340 files changed, 2993 insertions, 1972 deletions

diff --git a/Documentation/networking/msg_zerocopy.rst b/Documentation/networking/msg_zerocopy.rst
index fe46d4867e2d..18c1415e7bfa 100644
--- a/Documentation/networking/msg_zerocopy.rst
+++ b/Documentation/networking/msg_zerocopy.rst
@@ -7,7 +7,7 @@ Intro
 =====
 
 The MSG_ZEROCOPY flag enables copy avoidance for socket send calls.
-The feature is currently implemented for TCP sockets.
+The feature is currently implemented for TCP and UDP sockets.
 
 
 Opportunity and Caveats
diff --git a/Documentation/networking/operstates.txt b/Documentation/networking/operstates.txt
index 355c6d8ef8ad..b203d1334822 100644
--- a/Documentation/networking/operstates.txt
+++ b/Documentation/networking/operstates.txt
@@ -22,8 +22,9 @@ and changeable from userspace under certain rules.
 2. Querying from userspace
 
 Both admin and operational state can be queried via the netlink
-operation RTM_GETLINK. It is also possible to subscribe to RTMGRP_LINK
-to be notified of updates. This is important for setting from userspace.
+operation RTM_GETLINK. It is also possible to subscribe to RTNLGRP_LINK
+to be notified of updates while the interface is admin up. This is
+important for setting from userspace.
 
 These values contain interface state:
 
@@ -101,8 +102,9 @@ because some driver controlled protocol establishment has to
 complete. Corresponding functions are netif_dormant_on() to set the
 flag, netif_dormant_off() to clear it and netif_dormant() to query.
 
-On device allocation, networking core sets the flags equivalent to
-netif_carrier_ok() and !netif_dormant().
+On device allocation, both flags __LINK_STATE_NOCARRIER and
+__LINK_STATE_DORMANT are cleared, so the effective state is equivalent
+to netif_carrier_ok() and !netif_dormant().
 
 
 Whenever the driver CHANGES one of these flags, a workqueue event is
@@ -133,11 +135,11 @@ netif_carrier_ok() && !netif_dormant() is set by the
 driver. Afterwards, the userspace application can set IFLA_OPERSTATE
 to IF_OPER_DORMANT or IF_OPER_UP as long as the driver does not set
 netif_carrier_off() or netif_dormant_on(). Changes made by userspace
-are multicasted on the netlink group RTMGRP_LINK.
+are multicasted on the netlink group RTNLGRP_LINK.
 
 So basically a 802.1X supplicant interacts with the kernel like this:
 
--subscribe to RTMGRP_LINK
+-subscribe to RTNLGRP_LINK
 -set IFLA_LINKMODE to 1 via RTM_SETLINK
 -query RTM_GETLINK once to get initial state
 -if initial flags are not (IFF_LOWER_UP && !IFF_DORMANT), wait until
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 58649bd4fcfc..ebc679bcb2dc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -80,7 +80,9 @@ nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
 
 nr_negative shows the number of unused dentries that are also
-negative dentries which do not mapped to actual files.
+negative dentries which do not map to any files. Instead,
+they help speeding up rejection of non-existing files provided
+by the users.
 
 ==============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 9919840d54cd..41ce5f4ad838 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6151,7 +6151,7 @@ FREESCALE SOC SOUND DRIVERS
 M:      Timur Tabi <timur@kernel.org>
 M:      Nicolin Chen <nicoleotsuka@gmail.com>
 M:      Xiubo Li <Xiubo.Lee@gmail.com>
-R:      Fabio Estevam <fabio.estevam@nxp.com>
+R:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Maintained
@@ -10898,7 +10898,7 @@ F:	include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
 
 NXP SGTL5000 DRIVER
-M:      Fabio Estevam <fabio.estevam@nxp.com>
+M:      Fabio Estevam <festevam@gmail.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Maintained
 F:      Documentation/devicetree/bindings/sound/sgtl5000.txt
diff --git a/Makefile b/Makefile
index 86cf35d1d79d..96c5335e7ee4 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Shy Crocodile
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/irq.h b/arch/alpha/include/asm/irq.h
index 4d17cacd1462..432402c8e47f 100644
--- a/arch/alpha/include/asm/irq.h
+++ b/arch/alpha/include/asm/irq.h
@@ -56,15 +56,15 @@
 
 #elif defined(CONFIG_ALPHA_DP264) || \
       defined(CONFIG_ALPHA_LYNX)  || \
-      defined(CONFIG_ALPHA_SHARK) || \
-      defined(CONFIG_ALPHA_EIGER)
+      defined(CONFIG_ALPHA_SHARK)
 # define NR_IRQS        64
 
 #elif defined(CONFIG_ALPHA_TITAN)
 #define NR_IRQS         80
 
 #elif defined(CONFIG_ALPHA_RAWHIDE) || \
-        defined(CONFIG_ALPHA_TAKARA)
+      defined(CONFIG_ALPHA_TAKARA) || \
+      defined(CONFIG_ALPHA_EIGER)
 # define NR_IRQS        128
 
 #elif defined(CONFIG_ALPHA_WILDFIRE)
diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
index d73dc473fbb9..188fc9256baf 100644
--- a/arch/alpha/mm/fault.c
+++ b/arch/alpha/mm/fault.c
@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *next_mm)
 /* Macro for exception fixup code to access integer registers.  */
 #define dpf_reg(r)                                                      \
         (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 :  \
-                                 (r) <= 18 ? (r)+8 : (r)-10])
+                                 (r) <= 18 ? (r)+10 : (r)-10])
 
 asmlinkage void
 do_page_fault(unsigned long address, unsigned long mmcsr,
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 664e918e2624..26524b75970a 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1400,6 +1400,7 @@ config NR_CPUS
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs"
         depends on SMP
+        select GENERIC_IRQ_MIGRATION
         help
           Say Y here to experiment with turning CPUs off and on.  CPUs
           can be controlled through /sys/devices/system/cpu.
diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
index 04758a2a87f0..67d77eee9433 100644
--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
+++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
@@ -644,6 +644,17 @@
         };
 };
 
+/* Configure pwm clock source for timers 8 & 9 */
+&timer8 {
+        assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>;
+        assigned-clock-parents = <&sys_clkin_ck>;
+};
+
+&timer9 {
+        assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>;
+        assigned-clock-parents = <&sys_clkin_ck>;
+};
+
 /*
  * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for
  * uart1 wakeirq.
diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
index bc853ebeda22..61a06f6add3c 100644
--- a/arch/arm/boot/dts/omap5-board-common.dtsi
+++ b/arch/arm/boot/dts/omap5-board-common.dtsi
@@ -317,7 +317,8 @@
 
         palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
                 pinctrl-single,pins = <
-                        OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0) /* sys_nirq1 */
+                        /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
+                        OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
                 >;
         };
 
@@ -385,7 +386,8 @@
 
         palmas: palmas@48 {
                 compatible = "ti,palmas";
-                interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
+                /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
+                interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
                 reg = <0x48>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
@@ -651,7 +653,8 @@
                 pinctrl-names = "default";
                 pinctrl-0 = <&twl6040_pins>;
 
-                interrupts = <GIC_SPI 119 IRQ_TYPE_NONE>; /* IRQ_SYS_2N cascaded to gic */
+                /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
+                interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_LOW>;
 
                 /* audpwron gpio defined in the board specific dts */
 
diff --git a/arch/arm/boot/dts/omap5-cm-t54.dts b/arch/arm/boot/dts/omap5-cm-t54.dts
index 5e21fb430a65..e78d3718f145 100644
--- a/arch/arm/boot/dts/omap5-cm-t54.dts
+++ b/arch/arm/boot/dts/omap5-cm-t54.dts
@@ -181,6 +181,13 @@
                         OMAP5_IOPAD(0x0042, PIN_INPUT_PULLDOWN | MUX_MODE6)  /* llib_wakereqin.gpio1_wk15 */
                 >;
         };
+
+        palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
+                pinctrl-single,pins = <
+                        /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
+                        OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
+                >;
+        };
 };
 
 &omap5_pmx_core {
@@ -414,8 +421,11 @@
 
         palmas: palmas@48 {
                 compatible = "ti,palmas";
-                interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
                 reg = <0x48>;
+                pinctrl-0 = <&palmas_sys_nirq_pins>;
+                pinctrl-names = "default";
+                /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
+                interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 ti,system-power-controller;
diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
index 4acb501dd3f8..3ed49898f4b2 100644
--- a/arch/arm/boot/dts/rk3188.dtsi
+++ b/arch/arm/boot/dts/rk3188.dtsi
@@ -719,7 +719,6 @@
                         pm_qos = <&qos_lcdc0>,
                                  <&qos_lcdc1>,
                                  <&qos_cif0>,
-                                 <&qos_cif1>,
                                  <&qos_ipp>,
                                  <&qos_rga>;
                 };
diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h
index c883fcbe93b6..46d41140df27 100644
--- a/arch/arm/include/asm/irq.h
+++ b/arch/arm/include/asm/irq.h
@@ -25,7 +25,6 @@
 #ifndef __ASSEMBLY__
 struct irqaction;
 struct pt_regs;
-extern void migrate_irqs(void);
 
 extern void asm_do_IRQ(unsigned int, struct pt_regs *);
 void handle_IRQ(unsigned int, struct pt_regs *);
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index ca56537b61bc..50e89869178a 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -48,6 +48,7 @@
 #define KVM_REQ_SLEEP \
         KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
 #define KVM_REQ_IRQ_PENDING     KVM_ARCH_REQ(1)
+#define KVM_REQ_VCPU_RESET      KVM_ARCH_REQ(2)
 
 DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
 
@@ -147,6 +148,13 @@ struct kvm_cpu_context {
 
 typedef struct kvm_cpu_context kvm_cpu_context_t;
 
+struct vcpu_reset_state {
+        unsigned long   pc;
+        unsigned long   r0;
+        bool            be;
+        bool            reset;
+};
+
 struct kvm_vcpu_arch {
         struct kvm_cpu_context ctxt;
 
@@ -186,6 +194,8 @@ struct kvm_vcpu_arch {
         /* Cache some mmu pages needed inside spinlock regions */
         struct kvm_mmu_memory_cache mmu_page_cache;
 
+        struct vcpu_reset_state reset_state;
+
         /* Detect first run of a vcpu */
         bool has_run_once;
 };
diff --git a/arch/arm/include/asm/stage2_pgtable.h b/arch/arm/include/asm/stage2_pgtable.h
index c4b1d4fb1797..de2089501b8b 100644
--- a/arch/arm/include/asm/stage2_pgtable.h
+++ b/arch/arm/include/asm/stage2_pgtable.h
@@ -76,4 +76,9 @@ static inline bool kvm_stage2_has_pud(struct kvm *kvm)
 #define S2_PMD_MASK                             PMD_MASK
 #define S2_PMD_SIZE                             PMD_SIZE
 
+static inline bool kvm_stage2_has_pmd(struct kvm *kvm)
+{
+        return true;
+}
+
 #endif  /* __ARM_S2_PGTABLE_H_ */
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 9908dacf9229..844861368cd5 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -31,7 +31,6 @@
 #include <linux/smp.h>
 #include <linux/init.h>
 #include <linux/seq_file.h>
-#include <linux/ratelimit.h>
 #include <linux/errno.h>
 #include <linux/list.h>
 #include <linux/kallsyms.h>
@@ -109,64 +108,3 @@ int __init arch_probe_nr_irqs(void)
         return nr_irqs;
 }
 #endif
-
-#ifdef CONFIG_HOTPLUG_CPU
-static bool migrate_one_irq(struct irq_desc *desc)
-{
-        struct irq_data *d = irq_desc_get_irq_data(desc);
-        const struct cpumask *affinity = irq_data_get_affinity_mask(d);
-        struct irq_chip *c;
-        bool ret = false;
-
-        /*
-         * If this is a per-CPU interrupt, or the affinity does not
-         * include this CPU, then we have nothing to do.
-         */
-        if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity))
-                return false;
-
-        if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
-                affinity = cpu_online_mask;
-                ret = true;
-        }
-
-        c = irq_data_get_irq_chip(d);
-        if (!c->irq_set_affinity)
-                pr_debug("IRQ%u: unable to set affinity\n", d->irq);
-        else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
-                cpumask_copy(irq_data_get_affinity_mask(d), affinity);
-
-        return ret;
-}
-
-/*
- * The current CPU has been marked offline.  Migrate IRQs off this CPU.
- * If the affinity settings do not allow other CPUs, force them onto any
- * available CPU.
- *
- * Note: we must iterate over all IRQs, whether they have an attached
- * action structure or not, as we need to get chained interrupts too.
- */
-void migrate_irqs(void)
-{
-        unsigned int i;
-        struct irq_desc *desc;
-        unsigned long flags;
-
-        local_irq_save(flags);
-
-        for_each_irq_desc(i, desc) {
-                bool affinity_broken;
-
-                raw_spin_lock(&desc->lock);
-                affinity_broken = migrate_one_irq(desc);
-                raw_spin_unlock(&desc->lock);
-
-                if (affinity_broken)
-                        pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n",
-                                i, smp_processor_id());
-        }
-
-        local_irq_restore(flags);
-}
-#endif /* CONFIG_HOTPLUG_CPU */
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 3bf82232b1be..1d6f5ea522f4 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -254,7 +254,7 @@ int __cpu_disable(void)
         /*
          * OK - migrate IRQs away from this CPU
          */
-        migrate_irqs();
+        irq_migrate_all_off_this_cpu();
 
         /*
          * Flush user cache and TLB mappings, and then remove this CPU
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 222c1635bc7a..e8bd288fd5be 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -1450,6 +1450,6 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
         reset_coproc_regs(vcpu, table, num);
 
         for (num = 1; num < NR_CP15_REGS; num++)
-                if (vcpu_cp15(vcpu, num) == 0x42424242)
-                        panic("Didn't reset vcpu_cp15(vcpu, %zi)", num);
+                WARN(vcpu_cp15(vcpu, num) == 0x42424242,
+                     "Didn't reset vcpu_cp15(vcpu, %zi)", num);
 }
diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c
index 5ed0c3ee33d6..e53327912adc 100644
--- a/arch/arm/kvm/reset.c
+++ b/arch/arm/kvm/reset.c
@@ -26,6 +26,7 @@
 #include <asm/cputype.h>
 #include <asm/kvm_arm.h>
 #include <asm/kvm_coproc.h>
+#include <asm/kvm_emulate.h>
 
 #include <kvm/arm_arch_timer.h>
 
@@ -69,6 +70,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
         /* Reset CP15 registers */
         kvm_reset_coprocs(vcpu);
 
+        /*
+         * Additional reset state handling that PSCI may have imposed on us.
+         * Must be done after all the sys_reg reset.
+         */
+        if (READ_ONCE(vcpu->arch.reset_state.reset)) {
+                unsigned long target_pc = vcpu->arch.reset_state.pc;
+
+                /* Gracefully handle Thumb2 entry point */
+                if (target_pc & 1) {
+                        target_pc &= ~1UL;
+                        vcpu_set_thumb(vcpu);
+                }
+
+                /* Propagate caller endianness */
+                if (vcpu->arch.reset_state.be)
+                        kvm_vcpu_set_be(vcpu);
+
+                *vcpu_pc(vcpu) = target_pc;
+                vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
+
+                vcpu->arch.reset_state.reset = false;
+        }
+
         /* Reset arch_timer context */
         return kvm_timer_vcpu_reset(vcpu);
 }
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index a8b291f00109..dae514c8276a 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -152,6 +152,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
         mpuss_can_lose_context = (cx->mpu_state == PWRDM_POWER_RET) &&
                                  (cx->mpu_logic_state == PWRDM_POWER_OFF);
 
+        /* Enter broadcast mode for periodic timers */
+        tick_broadcast_enable();
+
+        /* Enter broadcast mode for one-shot timers */
         tick_broadcast_enter();
 
         /*
@@ -218,15 +222,6 @@ fail:
         return index;
 }
 
-/*
- * For each cpu, setup the broadcast timer because local timers
- * stops for the states above C1.
- */
-static void omap_setup_broadcast_timer(void *arg)
-{
-        tick_broadcast_enable();
-}
-
 static struct cpuidle_driver omap4_idle_driver = {
         .name                           = "omap4_idle",
         .owner                          = THIS_MODULE,
@@ -319,8 +314,5 @@ int __init omap4_idle_init(void)
         if (!cpu_clkdm[0] || !cpu_clkdm[1])
                 return -ENODEV;
 
-        /* Configure the broadcast timer on each cpu */
-        on_each_cpu(omap_setup_broadcast_timer, NULL, 1);
-
         return cpuidle_register(idle_driver, cpu_online_mask);
 }
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index f86b72d1d59e..1444b4b4bd9f 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -83,6 +83,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)
         u32 enable_mask, enable_shift;
         u32 pipd_mask, pipd_shift;
         u32 reg;
+        int ret;
 
         if (dsi_id == 0) {
                 enable_mask = OMAP4_DSI1_LANEENABLE_MASK;
@@ -98,7 +99,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)
                 return -ENODEV;
         }
 
-        regmap_read(omap4_dsi_mux_syscon, OMAP4_DSIPHY_SYSCON_OFFSET, &reg);
+        ret = regmap_read(omap4_dsi_mux_syscon,
+                                          OMAP4_DSIPHY_SYSCON_OFFSET,
+                                          &reg);
+        if (ret)
+                return ret;
 
         reg &= ~enable_mask;
         reg &= ~pipd_mask;
diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
index fc5fb776a710..17558be4bf0a 100644
--- a/arch/arm/mach-omap2/omap-wakeupgen.c
+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
@@ -50,6 +50,9 @@
 #define OMAP4_NR_BANKS          4
 #define OMAP4_NR_IRQS           128
 
+#define SYS_NIRQ1_EXT_SYS_IRQ_1 7
+#define SYS_NIRQ2_EXT_SYS_IRQ_2 119
+
 static void __iomem *wakeupgen_base;
 static void __iomem *sar_base;
 static DEFINE_RAW_SPINLOCK(wakeupgen_lock);
@@ -153,6 +156,37 @@ static void wakeupgen_unmask(struct irq_data *d)
         irq_chip_unmask_parent(d);
 }
 
+/*
+ * The sys_nirq pins bypass peripheral modules and are wired directly
+ * to MPUSS wakeupgen. They get automatically inverted for GIC.
+ */
+static int wakeupgen_irq_set_type(struct irq_data *d, unsigned int type)
+{
+        bool inverted = false;
+
+        switch (type) {
+        case IRQ_TYPE_LEVEL_LOW:
+                type &= ~IRQ_TYPE_LEVEL_MASK;
+                type |= IRQ_TYPE_LEVEL_HIGH;
+                inverted = true;
+                break;
+        case IRQ_TYPE_EDGE_FALLING:
+                type &= ~IRQ_TYPE_EDGE_BOTH;
+                type |= IRQ_TYPE_EDGE_RISING;
+                inverted = true;
+                break;
+        default:
+                break;
+        }
+
+        if (inverted && d->hwirq != SYS_NIRQ1_EXT_SYS_IRQ_1 &&
+            d->hwirq != SYS_NIRQ2_EXT_SYS_IRQ_2)
+                pr_warn("wakeupgen: irq%li polarity inverted in dts\n",
+                        d->hwirq);
+
+        return irq_chip_set_type_parent(d, type);
+}
+
 #ifdef CONFIG_HOTPLUG_CPU
 static DEFINE_PER_CPU(u32 [MAX_NR_REG_BANKS], irqmasks);
 
@@ -446,7 +480,7 @@ static struct irq_chip wakeupgen_chip = {
         .irq_mask               = wakeupgen_mask,
         .irq_unmask             = wakeupgen_unmask,
         .irq_retrigger          = irq_chip_retrigger_hierarchy,
-        .irq_set_type           = irq_chip_set_type_parent,
+        .irq_set_type           = wakeupgen_irq_set_type,
         .flags                  = IRQCHIP_SKIP_SET_WAKE | IRQCHIP_MASK_ON_SUSPEND,
 #ifdef CONFIG_SMP
         .irq_set_affinity       = irq_chip_set_affinity_parent,
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f1e2922e447c..1e3e08a1c456 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2390,4 +2390,6 @@ void arch_teardown_dma_ops(struct device *dev)
                 return;
 
         arm_teardown_iommu_dma_ops(dev);
+        /* Let arch_setup_dma_ops() start again from scratch upon re-probe */
+        set_dma_ops(dev, NULL);
 }
diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
index 2c118a6ab358..0dc23fc227ed 100644
--- a/arch/arm/probes/kprobes/opt-arm.c
+++ b/arch/arm/probes/kprobes/opt-arm.c
@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
         }
 
         /* Copy arch-dep-instance from template. */
-        memcpy(code, (unsigned char *)optprobe_template_entry,
+        memcpy(code, (unsigned long *)&optprobe_template_entry,
                         TMPL_END_IDX * sizeof(kprobe_opcode_t));
 
         /* Adjust buffer according to instruction. */
diff --git a/arch/arm64/boot/dts/freescale/imx8mq-evk.dts b/arch/arm64/boot/dts/freescale/imx8mq-evk.dts
index 64acccc4bfcb..f74b13aa5aa5 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq-evk.dts
+++ b/arch/arm64/boot/dts/freescale/imx8mq-evk.dts
@@ -227,34 +227,34 @@
 
         pinctrl_usdhc1_100mhz: usdhc1-100grp {
                 fsl,pins = <
-                        MX8MQ_IOMUXC_SD1_CLK_USDHC1_CLK                 0x85
-                        MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD                 0xc5
-                        MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA3_USDHC1_DATA3             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA4_USDHC1_DATA4             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA5_USDHC1_DATA5             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA6_USDHC1_DATA6             0xc5
-                        MX8MQ_IOMUXC_SD1_DATA7_USDHC1_DATA7             0xc5
-                        MX8MQ_IOMUXC_SD1_STROBE_USDHC1_STROBE           0x85
+                        MX8MQ_IOMUXC_SD1_CLK_USDHC1_CLK                 0x8d
+                        MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD                 0xcd
+                        MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA3_USDHC1_DATA3             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA4_USDHC1_DATA4             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA5_USDHC1_DATA5             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA6_USDHC1_DATA6             0xcd
+                        MX8MQ_IOMUXC_SD1_DATA7_USDHC1_DATA7             0xcd
+                        MX8MQ_IOMUXC_SD1_STROBE_USDHC1_STROBE           0x8d
                         MX8MQ_IOMUXC_SD1_RESET_B_USDHC1_RESET_B         0xc1
                 >;
         };
 
         pinctrl_usdhc1_200mhz: usdhc1-200grp {
                 fsl,pins = <
-                        MX8MQ_IOMUXC_SD1_CLK_USDHC1_CLK                 0x87
-                        MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD                 0xc7
-                        MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA3_USDHC1_DATA3             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA4_USDHC1_DATA4             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA5_USDHC1_DATA5             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA6_USDHC1_DATA6             0xc7
-                        MX8MQ_IOMUXC_SD1_DATA7_USDHC1_DATA7             0xc7
-                        MX8MQ_IOMUXC_SD1_STROBE_USDHC1_STROBE           0x87
+                        MX8MQ_IOMUXC_SD1_CLK_USDHC1_CLK                 0x9f
+                        MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD                 0xdf
+                        MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA3_USDHC1_DATA3             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA4_USDHC1_DATA4             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA5_USDHC1_DATA5             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA6_USDHC1_DATA6             0xdf
+                        MX8MQ_IOMUXC_SD1_DATA7_USDHC1_DATA7             0xdf
+                        MX8MQ_IOMUXC_SD1_STROBE_USDHC1_STROBE           0x9f
                         MX8MQ_IOMUXC_SD1_RESET_B_USDHC1_RESET_B         0xc1
                 >;
         };
diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
index 8e9d6d5ed7b2..b6d31499fb43 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
@@ -360,6 +360,8 @@
                                          <&clk IMX8MQ_CLK_NAND_USDHC_BUS>,
                                          <&clk IMX8MQ_CLK_USDHC1_ROOT>;
                                 clock-names = "ipg", "ahb", "per";
+                                assigned-clocks = <&clk IMX8MQ_CLK_USDHC1>;
+                                assigned-clock-rates = <400000000>;
                                 fsl,tuning-start-tap = <20>;
                                 fsl,tuning-step = <2>;
                                 bus-width = <4>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
index bd937d68ca3b..040b36ef0dd2 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
@@ -40,6 +40,7 @@
                 pinctrl-0 = <&usb30_host_drv>;
                 regulator-name = "vcc_host_5v";
                 regulator-always-on;
+                regulator-boot-on;
                 vin-supply = <&vcc_sys>;
         };
 
@@ -51,6 +52,7 @@
                 pinctrl-0 = <&usb20_host_drv>;
                 regulator-name = "vcc_host1_5v";
                 regulator-always-on;
+                regulator-boot-on;
                 vin-supply = <&vcc_sys>;
         };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
index 1ee0dc0d9f10..d1cf404b8708 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
@@ -22,7 +22,7 @@
                 backlight = <&backlight>;
                 power-supply = <&pp3300_disp>;
 
-                ports {
+                port {
                         panel_in_edp: endpoint {
                                 remote-endpoint = <&edp_out_panel>;
                         };
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
index 81e73103fa78..15e254a77391 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
@@ -43,7 +43,7 @@
                 backlight = <&backlight>;
                 power-supply = <&pp3300_disp>;
 
-                ports {
+                port {
                         panel_in_edp: endpoint {
                                 remote-endpoint = <&edp_out_panel>;
                         };
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
index 0b8f1edbd746..b48a63c3efc3 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
@@ -91,7 +91,7 @@
                 pinctrl-0 = <&lcd_panel_reset>;
                 power-supply = <&vcc3v3_s0>;
 
-                ports {
+                port {
                         panel_in_edp: endpoint {
                                 remote-endpoint = <&edp_out_panel>;
                         };
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 7732d0ba4e60..da3fc7324d68 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -48,6 +48,7 @@
 #define KVM_REQ_SLEEP \
         KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
 #define KVM_REQ_IRQ_PENDING     KVM_ARCH_REQ(1)
+#define KVM_REQ_VCPU_RESET      KVM_ARCH_REQ(2)
 
 DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
 
@@ -208,6 +209,13 @@ struct kvm_cpu_context {
 
 typedef struct kvm_cpu_context kvm_cpu_context_t;
 
+struct vcpu_reset_state {
+        unsigned long   pc;
+        unsigned long   r0;
+        bool            be;
+        bool            reset;
+};
+
 struct kvm_vcpu_arch {
         struct kvm_cpu_context ctxt;
 
@@ -297,6 +305,9 @@ struct kvm_vcpu_arch {
         /* Virtual SError ESR to restore when HCR_EL2.VSE is set */
         u64 vsesr_el2;
 
+        /* Additional reset state */
+        struct vcpu_reset_state reset_state;
+
         /* True when deferrable sysregs are loaded on the physical CPU,
          * see kvm_vcpu_load_sysregs and kvm_vcpu_put_sysregs. */
         bool sysregs_loaded_on_cpu;
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index e1ec947e7c0c..0c656850eeea 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -332,6 +332,17 @@ static inline void *phys_to_virt(phys_addr_t x)
 #define virt_addr_valid(kaddr)          \
         (_virt_addr_is_linear(kaddr) && _virt_addr_valid(kaddr))
 
+/*
+ * Given that the GIC architecture permits ITS implementations that can only be
+ * configured with a LPI table address once, GICv3 systems with many CPUs may
+ * end up reserving a lot of different regions after a kexec for their LPI
+ * tables (one per CPU), as we are forced to reuse the same memory after kexec
+ * (and thus reserve it persistently with EFI beforehand)
+ */
+#if defined(CONFIG_EFI) && defined(CONFIG_ARM_GIC_V3_ITS)
+# define INIT_MEMBLOCK_RESERVED_REGIONS (INIT_MEMBLOCK_REGIONS + NR_CPUS + 1)
+#endif
+
 #include <asm-generic/memory_model.h>
 
 #endif
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 4b0e1231625c..d09ec76f08cf 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -313,7 +313,6 @@ void __init setup_arch(char **cmdline_p)
         arm64_memblock_init();
 
         paging_init();
-        efi_apply_persistent_mem_reservations();
 
         acpi_table_upgrade();
 
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index b0b1478094b4..421ebf6f7086 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -23,6 +23,7 @@
 #include <kvm/arm_psci.h>
 
 #include <asm/cpufeature.h>
+#include <asm/kprobes.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_host.h>
@@ -107,6 +108,7 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)
 
         write_sysreg(kvm_get_hyp_vector(), vbar_el1);
 }
+NOKPROBE_SYMBOL(activate_traps_vhe);
 
 static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu)
 {
@@ -154,6 +156,7 @@ static void deactivate_traps_vhe(void)
         write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1);
         write_sysreg(vectors, vbar_el1);
 }
+NOKPROBE_SYMBOL(deactivate_traps_vhe);
 
 static void __hyp_text __deactivate_traps_nvhe(void)
 {
@@ -513,6 +516,7 @@ int kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)
 
         return exit_code;
 }
+NOKPROBE_SYMBOL(kvm_vcpu_run_vhe);
 
 /* Switch to the guest for legacy non-VHE systems */
 int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
@@ -620,6 +624,7 @@ static void __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par,
               read_sysreg_el2(esr),   read_sysreg_el2(far),
               read_sysreg(hpfar_el2), par, vcpu);
 }
+NOKPROBE_SYMBOL(__hyp_call_panic_vhe);
 
 void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt)
 {
diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
index 68d6f7c3b237..b426e2cf973c 100644
--- a/arch/arm64/kvm/hyp/sysreg-sr.c
+++ b/arch/arm64/kvm/hyp/sysreg-sr.c
@@ -18,6 +18,7 @@
 #include <linux/compiler.h>
 #include <linux/kvm_host.h>
 
+#include <asm/kprobes.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_hyp.h>
@@ -98,12 +99,14 @@ void sysreg_save_host_state_vhe(struct kvm_cpu_context *ctxt)
 {
         __sysreg_save_common_state(ctxt);
 }
+NOKPROBE_SYMBOL(sysreg_save_host_state_vhe);
 
 void sysreg_save_guest_state_vhe(struct kvm_cpu_context *ctxt)
 {
         __sysreg_save_common_state(ctxt);
         __sysreg_save_el2_return_state(ctxt);
 }
+NOKPROBE_SYMBOL(sysreg_save_guest_state_vhe);
 
 static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctxt)
 {
@@ -188,12 +191,14 @@ void sysreg_restore_host_state_vhe(struct kvm_cpu_context *ctxt)
 {
         __sysreg_restore_common_state(ctxt);
 }
+NOKPROBE_SYMBOL(sysreg_restore_host_state_vhe);
 
 void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt)
 {
         __sysreg_restore_common_state(ctxt);
         __sysreg_restore_el2_return_state(ctxt);
 }
+NOKPROBE_SYMBOL(sysreg_restore_guest_state_vhe);
 
 void __hyp_text __sysreg32_save_state(struct kvm_vcpu *vcpu)
 {
diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index b72a3dd56204..f16a5f8ff2b4 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -32,6 +32,7 @@
 #include <asm/kvm_arm.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_coproc.h>
+#include <asm/kvm_emulate.h>
 #include <asm/kvm_mmu.h>
 
 /* Maximum phys_shift supported for any VM on this host */
@@ -105,16 +106,33 @@ int kvm_arch_vm_ioctl_check_extension(struct kvm *kvm, long ext)
  * This function finds the right table above and sets the registers on
  * the virtual CPU struct to their architecturally defined reset
  * values.
+ *
+ * Note: This function can be called from two paths: The KVM_ARM_VCPU_INIT
+ * ioctl or as part of handling a request issued by another VCPU in the PSCI
+ * handling code.  In the first case, the VCPU will not be loaded, and in the
+ * second case the VCPU will be loaded.  Because this function operates purely
+ * on the memory-backed valus of system registers, we want to do a full put if
+ * we were loaded (handling a request) and load the values back at the end of
+ * the function.  Otherwise we leave the state alone.  In both cases, we
+ * disable preemption around the vcpu reset as we would otherwise race with
+ * preempt notifiers which also call put/load.
  */
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 {
         const struct kvm_regs *cpu_reset;
+        int ret = -EINVAL;
+        bool loaded;
+
+        preempt_disable();
+        loaded = (vcpu->cpu != -1);
+        if (loaded)
+                kvm_arch_vcpu_put(vcpu);
 
         switch (vcpu->arch.target) {
         default:
                 if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) {
                         if (!cpu_has_32bit_el1())
-                                return -EINVAL;
+                                goto out;
                         cpu_reset = &default_regs_reset32;
                 } else {
                         cpu_reset = &default_regs_reset;
@@ -129,6 +147,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
         /* Reset system registers */
         kvm_reset_sys_regs(vcpu);
 
+        /*
+         * Additional reset state handling that PSCI may have imposed on us.
+         * Must be done after all the sys_reg reset.
+         */
+        if (vcpu->arch.reset_state.reset) {
+                unsigned long target_pc = vcpu->arch.reset_state.pc;
+
+                /* Gracefully handle Thumb2 entry point */
+                if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
+                        target_pc &= ~1UL;
+                        vcpu_set_thumb(vcpu);
+                }
+
+                /* Propagate caller endianness */
+                if (vcpu->arch.reset_state.be)
+                        kvm_vcpu_set_be(vcpu);
+
+                *vcpu_pc(vcpu) = target_pc;
+                vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
+
+                vcpu->arch.reset_state.reset = false;
+        }
+
         /* Reset PMU */
         kvm_pmu_vcpu_reset(vcpu);
 
@@ -137,7 +178,12 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
                 vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG;
 
         /* Reset timer */
-        return kvm_timer_vcpu_reset(vcpu);
+        ret = kvm_timer_vcpu_reset(vcpu);
+out:
+        if (loaded)
+                kvm_arch_vcpu_load(vcpu, smp_processor_id());
+        preempt_enable();
+        return ret;
 }
 
 void kvm_set_ipa_limit(void)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index e3e37228ae4e..c936aa40c3f4 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -314,12 +314,29 @@ static bool trap_raz_wi(struct kvm_vcpu *vcpu,
                 return read_zero(vcpu, p);
 }
 
-static bool trap_undef(struct kvm_vcpu *vcpu,
-                       struct sys_reg_params *p,
-                       const struct sys_reg_desc *r)
+/*
+ * ARMv8.1 mandates at least a trivial LORegion implementation, where all the
+ * RW registers are RES0 (which we can implement as RAZ/WI). On an ARMv8.0
+ * system, these registers should UNDEF. LORID_EL1 being a RO register, we
+ * treat it separately.
+ */
+static bool trap_loregion(struct kvm_vcpu *vcpu,
+                          struct sys_reg_params *p,
+                          const struct sys_reg_desc *r)
 {
-        kvm_inject_undefined(vcpu);
-        return false;
+        u64 val = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);
+        u32 sr = sys_reg((u32)r->Op0, (u32)r->Op1,
+                         (u32)r->CRn, (u32)r->CRm, (u32)r->Op2);
+
+        if (!(val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT))) {
+                kvm_inject_undefined(vcpu);
+                return false;
+        }
+
+        if (p->is_write && sr == SYS_LORID_EL1)
+                return write_to_read_only(vcpu, p, r);
+
+        return trap_raz_wi(vcpu, p, r);
 }
 
 static bool trap_oslsr_el1(struct kvm_vcpu *vcpu,
@@ -1048,11 +1065,6 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz)
                 if (val & ptrauth_mask)
                         kvm_debug("ptrauth unsupported for guests, suppressing\n");
                 val &= ~ptrauth_mask;
-        } else if (id == SYS_ID_AA64MMFR1_EL1) {
-                if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT))
-                        kvm_debug("LORegions unsupported for guests, suppressing\n");
-
-                val &= ~(0xfUL << ID_AA64MMFR1_LOR_SHIFT);
         }
 
         return val;
@@ -1338,11 +1350,11 @@ static const struct sys_reg_desc sys_reg_descs[] = {
         { SYS_DESC(SYS_MAIR_EL1), access_vm_reg, reset_unknown, MAIR_EL1 },
         { SYS_DESC(SYS_AMAIR_EL1), access_vm_reg, reset_amair_el1, AMAIR_EL1 },
 
-        { SYS_DESC(SYS_LORSA_EL1), trap_undef },
-        { SYS_DESC(SYS_LOREA_EL1), trap_undef },
-        { SYS_DESC(SYS_LORN_EL1), trap_undef },
-        { SYS_DESC(SYS_LORC_EL1), trap_undef },
-        { SYS_DESC(SYS_LORID_EL1), trap_undef },
+        { SYS_DESC(SYS_LORSA_EL1), trap_loregion },
+        { SYS_DESC(SYS_LOREA_EL1), trap_loregion },
+        { SYS_DESC(SYS_LORN_EL1), trap_loregion },
+        { SYS_DESC(SYS_LORC_EL1), trap_loregion },
+        { SYS_DESC(SYS_LORID_EL1), trap_loregion },
 
         { SYS_DESC(SYS_VBAR_EL1), NULL, reset_val, VBAR_EL1, 0 },
         { SYS_DESC(SYS_DISR_EL1), NULL, reset_val, DISR_EL1, 0 },
@@ -2596,7 +2608,9 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
         table = get_target_table(vcpu->arch.target, true, &num);
         reset_sys_reg_descs(vcpu, table, num);
 
-        for (num = 1; num < NR_SYS_REGS; num++)
-                if (__vcpu_sys_reg(vcpu, num) == 0x4242424242424242)
-                        panic("Didn't reset __vcpu_sys_reg(%zi)", num);
+        for (num = 1; num < NR_SYS_REGS; num++) {
+                if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
+                         "Didn't reset __vcpu_sys_reg(%zi)\n", num))
+                        break;
+        }
 }
diff --git a/arch/csky/include/asm/pgtable.h b/arch/csky/include/asm/pgtable.h
index edfcbb25fd9f..dcea277c09ae 100644
--- a/arch/csky/include/asm/pgtable.h
+++ b/arch/csky/include/asm/pgtable.h
@@ -45,8 +45,8 @@
         ((pte_t *)page_address(pmd_page(*(dir))) + __pte_offset_t(address))
 #define pmd_page(pmd)   (pfn_to_page(pmd_phys(pmd) >> PAGE_SHIFT))
 #define pte_clear(mm, addr, ptep)       set_pte((ptep), \
-                        (((unsigned int)addr&0x80000000)?__pte(1):__pte(0)))
-#define pte_none(pte)   (!(pte_val(pte)&0xfffffffe))
+        (((unsigned int) addr & PAGE_OFFSET) ? __pte(_PAGE_GLOBAL) : __pte(0)))
+#define pte_none(pte)           (!(pte_val(pte) & ~_PAGE_GLOBAL))
 #define pte_present(pte)        (pte_val(pte) & _PAGE_PRESENT)
 #define pte_pfn(x)      ((unsigned long)((x).pte_low >> PAGE_SHIFT))
 #define pfn_pte(pfn, prot) __pte(((unsigned long long)(pfn) << PAGE_SHIFT) \
@@ -241,6 +241,11 @@ static inline pte_t pte_mkyoung(pte_t pte)
 
 #define pgd_index(address)      ((address) >> PGDIR_SHIFT)
 
+#define __HAVE_PHYS_MEM_ACCESS_PROT
+struct file;
+extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+                                     unsigned long size, pgprot_t vma_prot);
+
 /*
  * Macro to make mark a page protection value as "uncacheable".  Note
  * that "protection" is really a misnomer here as the protection value
diff --git a/arch/csky/include/asm/processor.h b/arch/csky/include/asm/processor.h
index 8f454810514f..21e0bd5293dd 100644
--- a/arch/csky/include/asm/processor.h
+++ b/arch/csky/include/asm/processor.h
@@ -49,7 +49,7 @@ struct thread_struct {
 };
 
 #define INIT_THREAD  { \
-        .ksp = (unsigned long) init_thread_union.stack + THREAD_SIZE, \
+        .ksp = sizeof(init_stack) + (unsigned long) &init_stack, \
         .sr = DEFAULT_PSR_VALUE, \
 }
 
@@ -95,7 +95,7 @@ unsigned long get_wchan(struct task_struct *p);
 #define KSTK_ESP(tsk)           (task_pt_regs(tsk)->usp)
 
 #define task_pt_regs(p) \
-        ((struct pt_regs *)(THREAD_SIZE + p->stack) - 1)
+        ((struct pt_regs *)(THREAD_SIZE + task_stack_page(p)) - 1)
 
 #define cpu_relax() barrier()
 
diff --git a/arch/csky/kernel/dumpstack.c b/arch/csky/kernel/dumpstack.c
index 659253e9989c..d67f9777cfd9 100644
--- a/arch/csky/kernel/dumpstack.c
+++ b/arch/csky/kernel/dumpstack.c
@@ -38,7 +38,11 @@ void show_stack(struct task_struct *task, unsigned long *stack)
                 if (task)
                         stack = (unsigned long *)thread_saved_fp(task);
                 else
+#ifdef CONFIG_STACKTRACE
+                        asm volatile("mov %0, r8\n":"=r"(stack)::"memory");
+#else
                         stack = (unsigned long *)&stack;
+#endif
         }
 
         show_trace(stack);
diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index 57f1afe19a52..f2f12fff36f7 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -8,6 +8,7 @@
 #include <linux/ptrace.h>
 #include <linux/regset.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 #include <linux/signal.h>
 #include <linux/smp.h>
 #include <linux/uaccess.h>
@@ -159,7 +160,7 @@ static int fpr_set(struct task_struct *target,
 static const struct user_regset csky_regsets[] = {
         [REGSET_GPR] = {
                 .core_note_type = NT_PRSTATUS,
-                .n = ELF_NGREG,
+                .n = sizeof(struct pt_regs) / sizeof(u32),
                 .size = sizeof(u32),
                 .align = sizeof(u32),
                 .get = &gpr_get,
diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c
index ddc4dd79f282..b07a534b3062 100644
--- a/arch/csky/kernel/smp.c
+++ b/arch/csky/kernel/smp.c
@@ -160,7 +160,8 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
         unsigned long mask = 1 << cpu;
 
-        secondary_stack = (unsigned int)tidle->stack + THREAD_SIZE - 8;
+        secondary_stack =
+                (unsigned int) task_stack_page(tidle) + THREAD_SIZE - 8;
         secondary_hint = mfcr("cr31");
         secondary_ccr  = mfcr("cr18");
 
diff --git a/arch/csky/mm/ioremap.c b/arch/csky/mm/ioremap.c
index cb7c03e5cd21..8473b6bdf512 100644
--- a/arch/csky/mm/ioremap.c
+++ b/arch/csky/mm/ioremap.c
@@ -46,3 +46,17 @@ void iounmap(void __iomem *addr)
         vunmap((void *)((unsigned long)addr & PAGE_MASK));
 }
 EXPORT_SYMBOL(iounmap);
+
+pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+                              unsigned long size, pgprot_t vma_prot)
+{
+        if (!pfn_valid(pfn)) {
+                vma_prot.pgprot |= _PAGE_SO;
+                return pgprot_noncached(vma_prot);
+        } else if (file->f_flags & O_SYNC) {
+                return pgprot_noncached(vma_prot);
+        }
+
+        return vma_prot;
+}
+EXPORT_SYMBOL(phys_mem_access_prot);
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index b16710a8a9e7..76e9bf88d3b9 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -79,8 +79,6 @@ enum reg_val_type {
         REG_64BIT_32BIT,
         /* 32-bit compatible, need truncation for 64-bit ops. */
         REG_32BIT,
-        /* 32-bit zero extended. */
-        REG_32BIT_ZERO_EX,
         /* 32-bit no sign/zero extension needed. */
         REG_32BIT_POS
 };
@@ -343,12 +341,15 @@ static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg)
         const struct bpf_prog *prog = ctx->skf;
         int stack_adjust = ctx->stack_size;
         int store_offset = stack_adjust - 8;
+        enum reg_val_type td;
         int r0 = MIPS_R_V0;
 
-        if (dest_reg == MIPS_R_RA &&
-            get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX)
+        if (dest_reg == MIPS_R_RA) {
                 /* Don't let zero extended value escape. */
-                emit_instr(ctx, sll, r0, r0, 0);
+                td = get_reg_val_type(ctx, prog->len, BPF_REG_0);
+                if (td == REG_64BIT)
+                        emit_instr(ctx, sll, r0, r0, 0);
+        }
 
         if (ctx->flags & EBPF_SAVE_RA) {
                 emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP);
@@ -692,7 +693,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
@@ -707,7 +708,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
@@ -721,7 +722,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (dst < 0)
                         return dst;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX)
+                if (td == REG_64BIT)
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 if (insn->imm == 1) {
@@ -860,13 +861,13 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
                 if (src < 0 || dst < 0)
                         return -EINVAL;
                 td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
-                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                if (td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
                 did_move = false;
                 ts = get_reg_val_type(ctx, this_idx, insn->src_reg);
-                if (ts == REG_64BIT || ts == REG_32BIT_ZERO_EX) {
+                if (ts == REG_64BIT) {
                         int tmp_reg = MIPS_R_AT;
 
                         if (bpf_op == BPF_MOV) {
@@ -1254,8 +1255,7 @@ jeq_common:
                 if (insn->imm == 64 && td == REG_32BIT)
                         emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
 
-                if (insn->imm != 64 &&
-                    (td == REG_64BIT || td == REG_32BIT_ZERO_EX)) {
+                if (insn->imm != 64 && td == REG_64BIT) {
                         /* sign extend */
                         emit_instr(ctx, sll, dst, dst, 0);
                 }
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index c9bfe526ca9d..d8c8d7c9df15 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -904,7 +904,7 @@ static inline int pud_none(pud_t pud)
 
 static inline int pud_present(pud_t pud)
 {
-        return (pud_raw(pud) & cpu_to_be64(_PAGE_PRESENT));
+        return !!(pud_raw(pud) & cpu_to_be64(_PAGE_PRESENT));
 }
 
 extern struct page *pud_page(pud_t pud);
@@ -951,7 +951,7 @@ static inline int pgd_none(pgd_t pgd)
 
 static inline int pgd_present(pgd_t pgd)
 {
-        return (pgd_raw(pgd) & cpu_to_be64(_PAGE_PRESENT));
+        return !!(pgd_raw(pgd) & cpu_to_be64(_PAGE_PRESENT));
 }
 
 static inline pte_t pgd_pte(pgd_t pgd)
diff --git a/arch/riscv/include/asm/pgtable-bits.h b/arch/riscv/include/asm/pgtable-bits.h
index 2fa2942be221..470755cb7558 100644
--- a/arch/riscv/include/asm/pgtable-bits.h
+++ b/arch/riscv/include/asm/pgtable-bits.h
@@ -35,6 +35,12 @@
 #define _PAGE_SPECIAL   _PAGE_SOFT
 #define _PAGE_TABLE     _PAGE_PRESENT
 
+/*
+ * _PAGE_PROT_NONE is set on not-present pages (and ignored by the hardware) to
+ * distinguish them from swapped out pages
+ */
+#define _PAGE_PROT_NONE _PAGE_READ
+
 #define _PAGE_PFN_SHIFT 10
 
 /* Set of bits to preserve across pte_modify() */
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 16301966d65b..a8179a8c1491 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -44,7 +44,7 @@
 /* Page protection bits */
 #define _PAGE_BASE      (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER)
 
-#define PAGE_NONE               __pgprot(0)
+#define PAGE_NONE               __pgprot(_PAGE_PROT_NONE)
 #define PAGE_READ               __pgprot(_PAGE_BASE | _PAGE_READ)
 #define PAGE_WRITE              __pgprot(_PAGE_BASE | _PAGE_READ | _PAGE_WRITE)
 #define PAGE_EXEC               __pgprot(_PAGE_BASE | _PAGE_EXEC)
@@ -98,7 +98,7 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
 static inline int pmd_present(pmd_t pmd)
 {
-        return (pmd_val(pmd) & _PAGE_PRESENT);
+        return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pmd_none(pmd_t pmd)
@@ -178,7 +178,7 @@ static inline pte_t *pte_offset_kernel(pmd_t *pmd, unsigned long addr)
 
 static inline int pte_present(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_PRESENT);
+        return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
 }
 
 static inline int pte_none(pte_t pte)
@@ -380,7 +380,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
  *
  * Format of swap PTE:
  *      bit            0:       _PAGE_PRESENT (zero)
- *      bit            1:       reserved for future use (zero)
+ *      bit            1:       _PAGE_PROT_NONE (zero)
  *      bits      2 to 6:       swap type
  *      bits 7 to XLEN-1:       swap offset
  */
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 1e1395d63dab..65df1dfdc303 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -18,8 +18,6 @@
 #include <asm/cache.h>
 #include <asm/thread_info.h>
 
-#define MAX_BYTES_PER_LONG      0x10
-
 OUTPUT_ARCH(riscv)
 ENTRY(_start)
 
@@ -76,6 +74,8 @@ SECTIONS
                 *(.sbss*)
         }
 
+        BSS_SECTION(PAGE_SIZE, PAGE_SIZE, 0)
+
         EXCEPTION_TABLE(0x10)
         NOTES
 
@@ -83,10 +83,6 @@ SECTIONS
                 *(.rel.dyn*)
         }
 
-        BSS_SECTION(MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG,
-                    MAX_BYTES_PER_LONG)
-
         _end = .;
 
         STABS_DEBUG
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index 537f97fde37f..b6796e616812 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -30,10 +30,10 @@
         .section .text
 ENTRY(swsusp_arch_suspend)
         lg      %r1,__LC_NODAT_STACK
-        aghi    %r1,-STACK_FRAME_OVERHEAD
         stmg    %r6,%r15,__SF_GPRS(%r1)
+        aghi    %r1,-STACK_FRAME_OVERHEAD
         stg     %r15,__SF_BACKCHAIN(%r1)
-        lgr     %r1,%r15
+        lgr     %r15,%r1
 
         /* Store FPU registers */
         brasl   %r14,save_fpu_regs
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index a966d7bfac57..4266a4de3160 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -382,7 +382,9 @@ static void zpci_irq_handler(struct airq_struct *airq)
                         if (ai == -1UL)
                                 break;
                         inc_irq_stat(IRQIO_MSI);
+                        airq_iv_lock(aibv, ai);
                         generic_handle_irq(airq_iv_get_data(aibv, ai));
+                        airq_iv_unlock(aibv, ai);
                 }
         }
 }
@@ -408,7 +410,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         zdev->aisb = aisb;
 
         /* Create adapter interrupt vector */
-        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA);
+        zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK);
         if (!zdev->aibv)
                 return -ENOMEM;
 
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 374a19712e20..b684f0294f35 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2278,6 +2278,19 @@ void perf_check_microcode(void)
                 x86_pmu.check_microcode();
 }
 
