bpf/btf.h b/tools/lib/bpf/btf.h
index 24f361d99a5e..dd8a86eab8ca 100644
--- a/tools/lib/bpf/btf.h
+++ b/tools/lib/bpf/btf.h
@@ -4,19 +4,21 @@
 #ifndef __BPF_BTF_H
 #define __BPF_BTF_H
 
-#include <stdint.h>
+#include <linux/types.h>
 
 #define BTF_ELF_SEC ".BTF"
 
 struct btf;
+struct btf_type;
 
 typedef int (*btf_print_fn_t)(const char *, ...)
         __attribute__((format(printf, 1, 2)));
 
 void btf__free(struct btf *btf);
-struct btf *btf__new(uint8_t *data, uint32_t size, btf_print_fn_t err_log);
-int32_t btf__find_by_name(const struct btf *btf, const char *type_name);
-int64_t btf__resolve_size(const struct btf *btf, uint32_t type_id);
+struct btf *btf__new(__u8 *data, __u32 size, btf_print_fn_t err_log);
+__s32 btf__find_by_name(const struct btf *btf, const char *type_name);
+const struct btf_type *btf__type_by_id(const struct btf *btf, __u32 id);
+__s64 btf__resolve_size(const struct btf *btf, __u32 type_id);
 int btf__resolve_type(const struct btf *btf, __u32 type_id);
 int btf__fd(const struct btf *btf);
 const char *btf__name_by_offset(const struct btf *btf, __u32 offset);
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 955f8eafbf41..26e9527ee464 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -37,6 +37,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/bpf.h>
+#include <linux/btf.h>
 #include <linux/list.h>
 #include <linux/limits.h>
 #include <sys/stat.h>
@@ -170,8 +171,8 @@ struct bpf_map {
         size_t offset;
         int map_ifindex;
         struct bpf_map_def def;
-        uint32_t btf_key_type_id;
-        uint32_t btf_value_type_id;
+        __u32 btf_key_type_id;
+        __u32 btf_value_type_id;
         void *priv;
         bpf_map_clear_priv_t clear_priv;
 };
@@ -969,68 +970,72 @@ bpf_program__collect_reloc(struct bpf_program *prog, GElf_Shdr *shdr,
 
 static int bpf_map_find_btf_info(struct bpf_map *map, const struct btf *btf)
 {
+        const struct btf_type *container_type;
+        const struct btf_member *key, *value;
         struct bpf_map_def *def = &map->def;
         const size_t max_name = 256;
-        int64_t key_size, value_size;
-        int32_t key_id, value_id;
-        char name[max_name];
+        char container_name[max_name];
+        __s64 key_size, value_size;
+        __s32 container_id;
 
-        /* Find key type by name from BTF */
-        if (snprintf(name, max_name, "%s_key", map->name) == max_name) {
-                pr_warning("map:%s length of BTF key_type:%s_key is too long\n",
+        if (snprintf(container_name, max_name, "____btf_map_%s", map->name) ==
+            max_name) {
+                pr_warning("map:%s length of '____btf_map_%s' is too long\n",
                            map->name, map->name);
                 return -EINVAL;
         }
 
-        key_id = btf__find_by_name(btf, name);
-        if (key_id < 0) {
-                pr_debug("map:%s key_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return key_id;
+        container_id = btf__find_by_name(btf, container_name);
+        if (container_id < 0) {
+                pr_debug("map:%s container_name:%s cannot be found in BTF. Missing BPF_ANNOTATE_KV_PAIR?\n",
+                         map->name, container_name);
+                return container_id;
         }
 
-        key_size = btf__resolve_size(btf, key_id);
-        if (key_size < 0) {
-                pr_warning("map:%s key_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
-                return key_size;
+        container_type = btf__type_by_id(btf, container_id);
+        if (!container_type) {
+                pr_warning("map:%s cannot find BTF type for container_id:%u\n",
+                           map->name, container_id);
+                return -EINVAL;
         }
 