+static int x86_pmu_check_period(struct perf_event *event, u64 value)
+{
+        if (x86_pmu.check_period && x86_pmu.check_period(event, value))
+                return -EINVAL;
+
+        if (value && x86_pmu.limit_period) {
+                if (x86_pmu.limit_period(event, value) > value)
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
 static struct pmu pmu = {
         .pmu_enable             = x86_pmu_enable,
         .pmu_disable            = x86_pmu_disable,
@@ -2302,6 +2315,7 @@ static struct pmu pmu = {
         .event_idx              = x86_pmu_event_idx,
         .sched_task             = x86_pmu_sched_task,
         .task_ctx_size          = sizeof(struct x86_perf_task_context),
+        .check_period           = x86_pmu_check_period,
 };
 
 void arch_perf_update_userpage(struct perf_event *event,
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index daafb893449b..730978dff63f 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3587,6 +3587,11 @@ static void intel_pmu_sched_task(struct perf_event_context *ctx,
         intel_pmu_lbr_sched_task(ctx, sched_in);
 }
 
+static int intel_pmu_check_period(struct perf_event *event, u64 value)
+{
+        return intel_pmu_has_bts_period(event, value) ? -EINVAL : 0;
+}
+
 PMU_FORMAT_ATTR(offcore_rsp, "config1:0-63");
 
 PMU_FORMAT_ATTR(ldlat, "config1:0-15");
@@ -3667,6 +3672,8 @@ static __initconst const struct x86_pmu core_pmu = {
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
         .cpu_dead               = intel_pmu_cpu_dead,
+
+        .check_period           = intel_pmu_check_period,
 };
 
 static struct attribute *intel_pmu_attrs[];
@@ -3711,6 +3718,8 @@ static __initconst const struct x86_pmu intel_pmu = {
 
         .guest_get_msrs         = intel_guest_get_msrs,
         .sched_task             = intel_pmu_sched_task,
+
+        .check_period           = intel_pmu_check_period,
 };
 
 static __init void intel_clovertown_quirk(void)
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 78d7b7031bfc..d46fd6754d92 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -646,6 +646,11 @@ struct x86_pmu {
          * Intel host/guest support (KVM)
          */
         struct perf_guest_switch_msr *(*guest_get_msrs)(int *nr);
+
+        /*
+         * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
+         */
+        int (*check_period) (struct perf_event *event, u64 period);
 };
 
 struct x86_perf_task_context {
@@ -857,7 +862,7 @@ static inline int amd_pmu_init(void)
 
 #ifdef CONFIG_CPU_SUP_INTEL
 
-static inline bool intel_pmu_has_bts(struct perf_event *event)
+static inline bool intel_pmu_has_bts_period(struct perf_event *event, u64 period)
 {
         struct hw_perf_event *hwc = &event->hw;
         unsigned int hw_event, bts_event;
@@ -868,7 +873,14 @@ static inline bool intel_pmu_has_bts(struct perf_event *event)
         hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
         bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
 
-        return hw_event == bts_event && hwc->sample_period == 1;
+        return hw_event == bts_event && period == 1;
+}
+
+static inline bool intel_pmu_has_bts(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+
+        return intel_pmu_has_bts_period(event, hwc->sample_period);
 }
 
 int intel_pmu_save_and_restart(struct perf_event *event);
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index f65b78d32f5e..7dbbe9ffda17 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -51,7 +51,7 @@ static unsigned long get_dr(int n)
 /*
  * fill in the user structure for a core dump..
  */
-static void dump_thread32(struct pt_regs *regs, struct user32 *dump)
+static void fill_dump(struct pt_regs *regs, struct user32 *dump)
 {
         u32 fs, gs;
         memset(dump, 0, sizeof(*dump));
@@ -157,10 +157,12 @@ static int aout_core_dump(struct coredump_params *cprm)
         fs = get_fs();
         set_fs(KERNEL_DS);
         has_dumped = 1;
+
+        fill_dump(cprm->regs, &dump);
+
         strncpy(dump.u_comm, current->comm, sizeof(current->comm));
         dump.u_ar0 = offsetof(struct user32, regs);
         dump.signal = cprm->siginfo->si_signo;
-        dump_thread32(cprm->regs, &dump);
 
         /*
          * If the size of the dump file exceeds the rlimit, then see
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index d9a9993af882..9f15384c504a 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -52,6 +52,8 @@
 
 #define INTEL_FAM6_CANNONLAKE_MOBILE    0x66
 
+#define INTEL_FAM6_ICELAKE_MOBILE       0x7E
+
 /* "Small Core" Processors (Atom) */
 
 #define INTEL_FAM6_ATOM_BONNELL         0x1C /* Diamondville, Pineview */
diff --git a/arch/x86/include/asm/uv/bios.h b/arch/x86/include/asm/uv/bios.h
index e652a7cc6186..3f697a9e3f59 100644
--- a/arch/x86/include/asm/uv/bios.h
+++ b/arch/x86/include/asm/uv/bios.h
@@ -48,7 +48,8 @@ enum {
         BIOS_STATUS_SUCCESS             =  0,
         BIOS_STATUS_UNIMPLEMENTED       = -ENOSYS,
         BIOS_STATUS_EINVAL              = -EINVAL,
-        BIOS_STATUS_UNAVAIL             = -EBUSY
+        BIOS_STATUS_UNAVAIL             = -EBUSY,
+        BIOS_STATUS_ABORT               = -EINTR,
 };
 
 /* Address map parameters */
@@ -167,4 +168,9 @@ extern long system_serial_number;
 
 extern struct kobject *sgi_uv_kobj;     /* /sys/firmware/sgi_uv */
 
+/*
+ * EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details
+ */
+extern struct semaphore __efi_uv_runtime_lock;
+
 #endif /* _ASM_X86_UV_BIOS_H */
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index d8ea4ebd79e7..d737a51a53ca 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2473,6 +2473,10 @@ static int nested_check_vm_execution_controls(struct kvm_vcpu *vcpu,
             (nested_cpu_has_vpid(vmcs12) && !vmcs12->virtual_processor_id))
                 return -EINVAL;
 
+        if (!nested_cpu_has_preemption_timer(vmcs12) &&
+            nested_cpu_has_save_preemption_timer(vmcs12))
+                return -EINVAL;
+
         if (nested_cpu_has_ept(vmcs12) &&
             !valid_ept_address(vcpu, vmcs12->ept_pointer))
                 return -EINVAL;
@@ -5557,9 +5561,11 @@ void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, u32 ept_caps,
          * secondary cpu-based controls.  Do not include those that
          * depend on CPUID bits, they are added later by vmx_cpuid_update.
          */
-        rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
-                msrs->secondary_ctls_low,
-                msrs->secondary_ctls_high);
+        if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
+                rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
+                      msrs->secondary_ctls_low,
+                      msrs->secondary_ctls_high);
+
         msrs->secondary_ctls_low = 0;
         msrs->secondary_ctls_high &=
                 SECONDARY_EXEC_DESC |
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 95d618045001..30a6bcd735ec 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -863,7 +863,8 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
         if (!entry_only)
                 j = find_msr(&m->host, msr);
 
-        if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
+        if ((i < 0 && m->guest.nr == NR_AUTOLOAD_MSRS) ||
+                (j < 0 &&  m->host.nr == NR_AUTOLOAD_MSRS)) {
                 printk_once(KERN_WARNING "Not enough msr switch entries. "
                                 "Can't add msr %x\n", msr);
                 return;
@@ -1193,21 +1194,6 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
         if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
                 return;
 
-        /*
-         * First handle the simple case where no cmpxchg is necessary; just
-         * allow posting non-urgent interrupts.
-         *
-         * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
-         * PI.NDST: pi_post_block will do it for us and the wakeup_handler
-         * expects the VCPU to be on the blocked_vcpu_list that matches
-         * PI.NDST.
-         */
-        if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR ||
-            vcpu->cpu == cpu) {
-                pi_clear_sn(pi_desc);
-                return;
-        }
-
         /* The full case.  */
         do {
                 old.control = new.control = pi_desc->control;
@@ -1222,6 +1208,17 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
                 new.sn = 0;
         } while (cmpxchg64(&pi_desc->control, old.control,
                            new.control) != old.control);
+
+        /*
+         * Clear SN before reading the bitmap.  The VT-d firmware
+         * writes the bitmap and reads SN atomically (5.2.3 in the
+         * spec), so it doesn't really have a memory barrier that
+         * pairs with this, but we cannot do that and we need one.
+         */
+        smp_mb__after_atomic();
+
+        if (!bitmap_empty((unsigned long *)pi_desc->pir, NR_VECTORS))
+                pi_set_on(pi_desc);
 }
 
 /*
diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h
index 99328954c2fc..0ac0a64c7790 100644
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -337,16 +337,16 @@ static inline int pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
         return test_and_set_bit(vector, (unsigned long *)pi_desc->pir);
 }
 
-static inline void pi_clear_sn(struct pi_desc *pi_desc)
+static inline void pi_set_sn(struct pi_desc *pi_desc)
 {
-        return clear_bit(POSTED_INTR_SN,
+        return set_bit(POSTED_INTR_SN,
                         (unsigned long *)&pi_desc->control);
 }
 
-static inline void pi_set_sn(struct pi_desc *pi_desc)
+static inline void pi_set_on(struct pi_desc *pi_desc)
 {
-        return set_bit(POSTED_INTR_SN,
-                        (unsigned long *)&pi_desc->control);
+        set_bit(POSTED_INTR_ON,
+                (unsigned long *)&pi_desc->control);
 }
 
 static inline void pi_clear_on(struct pi_desc *pi_desc)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e67ecf25e690..941f932373d0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7801,7 +7801,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
          * 1) We should set ->mode before checking ->requests.  Please see
          * the comment in kvm_vcpu_exiting_guest_mode().
          *
-         * 2) For APICv, we should set ->mode before checking PIR.ON.  This
+         * 2) For APICv, we should set ->mode before checking PID.ON. This
          * pairs with the memory barrier implicit in pi_test_and_set_on
          * (see vmx_deliver_posted_interrupt).
          *
diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
index 4a6a5a26c582..eb33432f2f24 100644
--- a/arch/x86/platform/uv/bios_uv.c
+++ b/arch/x86/platform/uv/bios_uv.c
@@ -29,7 +29,8 @@
 
 struct uv_systab *uv_systab;
 
-s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
+static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
+                        u64 a4, u64 a5)
 {
         struct uv_systab *tab = uv_systab;
         s64 ret;
@@ -51,6 +52,19 @@ s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
 
         return ret;
 }
+
+s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
+{
+        s64 ret;
+
+        if (down_interruptible(&__efi_uv_runtime_lock))
+                return BIOS_STATUS_ABORT;
+
+        ret = __uv_bios_call(which, a1, a2, a3, a4, a5);
+        up(&__efi_uv_runtime_lock);
+
+        return ret;
+}
 EXPORT_SYMBOL_GPL(uv_bios_call);
 
 s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
@@ -59,10 +73,15 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
         unsigned long bios_flags;
         s64 ret;
 
+        if (down_interruptible(&__efi_uv_runtime_lock))
+                return BIOS_STATUS_ABORT;
+
         local_irq_save(bios_flags);
-        ret = uv_bios_call(which, a1, a2, a3, a4, a5);
+        ret = __uv_bios_call(which, a1, a2, a3, a4, a5);
         local_irq_restore(bios_flags);
 
+        up(&__efi_uv_runtime_lock);
+
         return ret;
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 8f5b533764ca..9437a5eb07cf 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -737,12 +737,20 @@ static void blk_mq_requeue_work(struct work_struct *work)
         spin_unlock_irq(&q->requeue_lock);
 
         list_for_each_entry_safe(rq, next, &rq_list, queuelist) {
-                if (!(rq->rq_flags & RQF_SOFTBARRIER))
+                if (!(rq->rq_flags & (RQF_SOFTBARRIER | RQF_DONTPREP)))
                         continue;
 
                 rq->rq_flags &= ~RQF_SOFTBARRIER;
                 list_del_init(&rq->queuelist);
-                blk_mq_sched_insert_request(rq, true, false, false);
+                /*
+                 * If RQF_DONTPREP, rq has contained some driver specific
+                 * data, so insert it to hctx dispatch list to avoid any
+                 * merge.
+                 */
+                if (rq->rq_flags & RQF_DONTPREP)
+                        blk_mq_request_bypass_insert(rq, false);
+                else
+                        blk_mq_sched_insert_request(rq, true, false, false);
         }
 
         while (!list_empty(&rq_list)) {
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 17eb09d222ff..ec78a04eb136 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -122,8 +122,10 @@ static void alg_do_release(const struct af_alg_type *type, void *private)
 
 int af_alg_release(struct socket *sock)
 {
-        if (sock->sk)
+        if (sock->sk) {
                 sock_put(sock->sk);
+                sock->sk = NULL;
+        }
         return 0;
 }
 EXPORT_SYMBOL_GPL(af_alg_release);
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index a43276c76fc6..21393ec3b9a4 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -509,7 +509,7 @@ static int ht16k33_remove(struct i2c_client *client)
         struct ht16k33_priv *priv = i2c_get_clientdata(client);
         struct ht16k33_fbdev *fbdev = &priv->fbdev;
 
-        cancel_delayed_work(&fbdev->work);
+        cancel_delayed_work_sync(&fbdev->work);
         unregister_framebuffer(fbdev->info);
         framebuffer_release(fbdev->info);
         free_page((unsigned long) fbdev->buffer);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 6f2856c6d0f2..55481b40df9a 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4075,7 +4075,7 @@ static unsigned int floppy_check_events(struct gendisk *disk,
 
         if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
                 if (lock_fdc(drive))
-                        return -EINTR;
+                        return 0;
                 poll_drive(false, 0);
                 process_fd_request();
         }
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index f94d33525771..d299ec79e4c3 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -781,12 +781,12 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
         SYSC_QUIRK("smartreflex", 0, -1, 0x38, -1, 0x00000000, 0xffffffff,
                    SYSC_QUIRK_LEGACY_IDLE),
         SYSC_QUIRK("timer", 0, 0, 0x10, 0x14, 0x00000015, 0xffffffff,
-                   SYSC_QUIRK_LEGACY_IDLE),
+                   0),
         /* Some timers on omap4 and later */
         SYSC_QUIRK("timer", 0, 0, 0x10, -1, 0x50002100, 0xffffffff,
-                   SYSC_QUIRK_LEGACY_IDLE),
+                   0),
         SYSC_QUIRK("timer", 0, 0, 0x10, -1, 0x4fff1301, 0xffff00ff,
-                   SYSC_QUIRK_LEGACY_IDLE),
+                   0),
         SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x00000052, 0xffffffff,
                    SYSC_QUIRK_LEGACY_IDLE),
         /* Uarts on omap4 and later */
diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
index 595124074821..c364027638e1 100644
--- a/drivers/clocksource/timer-ti-dm.c
+++ b/drivers/clocksource/timer-ti-dm.c
@@ -154,6 +154,10 @@ static int omap_dm_timer_of_set_source(struct omap_dm_timer *timer)
         if (IS_ERR(parent))
                 return -ENODEV;
 
+        /* Bail out if both clocks point to fck */
+        if (clk_is_match(parent, timer->fclk))
+                return 0;
+
         ret = clk_set_parent(timer->fclk, parent);
         if (ret < 0)
                 pr_err("%s: failed to set parent\n", __func__);
@@ -864,7 +868,6 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
         timer->pdev = pdev;
 
         pm_runtime_enable(dev);
-        pm_runtime_irq_safe(dev);
 
         if (!timer->reserved) {
                 ret = pm_runtime_get_sync(dev);
diff --git a/drivers/crypto/ccree/cc_driver.c b/drivers/crypto/ccree/cc_driver.c
index 8ada308d72ee..b0125ad65825 100644
--- a/drivers/crypto/ccree/cc_driver.c
+++ b/drivers/crypto/ccree/cc_driver.c
@@ -380,7 +380,7 @@ static int init_cc_resources(struct platform_device *plat_dev)
         rc = cc_ivgen_init(new_drvdata);
         if (rc) {
                 dev_err(dev, "cc_ivgen_init failed\n");
-                goto post_power_mgr_err;
+                goto post_buf_mgr_err;
         }
 
         /* Allocate crypto algs */
@@ -403,6 +403,9 @@ static int init_cc_resources(struct platform_device *plat_dev)
                 goto post_hash_err;
         }
 
+        /* All set, we can allow autosuspend */
+        cc_pm_go(new_drvdata);
+
         /* If we got here and FIPS mode is enabled
          * it means all FIPS test passed, so let TEE
          * know we're good.
@@ -417,8 +420,6 @@ post_cipher_err:
         cc_cipher_free(new_drvdata);
 post_ivgen_err:
         cc_ivgen_fini(new_drvdata);
-post_power_mgr_err:
-        cc_pm_fini(new_drvdata);
 post_buf_mgr_err:
          cc_buffer_mgr_fini(new_drvdata);
 post_req_mgr_err:
diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
index d990f472e89f..6ff7e75ad90e 100644
--- a/drivers/crypto/ccree/cc_pm.c
+++ b/drivers/crypto/ccree/cc_pm.c
@@ -100,20 +100,19 @@ int cc_pm_put_suspend(struct device *dev)
 
 int cc_pm_init(struct cc_drvdata *drvdata)
 {
-        int rc = 0;
         struct device *dev = drvdata_to_dev(drvdata);
 
         /* must be before the enabling to avoid resdundent suspending */
         pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
         pm_runtime_use_autosuspend(dev);
         /* activate the PM module */
-        rc = pm_runtime_set_active(dev);
-        if (rc)
-                return rc;
-        /* enable the PM module*/
-        pm_runtime_enable(dev);
+        return pm_runtime_set_active(dev);
+}
 
-        return rc;
+/* enable the PM module*/
+void cc_pm_go(struct cc_drvdata *drvdata)
+{
+        pm_runtime_enable(drvdata_to_dev(drvdata));
 }
 
 void cc_pm_fini(struct cc_drvdata *drvdata)
diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
index 020a5403c58b..f62624357020 100644
--- a/drivers/crypto/ccree/cc_pm.h
+++ b/drivers/crypto/ccree/cc_pm.h
@@ -16,6 +16,7 @@
 extern const struct dev_pm_ops ccree_pm;
 
 int cc_pm_init(struct cc_drvdata *drvdata);
+void cc_pm_go(struct cc_drvdata *drvdata);
 void cc_pm_fini(struct cc_drvdata *drvdata);
 int cc_pm_suspend(struct device *dev);
 int cc_pm_resume(struct device *dev);
@@ -29,6 +30,8 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
         return 0;
 }
 
+static void cc_pm_go(struct cc_drvdata *drvdata) {}
+
 static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
 
 static inline int cc_pm_suspend(struct device *dev)
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 4c46ff6f2242..55b77c576c42 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -592,11 +592,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
 
                 early_memunmap(tbl, sizeof(*tbl));
         }
-        return 0;
-}
 
-int __init efi_apply_persistent_mem_reservations(void)
-{
         if (efi.mem_reserve != EFI_INVALID_TABLE_ADDR) {
                 unsigned long prsv = efi.mem_reserve;
 
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index eee42d5e25ee..c037c6c5d0b7 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -75,9 +75,6 @@ void install_memreserve_table(efi_system_table_t *sys_table_arg)
         efi_guid_t memreserve_table_guid = LINUX_EFI_MEMRESERVE_TABLE_GUID;
         efi_status_t status;
 
-        if (IS_ENABLED(CONFIG_ARM))
-                return;
-
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA, sizeof(*rsv),
                                 (void **)&rsv);
         if (status != EFI_SUCCESS) {
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 8903b9ccfc2b..e2abfdb5cee6 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -147,6 +147,13 @@ void efi_call_virt_check_flags(unsigned long flags, const char *call)
 static DEFINE_SEMAPHORE(efi_runtime_lock);
 
 /*
+ * Expose the EFI runtime lock to the UV platform
+ */
+#ifdef CONFIG_X86_UV
+extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock);
+#endif
+
+/*
  * Calls the appropriate efi_runtime_service() with the appropriate
  * arguments.
  *
diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
index 00e954f22bc9..74401e0adb29 100644
--- a/drivers/gpio/gpio-mt7621.c
+++ b/drivers/gpio/gpio-mt7621.c
@@ -30,6 +30,7 @@
 #define GPIO_REG_EDGE           0xA0
 
 struct mtk_gc {
+        struct irq_chip irq_chip;
         struct gpio_chip chip;
         spinlock_t lock;
         int bank;
@@ -189,13 +190,6 @@ mediatek_gpio_irq_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static struct irq_chip mediatek_gpio_irq_chip = {
-        .irq_unmask             = mediatek_gpio_irq_unmask,
-        .irq_mask               = mediatek_gpio_irq_mask,
-        .irq_mask_ack           = mediatek_gpio_irq_mask,
-        .irq_set_type           = mediatek_gpio_irq_type,
-};
-
 static int
 mediatek_gpio_xlate(struct gpio_chip *chip,
                     const struct of_phandle_args *spec, u32 *flags)
@@ -254,6 +248,13 @@ mediatek_gpio_bank_probe(struct device *dev,
                 return ret;
         }
 
+        rg->irq_chip.name = dev_name(dev);
+        rg->irq_chip.parent_device = dev;
+        rg->irq_chip.irq_unmask = mediatek_gpio_irq_unmask;
+        rg->irq_chip.irq_mask = mediatek_gpio_irq_mask;
+        rg->irq_chip.irq_mask_ack = mediatek_gpio_irq_mask;
+        rg->irq_chip.irq_set_type = mediatek_gpio_irq_type;
+
         if (mtk->gpio_irq) {
                 /*
                  * Manually request the irq here instead of passing
@@ -270,14 +271,14 @@ mediatek_gpio_bank_probe(struct device *dev,
                         return ret;
                 }
 
-                ret = gpiochip_irqchip_add(&rg->chip, &mediatek_gpio_irq_chip,
+                ret = gpiochip_irqchip_add(&rg->chip, &rg->irq_chip,
                                            0, handle_simple_irq, IRQ_TYPE_NONE);
                 if (ret) {
                         dev_err(dev, "failed to add gpiochip_irqchip\n");
                         return ret;
                 }
 
-                gpiochip_set_chained_irqchip(&rg->chip, &mediatek_gpio_irq_chip,
+                gpiochip_set_chained_irqchip(&rg->chip, &rg->irq_chip,
                                              mtk->gpio_irq, NULL);
         }
 
@@ -310,7 +311,6 @@ mediatek_gpio_probe(struct platform_device *pdev)
         mtk->gpio_irq = irq_of_parse_and_map(np, 0);
         mtk->dev = dev;
         platform_set_drvdata(pdev, mtk);
-        mediatek_gpio_irq_chip.name = dev_name(dev);
 
         for (i = 0; i < MTK_BANK_CNT; i++) {
                 ret = mediatek_gpio_bank_probe(dev, np, i);
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index e9600b556f39..bcc6be4a5cb2 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -245,6 +245,7 @@ static bool pxa_gpio_has_pinctrl(void)
 {
         switch (gpio_type) {
         case PXA3XX_GPIO:
+        case MMP2_GPIO:
                 return false;
 
         default:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 8fab0d637ee5..3a9b48b227ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -90,8 +90,10 @@ static int psp_sw_fini(void *handle)
         adev->psp.sos_fw = NULL;
         release_firmware(adev->psp.asd_fw);
         adev->psp.asd_fw = NULL;
-        release_firmware(adev->psp.ta_fw);
-        adev->psp.ta_fw = NULL;
+        if (adev->psp.ta_fw) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+        }
         return 0;
 }
 
@@ -435,6 +437,9 @@ static int psp_xgmi_initialize(struct psp_context *psp)
         struct ta_xgmi_shared_memory *xgmi_cmd;
         int ret;
 
+        if (!psp->adev->psp.ta_fw)
+                return -ENOENT;
+
         if (!psp->xgmi_context.initialized) {
                 ret = psp_xgmi_init_shared_buf(psp);
                 if (ret)
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index 0c6e7f9b143f..189fcb004579 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -152,18 +152,22 @@ static int psp_v11_0_init_microcode(struct psp_context *psp)
 
         snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_ta.bin", chip_name);
         err = request_firmware(&adev->psp.ta_fw, fw_name, adev->dev);
-        if (err)
-                goto out2;
-
-        err = amdgpu_ucode_validate(adev->psp.ta_fw);
-        if (err)
-                goto out2;
-
-        ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
-        adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
-        adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
-        adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
-                le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        if (err) {
+                release_firmware(adev->psp.ta_fw);
+                adev->psp.ta_fw = NULL;
+                dev_info(adev->dev,
+                         "psp v11.0: Failed to load firmware \"%s\"\n", fw_name);
+        } else {
+                err = amdgpu_ucode_validate(adev->psp.ta_fw);
+                if (err)
+                        goto out2;
+
+                ta_hdr = (const struct ta_firmware_header_v1_0 *)adev->psp.ta_fw->data;
+                adev->psp.ta_xgmi_ucode_version = le32_to_cpu(ta_hdr->ta_xgmi_ucode_version);
+                adev->psp.ta_xgmi_ucode_size = le32_to_cpu(ta_hdr->ta_xgmi_size_bytes);
+                adev->psp.ta_xgmi_start_addr = (uint8_t *)ta_hdr +
+                        le32_to_cpu(ta_hdr->header.ucode_array_offset_bytes);
+        }
 
         return 0;
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 9a7ac58eb18e..ddd75a4d8ba5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -671,6 +671,25 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us
         return bytes_from_user;
 }
 
+/*
+ * Returns the min and max vrr vfreq through the connector's debugfs file.
+ * Example usage: cat /sys/kernel/debug/dri/0/DP-1/vrr_range
+ */
+static int vrr_range_show(struct seq_file *m, void *data)
+{
+        struct drm_connector *connector = m->private;
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+        if (connector->status != connector_status_connected)
+                return -ENODEV;
+
+        seq_printf(m, "Min: %u\n", (unsigned int)aconnector->min_vfreq);
+        seq_printf(m, "Max: %u\n", (unsigned int)aconnector->max_vfreq);
+
+        return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(vrr_range);
+
 static const struct file_operations dp_link_settings_debugfs_fops = {
         .owner = THIS_MODULE,
         .read = dp_link_settings_read,
@@ -697,7 +716,8 @@ static const struct {
 } dp_debugfs_entries[] = {
                 {"link_settings", &dp_link_settings_debugfs_fops},
                 {"phy_settings", &dp_phy_settings_debugfs_fop},
-                {"test_pattern", &dp_phy_test_pattern_fops}
+                {"test_pattern", &dp_phy_test_pattern_fops},
+                {"vrr_range", &vrr_range_fops}
 };
 
 int connector_debugfs_init(struct amdgpu_dm_connector *connector)
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 99cba8ea5d82..5df1256618cc 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -528,7 +528,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 
         object_count = cl->object_count;
 
-        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids), object_count * sizeof(__u32));
+        object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
+                        array_size(object_count, sizeof(__u32)));
         if (IS_ERR(object_ids))
                 return PTR_ERR(object_ids);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 216f52b744a6..c882ea94172c 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1824,6 +1824,16 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static inline bool
+__vma_matches(struct vm_area_struct *vma, struct file *filp,
+              unsigned long addr, unsigned long size)
+{
+        if (vma->vm_file != filp)
+                return false;
+
+        return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
+}
+
 /**
  * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
  *                       it is mapped to.
@@ -1882,7 +1892,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
                         return -EINTR;
                 }
                 vma = find_vma(mm, addr);
-                if (vma)
+                if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
                         vma->vm_page_prot =
                                 pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
                 else
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index d6c8f8fdfda5..017fc602a10e 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -594,7 +594,8 @@ static void i915_pmu_enable(struct perf_event *event)
          * Update the bitmask of enabled events and increment
          * the event reference counter.
          */
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        BUILD_BUG_ON(ARRAY_SIZE(i915->pmu.enable_count) != I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == ~0);
         i915->pmu.enable |= BIT_ULL(bit);
         i915->pmu.enable_count[bit]++;
@@ -615,11 +616,16 @@ static void i915_pmu_enable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                engine->pmu.enable |= BIT(sample);
 
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.enable_count) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                BUILD_BUG_ON(ARRAY_SIZE(engine->pmu.sample) !=
+                             I915_ENGINE_SAMPLE_COUNT);
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
+
+                engine->pmu.enable |= BIT(sample);
                 engine->pmu.enable_count[sample]++;
         }
 
@@ -649,9 +655,11 @@ static void i915_pmu_disable(struct perf_event *event)
                 engine = intel_engine_lookup_user(i915,
                                                   engine_event_class(event),
                                                   engine_event_instance(event));
-                GEM_BUG_ON(!engine);
-                GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
+
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.enable_count));
+                GEM_BUG_ON(sample >= ARRAY_SIZE(engine->pmu.sample));
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == 0);
+
                 /*
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
@@ -660,7 +668,7 @@ static void i915_pmu_disable(struct perf_event *event)
                         engine->pmu.enable &= ~BIT(sample);
         }
 
-        GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
+        GEM_BUG_ON(bit >= ARRAY_SIZE(i915->pmu.enable_count));
         GEM_BUG_ON(i915->pmu.enable_count[bit] == 0);
         /*
          * Decrement the reference count and clear the enabled
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 7f164ca3db12..b3728c5f13e7 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -31,6 +31,8 @@ enum {
         ((1 << I915_PMU_SAMPLE_BITS) + \
          (I915_PMU_LAST + 1 - __I915_PMU_OTHER(0)))
 
+#define I915_ENGINE_SAMPLE_COUNT (I915_SAMPLE_SEMA + 1)
+
 struct i915_pmu_sample {
         u64 cur;
 };
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 0a7d60509ca7..067054cf4a86 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1790,7 +1790,7 @@ enum i915_power_well_id {
 #define _CNL_PORT_TX_C_LN0_OFFSET               0x162C40
 #define _CNL_PORT_TX_D_LN0_OFFSET               0x162E40
 #define _CNL_PORT_TX_F_LN0_OFFSET               0x162840
-#define _CNL_PORT_TX_DW_GRP(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_GRP(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
                                                _CNL_PORT_TX_B_GRP_OFFSET, \
@@ -1798,7 +1798,7 @@ enum i915_power_well_id {
                                                _CNL_PORT_TX_AE_GRP_OFFSET, \
                                                _CNL_PORT_TX_F_GRP_OFFSET) + \
                                                4 * (dw))
-#define _CNL_PORT_TX_DW_LN0(port, dw)   (_PICK((port), \
+#define _CNL_PORT_TX_DW_LN0(dw, port)   (_PICK((port), \
                                                _CNL_PORT_TX_AE_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
                                                _CNL_PORT_TX_B_LN0_OFFSET, \
@@ -1834,9 +1834,9 @@ enum i915_power_well_id {
 
 #define _CNL_PORT_TX_DW4_LN0_AE         0x162450
 #define _CNL_PORT_TX_DW4_LN1_AE         0x1624D0
-#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 4))
-#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 4))
-#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0((port), 4) + \
+#define CNL_PORT_TX_DW4_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(4, (port)))
+#define CNL_PORT_TX_DW4_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)))
+#define CNL_PORT_TX_DW4_LN(port, ln)   _MMIO(_CNL_PORT_TX_DW_LN0(4, (port)) + \
                                            ((ln) * (_CNL_PORT_TX_DW4_LN1_AE - \
                                                     _CNL_PORT_TX_DW4_LN0_AE)))
 #define ICL_PORT_TX_DW4_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(4, port))
@@ -1864,8 +1864,12 @@ enum i915_power_well_id {
 #define   RTERM_SELECT(x)               ((x) << 3)
 #define   RTERM_SELECT_MASK             (0x7 << 3)
 
-#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP((port), 7))
-#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0((port), 7))
+#define CNL_PORT_TX_DW7_GRP(port)       _MMIO(_CNL_PORT_TX_DW_GRP(7, (port)))
+#define CNL_PORT_TX_DW7_LN0(port)       _MMIO(_CNL_PORT_TX_DW_LN0(7, (port)))
+#define ICL_PORT_TX_DW7_AUX(port)       _MMIO(_ICL_PORT_TX_DW_AUX(7, port))
+#define ICL_PORT_TX_DW7_GRP(port)       _MMIO(_ICL_PORT_TX_DW_GRP(7, port))
+#define ICL_PORT_TX_DW7_LN0(port)       _MMIO(_ICL_PORT_TX_DW_LN(7, 0, port))
+#define ICL_PORT_TX_DW7_LN(port, ln)    _MMIO(_ICL_PORT_TX_DW_LN(7, ln, port))
 #define   N_SCALAR(x)                   ((x) << 24)
 #define   N_SCALAR_MASK                 (0x7F << 24)
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4079050f9d6c..7edce1b7b348 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -494,103 +494,58 @@ static const struct cnl_ddi_buf_trans cnl_ddi_translations_edp_1_05V[] = {
         { 0x2, 0x7F, 0x3F, 0x00, 0x00 },        /* 400   400      0.0   */
 };
 
-struct icl_combo_phy_ddi_buf_trans {
-        u32 dw2_swing_select;
-        u32 dw2_swing_scalar;
-        u32 dw4_scaling;
-};
-
-/* Voltage Swing Programming for VccIO 0.85V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0xB, 0x70, 0x0018 },  /* 600         0.0   */
-        { 0xB, 0x70, 0x3015 },  /* 600         3.5   */
-        { 0xB, 0x70, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x00, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x00, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
-};
-
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.85V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_85V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
-};
-
-/* Voltage Swing Programming for VccIO 0.95V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x76, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x76, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+/* icl_combo_phy_ddi_translations */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 0.95V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_0_95V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr2[] = {
+                                                /* NT mV Trans mV db    */
+        { 0x0, 0x7F, 0x3F, 0x00, 0x00 },        /* 200   200      0.0   */
+        { 0x8, 0x7F, 0x38, 0x00, 0x07 },        /* 200   250      1.9   */
+        { 0x1, 0x7F, 0x33, 0x00, 0x0C },        /* 200   300      3.5   */
+        { 0x9, 0x7F, 0x31, 0x00, 0x0E },        /* 200   350      4.9   */
+        { 0x8, 0x7F, 0x3F, 0x00, 0x00 },        /* 250   250      0.0   */
+        { 0x1, 0x7F, 0x38, 0x00, 0x07 },        /* 250   300      1.6   */
+        { 0x9, 0x7F, 0x35, 0x00, 0x0A },        /* 250   350      2.9   */
+        { 0x1, 0x7F, 0x3F, 0x00, 0x00 },        /* 300   300      0.0   */
+        { 0x9, 0x7F, 0x38, 0x00, 0x07 },        /* 300   350      1.3   */
+        { 0x9, 0x7F, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
 };
 
-/* Voltage Swing Programming for VccIO 1.05V for DP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_dp_hdmi_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x2, 0x98, 0x0018 },  /* 400         0.0   */
-        { 0x2, 0x98, 0x3015 },  /* 400         3.5   */
-        { 0x2, 0x98, 0x6012 },  /* 400         6.0   */
-        { 0x2, 0x98, 0x900F },  /* 400         9.5   */
-        { 0x4, 0x98, 0x0018 },  /* 600         0.0   */
-        { 0x4, 0x98, 0x3015 },  /* 600         3.5   */
-        { 0x4, 0x98, 0x6012 },  /* 600         6.0   */
-        { 0x5, 0x71, 0x0018 },  /* 800         0.0   */
-        { 0x5, 0x71, 0x3015 },  /* 800         3.5   */
-        { 0x6, 0x98, 0x0018 },  /* 1200        0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_edp_hbr3[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x35, 0x3F, 0x00, 0x00 },        /* 350   350      0.0   */
+        { 0xA, 0x4F, 0x37, 0x00, 0x08 },        /* 350   500      3.1   */
+        { 0xC, 0x71, 0x2F, 0x00, 0x10 },        /* 350   700      6.0   */
+        { 0x6, 0x7F, 0x2B, 0x00, 0x14 },        /* 350   900      8.2   */
+        { 0xA, 0x4C, 0x3F, 0x00, 0x00 },        /* 500   500      0.0   */
+        { 0xC, 0x73, 0x34, 0x00, 0x0B },        /* 500   700      2.9   */
+        { 0x6, 0x7F, 0x2F, 0x00, 0x10 },        /* 500   900      5.1   */
+        { 0xC, 0x6C, 0x3C, 0x00, 0x03 },        /* 650   700      0.6   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   900      3.5   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 900   900      0.0   */
 };
 
-/* FIXME - After table is updated in Bspec */
-/* Voltage Swing Programming for VccIO 1.05V for eDP */
-static const struct icl_combo_phy_ddi_buf_trans icl_combo_phy_ddi_translations_edp_1_05V[] = {
-                                /* Voltage mV  db    */
-        { 0x0, 0x00, 0x00 },    /* 200         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 200         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 200         6.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 250         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 250         4.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         0.0   */
-        { 0x0, 0x00, 0x00 },    /* 300         1.5   */
-        { 0x0, 0x00, 0x00 },    /* 350         0.0   */
+static const struct cnl_ddi_buf_trans icl_combo_phy_ddi_translations_hdmi[] = {
+                                                /* NT mV Trans mV db    */
+        { 0xA, 0x60, 0x3F, 0x00, 0x00 },        /* 450   450      0.0   */
+        { 0xB, 0x73, 0x36, 0x00, 0x09 },        /* 450   650      3.2   */
+        { 0x6, 0x7F, 0x31, 0x00, 0x0E },        /* 450   850      5.5   */
+        { 0xB, 0x73, 0x3F, 0x00, 0x00 },        /* 650   650      0.0   ALS */
+        { 0x6, 0x7F, 0x37, 0x00, 0x08 },        /* 650   850      2.3   */
+        { 0x6, 0x7F, 0x3F, 0x00, 0x00 },        /* 850   850      0.0   */
+        { 0x6, 0x7F, 0x35, 0x00, 0x0A },        /* 600   850      3.0   */
 };
 
 struct icl_mg_phy_ddi_buf_trans {
@@ -871,43 +826,23 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv, int *n_entries)
         }
 }
 
-static const struct icl_combo_phy_ddi_buf_trans *
+static const struct cnl_ddi_buf_trans *
 icl_get_combo_buf_trans(struct drm_i915_private *dev_priv, enum port port,
-                        int type, int *n_entries)
+                        int type, int rate, int *n_entries)
 {
-        u32 voltage = I915_READ(ICL_PORT_COMP_DW3(port)) & VOLTAGE_INFO_MASK;
-
-        if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_85V);
-                        return icl_combo_phy_ddi_translations_edp_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_0_95V);
-                        return icl_combo_phy_ddi_translations_edp_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_1_05V);
-                        return icl_combo_phy_ddi_translations_edp_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
-        } else {
-                switch (voltage) {
-                case VOLTAGE_INFO_0_85V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_85V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_85V;
-                case VOLTAGE_INFO_0_95V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_0_95V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_0_95V;
-                case VOLTAGE_INFO_1_05V:
-                        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hdmi_1_05V);
-                        return icl_combo_phy_ddi_translations_dp_hdmi_1_05V;
-                default:
-                        MISSING_CASE(voltage);
-                        return NULL;
-                }
+        if (type == INTEL_OUTPUT_HDMI) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_hdmi);
+                return icl_combo_phy_ddi_translations_hdmi;
+        } else if (rate > 540000 && type == INTEL_OUTPUT_EDP) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr3);
+                return icl_combo_phy_ddi_translations_edp_hbr3;
+        } else if (type == INTEL_OUTPUT_EDP && dev_priv->vbt.edp.low_vswing) {
+                *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_edp_hbr2);
+                return icl_combo_phy_ddi_translations_edp_hbr2;
         }
+
+        *n_entries = ARRAY_SIZE(icl_combo_phy_ddi_translations_dp_hbr2);
+        return icl_combo_phy_ddi_translations_dp_hbr2;
 }
 
 static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
@@ -918,8 +853,8 @@ static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port por
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
-                        icl_get_combo_buf_trans(dev_priv, port,
-                                                INTEL_OUTPUT_HDMI, &n_entries);
+                        icl_get_combo_buf_trans(dev_priv, port, INTEL_OUTPUT_HDMI,
+                                                0, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
                 default_entry = n_entries - 1;
@@ -2275,13 +2210,14 @@ static void bxt_ddi_vswing_sequence(struct intel_encoder *encoder,
 u8 intel_ddi_dp_voltage_max(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+        struct intel_dp *intel_dp = enc_to_intel_dp(&encoder->base);
         enum port port = encoder->port;
         int n_entries;
 
         if (IS_ICELAKE(dev_priv)) {
                 if (intel_port_is_combophy(dev_priv, port))
                         icl_get_combo_buf_trans(dev_priv, port, encoder->type,
-                                                &n_entries);
+                                                intel_dp->link_rate, &n_entries);
                 else
                         n_entries = ARRAY_SIZE(icl_mg_phy_ddi_translations);
         } else if (IS_CANNONLAKE(dev_priv)) {
@@ -2462,14 +2398,15 @@ static void cnl_ddi_vswing_sequence(struct intel_encoder *encoder,
 }
 
 static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
-                                         u32 level, enum port port, int type)
+                                        u32 level, enum port port, int type,
+                                        int rate)
 {
-        const struct icl_combo_phy_ddi_buf_trans *ddi_translations = NULL;
+        const struct cnl_ddi_buf_trans *ddi_translations = NULL;
         u32 n_entries, val;
         int ln;
 
         ddi_translations = icl_get_combo_buf_trans(dev_priv, port, type,
-                                                   &n_entries);
+                                                   rate, &n_entries);
         if (!ddi_translations)
                 return;
 
@@ -2478,34 +2415,23 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 level = n_entries - 1;
         }
 
-        /* Set PORT_TX_DW5 Rterm Sel to 110b. */
+        /* Set PORT_TX_DW5 */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        val &= ~RTERM_SELECT_MASK;
+        val &= ~(SCALING_MODE_SEL_MASK | RTERM_SELECT_MASK |
+                  TAP2_DISABLE | TAP3_DISABLE);
+        val |= SCALING_MODE_SEL(0x2);
         val |= RTERM_SELECT(0x6);
-        I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
-
-        /* Program PORT_TX_DW5 */
-        val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
-        /* Set DisableTap2 and DisableTap3 if MIPI DSI
-         * Clear DisableTap2 and DisableTap3 for all other Ports
-         */
-        if (type == INTEL_OUTPUT_DSI) {
-                val |= TAP2_DISABLE;
-                val |= TAP3_DISABLE;
-        } else {
-                val &= ~TAP2_DISABLE;
-                val &= ~TAP3_DISABLE;
-        }
+        val |= TAP3_DISABLE;
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* Program PORT_TX_DW2 */
         val = I915_READ(ICL_PORT_TX_DW2_LN0(port));
         val &= ~(SWING_SEL_LOWER_MASK | SWING_SEL_UPPER_MASK |
                  RCOMP_SCALAR_MASK);
-        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_select);
-        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_select);
+        val |= SWING_SEL_UPPER(ddi_translations[level].dw2_swing_sel);
+        val |= SWING_SEL_LOWER(ddi_translations[level].dw2_swing_sel);
         /* Program Rcomp scalar for every table entry */
-        val |= RCOMP_SCALAR(ddi_translations[level].dw2_swing_scalar);
+        val |= RCOMP_SCALAR(0x98);
         I915_WRITE(ICL_PORT_TX_DW2_GRP(port), val);
 
         /* Program PORT_TX_DW4 */
@@ -2514,9 +2440,17 @@ static void icl_ddi_combo_vswing_program(struct drm_i915_private *dev_priv,
                 val = I915_READ(ICL_PORT_TX_DW4_LN(port, ln));
                 val &= ~(POST_CURSOR_1_MASK | POST_CURSOR_2_MASK |
                          CURSOR_COEFF_MASK);
-                val |= ddi_translations[level].dw4_scaling;
+                val |= POST_CURSOR_1(ddi_translations[level].dw4_post_cursor_1);
+                val |= POST_CURSOR_2(ddi_translations[level].dw4_post_cursor_2);
+                val |= CURSOR_COEFF(ddi_translations[level].dw4_cursor_coeff);
                 I915_WRITE(ICL_PORT_TX_DW4_LN(port, ln), val);
         }
+
+        /* Program PORT_TX_DW7 */
+        val = I915_READ(ICL_PORT_TX_DW7_LN0(port));
+        val &= ~N_SCALAR_MASK;
+        val |= N_SCALAR(ddi_translations[level].dw7_n_scalar);
+        I915_WRITE(ICL_PORT_TX_DW7_GRP(port), val);
 }
 
 static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
@@ -2581,7 +2515,7 @@ static void icl_combo_phy_ddi_vswing_sequence(struct intel_encoder *encoder,
         I915_WRITE(ICL_PORT_TX_DW5_GRP(port), val);
 
         /* 5. Program swing and de-emphasis */
-        icl_ddi_combo_vswing_program(dev_priv, level, port, type);
+        icl_ddi_combo_vswing_program(dev_priv, level, port, type, rate);
 
         /* 6. Set training enable to trigger update */
         val = I915_READ(ICL_PORT_TX_DW5_LN0(port));
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index fdd2cbc56fa3..22a74608c6e4 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -304,9 +304,11 @@ static int cnl_max_source_rate(struct intel_dp *intel_dp)
 static int icl_max_source_rate(struct intel_dp *intel_dp)
 {
         struct intel_digital_port *dig_port = dp_to_dig_port(intel_dp);
+        struct drm_i915_private *dev_priv = to_i915(dig_port->base.base.dev);
         enum port port = dig_port->base.port;
 
-        if (port == PORT_B)
+        if (intel_port_is_combophy(dev_priv, port) &&
+            !intel_dp_is_edp(intel_dp))
                 return 540000;
 
         return 810000;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f94a04b4ad87..e9ddeaf05a14 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -209,6 +209,16 @@ struct intel_fbdev {
         unsigned long vma_flags;
         async_cookie_t cookie;
         int preferred_bpp;
+
+        /* Whether or not fbdev hpd processing is temporarily suspended */
+        bool hpd_suspended : 1;
+        /* Set when a hotplug was received while HPD processing was
+         * suspended
+         */
+        bool hpd_waiting : 1;
+
+        /* Protects hpd_suspended */
+        struct mutex hpd_lock;
 };
 
 struct intel_encoder {
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index fb5bb5b32a60..7f365ac0b549 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -679,6 +679,7 @@ int intel_fbdev_init(struct drm_device *dev)
         if (ifbdev == NULL)
                 return -ENOMEM;
 
+        mutex_init(&ifbdev->hpd_lock);
         drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
 
         if (!intel_fbdev_init_bios(dev, ifbdev))
@@ -752,6 +753,26 @@ void intel_fbdev_fini(struct drm_i915_private *dev_priv)
         intel_fbdev_destroy(ifbdev);
 }
 
+/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
+ * processing, fbdev will perform a full connector reprobe if a hotplug event
+ * was received while HPD was suspended.
+ */
+static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
+{
+        bool send_hpd = false;
+
+        mutex_lock(&ifbdev->hpd_lock);
+        ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
+        send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
+        ifbdev->hpd_waiting = false;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd) {
+                DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
+                drm_fb_helper_hotplug_event(&ifbdev->helper);
+        }
+}
+
 void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -773,6 +794,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
                  */
                 if (state != FBINFO_STATE_RUNNING)
                         flush_work(&dev_priv->fbdev_suspend_work);
+
                 console_lock();
         } else {
                 /*
@@ -800,17 +822,26 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
 
         drm_fb_helper_set_suspend(&ifbdev->helper, state);
         console_unlock();
+
+        intel_fbdev_hpd_set_suspend(ifbdev, state);
 }
 
 void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
         struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
+        bool send_hpd;
 
         if (!ifbdev)
                 return;
 
         intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma || ifbdev->helper.deferred_setup)
+
+        mutex_lock(&ifbdev->hpd_lock);
+        send_hpd = !ifbdev->hpd_suspended;
+        ifbdev->hpd_waiting = true;
+        mutex_unlock(&ifbdev->hpd_lock);
+
+        if (send_hpd && (ifbdev->vma || ifbdev->helper.deferred_setup))
                 drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b8f106d9ecf8..3ac20153705a 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -55,7 +55,12 @@
 struct opregion_header {
         u8 signature[16];
         u32 size;
-        u32 opregion_ver;
+        struct {
+                u8 rsvd;
+                u8 revision;
+                u8 minor;
+                u8 major;
+        }  __packed over;
         u8 bios_ver[32];
         u8 vbios_ver[16];
         u8 driver_ver[16];
@@ -119,7 +124,8 @@ struct opregion_asle {
         u64 fdss;
         u32 fdsp;
         u32 stat;
-        u64 rvda;       /* Physical address of raw vbt data */
+        u64 rvda;       /* Physical (2.0) or relative from opregion (2.1+)
+                         * address of raw VBT data. */
         u32 rvds;       /* Size of raw vbt data */
         u8 rsvd[58];
 } __packed;
@@ -925,6 +931,11 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         opregion->header = base;
         opregion->lid_state = base + ACPI_CLID;
 
+        DRM_DEBUG_DRIVER("ACPI OpRegion version %u.%u.%u\n",
+                         opregion->header->over.major,
+                         opregion->header->over.minor,
+                         opregion->header->over.revision);
+
         mboxes = opregion->header->mboxes;
         if (mboxes & MBOX_ACPI) {
                 DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
@@ -953,11 +964,26 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
         if (dmi_check_system(intel_no_opregion_vbt))
                 goto out;
 
-        if (opregion->header->opregion_ver >= 2 && opregion->asle &&
+        if (opregion->header->over.major >= 2 && opregion->asle &&
             opregion->asle->rvda && opregion->asle->rvds) {
-                opregion->rvda = memremap(opregion->asle->rvda,
-                                          opregion->asle->rvds,
+                resource_size_t rvda = opregion->asle->rvda;
+
+                /*
+                 * opregion 2.0: rvda is the physical VBT address.
+                 *
+                 * opregion 2.1+: rvda is unsigned, relative offset from
+                 * opregion base, and should never point within opregion.
+                 */
+                if (opregion->header->over.major > 2 ||
+                    opregion->header->over.minor >= 1) {
+                        WARN_ON(rvda < OPREGION_SIZE);
+
+                        rvda += asls;
+                }
+
+                opregion->rvda = memremap(rvda, opregion->asle->rvds,
                                           MEMREMAP_WB);
+
                 vbt = opregion->rvda;
                 vbt_size = opregion->asle->rvds;
                 if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
@@ -967,6 +993,8 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
                         goto out;
                 } else {
                         DRM_DEBUG_KMS("Invalid VBT in ACPI OpRegion (RVDA)\n");
+                        memunmap(opregion->rvda);
+                        opregion->rvda = NULL;
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 72edaa7ff411..a1a7cc29fdd1 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -415,16 +415,17 @@ struct intel_engine_cs {
                 /**
                  * @enable_count: Reference count for the enabled samplers.
                  *
-                 * Index number corresponds to the bit number from @enable.
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-                unsigned int enable_count[I915_PMU_SAMPLE_BITS];
+                unsigned int enable_count[I915_ENGINE_SAMPLE_COUNT];
                 /**
                  * @sample: Counter values for sampling events.
                  *
                  * Our internal timer stores the current counters in this field.
+                 *
+                 * Index number corresponds to @enum drm_i915_pmu_engine_sample.
                  */
-#define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
-                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
+                struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_COUNT];
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 2c5bbe317353..e31e263cf86b 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -643,8 +643,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 int bus_format;
 
                 ret = of_property_read_u32(child, "reg", &i);
-                if (ret || i < 0 || i > 1)
-                        return -EINVAL;
+                if (ret || i < 0 || i > 1) {
+                        ret = -EINVAL;
+                        goto free_child;
+                }
 
                 if (!of_device_is_available(child))
                         continue;
@@ -657,7 +659,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 channel = &imx_ldb->channel[i];
                 channel->ldb = imx_ldb;
                 channel->chno = i;
-                channel->child = child;
 
                 /*
                  * The output port is port@4 with an external 4-port mux or
@@ -667,13 +668,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
                 if (ret && ret != -ENODEV)
-                        return ret;
+                        goto free_child;
 
                 /* panel ddc only if there is no bridge */
                 if (!channel->bridge) {
                         ret = imx_ldb_panel_ddc(dev, channel, child);
                         if (ret)
-                                return ret;
+                                goto free_child;
                 }
 
                 bus_format = of_get_bus_format(dev, child);
@@ -689,18 +690,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 if (bus_format < 0) {
                         dev_err(dev, "could not determine data mapping: %d\n",
                                 bus_format);
-                        return bus_format;
+                        ret = bus_format;
+                        goto free_child;
                 }
                 channel->bus_format = bus_format;
+                channel->child = child;
 
                 ret = imx_ldb_register(drm, channel);
-                if (ret)
-                        return ret;
+                if (ret) {
+                        channel->child = NULL;
+                        goto free_child;
+                }
         }
 
         dev_set_drvdata(dev, imx_ldb);
 
         return 0;
+
+free_child:
+        of_node_put(child);
+        return ret;
 }
 
 static void imx_ldb_unbind(struct device *dev, struct device *master,
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index c390924de93d..21e964f6ab5c 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -370,9 +370,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
         if (ret)
                 return ret;
 
-        /* CRTC should be enabled */
+        /* nothing to check when disabling or disabled */
         if (!crtc_state->enable)
-                return -EINVAL;
+                return 0;
 
         switch (plane->type) {
         case DRM_PLANE_TYPE_PRIMARY:
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index 4463d3826ecb..e2942c9a11a7 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -440,13 +440,10 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)
 
         while ((entity->dependency =
                         sched->ops->dependency(sched_job, entity))) {
+                trace_drm_sched_job_wait_dep(sched_job, entity->dependency);
 
-                if (drm_sched_entity_add_dependency_cb(entity)) {
-
-                        trace_drm_sched_job_wait_dep(sched_job,
-                                                     entity->dependency);
+                if (drm_sched_entity_add_dependency_cb(entity))
                         return NULL;
-                }
         }
 
         /* skip jobs from entity that marked guilty */
diff --git a/drivers/gpu/drm/vkms/vkms_crc.c b/drivers/gpu/drm/vkms/vkms_crc.c
index 9d9e8146db90..d7b409a3c0f8 100644
--- a/drivers/gpu/drm/vkms/vkms_crc.c
+++ b/drivers/gpu/drm/vkms/vkms_crc.c
@@ -1,4 +1,5 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
+
 #include "vkms_drv.h"
 #include <linux/crc32.h>
 #include <drm/drm_atomic.h>
diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
index 177bbcb38306..eb56ee893761 100644
--- a/drivers/gpu/drm/vkms/vkms_crtc.c
+++ b/drivers/gpu/drm/vkms/vkms_crtc.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_atomic_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 83087877565c..7dcbecb5fac2 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -1,9 +1,4 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 /**
  * DOC: vkms (Virtual Kernel Modesetting)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
index e4469cd3d254..81f1cfbeb936 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.h
+++ b/drivers/gpu/drm/vkms/vkms_drv.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
 #ifndef _VKMS_DRV_H_
 #define _VKMS_DRV_H_
 
diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
index 80311daed47a..138b0bb325cf 100644
--- a/drivers/gpu/drm/vkms/vkms_gem.c
+++ b/drivers/gpu/drm/vkms/vkms_gem.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include <linux/shmem_fs.h>
 
diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
index 271a0eb9042c..4173e4f48334 100644
--- a/drivers/gpu/drm/vkms/vkms_output.c
+++ b/drivers/gpu/drm/vkms/vkms_output.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_crtc_helper.h>
diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
index 418817600ad1..0e67d2d42f0c 100644
--- a/drivers/gpu/drm/vkms/vkms_plane.c
+++ b/drivers/gpu/drm/vkms/vkms_plane.c
@@ -1,10 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
 
 #include "vkms_drv.h"
 #include <drm/drm_plane_helper.h>
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 474b00e19697..0a7d4395d427 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
         .cpmem_ofs = 0x1f000000,
         .srm_ofs = 0x1f040000,
         .tpm_ofs = 0x1f060000,
-        .csi0_ofs = 0x1f030000,
-        .csi1_ofs = 0x1f038000,
+        .csi0_ofs = 0x1e030000,
+        .csi1_ofs = 0x1e038000,
         .ic_ofs = 0x1e020000,
         .disp0_ofs = 0x1e040000,
         .disp1_ofs = 0x1e048000,
@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
         .cpmem_ofs = 0x07000000,
         .srm_ofs = 0x07040000,
         .tpm_ofs = 0x07060000,
-        .csi0_ofs = 0x07030000,
-        .csi1_ofs = 0x07038000,
+        .csi0_ofs = 0x06030000,
+        .csi1_ofs = 0x06038000,
         .ic_ofs = 0x06020000,
         .disp0_ofs = 0x06040000,
         .disp1_ofs = 0x06048000,
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index 2f8db9d62551..4a28f3fbb0a2 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -106,6 +106,7 @@ struct ipu_pre {
         void                    *buffer_virt;
         bool                    in_use;
         unsigned int            safe_window_end;
+        unsigned int            last_bufaddr;
 };
 
 static DEFINE_MUTEX(ipu_pre_list_mutex);
@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
 
         writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
               IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
         unsigned short current_yblock;
         u32 val;
 
+        if (bufaddr == pre->last_bufaddr)
+                return;
+
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+        pre->last_bufaddr = bufaddr;
 
         do {
                 if (time_after(jiffies, timeout)) {
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index 4adec4ab7d06..59ee01f3d022 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -3594,7 +3594,8 @@ nct6775_check_fan_inputs(struct nct6775_data *data)
                         fan5pin |= cr1b & BIT(5);
                         fan5pin |= creb & BIT(5);
 
-                        fan6pin = creb & BIT(3);
+                        fan6pin = !dsw_en && (cr2d & BIT(1));
+                        fan6pin |= creb & BIT(3);
 
                         pwm5pin |= cr2d & BIT(7);
                         pwm5pin |= (creb & BIT(4)) && !(cr2a & BIT(0));
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index ec6e69aa3a8e..d2fbb4bb4a43 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -183,6 +183,15 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
         bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
 }
 
+static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
+{
+        i2c_dev->curr_msg = NULL;
+        i2c_dev->num_msgs = 0;
+
+        i2c_dev->msg_buf = NULL;
+        i2c_dev->msg_buf_remaining = 0;
+}
+
 /*
  * Note about I2C_C_CLEAR on error:
  * The I2C_C_CLEAR on errors will take some time to resolve -- if you were in
@@ -283,6 +292,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 
         time_left = wait_for_completion_timeout(&i2c_dev->completion,
                                                 adap->timeout);
+
+        bcm2835_i2c_finish_transfer(i2c_dev);
+
         if (!time_left) {
                 bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
                                    BCM2835_I2C_C_CLEAR);
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index b13605718291..d917cefc5a19 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -382,8 +382,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
          * Check for the message size against FIFO depth and set the
          * 'hold bus' bit if it is greater than FIFO depth.
          */
-        if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
+        if ((id->recv_count > CDNS_I2C_FIFO_DEPTH)  || id->bus_hold_flag)
                 ctrl_reg |= CDNS_I2C_CR_HOLD;
+        else
+                ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
 
         cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
@@ -440,8 +442,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
          * Check for the message size against FIFO depth and set the
          * 'hold bus' bit if it is greater than FIFO depth.
          */
-        if (id->send_count > CDNS_I2C_FIFO_DEPTH)
+        if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
                 ctrl_reg |= CDNS_I2C_CR_HOLD;
+        else
+                ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+
         cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
         /* Clear the interrupts in interrupt status register. */
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 4713957b0cbb..a878351f1643 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -420,7 +420,7 @@ config KEYBOARD_MPR121
 
 config KEYBOARD_SNVS_PWRKEY
         tristate "IMX SNVS Power Key Driver"
-        depends on SOC_IMX6SX
+        depends on SOC_IMX6SX || SOC_IMX7D
         depends on OF
         help
           This is the snvs powerkey driver for the Freescale i.MX application
diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c
index 312916f99597..73686c2460ce 100644
--- a/drivers/input/keyboard/cap11xx.c
+++ b/drivers/input/keyboard/cap11xx.c
@@ -75,9 +75,7 @@
 struct cap11xx_led {
         struct cap11xx_priv *priv;
         struct led_classdev cdev;
-        struct work_struct work;
         u32 reg;
-        enum led_brightness new_brightness;
 };
 #endif
 
@@ -233,30 +231,21 @@ static void cap11xx_input_close(struct input_dev *idev)
 }
 
 #ifdef CONFIG_LEDS_CLASS
-static void cap11xx_led_work(struct work_struct *work)
+static int cap11xx_led_set(struct led_classdev *cdev,
+                            enum led_brightness value)
 {
-        struct cap11xx_led *led = container_of(work, struct cap11xx_led, work);
+        struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev);
         struct cap11xx_priv *priv = led->priv;
-        int value = led->new_brightness;
 
         /*
-         * All LEDs share the same duty cycle as this is a HW limitation.
-         * Brightness levels per LED are either 0 (OFF) and 1 (ON).
+         * All LEDs share the same duty cycle as this is a HW
+         * limitation. Brightness levels per LED are either
+         * 0 (OFF) and 1 (ON).
          */
-        regmap_update_bits(priv->regmap, CAP11XX_REG_LED_OUTPUT_CONTROL,
-                                BIT(led->reg), value ? BIT(led->reg) : 0);
-}
-
-static void cap11xx_led_set(struct led_classdev *cdev,
-                           enum led_brightness value)
-{
-        struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev);
-
-        if (led->new_brightness == value)
-                return;
-
-        led->new_brightness = value;
-        schedule_work(&led->work);
+        return regmap_update_bits(priv->regmap,
+                                  CAP11XX_REG_LED_OUTPUT_CONTROL,
+                                  BIT(led->reg),
+                                  value ? BIT(led->reg) : 0);
 }
 
 static int cap11xx_init_leds(struct device *dev,
@@ -299,7 +288,7 @@ static int cap11xx_init_leds(struct device *dev,
                 led->cdev.default_trigger =
                         of_get_property(child, "linux,default-trigger", NULL);
                 led->cdev.flags = 0;
-                led->cdev.brightness_set = cap11xx_led_set;
+                led->cdev.brightness_set_blocking = cap11xx_led_set;
                 led->cdev.max_brightness = 1;
                 led->cdev.brightness = LED_OFF;
 
@@ -312,8 +301,6 @@ static int cap11xx_init_leds(struct device *dev,
                 led->reg = reg;
                 led->priv = priv;
 
-                INIT_WORK(&led->work, cap11xx_led_work);
-
                 error = devm_led_classdev_register(dev, &led->cdev);
                 if (error) {
                         of_node_put(child);
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 403452ef00e6..3d1cb7bf5e35 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -222,7 +222,7 @@ static void matrix_keypad_stop(struct input_dev *dev)
         keypad->stopped = true;
         spin_unlock_irq(&keypad->lock);
 
-        flush_work(&keypad->work.work);
+        flush_delayed_work(&keypad->work);
         /*
          * matrix_keypad_scan() will leave IRQs enabled;
          * we should disable them now.
diff --git a/drivers/input/keyboard/qt2160.c b/drivers/input/keyboard/qt2160.c
index 43b86482dda0..d466bc07aebb 100644
--- a/drivers/input/keyboard/qt2160.c
+++ b/drivers/input/keyboard/qt2160.c
@@ -58,10 +58,9 @@ static unsigned char qt2160_key2code[] = {
 struct qt2160_led {
         struct qt2160_data *qt2160;
         struct led_classdev cdev;
-        struct work_struct work;
         char name[32];
         int id;
-        enum led_brightness new_brightness;
+        enum led_brightness brightness;
 };
 #endif
 
@@ -74,7 +73,6 @@ struct qt2160_data {
         u16 key_matrix;
 #ifdef CONFIG_LEDS_CLASS
         struct qt2160_led leds[QT2160_NUM_LEDS_X];
-        struct mutex led_lock;
 #endif
 };
 
@@ -83,46 +81,39 @@ static int qt2160_write(struct i2c_client *client, u8 reg, u8 data);
 
 #ifdef CONFIG_LEDS_CLASS
 
-static void qt2160_led_work(struct work_struct *work)
+static int qt2160_led_set(struct led_classdev *cdev,
+                          enum led_brightness value)
 {
-        struct qt2160_led *led = container_of(work, struct qt2160_led, work);
+        struct qt2160_led *led = container_of(cdev, struct qt2160_led, cdev);
         struct qt2160_data *qt2160 = led->qt2160;
         struct i2c_client *client = qt2160->client;
-        int value = led->new_brightness;
         u32 drive, pwmen;
 
-        mutex_lock(&qt2160->led_lock);
-
-        drive = qt2160_read(client, QT2160_CMD_DRIVE_X);
-        pwmen = qt2160_read(client, QT2160_CMD_PWMEN_X);
-        if (value != LED_OFF) {
-                drive |= (1 << led->id);
-                pwmen |= (1 << led->id);
-
-        } else {
-                drive &= ~(1 << led->id);
-                pwmen &= ~(1 << led->id);
-        }
-        qt2160_write(client, QT2160_CMD_DRIVE_X, drive);
-        qt2160_write(client, QT2160_CMD_PWMEN_X, pwmen);
+        if (value != led->brightness) {
+                drive = qt2160_read(client, QT2160_CMD_DRIVE_X);
+                pwmen = qt2160_read(client, QT2160_CMD_PWMEN_X);
+                if (value != LED_OFF) {
+                        drive |= BIT(led->id);
+                        pwmen |= BIT(led->id);
 
-        /*
-         * Changing this register will change the brightness
-         * of every LED in the qt2160. It's a HW limitation.
-         */
-        if (value != LED_OFF)
-                qt2160_write(client, QT2160_CMD_PWM_DUTY, value);
+                } else {
+                        drive &= ~BIT(led->id);
+                        pwmen &= ~BIT(led->id);
+                }
+                qt2160_write(client, QT2160_CMD_DRIVE_X, drive);
+                qt2160_write(client, QT2160_CMD_PWMEN_X, pwmen);
 
-        mutex_unlock(&qt2160->led_lock);
-}
+                /*
+                 * Changing this register will change the brightness
+                 * of every LED in the qt2160. It's a HW limitation.
+                 */
+                if (value != LED_OFF)
+                        qt2160_write(client, QT2160_CMD_PWM_DUTY, value);
 
-static void qt2160_led_set(struct led_classdev *cdev,
-                           enum led_brightness value)
-{
-        struct qt2160_led *led = container_of(cdev, struct qt2160_led, cdev);
+                led->brightness = value;
+        }
 
-        led->new_brightness = value;
-        schedule_work(&led->work);
+        return 0;
 }
 
 #endif /* CONFIG_LEDS_CLASS */
@@ -293,20 +284,16 @@ static int qt2160_register_leds(struct qt2160_data *qt2160)
         int ret;
         int i;
 
-        mutex_init(&qt2160->led_lock);
-
         for (i = 0; i < QT2160_NUM_LEDS_X; i++) {
                 struct qt2160_led *led = &qt2160->leds[i];
 
                 snprintf(led->name, sizeof(led->name), "qt2160:x%d", i);
                 led->cdev.name = led->name;
-                led->cdev.brightness_set = qt2160_led_set;
+                led->cdev.brightness_set_blocking = qt2160_led_set;
                 led->cdev.brightness = LED_OFF;
                 led->id = i;
                 led->qt2160 = qt2160;
 
-                INIT_WORK(&led->work, qt2160_led_work);
-
                 ret = led_classdev_register(&client->dev, &led->cdev);
                 if (ret < 0)
                         return ret;
@@ -324,10 +311,8 @@ static void qt2160_unregister_leds(struct qt2160_data *qt2160)
 {
         int i;
 
-        for (i = 0; i < QT2160_NUM_LEDS_X; i++) {
+        for (i = 0; i < QT2160_NUM_LEDS_X; i++)
                 led_classdev_unregister(&qt2160->leds[i].cdev);
-                cancel_work_sync(&qt2160->leds[i].work);
-        }
 }
 
 #else
diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c
index babcfb165e4f..3b85631fde91 100644
--- a/drivers/input/keyboard/st-keyscan.c
+++ b/drivers/input/keyboard/st-keyscan.c
@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev)
 
         input_dev->id.bustype = BUS_HOST;
 
+        keypad_data->input_dev = input_dev;
+
         error = keypad_matrix_key_parse_dt(keypad_data);
         if (error)
                 return error;
@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)
 
         input_set_drvdata(input_dev, keypad_data);
 
-        keypad_data->input_dev = input_dev;
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         keypad_data->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(keypad_data->base))
diff --git a/drivers/input/misc/apanel.c b/drivers/input/misc/apanel.c
index 094bddf56755..c1e66f45d552 100644
--- a/drivers/input/misc/apanel.c
+++ b/drivers/input/misc/apanel.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/input-polldev.h>
 #include <linux/i2c.h>
-#include <linux/workqueue.h>
 #include <linux/leds.h>
 
 #define APANEL_NAME     "Fujitsu Application Panel"
@@ -59,8 +58,6 @@ struct apanel {
         struct i2c_client *client;
         unsigned short keymap[MAX_PANEL_KEYS];
         u16    nkeys;
-        u16    led_bits;
-        struct work_struct led_work;
         struct led_classdev mail_led;
 };
 
@@ -109,25 +106,13 @@ static void apanel_poll(struct input_polled_dev *ipdev)
                         report_key(idev, ap->keymap[i]);
 }
 
-/* Track state changes of LED */
-static void led_update(struct work_struct *work)
-{
-        struct apanel *ap = container_of(work, struct apanel, led_work);
-
-        i2c_smbus_write_word_data(ap->client, 0x10, ap->led_bits);
-}
-
-static void mail_led_set(struct led_classdev *led,
+static int mail_led_set(struct led_classdev *led,
                          enum led_brightness value)
 {
         struct apanel *ap = container_of(led, struct apanel, mail_led);
+        u16 led_bits = value != LED_OFF ? 0x8000 : 0x0000;
 
-        if (value != LED_OFF)
-                ap->led_bits |= 0x8000;
-        else
-                ap->led_bits &= ~0x8000;
-
-        schedule_work(&ap->led_work);
+        return i2c_smbus_write_word_data(ap->client, 0x10, led_bits);
 }
 
 static int apanel_remove(struct i2c_client *client)
@@ -179,7 +164,7 @@ static struct apanel apanel = {
         },
         .mail_led = {
                 .name = "mail:blue",
-                .brightness_set = mail_led_set,
+                .brightness_set_blocking = mail_led_set,
         },
 };
 
@@ -235,7 +220,6 @@ static int apanel_probe(struct i2c_client *client,
         if (err)
                 goto out3;
 
-        INIT_WORK(&ap->led_work, led_update);
         if (device_chip[APANEL_DEV_LED] != CHIP_NONE) {
                 err = led_classdev_register(&client->dev, &ap->mail_led);
                 if (err)
diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
index 1efcfdf9f8a8..dd9dd4e40827 100644
--- a/drivers/input/misc/bma150.c
+++ b/drivers/input/misc/bma150.c
@@ -481,13 +481,14 @@ static int bma150_register_input_device(struct bma150_data *bma150)
         idev->close = bma150_irq_close;
         input_set_drvdata(idev, bma150);
 
+        bma150->input = idev;
+
         error = input_register_device(idev);
         if (error) {
                 input_free_device(idev);
                 return error;
         }
 
-        bma150->input = idev;
         return 0;
 }
 
@@ -510,15 +511,15 @@ static int bma150_register_polled_device(struct bma150_data *bma150)
 
         bma150_init_input_device(bma150, ipoll_dev->input);
 
+        bma150->input_polled = ipoll_dev;
+        bma150->input = ipoll_dev->input;
+
         error = input_register_polled_device(ipoll_dev);
         if (error) {
                 input_free_polled_device(ipoll_dev);
                 return error;
         }
 
-        bma150->input_polled = ipoll_dev;
-        bma150->input = ipoll_dev->input;
-
         return 0;
 }
 
diff --git a/drivers/input/misc/pwm-vibra.c b/drivers/input/misc/pwm-vibra.c
index 55da191ae550..dbb6d9e1b947 100644
--- a/drivers/input/misc/pwm-vibra.c
+++ b/drivers/input/misc/pwm-vibra.c
@@ -34,6 +34,7 @@ struct pwm_vibrator {
         struct work_struct play_work;
         u16 level;
         u32 direction_duty_cycle;
+        bool vcc_on;
 };
 
 static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
@@ -42,10 +43,13 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
         struct pwm_state state;
         int err;
 
-        err = regulator_enable(vibrator->vcc);
-        if (err) {
-                dev_err(pdev, "failed to enable regulator: %d", err);
-                return err;
+        if (!vibrator->vcc_on) {
+                err = regulator_enable(vibrator->vcc);
+                if (err) {
+                        dev_err(pdev, "failed to enable regulator: %d", err);
+                        return err;
+                }
+                vibrator->vcc_on = true;
         }
 
         pwm_get_state(vibrator->pwm, &state);
@@ -76,11 +80,14 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
 
 static void pwm_vibrator_stop(struct pwm_vibrator *vibrator)
 {
-        regulator_disable(vibrator->vcc);
-
         if (vibrator->pwm_dir)
                 pwm_disable(vibrator->pwm_dir);
         pwm_disable(vibrator->pwm);
+
+        if (vibrator->vcc_on) {
+                regulator_disable(vibrator->vcc);
+                vibrator->vcc_on = false;
+        }
 }
 
 static void pwm_vibrator_play_work(struct work_struct *work)
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index f322a1768fbb..225ae6980182 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1336,7 +1336,6 @@ MODULE_DEVICE_TABLE(i2c, elan_id);
 static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0000", 0 },
         { "ELAN0100", 0 },
-        { "ELAN0501", 0 },
         { "ELAN0600", 0 },
         { "ELAN0602", 0 },
         { "ELAN0605", 0 },
@@ -1346,6 +1345,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN060C", 0 },
         { "ELAN0611", 0 },
         { "ELAN0612", 0 },
+        { "ELAN0617", 0 },
         { "ELAN0618", 0 },
         { "ELAN061C", 0 },
         { "ELAN061D", 0 },
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 9fe075c137dc..a7f8b1614559 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1119,6 +1119,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX31               0x361f00        20, 15, 0e      clickpad
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
+ * Fujitsu CELSIUS H760    0x570f02        40, 14, 0c      3 hw buttons (**)
+ * Fujitsu CELSIUS H780    0x5d0f02        41, 16, 0d      3 hw buttons (**)
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E546   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
@@ -1171,6 +1173,13 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
                 },
         },
+        {
+                /* Fujitsu H780 also has a middle button */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"),
+                },
+        },
 #endif
         { }
 };
diff --git a/drivers/input/serio/ps2-gpio.c b/drivers/input/serio/ps2-gpio.c
index c62cceb97bb1..5e8d8384aa2a 100644
--- a/drivers/input/serio/ps2-gpio.c
+++ b/drivers/input/serio/ps2-gpio.c
@@ -76,6 +76,7 @@ static void ps2_gpio_close(struct serio *serio)
 {
         struct ps2_gpio_data *drvdata = serio->port_data;
 
+        flush_delayed_work(&drvdata->tx_work);
         disable_irq(drvdata->irq);
 }
 
diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
index d713271ebf7c..a64116586b4c 100644
--- a/drivers/mailbox/bcm-flexrm-mailbox.c
+++ b/drivers/mailbox/bcm-flexrm-mailbox.c
@@ -1396,9 +1396,9 @@ static void flexrm_shutdown(struct mbox_chan *chan)
 
         /* Clear ring flush state */
         timeout = 1000; /* timeout of 1s */
-        writel_relaxed(0x0, ring + RING_CONTROL);
+        writel_relaxed(0x0, ring->regs + RING_CONTROL);
         do {
-                if (!(readl_relaxed(ring + RING_FLUSH_DONE) &
+                if (!(readl_relaxed(ring->regs + RING_FLUSH_DONE) &
                       FLUSH_DONE_MASK))
                         break;
                 mdelay(1);
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index c6a7d4582dc6..38d9df3fb199 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -310,6 +310,7 @@ int mbox_flush(struct mbox_chan *chan, unsigned long timeout)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(mbox_flush);
 
 /**
  * mbox_request_channel - Request a mailbox channel.
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 47d4e0d30bf0..dd538e6b2748 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -932,7 +932,7 @@ static int dm_crypt_integrity_io_alloc(struct dm_crypt_io *io, struct bio *bio)
         if (IS_ERR(bip))
                 return PTR_ERR(bip);
 
-        tag_len = io->cc->on_disk_tag_size * bio_sectors(bio);
+        tag_len = io->cc->on_disk_tag_size * (bio_sectors(bio) >> io->cc->sector_shift);
 
         bip->bip_iter.bi_size = tag_len;
         bip->bip_iter.bi_sector = io->cc->start + io->sector;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ca8af21bf644..e83b63608262 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -257,6 +257,7 @@ struct pool {
 
         spinlock_t lock;
         struct bio_list deferred_flush_bios;
+        struct bio_list deferred_flush_completions;
         struct list_head prepared_mappings;
         struct list_head prepared_discards;
         struct list_head prepared_discards_pt2;
@@ -956,6 +957,39 @@ static void process_prepared_mapping_fail(struct dm_thin_new_mapping *m)
         mempool_free(m, &m->tc->pool->mapping_pool);
 }
 
+static void complete_overwrite_bio(struct thin_c *tc, struct bio *bio)
+{
+        struct pool *pool = tc->pool;
+        unsigned long flags;
+
+        /*
+         * If the bio has the REQ_FUA flag set we must commit the metadata
+         * before signaling its completion.
+         */
+        if (!bio_triggers_commit(tc, bio)) {
+                bio_endio(bio);
+                return;
+        }
+
+        /*
+         * Complete bio with an error if earlier I/O caused changes to the
+         * metadata that can't be committed, e.g, due to I/O errors on the
+         * metadata device.
+         */
+        if (dm_thin_aborted_changes(tc->td)) {
+                bio_io_error(bio);
+                return;
+        }
+
+        /*
+         * Batch together any bios that trigger commits and then issue a
+         * single commit for them in process_deferred_bios().
+         */
+        spin_lock_irqsave(&pool->lock, flags);
+        bio_list_add(&pool->deferred_flush_completions, bio);
+        spin_unlock_irqrestore(&pool->lock, flags);
+}
+
 static void process_prepared_mapping(struct dm_thin_new_mapping *m)
 {
         struct thin_c *tc = m->tc;
@@ -988,7 +1022,7 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
          */
         if (bio) {
                 inc_remap_and_issue_cell(tc, m->cell, m->data_block);
-                bio_endio(bio);
+                complete_overwrite_bio(tc, bio);
         } else {
                 inc_all_io_entry(tc->pool, m->cell->holder);
                 remap_and_issue(tc, m->cell->holder, m->data_block);
@@ -2317,7 +2351,7 @@ static void process_deferred_bios(struct pool *pool)
 {
         unsigned long flags;
         struct bio *bio;
-        struct bio_list bios;
+        struct bio_list bios, bio_completions;
         struct thin_c *tc;
 
         tc = get_first_thin(pool);
@@ -2328,26 +2362,36 @@ static void process_deferred_bios(struct pool *pool)
         }
 
         /*
-         * If there are any deferred flush bios, we must commit
-         * the metadata before issuing them.
+         * If there are any deferred flush bios, we must commit the metadata
+         * before issuing them or signaling their completion.
          */
         bio_list_init(&bios);
+        bio_list_init(&bio_completions);
+
         spin_lock_irqsave(&pool->lock, flags);
         bio_list_merge(&bios, &pool->deferred_flush_bios);
         bio_list_init(&pool->deferred_flush_bios);
+
+        bio_list_merge(&bio_completions, &pool->deferred_flush_completions);
+        bio_list_init(&pool->deferred_flush_completions);
         spin_unlock_irqrestore(&pool->lock, flags);
 
-        if (bio_list_empty(&bios) &&
+        if (bio_list_empty(&bios) && bio_list_empty(&bio_completions) &&
             !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
                 return;
 
         if (commit(pool)) {
+                bio_list_merge(&bios, &bio_completions);
+
                 while ((bio = bio_list_pop(&bios)))
                         bio_io_error(bio);
                 return;
         }
         pool->last_commit_jiffies = jiffies;
 
+        while ((bio = bio_list_pop(&bio_completions)))
+                bio_endio(bio);
+
         while ((bio = bio_list_pop(&bios)))
                 generic_make_request(bio);
 }
@@ -2954,6 +2998,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
         INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
         spin_lock_init(&pool->lock);
         bio_list_init(&pool->deferred_flush_bios);
+        bio_list_init(&pool->deferred_flush_completions);
         INIT_LIST_HEAD(&pool->prepared_mappings);
         INIT_LIST_HEAD(&pool->prepared_discards);
         INIT_LIST_HEAD(&pool->prepared_discards_pt2);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 1d54109071cc..fa47249fa3e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1863,6 +1863,20 @@ static void end_sync_read(struct bio *bio)
                 reschedule_retry(r1_bio);
 }
 
+static void abort_sync_write(struct mddev *mddev, struct r1bio *r1_bio)
+{
+        sector_t sync_blocks = 0;
+        sector_t s = r1_bio->sector;
+        long sectors_to_go = r1_bio->sectors;
+
+        /* make sure these bits don't get cleared. */
+        do {
+                md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
+                s += sync_blocks;
+                sectors_to_go -= sync_blocks;
+        } while (sectors_to_go > 0);
+}
+
 static void end_sync_write(struct bio *bio)
 {
         int uptodate = !bio->bi_status;
@@ -1874,15 +1888,7 @@ static void end_sync_write(struct bio *bio)
         struct md_rdev *rdev = conf->mirrors[find_bio_disk(r1_bio, bio)].rdev;
 
         if (!uptodate) {
-                sector_t sync_blocks = 0;
-                sector_t s = r1_bio->sector;
-                long sectors_to_go = r1_bio->sectors;
-                /* make sure these bits doesn't get cleared. */
-                do {
-                        md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
-                        s += sync_blocks;
-                        sectors_to_go -= sync_blocks;
-                } while (sectors_to_go > 0);
+                abort_sync_write(mddev, r1_bio);
                 set_bit(WriteErrorSeen, &rdev->flags);
                 if (!test_and_set_bit(WantReplacement, &rdev->flags))
                         set_bit(MD_RECOVERY_NEEDED, &
@@ -2172,8 +2178,10 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio)
                      (i == r1_bio->read_disk ||
                       !test_bit(MD_RECOVERY_SYNC, &mddev->recovery))))
                         continue;
-                if (test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+                if (test_bit(Faulty, &conf->mirrors[i].rdev->flags)) {
+                        abort_sync_write(mddev, r1_bio);
                         continue;
+                }
 
                 bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
                 if (test_bit(FailFast, &conf->mirrors[i].rdev->flags))
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index aef1185f383d..14f3fdb8c6bb 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2112,7 +2112,7 @@ static void mmc_blk_mq_req_done(struct mmc_request *mrq)
                 if (waiting)
                         wake_up(&mq->wait);
                 else
-                        kblockd_schedule_work(&mq->complete_work);
+                        queue_work(mq->card->complete_wq, &mq->complete_work);
 
                 return;
         }
@@ -2924,6 +2924,13 @@ static int mmc_blk_probe(struct mmc_card *card)
 
         mmc_fixup_device(card, mmc_blk_fixups);
 
+        card->complete_wq = alloc_workqueue("mmc_complete",
+                                        WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+        if (unlikely(!card->complete_wq)) {
+                pr_err("Failed to create mmc completion workqueue");
+                return -ENOMEM;
+        }
+
         md = mmc_blk_alloc(card);
         if (IS_ERR(md))
                 return PTR_ERR(md);
@@ -2987,6 +2994,7 @@ static void mmc_blk_remove(struct mmc_card *card)
         pm_runtime_put_noidle(&card->dev);
         mmc_blk_remove_req(md);
         dev_set_drvdata(&card->dev, NULL);
+        destroy_workqueue(card->complete_wq);
 }
 
 static int _mmc_blk_suspend(struct mmc_card *card)
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index f19ec60bcbdc..2eba507790e4 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -1338,7 +1338,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                host->regs + SD_EMMC_IRQ_EN);
 
         ret = request_threaded_irq(host->irq, meson_mmc_irq,
-                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
+                                   meson_mmc_irq_thread, IRQF_SHARED,
+                                   dev_name(&pdev->dev), host);
         if (ret)
                 goto err_init_clk;
 
diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
index 279e326e397e..70fadc976795 100644
--- a/drivers/mmc/host/sunxi-mmc.c
+++ b/drivers/mmc/host/sunxi-mmc.c
@@ -1399,13 +1399,37 @@ static int sunxi_mmc_probe(struct platform_device *pdev)
         mmc->caps              |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                                   MMC_CAP_ERASE | MMC_CAP_SDIO_IRQ;
 
-        if (host->cfg->clk_delays || host->use_new_timings)
+        /*
+         * Some H5 devices do not have signal traces precise enough to
+         * use HS DDR mode for their eMMC chips.
+         *
+         * We still enable HS DDR modes for all the other controller
+         * variants that support them.
+         */
+        if ((host->cfg->clk_delays || host->use_new_timings) &&
+            !of_device_is_compatible(pdev->dev.of_node,
+                                     "allwinner,sun50i-h5-emmc"))
                 mmc->caps      |= MMC_CAP_1_8V_DDR | MMC_CAP_3_3V_DDR;
 
         ret = mmc_of_parse(mmc);
         if (ret)
                 goto error_free_dma;
 
+        /*
+         * If we don't support delay chains in the SoC, we can't use any
+         * of the higher speed modes. Mask them out in case the device
+         * tree specifies the properties for them, which gets added to
+         * the caps by mmc_of_parse() above.
+         */
+        if (!(host->cfg->clk_delays || host->use_new_timings)) {
+                mmc->caps &= ~(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR |
+                               MMC_CAP_1_2V_DDR | MMC_CAP_UHS);
+                mmc->caps2 &= ~MMC_CAP2_HS200;
+        }
+
+        /* TODO: This driver doesn't support HS400 mode yet */
+        mmc->caps2 &= ~MMC_CAP2_HS400;
+
         ret = sunxi_mmc_init_host(host);
         if (ret)
                 goto error_free_dma;
diff --git a/drivers/mtd/devices/powernv_flash.c b/drivers/mtd/devices/powernv_flash.c
index 22f753e555ac..83f88b8b5d9f 100644
--- a/drivers/mtd/devices/powernv_flash.c
+++ b/drivers/mtd/devices/powernv_flash.c
@@ -212,7 +212,7 @@ static int powernv_flash_set_driver_info(struct device *dev,
          * Going to have to check what details I need to set and how to
          * get them
          */
-        mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
+        mtd->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFP", dev->of_node);
         mtd->type = MTD_NORFLASH;
         mtd->flags = MTD_WRITEABLE;
         mtd->size = size;
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 999b705769a8..3ef01baef9b6 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -507,6 +507,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd)
 {
         struct nvmem_config config = {};
 
+        config.id = -1;
         config.dev = &mtd->dev;
         config.name = mtd->name;
         config.owner = THIS_MODULE;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index edb1c023a753..21bf8ac78380 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -197,9 +197,9 @@ config VXLAN
 
 config GENEVE
        tristate "Generic Network Virtualization Encapsulation"
-       depends on INET && NET_UDP_TUNNEL
+       depends on INET
        depends on IPV6 || !IPV6
-       select NET_IP_TUNNEL
+       select NET_UDP_TUNNEL
        select GRO_CELLS
        ---help---
           This allows one to create geneve virtual interfaces that provide
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 0e4bbdcc614f..c76892ac4e69 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -344,7 +344,8 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
         b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
 }
 
-static void b53_enable_vlan(struct b53_device *dev, bool enable)
+static void b53_enable_vlan(struct b53_device *dev, bool enable,
+                            bool enable_filtering)
 {
         u8 mgmt, vc0, vc1, vc4 = 0, vc5;
 
@@ -369,8 +370,13 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
                 vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
                 vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
                 vc4 &= ~VC4_ING_VID_CHECK_MASK;
-                vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
-                vc5 |= VC5_DROP_VTABLE_MISS;
+                if (enable_filtering) {
+                        vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+                        vc5 |= VC5_DROP_VTABLE_MISS;
+                } else {
+                        vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
+                        vc5 &= ~VC5_DROP_VTABLE_MISS;
+                }
 
                 if (is5325(dev))
                         vc0 &= ~VC0_RESERVED_1;
@@ -420,6 +426,9 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
         }
 
         b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
+
+        dev->vlan_enabled = enable;
+        dev->vlan_filtering_enabled = enable_filtering;
 }
 
 static int b53_set_jumbo(struct b53_device *dev, bool enable, bool allow_10_100)
@@ -632,25 +641,35 @@ static void b53_enable_mib(struct b53_device *dev)
         b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
 }
 
+static u16 b53_default_pvid(struct b53_device *dev)
+{
+        if (is5325(dev) || is5365(dev))
+                return 1;
+        else
+                return 0;
+}
+
 int b53_configure_vlan(struct dsa_switch *ds)
 {
         struct b53_device *dev = ds->priv;
         struct b53_vlan vl = { 0 };
-        int i;
+        int i, def_vid;
+
+        def_vid = b53_default_pvid(dev);
 
         /* clear all vlan entries */
         if (is5325(dev) || is5365(dev)) {
-                for (i = 1; i < dev->num_vlans; i++)
+                for (i = def_vid; i < dev->num_vlans; i++)
                         b53_set_vlan_entry(dev, i, &vl);
         } else {
                 b53_do_vlan_op(dev, VTA_CMD_CLEAR);
         }
 
-        b53_enable_vlan(dev, false);
+        b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
 
         b53_for_each_port(dev, i)
                 b53_write16(dev, B53_VLAN_PAGE,
-                            B53_VLAN_PORT_DEF_TAG(i), 1);
+                            B53_VLAN_PORT_DEF_TAG(i), def_vid);
 
         if (!is5325(dev) && !is5365(dev))
                 b53_set_jumbo(dev, dev->enable_jumbo, false);
@@ -1255,6 +1274,46 @@ EXPORT_SYMBOL(b53_phylink_mac_link_up);
 
 int b53_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
 {
+        struct b53_device *dev = ds->priv;
+        struct net_device *bridge_dev;
+        unsigned int i;
+        u16 pvid, new_pvid;
+
+        /* Handle the case were multiple bridges span the same switch device
+         * and one of them has a different setting than what is being requested
+         * which would be breaking filtering semantics for any of the other
+         * bridge devices.
+         */
+        b53_for_each_port(dev, i) {
+                bridge_dev = dsa_to_port(ds, i)->bridge_dev;
+                if (bridge_dev &&
+                    bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
+                    br_vlan_enabled(bridge_dev) != vlan_filtering) {
+                        netdev_err(bridge_dev,
+                                   "VLAN filtering is global to the switch!\n");
+                        return -EINVAL;
+                }
+        }
+
+        b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &pvid);
+        new_pvid = pvid;
+        if (dev->vlan_filtering_enabled && !vlan_filtering) {
+                /* Filtering is currently enabled, use the default PVID since
+                 * the bridge does not expect tagging anymore
+                 */
+                dev->ports[port].pvid = pvid;
+                new_pvid = b53_default_pvid(dev);
+        } else if (!dev->vlan_filtering_enabled && vlan_filtering) {
+                /* Filtering is currently disabled, restore the previous PVID */
+                new_pvid = dev->ports[port].pvid;
+        }
+
+        if (pvid != new_pvid)
+                b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
+                            new_pvid);
+
+        b53_enable_vlan(dev, dev->vlan_enabled, vlan_filtering);
+
         return 0;
 }
 EXPORT_SYMBOL(b53_vlan_filtering);
@@ -1270,7 +1329,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
         if (vlan->vid_end > dev->num_vlans)
                 return -ERANGE;
 
-        b53_enable_vlan(dev, true);
+        b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
 
         return 0;
 }
@@ -1300,7 +1359,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
                 b53_fast_age_vlan(dev, vid);
         }
 
-        if (pvid) {
+        if (pvid && !dsa_is_cpu_port(ds, port)) {
                 b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
                             vlan->vid_end);
                 b53_fast_age_vlan(dev, vid);
@@ -1326,12 +1385,8 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
 
                 vl->members &= ~BIT(port);
 
-                if (pvid == vid) {
-                        if (is5325(dev) || is5365(dev))
-                                pvid = 1;
-                        else
-                                pvid = 0;
-                }
+                if (pvid == vid)
+                        pvid = b53_default_pvid(dev);
 
                 if (untagged && !dsa_is_cpu_port(ds, port))
                         vl->untag &= ~(BIT(port));
@@ -1644,10 +1699,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
         b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
         dev->ports[port].vlan_ctl_mask = pvlan;
 
-        if (is5325(dev) || is5365(dev))
-                pvid = 1;
-        else
-                pvid = 0;
+        pvid = b53_default_pvid(dev);
 
         /* Make this port join all VLANs without VLAN entries */
         if (is58xx(dev)) {
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index ec796482792d..4dc7ee38b258 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -91,6 +91,7 @@ enum {
 struct b53_port {
         u16             vlan_ctl_mask;
         struct ethtool_eee eee;
+        u16             pvid;
 };
 
 struct b53_vlan {
@@ -137,6 +138,8 @@ struct b53_device {
 
         unsigned int num_vlans;
         struct b53_vlan *vlans;
+        bool vlan_enabled;
+        bool vlan_filtering_enabled;
         unsigned int num_ports;
         struct b53_port *ports;
 };
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 361fbde76654..14138d423cf1 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -690,7 +690,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
          * port, the other ones have already been disabled during
          * bcm_sf2_sw_setup
          */
-        for (port = 0; port < DSA_MAX_PORTS; port++) {
+        for (port = 0; port < ds->num_ports; port++) {
                 if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port))
                         bcm_sf2_port_disable(ds, port, NULL);
         }
@@ -726,10 +726,11 @@ static void bcm_sf2_sw_get_wol(struct dsa_switch *ds, int port,
 {
         struct net_device *p = ds->ports[port].cpu_dp->master;
         struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
-        struct ethtool_wolinfo pwol;
+        struct ethtool_wolinfo pwol = { };
 
         /* Get the parent device WoL settings */
-        p->ethtool_ops->get_wol(p, &pwol);
+        if (p->ethtool_ops->get_wol)
+                p->ethtool_ops->get_wol(p, &pwol);
 
         /* Advertise the parent device supported settings */
         wol->supported = pwol.supported;
@@ -750,9 +751,10 @@ static int bcm_sf2_sw_set_wol(struct dsa_switch *ds, int port,
         struct net_device *p = ds->ports[port].cpu_dp->master;
         struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
         s8 cpu_port = ds->ports[port].cpu_dp->index;
-        struct ethtool_wolinfo pwol;
+        struct ethtool_wolinfo pwol =  { };
 
-        p->ethtool_ops->get_wol(p, &pwol);
+        if (p->ethtool_ops->get_wol)
+                p->ethtool_ops->get_wol(p, &pwol);
         if (wol->wolopts & ~pwol.supported)
                 return -EINVAL;
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 8dca2c949e73..12fd7ce3f1ff 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -261,6 +261,7 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         unsigned int sub_irq;
         unsigned int n;
         u16 reg;
+        u16 ctl1;
         int err;
 
         mutex_lock(&chip->reg_lock);
@@ -270,13 +271,28 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
         if (err)
                 goto out;
 
-        for (n = 0; n < chip->g1_irq.nirqs; ++n) {
-                if (reg & (1 << n)) {
-                        sub_irq = irq_find_mapping(chip->g1_irq.domain, n);
-                        handle_nested_irq(sub_irq);
-                        ++nhandled;
+        do {
+                for (n = 0; n < chip->g1_irq.nirqs; ++n) {
+                        if (reg & (1 << n)) {
+                                sub_irq = irq_find_mapping(chip->g1_irq.domain,
+                                                           n);
+                                handle_nested_irq(sub_irq);
+                                ++nhandled;
+                        }
                 }
-        }
+
+                mutex_lock(&chip->reg_lock);
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &ctl1);
+                if (err)
+                        goto unlock;
+                err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, &reg);
+unlock:
+                mutex_unlock(&chip->reg_lock);
+                if (err)
+                        goto out;
+                ctl1 &= GENMASK(chip->g1_irq.nirqs, 0);
+        } while (reg & ctl1);
+
 out:
         return (nhandled > 0 ? IRQ_HANDLED : IRQ_NONE);
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index a70bb1bb90e7..a6eacf2099c3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -2663,11 +2663,6 @@ static int ena_restore_device(struct ena_adapter *adapter)
                 goto err_device_destroy;
         }
 
-        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
-        /* Make sure we don't have a race with AENQ Links state handler */
-        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
-                netif_carrier_on(adapter->netdev);
-
         rc = ena_enable_msix_and_set_admin_interrupts(adapter,
                                                       adapter->num_queues);
         if (rc) {
@@ -2684,6 +2679,11 @@ static int ena_restore_device(struct ena_adapter *adapter)
         }
 
         set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
+
+        clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+        if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
+                netif_carrier_on(adapter->netdev);
+
         mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
         dev_err(&pdev->dev,
                 "Device reset completed successfully, Driver info: %s\n",
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index dc8b6173d8d8..63870072cbbd 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    2
 #define DRV_MODULE_VER_MINOR    0
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 3
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 28c9b0bdf2f6..bc3ac369cbe3 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -134,6 +134,10 @@ static void bcm_sysport_set_rx_csum(struct net_device *dev,
 
         priv->rx_chk_en = !!(wanted & NETIF_F_RXCSUM);
         reg = rxchk_readl(priv, RXCHK_CONTROL);
+        /* Clear L2 header checks, which would prevent BPDUs
+         * from being received.
+         */
+        reg &= ~RXCHK_L2_HDR_DIS;
         if (priv->rx_chk_en)
                 reg |= RXCHK_EN;
         else
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 2370dc204202..697c2427f2b7 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2098,6 +2098,7 @@ static int fec_enet_get_regs_len(struct net_device *ndev)
 #if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || \
         defined(CONFIG_M520x) || defined(CONFIG_M532x) || defined(CONFIG_ARM) || \
         defined(CONFIG_ARM64) || defined(CONFIG_COMPILE_TEST)
+static __u32 fec_enet_register_version = 2;
 static u32 fec_enet_register_offset[] = {
         FEC_IEVENT, FEC_IMASK, FEC_R_DES_ACTIVE_0, FEC_X_DES_ACTIVE_0,
         FEC_ECNTRL, FEC_MII_DATA, FEC_MII_SPEED, FEC_MIB_CTRLSTAT, FEC_R_CNTRL,
@@ -2128,6 +2129,7 @@ static u32 fec_enet_register_offset[] = {
         IEEE_R_FDXFC, IEEE_R_OCTETS_OK
 };
 #else
+static __u32 fec_enet_register_version = 1;
 static u32 fec_enet_register_offset[] = {
         FEC_ECNTRL, FEC_IEVENT, FEC_IMASK, FEC_IVEC, FEC_R_DES_ACTIVE_0,
         FEC_R_DES_ACTIVE_1, FEC_R_DES_ACTIVE_2, FEC_X_DES_ACTIVE_0,
@@ -2149,6 +2151,8 @@ static void fec_enet_get_regs(struct net_device *ndev,
         u32 *buf = (u32 *)regbuf;
         u32 i, off;
 
+        regs->version = fec_enet_register_version;
+
         memset(buf, 0, regs->len);
 
         for (i = 0; i < ARRAY_SIZE(fec_enet_register_offset); i++) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 3b9e74be5fbd..ac55db065f16 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         dsaf_dev = dev_get_drvdata(&pdev->dev);
         if (!dsaf_dev) {
                 dev_err(&pdev->dev, "dsaf_dev is NULL\n");
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
         if (AE_IS_VER1(dsaf_dev->dsaf_ver)) {
                 dev_err(dsaf_dev->dev, "%s v1 chip doesn't support RoCE!\n",
                         dsaf_dev->ae_dev.name);
+                put_device(&pdev->dev);
                 return -ENODEV;
         }
 
@@ -3126,6 +3128,9 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
                 dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1);
                 dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit);
         }
+
+        put_device(&pdev->dev);
+
         return 0;
 }
 EXPORT_SYMBOL(hns_dsaf_roce_reset);
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 2f427271a793..292a668ce88e 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2879,7 +2879,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
 
         ret = mv643xx_eth_shared_of_probe(pdev);
         if (ret)
-                return ret;
+                goto err_put_clk;
         pd = dev_get_platdata(&pdev->dev);
 
         msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
@@ -2887,6 +2887,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
         infer_hw_params(msp);
 
         return 0;
+
+err_put_clk:
+        if (!IS_ERR(msp->clk))
+                clk_disable_unprepare(msp->clk);
+        return ret;
 }
 
 static int mv643xx_eth_shared_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index f3a5fa84860f..57727fe1501e 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5073,7 +5073,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         INIT_WORK(&hw->restart_work, sky2_restart);
 
         pci_set_drvdata(pdev, hw);
-        pdev->d3_delay = 200;
+        pdev->d3_delay = 300;
 
         return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 6b88881b8e35..c1438ae52a11 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3360,7 +3360,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         dev->addr_len = ETH_ALEN;
         mlx4_en_u64_to_mac(dev->dev_addr, mdev->dev->caps.def_mac[priv->port]);
         if (!is_valid_ether_addr(dev->dev_addr)) {
-                en_err(priv, "Port: %d, invalid mac burned: %pM, quiting\n",
+                en_err(priv, "Port: %d, invalid mac burned: %pM, quitting\n",
                        priv->port, dev->dev_addr);
                 err = -EINVAL;
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 9a0881cb7f51..6c01314e87b0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -617,6 +617,8 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
 }
 #endif
 