-        if (def->key_size != key_size) {
-                pr_warning("map:%s key_type:%s has BTF type_size:%u != key_size:%u\n",
-                           map->name, name, (unsigned int)key_size, def->key_size);
+        if (BTF_INFO_KIND(container_type->info) != BTF_KIND_STRUCT ||
+            BTF_INFO_VLEN(container_type->info) < 2) {
+                pr_warning("map:%s container_name:%s is an invalid container struct\n",
+                           map->name, container_name);
                 return -EINVAL;
         }
 
-        /* Find value type from BTF */
-        if (snprintf(name, max_name, "%s_value", map->name) == max_name) {
-                pr_warning("map:%s length of BTF value_type:%s_value is too long\n",
-                          map->name, map->name);
-                return -EINVAL;
+        key = (struct btf_member *)(container_type + 1);
+        value = key + 1;
+
+        key_size = btf__resolve_size(btf, key->type);
+        if (key_size < 0) {
+                pr_warning("map:%s invalid BTF key_type_size\n",
+                           map->name);
+                return key_size;
         }
 
-        value_id = btf__find_by_name(btf, name);
-        if (value_id < 0) {
-                pr_debug("map:%s value_type:%s cannot be found in BTF\n",
-                         map->name, name);
-                return value_id;
+        if (def->key_size != key_size) {
+                pr_warning("map:%s btf_key_type_size:%u != map_def_key_size:%u\n",
+                           map->name, (__u32)key_size, def->key_size);
+                return -EINVAL;
         }
 
-        value_size = btf__resolve_size(btf, value_id);
+        value_size = btf__resolve_size(btf, value->type);
         if (value_size < 0) {
-                pr_warning("map:%s value_type:%s cannot get the BTF type_size\n",
-                           map->name, name);
+                pr_warning("map:%s invalid BTF value_type_size\n", map->name);
                 return value_size;
         }
 
         if (def->value_size != value_size) {
-                pr_warning("map:%s value_type:%s has BTF type_size:%u != value_size:%u\n",
-                           map->name, name, (unsigned int)value_size, def->value_size);
+                pr_warning("map:%s btf_value_type_size:%u != map_def_value_size:%u\n",
+                           map->name, (__u32)value_size, def->value_size);
                 return -EINVAL;
         }
 
-        map->btf_key_type_id = key_id;
-        map->btf_value_type_id = value_id;
+        map->btf_key_type_id = key->type;
+        map->btf_value_type_id = value->type;
 
         return 0;
 }
@@ -2141,12 +2146,12 @@ const char *bpf_map__name(struct bpf_map *map)
         return map ? map->name : NULL;
 }
 
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_key_type_id : 0;
 }
 
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map)
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map)
 {
         return map ? map->btf_value_type_id : 0;
 }
@@ -2333,8 +2338,8 @@ bpf_perf_event_read_simple(void *mem, unsigned long size,
         volatile struct perf_event_mmap_page *header = mem;
         __u64 data_tail = header->data_tail;
         __u64 data_head = header->data_head;
+        int ret = LIBBPF_PERF_EVENT_ERROR;
         void *base, *begin, *end;
-        int ret;
 
         asm volatile("" ::: "memory"); /* in real code it should be smp_rmb() */
         if (data_head == data_tail)
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 1f8fc2060460..413778a93499 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -254,8 +254,8 @@ bpf_map__next(struct bpf_map *map, struct bpf_object *obj);
 int bpf_map__fd(struct bpf_map *map);
 const struct bpf_map_def *bpf_map__def(struct bpf_map *map);
 const char *bpf_map__name(struct bpf_map *map);
-uint32_t bpf_map__btf_key_type_id(const struct bpf_map *map);
-uint32_t bpf_map__btf_value_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_key_type_id(const struct bpf_map *map);
+__u32 bpf_map__btf_value_type_id(const struct bpf_map *map);
 
 typedef void (*bpf_map_clear_priv_t)(struct bpf_map *, void *);
 int bpf_map__set_priv(struct bpf_map *map, void *priv,
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index d39e4ff7d0bf..a6db83a88e85 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -106,7 +106,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBC1%, C2%, C3%\fP The residency percentage that Linux requested C1, C2, C3....  The system summary is the average of all CPUs in the system.  Note that these are software, reflecting what was requested.  The hardware counters reflect what was actually achieved.
 \fBCPU%c1, CPU%c3, CPU%c6, CPU%c7\fP show the percentage residency in hardware core idle states.  These numbers are from hardware residency counters.
 \fBCoreTmp\fP Degrees Celsius reported by the per-core Digital Thermal Sensor.
-\fBPkgTtmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
+\fBPkgTmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
 \fBGFX%rc6\fP The percentage of time the GPU is in the "render C6" state, rc6, during the measurement interval. From /sys/class/drm/card0/power/rc6_residency_ms.
 \fBGFXMHz\fP Instantaneous snapshot of what sysfs presents at the end of the measurement interval. From /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz.
 \fBPkg%pc2, Pkg%pc3, Pkg%pc6, Pkg%pc7\fP percentage residency in hardware package idle states.  These numbers are from hardware residency counters.
@@ -114,7 +114,7 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBCorWatt\fP Watts consumed by the core part of the package.
 \fBGFXWatt\fP Watts consumed by the Graphics part of the package -- available only on client processors.
 \fBRAMWatt\fP Watts consumed by the DRAM DIMMS -- available only on server processors.
-\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.
+\fBPKG_%\fP percent of the interval that RAPL throttling was active on the Package.  Note that the system summary is the sum of the package throttling time, and thus may be higher than 100% on a multi-package system.  Note that the meaning of this field is model specific.  For example, some hardware increments this counter when RAPL responds to thermal limits, but does not increment this counter when RAPL responds to power limits.  Comparing PkgWatt and PkgTmp to system limits is necessary.
 \fBRAM_%\fP percent of the interval that RAPL throttling was active on DRAM.
 .fi
 .SH TOO MUCH INFORMATION EXAMPLE
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 4d14bbbf9b63..980bd9d20646 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1163,9 +1163,7 @@ void format_all_counters(struct thread_data *t, struct core_data *c, struct pkg_
         if (!printed || !summary_only)
                 print_header("\t");
 
-        if (topo.num_cpus > 1)
-                format_counters(&average.threads, &average.cores,
-                        &average.packages);
+        format_counters(&average.threads, &average.cores, &average.packages);
 
         printed = 1;
 
@@ -1692,7 +1690,7 @@ void get_apic_id(struct thread_data *t)
         t->x2apic_id = edx;
 
         if (debug && (t->apic_id != t->x2apic_id))
-                fprintf(stderr, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
+                fprintf(outf, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
 }
 
 /*
@@ -2473,55 +2471,43 @@ int get_core_id(int cpu)
 