+#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
+
 /* We reach this function only after checking that any of
  * the (IPv4 | IPv6) bits are set in cqe->status.
  */
@@ -624,9 +626,20 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
                       netdev_features_t dev_features)
 {
         __wsum hw_checksum = 0;
+        void *hdr;
+
+        /* CQE csum doesn't cover padding octets in short ethernet
+         * frames. And the pad field is appended prior to calculating
+         * and appending the FCS field.
+         *
+         * Detecting these padded frames requires to verify and parse
+         * IP headers, so we simply force all those small frames to skip
+         * checksum complete.
+         */
+        if (short_frame(skb->len))
+                return -EINVAL;
 
-        void *hdr = (u8 *)va + sizeof(struct ethhdr);
-
+        hdr = (u8 *)va + sizeof(struct ethhdr);
         hw_checksum = csum_unfold((__force __sum16)cqe->checksum);
 
         if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) &&
@@ -819,6 +832,11 @@ xdp_drop_no_cnt:
                 skb_record_rx_queue(skb, cq_ring);
 
                 if (likely(dev->features & NETIF_F_RXCSUM)) {
+                        /* TODO: For IP non TCP/UDP packets when csum complete is
+                         * not an option (not supported or any other reason) we can
+                         * actually check cqe IPOK status bit and report
+                         * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE
+                         */
                         if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP |
                                                        MLX4_CQE_STATUS_UDP)) &&
                             (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3e0fa8a8077b..e267ff93e8a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1583,6 +1583,24 @@ no_trig:
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 }
 
+void mlx5_cmd_flush(struct mlx5_core_dev *dev)
+{
+        struct mlx5_cmd *cmd = &dev->cmd;
+        int i;
+
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                while (down_trylock(&cmd->sem))
+                        mlx5_cmd_trigger_completions(dev);
+
+        while (down_trylock(&cmd->pages_sem))
+                mlx5_cmd_trigger_completions(dev);
+
+        /* Unlock cmdif */
+        up(&cmd->pages_sem);
+        for (i = 0; i < cmd->max_reg_cmds; i++)
+                up(&cmd->sem);
+}
+
 static int status_to_err(u8 status)
 {
         return status ? -1 : 0; /* TBD more meaningful codes */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 8fa8fdd30b85..448a92561567 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -657,6 +657,7 @@ struct mlx5e_channel_stats {
 enum {
         MLX5E_STATE_OPENED,
         MLX5E_STATE_DESTROYING,
+        MLX5E_STATE_XDP_TX_ENABLED,
 };
 
 struct mlx5e_rqt {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 3740177eed09..03b2a9f9c589 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -365,7 +365,8 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
         int sq_num;
         int i;
 
-        if (unlikely(!test_bit(MLX5E_STATE_OPENED, &priv->state)))
+        /* this flag is sufficient, no need to test internal sq state */
+        if (unlikely(!mlx5e_xdp_tx_is_enabled(priv)))
                 return -ENETDOWN;
 
         if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
@@ -378,9 +379,6 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
 
         sq = &priv->channels.c[sq_num]->xdpsq;
 
-        if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
-                return -ENETDOWN;
-
         for (i = 0; i < n; i++) {
                 struct xdp_frame *xdpf = frames[i];
                 struct mlx5e_xdp_info xdpi;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
index 3a67cb3cd179..ee27a7c8cd87 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
@@ -50,6 +50,23 @@ void mlx5e_xdp_rx_poll_complete(struct mlx5e_rq *rq);
 int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
                    u32 flags);
 
+static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv)
+{
+        set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
+static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
+{
+        clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+        /* let other device's napi(s) see our new state */
+        synchronize_rcu();
+}
+
+static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
+{
+        return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+}
+
 static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq)
 {
         if (sq->doorbell_cseg) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 3bbccead2f63..47233b9a4f81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -354,9 +354,6 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
 
         new_channels.params = priv->channels.params;
         new_channels.params.num_channels = count;
-        if (!netif_is_rxfh_configured(priv->netdev))
-                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
-                                              MLX5E_INDIR_RQT_SIZE, count);
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
@@ -372,6 +369,10 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
         if (arfs_enabled)
                 mlx5e_arfs_disable(priv);
 
+        if (!netif_is_rxfh_configured(priv->netdev))
+                mlx5e_build_default_indir_rqt(priv->rss_params.indirection_rqt,
+                                              MLX5E_INDIR_RQT_SIZE, count);
+
         /* Switch to new channels, set new parameters and close old ones */
         mlx5e_switch_priv_channels(priv, &new_channels, NULL);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 01819e5c9975..93e50ccd44c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2938,6 +2938,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
 
         mlx5e_build_tx2sq_maps(priv);
         mlx5e_activate_channels(&priv->channels);
+        mlx5e_xdp_tx_enable(priv);
         netif_tx_start_all_queues(priv->netdev);
 
         if (mlx5e_is_vport_rep(priv))
@@ -2959,6 +2960,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv)
          */
         netif_tx_stop_all_queues(priv->netdev);
         netif_tx_disable(priv->netdev);
+        mlx5e_xdp_tx_disable(priv);
         mlx5e_deactivate_channels(&priv->channels);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/events.c b/drivers/net/ethernet/mellanox/mlx5/core/events.c
index fbc42b7252a9..503035469d2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/events.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/events.c
@@ -211,11 +211,10 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
         enum port_module_event_status_type module_status;
         enum port_module_event_error_type error_type;
         struct mlx5_eqe_port_module *module_event_eqe;
-        const char *status_str, *error_str;
+        const char *status_str;
         u8 module_num;
 
         module_event_eqe = &eqe->data.port_module;
-        module_num = module_event_eqe->module;
         module_status = module_event_eqe->module_status &
                         PORT_MODULE_EVENT_MODULE_STATUS_MASK;
         error_type = module_event_eqe->error_type &
@@ -223,25 +222,27 @@ static int port_module(struct notifier_block *nb, unsigned long type, void *data
 
         if (module_status < MLX5_MODULE_STATUS_NUM)
                 events->pme_stats.status_counters[module_status]++;
-        status_str = mlx5_pme_status_to_string(module_status);
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+        if (module_status == MLX5_MODULE_STATUS_ERROR)
                 if (error_type < MLX5_MODULE_EVENT_ERROR_NUM)
                         events->pme_stats.error_counters[error_type]++;
-                error_str = mlx5_pme_error_to_string(error_type);
-        }
 
         if (!printk_ratelimit())
                 return NOTIFY_OK;
 
-        if (module_status == MLX5_MODULE_STATUS_ERROR)
+        module_num = module_event_eqe->module;
+        status_str = mlx5_pme_status_to_string(module_status);
+        if (module_status == MLX5_MODULE_STATUS_ERROR) {
+                const char *error_str = mlx5_pme_error_to_string(error_type);
+
                 mlx5_core_err(events->dev,
                               "Port module event[error]: module %u, %s, %s\n",
                               module_num, status_str, error_str);
-        else
+        } else {
                 mlx5_core_info(events->dev,
                                "Port module event: module %u, %s\n",
                                module_num, status_str);
+        }
 
         return NOTIFY_OK;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 196c07383082..cb9fa3430c53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -103,7 +103,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
         mlx5_core_err(dev, "start\n");
         if (pci_channel_offline(dev->pdev) || in_fatal(dev) || force) {
                 dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
-                mlx5_cmd_trigger_completions(dev);
+                mlx5_cmd_flush(dev);
         }
 
         mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 5300b0b6d836..4fdac020b795 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -126,6 +126,7 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev,
                              struct ptp_system_timestamp *sts);
 
 void mlx5_cmd_trigger_completions(struct mlx5_core_dev *dev);
+void mlx5_cmd_flush(struct mlx5_core_dev *dev);
 int mlx5_cq_debugfs_init(struct mlx5_core_dev *dev);
 void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev);
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 32519c93df17..b65e274b02e9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -862,8 +862,9 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                 bool configure = false;
                 bool pfc = false;
+                u16 thres_cells;
+                u16 delay_cells;
                 bool lossy;
-                u16 thres;
 
                 for (j = 0; j < IEEE_8021QAZ_MAX_TCS; j++) {
                         if (prio_tc[j] == i) {
@@ -877,10 +878,11 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
                         continue;
 
                 lossy = !(pfc || pause_en);
-                thres = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
-                delay = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay, pfc,
-                                                  pause_en);
-                mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres + delay, thres, lossy);
+                thres_cells = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
+                delay_cells = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay,
+                                                        pfc, pause_en);
+                mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres_cells + delay_cells,
+                                     thres_cells, lossy);
         }
 
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pbmc), pbmc_pl);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index beb8e5d6401a..ded556b7bab5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1688,6 +1688,15 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
 
         eth_hlen = ETH_HLEN + (vlan_valid ? sizeof(u32) : 0);
 
+        if (!ether_addr_equal(ethh->h_dest,
+                              p_hwfn->p_rdma_info->iwarp.mac_addr)) {
+                DP_VERBOSE(p_hwfn,
+                           QED_MSG_RDMA,
+                           "Got unexpected mac %pM instead of %pM\n",
+                           ethh->h_dest, p_hwfn->p_rdma_info->iwarp.mac_addr);
+                return -EINVAL;
+        }
+
         ether_addr_copy(remote_mac_addr, ethh->h_source);
         ether_addr_copy(local_mac_addr, ethh->h_dest);
 
@@ -2605,7 +2614,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
         struct qed_iwarp_info *iwarp_info;
         struct qed_ll2_acquire_data data;
         struct qed_ll2_cbs cbs;
-        u32 mpa_buff_size;
+        u32 buff_size;
         u16 n_ooo_bufs;
         int rc = 0;
         int i;
@@ -2632,7 +2641,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 
         memset(&data, 0, sizeof(data));
         data.input.conn_type = QED_LL2_TYPE_IWARP;
-        data.input.mtu = QED_IWARP_MAX_SYN_PKT_SIZE;
+        data.input.mtu = params->max_mtu;
         data.input.rx_num_desc = QED_IWARP_LL2_SYN_RX_SIZE;
         data.input.tx_num_desc = QED_IWARP_LL2_SYN_TX_SIZE;
         data.input.tx_max_bds_per_packet = 1;   /* will never be fragmented */
@@ -2654,9 +2663,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
                 goto err;
         }
 
+        buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
         rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
                                          QED_IWARP_LL2_SYN_RX_SIZE,
-                                         QED_IWARP_MAX_SYN_PKT_SIZE,
+                                         buff_size,
                                          iwarp_info->ll2_syn_handle);
         if (rc)
                 goto err;
@@ -2710,10 +2720,9 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
         if (rc)
                 goto err;
 
-        mpa_buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
         rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
                                          data.input.rx_num_desc,
-                                         mpa_buff_size,
+                                         buff_size,
                                          iwarp_info->ll2_mpa_handle);
         if (rc)
                 goto err;
@@ -2726,7 +2735,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
 
         iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
 
-        iwarp_info->mpa_intermediate_buf = kzalloc(mpa_buff_size, GFP_KERNEL);
+        iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
         if (!iwarp_info->mpa_intermediate_buf)
                 goto err;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
index b8f612d00241..7ac959038324 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
@@ -46,7 +46,6 @@ enum qed_iwarp_qp_state qed_roce2iwarp_state(enum qed_roce_qp_state state);
 
 #define QED_IWARP_LL2_SYN_TX_SIZE       (128)
 #define QED_IWARP_LL2_SYN_RX_SIZE       (256)
-#define QED_IWARP_MAX_SYN_PKT_SIZE      (128)
 
 #define QED_IWARP_LL2_OOO_DEF_TX_SIZE   (256)
 #define QED_IWARP_MAX_OOO               (16)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index abb94c543aa2..6e36b88ca7c9 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1286,11 +1286,13 @@ static u16 rtl_get_events(struct rtl8169_private *tp)
 static void rtl_ack_events(struct rtl8169_private *tp, u16 bits)
 {
         RTL_W16(tp, IntrStatus, bits);
+        mmiowb();
 }
 
 static void rtl_irq_disable(struct rtl8169_private *tp)
 {
         RTL_W16(tp, IntrMask, 0);
+        mmiowb();
 }
 
 #define RTL_EVENT_NAPI_RX       (RxOK | RxErr)
@@ -6072,7 +6074,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
         struct device *d = tp_to_dev(tp);
         dma_addr_t mapping;
         u32 opts[2], len;
-        bool stop_queue;
         int frags;
 
         if (unlikely(!rtl_tx_slots_avail(tp, skb_shinfo(skb)->nr_frags))) {
@@ -6114,6 +6115,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         txd->opts2 = cpu_to_le32(opts[1]);
 
+        netdev_sent_queue(dev, skb->len);
+
         skb_tx_timestamp(skb);
 
         /* Force memory writes to complete before releasing descriptor */
@@ -6126,14 +6129,16 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
 
         tp->cur_tx += frags + 1;
 
-        stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS);
-        if (unlikely(stop_queue))
-                netif_stop_queue(dev);
+        RTL_W8(tp, TxPoll, NPQ);
 
-        if (__netdev_sent_queue(dev, skb->len, skb->xmit_more))
-                RTL_W8(tp, TxPoll, NPQ);
+        mmiowb();
 
-        if (unlikely(stop_queue)) {
+        if (!rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) {
+                /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must
+                 * not miss a ring update when it notices a stopped queue.
+                 */
+                smp_wmb();
+                netif_stop_queue(dev);
                 /* Sync with rtl_tx:
                  * - publish queue status and cur_tx ring index (write barrier)
                  * - refresh dirty_tx ring index (read barrier).
@@ -6483,7 +6488,9 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete_done(napi, work_done);
+
                 rtl_irq_enable(tp);
+                mmiowb();
         }
 
         return work_done;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 2f2bda68d861..c08034154a9a 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6115,7 +6115,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
-        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
         struct efx_mcdi_mtd_partition *parts;
         size_t outlen, n_parts_total, i, n_parts;
         unsigned int type;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 20299f6f65fc..736e29635b77 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -241,15 +241,18 @@ static inline void dwmac4_get_timestamp(void *desc, u32 ats, u64 *ts)
 static int dwmac4_rx_check_timestamp(void *desc)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
+        unsigned int rdes0 = le32_to_cpu(p->des0);
+        unsigned int rdes1 = le32_to_cpu(p->des1);
+        unsigned int rdes3 = le32_to_cpu(p->des3);
         u32 own, ctxt;
         int ret = 1;
 
-        own = p->des3 & RDES3_OWN;
-        ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
+        own = rdes3 & RDES3_OWN;
+        ctxt = ((rdes3 & RDES3_CONTEXT_DESCRIPTOR)
                 >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
 
         if (likely(!own && ctxt)) {
-                if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
+                if ((rdes0 == 0xffffffff) && (rdes1 == 0xffffffff))
                         /* Corrupted value */
                         ret = -EINVAL;
                 else
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 5d85742a2be0..3c749c327cbd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -696,25 +696,27 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
                                      struct ethtool_eee *edata)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
+        int ret;
 
-        priv->eee_enabled = edata->eee_enabled;
-
-        if (!priv->eee_enabled)
+        if (!edata->eee_enabled) {
                 stmmac_disable_eee_mode(priv);
-        else {
+        } else {
                 /* We are asking for enabling the EEE but it is safe
                  * to verify all by invoking the eee_init function.
                  * In case of failure it will return an error.
                  */
-                priv->eee_enabled = stmmac_eee_init(priv);
-                if (!priv->eee_enabled)
+                edata->eee_enabled = stmmac_eee_init(priv);
+                if (!edata->eee_enabled)
                         return -EOPNOTSUPP;
-
-                /* Do not change tx_lpi_timer in case of failure */
-                priv->tx_lpi_timer = edata->tx_lpi_timer;
         }
 
-        return phy_ethtool_set_eee(dev->phydev, edata);
+        ret = phy_ethtool_set_eee(dev->phydev, edata);
+        if (ret)
+                return ret;
+
+        priv->eee_enabled = edata->eee_enabled;
+        priv->tx_lpi_timer = edata->tx_lpi_timer;
+        return 0;
 }
 
 static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 1f612268c998..d847f672a705 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -259,7 +259,7 @@ static int netcp_module_probe(struct netcp_device *netcp_device,
                 const char *name;
                 char node_name[32];
 
-                if (of_property_read_string(node, "label", &name) < 0) {
+                if (of_property_read_string(child, "label", &name) < 0) {
                         snprintf(node_name, sizeof(node_name), "%pOFn", child);
                         name = node_name;
                 }
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 189cd2048c3a..c5675df5fc6f 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -553,7 +553,7 @@ int phy_start_aneg(struct phy_device *phydev)
         if (err < 0)
                 goto out_unlock;
 
-        if (__phy_is_started(phydev)) {
+        if (phy_is_started(phydev)) {
                 if (phydev->autoneg == AUTONEG_ENABLE) {
                         err = phy_check_link_status(phydev);
                 } else {
@@ -709,7 +709,7 @@ void phy_stop_machine(struct phy_device *phydev)
         cancel_delayed_work_sync(&phydev->state_queue);
 
         mutex_lock(&phydev->lock);
-        if (__phy_is_started(phydev))
+        if (phy_is_started(phydev))
                 phydev->state = PHY_UP;
         mutex_unlock(&phydev->lock);
 }
@@ -762,9 +762,6 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
 {
         struct phy_device *phydev = phy_dat;
 
-        if (!phy_is_started(phydev))
-                return IRQ_NONE;                /* It can't be ours.  */
-
         if (phydev->drv->did_interrupt && !phydev->drv->did_interrupt(phydev))
                 return IRQ_NONE;
 
@@ -842,15 +839,14 @@ EXPORT_SYMBOL(phy_stop_interrupts);
  */
 void phy_stop(struct phy_device *phydev)
 {
-        mutex_lock(&phydev->lock);
-
-        if (!__phy_is_started(phydev)) {
+        if (!phy_is_started(phydev)) {
                 WARN(1, "called from state %s\n",
                      phy_state_to_str(phydev->state));
-                mutex_unlock(&phydev->lock);
                 return;
         }
 
+        mutex_lock(&phydev->lock);
+
         if (phy_interrupt_is_valid(phydev))
                 phy_disable_interrupts(phydev);
 
@@ -989,8 +985,10 @@ void phy_state_machine(struct work_struct *work)
          * state machine would be pointless and possibly error prone when
          * called from phy_disconnect() synchronously.
          */
+        mutex_lock(&phydev->lock);
         if (phy_polling_mode(phydev) && phy_is_started(phydev))
                 phy_queue_state_machine(phydev, PHY_STATE_TIME);
+        mutex_unlock(&phydev->lock);
 }
 
 /**
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index e7becc7379d7..938803237d7f 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -474,6 +474,17 @@ static void phylink_run_resolve(struct phylink *pl)
                 queue_work(system_power_efficient_wq, &pl->resolve);
 }
 
+static void phylink_run_resolve_and_disable(struct phylink *pl, int bit)
+{
+        unsigned long state = pl->phylink_disable_state;
+
+        set_bit(bit, &pl->phylink_disable_state);
+        if (state == 0) {
+                queue_work(system_power_efficient_wq, &pl->resolve);
+                flush_work(&pl->resolve);
+        }
+}
+
 static void phylink_fixed_poll(struct timer_list *t)
 {
         struct phylink *pl = container_of(t, struct phylink, link_poll);
@@ -924,9 +935,7 @@ void phylink_stop(struct phylink *pl)
         if (pl->link_an_mode == MLO_AN_FIXED && !IS_ERR(pl->link_gpio))
                 del_timer_sync(&pl->link_poll);
 
-        set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED);
 }
 EXPORT_SYMBOL_GPL(phylink_stop);
 
@@ -1632,9 +1641,7 @@ static void phylink_sfp_link_down(void *upstream)
 
         ASSERT_RTNL();
 
-        set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
-        queue_work(system_power_efficient_wq, &pl->resolve);
-        flush_work(&pl->resolve);
+        phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK);
 }
 
 static void phylink_sfp_link_up(void *upstream)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index ad9db652874d..fef701bfad62 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -347,6 +347,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
                                 return ret;
                 }
         }
+        bus->socket_ops->attach(bus->sfp);
         if (bus->started)
                 bus->socket_ops->start(bus->sfp);
         bus->netdev->sfp_bus = bus;
@@ -362,6 +363,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
         if (bus->registered) {
                 if (bus->started)
                         bus->socket_ops->stop(bus->sfp);
+                bus->socket_ops->detach(bus->sfp);
                 if (bus->phydev && ops && ops->disconnect_phy)
                         ops->disconnect_phy(bus->upstream);
         }
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index fd8bb998ae52..68c8fbf099f8 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -184,6 +184,7 @@ struct sfp {
 
         struct gpio_desc *gpio[GPIO_MAX];
 
+        bool attached;
         unsigned int state;
         struct delayed_work poll;
         struct delayed_work timeout;
@@ -1475,7 +1476,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
          */
         switch (sfp->sm_mod_state) {
         default:
-                if (event == SFP_E_INSERT) {
+                if (event == SFP_E_INSERT && sfp->attached) {
                         sfp_module_tx_disable(sfp);
                         sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT);
                 }
@@ -1607,6 +1608,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
         mutex_unlock(&sfp->sm_mutex);
 }
 
+static void sfp_attach(struct sfp *sfp)
+{
+        sfp->attached = true;
+        if (sfp->state & SFP_F_PRESENT)
+                sfp_sm_event(sfp, SFP_E_INSERT);
+}
+
+static void sfp_detach(struct sfp *sfp)
+{
+        sfp->attached = false;
+        sfp_sm_event(sfp, SFP_E_REMOVE);
+}
+
 static void sfp_start(struct sfp *sfp)
 {
         sfp_sm_event(sfp, SFP_E_DEV_UP);
@@ -1667,6 +1681,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee,
 }
 
 static const struct sfp_socket_ops sfp_module_ops = {
+        .attach = sfp_attach,
+        .detach = sfp_detach,
         .start = sfp_start,
         .stop = sfp_stop,
         .module_info = sfp_module_info,
@@ -1834,10 +1850,6 @@ static int sfp_probe(struct platform_device *pdev)
         dev_info(sfp->dev, "Host maximum power %u.%uW\n",
                  sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10);
 
-        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
-        if (!sfp->sfp_bus)
-                return -ENOMEM;
-
         /* Get the initial state, and always signal TX disable,
          * since the network interface will not be up.
          */
@@ -1848,10 +1860,6 @@ static int sfp_probe(struct platform_device *pdev)
                 sfp->state |= SFP_F_RATE_SELECT;
         sfp_set_state(sfp, sfp->state);
         sfp_module_tx_disable(sfp);
-        rtnl_lock();
-        if (sfp->state & SFP_F_PRESENT)
-                sfp_sm_event(sfp, SFP_E_INSERT);
-        rtnl_unlock();
 
         for (i = 0; i < GPIO_MAX; i++) {
                 if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i])
@@ -1884,6 +1892,10 @@ static int sfp_probe(struct platform_device *pdev)
                 dev_warn(sfp->dev,
                          "No tx_disable pin: SFP modules will always be emitting.\n");
 
+        sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
+        if (!sfp->sfp_bus)
+                return -ENOMEM;
+
         return 0;
 }
 
diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
index 31b0acf337e2..64f54b0bbd8c 100644
--- a/drivers/net/phy/sfp.h
+++ b/drivers/net/phy/sfp.h
@@ -7,6 +7,8 @@
 struct sfp;
 
 struct sfp_socket_ops {
+        void (*attach)(struct sfp *sfp);
+        void (*detach)(struct sfp *sfp);
         void (*start)(struct sfp *sfp);
         void (*stop)(struct sfp *sfp);
         int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
index 74a8782313cf..bd6084e315de 100644
--- a/drivers/net/phy/xilinx_gmii2rgmii.c
+++ b/drivers/net/phy/xilinx_gmii2rgmii.c
@@ -44,7 +44,10 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
         u16 val = 0;
         int err;
 
-        err = priv->phy_drv->read_status(phydev);
+        if (priv->phy_drv->read_status)
+                err = priv->phy_drv->read_status(phydev);
+        else
+                err = genphy_read_status(phydev);
         if (err < 0)
                 return err;
 
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index afd9d25d1992..958f1cf67282 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
         }
 }
 
-static bool __team_option_inst_tmp_find(const struct list_head *opts,
-                                        const struct team_option_inst *needle)
-{
-        struct team_option_inst *opt_inst;
-
-        list_for_each_entry(opt_inst, opts, tmp_list)
-                if (opt_inst == needle)
-                        return true;
-        return false;
-}
-
 static int __team_options_register(struct team *team,
                                    const struct team_option *option,
                                    size_t option_count)
@@ -2460,7 +2449,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
         int err = 0;
         int i;
         struct nlattr *nl_option;
-        LIST_HEAD(opt_inst_list);
 
         rtnl_lock();
 
@@ -2480,6 +2468,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                 struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
                 struct nlattr *attr;
                 struct nlattr *attr_data;
+                LIST_HEAD(opt_inst_list);
                 enum team_option_type opt_type;
                 int opt_port_ifindex = 0; /* != 0 for per-port options */
                 u32 opt_array_index = 0;
@@ -2584,23 +2573,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                         if (err)
                                 goto team_put;
                         opt_inst->changed = true;
-
-                        /* dumb/evil user-space can send us duplicate opt,
-                         * keep only the last one
-                         */
-                        if (__team_option_inst_tmp_find(&opt_inst_list,
-                                                        opt_inst))
-                                continue;
-
                         list_add(&opt_inst->tmp_list, &opt_inst_list);
                 }
                 if (!opt_found) {
                         err = -ENOENT;
                         goto team_put;
                 }
-        }
 
-        err = team_nl_send_event_options_get(team, &opt_inst_list);
+                err = team_nl_send_event_options_get(team, &opt_inst_list);
+                if (err)
+                        break;
+        }
 
 team_put:
         team_nl_team_put(team);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 735ad838e2ba..18af2f8eee96 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1201,8 +1201,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC7304/MC7354 */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC7304/MC7354 */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354, WP76xx */
+        {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 10)},/* Sierra Wireless MC7304/MC7354 */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
         {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 60dd1ec1665f..ada6baf8847a 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -557,6 +557,7 @@ enum spd_duplex {
 /* MAC PASSTHRU */
 #define AD_MASK                 0xfee0
 #define BND_MASK                0x0004
+#define BD_MASK                 0x0001
 #define EFUSE                   0xcfdb
 #define PASS_THRU_MASK          0x1
 
@@ -1176,9 +1177,9 @@ static int vendor_mac_passthru_addr_read(struct r8152 *tp, struct sockaddr *sa)
                         return -ENODEV;
                 }
         } else {
-                /* test for RTL8153-BND */
+                /* test for RTL8153-BND and RTL8153-BD */
                 ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_MISC_1);
-                if ((ocp_data & BND_MASK) == 0) {
+                if ((ocp_data & BND_MASK) == 0 && (ocp_data & BD_MASK)) {
                         netif_dbg(tp, probe, tp->netdev,
                                   "Invalid variant for MAC pass through\n");
                         return -ENODEV;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 5209ee9aac47..2aae11feff0c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2219,7 +2219,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
         struct pcpu_sw_netstats *tx_stats, *rx_stats;
         union vxlan_addr loopback;
         union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
-        struct net_device *dev = skb->dev;
+        struct net_device *dev;
         int len = skb->len;
 
         tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
@@ -2239,9 +2239,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
 #endif
         }
 
+        rcu_read_lock();
+        dev = skb->dev;
+        if (unlikely(!(dev->flags & IFF_UP))) {
+                kfree_skb(skb);
+                goto drop;
+        }
+
         if (dst_vxlan->cfg.flags & VXLAN_F_LEARN)
-                vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0,
-                            vni);
+                vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
 
         u64_stats_update_begin(&tx_stats->syncp);
         tx_stats->tx_packets++;
@@ -2254,8 +2260,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
                 rx_stats->rx_bytes += len;
                 u64_stats_update_end(&rx_stats->syncp);
         } else {
+drop:
                 dev->stats.rx_dropped++;
         }
+        rcu_read_unlock();
 }
 
 static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
index 0e6b43bb4678..a5ea3ba495a4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
@@ -158,39 +158,49 @@ static const struct ieee80211_ops mt76x0u_ops = {
         .get_txpower = mt76x02_get_txpower,
 };
 
-static int mt76x0u_register_device(struct mt76x02_dev *dev)
+static int mt76x0u_init_hardware(struct mt76x02_dev *dev)
 {
-        struct ieee80211_hw *hw = dev->mt76.hw;
         int err;
 
-        err = mt76u_alloc_queues(&dev->mt76);
-        if (err < 0)
-                goto out_err;
-
-        err = mt76u_mcu_init_rx(&dev->mt76);
-        if (err < 0)
-                goto out_err;
-
         mt76x0_chip_onoff(dev, true, true);
-        if (!mt76x02_wait_for_mac(&dev->mt76)) {
-                err = -ETIMEDOUT;
-                goto out_err;
-        }
+
+        if (!mt76x02_wait_for_mac(&dev->mt76))
+                return -ETIMEDOUT;
 
         err = mt76x0u_mcu_init(dev);
         if (err < 0)
-                goto out_err;
+                return err;
 
         mt76x0_init_usb_dma(dev);
         err = mt76x0_init_hardware(dev);
         if (err < 0)
-                goto out_err;
+                return err;
 
         mt76_rmw(dev, MT_US_CYC_CFG, MT_US_CYC_CNT, 0x1e);
         mt76_wr(dev, MT_TXOP_CTRL_CFG,
                 FIELD_PREP(MT_TXOP_TRUN_EN, 0x3f) |
                 FIELD_PREP(MT_TXOP_EXT_CCA_DLY, 0x58));
 
+        return 0;
+}
+
+static int mt76x0u_register_device(struct mt76x02_dev *dev)
+{
+        struct ieee80211_hw *hw = dev->mt76.hw;
+        int err;
+
+        err = mt76u_alloc_queues(&dev->mt76);
+        if (err < 0)
+                goto out_err;
+
+        err = mt76u_mcu_init_rx(&dev->mt76);
+        if (err < 0)
+                goto out_err;
+
+        err = mt76x0u_init_hardware(dev);
+        if (err < 0)
+                goto out_err;
+
         err = mt76x0_register_device(dev);
         if (err < 0)
                 goto out_err;
@@ -301,6 +311,8 @@ static int __maybe_unused mt76x0_suspend(struct usb_interface *usb_intf,
 
         mt76u_stop_queues(&dev->mt76);
         mt76x0u_mac_stop(dev);
+        clear_bit(MT76_STATE_MCU_RUNNING, &dev->mt76.state);
+        mt76x0_chip_onoff(dev, false, false);
         usb_kill_urb(usb->mcu.res.urb);
 
         return 0;
@@ -328,7 +340,7 @@ static int __maybe_unused mt76x0_resume(struct usb_interface *usb_intf)
         tasklet_enable(&usb->rx_tasklet);
         tasklet_enable(&usb->tx_tasklet);
 
-        ret = mt76x0_init_hardware(dev);
+        ret = mt76x0u_init_hardware(dev);
         if (ret)
                 goto err;
 
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 022ea1ee63f8..7fee665ec45e 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2560,15 +2560,15 @@ static void nvme_reset_work(struct work_struct *work)
         mutex_lock(&dev->shutdown_lock);
         result = nvme_pci_enable(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         result = nvme_pci_configure_admin_queue(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         result = nvme_alloc_admin_tags(dev);
         if (result)
-                goto out;
+                goto out_unlock;
 
         /*
          * Limit the max command size to prevent iod->sg allocations going
@@ -2651,6 +2651,8 @@ static void nvme_reset_work(struct work_struct *work)
         nvme_start_ctrl(&dev->ctrl);
         return;
 
+ out_unlock:
+        mutex_unlock(&dev->shutdown_lock);
  out:
         nvme_remove_dead_ctrl(dev, result);
 }
diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
index c69ca95b1ad5..0f140a802137 100644
--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
@@ -693,7 +693,7 @@ static const char * const sd_a_groups[] = {
 
 static const char * const sdxc_a_groups[] = {
         "sdxc_d0_0_a", "sdxc_d13_0_a", "sdxc_d47_a", "sdxc_clk_a",
-        "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d0_13_1_a"
+        "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d13_1_a"
 };
 
 static const char * const pcm_a_groups[] = {
diff --git a/drivers/pinctrl/qcom/pinctrl-qcs404.c b/drivers/pinctrl/qcom/pinctrl-qcs404.c
index 7aae52a09ff0..4ffd56ff809e 100644
--- a/drivers/pinctrl/qcom/pinctrl-qcs404.c
+++ b/drivers/pinctrl/qcom/pinctrl-qcs404.c
@@ -79,7 +79,7 @@ enum {
                 .intr_cfg_reg = 0,                      \
                 .intr_status_reg = 0,                   \
                 .intr_target_reg = 0,                   \
-                .tile = NORTH,                          \
+                .tile = SOUTH,                          \
                 .mux_bit = -1,                          \
                 .pull_bit = pull,                       \
                 .drv_bit = drv,                         \
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 4e7b55a14b1a..6e294b4d3635 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
                 usrparm.psf_data &= 0x7fffffffULL;
                 usrparm.rssd_result &= 0x7fffffffULL;
         }
+        /* at least 2 bytes are accessed and should be allocated */
+        if (usrparm.psf_data_len < 2) {
+                DBF_DEV_EVENT(DBF_WARNING, device,
+                              "Symmetrix ioctl invalid data length %d",
+                              usrparm.psf_data_len);
+                rc = -EINVAL;
+                goto out;
+        }
         /* alloc I/O data area */
         psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
         rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 48ea0004a56d..5a699746c357 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -248,7 +248,8 @@ static inline int ap_test_config(unsigned int *field, unsigned int nr)
 static inline int ap_test_config_card_id(unsigned int id)
 {
         if (!ap_configuration)  /* QCI not supported */
-                return 1;
+                /* only ids 0...3F may be probed */
+                return id < 0x40 ? 1 : 0;
         return ap_test_config(ap_configuration->apm, id);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index aeeb0144bd55..8d1acc802a67 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1785,13 +1785,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
 
                 /* Issue Marker IOCB */
                 qla2x00_marker(vha, vha->hw->req_q_map[0],
-                    vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun,
+                    vha->hw->rsp_q_map[0], fcport->loop_id, lun,
                     flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
         }
 
 done_free_sp:
         sp->free(sp);
-        sp->fcport->flags &= ~FCF_ASYNC_SENT;
+        fcport->flags &= ~FCF_ASYNC_SENT;
 done:
         return rval;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index b2da8a00ec33..5464d467e23e 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2951,9 +2951,6 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
         if (rot == 1) {
                 blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
                 blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q);
-        } else {
-                blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
-                blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
         }
 
         if (sdkp->device->type == TYPE_ZBC) {
@@ -3090,6 +3087,15 @@ static int sd_revalidate_disk(struct gendisk *disk)
         if (sdkp->media_present) {
                 sd_read_capacity(sdkp, buffer);
 
+                /*
+                 * set the default to rotational.  All non-rotational devices
+                 * support the block characteristics VPD page, which will
+                 * cause this to be updated correctly and any device which
+                 * doesn't support it should be treated as rotational.
+                 */
+                blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
+                blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
+
                 if (scsi_device_supports_vpd(sdp)) {
                         sd_read_block_provisioning(sdkp);
                         sd_read_block_limits(sdkp);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index dfd23245f778..6fff16113628 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -774,7 +774,7 @@ of_cpufreq_cooling_register(struct cpufreq_policy *policy)
 
                 cdev = __cpufreq_cooling_register(np, policy, capacitance);
                 if (IS_ERR(cdev)) {
-                        pr_err("cpu_cooling: cpu%d is not running as cooling device: %ld\n",
+                        pr_err("cpu_cooling: cpu%d failed to register as cooling device: %ld\n",
                                policy->cpu, PTR_ERR(cdev));
                         cdev = NULL;
                 }
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 4bfdb4a1e47d..2df059cc07e2 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -867,14 +867,14 @@ __init *thermal_of_build_thermal_zone(struct device_node *np)
 
         ret = of_property_read_u32(np, "polling-delay-passive", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay-passive property\n");
+                pr_err("%pOFn: missing polling-delay-passive property\n", np);
                 goto free_tz;
         }
         tz->passive_delay = prop;
 
         ret = of_property_read_u32(np, "polling-delay", &prop);
         if (ret < 0) {
-                pr_err("missing polling-delay property\n");
+                pr_err("%pOFn: missing polling-delay property\n", np);
                 goto free_tz;
         }
         tz->polling_delay = prop;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 24a129fcdd61..a2e5dc7716e2 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
 
         ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
                              len, iov, 64, VHOST_ACCESS_WO);
-        if (ret)
+        if (ret < 0)
                 return ret;
 
         for (i = 0; i < ret; i++) {
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index d0078cbb718b..e996174cbfc0 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -14,13 +14,30 @@
 #include <linux/err.h>
 #include <linux/fs.h>
 
+static inline bool spacetab(char c) { return c == ' ' || c == '\t'; }
+static inline char *next_non_spacetab(char *first, const char *last)
+{
+        for (; first <= last; first++)
+                if (!spacetab(*first))
+                        return first;
+        return NULL;
+}
+static inline char *next_terminator(char *first, const char *last)
+{
+        for (; first <= last; first++)
+                if (spacetab(*first) || !*first)
+                        return first;
+        return NULL;
+}
+
 static int load_script(struct linux_binprm *bprm)
 {
         const char *i_arg, *i_name;
-        char *cp;
+        char *cp, *buf_end;
         struct file *file;
         int retval;
 
+        /* Not ours to exec if we don't start with "#!". */
         if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
                 return -ENOEXEC;
 
@@ -33,23 +50,41 @@ static int load_script(struct linux_binprm *bprm)
         if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
                 return -ENOENT;
 
-        /*
-         * This section does the #! interpretation.
-         * Sorta complicated, but hopefully it will work.  -TYT
-         */
-
+        /* Release since we are not mapping a binary into memory. */
         allow_write_access(bprm->file);
         fput(bprm->file);
         bprm->file = NULL;
 
-        for (cp = bprm->buf+2;; cp++) {
-                if (cp >= bprm->buf + BINPRM_BUF_SIZE)
+        /*
+         * This section handles parsing the #! line into separate
+         * interpreter path and argument strings. We must be careful
+         * because bprm->buf is not yet guaranteed to be NUL-terminated
+         * (though the buffer will have trailing NUL padding when the
+         * file size was smaller than the buffer size).
+         *
+         * We do not want to exec a truncated interpreter path, so either
+         * we find a newline (which indicates nothing is truncated), or
+         * we find a space/tab/NUL after the interpreter path (which
+         * itself may be preceded by spaces/tabs). Truncating the
+         * arguments is fine: the interpreter can re-read the script to
+         * parse them on its own.
+         */
+        buf_end = bprm->buf + sizeof(bprm->buf) - 1;
+        cp = strnchr(bprm->buf, sizeof(bprm->buf), '\n');
+        if (!cp) {
+                cp = next_non_spacetab(bprm->buf + 2, buf_end);
+                if (!cp)
+                        return -ENOEXEC; /* Entire buf is spaces/tabs */
+                /*
+                 * If there is no later space/tab/NUL we must assume the
+                 * interpreter path is truncated.
+                 */
+                if (!next_terminator(cp, buf_end))
                         return -ENOEXEC;
-                if (!*cp || (*cp == '\n'))
-                        break;
+                cp = buf_end;
         }
+        /* NUL-terminate the buffer and any trailing spaces/tabs. */
         *cp = '\0';
-
         while (cp > bprm->buf) {
                 cp--;
                 if ((*cp == ' ') || (*cp == '\t'))
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 712f00995390..5508baa11bb6 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -116,16 +116,8 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
-        ret = file_write_and_wait_range(file, start, end);
-        if (ret)
-                return ret;
-
         if (!journal) {
-                struct writeback_control wbc = {
-                        .sync_mode = WB_SYNC_ALL
-                };
-
-                ret = ext4_write_inode(inode, &wbc);
+                ret = __generic_file_fsync(file, start, end, datasync);
                 if (!ret)
                         ret = ext4_sync_parent(inode);
                 if (test_opt(inode->i_sb, BARRIER))
@@ -133,6 +125,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                 goto out;
         }
 
+        ret = file_write_and_wait_range(file, start, end);
+        if (ret)
+                return ret;
         /*
          * data=writeback,ordered:
          *  The caller's filemap_fdatawrite()/wait will sync the data.
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index f15b4c57c4bd..78510ab91835 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -28,7 +28,6 @@
 #include "util.h"
 #include "trans.h"
 #include "dir.h"
-#include "lops.h"
 
 struct workqueue_struct *gfs2_freeze_wq;
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 5bfaf381921a..b8830fda51e8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -733,7 +733,7 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
         lh->lh_crc = cpu_to_be32(crc);
 
         gfs2_log_write(sdp, page, sb->s_blocksize, 0, addr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE | op_flags);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, op_flags);
         log_flush_wait(sdp);
 }
 
@@ -810,7 +810,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 
         gfs2_ordered_write(sdp);
         lops_before_commit(sdp, tr);
-        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE);
+        gfs2_log_submit_bio(&sdp->sd_log_bio, REQ_OP_WRITE, 0);
 
         if (sdp->sd_log_head != sdp->sd_log_flush_head) {
                 log_flush_wait(sdp);
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 94dcab655bc0..2295042bc625 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -17,9 +17,7 @@
 #include <linux/bio.h>
 #include <linux/fs.h>
 #include <linux/list_sort.h>
-#include <linux/blkdev.h>
 
-#include "bmap.h"
 #include "dir.h"
 #include "gfs2.h"
 #include "incore.h"
@@ -195,6 +193,7 @@ static void gfs2_end_log_write_bh(struct gfs2_sbd *sdp, struct bio_vec *bvec,
 /**
  * gfs2_end_log_write - end of i/o to the log
  * @bio: The bio
+ * @error: Status of i/o request
  *
  * Each bio_vec contains either data from the pagecache or data
  * relating to the log itself. Here we iterate over the bio_vec
@@ -231,19 +230,20 @@ static void gfs2_end_log_write(struct bio *bio)
 /**
  * gfs2_log_submit_bio - Submit any pending log bio
  * @biop: Address of the bio pointer
- * @opf: REQ_OP | op_flags
+ * @op: REQ_OP
+ * @op_flags: req_flag_bits
  *
  * Submit any pending part-built or full bio to the block device. If
  * there is no pending bio, then this is a no-op.
  */
 
-void gfs2_log_submit_bio(struct bio **biop, int opf)
+void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags)
 {
         struct bio *bio = *biop;
         if (bio) {
                 struct gfs2_sbd *sdp = bio->bi_private;
                 atomic_inc(&sdp->sd_log_in_flight);
-                bio->bi_opf = opf;
+                bio_set_op_attrs(bio, op, op_flags);
                 submit_bio(bio);
                 *biop = NULL;
         }
@@ -304,7 +304,7 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
                 nblk >>= sdp->sd_fsb2bb_shift;
                 if (blkno == nblk && !flush)
                         return bio;
-                gfs2_log_submit_bio(biop, op);
+                gfs2_log_submit_bio(biop, op, 0);
         }
 
         *biop = gfs2_log_alloc_bio(sdp, blkno, end_io);
@@ -375,184 +375,6 @@ void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page)
                        gfs2_log_bmap(sdp));
 }
 
-/**
- * gfs2_end_log_read - end I/O callback for reads from the log
- * @bio: The bio
- *
- * Simply unlock the pages in the bio. The main thread will wait on them and
- * process them in order as necessary.
- */
-
-static void gfs2_end_log_read(struct bio *bio)
-{
-        struct page *page;
-        struct bio_vec *bvec;
-        int i;
-
-        bio_for_each_segment_all(bvec, bio, i) {
-                page = bvec->bv_page;
-                if (bio->bi_status) {
-                        int err = blk_status_to_errno(bio->bi_status);
-
-                        SetPageError(page);
-                        mapping_set_error(page->mapping, err);
-                }
-                unlock_page(page);
-        }
-
-        bio_put(bio);
-}
-
-/**
- * gfs2_jhead_pg_srch - Look for the journal head in a given page.
- * @jd: The journal descriptor
- * @page: The page to look in
- *
- * Returns: 1 if found, 0 otherwise.
- */
-
-static bool gfs2_jhead_pg_srch(struct gfs2_jdesc *jd,
-                              struct gfs2_log_header_host *head,
-                              struct page *page)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct gfs2_log_header_host uninitialized_var(lh);
-        void *kaddr = kmap_atomic(page);
-        unsigned int offset;
-        bool ret = false;
-
-        for (offset = 0; offset < PAGE_SIZE; offset += sdp->sd_sb.sb_bsize) {
-                if (!__get_log_header(sdp, kaddr + offset, 0, &lh)) {
-                        if (lh.lh_sequence > head->lh_sequence)
-                                *head = lh;
-                        else {
-                                ret = true;
-                                break;
-                        }
-                }
-        }
-        kunmap_atomic(kaddr);
-        return ret;
-}
-
-/**
- * gfs2_jhead_process_page - Search/cleanup a page
- * @jd: The journal descriptor
- * @index: Index of the page to look into
- * @done: If set, perform only cleanup, else search and set if found.
- *
- * Find the page with 'index' in the journal's mapping. Search the page for
- * the journal head if requested (cleanup == false). Release refs on the
- * page so the page cache can reclaim it (put_page() twice). We grabbed a
- * reference on this page two times, first when we did a find_or_create_page()
- * to obtain the page to add it to the bio and second when we do a
- * find_get_page() here to get the page to wait on while I/O on it is being
- * completed.
- * This function is also used to free up a page we might've grabbed but not
- * used. Maybe we added it to a bio, but not submitted it for I/O. Or we
- * submitted the I/O, but we already found the jhead so we only need to drop
- * our references to the page.
- */
-
-static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
-                                    struct gfs2_log_header_host *head,
-                                    bool *done)
-{
-        struct page *page;
-
-        page = find_get_page(jd->jd_inode->i_mapping, index);
-        wait_on_page_locked(page);
-
-        if (PageError(page))
-                *done = true;
-
-        if (!*done)
-                *done = gfs2_jhead_pg_srch(jd, head, page);
-
-        put_page(page); /* Once for find_get_page */
-        put_page(page); /* Once more for find_or_create_page */
-}
-
-/**
- * gfs2_find_jhead - find the head of a log
- * @jd: The journal descriptor
- * @head: The log descriptor for the head of the log is returned here
- *
- * Do a search of a journal by reading it in large chunks using bios and find
- * the valid log entry with the highest sequence number.  (i.e. the log head)
- *
- * Returns: 0 on success, errno otherwise
- */
-
-int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
-{
-        struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode);
-        struct address_space *mapping = jd->jd_inode->i_mapping;
-        struct gfs2_journal_extent *je;
-        u32 block, read_idx = 0, submit_idx = 0, index = 0;
-        int shift = PAGE_SHIFT - sdp->sd_sb.sb_bsize_shift;
-        int blocks_per_page = 1 << shift, sz, ret = 0;
-        struct bio *bio = NULL;
-        struct page *page;
-        bool done = false;
-        errseq_t since;
-
-        memset(head, 0, sizeof(*head));
-        if (list_empty(&jd->extent_list))
-                gfs2_map_journal_extents(sdp, jd);
-
-        since = filemap_sample_wb_err(mapping);
-        list_for_each_entry(je, &jd->extent_list, list) {
-                for (block = 0; block < je->blocks; block += blocks_per_page) {
-                        index = (je->lblock + block) >> shift;
-
-                        page = find_or_create_page(mapping, index, GFP_NOFS);
-                        if (!page) {
-                                ret = -ENOMEM;
-                                done = true;
-                                goto out;
-                        }
-
-                        if (bio) {
-                                sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                                if (sz == PAGE_SIZE)
-                                        goto page_added;
-                                submit_idx = index;
-                                submit_bio(bio);
-                                bio = NULL;
-                        }
-
-                        bio = gfs2_log_alloc_bio(sdp,
-                                                 je->dblock + (index << shift),
-                                                 gfs2_end_log_read);
-                        bio->bi_opf = REQ_OP_READ;
-                        sz = bio_add_page(bio, page, PAGE_SIZE, 0);
-                        gfs2_assert_warn(sdp, sz == PAGE_SIZE);
-
-page_added:
-                        if (submit_idx <= read_idx + BIO_MAX_PAGES) {
-                                /* Keep at least one bio in flight */
-                                continue;
-                        }
-
-                        gfs2_jhead_process_page(jd, read_idx++, head, &done);
-                        if (done)
-                                goto out;  /* found */
-                }
-        }
-
-out:
-        if (bio)
-                submit_bio(bio);
-        while (read_idx <= index)
-                gfs2_jhead_process_page(jd, read_idx++, head, &done);
-
-        if (!ret)
-                ret = filemap_check_wb_err(mapping, since);
-
-        return ret;
-}
-
 static struct page *gfs2_get_log_desc(struct gfs2_sbd *sdp, u32 ld_type,
                                       u32 ld_length, u32 ld_data1)
 {
diff --git a/fs/gfs2/lops.h b/fs/gfs2/lops.h
index 331160fc568b..711c4d89c063 100644
--- a/fs/gfs2/lops.h
+++ b/fs/gfs2/lops.h
@@ -30,10 +30,8 @@ extern u64 gfs2_log_bmap(struct gfs2_sbd *sdp);
 extern void gfs2_log_write(struct gfs2_sbd *sdp, struct page *page,
                            unsigned size, unsigned offset, u64 blkno);
 extern void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page);
-extern void gfs2_log_submit_bio(struct bio **biop, int opf);
+extern void gfs2_log_submit_bio(struct bio **biop, int op, int op_flags);
 extern void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
-extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
-                           struct gfs2_log_header_host *head);
 
 static inline unsigned int buf_limit(struct gfs2_sbd *sdp)
 {
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 1179763f6370..b041cb8ae383 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -41,7 +41,6 @@
 #include "dir.h"
 #include "meta_io.h"
 #include "trace_gfs2.h"
-#include "lops.h"
 