 void set_node_data(void)
 {
-        char path[80];
-        FILE *filep;
-        int pkg, node, cpu;
-
-        struct pkg_node_info {
-                int count;
-                int min;
-        } *pni;
-
-        pni = calloc(topo.num_packages, sizeof(struct pkg_node_info));
-        if (!pni)
-                err(1, "calloc pkg_node_count");
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                pni[pkg].min = topo.num_cpus;
-
-        for (node = 0; node <= topo.max_node_num; node++) {
-                /* find the "first" cpu in the node */
-                sprintf(path, "/sys/bus/node/devices/node%d/cpulist", node);
-                filep = fopen(path, "r");
-                if (!filep)
-                        continue;
-                fscanf(filep, "%d", &cpu);
-                fclose(filep);
-
-                pkg = cpus[cpu].physical_package_id;
-                pni[pkg].count++;
-
-                if (node < pni[pkg].min)
-                        pni[pkg].min = node;
-        }
-
-        for (pkg = 0; pkg < topo.num_packages; pkg++)
-                if (pni[pkg].count > topo.nodes_per_pkg)
-                        topo.nodes_per_pkg = pni[0].count;
-
-        /* Fake 1 node per pkg for machines that don't
-         * expose nodes and thus avoid -nan results
-         */
-        if (topo.nodes_per_pkg == 0)
-                topo.nodes_per_pkg = 1;
-
-        for (cpu = 0; cpu < topo.num_cpus; cpu++) {
-                pkg = cpus[cpu].physical_package_id;
-                node = cpus[cpu].physical_node_id;
-                cpus[cpu].logical_node_id = node - pni[pkg].min;
+        int pkg, node, lnode, cpu, cpux;
+        int cpu_count;
+
+        /* initialize logical_node_id */
+        for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu)
+                cpus[cpu].logical_node_id = -1;
+
+        cpu_count = 0;
+        for (pkg = 0; pkg < topo.num_packages; pkg++) {
+                lnode = 0;
+                for (cpu = 0; cpu <= topo.max_cpu_num; ++cpu) {
+                        if (cpus[cpu].physical_package_id != pkg)
+                                continue;
+                        /* find a cpu with an unset logical_node_id */
+                        if (cpus[cpu].logical_node_id != -1)
+                                continue;
+                        cpus[cpu].logical_node_id = lnode;
+                        node = cpus[cpu].physical_node_id;
+                        cpu_count++;
+                        /*
+                         * find all matching cpus on this pkg and set
+                         * the logical_node_id
+                         */
+                        for (cpux = cpu; cpux <= topo.max_cpu_num; cpux++) {
+                                if ((cpus[cpux].physical_package_id == pkg) &&
+                                   (cpus[cpux].physical_node_id == node)) {
+                                        cpus[cpux].logical_node_id = lnode;
+                                        cpu_count++;
+                                }
+                        }
+                        lnode++;
+                        if (lnode > topo.nodes_per_pkg)
+                                topo.nodes_per_pkg = lnode;
+                }
+                if (cpu_count >= topo.max_cpu_num)
+                        break;
         }
-        free(pni);
-
 }
 
 int get_physical_node_id(struct cpu_topology *thiscpu)
@@ -4471,7 +4457,9 @@ void process_cpuid()
         family = (fms >> 8) & 0xf;
         model = (fms >> 4) & 0xf;
         stepping = fms & 0xf;
-        if (family == 6 || family == 0xf)
+        if (family == 0xf)
+                family += (fms >> 20) & 0xff;
+        if (family >= 6)
                 model += ((fms >> 16) & 0xf) << 4;
 
         if (!quiet) {
@@ -4840,16 +4828,8 @@ void topology_probe()
                 siblings = get_thread_siblings(&cpus[i]);
                 if (siblings > max_siblings)
                         max_siblings = siblings;
-                if (cpus[i].thread_id != -1)
+                if (cpus[i].thread_id == 0)
                         topo.num_cores++;
-
-                if (debug > 1)
-                        fprintf(outf,
-                                "cpu %d pkg %d node %d core %d thread %d\n",
-                                i, cpus[i].physical_package_id,
-                                cpus[i].physical_node_id,
-                                cpus[i].physical_core_id,
-                                cpus[i].thread_id);
         }
 
         topo.cores_per_node = max_core_id + 1;
@@ -4875,6 +4855,20 @@ void topology_probe()
         topo.threads_per_core = max_siblings;
         if (debug > 1)
                 fprintf(outf, "max_siblings %d\n", max_siblings);
+
+        if (debug < 1)
+                return;
+
+        for (i = 0; i <= topo.max_cpu_num; ++i) {
+                fprintf(outf,
+                        "cpu %d pkg %d node %d lnode %d core %d thread %d\n",
+                        i, cpus[i].physical_package_id,
+                        cpus[i].physical_node_id,
+                        cpus[i].logical_node_id,
+                        cpus[i].physical_core_id,
+                        cpus[i].thread_id);
+        }
+
 }
 
 void
@@ -5102,7 +5096,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 18.06.20"
+        fprintf(outf, "turbostat version 18.07.27"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index f2f28b6c8915..810de20e8e26 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -158,6 +158,15 @@ struct bpf_map_def {
         unsigned int numa_node;
 };
 