 #define DO 0
 #define UNDO 1
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 7389e445a7a7..2dac43065382 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -182,6 +182,129 @@ static int get_log_header(struct gfs2_jdesc *jd, unsigned int blk,
 }
 
 /**
+ * find_good_lh - find a good log header
+ * @jd: the journal
+ * @blk: the segment to start searching from
+ * @lh: the log header to fill in
+ * @forward: if true search forward in the log, else search backward
+ *
+ * Call get_log_header() to get a log header for a segment, but if the
+ * segment is bad, either scan forward or backward until we find a good one.
+ *
+ * Returns: errno
+ */
+
+static int find_good_lh(struct gfs2_jdesc *jd, unsigned int *blk,
+                        struct gfs2_log_header_host *head)
+{
+        unsigned int orig_blk = *blk;
+        int error;
+
+        for (;;) {
+                error = get_log_header(jd, *blk, head);
+                if (error <= 0)
+                        return error;
+
+                if (++*blk == jd->jd_blocks)
+                        *blk = 0;
+
+                if (*blk == orig_blk) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+        }
+}
+
+/**
+ * jhead_scan - make sure we've found the head of the log
+ * @jd: the journal
+ * @head: this is filled in with the log descriptor of the head
+ *
+ * At this point, seg and lh should be either the head of the log or just
+ * before.  Scan forward until we find the head.
+ *
+ * Returns: errno
+ */
+
+static int jhead_scan(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        unsigned int blk = head->lh_blkno;
+        struct gfs2_log_header_host lh;
+        int error;
+
+        for (;;) {
+                if (++blk == jd->jd_blocks)
+                        blk = 0;
+
+                error = get_log_header(jd, blk, &lh);
+                if (error < 0)
+                        return error;
+                if (error == 1)
+                        continue;
+
+                if (lh.lh_sequence == head->lh_sequence) {
+                        gfs2_consist_inode(GFS2_I(jd->jd_inode));
+                        return -EIO;
+                }
+                if (lh.lh_sequence < head->lh_sequence)
+                        break;
+
+                *head = lh;
+        }
+
+        return 0;
+}
+
+/**
+ * gfs2_find_jhead - find the head of a log
+ * @jd: the journal
+ * @head: the log descriptor for the head of the log is returned here
+ *
+ * Do a binary search of a journal and find the valid log entry with the
+ * highest sequence number.  (i.e. the log head)
+ *
+ * Returns: errno
+ */
+
+int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
+{
+        struct gfs2_log_header_host lh_1, lh_m;
+        u32 blk_1, blk_2, blk_m;
+        int error;
+
+        blk_1 = 0;
+        blk_2 = jd->jd_blocks - 1;
+
+        for (;;) {
+                blk_m = (blk_1 + blk_2) / 2;
+
+                error = find_good_lh(jd, &blk_1, &lh_1);
+                if (error)
+                        return error;
+
+                error = find_good_lh(jd, &blk_m, &lh_m);
+                if (error)
+                        return error;
+
+                if (blk_1 == blk_m || blk_m == blk_2)
+                        break;
+
+                if (lh_1.lh_sequence <= lh_m.lh_sequence)
+                        blk_1 = blk_m;
+                else
+                        blk_2 = blk_m;
+        }
+
+        error = jhead_scan(jd, &lh_1);
+        if (error)
+                return error;
+
+        *head = lh_1;
+
+        return error;
+}
+
+/**
  * foreach_descriptor - go through the active part of the log
  * @jd: the journal
  * @start: the first log header in the active region
diff --git a/fs/gfs2/recovery.h b/fs/gfs2/recovery.h
index 99575ab81202..11d81248be85 100644
--- a/fs/gfs2/recovery.h
+++ b/fs/gfs2/recovery.h
@@ -27,6 +27,8 @@ extern int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where)
 extern int gfs2_revoke_check(struct gfs2_jdesc *jd, u64 blkno, unsigned int where);
 extern void gfs2_revoke_clean(struct gfs2_jdesc *jd);
 
+extern int gfs2_find_jhead(struct gfs2_jdesc *jd,
+                    struct gfs2_log_header_host *head);
 extern int gfs2_recover_journal(struct gfs2_jdesc *gfs2_jd, bool wait);
 extern void gfs2_recover_func(struct work_struct *work);
 extern int __get_log_header(struct gfs2_sbd *sdp,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index d4b11c903971..ca71163ff7cf 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -45,7 +45,6 @@
 #include "util.h"
 #include "sys.h"
 #include "xattr.h"
-#include "lops.h"
 
 #define args_neq(a1, a2, x) ((a1)->ar_##x != (a2)->ar_##x)
 
diff --git a/fs/inode.c b/fs/inode.c
index 0cd47fe0dbe5..73432e64f874 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -730,11 +730,8 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
                 return LRU_REMOVED;
         }
 
-        /*
-         * Recently referenced inodes and inodes with many attached pages
-         * get one more pass.
-         */
-        if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
+        /* recently referenced inodes get one more pass */
+        if (inode->i_state & I_REFERENCED) {
                 inode->i_state &= ~I_REFERENCED;
                 spin_unlock(&inode->i_lock);
                 return LRU_ROTATE;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 885363ca8569..2f6b447cdd82 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -229,6 +229,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
         spin_lock(&delegation->lock);
         if (delegation->inode != NULL)
                 inode = igrab(delegation->inode);
+        if (!inode)
+                set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
         spin_unlock(&delegation->lock);
         return inode;
 }
@@ -681,7 +683,7 @@ void nfs_expire_all_delegations(struct nfs_client *clp)
 
 /**
  * nfs_super_return_all_delegations - return delegations for one superblock
- * @sb: sb to process
+ * @server: pointer to nfs_server to process
  *
  */
 void nfs_server_return_all_delegations(struct nfs_server *server)
@@ -944,10 +946,11 @@ restart:
         list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
                 list_for_each_entry_rcu(delegation, &server->delegations,
                                                                 super_list) {
-                        if (test_bit(NFS_DELEGATION_RETURNING,
-                                                &delegation->flags))
-                                continue;
-                        if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
+                        if (test_bit(NFS_DELEGATION_INODE_FREEING,
+                                                &delegation->flags) ||
+                            test_bit(NFS_DELEGATION_RETURNING,
+                                                &delegation->flags) ||
+                            test_bit(NFS_DELEGATION_NEED_RECLAIM,
                                                 &delegation->flags) == 0)
                                 continue;
                         if (!nfs_sb_active(server->super))
@@ -1053,10 +1056,11 @@ restart:
         list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
                 list_for_each_entry_rcu(delegation, &server->delegations,
                                                                 super_list) {
-                        if (test_bit(NFS_DELEGATION_RETURNING,
-                                                &delegation->flags))
-                                continue;
-                        if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
+                        if (test_bit(NFS_DELEGATION_INODE_FREEING,
+                                                &delegation->flags) ||
+                            test_bit(NFS_DELEGATION_RETURNING,
+                                                &delegation->flags) ||
+                            test_bit(NFS_DELEGATION_TEST_EXPIRED,
                                                 &delegation->flags) == 0)
                                 continue;
                         if (!nfs_sb_active(server->super))
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index dcbf3394ba0e..35b4b02c1ae0 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -34,6 +34,7 @@ enum {
         NFS_DELEGATION_RETURNING,
         NFS_DELEGATION_REVOKED,
         NFS_DELEGATION_TEST_EXPIRED,
+        NFS_DELEGATION_INODE_FREEING,
 };
 
 int nfs_inode_set_delegation(struct inode *inode, const struct cred *cred,
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 6bf4471850c8..a71d0b42d160 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -139,12 +139,19 @@ struct nfs_cache_array {
         struct nfs_cache_array_entry array[0];
 };
 
+struct readdirvec {
+        unsigned long nr;
+        unsigned long index;
+        struct page *pages[NFS_MAX_READDIR_RAPAGES];
+};
+
 typedef int (*decode_dirent_t)(struct xdr_stream *, struct nfs_entry *, bool);
 typedef struct {
         struct file     *file;
         struct page     *page;
         struct dir_context *ctx;
         unsigned long   page_index;
+        struct readdirvec pvec;
         u64             *dir_cookie;
         u64             last_cookie;
         loff_t          current_index;
@@ -524,6 +531,10 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
         struct nfs_cache_array *array;
         unsigned int count = 0;
         int status;
+        int max_rapages = NFS_MAX_READDIR_RAPAGES;
+
+        desc->pvec.index = desc->page_index;
+        desc->pvec.nr = 0;
 
         scratch = alloc_page(GFP_KERNEL);
         if (scratch == NULL)
@@ -548,20 +559,40 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
                 if (desc->plus)
                         nfs_prime_dcache(file_dentry(desc->file), entry);
 
-                status = nfs_readdir_add_to_array(entry, page);
+                status = nfs_readdir_add_to_array(entry, desc->pvec.pages[desc->pvec.nr]);
+                if (status == -ENOSPC) {
+                        desc->pvec.nr++;
+                        if (desc->pvec.nr == max_rapages)
+                                break;
+                        status = nfs_readdir_add_to_array(entry, desc->pvec.pages[desc->pvec.nr]);
+                }
                 if (status != 0)
                         break;
         } while (!entry->eof);
 
+        /*
+         * page and desc->pvec.pages[0] are valid, don't need to check
+         * whether or not to be NULL.
+         */
+        copy_highpage(page, desc->pvec.pages[0]);
+
 out_nopages:
         if (count == 0 || (status == -EBADCOOKIE && entry->eof != 0)) {
-                array = kmap(page);
+                array = kmap_atomic(desc->pvec.pages[desc->pvec.nr]);
                 array->eof_index = array->size;
                 status = 0;
-                kunmap(page);
+                kunmap_atomic(array);
         }
 
         put_page(scratch);
+
+        /*
+         * desc->pvec.nr > 0 means at least one page was completely filled,
+         * we should return -ENOSPC. Otherwise function
+         * nfs_readdir_xdr_to_array will enter infinite loop.
+         */
+        if (desc->pvec.nr > 0)
+                return -ENOSPC;
         return status;
 }
 
@@ -574,8 +605,8 @@ void nfs_readdir_free_pages(struct page **pages, unsigned int npages)
 }
 
 /*
- * nfs_readdir_large_page will allocate pages that must be freed with a call
- * to nfs_readdir_free_pagearray
+ * nfs_readdir_alloc_pages() will allocate pages that must be freed with a call
+ * to nfs_readdir_free_pages()
  */
 static
 int nfs_readdir_alloc_pages(struct page **pages, unsigned int npages)
@@ -595,6 +626,24 @@ out_freepages:
         return -ENOMEM;
 }
 
+/*
+ * nfs_readdir_rapages_init initialize rapages by nfs_cache_array structure.
+ */
+static
+void nfs_readdir_rapages_init(nfs_readdir_descriptor_t *desc)
+{
+        struct nfs_cache_array *array;
+        int max_rapages = NFS_MAX_READDIR_RAPAGES;
+        int index;
+
+        for (index = 0; index < max_rapages; index++) {
+                array = kmap_atomic(desc->pvec.pages[index]);
+                memset(array, 0, sizeof(struct nfs_cache_array));
+                array->eof_index = -1;
+                kunmap_atomic(array);
+        }
+}
+
 static
 int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page, struct inode *inode)
 {
@@ -605,6 +654,12 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
         int status = -ENOMEM;
         unsigned int array_size = ARRAY_SIZE(pages);
 
+        /*
+         * This means we hit readdir rdpages miss, the preallocated rdpages
+         * are useless, the preallocate rdpages should be reinitialized.
+         */
+        nfs_readdir_rapages_init(desc);
+
         entry.prev_cookie = 0;
         entry.cookie = desc->last_cookie;
         entry.eof = 0;
@@ -664,9 +719,24 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)
         struct inode    *inode = file_inode(desc->file);
         int ret;
 
-        ret = nfs_readdir_xdr_to_array(desc, page, inode);
-        if (ret < 0)
-                goto error;
+        /*
+         * If desc->page_index in range desc->pvec.index and
+         * desc->pvec.index + desc->pvec.nr, we get readdir cache hit.
+         */
+        if (desc->page_index >= desc->pvec.index &&
+                desc->page_index < (desc->pvec.index + desc->pvec.nr)) {
+                /*
+                 * page and desc->pvec.pages[x] are valid, don't need to check
+                 * whether or not to be NULL.
+                 */
+                copy_highpage(page, desc->pvec.pages[desc->page_index - desc->pvec.index]);
+                ret = 0;
+        } else {
+                ret = nfs_readdir_xdr_to_array(desc, page, inode);
+                if (ret < 0)
+                        goto error;
+        }
+
         SetPageUptodate(page);
 
         if (invalidate_inode_pages2_range(inode->i_mapping, page->index + 1, -1) < 0) {
@@ -831,6 +901,7 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
                         *desc = &my_desc;
         struct nfs_open_dir_context *dir_ctx = file->private_data;
         int res = 0;
+        int max_rapages = NFS_MAX_READDIR_RAPAGES;
 
         dfprintk(FILE, "NFS: readdir(%pD2) starting at cookie %llu\n",
                         file, (long long)ctx->pos);
@@ -850,6 +921,12 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
         desc->decode = NFS_PROTO(inode)->decode_dirent;
         desc->plus = nfs_use_readdirplus(inode, ctx);
 
+        res = nfs_readdir_alloc_pages(desc->pvec.pages, max_rapages);
+        if (res < 0)
+                return -ENOMEM;
+
+        nfs_readdir_rapages_init(desc);
+
         if (ctx->pos == 0 || nfs_attribute_cache_expired(inode))
                 res = nfs_revalidate_mapping(inode, file->f_mapping);
         if (res < 0)
@@ -885,6 +962,7 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
                         break;
         } while (!desc->eof);
 out:
+        nfs_readdir_free_pages(desc->pvec.pages, max_rapages);
         if (res > 0)
                 res = 0;
         dfprintk(FILE, "NFS: readdir(%pD2) returns %d\n", file, res);
@@ -945,7 +1023,7 @@ static int nfs_fsync_dir(struct file *filp, loff_t start, loff_t end,
 
 /**
  * nfs_force_lookup_revalidate - Mark the directory as having changed
- * @dir - pointer to directory inode
+ * @dir: pointer to directory inode
  *
  * This forces the revalidation code in nfs_lookup_revalidate() to do a
  * full lookup on all child dentries of 'dir' whenever a change occurs
@@ -1649,7 +1727,7 @@ nfs4_do_lookup_revalidate(struct inode *dir, struct dentry *dentry,
 reval_dentry:
         if (flags & LOOKUP_RCU)
                 return -ECHILD;
-        return nfs_lookup_revalidate_dentry(dir, dentry, inode);;
+        return nfs_lookup_revalidate_dentry(dir, dentry, inode);
 
 full_reval:
         return nfs_do_lookup_revalidate(dir, dentry, flags);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 33824a0a57bf..0fd811ac08b5 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -428,7 +428,7 @@ out_put:
         hdr->release(hdr);
 }
 
-static void nfs_read_sync_pgio_error(struct list_head *head)
+static void nfs_read_sync_pgio_error(struct list_head *head, int error)
 {
         struct nfs_page *req;
 
@@ -664,8 +664,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
 
         list_for_each_entry_safe(req, tmp, &reqs, wb_list) {
                 if (!nfs_pageio_add_request(&desc, req)) {
-                        nfs_list_remove_request(req);
-                        nfs_list_add_request(req, &failed);
+                        nfs_list_move_request(req, &failed);
                         spin_lock(&cinfo.inode->i_lock);
                         dreq->flags = 0;
                         if (desc.pg_error < 0)
@@ -821,7 +820,7 @@ out_put:
         hdr->release(hdr);
 }
 
-static void nfs_write_sync_pgio_error(struct list_head *head)
+static void nfs_write_sync_pgio_error(struct list_head *head, int error)
 {
         struct nfs_page *req;
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 29553fdba8af..4899b85f9b3c 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -89,8 +89,8 @@ EXPORT_SYMBOL_GPL(nfs_file_release);
 
 /**
  * nfs_revalidate_size - Revalidate the file size
- * @inode - pointer to inode struct
- * @file - pointer to struct file
+ * @inode: pointer to inode struct
+ * @filp: pointer to struct file
  *
  * Revalidates the file length. This is basically a wrapper around
  * nfs_revalidate_inode() that takes into account the fact that we may
@@ -276,6 +276,12 @@ EXPORT_SYMBOL_GPL(nfs_file_fsync);
  * then a modify/write/read cycle when writing to a page in the
  * page cache.
  *
+ * Some pNFS layout drivers can only read/write at a certain block
+ * granularity like all block devices and therefore we must perform
+ * read/modify/write whenever a page hasn't read yet and the data
+ * to be written there is not aligned to a block boundary and/or
+ * smaller than the block size.
+ *
  * The modify/write/read cycle may occur if a page is read before
  * being completely filled by the writer.  In this situation, the
  * page must be completely written to stable storage on the server
@@ -291,26 +297,32 @@ EXPORT_SYMBOL_GPL(nfs_file_fsync);
  * and that the new data won't completely replace the old data in
  * that range of the file.
  */
-static int nfs_want_read_modify_write(struct file *file, struct page *page,
-                        loff_t pos, unsigned len)
+static bool nfs_full_page_write(struct page *page, loff_t pos, unsigned int len)
 {
         unsigned int pglen = nfs_page_length(page);
         unsigned int offset = pos & (PAGE_SIZE - 1);
         unsigned int end = offset + len;
 
-        if (pnfs_ld_read_whole_page(file->f_mapping->host)) {
-                if (!PageUptodate(page))
-                        return 1;
-                return 0;
-        }
+        return !pglen || (end >= pglen && !offset);
+}
 
-        if ((file->f_mode & FMODE_READ) &&      /* open for read? */
-            !PageUptodate(page) &&              /* Uptodate? */
-            !PagePrivate(page) &&               /* i/o request already? */
-            pglen &&                            /* valid bytes of file? */
-            (end < pglen || offset))            /* replace all valid bytes? */
-                return 1;
-        return 0;
+static bool nfs_want_read_modify_write(struct file *file, struct page *page,
+                        loff_t pos, unsigned int len)
+{
+        /*
+         * Up-to-date pages, those with ongoing or full-page write
+         * don't need read/modify/write
+         */
+        if (PageUptodate(page) || PagePrivate(page) ||
+            nfs_full_page_write(page, pos, len))
+                return false;
+
+        if (pnfs_ld_read_whole_page(file->f_mapping->host))
+                return true;
+        /* Open for reading too? */
+        if (file->f_mode & FMODE_READ)
+                return true;
+        return false;
 }
 
 /*
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 11766a74216d..ca7a6203b3cb 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -483,9 +483,15 @@ ff_layout_get_ds_cred(struct pnfs_layout_segment *lseg, u32 ds_idx,
 }
 
 /**
-* Find or create a DS rpc client with th MDS server rpc client auth flavor
-* in the nfs_client cl_ds_clients list.
-*/
+ * nfs4_ff_find_or_create_ds_client - Find or create a DS rpc client
+ * @lseg: pointer to layout segment
+ * @ds_idx: mirror index
+ * @ds_clp: nfs_client for the DS
+ * @inode: pointer to inode
+ *
+ * Find or create a DS rpc client with th MDS server rpc client auth flavor
+ * in the nfs_client cl_ds_clients list.
+ */
 struct rpc_clnt *
 nfs4_ff_find_or_create_ds_client(struct pnfs_layout_segment *lseg, u32 ds_idx,
                                  struct nfs_client *ds_clp, struct inode *inode)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 094775ea0781..414a90d48493 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -143,6 +143,7 @@ EXPORT_SYMBOL_GPL(nfs_sync_inode);
 
 /**
  * nfs_sync_mapping - helper to flush all mmapped dirty data to disk
+ * @mapping: pointer to struct address_space
  */
 int nfs_sync_mapping(struct address_space *mapping)
 {
@@ -1184,8 +1185,8 @@ int nfs_attribute_cache_expired(struct inode *inode)
 
 /**
  * nfs_revalidate_inode - Revalidate the inode attributes
- * @server - pointer to nfs_server struct
- * @inode - pointer to inode struct
+ * @server: pointer to nfs_server struct
+ * @inode: pointer to inode struct
  *
  * Updates inode attribute information by retrieving the data from the server.
  */
@@ -1255,8 +1256,8 @@ out:
 
 /**
  * nfs_revalidate_mapping - Revalidate the pagecache
- * @inode - pointer to host inode
- * @mapping - pointer to mapping
+ * @inode: pointer to host inode
+ * @mapping: pointer to mapping
  */
 int nfs_revalidate_mapping(struct inode *inode,
                 struct address_space *mapping)
@@ -1371,8 +1372,8 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 
 /**
  * nfs_check_inode_attributes - verify consistency of the inode attribute cache
- * @inode - pointer to inode
- * @fattr - updated attributes
+ * @inode: pointer to inode
+ * @fattr: updated attributes
  *
  * Verifies the attribute cache. If we have just changed the attributes,
  * so that fattr carries weak cache consistency data, then it may
@@ -1572,8 +1573,8 @@ EXPORT_SYMBOL_GPL(_nfs_display_fhandle);
 
 /**
  * nfs_inode_attrs_need_update - check if the inode attributes need updating
- * @inode - pointer to inode
- * @fattr - attributes
+ * @inode: pointer to inode
+ * @fattr: attributes
  *
  * Attempt to divine whether or not an RPC call reply carrying stale
  * attributes got scheduled after another call carrying updated ones.
@@ -1614,8 +1615,8 @@ static int nfs_refresh_inode_locked(struct inode *inode, struct nfs_fattr *fattr
 
 /**
  * nfs_refresh_inode - try to update the inode attribute cache
- * @inode - pointer to inode
- * @fattr - updated attributes
+ * @inode: pointer to inode
+ * @fattr: updated attributes
  *
  * Check that an RPC call that returned attributes has not overlapped with
  * other recent updates of the inode metadata, then decide whether it is
@@ -1649,8 +1650,8 @@ static int nfs_post_op_update_inode_locked(struct inode *inode,
 
 /**
  * nfs_post_op_update_inode - try to update the inode attribute cache
- * @inode - pointer to inode
- * @fattr - updated attributes
+ * @inode: pointer to inode
+ * @fattr: updated attributes
  *
  * After an operation that has changed the inode metadata, mark the
  * attribute cache as being invalid, then try to update it.
@@ -1679,8 +1680,8 @@ EXPORT_SYMBOL_GPL(nfs_post_op_update_inode);
 
 /**
  * nfs_post_op_update_inode_force_wcc_locked - update the inode attribute cache
- * @inode - pointer to inode
- * @fattr - updated attributes
+ * @inode: pointer to inode
+ * @fattr: updated attributes
  *
  * After an operation that has changed the inode metadata, mark the
  * attribute cache as being invalid, then try to update it. Fake up
@@ -1731,8 +1732,8 @@ out_noforce:
 
 /**
  * nfs_post_op_update_inode_force_wcc - try to update the inode attribute cache
- * @inode - pointer to inode
- * @fattr - updated attributes
+ * @inode: pointer to inode
+ * @fattr: updated attributes
  *
  * After an operation that has changed the inode metadata, mark the
  * attribute cache as being invalid, then try to update it. Fake up
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index b1e577302518..c7cf23ae6597 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -69,7 +69,8 @@ struct nfs_clone_mount {
  * Maximum number of pages that readdir can use for creating
  * a vmapped array of pages.
  */
-#define NFS_MAX_READDIR_PAGES 8
+#define NFS_MAX_READDIR_PAGES 64
+#define NFS_MAX_READDIR_RAPAGES 8
 
 struct nfs_client_initdata {
         unsigned long init_flags;
@@ -755,6 +756,7 @@ static inline bool nfs_error_is_fatal(int err)
 {
         switch (err) {
         case -ERESTARTSYS:
+        case -EINTR:
         case -EACCES:
         case -EDQUOT:
         case -EFBIG:
@@ -763,6 +765,7 @@ static inline bool nfs_error_is_fatal(int err)
         case -EROFS:
         case -ESTALE:
         case -E2BIG:
+        case -ENOMEM:
                 return true;
         default:
                 return false;
diff --git a/fs/nfs/io.c b/fs/nfs/io.c
index 9034b4926909..5088fda9b453 100644
--- a/fs/nfs/io.c
+++ b/fs/nfs/io.c
@@ -25,7 +25,7 @@ static void nfs_block_o_direct(struct nfs_inode *nfsi, struct inode *inode)
 
 /**
  * nfs_start_io_read - declare the file is being used for buffered reads
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a buffered read operation is about to start, and ensure
  * that we block all direct I/O.
@@ -56,7 +56,7 @@ nfs_start_io_read(struct inode *inode)
 
 /**
  * nfs_end_io_read - declare that the buffered read operation is done
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a buffered read operation is done, and release the shared
  * lock on inode->i_rwsem.
@@ -69,7 +69,7 @@ nfs_end_io_read(struct inode *inode)
 
 /**
  * nfs_start_io_write - declare the file is being used for buffered writes
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a buffered read operation is about to start, and ensure
  * that we block all direct I/O.
@@ -83,7 +83,7 @@ nfs_start_io_write(struct inode *inode)
 
 /**
  * nfs_end_io_write - declare that the buffered write operation is done
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a buffered write operation is done, and release the
  * lock on inode->i_rwsem.
@@ -105,7 +105,7 @@ static void nfs_block_buffered(struct nfs_inode *nfsi, struct inode *inode)
 
 /**
  * nfs_end_io_direct - declare the file is being used for direct i/o
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a direct I/O operation is about to start, and ensure
  * that we block all buffered I/O.
@@ -136,7 +136,7 @@ nfs_start_io_direct(struct inode *inode)
 
 /**
  * nfs_end_io_direct - declare that the direct i/o operation is done
- * @inode - file inode
+ * @inode: file inode
  *
  * Declare that a direct I/O operation is done, and release the shared
  * lock on inode->i_rwsem.
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index e5686be67be8..15f099a24c29 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -221,10 +221,10 @@ static struct vfsmount *nfs_do_clone_mount(struct nfs_server *server,
 
 /**
  * nfs_do_submount - set up mountpoint when crossing a filesystem boundary
- * @dentry - parent directory
- * @fh - filehandle for new root dentry
- * @fattr - attributes for new root inode
- * @authflavor - security flavor to use when performing the mount
+ * @dentry: parent directory
+ * @fh: filehandle for new root dentry
+ * @fattr: attributes for new root inode
+ * @authflavor: security flavor to use when performing the mount
  *
  */
 struct vfsmount *nfs_do_submount(struct dentry *dentry, struct nfs_fh *fh,
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index 9fce18548f7e..c5c3fc6e6c60 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -222,8 +222,6 @@ static int __nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
         switch (status) {
                 case 0:
                         status = nfs_refresh_inode(inode, fattr);
-                        set_cached_acl(inode, ACL_TYPE_ACCESS, acl);
-                        set_cached_acl(inode, ACL_TYPE_DEFAULT, dfacl);
                         break;
                 case -EPFNOSUPPORT:
                 case -EPROTONOSUPPORT:
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 2548405da1f7..1339ede979af 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -42,7 +42,7 @@ static int nfs_get_cb_ident_idr(struct nfs_client *clp, int minorversion)
 }
 
 #ifdef CONFIG_NFS_V4_1
-/**
+/*
  * Per auth flavor data server rpc clients
  */
 struct nfs4_ds_server {
@@ -51,7 +51,9 @@ struct nfs4_ds_server {
 };
 
 /**
- * Common lookup case for DS I/O
+ * nfs4_find_ds_client - Common lookup case for DS I/O
+ * @ds_clp: pointer to the DS's nfs_client
+ * @flavor: rpc auth flavour to match
  */
 static struct nfs4_ds_server *
 nfs4_find_ds_client(struct nfs_client *ds_clp, rpc_authflavor_t flavor)
@@ -118,9 +120,13 @@ nfs4_free_ds_server(struct nfs4_ds_server *dss)
 }
 
 /**
-* Find or create a DS rpc client with th MDS server rpc client auth flavor
-* in the nfs_client cl_ds_clients list.
-*/
+ * nfs4_find_or_create_ds_client - Find or create a DS rpc client
+ * @ds_clp: pointer to the DS's nfs_client
+ * @inode: pointer to the inode
+ *
+ * Find or create a DS rpc client with th MDS server rpc client auth flavor
+ * in the nfs_client cl_ds_clients list.
+ */
 struct rpc_clnt *
 nfs4_find_or_create_ds_client(struct nfs_client *ds_clp, struct inode *inode)
 {
@@ -145,7 +151,6 @@ static void
 nfs4_shutdown_ds_clients(struct nfs_client *clp)
 {
         struct nfs4_ds_server *dss;
-        LIST_HEAD(shutdown_list);
 
         while (!list_empty(&clp->cl_ds_clients)) {
                 dss = list_entry(clp->cl_ds_clients.next,
@@ -284,7 +289,7 @@ static int nfs4_init_callback(struct nfs_client *clp)
 
 /**
  * nfs40_init_client - nfs_client initialization tasks for NFSv4.0
- * @clp - nfs_client to initialize
+ * @clp: nfs_client to initialize
  *
  * Returns zero on success, or a negative errno if some error occurred.
  */
@@ -312,7 +317,7 @@ int nfs40_init_client(struct nfs_client *clp)
 
 /**
  * nfs41_init_client - nfs_client initialization tasks for NFSv4.1+
- * @clp - nfs_client to initialize
+ * @clp: nfs_client to initialize
  *
  * Returns zero on success, or a negative errno if some error occurred.
  */
@@ -360,9 +365,7 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp)
  * nfs4_init_client - Initialise an NFS4 client record
  *
  * @clp: nfs_client to initialise
- * @timeparms: timeout parameters for underlying RPC transport
- * @ip_addr: callback IP address in presentation format
- * @authflavor: authentication flavor for underlying RPC transport
+ * @cl_init: pointer to nfs_client_initdata
  *
  * Returns pointer to an NFS client, or an ERR_PTR value.
  */
@@ -649,13 +652,13 @@ nfs4_check_server_scope(struct nfs41_server_scope *s1,
 
 /**
  * nfs4_detect_session_trunking - Checks for session trunking.
- *
- * Called after a successful EXCHANGE_ID on a multi-addr connection.
- * Upon success, add the transport.
- *
  * @clp:    original mount nfs_client
  * @res:    result structure from an exchange_id using the original mount
  *          nfs_client with a new multi_addr transport
+ * @xprt:   pointer to the transport to add.
+ *
+ * Called after a successful EXCHANGE_ID on a multi-addr connection.
+ * Upon success, add the transport.
  *
  * Returns zero on success, otherwise -EINVAL
  *
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index 3f23b6840547..bf34ddaa2ad7 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -44,6 +44,7 @@
 #include <linux/keyctl.h>
 #include <linux/key-type.h>
 #include <keys/user-type.h>
+#include <keys/request_key_auth-type.h>
 #include <linux/module.h>
 
 #include "internal.h"
@@ -59,7 +60,7 @@ static struct key_type key_type_id_resolver_legacy;
 struct idmap_legacy_upcalldata {
         struct rpc_pipe_msg pipe_msg;
         struct idmap_msg idmap_msg;
-        struct key_construction *key_cons;
+        struct key      *authkey;
         struct idmap *idmap;
 };
 
@@ -384,7 +385,7 @@ static const match_table_t nfs_idmap_tokens = {
         { Opt_find_err, NULL }
 };
 
-static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *);
+static int nfs_idmap_legacy_upcall(struct key *, void *);
 static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
                                    size_t);
 static void idmap_release_pipe(struct inode *);
@@ -549,11 +550,12 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,
 static void
 nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret)
 {
-        struct key_construction *cons = idmap->idmap_upcall_data->key_cons;
+        struct key *authkey = idmap->idmap_upcall_data->authkey;
 
         kfree(idmap->idmap_upcall_data);
         idmap->idmap_upcall_data = NULL;
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
+        key_put(authkey);
 }
 
 static void
@@ -563,15 +565,14 @@ nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)
                 nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
 }
 
-static int nfs_idmap_legacy_upcall(struct key_construction *cons,
-                                   const char *op,
-                                   void *aux)
+static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
 {
         struct idmap_legacy_upcalldata *data;
+        struct request_key_auth *rka = get_request_key_auth(authkey);
         struct rpc_pipe_msg *msg;
         struct idmap_msg *im;
         struct idmap *idmap = (struct idmap *)aux;
-        struct key *key = cons->key;
+        struct key *key = rka->target_key;
         int ret = -ENOKEY;
 
         if (!aux)
@@ -586,7 +587,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
         msg = &data->pipe_msg;
         im = &data->idmap_msg;
         data->idmap = idmap;
-        data->key_cons = cons;
+        data->authkey = key_get(authkey);
 
         ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
         if (ret < 0)
@@ -604,7 +605,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
 out2:
         kfree(data);
 out1:
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
         return ret;
 }
 
@@ -651,9 +652,10 @@ out:
 static ssize_t
 idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
+        struct request_key_auth *rka;
         struct rpc_inode *rpci = RPC_I(file_inode(filp));
         struct idmap *idmap = (struct idmap *)rpci->private;
-        struct key_construction *cons;
+        struct key *authkey;
         struct idmap_msg im;
         size_t namelen_in;
         int ret = -ENOKEY;
@@ -665,7 +667,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         if (idmap->idmap_upcall_data == NULL)
                 goto out_noupcall;
 
-        cons = idmap->idmap_upcall_data->key_cons;
+        authkey = idmap->idmap_upcall_data->authkey;
+        rka = get_request_key_auth(authkey);
 
         if (mlen != sizeof(im)) {
                 ret = -ENOSPC;
@@ -690,9 +693,9 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 
         ret = nfs_idmap_read_and_verify_message(&im,
                         &idmap->idmap_upcall_data->idmap_msg,
-                        cons->key, cons->authkey);
+                        rka->target_key, authkey);
         if (ret >= 0) {
-                key_set_timeout(cons->key, nfs_idmap_cache_timeout);
+                key_set_timeout(rka->target_key, nfs_idmap_cache_timeout);
                 ret = mlen;
         }
 
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 24f06dcc2b08..2e460c33ae48 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -137,6 +137,7 @@ static size_t nfs_parse_server_name(char *string, size_t len,
 
 /**
  * nfs_find_best_sec - Find a security mechanism supported locally
+ * @clnt: pointer to rpc_clnt
  * @server: NFS server struct
  * @flavors: List of security tuples returned by SECINFO procedure
  *
@@ -288,8 +289,8 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
 
 /**
  * nfs_follow_referral - set up mountpoint when hitting a referral on moved error
- * @dentry - parent directory
- * @locations - array of NFSv4 server location information
+ * @dentry: parent directory
+ * @locations: array of NFSv4 server location information
  *
  */
 static struct vfsmount *nfs_follow_referral(struct dentry *dentry,
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 557a5d636183..77c6e2d3f3fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -730,13 +730,25 @@ static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res)
         res->sr_slot = NULL;
 }
 
+static void nfs4_slot_sequence_record_sent(struct nfs4_slot *slot,
+                u32 seqnr)
+{
+        if ((s32)(seqnr - slot->seq_nr_highest_sent) > 0)
+                slot->seq_nr_highest_sent = seqnr;
+}
+static void nfs4_slot_sequence_acked(struct nfs4_slot *slot,
+                u32 seqnr)
+{
+        slot->seq_nr_highest_sent = seqnr;
+        slot->seq_nr_last_acked = seqnr;
+}
+
 static int nfs41_sequence_process(struct rpc_task *task,
                 struct nfs4_sequence_res *res)
 {
         struct nfs4_session *session;
         struct nfs4_slot *slot = res->sr_slot;
         struct nfs_client *clp;
-        bool interrupted = false;
         int ret = 1;
 
         if (slot == NULL)
@@ -747,16 +759,12 @@ static int nfs41_sequence_process(struct rpc_task *task,
 
         session = slot->table->session;
 
-        if (slot->interrupted) {
-                if (res->sr_status != -NFS4ERR_DELAY)
-                        slot->interrupted = 0;
-                interrupted = true;
-        }
-
         trace_nfs4_sequence_done(session, res);
         /* Check the SEQUENCE operation status */
         switch (res->sr_status) {
         case 0:
+                /* Mark this sequence number as having been acked */
+                nfs4_slot_sequence_acked(slot, slot->seq_nr);
                 /* Update the slot's sequence and clientid lease timer */
                 slot->seq_done = 1;
                 clp = session->clp;
@@ -771,9 +779,9 @@ static int nfs41_sequence_process(struct rpc_task *task,
                  * sr_status remains 1 if an RPC level error occurred.
                  * The server may or may not have processed the sequence
                  * operation..
-                 * Mark the slot as having hosted an interrupted RPC call.
                  */
-                slot->interrupted = 1;
+                nfs4_slot_sequence_record_sent(slot, slot->seq_nr);
+                slot->seq_done = 1;
                 goto out;
         case -NFS4ERR_DELAY:
                 /* The server detected a resend of the RPC call and
@@ -784,6 +792,7 @@ static int nfs41_sequence_process(struct rpc_task *task,
                         __func__,
                         slot->slot_nr,
                         slot->seq_nr);
+                nfs4_slot_sequence_acked(slot, slot->seq_nr);
                 goto out_retry;
         case -NFS4ERR_RETRY_UNCACHED_REP:
         case -NFS4ERR_SEQ_FALSE_RETRY:
@@ -791,6 +800,7 @@ static int nfs41_sequence_process(struct rpc_task *task,
                  * The server thinks we tried to replay a request.
                  * Retry the call after bumping the sequence ID.
                  */
+                nfs4_slot_sequence_acked(slot, slot->seq_nr);
                 goto retry_new_seq;
         case -NFS4ERR_BADSLOT:
                 /*
@@ -801,21 +811,28 @@ static int nfs41_sequence_process(struct rpc_task *task,
                         goto session_recover;
                 goto retry_nowait;
         case -NFS4ERR_SEQ_MISORDERED:
+                nfs4_slot_sequence_record_sent(slot, slot->seq_nr);
                 /*
-                 * Was the last operation on this sequence interrupted?
-                 * If so, retry after bumping the sequence number.
-                 */
-                if (interrupted)
-                        goto retry_new_seq;
-                /*
-                 * Could this slot have been previously retired?
-                 * If so, then the server may be expecting seq_nr = 1!
+                 * Were one or more calls using this slot interrupted?
+                 * If the server never received the request, then our
+                 * transmitted slot sequence number may be too high.
                  */
-                if (slot->seq_nr != 1) {
-                        slot->seq_nr = 1;
+                if ((s32)(slot->seq_nr - slot->seq_nr_last_acked) > 1) {
+                        slot->seq_nr--;
                         goto retry_nowait;
                 }
-                goto session_recover;
+                /*
+                 * RFC5661:
+                 * A retry might be sent while the original request is
+                 * still in progress on the replier. The replier SHOULD
+                 * deal with the issue by returning NFS4ERR_DELAY as the
+                 * reply to SEQUENCE or CB_SEQUENCE operation, but
+                 * implementations MAY return NFS4ERR_SEQ_MISORDERED.
+                 *
+                 * Restart the search after a delay.
+                 */
+                slot->seq_nr = slot->seq_nr_highest_sent;
+                goto out_retry;
         default:
                 /* Just update the slot sequence no. */
                 slot->seq_done = 1;
@@ -906,17 +923,6 @@ static const struct rpc_call_ops nfs41_call_sync_ops = {
         .rpc_call_done = nfs41_call_sync_done,
 };
 
-static void
-nfs4_sequence_process_interrupted(struct nfs_client *client,
-                struct nfs4_slot *slot, const struct cred *cred)
-{
-        struct rpc_task *task;
-
-        task = _nfs41_proc_sequence(client, cred, slot, true);
-        if (!IS_ERR(task))
-                rpc_put_task_async(task);
-}
-
 #else   /* !CONFIG_NFS_V4_1 */
 
 static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
@@ -937,14 +943,6 @@ int nfs4_sequence_done(struct rpc_task *task,
 }
 EXPORT_SYMBOL_GPL(nfs4_sequence_done);
 
-static void
-nfs4_sequence_process_interrupted(struct nfs_client *client,
-                struct nfs4_slot *slot, const struct cred *cred)
-{
-        WARN_ON_ONCE(1);
-        slot->interrupted = 0;
-}
-
 #endif  /* !CONFIG_NFS_V4_1 */
 
 static
@@ -982,26 +980,19 @@ int nfs4_setup_sequence(struct nfs_client *client,
                 task->tk_timeout = 0;
         }
 
-        for (;;) {
-                spin_lock(&tbl->slot_tbl_lock);
-                /* The state manager will wait until the slot table is empty */
-                if (nfs4_slot_tbl_draining(tbl) && !args->sa_privileged)
-                        goto out_sleep;
-
-                slot = nfs4_alloc_slot(tbl);
-                if (IS_ERR(slot)) {
-                        /* Try again in 1/4 second */
-                        if (slot == ERR_PTR(-ENOMEM))
-                                task->tk_timeout = HZ >> 2;
-                        goto out_sleep;
-                }
-                spin_unlock(&tbl->slot_tbl_lock);
+        spin_lock(&tbl->slot_tbl_lock);
+        /* The state manager will wait until the slot table is empty */
+        if (nfs4_slot_tbl_draining(tbl) && !args->sa_privileged)
+                goto out_sleep;
 
-                if (likely(!slot->interrupted))
-                        break;
-                nfs4_sequence_process_interrupted(client,
-                                slot, task->tk_msg.rpc_cred);
+        slot = nfs4_alloc_slot(tbl);
+        if (IS_ERR(slot)) {
+                /* Try again in 1/4 second */
+                if (slot == ERR_PTR(-ENOMEM))
+                        task->tk_timeout = HZ >> 2;
+                goto out_sleep;
         }
+        spin_unlock(&tbl->slot_tbl_lock);
 
         nfs4_sequence_attach_slot(args, res, slot);
 
@@ -1555,6 +1546,10 @@ static void nfs_clear_open_stateid(struct nfs4_state *state,
 
 static void nfs_set_open_stateid_locked(struct nfs4_state *state,
                 const nfs4_stateid *stateid, nfs4_stateid *freeme)
+        __must_hold(&state->owner->so_lock)
+        __must_hold(&state->seqlock)
+        __must_hold(RCU)
+
 {
         DEFINE_WAIT(wait);
         int status = 0;
@@ -5963,7 +5958,7 @@ out:
 /**
  * nfs4_proc_setclientid_confirm - Confirm client ID
  * @clp: state data structure
- * @res: result of a previous SETCLIENTID
+ * @arg: result of a previous SETCLIENTID
  * @cred: credential to use for this call
  *
  * Returns zero, a negative errno, or a negative NFS4ERR status code.
@@ -7527,7 +7522,7 @@ int nfs4_proc_fsid_present(struct inode *inode, const struct cred *cred)
         return status;
 }
 
-/**
+/*
  * If 'use_integrity' is true and the state managment nfs_client
  * cl_rpcclient is using krb5i/p, use the integrity protected cl_rpcclient
  * and the machine credential as per RFC3530bis and RFC5661 Security
@@ -9219,7 +9214,7 @@ nfs4_proc_layoutcommit(struct nfs4_layoutcommit_data *data, bool sync)
         return status;
 }
 
-/**
+/*
  * Use the state managment nfs_client cl_rpcclient, which uses krb5i (if
  * possible) as per RFC3530bis and RFC5661 Security Considerations sections
  */
@@ -9484,7 +9479,7 @@ static const struct rpc_call_ops nfs41_free_stateid_ops = {
  * @server: server / transport on which to perform the operation
  * @stateid: state ID to release
  * @cred: credential
- * @is_recovery: set to true if this call needs to be privileged
+ * @privileged: set to true if this call needs to be privileged
  *
  * Note: this function is always asynchronous.
  */
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index a5489d70a724..bcb532def9e2 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -55,7 +55,7 @@ static void nfs4_shrink_slot_table(struct nfs4_slot_table  *tbl, u32 newsize)
 
 /**
  * nfs4_slot_tbl_drain_complete - wake waiters when drain is complete
- * @tbl - controlling slot table
+ * @tbl: controlling slot table
  *
  */
 void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl)
@@ -110,6 +110,8 @@ static struct nfs4_slot *nfs4_new_slot(struct nfs4_slot_table  *tbl,
                 slot->table = tbl;
                 slot->slot_nr = slotid;
                 slot->seq_nr = seq_init;
+                slot->seq_nr_highest_sent = seq_init;
+                slot->seq_nr_last_acked = seq_init - 1;
         }
         return slot;
 }
@@ -276,7 +278,8 @@ static void nfs4_reset_slot_table(struct nfs4_slot_table *tbl,
         p = &tbl->slots;
         while (*p) {
                 (*p)->seq_nr = ivalue;
-                (*p)->interrupted = 0;
+                (*p)->seq_nr_highest_sent = ivalue;
+                (*p)->seq_nr_last_acked = ivalue - 1;
                 p = &(*p)->next;
         }
         tbl->highest_used_slotid = NFS4_NO_SLOT;
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 3c550f297561..230509b77121 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -23,8 +23,9 @@ struct nfs4_slot {
         unsigned long           generation;
         u32                     slot_nr;
         u32                     seq_nr;
-        unsigned int            interrupted : 1,
-                                privileged : 1,
+        u32                     seq_nr_last_acked;
+        u32                     seq_nr_highest_sent;
+        unsigned int            privileged : 1,
                                 seq_done : 1;
 };
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 02488b50534a..3de36479ed7a 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -563,6 +563,7 @@ static void nfs4_gc_state_owners(struct nfs_server *server)
  * nfs4_get_state_owner - Look up a state owner given a credential
  * @server: nfs_server to search
  * @cred: RPC credential to match
+ * @gfp_flags: allocation mode
  *
  * Returns a pointer to an instantiated nfs4_state_owner struct, or NULL.
  */
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index e54d899c1848..e9f39fa5964b 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -350,7 +350,7 @@ nfs_create_request(struct nfs_open_context *ctx, struct page *page,
 
 /**
  * nfs_unlock_request - Unlock request and wake up sleepers.
- * @req:
+ * @req: pointer to request
  */
 void nfs_unlock_request(struct nfs_page *req)
 {
@@ -368,7 +368,7 @@ void nfs_unlock_request(struct nfs_page *req)
 
 /**
  * nfs_unlock_and_release_request - Unlock request and release the nfs_page
- * @req:
+ * @req: pointer to request
  */
 void nfs_unlock_and_release_request(struct nfs_page *req)
 {
@@ -531,7 +531,6 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
  * nfs_pgio_rpcsetup - Set up arguments for a pageio call
  * @hdr: The pageio hdr
  * @count: Number of bytes to read
- * @offset: Initial offset
  * @how: How to commit data (writes only)
  * @cinfo: Commit information for the call (writes only)
  */
@@ -634,7 +633,6 @@ EXPORT_SYMBOL_GPL(nfs_initiate_pgio);
 
 /**
  * nfs_pgio_error - Clean up from a pageio error
- * @desc: IO descriptor
  * @hdr: pageio header
  */
 static void nfs_pgio_error(struct nfs_pgio_header *hdr)
@@ -768,8 +766,7 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc,
         pageused = 0;
         while (!list_empty(head)) {
                 req = nfs_list_entry(head->next);
-                nfs_list_remove_request(req);
-                nfs_list_add_request(req, &hdr->pages);
+                nfs_list_move_request(req, &hdr->pages);
 
                 if (!last_page || last_page != req->wb_page) {
                         pageused++;
@@ -893,6 +890,7 @@ static bool nfs_match_lock_context(const struct nfs_lock_context *l1,
  * nfs_can_coalesce_requests - test two requests for compatibility
  * @prev: pointer to nfs_page
  * @req: pointer to nfs_page
+ * @pgio: pointer to nfs_pagio_descriptor
  *
  * The nfs_page structures 'prev' and 'req' are compared to ensure that the
  * page data area they describe is contiguous, and that their RPC
@@ -961,8 +959,7 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,
         }
         if (!nfs_can_coalesce_requests(prev, req, desc))
                 return 0;
-        nfs_list_remove_request(req);
-        nfs_list_add_request(req, &mirror->pg_list);
+        nfs_list_move_request(req, &mirror->pg_list);
         mirror->pg_count += req->wb_bytes;
         return 1;
 }
@@ -988,6 +985,16 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
         }
 }
 
+static void
+nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,
+                struct nfs_page *req)
+{
+        LIST_HEAD(head);
+
+        nfs_list_move_request(req, &head);
+        desc->pg_completion_ops->error_cleanup(&head, desc->pg_error);
+}
+
 /**
  * nfs_pageio_add_request - Attempt to coalesce a request into a page list.
  * @desc: destination io descriptor
@@ -1025,10 +1032,8 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
                         nfs_page_group_unlock(req);
                         desc->pg_moreio = 1;
                         nfs_pageio_doio(desc);
-                        if (desc->pg_error < 0)
-                                return 0;
-                        if (mirror->pg_recoalesce)
-                                return 0;
+                        if (desc->pg_error < 0 || mirror->pg_recoalesce)
+                                goto out_cleanup_subreq;
                         /* retry add_request for this subreq */
                         nfs_page_group_lock(req);
                         continue;
@@ -1061,6 +1066,10 @@ err_ptr:
         desc->pg_error = PTR_ERR(subreq);
         nfs_page_group_unlock(req);
         return 0;
+out_cleanup_subreq:
+        if (req != subreq)
+                nfs_pageio_cleanup_request(desc, subreq);
+        return 0;
 }
 
 static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
@@ -1079,7 +1088,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                         struct nfs_page *req;
 
                         req = list_first_entry(&head, struct nfs_page, wb_list);
-                        nfs_list_remove_request(req);
                         if (__nfs_pageio_add_request(desc, req))
                                 continue;
                         if (desc->pg_error < 0) {
@@ -1120,7 +1128,8 @@ static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
 
         for (midx = 0; midx < desc->pg_mirror_count; midx++) {
                 mirror = &desc->pg_mirrors[midx];
-                desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
+                desc->pg_completion_ops->error_cleanup(&mirror->pg_list,
+                                desc->pg_error);
         }
 }
 
@@ -1168,11 +1177,14 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
                 if (nfs_pgio_has_mirroring(desc))
                         desc->pg_mirror_idx = midx;
                 if (!nfs_pageio_add_request_mirror(desc, dupreq))
-                        goto out_failed;
+                        goto out_cleanup_subreq;
         }
 
         return 1;
 
+out_cleanup_subreq:
+        if (req != dupreq)
+                nfs_pageio_cleanup_request(desc, dupreq);
 out_failed:
         nfs_pageio_error_cleanup(desc);
         return 0;
@@ -1194,7 +1206,7 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
                 desc->pg_mirror_idx = mirror_idx;
         for (;;) {
                 nfs_pageio_doio(desc);
-                if (!mirror->pg_recoalesce)
+                if (desc->pg_error < 0 || !mirror->pg_recoalesce)
                         break;
                 if (!nfs_do_recoalesce(desc))
                         break;
@@ -1222,9 +1234,8 @@ int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
         while (!list_empty(&hdr->pages)) {
                 struct nfs_page *req = nfs_list_entry(hdr->pages.next);
 