+#define BPF_ANNOTATE_KV_PAIR(name, type_key, type_val)          \
+        struct ____btf_map_##name {                             \
+                type_key key;                                   \
+                type_val value;                                 \
+        };                                                      \
+        struct ____btf_map_##name                               \
+        __attribute__ ((section(".maps." #name), used))         \
+                ____btf_map_##name = { }
+
 static int (*bpf_skb_load_bytes)(void *ctx, int off, void *to, int len) =
         (void *) BPF_FUNC_skb_load_bytes;
 static int (*bpf_skb_store_bytes)(void *ctx, int off, void *from, int len, int flags) =
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 3619f3023088..ffdd27737c9e 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -247,6 +247,34 @@ static struct btf_raw_test raw_tests[] = {
         .max_entries = 4,
 },
 
+{
+        .descr = "struct test #3 Invalid member offset",
+        .raw_types = {
+                /* int */                                       /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* int64 */                                     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 64, 8),
+
+                /* struct A { */                                /* [3] */
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 2), 16),
+                BTF_MEMBER_ENC(NAME_TBD, 1, 64),        /* int m;               */
+                BTF_MEMBER_ENC(NAME_TBD, 2, 0),         /* int64 n; */
+                /* } */
+                BTF_END_RAW,
+        },
+        .str_sec = "\0A\0m\0n\0",
+        .str_sec_size = sizeof("\0A\0m\0n\0"),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "struct_test3_map",
+        .key_size = sizeof(int),
+        .value_size = 16,
+        .key_type_id = 1,
+        .value_type_id = 3,
+        .max_entries = 4,
+        .btf_load_err = true,
+        .err_str = "Invalid member bits_offset",
+},
+
 /* Test member exceeds the size of struct.
  *
  * struct A {
@@ -479,7 +507,7 @@ static struct btf_raw_test raw_tests[] = {
         .key_size = sizeof(int),
         .value_size = sizeof(void *) * 4,
         .key_type_id = 1,
-        .value_type_id = 4,
+        .value_type_id = 5,
         .max_entries = 4,
 },
 
@@ -1264,6 +1292,88 @@ static struct btf_raw_test raw_tests[] = {
         .err_str = "type != 0",
 },
 
+{
+        .descr = "arraymap invalid btf key (a bit field)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 32 bit int with 32 bit offset */     /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 32, 32, 8),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf key (!= 32 bits)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                /* 16 bit int with 0 bit offset */      /* [2] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 16, 2),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        .value_size = sizeof(int),
+        .key_type_id = 2,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too small)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size < map->value_size */
+        .value_size = sizeof(__u64),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
+{
+        .descr = "arraymap invalid btf value (too big)",
+        .raw_types = {
+                /* int */                               /* [1] */
+                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+                BTF_END_RAW,
+        },
+        .str_sec = "",
+        .str_sec_size = sizeof(""),
+        .map_type = BPF_MAP_TYPE_ARRAY,
+        .map_name = "array_map_check_btf",
+        .key_size = sizeof(int),
+        /* btf_value_size > map->value_size */
+        .value_size = sizeof(__u16),
+        .key_type_id = 1,
+        .value_type_id = 1,
+        .max_entries = 4,
+        .map_create_err = true,
+},
+
 }; /* struct btf_raw_test raw_tests[] */
 
 static const char *get_next_str(const char *start, const char *end)
@@ -2023,7 +2133,7 @@ static struct btf_raw_test pprint_test = {
                 BTF_ENUM_ENC(NAME_TBD, 2),
                 BTF_ENUM_ENC(NAME_TBD, 3),
                 /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 28),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 32),
                 BTF_MEMBER_ENC(NAME_TBD, 11, 0),        /* uint32_t ui32 */
                 BTF_MEMBER_ENC(NAME_TBD, 10, 32),       /* uint16_t ui16 */
                 BTF_MEMBER_ENC(NAME_TBD, 12, 64),       /* int32_t si32 */
diff --git a/tools/testing/selftests/bpf/test_btf_haskv.c b/tools/testing/selftests/bpf/test_btf_haskv.c
index 8c7ca096ecf2..b21b876f475d 100644
--- a/tools/testing/selftests/bpf/test_btf_haskv.c
+++ b/tools/testing/selftests/bpf/test_btf_haskv.c
@@ -10,11 +10,6 @@ struct ipv_counts {
         unsigned int v6;
 };
 