-                nfs_list_remove_request(req);
                 if (!nfs_pageio_add_request(desc, req))
-                        nfs_list_add_request(req, &failed);
+                        nfs_list_move_request(req, &failed);
         }
         nfs_pageio_complete(desc);
         if (!list_empty(&failed)) {
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 53726da5c010..8247bd1634cb 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -758,22 +758,35 @@ static int
 pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
                 struct nfs_server *server,
                 struct list_head *layout_list)
+        __must_hold(&clp->cl_lock)
+        __must_hold(RCU)
 {
         struct pnfs_layout_hdr *lo, *next;
         struct inode *inode;
 
         list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
-                if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
+                if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
+                    test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
+                    !list_empty(&lo->plh_bulk_destroy))
                         continue;
+                /* If the sb is being destroyed, just bail */
+                if (!nfs_sb_active(server->super))
+                        break;
                 inode = igrab(lo->plh_inode);
-                if (inode == NULL)
-                        continue;
-                list_del_init(&lo->plh_layouts);
-                if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
-                        continue;
-                rcu_read_unlock();
-                spin_unlock(&clp->cl_lock);
-                iput(inode);
+                if (inode != NULL) {
+                        list_del_init(&lo->plh_layouts);
+                        if (pnfs_layout_add_bulk_destroy_list(inode,
+                                                layout_list))
+                                continue;
+                        rcu_read_unlock();
+                        spin_unlock(&clp->cl_lock);
+                        iput(inode);
+                } else {
+                        rcu_read_unlock();
+                        spin_unlock(&clp->cl_lock);
+                        set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
+                }
+                nfs_sb_deactive(server->super);
                 spin_lock(&clp->cl_lock);
                 rcu_read_lock();
                 return -EAGAIN;
@@ -811,7 +824,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
                 /* Free all lsegs that are attached to commit buckets */
                 nfs_commit_inode(inode, 0);
                 pnfs_put_layout_hdr(lo);
-                iput(inode);
+                nfs_iput_and_deactive(inode);
         }
         return ret;
 }
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 5e80a07b7bea..56659ccce1d8 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -104,6 +104,7 @@ enum {
         NFS_LAYOUT_RETURN_REQUESTED,    /* Return this layout ASAP */
         NFS_LAYOUT_INVALID_STID,        /* layout stateid id is invalid */
         NFS_LAYOUT_FIRST_LAYOUTGET,     /* Serialize first layoutget */
+        NFS_LAYOUT_INODE_FREEING,       /* The inode is being freed */
 };
 
 enum layoutdriver_policy_flags {
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index f9f19784db82..1d95a60b2586 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -205,7 +205,7 @@ static void nfs_initiate_read(struct nfs_pgio_header *hdr,
 }
 
 static void
-nfs_async_read_error(struct list_head *head)
+nfs_async_read_error(struct list_head *head, int error)
 {
         struct nfs_page *req;
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 0570391eaa16..23790c7b2289 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1919,7 +1919,7 @@ static int nfs_parse_devname(const char *dev_name,
                 /* kill possible hostname list: not supported */
                 comma = strchr(dev_name, ',');
                 if (comma != NULL && comma < end)
-                        *comma = 0;
+                        len = comma - dev_name;
         }
 
         if (len > maxnamlen)
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 79b97b3c4427..52d533967485 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -39,6 +39,7 @@ nfs_free_unlinkdata(struct nfs_unlinkdata *data)
 /**
  * nfs_async_unlink_done - Sillydelete post-processing
  * @task: rpc_task of the sillydelete
+ * @calldata: pointer to nfs_unlinkdata
  *
  * Do the directory attribute update.
  */
@@ -54,7 +55,7 @@ static void nfs_async_unlink_done(struct rpc_task *task, void *calldata)
 
 /**
  * nfs_async_unlink_release - Release the sillydelete data.
- * @task: rpc_task of the sillydelete
+ * @calldata: struct nfs_unlinkdata to release
  *
  * We need to call nfs_put_unlinkdata as a 'tk_release' task since the
  * rpc_task would be freed too.
@@ -159,8 +160,8 @@ static int nfs_call_unlink(struct dentry *dentry, struct inode *inode, struct nf
 
 /**
  * nfs_async_unlink - asynchronous unlinking of a file
- * @dir: parent directory of dentry
- * @dentry: dentry to unlink
+ * @dentry: parent directory of dentry
+ * @name: name of dentry to unlink
  */
 static int
 nfs_async_unlink(struct dentry *dentry, const struct qstr *name)
@@ -324,6 +325,7 @@ static const struct rpc_call_ops nfs_rename_ops = {
  * @new_dir: target directory for the rename
  * @old_dentry: original dentry to be renamed
  * @new_dentry: dentry to which the old_dentry should be renamed
+ * @complete: Function to run on successful completion
  *
  * It's expected that valid references to the dentries and inodes are held
  */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index f12cb31a41e5..f3ebabaa291d 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -26,6 +26,7 @@
 #include <linux/iversion.h>
 
 #include <linux/uaccess.h>
+#include <linux/sched/mm.h>
 
 #include "delegation.h"
 #include "internal.h"
@@ -238,9 +239,9 @@ out:
 }
 
 /* A writeback failed: mark the page as bad, and invalidate the page cache */
-static void nfs_set_pageerror(struct page *page)
+static void nfs_set_pageerror(struct address_space *mapping)
 {
-        nfs_zap_mapping(page_file_mapping(page)->host, page_file_mapping(page));
+        nfs_zap_mapping(mapping->host, mapping);
 }
 
 /*
@@ -712,11 +713,13 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
 {
         struct inode *inode = mapping->host;
         struct nfs_pageio_descriptor pgio;
-        struct nfs_io_completion *ioc = nfs_io_completion_alloc(GFP_NOFS);
+        struct nfs_io_completion *ioc;
+        unsigned int pflags = memalloc_nofs_save();
         int err;
 
         nfs_inc_stats(inode, NFSIOS_VFSWRITEPAGES);
 
+        ioc = nfs_io_completion_alloc(GFP_NOFS);
         if (ioc)
                 nfs_io_completion_init(ioc, nfs_io_completion_commit, inode);
 
@@ -727,6 +730,8 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
         nfs_pageio_complete(&pgio);
         nfs_io_completion_put(ioc);
 
+        memalloc_nofs_restore(pflags);
+
         if (err < 0)
                 goto out_err;
         err = pgio.pg_error;
@@ -865,7 +870,6 @@ EXPORT_SYMBOL_GPL(nfs_request_add_commit_list_locked);
 /**
  * nfs_request_add_commit_list - add request to a commit list
  * @req: pointer to a struct nfs_page
- * @dst: commit list head
  * @cinfo: holds list lock and accounting info
  *
  * This sets the PG_CLEAN bit, updates the cinfo count of
@@ -994,7 +998,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)
                 nfs_list_remove_request(req);
                 if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) &&
                     (hdr->good_bytes < bytes)) {
-                        nfs_set_pageerror(req->wb_page);
+                        nfs_set_pageerror(page_file_mapping(req->wb_page));
                         nfs_context_set_write_error(req->wb_context, hdr->error);
                         goto remove_req;
                 }
@@ -1348,7 +1352,8 @@ int nfs_updatepage(struct file *file, struct page *page,
                 unsigned int offset, unsigned int count)
 {
         struct nfs_open_context *ctx = nfs_file_open_context(file);
-        struct inode    *inode = page_file_mapping(page)->host;
+        struct address_space *mapping = page_file_mapping(page);
+        struct inode    *inode = mapping->host;
         int             status = 0;
 
         nfs_inc_stats(inode, NFSIOS_VFSUPDATEPAGE);
@@ -1366,7 +1371,7 @@ int nfs_updatepage(struct file *file, struct page *page,
 
         status = nfs_writepage_setup(ctx, page, offset, count);
         if (status < 0)
-                nfs_set_pageerror(page);
+                nfs_set_pageerror(mapping);
         else
                 __set_page_dirty_nobuffers(page);
 out:
@@ -1411,20 +1416,27 @@ static void nfs_redirty_request(struct nfs_page *req)
         nfs_release_request(req);
 }
 
-static void nfs_async_write_error(struct list_head *head)
+static void nfs_async_write_error(struct list_head *head, int error)
 {
         struct nfs_page *req;
 
         while (!list_empty(head)) {
                 req = nfs_list_entry(head->next);
                 nfs_list_remove_request(req);
+                if (nfs_error_is_fatal(error)) {
+                        nfs_context_set_write_error(req->wb_context, error);
+                        if (nfs_error_is_fatal_on_server(error)) {
+                                nfs_write_error_remove_page(req);
+                                continue;
+                        }
+                }
                 nfs_redirty_request(req);
         }
 }
 
 static void nfs_async_write_reschedule_io(struct nfs_pgio_header *hdr)
 {
-        nfs_async_write_error(&hdr->pages);
+        nfs_async_write_error(&hdr->pages, 0);
         filemap_fdatawrite_range(hdr->inode->i_mapping, hdr->args.offset,
                         hdr->args.offset + hdr->args.count - 1);
 }
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index b33f9785b756..72a7681f4046 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1239,8 +1239,8 @@ static __net_init int nfsd_init_net(struct net *net)
         retval = nfsd_idmap_init(net);
         if (retval)
                 goto out_idmap_error;
-        nn->nfsd4_lease = 45;   /* default lease time */
-        nn->nfsd4_grace = 45;
+        nn->nfsd4_lease = 90;   /* default lease time */
+        nn->nfsd4_grace = 90;
         nn->somebody_reclaimed = false;
         nn->clverifier_counter = prandom_u32();
         nn->clientid_counter = prandom_u32();
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f0ec9edab2f3..85b0ef890b28 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -423,7 +423,7 @@ struct mem_size_stats {
 };
 
 static void smaps_account(struct mem_size_stats *mss, struct page *page,
-                bool compound, bool young, bool dirty)
+                bool compound, bool young, bool dirty, bool locked)
 {
         int i, nr = compound ? 1 << compound_order(page) : 1;
         unsigned long size = nr * PAGE_SIZE;
@@ -450,24 +450,31 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page,
                 else
                         mss->private_clean += size;
                 mss->pss += (u64)size << PSS_SHIFT;
+                if (locked)
+                        mss->pss_locked += (u64)size << PSS_SHIFT;
                 return;
         }
 
         for (i = 0; i < nr; i++, page++) {
                 int mapcount = page_mapcount(page);
+                unsigned long pss = (PAGE_SIZE << PSS_SHIFT);
 
                 if (mapcount >= 2) {
                         if (dirty || PageDirty(page))
                                 mss->shared_dirty += PAGE_SIZE;
                         else
                                 mss->shared_clean += PAGE_SIZE;
-                        mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
+                        mss->pss += pss / mapcount;
+                        if (locked)
+                                mss->pss_locked += pss / mapcount;
                 } else {
                         if (dirty || PageDirty(page))
                                 mss->private_dirty += PAGE_SIZE;
                         else
                                 mss->private_clean += PAGE_SIZE;
-                        mss->pss += PAGE_SIZE << PSS_SHIFT;
+                        mss->pss += pss;
+                        if (locked)
+                                mss->pss_locked += pss;
                 }
         }
 }
@@ -490,6 +497,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page = NULL;
 
         if (pte_present(*pte)) {
@@ -532,7 +540,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
         if (!page)
                 return;
 
-        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte));
+        smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -541,6 +549,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
 {
         struct mem_size_stats *mss = walk->private;
         struct vm_area_struct *vma = walk->vma;
+        bool locked = !!(vma->vm_flags & VM_LOCKED);
         struct page *page;
 
         /* FOLL_DUMP will return -EFAULT on huge zero page */
@@ -555,7 +564,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
-        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
+        smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked);
 }
 #else
 static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
@@ -737,11 +746,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
                 }
         }
 #endif
-
         /* mmap_sem is held in m_start */
         walk_page_vma(vma, &smaps_walk);
-        if (vma->vm_flags & VM_LOCKED)
-                mss->pss_locked += mss->pss;
 }
 
 #define SEQ_PUT_DEC(str, val) \
diff --git a/include/uapi/asm-generic/shmparam.h b/include/asm-generic/shmparam.h
index 8b78c0ba08b1..8b78c0ba08b1 100644
--- a/include/uapi/asm-generic/shmparam.h
+++ b/include/asm-generic/shmparam.h
diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h
new file mode 100644
index 000000000000..a726dd3f1dc6
--- /dev/null
+++ b/include/keys/request_key_auth-type.h
@@ -0,0 +1,36 @@
+/* request_key authorisation token key type
+ *
+ * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#ifndef _KEYS_REQUEST_KEY_AUTH_TYPE_H
+#define _KEYS_REQUEST_KEY_AUTH_TYPE_H
+
+#include <linux/key.h>
+
+/*
+ * Authorisation record for request_key().
+ */
+struct request_key_auth {
+        struct key              *target_key;
+        struct key              *dest_keyring;
+        const struct cred       *cred;
+        void                    *callout_info;
+        size_t                  callout_len;
+        pid_t                   pid;
+        char                    op[8];
+} __randomize_layout;
+
+static inline struct request_key_auth *get_request_key_auth(const struct key *key)
+{
+        return key->payload.data[0];
+}
+
+
+#endif /* _KEYS_REQUEST_KEY_AUTH_TYPE_H */
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 4f31f96bbfab..c36c86f1ec9a 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -100,7 +100,7 @@ enum vgic_irq_config {
 };
 
 struct vgic_irq {
-        spinlock_t irq_lock;            /* Protects the content of the struct */
+        raw_spinlock_t irq_lock;        /* Protects the content of the struct */
         struct list_head lpi_list;      /* Used to link all LPIs together */
         struct list_head ap_list;
 
@@ -256,7 +256,7 @@ struct vgic_dist {
         u64                     propbaser;
 
         /* Protects the lpi_list and the count value below. */
-        spinlock_t              lpi_list_lock;
+        raw_spinlock_t          lpi_list_lock;
         struct list_head        lpi_list_head;
         int                     lpi_list_count;
 
@@ -307,7 +307,7 @@ struct vgic_cpu {
         unsigned int used_lrs;
         struct vgic_irq private_irqs[VGIC_NR_PRIVATE_IRQS];
 
-        spinlock_t ap_list_lock;        /* Protects the ap_list */
+        raw_spinlock_t ap_list_lock;    /* Protects the ap_list */
 
         /*
          * List of IRQs that this VCPU should consider because they are either
diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
index 19f32b0c29af..6b318efd8a74 100644
--- a/include/linux/compiler_attributes.h
+++ b/include/linux/compiler_attributes.h
@@ -34,6 +34,7 @@
 #ifndef __has_attribute
 # define __has_attribute(x) __GCC4_has_attribute_##x
 # define __GCC4_has_attribute___assume_aligned__      (__GNUC_MINOR__ >= 9)
+# define __GCC4_has_attribute___copy__                0
 # define __GCC4_has_attribute___designated_init__     0
 # define __GCC4_has_attribute___externally_visible__  1
 # define __GCC4_has_attribute___noclone__             1
@@ -101,6 +102,19 @@
 #define __attribute_const__             __attribute__((__const__))
 
 /*
+ * Optional: only supported since gcc >= 9
+ * Optional: not supported by clang
+ * Optional: not supported by icc
+ *
+ *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-copy-function-attribute
+ */
+#if __has_attribute(__copy__)
+# define __copy(symbol)                 __attribute__((__copy__(symbol)))
+#else
+# define __copy(symbol)
+#endif
+
+/*
  * Don't. Just don't. See commit 771c035372a0 ("deprecate the '__deprecated'
  * attribute warnings entirely and for good") for more information.
  *
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 45ff763fba76..28604a8d0aa9 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1198,8 +1198,6 @@ static inline bool efi_enabled(int feature)
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
 extern bool efi_is_table_address(unsigned long phys_addr);
-
-extern int efi_apply_persistent_mem_reservations(void);
 #else
 static inline bool efi_enabled(int feature)
 {
@@ -1218,11 +1216,6 @@ static inline bool efi_is_table_address(unsigned long phys_addr)
 {
         return false;
 }
-
-static inline int efi_apply_persistent_mem_reservations(void)
-{
-        return 0;
-}
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index bc9af551fc83..e49d1de0614e 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -21,15 +21,6 @@ struct kernel_pkey_query;
 struct kernel_pkey_params;
 
 /*
- * key under-construction record
- * - passed to the request_key actor if supplied
- */
-struct key_construction {
-        struct key      *key;   /* key being constructed */
-        struct key      *authkey;/* authorisation for key being constructed */
-};
-
-/*
  * Pre-parsed payload, used by key add, update and instantiate.
  *
  * This struct will be cleared and data and datalen will be set with the data
@@ -50,8 +41,7 @@ struct key_preparsed_payload {
         time64_t        expiry;         /* Expiry time of key */
 } __randomize_layout;
 
-typedef int (*request_key_actor_t)(struct key_construction *key,
-                                   const char *op, void *aux);
+typedef int (*request_key_actor_t)(struct key *auth_key, void *aux);
 
 /*
  * Preparsed matching criterion.
@@ -181,20 +171,20 @@ extern int key_instantiate_and_link(struct key *key,
                                     const void *data,
                                     size_t datalen,
                                     struct key *keyring,
-                                    struct key *instkey);
+                                    struct key *authkey);
 extern int key_reject_and_link(struct key *key,
                                unsigned timeout,
                                unsigned error,
                                struct key *keyring,
-                               struct key *instkey);
-extern void complete_request_key(struct key_construction *cons, int error);
+                               struct key *authkey);
+extern void complete_request_key(struct key *authkey, int error);
 
 static inline int key_negate_and_link(struct key *key,
                                       unsigned timeout,
                                       struct key *keyring,
-                                      struct key *instkey)
+                                      struct key *authkey)
 {
-        return key_reject_and_link(key, timeout, ENOKEY, keyring, instkey);
+        return key_reject_and_link(key, timeout, ENOKEY, keyring, authkey);
 }
 
 extern int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep);
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 64c41cf45590..859b55b66db2 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -29,9 +29,6 @@ extern unsigned long max_pfn;
  */
 extern unsigned long long max_possible_pfn;
 
-#define INIT_MEMBLOCK_REGIONS   128
-#define INIT_PHYSMEM_REGIONS    4
-
 /**
  * enum memblock_flags - definition of memory region attributes
  * @MEMBLOCK_NONE: no special request
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index de7377815b6b..8ef330027b13 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -308,6 +308,7 @@ struct mmc_card {
         unsigned int    nr_parts;
 
         unsigned int            bouncesz;       /* Bounce buffer size */
+        struct workqueue_struct *complete_wq;   /* Private workqueue */
 };
 
 static inline bool mmc_large_sector(struct mmc_card *card)
diff --git a/include/linux/module.h b/include/linux/module.h
index 8fa38d3e7538..f5bc4c046461 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -129,13 +129,13 @@ extern void cleanup_module(void);
 #define module_init(initfn)                                     \
         static inline initcall_t __maybe_unused __inittest(void)                \
         { return initfn; }                                      \
-        int init_module(void) __attribute__((alias(#initfn)));
+        int init_module(void) __copy(initfn) __attribute__((alias(#initfn)));
 
 /* This is only required if you want to be unloadable. */
 #define module_exit(exitfn)                                     \
         static inline exitcall_t __maybe_unused __exittest(void)                \
         { return exitfn; }                                      \
-        void cleanup_module(void) __attribute__((alias(#exitfn)));
+        void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn)));
 
 #endif
 
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 2b2a6dce1630..4c76fe2c8488 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -11,6 +11,8 @@
 #define _LINUX_NETDEV_FEATURES_H
 
 #include <linux/types.h>
+#include <linux/bitops.h>
+#include <asm/byteorder.h>
 
 typedef u64 netdev_features_t;
 
@@ -154,8 +156,26 @@ enum {
 #define NETIF_F_HW_TLS_TX       __NETIF_F(HW_TLS_TX)
 #define NETIF_F_HW_TLS_RX       __NETIF_F(HW_TLS_RX)
 
-#define for_each_netdev_feature(mask_addr, bit) \
-        for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT)
+/* Finds the next feature with the highest number of the range of start till 0.
+ */
+static inline int find_next_netdev_feature(u64 feature, unsigned long start)
+{
+        /* like BITMAP_LAST_WORD_MASK() for u64
+         * this sets the most significant 64 - start to 0.
+         */
+        feature &= ~0ULL >> (-start & ((sizeof(feature) * 8) - 1));
+
+        return fls64(feature) - 1;
+}
+
+/* This goes for the MSB to the LSB through the set feature bits,
+ * mask_addr should be a u64 and bit an int
+ */
+#define for_each_netdev_feature(mask_addr, bit)                         \
+        for ((bit) = find_next_netdev_feature((mask_addr),              \
+                                              NETDEV_FEATURE_COUNT);    \
+             (bit) >= 0;                                                \
+             (bit) = find_next_netdev_feature((mask_addr), (bit) - 1))
 
 /* Features valid for ethtool to change */
 /* = all defined minus driver/device-class-related */
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index e27572d30d97..ad69430fd0eb 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -164,6 +164,16 @@ nfs_list_add_request(struct nfs_page *req, struct list_head *head)
         list_add_tail(&req->wb_list, head);
 }
 
+/**
+ * nfs_list_move_request - Move a request to a new list
+ * @req: request
+ * @head: head of list into which to insert the request.
+ */
+static inline void
+nfs_list_move_request(struct nfs_page *req, struct list_head *head)
+{
+        list_move_tail(&req->wb_list, head);
+}
 
 /**
  * nfs_list_remove_request - Remove a request from its wb_list
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 441a93ebcac0..b4bd2bf5f585 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1549,7 +1549,7 @@ struct nfs_commit_data {
 };
 
 struct nfs_pgio_completion_ops {
-        void    (*error_cleanup)(struct list_head *head);
+        void    (*error_cleanup)(struct list_head *head, int);
         void    (*init_hdr)(struct nfs_pgio_header *hdr);
         void    (*completion)(struct nfs_pgio_header *hdr);
         void    (*reschedule_io)(struct nfs_pgio_header *hdr);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 1d5c551a5add..e1a051724f7e 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -447,6 +447,11 @@ struct pmu {
          * Filter events for PMU-specific reasons.
          */
         int (*filter_match)             (struct perf_event *event); /* optional */
+
+        /*
+         * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
+         */
+        int (*check_period)             (struct perf_event *event, u64 value); /* optional */
 };
 
 enum perf_addr_filter_action_t {
diff --git a/include/linux/phy.h b/include/linux/phy.h
index ef20aeea10cc..127fcc9c3778 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -674,26 +674,13 @@ phy_lookup_setting(int speed, int duplex, const unsigned long *mask,
 size_t phy_speeds(unsigned int *speeds, size_t size,
                   unsigned long *mask);
 
-static inline bool __phy_is_started(struct phy_device *phydev)
-{
-        WARN_ON(!mutex_is_locked(&phydev->lock));
-
-        return phydev->state >= PHY_UP;
-}
-
 /**
  * phy_is_started - Convenience function to check whether PHY is started
  * @phydev: The phy_device struct
  */
 static inline bool phy_is_started(struct phy_device *phydev)
 {
-        bool started;
-
-        mutex_lock(&phydev->lock);
-        started = __phy_is_started(phydev);
-        mutex_unlock(&phydev->lock);
-
-        return started;
+        return phydev->state >= PHY_UP;
 }
 
 void phy_resolve_aneg_linkmode(struct phy_device *phydev);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 95d25b010a25..bdb9563c64a0 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2434,7 +2434,7 @@ static inline void skb_probe_transport_header(struct sk_buff *skb,
 
         if (skb_flow_dissect_flow_keys_basic(skb, &keys, NULL, 0, 0, 0, 0))
                 skb_set_transport_header(skb, keys.control.thoff);
-        else
+        else if (offset_hint >= 0)
                 skb_set_transport_header(skb, offset_hint);
 }
 
@@ -4212,6 +4212,12 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
         return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
 }
 
+static inline bool skb_is_gso_tcp(const struct sk_buff *skb)
+{
+        return skb_is_gso(skb) &&
+               skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6);
+}
+
 static inline void skb_gso_reset(struct sk_buff *skb)
 {
         skb_shinfo(skb)->gso_size = 0;
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index cb462f9ab7dd..71f2394abbf7 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -57,6 +57,15 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
 
                 if (!skb_partial_csum_set(skb, start, off))
                         return -EINVAL;
+        } else {
+                /* gso packets without NEEDS_CSUM do not set transport_offset.
+                 * probe and drop if does not match one of the above types.
+                 */
+                if (gso_type) {
+                        skb_probe_transport_header(skb, -1);
+                        if (!skb_transport_header_was_set(skb))
+                                return -EINVAL;
+                }
         }
 
         if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 00b5e7825508..74ff688568a0 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -39,6 +39,7 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
+        u32                     n_redirects;
         unsigned long           rate_last;
         /*
          * Once inet_peer is queued for deletion (refcnt == 0), following field
diff --git a/include/net/sock.h b/include/net/sock.h
index 2b229f7be8eb..f43f935cb113 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1277,7 +1277,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
         percpu_counter_inc(sk->sk_prot->sockets_allocated);
 }
 
-static inline int
+static inline u64
 sk_sockets_allocated_read_positive(struct sock *sk)
 {
         return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 14565d703291..e8baca85bac6 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -137,15 +137,21 @@ enum {
         INET_DIAG_TCLASS,
         INET_DIAG_SKMEMINFO,
         INET_DIAG_SHUTDOWN,
-        INET_DIAG_DCTCPINFO,
-        INET_DIAG_PROTOCOL,  /* response attribute only */
+
+        /*
+         * Next extenstions cannot be requested in struct inet_diag_req_v2:
+         * its field idiag_ext has only 8 bits.
+         */
+
+        INET_DIAG_DCTCPINFO,    /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_PROTOCOL,     /* response attribute only */
         INET_DIAG_SKV6ONLY,
         INET_DIAG_LOCALS,
         INET_DIAG_PEERS,
         INET_DIAG_PAD,
-        INET_DIAG_MARK,
-        INET_DIAG_BBRINFO,
-        INET_DIAG_CLASS_ID,
+        INET_DIAG_MARK,         /* only with CAP_NET_ADMIN */
+        INET_DIAG_BBRINFO,      /* request as INET_DIAG_VEGASINFO */
+        INET_DIAG_CLASS_ID,     /* request as INET_DIAG_TCLASS */
         INET_DIAG_MD5SIG,
         __INET_DIAG_MAX,
 };
diff --git a/init/main.c b/init/main.c
index e2e80ca3165a..c86a1c8f19f4 100644
--- a/init/main.c
+++ b/init/main.c
@@ -695,7 +695,6 @@ asmlinkage __visible void __init start_kernel(void)
                 initrd_start = 0;
         }
 #endif
-        page_ext_init();
         kmemleak_init();
         setup_per_cpu_pageset();
         numa_policy_init();
@@ -1131,6 +1130,8 @@ static noinline void __init kernel_init_freeable(void)
         sched_init_smp();
 
         page_alloc_init_late();
+        /* Initialize page ext after all struct pages are initialized. */
+        page_ext_init();
 
         do_basic_setup();
 
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index d43b14535827..950ab2f28922 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -44,7 +44,7 @@ static void do_up_read(struct irq_work *entry)
         struct stack_map_irq_work *work;
 
         work = container_of(entry, struct stack_map_irq_work, irq_work);
-        up_read(work->sem);
+        up_read_non_owner(work->sem);
         work->sem = NULL;
 }
 
@@ -338,6 +338,12 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
         } else {
                 work->sem = &current->mm->mmap_sem;
                 irq_work_queue(&work->irq_work);
+                /*
+                 * The irq_work will release the mmap_sem with
+                 * up_read_non_owner(). The rwsem_release() is called
+                 * here to release the lock from lockdep's perspective.
+                 */
+                rwsem_release(&current->mm->mmap_sem.dep_map, 1, _RET_IP_);
         }
 }
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 56674a7c3778..8f295b790297 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1617,12 +1617,13 @@ static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
         return 0;
 }
 
-static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
-                             int size, enum bpf_access_type t)
+static int check_sock_access(struct bpf_verifier_env *env, int insn_idx,
+                             u32 regno, int off, int size,
+                             enum bpf_access_type t)
 {
         struct bpf_reg_state *regs = cur_regs(env);
         struct bpf_reg_state *reg = &regs[regno];
-        struct bpf_insn_access_aux info;
+        struct bpf_insn_access_aux info = {};
 
         if (reg->smin_value < 0) {
                 verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
@@ -1636,6 +1637,8 @@ static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
                 return -EACCES;
         }
 
+        env->insn_aux_data[insn_idx].ctx_field_size = info.ctx_field_size;
+
         return 0;
 }
 
@@ -2032,7 +2035,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                         verbose(env, "cannot write into socket\n");
                         return -EACCES;
                 }
-                err = check_sock_access(env, regno, off, size, t);
+                err = check_sock_access(env, insn_idx, regno, off, size, t);
                 if (!err && value_regno >= 0)
                         mark_reg_unknown(env, regs, value_regno);
         } else {
diff --git a/kernel/events/core.c b/kernel/events/core.c
index e5ede6918050..26d6edab051a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4963,6 +4963,11 @@ static void __perf_event_period(struct perf_event *event,
         }
 }
 
+static int perf_event_check_period(struct perf_event *event, u64 value)
+{
+        return event->pmu->check_period(event, value);
+}
+
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
 {
         u64 value;
@@ -4979,6 +4984,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
         if (event->attr.freq && value > sysctl_perf_event_sample_rate)
                 return -EINVAL;
 
+        if (perf_event_check_period(event, value))
+                return -EINVAL;
+
         event_function_call(event, __perf_event_period, &value);
 
         return 0;
@@ -9391,6 +9399,11 @@ static int perf_pmu_nop_int(struct pmu *pmu)
         return 0;
 }
 
+static int perf_event_nop_int(struct perf_event *event, u64 value)
+{
+        return 0;
+}
+
 static DEFINE_PER_CPU(unsigned int, nop_txn_flags);
 
 static void perf_pmu_start_txn(struct pmu *pmu, unsigned int flags)
@@ -9691,6 +9704,9 @@ got_cpu_context:
                 pmu->pmu_disable = perf_pmu_nop_void;
         }
 
+        if (!pmu->check_period)
+                pmu->check_period = perf_event_nop_int;
+
         if (!pmu->event_idx)
                 pmu->event_idx = perf_event_idx_default;
 
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 309ef5a64af5..5ab4fe3b1dcc 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -734,7 +734,7 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
         size = sizeof(struct ring_buffer);
         size += nr_pages * sizeof(void *);
 
-        if (order_base_2(size) >= MAX_ORDER)
+        if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
                 goto fail;
 
         rb = kzalloc(size, GFP_KERNEL);
diff --git a/kernel/signal.c b/kernel/signal.c
index 99fa8ff06fd9..57b7771e20d7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2436,9 +2436,12 @@ relock:
         }
 
         /* Has this task already been marked for death? */
-        ksig->info.si_signo = signr = SIGKILL;
-        if (signal_group_exit(signal))
+        if (signal_group_exit(signal)) {
+                ksig->info.si_signo = signr = SIGKILL;
+                sigdelset(&current->pending.signal, SIGKILL);
+                recalc_sigpending();
                 goto fatal;
+        }
 
         for (;;) {
                 struct k_sigaction *ka;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c521b7347482..c4238b441624 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3384,6 +3384,8 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file
         const char tgid_space[] = "          ";
         const char space[] = "  ";
 
+        print_event_info(buf, m);
+
         seq_printf(m, "#                          %s  _-----=> irqs-off\n",
                    tgid ? tgid_space : space);
         seq_printf(m, "#                          %s / _----=> need-resched\n",
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index d5fb09ebba8b..9eaf07f99212 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -861,22 +861,14 @@ static const struct file_operations kprobe_profile_ops = {
 static nokprobe_inline int
 fetch_store_strlen(unsigned long addr)
 {
-        mm_segment_t old_fs;
         int ret, len = 0;
         u8 c;
 
-        old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        pagefault_disable();
-
         do {
-                ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
+                ret = probe_mem_read(&c, (u8 *)addr + len, 1);
                 len++;
         } while (c && ret == 0 && len < MAX_STRING_SIZE);
 
-        pagefault_enable();
-        set_fs(old_fs);
-
         return (ret < 0) ? ret : len;
 }
 
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index 5c56afc17cf8..4737bb8c07a3 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -180,10 +180,12 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs,
                 if (unlikely(arg->dynamic))
                         *dl = make_data_loc(maxlen, dyndata - base);
                 ret = process_fetch_insn(arg->code, regs, dl, base);
-                if (unlikely(ret < 0 && arg->dynamic))
+                if (unlikely(ret < 0 && arg->dynamic)) {
                         *dl = make_data_loc(0, dyndata - base);
-                else
+                } else {
                         dyndata += ret;
+                        maxlen -= ret;
+                }
         }
 }
 
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index c6659cb37033..59875eb278ea 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -768,9 +768,11 @@ all_leaves_cluster_together:
                 new_s0->index_key[i] =
                         ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE);
 
-        blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
-        pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
-        new_s0->index_key[keylen - 1] &= ~blank;
+        if (level & ASSOC_ARRAY_KEY_CHUNK_MASK) {
+                blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
+                pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
+                new_s0->index_key[keylen - 1] &= ~blank;
+        }
 
         /* This now reduces to a node splitting exercise for which we'll need
          * to regenerate the disparity table.
diff --git a/lib/crc32.c b/lib/crc32.c
index 45b1d67a1767..4a20455d1f61 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -206,8 +206,8 @@ u32 __pure __weak __crc32c_le(u32 crc, unsigned char const *p, size_t len)
 EXPORT_SYMBOL(crc32_le);
 EXPORT_SYMBOL(__crc32c_le);
 
-u32 crc32_le_base(u32, unsigned char const *, size_t) __alias(crc32_le);
-u32 __crc32c_le_base(u32, unsigned char const *, size_t) __alias(__crc32c_le);
+u32 __pure crc32_le_base(u32, unsigned char const *, size_t) __alias(crc32_le);
+u32 __pure __crc32c_le_base(u32, unsigned char const *, size_t) __alias(__crc32c_le);
 
 /*
  * This multiplies the polynomials x and y modulo the given modulus.
diff --git a/mm/gup.c b/mm/gup.c
index 05acd7e2eb22..75029649baca 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1674,7 +1674,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
                 if (!pmd_present(pmd))
                         return 0;
 
-                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) {
+                if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) ||
+                             pmd_devmap(pmd))) {
                         /*
                          * NUMA hinting faults need to be handled in the GUP
                          * slowpath for accounting purposes and so that they
diff --git a/mm/memblock.c b/mm/memblock.c
index 022d4cbb3618..ea31045ba704 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -26,6 +26,13 @@
 
 #include "internal.h"
 
+#define INIT_MEMBLOCK_REGIONS                   128
+#define INIT_PHYSMEM_REGIONS                    4
+
+#ifndef INIT_MEMBLOCK_RESERVED_REGIONS
+# define INIT_MEMBLOCK_RESERVED_REGIONS         INIT_MEMBLOCK_REGIONS
+#endif
+
 /**
  * DOC: memblock overview
  *
@@ -92,7 +99,7 @@ unsigned long max_pfn;
 unsigned long long max_possible_pfn;
 
 static struct memblock_region memblock_memory_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
-static struct memblock_region memblock_reserved_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
+static struct memblock_region memblock_reserved_init_regions[INIT_MEMBLOCK_RESERVED_REGIONS] __initdata_memblock;
 #ifdef CONFIG_HAVE_MEMBLOCK_PHYS_MAP
 static struct memblock_region memblock_physmem_init_regions[INIT_PHYSMEM_REGIONS] __initdata_memblock;
 #endif
@@ -105,7 +112,7 @@ struct memblock memblock __initdata_memblock = {
 
         .reserved.regions       = memblock_reserved_init_regions,
         .reserved.cnt           = 1,    /* empty dummy entry */
-        .reserved.max           = INIT_MEMBLOCK_REGIONS,
+        .reserved.max           = INIT_MEMBLOCK_RESERVED_REGIONS,
         .reserved.name          = "reserved",
 
 #ifdef CONFIG_HAVE_MEMBLOCK_PHYS_MAP
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 35fdde041f5c..7f79b78bc829 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4675,11 +4675,11 @@ refill:
                 /* Even if we own the page, we do not use atomic_set().
                  * This would break get_page_unless_zero() users.
                  */
-                page_ref_add(page, size - 1);
+                page_ref_add(page, PAGE_FRAG_CACHE_MAX_SIZE);
 
                 /* reset page count bias and offset to start of new frag */
                 nc->pfmemalloc = page_is_pfmemalloc(page);
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
                 nc->offset = size;
         }
 
@@ -4695,10 +4695,10 @@ refill:
                 size = nc->size;
 #endif
                 /* OK, page count is 0, we can safely set it */
-                set_page_count(page, size);
+                set_page_count(page, PAGE_FRAG_CACHE_MAX_SIZE + 1);
 
                 /* reset page count bias and offset to start of new frag */
-                nc->pagecnt_bias = size;
+                nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
                 offset = size - fragsz;
         }
 
diff --git a/mm/page_ext.c b/mm/page_ext.c
index ae44f7adbe07..8c78b8d45117 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -398,10 +398,8 @@ void __init page_ext_init(void)
                          * We know some arch can have a nodes layout such as
                          * -------------pfn-------------->
                          * N0 | N1 | N2 | N0 | N1 | N2|....
-                         *
-                         * Take into account DEFERRED_STRUCT_PAGE_INIT.
                          */
-                        if (early_pfn_to_nid(pfn) != nid)
+                        if (pfn_to_nid(pfn) != nid)
                                 continue;
                         if (init_section_page_ext(pfn, nid))
                                 goto oom;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a714c4f800e9..e979705bbf32 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -491,16 +491,6 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl,
                 delta = freeable / 2;
         }
 
-        /*
-         * Make sure we apply some minimal pressure on default priority
-         * even on small cgroups. Stale objects are not only consuming memory
-         * by themselves, but can also hold a reference to a dying cgroup,
-         * preventing it from being reclaimed. A dying cgroup with all
-         * corresponding structures like per-cpu stats and kmem caches
-         * can be really big, so it may lead to a significant waste of memory.
-         */
-        delta = max_t(unsigned long long, delta, min(freeable, batch_size));
-
         total_scan += delta;
         if (total_scan < 0) {
                 pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b85ca809e509..ffc83bebfe40 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -227,6 +227,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 
         switch (ntohs(ethhdr->h_proto)) {
         case ETH_P_8021Q:
+                if (!pskb_may_pull(skb, sizeof(*vhdr)))
+                        goto dropped;
                 vhdr = vlan_eth_hdr(skb);
 
                 /* drop batman-in-batman packets to prevent loops */
diff --git a/net/core/dev.c b/net/core/dev.c
index 8e276e0192a1..5d03889502eb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8152,7 +8152,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(upper->wanted_features & feature)
                     && (features & feature)) {
@@ -8172,7 +8172,7 @@ static void netdev_sync_lower_features(struct net_device *upper,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(features & feature) && (lower->features & feature)) {
                         netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
diff --git a/net/core/filter.c b/net/core/filter.c
index 7a54dc11ac2d..f7d0004fc160 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2789,8 +2789,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2831,8 +2830,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
@@ -2957,8 +2955,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2987,8 +2984,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 26d848484912..2415d9cb9b89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -356,6 +356,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
  */
 void *netdev_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __netdev_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(netdev_alloc_frag);
@@ -369,6 +371,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
 
 void *napi_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __napi_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(napi_alloc_frag);
diff --git a/net/core/sock.c b/net/core/sock.c
index 6aa2e7e0b4fb..bc3512f230a3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2380,7 +2380,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
         }
 
         if (sk_has_memory_pressure(sk)) {
-                int alloc;
+                u64 alloc;
 
                 if (!sk_under_memory_pressure(sk))
                         return 1;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 1a4e9ff02762..5731670c560b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -108,6 +108,7 @@ static size_t inet_sk_attr_size(struct sock *sk,
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
                 + nla_total_size(sizeof(struct inet_diag_msg))
                 + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
@@ -287,12 +288,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto errout;
         }
 
-        if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) {
+        if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
+            ext & (1 << (INET_DIAG_TCLASS - 1))) {
                 u32 classid = 0;
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
                 classid = sock_cgroup_classid(&sk->sk_cgrp_data);
 #endif
+                /* Fallback to socket priority if class id isn't set.
+                 * Classful qdiscs use it as direct reference to class.
+                 * For cgroup2 classid is always zero.
+                 */
+                if (!classid)
+                        classid = sk->sk_priority;
 
                 if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
                         goto errout;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d757b9642d0d..be778599bfed 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -216,6 +216,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
                         atomic_set(&p->rid, 0);
                         p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
                         p->rate_tokens = 0;
+                        p->n_redirects = 0;
                         /* 60*HZ is arbitrary, but chosen enough high so that the first
                          * calculation of tokens is at its maximum.
                          */
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index 2687db015b6f..fa2ba7c500e4 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -215,6 +215,7 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
 
         /* Change outer to look like the reply to an incoming packet */
         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMP;
         if (!nf_nat_ipv4_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
index a0aa13bcabda..0a8a60c1bf9a 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
@@ -105,6 +105,8 @@ static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
 int snmp_version(void *context, size_t hdrlen, unsigned char tag,
                  const void *data, size_t datalen)
 {
+        if (datalen != 1)
+                return -EINVAL;
         if (*(unsigned char *)data > 1)
                 return -ENOTSUPP;
         return 1;
@@ -114,8 +116,11 @@ int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
                 const void *data, size_t datalen)
 {
         struct snmp_ctx *ctx = (struct snmp_ctx *)context;
-        __be32 *pdata = (__be32 *)data;
+        __be32 *pdata;
 
+        if (datalen != 4)
+                return -EINVAL;
+        pdata = (__be32 *)data;
         if (*pdata == ctx->from) {
                 pr_debug("%s: %pI4 to %pI4\n", __func__,
                          (void *)&ctx->from, (void *)&ctx->to);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ce92f73cf104..5163b64f8fb3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -887,13 +887,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
         /* No redirected packets during ip_rt_redirect_silence;
          * reset the algorithm.
          */
-        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
+        if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
                 peer->rate_tokens = 0;
+                peer->n_redirects = 0;
+        }
 
         /* Too many ignored redirects; do not send anything
          * set dst.rate_last to the last seen redirected packet.
          */
-        if (peer->rate_tokens >= ip_rt_redirect_number) {
+        if (peer->n_redirects >= ip_rt_redirect_number) {
                 peer->rate_last = jiffies;
                 goto out_put_peer;
         }
@@ -910,6 +912,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
                 peer->rate_last = jiffies;
                 ++peer->rate_tokens;
+                ++peer->n_redirects;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
                 if (log_martians &&
                     peer->rate_tokens == ip_rt_redirect_number)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2079145a3b7c..cf3c5095c10e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2528,6 +2528,7 @@ void tcp_write_queue_purge(struct sock *sk)
         sk_mem_reclaim(sk);
         tcp_clear_all_retrans_hints(tcp_sk(sk));
         tcp_sk(sk)->packets_out = 0;
+        inet_csk(sk)->icsk_backoff = 0;
 }
 
 int tcp_disconnect(struct sock *sk, int flags)
@@ -2576,7 +2577,6 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->write_seq += tp->max_window + 2;
         if (tp->write_seq == 0)
                 tp->write_seq = 1;
-        icsk->icsk_backoff = 0;
         tp->snd_cwnd = 2;
         icsk->icsk_probes_out = 0;
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index efc6fef692ff..ec3cea9d6828 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -536,12 +536,15 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 if (sock_owned_by_user(sk))
                         break;
 
+                skb = tcp_rtx_queue_head(sk);
+                if (WARN_ON_ONCE(!skb))
+                        break;
+
                 icsk->icsk_backoff--;
                 icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
                                                TCP_TIMEOUT_INIT;
                 icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
 
-                skb = tcp_rtx_queue_head(sk);
 
                 tcp_mstamp_refresh(tp);
                 delta_us = (u32)(tp->tcp_mstamp - tcp_skb_timestamp_us(skb));
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 84c358804355..72ffd3d760ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1165,7 +1165,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                 if (ifa == ifp)
                         continue;
-                if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+                if (ifa->prefix_len != ifp->prefix_len ||
+                    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                        ifp->prefix_len))
                         continue;
                 if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 801a9a0c217e..43890898b0b5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1719,6 +1719,24 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
         return 0;
 }
 
+static void ip6erspan_set_version(struct nlattr *data[],
+                                  struct __ip6_tnl_parm *parms)
+{
+        parms->erspan_ver = 1;
+        if (data[IFLA_GRE_ERSPAN_VER])
+                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+
+        if (parms->erspan_ver == 1) {
+                if (data[IFLA_GRE_ERSPAN_INDEX])
+                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
+        } else if (parms->erspan_ver == 2) {
+                if (data[IFLA_GRE_ERSPAN_DIR])
+                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
+                if (data[IFLA_GRE_ERSPAN_HWID])
+                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
+        }
+}
+
 static void ip6gre_netlink_parms(struct nlattr *data[],
                                 struct __ip6_tnl_parm *parms)
 {
@@ -1767,20 +1785,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
 
         if (data[IFLA_GRE_COLLECT_METADATA])
                 parms->collect_md = true;
-
-        parms->erspan_ver = 1;
-        if (data[IFLA_GRE_ERSPAN_VER])
-                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
-
-        if (parms->erspan_ver == 1) {
-                if (data[IFLA_GRE_ERSPAN_INDEX])
-                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
-        } else if (parms->erspan_ver == 2) {
-                if (data[IFLA_GRE_ERSPAN_DIR])
-                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
-                if (data[IFLA_GRE_ERSPAN_HWID])
-                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
-        }
 }
 
 static int ip6gre_tap_init(struct net_device *dev)
@@ -2203,6 +2207,7 @@ static int ip6erspan_newlink(struct net *src_net, struct net_device *dev,
         int err;
 
         ip6gre_netlink_parms(data, &nt->parms);
+        ip6erspan_set_version(data, &nt->parms);
         ign = net_generic(net, ip6gre_net_id);
 
         if (nt->parms.collect_md) {
@@ -2248,6 +2253,7 @@ static int ip6erspan_changelink(struct net_device *dev, struct nlattr *tb[],
         if (IS_ERR(t))
                 return PTR_ERR(t);
 
+        ip6erspan_set_version(data, &p);
         ip6gre_tunnel_unlink_md(ign, t);
         ip6gre_tunnel_unlink(ign, t);
         ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 23022447eb49..7a41ee3c11b4 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -226,6 +226,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
         }
 
         nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMPV6;
         if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
                 return 0;
 
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 8d0ba757a46c..9b2f272ca164 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
         rcu_read_unlock();
 
         genlmsg_end(msg, hdr);
-        genlmsg_reply(msg, info);
-
-        return 0;
+        return genlmsg_reply(msg, info);
 
 nla_put_failure:
         rcu_read_unlock();
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 69e831bc317b..54821fb1a960 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -8,7 +8,7 @@
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
+        ieee80211_agg_stop_txq(sta, tid);
+
         spin_unlock_bh(&sta->lock);
 
         ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2493c74c2d37..96496b2c1670 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -941,6 +941,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                       BSS_CHANGED_P2P_PS |
                       BSS_CHANGED_TXPOWER;
         int err;
+        int prev_beacon_int;
 
         old = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (old)
@@ -963,6 +964,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
+        prev_beacon_int = sdata->vif.bss_conf.beacon_int;
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
 
         if (params->he_cap)
@@ -974,8 +976,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (!err)
                 ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
         mutex_unlock(&local->mtx);
-        if (err)
+        if (err) {
+                sdata->vif.bss_conf.beacon_int = prev_beacon_int;
                 return err;
+        }
 
         /*
          * Apply control port protocol, this allows us to
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index cad6592c52a1..2ec7011a4d07 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -70,6 +70,7 @@ enum mesh_deferred_task_flags {
  * @dst: mesh path destination mac address
  * @mpp: mesh proxy mac address
  * @rhash: rhashtable list pointer
+ * @walk_list: linked list containing all mesh_path objects.
  * @gate_list: list pointer for known gates list
  * @sdata: mesh subif
  * @next_hop: mesh neighbor to which frames for this destination will be
@@ -105,6 +106,7 @@ struct mesh_path {
         u8 dst[ETH_ALEN];
         u8 mpp[ETH_ALEN];       /* used for MPP or MAP */
         struct rhash_head rhash;
+        struct hlist_node walk_list;
         struct hlist_node gate_list;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info __rcu *next_hop;
@@ -133,12 +135,16 @@ struct mesh_path {
  * gate's mpath may or may not be resolved and active.
  * @gates_lock: protects updates to known_gates
  * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr
+ * @walk_head: linked list containging all mesh_path objects
+ * @walk_lock: lock protecting walk_head
  * @entries: number of entries in the table
  */
 struct mesh_table {
         struct hlist_head known_gates;
         spinlock_t gates_lock;
         struct rhashtable rhead;
+        struct hlist_head walk_head;
+        spinlock_t walk_lock;
         atomic_t entries;               /* Up to MAX_MESH_NEIGHBOURS */
 };
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index a5125624a76d..88a6d5e18ccc 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -59,8 +59,10 @@ static struct mesh_table *mesh_table_alloc(void)
                 return NULL;
 
         INIT_HLIST_HEAD(&newtbl->known_gates);
+        INIT_HLIST_HEAD(&newtbl->walk_head);
         atomic_set(&newtbl->entries,  0);
         spin_lock_init(&newtbl->gates_lock);
+        spin_lock_init(&newtbl->walk_lock);
 
         return newtbl;
 }
@@ -249,28 +251,15 @@ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
 static struct mesh_path *
 __mesh_path_lookup_by_idx(struct mesh_table *tbl, int idx)
 {
-        int i = 0, ret;
-        struct mesh_path *mpath = NULL;
-        struct rhashtable_iter iter;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return NULL;
-
-        rhashtable_walk_start(&iter);
+        int i = 0;
+        struct mesh_path *mpath;
 
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
                 if (i++ == idx)
                         break;
         }
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
 
-        if (IS_ERR(mpath) || !mpath)
+        if (!mpath)
                 return NULL;
 
         if (mpath_expired(mpath)) {
@@ -432,6 +421,7 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
                 return ERR_PTR(-ENOMEM);
 
         tbl = sdata->u.mesh.mesh_paths;
+        spin_lock_bh(&tbl->walk_lock);
         do {
                 ret = rhashtable_lookup_insert_fast(&tbl->rhead,
                                                     &new_mpath->rhash,
@@ -441,20 +431,20 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
                         mpath = rhashtable_lookup_fast(&tbl->rhead,
                                                        dst,
                                                        mesh_rht_params);
-
+                else if (!ret)
+                        hlist_add_head(&new_mpath->walk_list, &tbl->walk_head);
         } while (unlikely(ret == -EEXIST && !mpath));
+        spin_unlock_bh(&tbl->walk_lock);
 
-        if (ret && ret != -EEXIST)
-                return ERR_PTR(ret);
-
-        /* At this point either new_mpath was added, or we found a
-         * matching entry already in the table; in the latter case
-         * free the unnecessary new entry.
-         */
-        if (ret == -EEXIST) {
+        if (ret) {
                 kfree(new_mpath);
+
+                if (ret != -EEXIST)
+                        return ERR_PTR(ret);
+
                 new_mpath = mpath;
         }
+
         sdata->u.mesh.mesh_paths_generation++;
         return new_mpath;
 }
@@ -480,9 +470,17 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
 
         memcpy(new_mpath->mpp, mpp, ETH_ALEN);
         tbl = sdata->u.mesh.mpp_paths;
+
+        spin_lock_bh(&tbl->walk_lock);
         ret = rhashtable_lookup_insert_fast(&tbl->rhead,
                                             &new_mpath->rhash,
                                             mesh_rht_params);
+        if (!ret)
+                hlist_add_head_rcu(&new_mpath->walk_list, &tbl->walk_head);
+        spin_unlock_bh(&tbl->walk_lock);
+
+        if (ret)
+                kfree(new_mpath);
 
         sdata->u.mesh.mpp_paths_generation++;
         return ret;
@@ -503,20 +501,9 @@ void mesh_plink_broken(struct sta_info *sta)
         struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
         static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
 
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
                 if (rcu_access_pointer(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
@@ -530,8 +517,7 @@ void mesh_plink_broken(struct sta_info *sta)
                                 WLAN_REASON_MESH_PATH_DEST_UNREACHABLE, bcast);
                 }
         }
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        rcu_read_unlock();
 }
 
 static void mesh_path_free_rcu(struct mesh_table *tbl,
@@ -551,6 +537,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
 
 static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
 {
+        hlist_del_rcu(&mpath->walk_list);
         rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
         mesh_path_free_rcu(tbl, mpath);
 }
@@ -571,27 +558,14 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        struct hlist_node *n;
 
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if (rcu_access_pointer(mpath->next_hop) == sta)
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
@@ -599,51 +573,26 @@ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
 {
         struct mesh_table *tbl = sdata->u.mesh.mpp_paths;
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        struct hlist_node *n;
 
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if (ether_addr_equal(mpath->mpp, proxy))
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 static void table_flush_by_iface(struct mesh_table *tbl)
 {
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
-
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
+        struct hlist_node *n;
 
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 /**
@@ -675,15 +624,15 @@ static int table_path_del(struct mesh_table *tbl,
 {
         struct mesh_path *mpath;
 
-        rcu_read_lock();
+        spin_lock_bh(&tbl->walk_lock);
         mpath = rhashtable_lookup_fast(&tbl->rhead, addr, mesh_rht_params);
         if (!mpath) {
-                rcu_read_unlock();
+                spin_unlock_bh(&tbl->walk_lock);
                 return -ENXIO;
         }
 
         __mesh_path_del(tbl, mpath);
-        rcu_read_unlock();
+        spin_unlock_bh(&tbl->walk_lock);
         return 0;
 }
 
@@ -854,28 +803,16 @@ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
                           struct mesh_table *tbl)
 {
         struct mesh_path *mpath;
-        struct rhashtable_iter iter;
-        int ret;
+        struct hlist_node *n;
 
-        ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_KERNEL);
-        if (ret)
-                return;
-
-        rhashtable_walk_start(&iter);
-
-        while ((mpath = rhashtable_walk_next(&iter))) {
-                if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
-                        continue;
-                if (IS_ERR(mpath))
-                        break;
+        spin_lock_bh(&tbl->walk_lock);
+        hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
                 if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
                     (!(mpath->flags & MESH_PATH_FIXED)) &&
                      time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
                         __mesh_path_del(tbl, mpath);
         }
-
-        rhashtable_walk_stop(&iter);
-        rhashtable_walk_exit(&iter);
+        spin_unlock_bh(&tbl->walk_lock);
 }
 
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d0eb38b890aa..ba950ae974fc 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright (C) 2015-2017      Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -2146,6 +2146,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
                         break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (sdata->vif.bss_conf.ibss_joined)
+                                WARN_ON(drv_join_ibss(local, sdata));
+                        /* fall through */
                 default:
                         ieee80211_reconfig_stations(sdata);
                         /* fall through */
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index cad48d07c818..8401cefd9f65 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -29,6 +29,7 @@ config	IP_VS_IPV6
         bool "IPv6 support for IPVS"
         depends on IPV6 = y || IP_VS = IPV6
         select IP6_NF_IPTABLES
+        select NF_DEFRAG_IPV6
         ---help---
           Add IPv6 support to IPVS.
 
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index fe9abf3cc10a..235205c93e14 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1536,14 +1536,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
                 /* sorry, all this trouble for a no-hit :) */
                 IP_VS_DBG_PKT(12, af, pp, skb, iph->off,
                               "ip_vs_in: packet continues traversal as normal");
-                if (iph->fragoffs) {
-                        /* Fragment that couldn't be mapped to a conn entry
-                         * is missing module nf_defrag_ipv6
-                         */
-                        IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n");
+
+                /* Fragment couldn't be mapped to a conn entry */
+                if (iph->fragoffs)
                         IP_VS_DBG_PKT(7, af, pp, skb, iph->off,
                                       "unhandled fragment");
-                }
+
                 *verdict = NF_ACCEPT;
                 return 0;
         }
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 7d6318664eb2..ac8d848d7624 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -43,6 +43,7 @@
 #ifdef CONFIG_IP_VS_IPV6
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #endif
 #include <net/route.h>
 #include <net/sock.h>
@@ -900,11 +901,17 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 
 #ifdef CONFIG_IP_VS_IPV6
         if (udest->af == AF_INET6) {
+                int ret;
+
                 atype = ipv6_addr_type(&udest->addr.in6);
                 if ((!(atype & IPV6_ADDR_UNICAST) ||
                         atype & IPV6_ADDR_LINKLOCAL) &&
                         !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
                         return -EINVAL;
+
+                ret = nf_defrag_ipv6_enable(svc->ipvs->net);
+                if (ret)
+                        return ret;
         } else
 #endif
         {
@@ -1228,6 +1235,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
                         ret = -EINVAL;
                         goto out_err;
                 }
+
+                ret = nf_defrag_ipv6_enable(ipvs->net);
+                if (ret)
+                        goto out_err;
         }
 #endif
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5a92f23f179f..4893f248dfdc 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
         int err;
 
         list_for_each_entry(rule, &ctx->chain->rules, list) {
+                if (!nft_is_active_next(ctx->net, rule))
+                        continue;
+
                 err = nft_delrule(ctx, rule);
                 if (err < 0)
                         return err;
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index fe64df848365..0a4bad55a8aa 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -315,6 +315,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
         struct xt_target *target = expr->ops->data;
         void *info = nft_expr_priv(expr);
+        struct module *me = target->me;
         struct xt_tgdtor_param par;
 
         par.net = ctx->net;
@@ -325,7 +326,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
                 par.target->destroy(&par);
 
         if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
-                module_put(target->me);
+                module_put(me);
 }
 
 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index aecadd471e1d..13e1ac333fa4 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1899,7 +1899,7 @@ static int __init xt_init(void)
                 seqcount_init(&per_cpu(xt_recseq, i));
         }
 
-        xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
+        xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
         if (!xt)
                 return -ENOMEM;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3b1a78906bc0..1cd1d83a4be0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4292,7 +4292,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                 if (unlikely(rb->frames_per_block == 0))
                         goto out;
-                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
                         goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 9ccc93f257db..38bb882bb958 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -48,7 +48,7 @@ struct tcindex_data {
         u32 hash;               /* hash table size; 0 if undefined */
         u32 alloc_hash;         /* allocated size */
         u32 fall_through;       /* 0: only classify if explicit match */
-        struct rcu_head rcu;
+        struct rcu_work rwork;
 };
 
 static inline int tcindex_filter_is_set(struct tcindex_filter_result *r)
@@ -221,17 +221,11 @@ found:
         return 0;
 }
 
-static int tcindex_destroy_element(struct tcf_proto *tp,
-                                   void *arg, struct tcf_walker *walker)
-{
-        bool last;
-
-        return tcindex_delete(tp, arg, &last, NULL);
-}
-
-static void __tcindex_destroy(struct rcu_head *head)
+static void tcindex_destroy_work(struct work_struct *work)
 {
-        struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
+        struct tcindex_data *p = container_of(to_rcu_work(work),
+                                              struct tcindex_data,
+                                              rwork);
 
         kfree(p->perfect);
         kfree(p->h);
@@ -258,9 +252,11 @@ static int tcindex_filter_result_init(struct tcindex_filter_result *r)
         return tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
 }
 
-static void __tcindex_partial_destroy(struct rcu_head *head)
+static void tcindex_partial_destroy_work(struct work_struct *work)
 {
-        struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
+        struct tcindex_data *p = container_of(to_rcu_work(work),
+                                              struct tcindex_data,
+                                              rwork);
 
         kfree(p->perfect);
         kfree(p);
@@ -275,7 +271,7 @@ static void tcindex_free_perfect_hash(struct tcindex_data *cp)
         kfree(cp->perfect);
 }
 
-static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
+static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
 {
         int i, err = 0;
 
@@ -289,6 +285,9 @@ static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
                                     TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
                 if (err < 0)
                         goto errout;
+#ifdef CONFIG_NET_CLS_ACT
+                cp->perfect[i].exts.net = net;
+#endif
         }
 
         return 0;
@@ -305,9 +304,9 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                   struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
 {
         struct tcindex_filter_result new_filter_result, *old_r = r;
-        struct tcindex_filter_result cr;
         struct tcindex_data *cp = NULL, *oldp;
         struct tcindex_filter *f = NULL; /* make gcc behave */
+        struct tcf_result cr = {};
         int err, balloc = 0;
         struct tcf_exts e;
 
@@ -337,7 +336,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         if (p->perfect) {
                 int i;
 
-                if (tcindex_alloc_perfect_hash(cp) < 0)
+                if (tcindex_alloc_perfect_hash(net, cp) < 0)
                         goto errout;
                 for (i = 0; i < cp->hash; i++)
                         cp->perfect[i].res = p->perfect[i].res;
@@ -348,11 +347,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = tcindex_filter_result_init(&new_filter_result);
         if (err < 0)
                 goto errout1;
-        err = tcindex_filter_result_init(&cr);
-        if (err < 0)
-                goto errout1;
         if (old_r)
-                cr.res = r->res;
+                cr = r->res;
 
         if (tb[TCA_TCINDEX_HASH])
                 cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
@@ -406,7 +402,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         err = -ENOMEM;
         if (!cp->perfect && !cp->h) {
                 if (valid_perfect_hash(cp)) {
-                        if (tcindex_alloc_perfect_hash(cp) < 0)
+                        if (tcindex_alloc_perfect_hash(net, cp) < 0)
                                 goto errout_alloc;
                         balloc = 1;
                 } else {
@@ -443,8 +439,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         if (tb[TCA_TCINDEX_CLASSID]) {
-                cr.res.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
-                tcf_bind_filter(tp, &cr.res, base);
+                cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
+                tcf_bind_filter(tp, &cr, base);
         }
 
         if (old_r && old_r != r) {
@@ -456,7 +452,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
         }
 
         oldp = p;
-        r->res = cr.res;
+        r->res = cr;
         tcf_exts_change(&r->exts, &e);
 
         rcu_assign_pointer(tp->root, cp);
@@ -475,10 +471,12 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
                                 ; /* nothing */
 
                 rcu_assign_pointer(*fp, f);
+        } else {
+                tcf_exts_destroy(&new_filter_result.exts);
         }
 
         if (oldp)
-                call_rcu(&oldp->rcu, __tcindex_partial_destroy);
+                tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work);
         return 0;
 
 errout_alloc:
@@ -487,7 +485,6 @@ errout_alloc:
         else if (balloc == 2)
                 kfree(cp->h);
 errout1:
-        tcf_exts_destroy(&cr.exts);
         tcf_exts_destroy(&new_filter_result.exts);
 errout:
         kfree(cp);
@@ -562,15 +559,34 @@ static void tcindex_destroy(struct tcf_proto *tp,
                             struct netlink_ext_ack *extack)
 {
         struct tcindex_data *p = rtnl_dereference(tp->root);
-        struct tcf_walker walker;
+        int i;
 
         pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p);
-        walker.count = 0;
-        walker.skip = 0;
-        walker.fn = tcindex_destroy_element;
-        tcindex_walk(tp, &walker);
 
-        call_rcu(&p->rcu, __tcindex_destroy);
+        if (p->perfect) {
+                for (i = 0; i < p->hash; i++) {
+                        struct tcindex_filter_result *r = p->perfect + i;
+
+                        tcf_unbind_filter(tp, &r->res);
+                        if (tcf_exts_get_net(&r->exts))
+                                tcf_queue_work(&r->rwork,
+                                               tcindex_destroy_rexts_work);
+                        else
+                                __tcindex_destroy_rexts(r);
+                }
+        }
+
+        for (i = 0; p->h && i < p->hash; i++) {
+                struct tcindex_filter *f, *next;
+                bool last;
+
+                for (f = rtnl_dereference(p->h[i]); f; f = next) {
+                        next = rtnl_dereference(f->next);
+                        tcindex_delete(tp, &f->result, &last, NULL);
+                }
+        }
+
+        tcf_queue_work(&p->rwork, tcindex_destroy_work);
 }
 
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 66ba2ce2320f..968a85fe4d4a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -500,7 +500,7 @@ static void dev_watchdog_down(struct net_device *dev)
  *      netif_carrier_on - set carrier
  *      @dev: network device
  *
- * Device has detected that carrier.
+ * Device has detected acquisition of carrier.
  */
 void netif_carrier_on(struct net_device *dev)
 {
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 078f01a8d582..435847d98b51 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -256,6 +256,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
                 + nla_total_size(1) /* INET_DIAG_TOS */
                 + nla_total_size(1) /* INET_DIAG_TCLASS */
                 + nla_total_size(4) /* INET_DIAG_MARK */
+                + nla_total_size(4) /* INET_DIAG_CLASS_ID */
                 + nla_total_size(addrlen * asoc->peer.transport_count)
                 + nla_total_size(addrlen * addrcnt)
                 + nla_total_size(sizeof(struct inet_diag_meminfo))
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 123e9f2dc226..edfcf16e704c 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb)
 {
         skb->ip_summed = CHECKSUM_NONE;
         skb->csum_not_inet = 0;
+        gso_reset_checksum(skb, ~0);
         return sctp_compute_cksum(skb, skb_transport_offset(skb));
 }
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f24633114dfd..2936ed17bf9e 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -144,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                 }
         }
 
-        for (i = outcnt; i < stream->outcnt; i++)
+        for (i = outcnt; i < stream->outcnt; i++) {
                 kfree(SCTP_SO(stream, i)->ext);
+                SCTP_SO(stream, i)->ext = NULL;
+        }
 }
 
 static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index a712c9f8699b..fb07ad8d69a6 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -101,9 +101,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
 
         conn->tx_cdc_seq++;
         conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
-        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
-                            &conn->local_tx_ctrl, conn);
-        smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
+        smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
         rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
         if (!rc)
                 smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index 271e2524dc8f..f1cdde9d4b89 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -211,26 +211,27 @@ static inline int smc_curs_diff_large(unsigned int size,
 
 static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
                                           union smc_host_cursor *local,
+                                          union smc_host_cursor *save,
                                           struct smc_connection *conn)
 {
-        union smc_host_cursor temp;
-
-        smc_curs_copy(&temp, local, conn);
-        peer->count = htonl(temp.count);
-        peer->wrap = htons(temp.wrap);
+        smc_curs_copy(save, local, conn);
+        peer->count = htonl(save->count);
+        peer->wrap = htons(save->wrap);
         /* peer->reserved = htons(0); must be ensured by caller */
 }
 
 static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
-                                       struct smc_host_cdc_msg *local,
-                                       struct smc_connection *conn)
+                                       struct smc_connection *conn,
+                                       union smc_host_cursor *save)
 {
+        struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
+
         peer->common.type = local->common.type;
         peer->len = local->len;
         peer->seqno = htons(local->seqno);
         peer->token = htonl(local->token);
-        smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
-        smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
+        smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
+        smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
         peer->prod_flags = local->prod_flags;
         peer->conn_state_flags = local->conn_state_flags;
 }
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index fb6656295204..507105127095 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -44,7 +44,7 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
                       unsigned char *cksum, unsigned char *buf)
 {
         struct crypto_sync_skcipher *cipher;
-        unsigned char plain[8];
+        unsigned char *plain;
         s32 code;
 
         dprintk("RPC:       %s:\n", __func__);
@@ -52,6 +52,10 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
         if (IS_ERR(cipher))
                 return PTR_ERR(cipher);
 
+        plain = kmalloc(8, GFP_NOFS);
+        if (!plain)
+                return -ENOMEM;
+
         plain[0] = (unsigned char) ((seqnum >> 24) & 0xff);
         plain[1] = (unsigned char) ((seqnum >> 16) & 0xff);
         plain[2] = (unsigned char) ((seqnum >> 8) & 0xff);
@@ -67,6 +71,7 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
 
         code = krb5_encrypt(cipher, cksum, plain, buf, 8);
 out:
+        kfree(plain);
         crypto_free_sync_skcipher(cipher);
         return code;
 }
@@ -77,12 +82,17 @@ krb5_make_seq_num(struct krb5_ctx *kctx,
                 u32 seqnum,
                 unsigned char *cksum, unsigned char *buf)
 {
-        unsigned char plain[8];
+        unsigned char *plain;
+        s32 code;
 
         if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC)
                 return krb5_make_rc4_seq_num(kctx, direction, seqnum,
                                              cksum, buf);
 
+        plain = kmalloc(8, GFP_NOFS);
+        if (!plain)
+                return -ENOMEM;
+
         plain[0] = (unsigned char) (seqnum & 0xff);
         plain[1] = (unsigned char) ((seqnum >> 8) & 0xff);
         plain[2] = (unsigned char) ((seqnum >> 16) & 0xff);
@@ -93,7 +103,9 @@ krb5_make_seq_num(struct krb5_ctx *kctx,
         plain[6] = direction;
         plain[7] = direction;
 
-        return krb5_encrypt(key, cksum, plain, buf, 8);
+        code = krb5_encrypt(key, cksum, plain, buf, 8);
+        kfree(plain);
+        return code;
 }
 
 static s32
@@ -101,7 +113,7 @@ krb5_get_rc4_seq_num(struct krb5_ctx *kctx, unsigned char *cksum,
                      unsigned char *buf, int *direction, s32 *seqnum)
 {
         struct crypto_sync_skcipher *cipher;
-        unsigned char plain[8];
+        unsigned char *plain;
         s32 code;
 
         dprintk("RPC:       %s:\n", __func__);
@@ -113,20 +125,28 @@ krb5_get_rc4_seq_num(struct krb5_ctx *kctx, unsigned char *cksum,
         if (code)
                 goto out;
 
+        plain = kmalloc(8, GFP_NOFS);
+        if (!plain) {
+                code = -ENOMEM;
+                goto out;
+        }
+
         code = krb5_decrypt(cipher, cksum, buf, plain, 8);
         if (code)
-                goto out;
+                goto out_plain;
 
         if ((plain[4] != plain[5]) || (plain[4] != plain[6])
                                    || (plain[4] != plain[7])) {
                 code = (s32)KG_BAD_SEQ;
-                goto out;
+                goto out_plain;
         }
 
         *direction = plain[4];
 
         *seqnum = ((plain[0] << 24) | (plain[1] << 16) |
                                         (plain[2] << 8) | (plain[3]));
+out_plain:
+        kfree(plain);
 out:
         crypto_free_sync_skcipher(cipher);
         return code;
@@ -139,7 +159,7 @@ krb5_get_seq_num(struct krb5_ctx *kctx,
                int *direction, u32 *seqnum)
 {
         s32 code;
-        unsigned char plain[8];
+        unsigned char *plain;
         struct crypto_sync_skcipher *key = kctx->seq;
 
         dprintk("RPC:       krb5_get_seq_num:\n");
@@ -147,18 +167,25 @@ krb5_get_seq_num(struct krb5_ctx *kctx,
         if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC)
                 return krb5_get_rc4_seq_num(kctx, cksum, buf,
                                             direction, seqnum);
+        plain = kmalloc(8, GFP_NOFS);
+        if (!plain)
+                return -ENOMEM;
 
         if ((code = krb5_decrypt(key, cksum, buf, plain, 8)))
-                return code;
+                goto out;
 
         if ((plain[4] != plain[5]) || (plain[4] != plain[6]) ||
-            (plain[4] != plain[7]))
-                return (s32)KG_BAD_SEQ;
+            (plain[4] != plain[7])) {
+                code = (s32)KG_BAD_SEQ;
+                goto out;
+        }
 
         *direction = plain[4];
 
         *seqnum = ((plain[0]) |
                    (plain[1] << 8) | (plain[2] << 16) | (plain[3] << 24));
 
-        return 0;
+out:
+        kfree(plain);
+        return code;
 }
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index c048eb6deaaf..d4018e5a24c5 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -80,7 +80,7 @@ unx_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         if (!uid_eq(cred->cr_cred->fsuid, acred->cred->fsuid) || !gid_eq(cred->cr_cred->fsgid, acred->cred->fsgid))
                 return 0;
 
-        if (acred->cred && acred->cred->group_info != NULL)
+        if (acred->cred->group_info != NULL)
                 groups = acred->cred->group_info->ngroups;
         if (groups > UNX_NGROUPS)
                 groups = UNX_NGROUPS;
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index ec451b8114b0..b9313c15ee3a 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -252,7 +252,6 @@ static struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt, __be32 xid)
         req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
                                 rq_bc_pa_list);
         req->rq_reply_bytes_recvd = 0;
-        req->rq_bytes_sent = 0;
         memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
                         sizeof(req->rq_private_buf));
         req->rq_xid = xid;
diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
index 45a033329cd4..19bb356230ed 100644
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -146,7 +146,7 @@ rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
         rcu_read_lock();
         xprt = rcu_dereference(clnt->cl_xprt);
         /* no "debugfs" dentry? Don't bother with the symlink. */
-        if (!xprt->debugfs) {
+        if (IS_ERR_OR_NULL(xprt->debugfs)) {
                 rcu_read_unlock();
                 return;
         }
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index adc3c40cc733..2168d4d9c09f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -19,6 +19,7 @@
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/freezer.h>
+#include <linux/sched/mm.h>
 
 #include <linux/sunrpc/clnt.h>
 
@@ -902,7 +903,10 @@ void rpc_execute(struct rpc_task *task)
 
 static void rpc_async_schedule(struct work_struct *work)
 {
+        unsigned int pflags = memalloc_nofs_save();
+
         __rpc_execute(container_of(work, struct rpc_task, u.tk_work));
+        memalloc_nofs_restore(pflags);
 }
 
 /**
@@ -1067,7 +1071,10 @@ static void rpc_free_task(struct rpc_task *task)
 
 static void rpc_async_release(struct work_struct *work)
 {
+        unsigned int pflags = memalloc_nofs_save();
+
         rpc_free_task(container_of(work, struct rpc_task, u.tk_work));
+        memalloc_nofs_restore(pflags);
 }
 
 static void rpc_release_resources_task(struct rpc_task *task)
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index bc7489f1fe55..1cf4e379be7b 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -49,6 +49,7 @@
 #include <linux/sunrpc/metrics.h>
 #include <linux/sunrpc/bc_xprt.h>
 #include <linux/rcupdate.h>
+#include <linux/sched/mm.h>
 
 #include <trace/events/sunrpc.h>
 
@@ -643,11 +644,13 @@ static void xprt_autoclose(struct work_struct *work)
 {
         struct rpc_xprt *xprt =
                 container_of(work, struct rpc_xprt, task_cleanup);
+        unsigned int pflags = memalloc_nofs_save();
 
         clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
         xprt->ops->close(xprt);
         xprt_release_write(xprt, NULL);
         wake_up_bit(&xprt->state, XPRT_LOCKED);
+        memalloc_nofs_restore(pflags);
 }
 
 /**
@@ -1601,7 +1604,6 @@ xprt_request_init(struct rpc_task *task)
         req->rq_buffer  = NULL;
         req->rq_xid     = xprt_alloc_xid(xprt);
         xprt_init_connect_cookie(req, xprt);
-        req->rq_bytes_sent = 0;
         req->rq_snd_buf.len = 0;
         req->rq_snd_buf.buflen = 0;
         req->rq_rcv_buf.len = 0;
@@ -1723,6 +1725,7 @@ void xprt_release(struct rpc_task *task)
                 xprt->ops->buf_free(task);
         xprt_inject_disconnect(xprt);
         xdr_free_bvec(&req->rq_rcv_buf);
+        xdr_free_bvec(&req->rq_snd_buf);
         if (req->rq_cred != NULL)
                 put_rpccred(req->rq_cred);
         task->tk_rqstp = NULL;
@@ -1751,7 +1754,6 @@ xprt_init_bc_request(struct rpc_rqst *req, struct rpc_task *task)
          */
         xbufp->len = xbufp->head[0].iov_len + xbufp->page_len +
                 xbufp->tail[0].iov_len;
-        req->rq_bytes_sent = 0;
 }
 #endif
 
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 98c1e43eb7b1..d79b18c1f4cd 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -267,7 +267,6 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,
 
         /* Prepare rqst */
         rqst->rq_reply_bytes_recvd = 0;
-        rqst->rq_bytes_sent = 0;
         rqst->rq_xid = *p;
 
         rqst->rq_private_buf.len = size;
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index e7274dc10120..5d261353bd90 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -737,7 +737,6 @@ xprt_rdma_send_request(struct rpc_rqst *rqst)
                 goto drop_connection;
 
         rqst->rq_xmit_bytes_sent += rqst->rq_snd_buf.len;
-        rqst->rq_bytes_sent = 0;
 
         /* An RPC with no reply will throw off credit accounting,
          * so drop the connection to reset the credit grant.
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index b4e997d53ec7..89a63391d4d4 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -527,7 +527,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
 
         sendcq = ib_alloc_cq(ia->ri_device, NULL,
                              ep->rep_attr.cap.max_send_wr + 1,
-                             1, IB_POLL_WORKQUEUE);
+                             ia->ri_device->num_comp_vectors > 1 ? 1 : 0,
+                             IB_POLL_WORKQUEUE);
         if (IS_ERR(sendcq)) {
                 rc = PTR_ERR(sendcq);
                 goto out1;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ae09d850cd11..53de72d2dded 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -50,6 +50,7 @@
 #include <linux/bvec.h>
 #include <linux/highmem.h>
 #include <linux/uio.h>
+#include <linux/sched/mm.h>
 
 #include <trace/events/sunrpc.h>
 
@@ -404,8 +405,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
         size_t want, seek_init = seek, offset = 0;
         ssize_t ret;
 
-        if (seek < buf->head[0].iov_len) {
-                want = min_t(size_t, count, buf->head[0].iov_len);
+        want = min_t(size_t, count, buf->head[0].iov_len);
+        if (seek < want) {
                 ret = xs_read_kvec(sock, msg, flags, &buf->head[0], want, seek);
                 if (ret <= 0)
                         goto sock_err;
@@ -416,8 +417,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                         goto out;
                 seek = 0;
         } else {
-                seek -= buf->head[0].iov_len;
-                offset += buf->head[0].iov_len;
+                seek -= want;
+                offset += want;
         }
 
         want = xs_alloc_sparse_pages(buf,
@@ -442,8 +443,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                 offset += want;
         }
 
-        if (seek < buf->tail[0].iov_len) {
-                want = min_t(size_t, count - offset, buf->tail[0].iov_len);
+        want = min_t(size_t, count - offset, buf->tail[0].iov_len);
+        if (seek < want) {
                 ret = xs_read_kvec(sock, msg, flags, &buf->tail[0], want, seek);
                 if (ret <= 0)
                         goto sock_err;
@@ -453,7 +454,7 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                 if (ret != want)
                         goto out;
         } else
-                offset += buf->tail[0].iov_len;
+                offset = seek_init;
         ret = -EMSGSIZE;
 out:
         *read = offset - seek_init;
@@ -481,6 +482,14 @@ xs_read_stream_request_done(struct sock_xprt *transport)
         return transport->recv.fraghdr & cpu_to_be32(RPC_LAST_STREAM_FRAGMENT);
 }
 
+static void
+xs_read_stream_check_eor(struct sock_xprt *transport,
+                struct msghdr *msg)
+{
+        if (xs_read_stream_request_done(transport))
+                msg->msg_flags |= MSG_EOR;
+}
+
 static ssize_t
 xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg,
                 int flags, struct rpc_rqst *req)
@@ -492,17 +501,21 @@ xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg,
         xs_read_header(transport, buf);
 
         want = transport->recv.len - transport->recv.offset;
-        ret = xs_read_xdr_buf(transport->sock, msg, flags, buf,
-                        transport->recv.copied + want, transport->recv.copied,
-                        &read);
-        transport->recv.offset += read;
-        transport->recv.copied += read;
-        if (transport->recv.offset == transport->recv.len) {
-                if (xs_read_stream_request_done(transport))
-                        msg->msg_flags |= MSG_EOR;
-                return read;
+        if (want != 0) {
+                ret = xs_read_xdr_buf(transport->sock, msg, flags, buf,
+                                transport->recv.copied + want,
+                                transport->recv.copied,
+                                &read);
+                transport->recv.offset += read;
+                transport->recv.copied += read;
         }
 
+        if (transport->recv.offset == transport->recv.len)
+                xs_read_stream_check_eor(transport, msg);
+
+        if (want == 0)
+                return 0;
+
         switch (ret) {
         default:
                 break;
@@ -655,13 +668,34 @@ out_err:
         return ret != 0 ? ret : -ESHUTDOWN;
 }
 
+static __poll_t xs_poll_socket(struct sock_xprt *transport)
+{
+        return transport->sock->ops->poll(NULL, transport->sock, NULL);
+}
+
+static bool xs_poll_socket_readable(struct sock_xprt *transport)
+{
+        __poll_t events = xs_poll_socket(transport);
+
+        return (events & (EPOLLIN | EPOLLRDNORM)) && !(events & EPOLLRDHUP);
+}
+
+static void xs_poll_check_readable(struct sock_xprt *transport)
+{
+
+        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
+        if (!xs_poll_socket_readable(transport))
+                return;
+        if (!test_and_set_bit(XPRT_SOCK_DATA_READY, &transport->sock_state))
+                queue_work(xprtiod_workqueue, &transport->recv_worker);
+}
+
 static void xs_stream_data_receive(struct sock_xprt *transport)
 {
         size_t read = 0;
         ssize_t ret = 0;
 
         mutex_lock(&transport->recv_mutex);
-        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         if (transport->sock == NULL)
                 goto out;
         for (;;) {
@@ -671,6 +705,10 @@ static void xs_stream_data_receive(struct sock_xprt *transport)
                 read += ret;
                 cond_resched();
         }
+        if (ret == -ESHUTDOWN)
+                kernel_sock_shutdown(transport->sock, SHUT_RDWR);
+        else
+                xs_poll_check_readable(transport);
 out:
         mutex_unlock(&transport->recv_mutex);
         trace_xs_stream_read_data(&transport->xprt, ret, read);
@@ -680,7 +718,10 @@ static void xs_stream_data_receive_workfn(struct work_struct *work)
 {
         struct sock_xprt *transport =
                 container_of(work, struct sock_xprt, recv_worker);
+        unsigned int pflags = memalloc_nofs_save();
+
         xs_stream_data_receive(transport);
+        memalloc_nofs_restore(pflags);
 }
 
 static void
@@ -690,99 +731,65 @@ xs_stream_reset_connect(struct sock_xprt *transport)
         transport->recv.len = 0;
         transport->recv.copied = 0;
         transport->xmit.offset = 0;
+}
+
+static void
+xs_stream_start_connect(struct sock_xprt *transport)
+{
         transport->xprt.stat.connect_count++;
         transport->xprt.stat.connect_start = jiffies;
 }
 
 #define XS_SENDMSG_FLAGS        (MSG_DONTWAIT | MSG_NOSIGNAL)
 
+static int xs_sendmsg(struct socket *sock, struct msghdr *msg, size_t seek)
+{
+        if (seek)
+                iov_iter_advance(&msg->msg_iter, seek);
+        return sock_sendmsg(sock, msg);
+}
+
+static int xs_send_kvec(struct socket *sock, struct msghdr *msg, struct kvec *vec, size_t seek)
+{
+        iov_iter_kvec(&msg->msg_iter, WRITE, vec, 1, vec->iov_len);
+        return xs_sendmsg(sock, msg, seek);
+}
+
+static int xs_send_pagedata(struct socket *sock, struct msghdr *msg, struct xdr_buf *xdr, size_t base)
+{
+        int err;
+
+        err = xdr_alloc_bvec(xdr, GFP_KERNEL);
+        if (err < 0)
+                return err;
+
+        iov_iter_bvec(&msg->msg_iter, WRITE, xdr->bvec,
+                        xdr_buf_pagecount(xdr),
+                        xdr->page_len + xdr->page_base);
+        return xs_sendmsg(sock, msg, base + xdr->page_base);
+}
+
+#define xs_record_marker_len() sizeof(rpc_fraghdr)
+
 /* Common case:
  *  - stream transport
  *  - sending from byte 0 of the message
  *  - the message is wholly contained in @xdr's head iovec
  */
-static int xs_send_rm_and_kvec(struct socket *sock, struct xdr_buf *xdr,
-                               unsigned int remainder)
+static int xs_send_rm_and_kvec(struct socket *sock, struct msghdr *msg,
+                rpc_fraghdr marker, struct kvec *vec, size_t base)
 {
-        struct msghdr msg = {
-                .msg_flags      = XS_SENDMSG_FLAGS | (remainder ? MSG_MORE : 0)
-        };
-        rpc_fraghdr marker = cpu_to_be32(RPC_LAST_STREAM_FRAGMENT |
-                                         (u32)xdr->len);
         struct kvec iov[2] = {
-                {
+                [0] = {
                         .iov_base       = &marker,
                         .iov_len        = sizeof(marker)
                 },
-                {
-                        .iov_base       = xdr->head[0].iov_base,
-                        .iov_len        = xdr->head[0].iov_len
-                },
-        };
-        int ret;
-
-        ret = kernel_sendmsg(sock, &msg, iov, 2,
-                             iov[0].iov_len + iov[1].iov_len);
-        if (ret < 0)
-                return ret;
-        if (ret < iov[0].iov_len)
-                return -EPIPE;
-        return ret - iov[0].iov_len;
-}
-
-static int xs_send_kvec(struct socket *sock, struct sockaddr *addr, int addrlen, struct kvec *vec, unsigned int base, int more)
-{
-        struct msghdr msg = {
-                .msg_name       = addr,
-                .msg_namelen    = addrlen,
-                .msg_flags      = XS_SENDMSG_FLAGS | (more ? MSG_MORE : 0),
-        };
-        struct kvec iov = {
-                .iov_base       = vec->iov_base + base,
-                .iov_len        = vec->iov_len - base,
+                [1] = *vec,
         };
+        size_t len = iov[0].iov_len + iov[1].iov_len;
 
-        if (iov.iov_len != 0)
-                return kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
-        return kernel_sendmsg(sock, &msg, NULL, 0, 0);
-}
-
-static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more, bool zerocopy, int *sent_p)
-{
-        ssize_t (*do_sendpage)(struct socket *sock, struct page *page,
-                        int offset, size_t size, int flags);
-        struct page **ppage;
-        unsigned int remainder;
-        int err;
-
-        remainder = xdr->page_len - base;
-        base += xdr->page_base;
-        ppage = xdr->pages + (base >> PAGE_SHIFT);
-        base &= ~PAGE_MASK;
-        do_sendpage = sock->ops->sendpage;
-        if (!zerocopy)
-                do_sendpage = sock_no_sendpage;
-        for(;;) {
-                unsigned int len = min_t(unsigned int, PAGE_SIZE - base, remainder);
-                int flags = XS_SENDMSG_FLAGS;
-
-                remainder -= len;
-                if (more)
-                        flags |= MSG_MORE;
-                if (remainder != 0)
-                        flags |= MSG_SENDPAGE_NOTLAST | MSG_MORE;
-                err = do_sendpage(sock, *ppage, base, len, flags);
-                if (remainder == 0 || err != len)
-                        break;
-                *sent_p += err;
-                ppage++;
-                base = 0;
-        }
-        if (err > 0) {
-                *sent_p += err;
-                err = 0;
-        }
-        return err;
+        iov_iter_kvec(&msg->msg_iter, WRITE, iov, 2, len);
+        return xs_sendmsg(sock, msg, base);
 }
 
 /**
@@ -792,53 +799,60 @@ static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned i
  * @addrlen: UDP only -- length of destination address
  * @xdr: buffer containing this request
  * @base: starting position in the buffer
- * @zerocopy: true if it is safe to use sendpage()
+ * @rm: stream record marker field
  * @sent_p: return the total number of bytes successfully queued for sending
  *
  */
-static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, bool zerocopy, int *sent_p)
+static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, rpc_fraghdr rm, int *sent_p)
 {
-        unsigned int remainder = xdr->len - base;
+        struct msghdr msg = {
+                .msg_name = addr,
+                .msg_namelen = addrlen,
+                .msg_flags = XS_SENDMSG_FLAGS | MSG_MORE,
+        };
+        unsigned int rmsize = rm ? sizeof(rm) : 0;
+        unsigned int remainder = rmsize + xdr->len - base;
+        unsigned int want;
         int err = 0;
-        int sent = 0;
 
         if (unlikely(!sock))
                 return -ENOTSOCK;
 
-        if (base != 0) {
-                addr = NULL;
-                addrlen = 0;
-        }
-
-        if (base < xdr->head[0].iov_len || addr != NULL) {
-                unsigned int len = xdr->head[0].iov_len - base;
+        want = xdr->head[0].iov_len + rmsize;
+        if (base < want) {
+                unsigned int len = want - base;
                 remainder -= len;
-                if (!base && !addr)
-                        err = xs_send_rm_and_kvec(sock, xdr, remainder);
+                if (remainder == 0)
+                        msg.msg_flags &= ~MSG_MORE;
+                if (rmsize)
+                        err = xs_send_rm_and_kvec(sock, &msg, rm,
+                                        &xdr->head[0], base);
                 else
-                        err = xs_send_kvec(sock, addr, addrlen, &xdr->head[0],
-                                           base, remainder != 0);
+                        err = xs_send_kvec(sock, &msg, &xdr->head[0], base);
                 if (remainder == 0 || err != len)
                         goto out;
                 *sent_p += err;
                 base = 0;
         } else
-                base -= xdr->head[0].iov_len;
+                base -= want;
 
         if (base < xdr->page_len) {
                 unsigned int len = xdr->page_len - base;
                 remainder -= len;
-                err = xs_send_pagedata(sock, xdr, base, remainder != 0, zerocopy, &sent);
-                *sent_p += sent;
-                if (remainder == 0 || sent != len)
+                if (remainder == 0)
+                        msg.msg_flags &= ~MSG_MORE;
+                err = xs_send_pagedata(sock, &msg, xdr, base);
+                if (remainder == 0 || err != len)
                         goto out;
+                *sent_p += err;
                 base = 0;
         } else
                 base -= xdr->page_len;
 
         if (base >= xdr->tail[0].iov_len)
                 return 0;
-        err = xs_send_kvec(sock, NULL, 0, &xdr->tail[0], base, 0);
+        msg.msg_flags &= ~MSG_MORE;
+        err = xs_send_kvec(sock, &msg, &xdr->tail[0], base);
 out:
         if (err > 0) {
                 *sent_p += err;
@@ -907,6 +921,17 @@ xs_send_request_was_aborted(struct sock_xprt *transport, struct rpc_rqst *req)
         return transport->xmit.offset != 0 && req->rq_bytes_sent == 0;
 }
 
+/*
+ * Return the stream record marker field for a record of length < 2^31-1
+ */
+static rpc_fraghdr
+xs_stream_record_marker(struct xdr_buf *xdr)
+{
+        if (!xdr->len)
+                return 0;
+        return cpu_to_be32(RPC_LAST_STREAM_FRAGMENT | (u32)xdr->len);
+}
+
 /**
  * xs_local_send_request - write an RPC request to an AF_LOCAL socket
  * @req: pointer to RPC request
@@ -939,7 +964,8 @@ static int xs_local_send_request(struct rpc_rqst *req)
         req->rq_xtime = ktime_get();
         status = xs_sendpages(transport->sock, NULL, 0, xdr,
                               transport->xmit.offset,
-                              true, &sent);
+                              xs_stream_record_marker(xdr),
+                              &sent);
         dprintk("RPC:       %s(%u) = %d\n",
                         __func__, xdr->len - transport->xmit.offset, status);
 
@@ -951,7 +977,6 @@ static int xs_local_send_request(struct rpc_rqst *req)
                 req->rq_bytes_sent = transport->xmit.offset;
                 if (likely(req->rq_bytes_sent >= req->rq_slen)) {
                         req->rq_xmit_bytes_sent += transport->xmit.offset;
-                        req->rq_bytes_sent = 0;
                         transport->xmit.offset = 0;
                         return 0;
                 }
@@ -1007,7 +1032,7 @@ static int xs_udp_send_request(struct rpc_rqst *req)
 
         req->rq_xtime = ktime_get();
         status = xs_sendpages(transport->sock, xs_addr(xprt), xprt->addrlen,
-                              xdr, 0, true, &sent);
+                              xdr, 0, 0, &sent);
 
         dprintk("RPC:       xs_udp_send_request(%u) = %d\n",
                         xdr->len, status);
@@ -1071,7 +1096,6 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
         struct xdr_buf *xdr = &req->rq_snd_buf;
-        bool zerocopy = true;
         bool vm_wait = false;
         int status;
         int sent;
@@ -1086,12 +1110,6 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
         xs_pktdump("packet data:",
                                 req->rq_svec->iov_base,
                                 req->rq_svec->iov_len);
-        /* Don't use zero copy if this is a resend. If the RPC call
-         * completes while the socket holds a reference to the pages,
-         * then we may end up resending corrupted data.
-         */
-        if (req->rq_task->tk_flags & RPC_TASK_SENT)
-                zerocopy = false;
 
         if (test_bit(XPRT_SOCK_UPD_TIMEOUT, &transport->sock_state))
                 xs_tcp_set_socket_timeouts(xprt, transport->sock);
@@ -1104,7 +1122,8 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
                 sent = 0;
                 status = xs_sendpages(transport->sock, NULL, 0, xdr,
                                       transport->xmit.offset,
-                                      zerocopy, &sent);
+                                      xs_stream_record_marker(xdr),
+                                      &sent);
 
                 dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
                                 xdr->len - transport->xmit.offset, status);
@@ -1115,7 +1134,6 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
                 req->rq_bytes_sent = transport->xmit.offset;
                 if (likely(req->rq_bytes_sent >= req->rq_slen)) {
                         req->rq_xmit_bytes_sent += transport->xmit.offset;
-                        req->rq_bytes_sent = 0;
                         transport->xmit.offset = 0;
                         return 0;
                 }
@@ -1255,6 +1273,8 @@ static void xs_reset_transport(struct sock_xprt *transport)
         xprt_clear_connected(xprt);
         write_unlock_bh(&sk->sk_callback_lock);
         xs_sock_reset_connection_flags(xprt);
+        /* Reset stream record info */
+        xs_stream_reset_connect(transport);
         mutex_unlock(&transport->recv_mutex);
 
         trace_rpc_socket_close(xprt, sock);
@@ -1382,7 +1402,6 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
         int err;
 
         mutex_lock(&transport->recv_mutex);
-        clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state);
         sk = transport->inet;
         if (sk == NULL)
                 goto out;
@@ -1394,6 +1413,7 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
                 consume_skb(skb);
                 cond_resched();
         }
+        xs_poll_check_readable(transport);
 out:
         mutex_unlock(&transport->recv_mutex);
 }
@@ -1402,7 +1422,10 @@ static void xs_udp_data_receive_workfn(struct work_struct *work)
 {
         struct sock_xprt *transport =
                 container_of(work, struct sock_xprt, recv_worker);
+        unsigned int pflags = memalloc_nofs_save();
+
         xs_udp_data_receive(transport);
+        memalloc_nofs_restore(pflags);
 }
 
 /**
@@ -1893,7 +1916,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
                 sk->sk_write_space = xs_udp_write_space;
                 sock_set_flag(sk, SOCK_FASYNC);
                 sk->sk_error_report = xs_error_report;
-                sk->sk_allocation = GFP_NOIO;
 
                 xprt_clear_connected(xprt);
 
@@ -1904,7 +1926,7 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
                 write_unlock_bh(&sk->sk_callback_lock);
         }
 
-        xs_stream_reset_connect(transport);
+        xs_stream_start_connect(transport);
 
         return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, 0);
 }
@@ -2081,7 +2103,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 sk->sk_data_ready = xs_data_ready;
                 sk->sk_write_space = xs_udp_write_space;
                 sock_set_flag(sk, SOCK_FASYNC);
-                sk->sk_allocation = GFP_NOIO;
 
                 xprt_set_connected(xprt);
 
@@ -2244,7 +2265,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 sk->sk_write_space = xs_tcp_write_space;
                 sock_set_flag(sk, SOCK_FASYNC);
                 sk->sk_error_report = xs_error_report;
-                sk->sk_allocation = GFP_NOIO;
 
                 /* socket options */
                 sock_reset_flag(sk, SOCK_LINGER);
@@ -2264,8 +2284,7 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 
         xs_set_memalloc(xprt);
 
-        /* Reset TCP record info */
-        xs_stream_reset_connect(transport);
+        xs_stream_start_connect(transport);
 
         /* Tell the socket layer to start connecting... */
         set_bit(XPRT_SOCK_CONNECTING, &transport->sock_state);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 2792a3cae682..85ad5c0678d0 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         default:
                 pr_warn("Dropping received illegal msg type\n");
                 kfree_skb(skb);
-                return false;
+                return true;
         };
 }
 
@@ -1425,6 +1425,10 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 l->rcv_unacked = 0;
         } else {
                 /* RESET_MSG or ACTIVATE_MSG */
+                if (mtyp == ACTIVATE_MSG) {
+                        msg_set_dest_session_valid(hdr, 1);
+                        msg_set_dest_session(hdr, l->peer_session);
+                }
                 msg_set_max_pkt(hdr, l->advertised_mtu);
                 strcpy(data, l->if_name);
                 msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
@@ -1642,6 +1646,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                         break;
                 }
+
+                /* If this endpoint was re-created while peer was ESTABLISHING
+                 * it doesn't know current session number. Force re-synch.
+                 */
+                if (mtyp == ACTIVATE_MSG && msg_dest_session_valid(hdr) &&
+                    l->session != msg_dest_session(hdr)) {
+                        if (less(l->session, msg_dest_session(hdr)))
+                                l->session = msg_dest_session(hdr) + 1;
+                        break;
+                }
+
                 /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
                 if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a0924956bb61..d7e4b8b93f9d 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -360,6 +360,28 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u16 n)
         msg_set_bits(m, 1, 0, 0xffff, n);
 }
 
+/* Note: reusing bits in word 1 for ACTIVATE_MSG only, to re-synch
+ * link peer session number
+ */
+static inline bool msg_dest_session_valid(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 16, 0x1);
+}
+
+static inline void msg_set_dest_session_valid(struct tipc_msg *m, bool valid)
+{
+        msg_set_bits(m, 1, 16, 0x1, valid);
+}
+
+static inline u16 msg_dest_session(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_dest_session(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
 
 /*
  * Word 2
diff --git a/net/tipc/node.c b/net/tipc/node.c
index db2a6c3e0be9..2dc4919ab23c 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -830,15 +830,16 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_node_write_lock(n);
         if (!tipc_link_is_establishing(l)) {
                 __tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
-                if (delete) {
-                        kfree(l);
-                        le->link = NULL;
-                        n->link_cnt--;
-                }
         } else {
                 /* Defuse pending tipc_node_link_up() */
+                tipc_link_reset(l);
                 tipc_link_fsm_evt(l, LINK_RESET_EVT);
         }
+        if (delete) {
+                kfree(l);
+                le->link = NULL;
+                n->link_cnt--;
+        }
         trace_tipc_node_link_down(n, true, "node link down or deleted!");
         tipc_node_write_unlock(n);
         if (delete)
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index c361ce782412..c3d5ab01fba7 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1651,6 +1651,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
 
 static void vmci_transport_destruct(struct vsock_sock *vsk)
 {
+        /* transport can be NULL if we hit a failure at init() time */
+        if (!vmci_trans(vsk))
+                return;
+
         /* Ensure that the detach callback doesn't use the sk/vsk
          * we are about to destruct.
          */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 623dfe5e211c..b36ad8efb5e5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1068,6 +1068,8 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync)
 
         ASSERT_RTNL();
 
+        flush_work(&wdev->pmsr_free_wk);
+
         nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
 
         list_del_rcu(&wdev->list);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 74150ad95823..d91a408db113 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -250,7 +250,7 @@ nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
                 NLA_POLICY_MAX(NLA_U8, 15),
         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
-                NLA_POLICY_MAX(NLA_U8, 15),
+                NLA_POLICY_MAX(NLA_U8, 31),
         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index de9286703280..0216ab555249 100644
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -256,8 +256,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         goto out_err;
         } else {
-                memcpy(req->mac_addr, nla_data(info->attrs[NL80211_ATTR_MAC]),
-                       ETH_ALEN);
+                memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
                 memset(req->mac_addr_mask, 0xff, ETH_ALEN);
         }
 
@@ -272,6 +271,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
 
         req->n_peers = count;
         req->cookie = cfg80211_assign_cookie(rdev);
+        req->nl_portid = info->snd_portid;
 
         err = rdev_start_pmsr(rdev, wdev, req);
         if (err)
@@ -530,14 +530,14 @@ free:
 }
 EXPORT_SYMBOL_GPL(cfg80211_pmsr_report);
 