-typedef int btf_map_key;
-typedef struct ipv_counts btf_map_value;
-btf_map_key dumm_key;
-btf_map_value dummy_value;
-
 struct bpf_map_def SEC("maps") btf_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(int),
@@ -22,6 +17,8 @@ struct bpf_map_def SEC("maps") btf_map = {
         .max_entries = 4,
 };
 
+BPF_ANNOTATE_KV_PAIR(btf_map, int, struct ipv_counts);
+
 struct dummy_tracepoint_args {
         unsigned long long pad;
         struct sock *sock;
diff --git a/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc
new file mode 100644
index 000000000000..3b1f45e13a2e
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/00basic/snapshot.tc
@@ -0,0 +1,28 @@
+#!/bin/sh
+# description: Snapshot and tracing setting
+# flags: instance
+
+[ ! -f snapshot ] && exit_unsupported
+
+echo "Set tracing off"
+echo 0 > tracing_on
+
+echo "Allocate and take a snapshot"
+echo 1 > snapshot
+
+# Since trace buffer is empty, snapshot is also empty, but allocated
+grep -q "Snapshot is allocated" snapshot
+
+echo "Ensure keep tracing off"
+test `cat tracing_on` -eq 0
+
+echo "Set tracing on"
+echo 1 > tracing_on
+
+echo "Take a snapshot again"
+echo 1 > snapshot
+
+echo "Ensure keep tracing on"
+test `cat tracing_on` -eq 1
+
+exit 0
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index 95dd14648ba5..0f395dfb7774 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -44,12 +44,25 @@
 
 /******************** Little Endian Handling ********************************/
 
-#define cpu_to_le16(x)  htole16(x)
-#define cpu_to_le32(x)  htole32(x)
+/*
+ * cpu_to_le16/32 are used when initializing structures, a context where a
+ * function call is not allowed. To solve this, we code cpu_to_le16/32 in a way
+ * that allows them to be used when initializing structures.
+ */
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define cpu_to_le16(x)  (x)
+#define cpu_to_le32(x)  (x)
+#else
+#define cpu_to_le16(x)  ((((x) >> 8) & 0xffu) | (((x) & 0xffu) << 8))
+#define cpu_to_le32(x)  \
+        ((((x) & 0xff000000u) >> 24) | (((x) & 0x00ff0000u) >>  8) | \
+        (((x) & 0x0000ff00u) <<  8) | (((x) & 0x000000ffu) << 24))
+#endif
+
 #define le32_to_cpu(x)  le32toh(x)
 #define le16_to_cpu(x)  le16toh(x)
 
-
 /******************** Messages and Errors ***********************************/
 
 static const char argv0[] = "ffs-test";
diff --git a/tools/virtio/asm/barrier.h b/tools/virtio/asm/barrier.h
index 0ac3caf90877..d0351f83aebe 100644
--- a/tools/virtio/asm/barrier.h
+++ b/tools/virtio/asm/barrier.h
@@ -13,8 +13,8 @@
 } while (0);
 /* Weak barriers should be used. If not - it's a bug */
 # define mb() abort()
-# define rmb() abort()
-# define wmb() abort()
+# define dma_rmb() abort()
+# define dma_wmb() abort()
 #else
 #error Please fill in barrier macros
 #endif
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index fca8381bbe04..fb22bccfbc8a 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -52,6 +52,11 @@ static inline void *kmalloc(size_t s, gfp_t gfp)
                 return __kmalloc_fake;
         return malloc(s);
 }
+static inline void *kmalloc_array(unsigned n, size_t s, gfp_t gfp)
+{
+        return kmalloc(n * s, gfp);
+}
+
 static inline void *kzalloc(size_t s, gfp_t gfp)
 {
         void *p = kmalloc(s, gfp);