-void cfg80211_pmsr_free_wk(struct work_struct *work)
+static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
 {
-        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
-                                                 pmsr_free_wk);
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_pmsr_request *req, *tmp;
         LIST_HEAD(free_list);
 
+        lockdep_assert_held(&wdev->mtx);
+
         spin_lock_bh(&wdev->pmsr_lock);
         list_for_each_entry_safe(req, tmp, &wdev->pmsr_list, list) {
                 if (req->nl_portid)
@@ -547,14 +547,22 @@ void cfg80211_pmsr_free_wk(struct work_struct *work)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         list_for_each_entry_safe(req, tmp, &free_list, list) {
-                wdev_lock(wdev);
                 rdev_abort_pmsr(rdev, wdev, req);
-                wdev_unlock(wdev);
 
                 kfree(req);
         }
 }
 
+void cfg80211_pmsr_free_wk(struct work_struct *work)
+{
+        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
+                                                 pmsr_free_wk);
+
+        wdev_lock(wdev);
+        cfg80211_pmsr_process_abort(wdev);
+        wdev_unlock(wdev);
+}
+
 void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
 {
         struct cfg80211_pmsr_request *req;
@@ -568,8 +576,8 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
         spin_unlock_bh(&wdev->pmsr_lock);
 
         if (found)
-                schedule_work(&wdev->pmsr_free_wk);
-        flush_work(&wdev->pmsr_free_wk);
+                cfg80211_pmsr_process_abort(wdev);
+
         WARN_ON(!list_empty(&wdev->pmsr_list));
 }
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index cd48cdd582c0..ec30e3732c7b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -5,7 +5,7 @@
  * Copyright 2007-2009  Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
  * Copyright 2017       Intel Deutschland GmbH
- * Copyright (C) 2018 Intel Corporation
+ * Copyright (C) 2018-2019 Intel Corporation
  */
 #include <linux/export.h>
 #include <linux/bitops.h>
@@ -19,6 +19,7 @@
 #include <linux/mpls.h>
 #include <linux/gcd.h>
 #include <linux/bitfield.h>
+#include <linux/nospec.h>
 #include "core.h"
 #include "rdev-ops.h"
 
@@ -715,20 +716,25 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 {
         unsigned int dscp;
         unsigned char vlan_priority;
+        unsigned int ret;
 
         /* skb->priority values from 256->263 are magic values to
          * directly indicate a specific 802.1d priority.  This is used
          * to allow 802.1d priority to be passed directly in from VLAN
          * tags, etc.
          */
-        if (skb->priority >= 256 && skb->priority <= 263)
-                return skb->priority - 256;
+        if (skb->priority >= 256 && skb->priority <= 263) {
+                ret = skb->priority - 256;
+                goto out;
+        }
 
         if (skb_vlan_tag_present(skb)) {
                 vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
                         >> VLAN_PRIO_SHIFT;
-                if (vlan_priority > 0)
-                        return vlan_priority;
+                if (vlan_priority > 0) {
+                        ret = vlan_priority;
+                        goto out;
+                }
         }
 
         switch (skb->protocol) {
@@ -747,8 +753,9 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 if (!mpls)
                         return 0;
 
-                return (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
+                ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
                         >> MPLS_LS_TC_SHIFT;
+                goto out;
         }
         case htons(ETH_P_80221):
                 /* 802.21 is always network control traffic */
@@ -761,18 +768,24 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
                 unsigned int i, tmp_dscp = dscp >> 2;
 
                 for (i = 0; i < qos_map->num_des; i++) {
-                        if (tmp_dscp == qos_map->dscp_exception[i].dscp)
-                                return qos_map->dscp_exception[i].up;
+                        if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
+                                ret = qos_map->dscp_exception[i].up;
+                                goto out;
+                        }
                 }
 
                 for (i = 0; i < 8; i++) {
                         if (tmp_dscp >= qos_map->up[i].low &&
-                            tmp_dscp <= qos_map->up[i].high)
-                                return i;
+                            tmp_dscp <= qos_map->up[i].high) {
+                                ret = i;
+                                goto out;
+                        }
                 }
         }
 
-        return dscp >> 5;
+        ret = dscp >> 5;
+out:
+        return array_index_nospec(ret, IEEE80211_NUM_TIDS);
 }
 EXPORT_SYMBOL(cfg80211_classify8021d);
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 5121729b8b63..ec3a828672ef 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
         unsigned int lci = 1;
         struct sock *sk;
 
-        read_lock_bh(&x25_list_lock);
-
-        while ((sk = __x25_find_socket(lci, nb)) != NULL) {
+        while ((sk = x25_find_socket(lci, nb)) != NULL) {
                 sock_put(sk);
                 if (++lci == 4096) {
                         lci = 0;
                         break;
                 }
+                cond_resched();
         }
 
-        read_unlock_bh(&x25_list_lock);
         return lci;
 }
 
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index d4de871e7d4d..37e1fe180769 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -125,9 +125,10 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
         return 0;
 
 err_unreg_umem:
-        xdp_clear_umem_at_qid(dev, queue_id);
         if (!force_zc)
                 err = 0; /* fallback to copy mode */
+        if (err)
+                xdp_clear_umem_at_qid(dev, queue_id);
 out_rtnl_unlock:
         rtnl_unlock();
         return err;
@@ -259,10 +260,10 @@ static int xdp_umem_pin_pages(struct xdp_umem *umem)
         if (!umem->pgs)
                 return -ENOMEM;
 
-        down_write(&current->mm->mmap_sem);
-        npgs = get_user_pages(umem->address, umem->npgs,
-                              gup_flags, &umem->pgs[0], NULL);
-        up_write(&current->mm->mmap_sem);
+        down_read(&current->mm->mmap_sem);
+        npgs = get_user_pages_longterm(umem->address, umem->npgs,
+                                       gup_flags, &umem->pgs[0], NULL);
+        up_read(&current->mm->mmap_sem);
 
         if (npgs != umem->npgs) {
                 if (npgs >= 0) {
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index a03268454a27..45f3b528dc09 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -669,6 +669,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
                 if (!umem)
                         return -EINVAL;
 
+                /* Matches the smp_wmb() in XDP_UMEM_REG */
+                smp_rmb();
                 if (offset == XDP_UMEM_PGOFF_FILL_RING)
                         q = READ_ONCE(umem->fq);
                 else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
@@ -678,6 +680,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
         if (!q)
                 return -EINVAL;
 
+        /* Matches the smp_wmb() in xsk_init_queue */
+        smp_rmb();
         qpg = virt_to_head_page(q->ring);
         if (size > (PAGE_SIZE << compound_order(qpg)))
                 return -EINVAL;
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 479909b858c7..8f533c81aa8d 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -186,20 +186,9 @@ static inline int key_permission(const key_ref_t key_ref, unsigned perm)
         return key_task_permission(key_ref, current_cred(), perm);
 }
 
-/*
- * Authorisation record for request_key().
- */
-struct request_key_auth {
-        struct key              *target_key;
-        struct key              *dest_keyring;
-        const struct cred       *cred;
-        void                    *callout_info;
-        size_t                  callout_len;
-        pid_t                   pid;
-} __randomize_layout;
-
 extern struct key_type key_type_request_key_auth;
 extern struct key *request_key_auth_new(struct key *target,
+                                        const char *op,
                                         const void *callout_info,
                                         size_t callout_len,
                                         struct key *dest_keyring);
diff --git a/security/keys/key.c b/security/keys/key.c
index 44a80d6741a1..696f1c092c50 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -265,8 +265,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 
                 spin_lock(&user->lock);
                 if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
-                        if (user->qnkeys + 1 >= maxkeys ||
-                            user->qnbytes + quotalen >= maxbytes ||
+                        if (user->qnkeys + 1 > maxkeys ||
+                            user->qnbytes + quotalen > maxbytes ||
                             user->qnbytes + quotalen < user->qnbytes)
                                 goto no_quota;
                 }
@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         key->gid = gid;
         key->perm = perm;
         key->restrict_link = restrict_link;
+        key->last_used_at = ktime_get_real_seconds();
 
         if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index e8093d025966..7bbe03593e58 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -25,6 +25,7 @@
 #include <linux/security.h>
 #include <linux/uio.h>
 #include <linux/uaccess.h>
+#include <keys/request_key_auth-type.h>
 #include "internal.h"
 
 #define KEY_MAX_DESC_SIZE 4096
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 02c77e928f68..0e0b9ccad2f8 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -19,6 +19,7 @@
 #include <linux/security.h>
 #include <linux/user_namespace.h>
 #include <linux/uaccess.h>
+#include <keys/request_key_auth-type.h>
 #include "internal.h"
 
 /* Session keyring create vs join semaphore */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 301f0e300dbd..3f56a312dd35 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -18,31 +18,30 @@
 #include <linux/keyctl.h>
 #include <linux/slab.h>
 #include "internal.h"
+#include <keys/request_key_auth-type.h>
 
 #define key_negative_timeout    60      /* default timeout on a negative key's existence */
 
 /**
  * complete_request_key - Complete the construction of a key.
- * @cons: The key construction record.
+ * @auth_key: The authorisation key.
  * @error: The success or failute of the construction.
  *
  * Complete the attempt to construct a key.  The key will be negated
  * if an error is indicated.  The authorisation key will be revoked
  * unconditionally.
  */
-void complete_request_key(struct key_construction *cons, int error)
+void complete_request_key(struct key *authkey, int error)
 {
-        kenter("{%d,%d},%d", cons->key->serial, cons->authkey->serial, error);
+        struct request_key_auth *rka = get_request_key_auth(authkey);
+        struct key *key = rka->target_key;
+
+        kenter("%d{%d},%d", authkey->serial, key->serial, error);
 
         if (error < 0)
-                key_negate_and_link(cons->key, key_negative_timeout, NULL,
-                                    cons->authkey);
+                key_negate_and_link(key, key_negative_timeout, NULL, authkey);
         else
-                key_revoke(cons->authkey);
-
-        key_put(cons->key);
-        key_put(cons->authkey);
-        kfree(cons);
+                key_revoke(authkey);
 }
 EXPORT_SYMBOL(complete_request_key);
 
@@ -91,21 +90,19 @@ static int call_usermodehelper_keys(const char *path, char **argv, char **envp,
  * Request userspace finish the construction of a key
  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
  */
-static int call_sbin_request_key(struct key_construction *cons,
-                                 const char *op,
-                                 void *aux)
+static int call_sbin_request_key(struct key *authkey, void *aux)
 {
         static char const request_key[] = "/sbin/request-key";
+        struct request_key_auth *rka = get_request_key_auth(authkey);
         const struct cred *cred = current_cred();
         key_serial_t prkey, sskey;
-        struct key *key = cons->key, *authkey = cons->authkey, *keyring,
-                *session;
+        struct key *key = rka->target_key, *keyring, *session;
         char *argv[9], *envp[3], uid_str[12], gid_str[12];
         char key_str[12], keyring_str[3][12];
         char desc[20];
         int ret, i;
 
-        kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
+        kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
 
         ret = install_user_keyrings();
         if (ret < 0)
@@ -163,7 +160,7 @@ static int call_sbin_request_key(struct key_construction *cons,
         /* set up the argument list */
         i = 0;
         argv[i++] = (char *)request_key;
-        argv[i++] = (char *) op;
+        argv[i++] = (char *)rka->op;
         argv[i++] = key_str;
         argv[i++] = uid_str;
         argv[i++] = gid_str;
@@ -191,7 +188,7 @@ error_link:
         key_put(keyring);
 
 error_alloc:
-        complete_request_key(cons, ret);
+        complete_request_key(authkey, ret);
         kleave(" = %d", ret);
         return ret;
 }
@@ -205,42 +202,31 @@ static int construct_key(struct key *key, const void *callout_info,
                          size_t callout_len, void *aux,
                          struct key *dest_keyring)
 {
-        struct key_construction *cons;
         request_key_actor_t actor;
         struct key *authkey;
         int ret;
 
         kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
 
-        cons = kmalloc(sizeof(*cons), GFP_KERNEL);
-        if (!cons)
-                return -ENOMEM;
-
         /* allocate an authorisation key */
-        authkey = request_key_auth_new(key, callout_info, callout_len,
+        authkey = request_key_auth_new(key, "create", callout_info, callout_len,
                                        dest_keyring);
-        if (IS_ERR(authkey)) {
-                kfree(cons);
-                ret = PTR_ERR(authkey);
-                authkey = NULL;
-        } else {
-                cons->authkey = key_get(authkey);
-                cons->key = key_get(key);
+        if (IS_ERR(authkey))
+                return PTR_ERR(authkey);
 
-                /* make the call */
-                actor = call_sbin_request_key;
-                if (key->type->request_key)
-                        actor = key->type->request_key;
+        /* Make the call */
+        actor = call_sbin_request_key;
+        if (key->type->request_key)
+                actor = key->type->request_key;
 
-                ret = actor(cons, "create", aux);
+        ret = actor(authkey, aux);
 
-                /* check that the actor called complete_request_key() prior to
-                 * returning an error */
-                WARN_ON(ret < 0 &&
-                        !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
-                key_put(authkey);
-        }
+        /* check that the actor called complete_request_key() prior to
+         * returning an error */
+        WARN_ON(ret < 0 &&
+                !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
 
+        key_put(authkey);
         kleave(" = %d", ret);
         return ret;
 }
@@ -275,7 +261,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring)
                         if (cred->request_key_auth) {
                                 authkey = cred->request_key_auth;
                                 down_read(&authkey->sem);
-                                rka = authkey->payload.data[0];
+                                rka = get_request_key_auth(authkey);
                                 if (!test_bit(KEY_FLAG_REVOKED,
                                               &authkey->flags))
                                         dest_keyring =
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 87ea2f54dedc..afc304e8b61e 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -17,7 +17,7 @@
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 #include "internal.h"
-#include <keys/user-type.h>
+#include <keys/request_key_auth-type.h>
 
 static int request_key_auth_preparse(struct key_preparsed_payload *);
 static void request_key_auth_free_preparse(struct key_preparsed_payload *);
@@ -68,7 +68,7 @@ static int request_key_auth_instantiate(struct key *key,
 static void request_key_auth_describe(const struct key *key,
                                       struct seq_file *m)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         seq_puts(m, "key:");
         seq_puts(m, key->description);
@@ -83,7 +83,7 @@ static void request_key_auth_describe(const struct key *key,
 static long request_key_auth_read(const struct key *key,
                                   char __user *buffer, size_t buflen)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
         size_t datalen;
         long ret;
 
@@ -109,7 +109,7 @@ static long request_key_auth_read(const struct key *key,
  */
 static void request_key_auth_revoke(struct key *key)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         kenter("{%d}", key->serial);
 
@@ -136,7 +136,7 @@ static void free_request_key_auth(struct request_key_auth *rka)
  */
 static void request_key_auth_destroy(struct key *key)
 {
-        struct request_key_auth *rka = key->payload.data[0];
+        struct request_key_auth *rka = get_request_key_auth(key);
 
         kenter("{%d}", key->serial);
 
@@ -147,8 +147,9 @@ static void request_key_auth_destroy(struct key *key)
  * Create an authorisation token for /sbin/request-key or whoever to gain
  * access to the caller's security data.
  */
-struct key *request_key_auth_new(struct key *target, const void *callout_info,
-                                 size_t callout_len, struct key *dest_keyring)
+struct key *request_key_auth_new(struct key *target, const char *op,
+                                 const void *callout_info, size_t callout_len,
+                                 struct key *dest_keyring)
 {
         struct request_key_auth *rka, *irka;
         const struct cred *cred = current->cred;
@@ -166,6 +167,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
         if (!rka->callout_info)
                 goto error_free_rka;
         rka->callout_len = callout_len;
+        strlcpy(rka->op, op, sizeof(rka->op));
 
         /* see if the calling process is already servicing the key request of
          * another process */
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 6c99fa8ac5fa..6c0b30391ba9 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2112,13 +2112,6 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
         return 0;
 }
 
-/* allow waiting for a capture stream that hasn't been started */
-#if IS_ENABLED(CONFIG_SND_PCM_OSS)
-#define wait_capture_start(substream)   ((substream)->oss.oss)
-#else
-#define wait_capture_start(substream)   false
-#endif
-
 /* the common loop for read/write data */
 snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                                      void *data, bool interleaved,
@@ -2184,16 +2177,11 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                 snd_pcm_update_hw_ptr(substream);
 
         if (!is_playback &&
-            runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
-                if (size >= runtime->start_threshold) {
-                        err = snd_pcm_start(substream);
-                        if (err < 0)
-                                goto _end_unlock;
-                } else if (!wait_capture_start(substream)) {
-                        /* nothing to do */
-                        err = 0;
+            runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
+            size >= runtime->start_threshold) {
+                err = snd_pcm_start(substream);
+                if (err < 0)
                         goto _end_unlock;
-                }
         }
 
         avail = snd_pcm_avail(substream);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 152f54137082..a4ee7656d9ee 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -924,6 +924,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+        SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 6df758adff84..1ffa36e987b4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1855,6 +1855,8 @@ enum {
         ALC887_FIXUP_BASS_CHMAP,
         ALC1220_FIXUP_GB_DUAL_CODECS,
         ALC1220_FIXUP_CLEVO_P950,
+        ALC1220_FIXUP_SYSTEM76_ORYP5,
+        ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2056,6 +2058,17 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
         snd_hda_override_conn_list(codec, 0x1b, 1, conn1);
 }
 
+static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+                                const struct hda_fixup *fix, int action);
+
+static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
+                                     const struct hda_fixup *fix,
+                                     int action)
+{
+        alc1220_fixup_clevo_p950(codec, fix, action);
+        alc_fixup_headset_mode_no_hp_mic(codec, fix, action);
+}
+
 static const struct hda_fixup alc882_fixups[] = {
         [ALC882_FIXUP_ABIT_AW9D_MAX] = {
                 .type = HDA_FIXUP_PINS,
@@ -2300,6 +2313,19 @@ static const struct hda_fixup alc882_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc1220_fixup_clevo_p950,
         },
+        [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc1220_fixup_system76_oryp5,
+        },
+        [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        {}
+                },
+                .chained = true,
+                .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
+        },
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2376,6 +2402,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
@@ -5632,6 +5660,7 @@ enum {
         ALC294_FIXUP_ASUS_SPK,
         ALC225_FIXUP_HEADSET_JACK,
         ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+        ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6587,6 +6616,17 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
         },
+        [ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        /* Disable PCBEEP-IN passthrough */
+                        { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
+                        { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7272,7 +7312,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60130},
                 {0x19, 0x03a11020},
                 {0x21, 0x0321101f}),
-        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+        SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
                 {0x12, 0x90a60130},
                 {0x14, 0x90170110},
                 {0x19, 0x04a11040},
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index d00734d31e04..e5b6769b9797 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -795,6 +795,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         if (hcd->spdif)
                 hcp->daidrv[i] = hdmi_spdif_dai;
 
+        dev_set_drvdata(dev, hcp);
+
         ret = devm_snd_soc_register_component(dev, &hdmi_driver, hcp->daidrv,
                                      dai_count);
         if (ret) {
@@ -802,8 +804,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                         __func__, ret);
                 return ret;
         }
-
-        dev_set_drvdata(dev, hcp);
         return 0;
 }
 
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 89c43b26c379..a9b91bcfcc09 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -1778,7 +1778,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
         {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc},
         {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
         {"ADC STO1 ASRC", NULL, "AD ASRC"},
+        {"ADC STO1 ASRC", NULL, "DA ASRC"},
         {"ADC STO1 ASRC", NULL, "CLKDET"},
+        {"DAC STO1 ASRC", NULL, "AD ASRC"},
         {"DAC STO1 ASRC", NULL, "DA ASRC"},
         {"DAC STO1 ASRC", NULL, "CLKDET"},
 
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 37e001cf9cd1..3fe34417ec89 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -462,7 +462,7 @@ static int asoc_simple_card_parse_of(struct simple_card_data *priv)
         conf_idx        = 0;
         node = of_get_child_by_name(top, PREFIX "dai-link");
         if (!node) {
-                node = dev->of_node;
+                node = of_node_get(top);
                 loop = 0;
         }
 
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index d6c62aa13041..d4bde4834ce5 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -604,6 +604,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
         unsigned int fmt)
 {
         struct i2s_dai *i2s = to_info(dai);
+        struct i2s_dai *other = get_other_dai(i2s);
         int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave;
         u32 mod, tmp = 0;
         unsigned long flags;
@@ -661,7 +662,8 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
                  * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
                  * clock configuration assigned in DT is not overwritten.
                  */
-                if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
+                if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL &&
+                    other->clk_data.clks == NULL)
                         i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
                                                         0, SND_SOC_CLOCK_IN);
                 break;
@@ -699,7 +701,9 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
         struct i2s_dai *i2s = to_info(dai);
+        struct i2s_dai *other = get_other_dai(i2s);
         u32 mod, mask = 0, val = 0;
+        struct clk *rclksrc;
         unsigned long flags;
 
         WARN_ON(!pm_runtime_active(dai->dev));
@@ -782,6 +786,13 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
 
         i2s->frmclk = params_rate(params);
 
+        rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
+        if (!rclksrc || IS_ERR(rclksrc))
+                rclksrc = other->clk_table[CLK_I2S_RCLK_SRC];
+
+        if (rclksrc && !IS_ERR(rclksrc))
+                i2s->rclk_srcrate = clk_get_rate(rclksrc);
+
         return 0;
 }
 
@@ -886,11 +897,6 @@ static int config_setup(struct i2s_dai *i2s)
                 return 0;
 
         if (!(i2s->quirks & QUIRK_NO_MUXPSR)) {
-                struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
-
-                if (rclksrc && !IS_ERR(rclksrc))
-                        i2s->rclk_srcrate = clk_get_rate(rclksrc);
-
                 psr = i2s->rclk_srcrate / i2s->frmclk / rfs;
                 writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR);
                 dev_dbg(&i2s->pdev->dev,
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 59e250cc2e9d..e819e965e1db 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1526,14 +1526,14 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
         int ret;
 
         /*
-         * 1) Avoid duplicate register (ex. MIXer case)
-         * 2) re-register if card was rebinded
+         * 1) Avoid duplicate register for DVC with MIX case
+         * 2) Allow duplicate register for MIX
+         * 3) re-register if card was rebinded
          */
         list_for_each_entry(kctrl, &card->controls, list) {
                 struct rsnd_kctrl_cfg *c = kctrl->private_data;
 
-                if (strcmp(kctrl->id.name, name) == 0 &&
-                    c->mod == mod)
+                if (c == cfg)
                         return 0;
         }
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 45ef295743ec..f5afab631abb 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -286,7 +286,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         if (rsnd_ssi_is_multi_slave(mod, io))
                 return 0;
 
-        if (ssi->usrcnt > 1) {
+        if (ssi->usrcnt > 0) {
                 if (ssi->rate != rate) {
                         dev_err(dev, "SSI parent/child should use same rate\n");
                         return -EINVAL;
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index c5934adcfd01..c74991dd18ab 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -79,7 +79,7 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod,
                 break;
         case 9:
                 for (i = 0; i < 4; i++)
-                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << (id * 4));
+                        rsnd_mod_write(mod, SSI_SYS_STATUS((i * 2) + 1), 0xf << 4);
                 break;
         }
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae450ba4f08..50617db05c46 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -735,12 +735,17 @@ static struct snd_soc_component *soc_find_component(
         const struct device_node *of_node, const char *name)
 {
         struct snd_soc_component *component;
+        struct device_node *component_of_node;
 
         lockdep_assert_held(&client_mutex);
 
         for_each_component(component) {
                 if (of_node) {
-                        if (component->dev->of_node == of_node)
+                        component_of_node = component->dev->of_node;
+                        if (!component_of_node && component->dev->parent)
+                                component_of_node = component->dev->parent->of_node;
+
+                        if (component_of_node == of_node)
                                 return component;
                 } else if (name && strcmp(component->name, name) == 0) {
                         return component;
@@ -951,7 +956,7 @@ static void soc_remove_dai(struct snd_soc_dai *dai, int order)
 {
         int err;
 
-        if (!dai || !dai->probed ||
+        if (!dai || !dai->probed || !dai->driver ||
             dai->driver->remove_order != order)
                 return;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 2c4c13419539..20bad755888b 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -70,12 +70,16 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_clock_supply] = 1,
         [snd_soc_dapm_supply] = 2,
         [snd_soc_dapm_micbias] = 3,
+        [snd_soc_dapm_vmid] = 3,
         [snd_soc_dapm_dai_link] = 2,
         [snd_soc_dapm_dai_in] = 4,
         [snd_soc_dapm_dai_out] = 4,
         [snd_soc_dapm_aif_in] = 4,
         [snd_soc_dapm_aif_out] = 4,
         [snd_soc_dapm_mic] = 5,
+        [snd_soc_dapm_siggen] = 5,
+        [snd_soc_dapm_input] = 5,
+        [snd_soc_dapm_output] = 5,
         [snd_soc_dapm_mux] = 6,
         [snd_soc_dapm_demux] = 6,
         [snd_soc_dapm_dac] = 7,
@@ -83,11 +87,19 @@ static int dapm_up_seq[] = {
         [snd_soc_dapm_mixer] = 8,
         [snd_soc_dapm_mixer_named_ctl] = 8,
         [snd_soc_dapm_pga] = 9,
+        [snd_soc_dapm_buffer] = 9,
+        [snd_soc_dapm_scheduler] = 9,
+        [snd_soc_dapm_effect] = 9,
+        [snd_soc_dapm_src] = 9,
+        [snd_soc_dapm_asrc] = 9,
+        [snd_soc_dapm_encoder] = 9,
+        [snd_soc_dapm_decoder] = 9,
         [snd_soc_dapm_adc] = 10,
         [snd_soc_dapm_out_drv] = 11,
         [snd_soc_dapm_hp] = 11,
         [snd_soc_dapm_spk] = 11,
         [snd_soc_dapm_line] = 11,
+        [snd_soc_dapm_sink] = 11,
         [snd_soc_dapm_kcontrol] = 12,
         [snd_soc_dapm_post] = 13,
 };
@@ -100,13 +112,25 @@ static int dapm_down_seq[] = {
         [snd_soc_dapm_spk] = 3,
         [snd_soc_dapm_line] = 3,
         [snd_soc_dapm_out_drv] = 3,
+        [snd_soc_dapm_sink] = 3,
         [snd_soc_dapm_pga] = 4,
+        [snd_soc_dapm_buffer] = 4,
+        [snd_soc_dapm_scheduler] = 4,
+        [snd_soc_dapm_effect] = 4,
+        [snd_soc_dapm_src] = 4,
+        [snd_soc_dapm_asrc] = 4,
+        [snd_soc_dapm_encoder] = 4,
+        [snd_soc_dapm_decoder] = 4,
         [snd_soc_dapm_switch] = 5,
         [snd_soc_dapm_mixer_named_ctl] = 5,
         [snd_soc_dapm_mixer] = 5,
         [snd_soc_dapm_dac] = 6,
         [snd_soc_dapm_mic] = 7,
+        [snd_soc_dapm_siggen] = 7,
+        [snd_soc_dapm_input] = 7,
+        [snd_soc_dapm_output] = 7,
         [snd_soc_dapm_micbias] = 8,
+        [snd_soc_dapm_vmid] = 8,
         [snd_soc_dapm_mux] = 9,
         [snd_soc_dapm_demux] = 9,
         [snd_soc_dapm_aif_in] = 10,
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 045ef136903d..731b963b6995 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -502,6 +502,7 @@ static void remove_dai(struct snd_soc_component *comp,
 {
         struct snd_soc_dai_driver *dai_drv =
                 container_of(dobj, struct snd_soc_dai_driver, dobj);
+        struct snd_soc_dai *dai;
 
         if (pass != SOC_TPLG_PASS_PCM_DAI)
                 return;
@@ -509,6 +510,10 @@ static void remove_dai(struct snd_soc_component *comp,
         if (dobj->ops && dobj->ops->dai_unload)
                 dobj->ops->dai_unload(comp, dobj);
 
+        list_for_each_entry(dai, &comp->dai_list, list)
+                if (dai->driver == dai_drv)
+                        dai->driver = NULL;
+
         kfree(dai_drv->name);
         list_del(&dobj->list);
         kfree(dai_drv);
@@ -2482,6 +2487,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
         struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id)
 {
         struct soc_tplg tplg;
+        int ret;
 
         /* setup parsing context */
         memset(&tplg, 0, sizeof(tplg));
@@ -2495,7 +2501,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
         tplg.bytes_ext_ops = ops->bytes_ext_ops;
         tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count;
 
-        return soc_tplg_load(&tplg);
+        ret = soc_tplg_load(&tplg);
+        /* free the created components if fail to load topology */
+        if (ret)
+                snd_soc_tplg_component_remove(comp, SND_SOC_TPLG_INDEX_ALL);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load);
 
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 382847154227..db114f3977e0 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -314,6 +314,9 @@ static int search_roland_implicit_fb(struct usb_device *dev, int ifnum,
         return 0;
 }
 
+/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
+ * applies. Returns 1 if a quirk was found.
+ */
 static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
                                          struct usb_device *dev,
                                          struct usb_interface_descriptor *altsd,
@@ -384,7 +387,7 @@ add_sync_ep:
 
         subs->data_endpoint->sync_master = subs->sync_endpoint;
 
-        return 0;
+        return 1;
 }
 
 static int set_sync_endpoint(struct snd_usb_substream *subs,
@@ -423,6 +426,10 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
         if (err < 0)
                 return err;
 
+        /* endpoint set by quirk */
+        if (err > 0)
+                return 0;
+
         if (altsd->bNumEndpoints < 2)
                 return 0;
 
diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
index fd92ce8388fc..57aaeaf8e192 100644
--- a/tools/include/uapi/asm/bitsperlong.h
+++ b/tools/include/uapi/asm/bitsperlong.h
@@ -15,6 +15,8 @@
 #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
 #elif defined(__riscv)
 #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
+#elif defined(__alpha__)
+#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
 #else
 #include <asm-generic/bitsperlong.h>
 #endif
diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
index 9050eeea5f5f..1de8bd8ccf5d 100644
--- a/tools/testing/selftests/networking/timestamping/Makefile
+++ b/tools/testing/selftests/networking/timestamping/Makefile
@@ -9,6 +9,3 @@ all: $(TEST_PROGS)
 top_srcdir = ../../../../..
 KSFT_KHDR_INSTALL := 1
 include ../../lib.mk
-
-clean:
-        rm -fr $(TEST_GEN_FILES)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index 9e350fd34504..9c486fad3f9f 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -626,6 +626,13 @@ static void vcpu_req_sleep(struct kvm_vcpu *vcpu)
                 /* Awaken to handle a signal, request we sleep again later. */
                 kvm_make_request(KVM_REQ_SLEEP, vcpu);
         }
+
+        /*
+         * Make sure we will observe a potential reset request if we've
+         * observed a change to the power state. Pairs with the smp_wmb() in
+         * kvm_psci_vcpu_on().
+         */
+        smp_rmb();
 }
 
 static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu)
@@ -639,6 +646,9 @@ static void check_vcpu_requests(struct kvm_vcpu *vcpu)
                 if (kvm_check_request(KVM_REQ_SLEEP, vcpu))
                         vcpu_req_sleep(vcpu);
 
+                if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
+                        kvm_reset_vcpu(vcpu);
+
                 /*
                  * Clear IRQ_PENDING requests that were made to guarantee
                  * that a VCPU sees new virtual interrupts.
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index fbdf3ac2f001..30251e288629 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1695,11 +1695,14 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
 
         vma_pagesize = vma_kernel_pagesize(vma);
         /*
-         * PUD level may not exist for a VM but PMD is guaranteed to
-         * exist.
+         * The stage2 has a minimum of 2 level table (For arm64 see
+         * kvm_arm_setup_stage2()). Hence, we are guaranteed that we can
+         * use PMD_SIZE huge mappings (even when the PMD is folded into PGD).
+         * As for PUD huge maps, we must make sure that we have at least
+         * 3 levels, i.e, PMD is not folded.
          */
         if ((vma_pagesize == PMD_SIZE ||
-             (vma_pagesize == PUD_SIZE && kvm_stage2_has_pud(kvm))) &&
+             (vma_pagesize == PUD_SIZE && kvm_stage2_has_pmd(kvm))) &&
             !force_pte) {
                 gfn = (fault_ipa & huge_page_mask(hstate_vma(vma))) >> PAGE_SHIFT;
         }
diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
index 9b73d3ad918a..34d08ee63747 100644
--- a/virt/kvm/arm/psci.c
+++ b/virt/kvm/arm/psci.c
@@ -104,12 +104,10 @@ static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu)
 
 static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
 {
+        struct vcpu_reset_state *reset_state;
         struct kvm *kvm = source_vcpu->kvm;
         struct kvm_vcpu *vcpu = NULL;
-        struct swait_queue_head *wq;
         unsigned long cpu_id;
-        unsigned long context_id;
-        phys_addr_t target_pc;
 
         cpu_id = smccc_get_arg1(source_vcpu) & MPIDR_HWID_BITMASK;
         if (vcpu_mode_is_32bit(source_vcpu))
@@ -130,32 +128,30 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
                         return PSCI_RET_INVALID_PARAMS;
         }
 
-        target_pc = smccc_get_arg2(source_vcpu);
-        context_id = smccc_get_arg3(source_vcpu);
+        reset_state = &vcpu->arch.reset_state;
 
-        kvm_reset_vcpu(vcpu);
-
-        /* Gracefully handle Thumb2 entry point */
-        if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
-                target_pc &= ~((phys_addr_t) 1);
-                vcpu_set_thumb(vcpu);
-        }
+        reset_state->pc = smccc_get_arg2(source_vcpu);
 
         /* Propagate caller endianness */
-        if (kvm_vcpu_is_be(source_vcpu))
-                kvm_vcpu_set_be(vcpu);
+        reset_state->be = kvm_vcpu_is_be(source_vcpu);
 
-        *vcpu_pc(vcpu) = target_pc;
         /*
          * NOTE: We always update r0 (or x0) because for PSCI v0.1
          * the general puspose registers are undefined upon CPU_ON.
          */
-        smccc_set_retval(vcpu, context_id, 0, 0, 0);
-        vcpu->arch.power_off = false;
-        smp_mb();               /* Make sure the above is visible */
+        reset_state->r0 = smccc_get_arg3(source_vcpu);
+
+        WRITE_ONCE(reset_state->reset, true);
+        kvm_make_request(KVM_REQ_VCPU_RESET, vcpu);
 
-        wq = kvm_arch_vcpu_wq(vcpu);
-        swake_up_one(wq);
+        /*
+         * Make sure the reset request is observed if the change to
+         * power_state is observed.
+         */
+        smp_wmb();
+
+        vcpu->arch.power_off = false;
+        kvm_vcpu_wake_up(vcpu);
 
         return PSCI_RET_SUCCESS;
 }
diff --git a/virt/kvm/arm/vgic/vgic-debug.c b/virt/kvm/arm/vgic/vgic-debug.c
index 07aa900bac56..1f62f2b8065d 100644
--- a/virt/kvm/arm/vgic/vgic-debug.c
+++ b/virt/kvm/arm/vgic/vgic-debug.c
@@ -251,9 +251,9 @@ static int vgic_debug_show(struct seq_file *s, void *v)
                 return 0;
         }
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         print_irq_state(s, irq, vcpu);
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         vgic_put_irq(kvm, irq);
         return 0;
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index c0c0b88af1d5..3bdb31eaed64 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -64,7 +64,7 @@ void kvm_vgic_early_init(struct kvm *kvm)
         struct vgic_dist *dist = &kvm->arch.vgic;
 
         INIT_LIST_HEAD(&dist->lpi_list_head);
-        spin_lock_init(&dist->lpi_list_lock);
+        raw_spin_lock_init(&dist->lpi_list_lock);
 }
 
 /* CREATION */
@@ -171,7 +171,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
 
                 irq->intid = i + VGIC_NR_PRIVATE_IRQS;
                 INIT_LIST_HEAD(&irq->ap_list);
-                spin_lock_init(&irq->irq_lock);
+                raw_spin_lock_init(&irq->irq_lock);
                 irq->vcpu = NULL;
                 irq->target_vcpu = vcpu0;
                 kref_init(&irq->refcount);
@@ -206,7 +206,7 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
         vgic_cpu->sgi_iodev.base_addr = VGIC_ADDR_UNDEF;
 
         INIT_LIST_HEAD(&vgic_cpu->ap_list_head);
-        spin_lock_init(&vgic_cpu->ap_list_lock);
+        raw_spin_lock_init(&vgic_cpu->ap_list_lock);
 
         /*
          * Enable and configure all SGIs to be edge-triggered and
@@ -216,7 +216,7 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
                 struct vgic_irq *irq = &vgic_cpu->private_irqs[i];
 
                 INIT_LIST_HEAD(&irq->ap_list);
-                spin_lock_init(&irq->irq_lock);
+                raw_spin_lock_init(&irq->irq_lock);
                 irq->intid = i;
                 irq->vcpu = NULL;
                 irq->target_vcpu = vcpu;
@@ -231,13 +231,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
                         irq->config = VGIC_CONFIG_LEVEL;
                 }
 
-                /*
-                 * GICv3 can only be created via the KVM_DEVICE_CREATE API and
-                 * so we always know the emulation type at this point as it's
-                 * either explicitly configured as GICv3, or explicitly
-                 * configured as GICv2, or not configured yet which also
-                 * implies GICv2.
-                 */
                 if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
                         irq->group = 1;
                 else
@@ -281,7 +274,7 @@ int vgic_init(struct kvm *kvm)
 {
         struct vgic_dist *dist = &kvm->arch.vgic;
         struct kvm_vcpu *vcpu;
-        int ret = 0, i;
+        int ret = 0, i, idx;
 
         if (vgic_initialized(kvm))
                 return 0;
@@ -298,6 +291,19 @@ int vgic_init(struct kvm *kvm)
         if (ret)
                 goto out;
 
+        /* Initialize groups on CPUs created before the VGIC type was known */
+        kvm_for_each_vcpu(idx, vcpu, kvm) {
+                struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+
+                for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
+                        struct vgic_irq *irq = &vgic_cpu->private_irqs[i];
+                        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+                                irq->group = 1;
+                        else
+                                irq->group = 0;
+                }
+        }
+
         if (vgic_has_its(kvm)) {
                 ret = vgic_v4_init(kvm);
                 if (ret)
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index eb2a390a6c86..ab3f47745d9c 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -65,7 +65,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
 
         INIT_LIST_HEAD(&irq->lpi_list);
         INIT_LIST_HEAD(&irq->ap_list);
-        spin_lock_init(&irq->irq_lock);
+        raw_spin_lock_init(&irq->irq_lock);
 
         irq->config = VGIC_CONFIG_EDGE;
         kref_init(&irq->refcount);
@@ -73,7 +73,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
         irq->target_vcpu = vcpu;
         irq->group = 1;
 
-        spin_lock_irqsave(&dist->lpi_list_lock, flags);
+        raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
 
         /*
          * There could be a race with another vgic_add_lpi(), so we need to
@@ -101,7 +101,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
         dist->lpi_list_count++;
 
 out_unlock:
-        spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+        raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
 
         /*
          * We "cache" the configuration table entries in our struct vgic_irq's.
@@ -287,7 +287,7 @@ static int update_lpi_config(struct kvm *kvm, struct vgic_irq *irq,
         if (ret)
                 return ret;
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
         if (!filter_vcpu || filter_vcpu == irq->target_vcpu) {
                 irq->priority = LPI_PROP_PRIORITY(prop);
@@ -299,7 +299,7 @@ static int update_lpi_config(struct kvm *kvm, struct vgic_irq *irq,
                 }
         }
 
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         if (irq->hw)
                 return its_prop_update_vlpi(irq->host_irq, prop, needs_inv);
@@ -332,7 +332,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)
         if (!intids)
                 return -ENOMEM;
 
-        spin_lock_irqsave(&dist->lpi_list_lock, flags);
+        raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
         list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
                 if (i == irq_count)
                         break;
@@ -341,7 +341,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)
                         continue;
                 intids[i++] = irq->intid;
         }
-        spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+        raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
 
         *intid_ptr = intids;
         return i;
@@ -352,9 +352,9 @@ static int update_affinity(struct vgic_irq *irq, struct kvm_vcpu *vcpu)
         int ret = 0;
         unsigned long flags;
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         irq->target_vcpu = vcpu;
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         if (irq->hw) {
                 struct its_vlpi_map map;
@@ -455,7 +455,7 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
                 }
 
                 irq = vgic_get_irq(vcpu->kvm, NULL, intids[i]);
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 irq->pending_latch = pendmask & (1U << bit_nr);
                 vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
                 vgic_put_irq(vcpu->kvm, irq);
@@ -612,7 +612,7 @@ static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its,
                 return irq_set_irqchip_state(irq->host_irq,
                                              IRQCHIP_STATE_PENDING, true);
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         irq->pending_latch = true;
         vgic_queue_irq_unlock(kvm, irq, flags);
 
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index 738b65d2d0e7..b535fffc7400 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -147,7 +147,7 @@ static void vgic_mmio_write_sgir(struct kvm_vcpu *source_vcpu,
 
                 irq = vgic_get_irq(source_vcpu->kvm, vcpu, intid);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 irq->pending_latch = true;
                 irq->source |= 1U << source_vcpu->vcpu_id;
 
@@ -191,13 +191,13 @@ static void vgic_mmio_write_target(struct kvm_vcpu *vcpu,
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, NULL, intid + i);
                 int target;
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 irq->targets = (val >> (i * 8)) & cpu_mask;
                 target = irq->targets ? __ffs(irq->targets) : 0;
                 irq->target_vcpu = kvm_get_vcpu(vcpu->kvm, target);
 
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 }
@@ -230,13 +230,13 @@ static void vgic_mmio_write_sgipendc(struct kvm_vcpu *vcpu,
         for (i = 0; i < len; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 irq->source &= ~((val >> (i * 8)) & 0xff);
                 if (!irq->source)
                         irq->pending_latch = false;
 
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 }
@@ -252,7 +252,7 @@ static void vgic_mmio_write_sgipends(struct kvm_vcpu *vcpu,
         for (i = 0; i < len; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 irq->source |= (val >> (i * 8)) & 0xff;
 
@@ -260,7 +260,7 @@ static void vgic_mmio_write_sgipends(struct kvm_vcpu *vcpu,
                         irq->pending_latch = true;
                         vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
                 } else {
-                        spin_unlock_irqrestore(&irq->irq_lock, flags);
+                        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 }
                 vgic_put_irq(vcpu->kvm, irq);
         }
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
index b3d1f0985117..4a12322bf7df 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
@@ -169,13 +169,13 @@ static void vgic_mmio_write_irouter(struct kvm_vcpu *vcpu,
         if (!irq)
                 return;
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
         /* We only care about and preserve Aff0, Aff1 and Aff2. */
         irq->mpidr = val & GENMASK(23, 0);
         irq->target_vcpu = kvm_mpidr_to_vcpu(vcpu->kvm, irq->mpidr);
 
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
         vgic_put_irq(vcpu->kvm, irq);
 }
 
@@ -281,7 +281,7 @@ static int vgic_v3_uaccess_write_pending(struct kvm_vcpu *vcpu,
         for (i = 0; i < len * 8; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 if (test_bit(i, &val)) {
                         /*
                          * pending_latch is set irrespective of irq type
@@ -292,7 +292,7 @@ static int vgic_v3_uaccess_write_pending(struct kvm_vcpu *vcpu,
                         vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
                 } else {
                         irq->pending_latch = false;
-                        spin_unlock_irqrestore(&irq->irq_lock, flags);
+                        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 }
 
                 vgic_put_irq(vcpu->kvm, irq);
@@ -957,7 +957,7 @@ void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg, bool allow_group1)
 
                 irq = vgic_get_irq(vcpu->kvm, c_vcpu, sgi);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 /*
                  * An access targetting Group0 SGIs can only generate
@@ -968,7 +968,7 @@ void vgic_v3_dispatch_sgi(struct kvm_vcpu *vcpu, u64 reg, bool allow_group1)
                         irq->pending_latch = true;
                         vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
                 } else {
-                        spin_unlock_irqrestore(&irq->irq_lock, flags);
+                        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 }
 
                 vgic_put_irq(vcpu->kvm, irq);
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index ceeda7e04a4d..7de42fba05b5 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -77,7 +77,7 @@ void vgic_mmio_write_group(struct kvm_vcpu *vcpu, gpa_t addr,
         for (i = 0; i < len * 8; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 irq->group = !!(val & BIT(i));
                 vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
 
@@ -120,7 +120,7 @@ void vgic_mmio_write_senable(struct kvm_vcpu *vcpu,
         for_each_set_bit(i, &val, len * 8) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 irq->enabled = true;
                 vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
 
@@ -139,11 +139,11 @@ void vgic_mmio_write_cenable(struct kvm_vcpu *vcpu,
         for_each_set_bit(i, &val, len * 8) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 irq->enabled = false;
 
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 }
@@ -160,10 +160,10 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu,
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
                 unsigned long flags;
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 if (irq_is_pending(irq))
                         value |= (1U << i);
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
                 vgic_put_irq(vcpu->kvm, irq);
         }
@@ -215,7 +215,7 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
         for_each_set_bit(i, &val, len * 8) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 if (irq->hw)
                         vgic_hw_irq_spending(vcpu, irq, is_uaccess);
                 else
@@ -262,14 +262,14 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
         for_each_set_bit(i, &val, len * 8) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 if (irq->hw)
                         vgic_hw_irq_cpending(vcpu, irq, is_uaccess);
                 else
                         irq->pending_latch = false;
 
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 }
@@ -311,7 +311,7 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
         unsigned long flags;
         struct kvm_vcpu *requester_vcpu = vgic_get_mmio_requester_vcpu();
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
         if (irq->hw) {
                 vgic_hw_irq_change_active(vcpu, irq, active, !requester_vcpu);
@@ -342,7 +342,7 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
         if (irq->active)
                 vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
         else
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 }
 
 /*
@@ -485,10 +485,10 @@ void vgic_mmio_write_priority(struct kvm_vcpu *vcpu,
         for (i = 0; i < len; i++) {
                 struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 /* Narrow the priority range to what we actually support */
                 irq->priority = (val >> (i * 8)) & GENMASK(7, 8 - VGIC_PRI_BITS);
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
                 vgic_put_irq(vcpu->kvm, irq);
         }
@@ -534,14 +534,14 @@ void vgic_mmio_write_config(struct kvm_vcpu *vcpu,
                         continue;
 
                 irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
                 if (test_bit(i * 2 + 1, &val))
                         irq->config = VGIC_CONFIG_EDGE;
                 else
                         irq->config = VGIC_CONFIG_LEVEL;
 
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 }
@@ -590,12 +590,12 @@ void vgic_write_irq_line_level_info(struct kvm_vcpu *vcpu, u32 intid,
                  * restore irq config before line level.
                  */
                 new_level = !!(val & (1U << i));
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 irq->line_level = new_level;
                 if (new_level)
                         vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
                 else
-                        spin_unlock_irqrestore(&irq->irq_lock, flags);
+                        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
                 vgic_put_irq(vcpu->kvm, irq);
         }
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 69b892abd7dc..d91a8938aa7c 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -84,7 +84,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
 
                 irq = vgic_get_irq(vcpu->kvm, vcpu, intid);
 
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
 
                 /* Always preserve the active bit */
                 irq->active = !!(val & GICH_LR_ACTIVE_BIT);
@@ -127,7 +127,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu)
                                 vgic_irq_set_phys_active(irq, false);
                 }
 
-                spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&irq->irq_lock);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 9c0dd234ebe8..4ee0aeb9a905 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -76,7 +76,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
                 if (!irq)       /* An LPI could have been unmapped. */
                         continue;
 
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
 
                 /* Always preserve the active bit */
                 irq->active = !!(val & ICH_LR_ACTIVE_BIT);
@@ -119,7 +119,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu)
                                 vgic_irq_set_phys_active(irq, false);
                 }
 
-                spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&irq->irq_lock);
                 vgic_put_irq(vcpu->kvm, irq);
         }
 
@@ -347,9 +347,9 @@ retry:
 
         status = val & (1 << bit_nr);
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         if (irq->target_vcpu != vcpu) {
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 goto retry;
         }
         irq->pending_latch = status;
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 870b1185173b..abd9c7352677 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -54,11 +54,11 @@ struct vgic_global kvm_vgic_global_state __ro_after_init = {
  * When taking more than one ap_list_lock at the same time, always take the
  * lowest numbered VCPU's ap_list_lock first, so:
  *   vcpuX->vcpu_id < vcpuY->vcpu_id:
- *     spin_lock(vcpuX->arch.vgic_cpu.ap_list_lock);
- *     spin_lock(vcpuY->arch.vgic_cpu.ap_list_lock);
+ *     raw_spin_lock(vcpuX->arch.vgic_cpu.ap_list_lock);
+ *     raw_spin_lock(vcpuY->arch.vgic_cpu.ap_list_lock);
  *
  * Since the VGIC must support injecting virtual interrupts from ISRs, we have
- * to use the spin_lock_irqsave/spin_unlock_irqrestore versions of outer
+ * to use the raw_spin_lock_irqsave/raw_spin_unlock_irqrestore versions of outer
  * spinlocks for any lock that may be taken while injecting an interrupt.
  */
 
@@ -72,7 +72,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)
         struct vgic_irq *irq = NULL;
         unsigned long flags;
 
-        spin_lock_irqsave(&dist->lpi_list_lock, flags);
+        raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
 
         list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
                 if (irq->intid != intid)
@@ -88,7 +88,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)
         irq = NULL;
 
 out_unlock:
-        spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+        raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
 
         return irq;
 }
@@ -138,15 +138,15 @@ void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
         if (irq->intid < VGIC_MIN_LPI)
                 return;
 
-        spin_lock_irqsave(&dist->lpi_list_lock, flags);
+        raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
         if (!kref_put(&irq->refcount, vgic_irq_release)) {
-                spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+                raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
                 return;
         };
 
         list_del(&irq->lpi_list);
         dist->lpi_list_count--;
-        spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+        raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
 
         kfree(irq);
 }
@@ -244,8 +244,8 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
         bool penda, pendb;
         int ret;
 
-        spin_lock(&irqa->irq_lock);
-        spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
+        raw_spin_lock(&irqa->irq_lock);
+        raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
 
         if (irqa->active || irqb->active) {
                 ret = (int)irqb->active - (int)irqa->active;
@@ -263,8 +263,8 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
         /* Both pending and enabled, sort by priority */
         ret = irqa->priority - irqb->priority;
 out:
-        spin_unlock(&irqb->irq_lock);
-        spin_unlock(&irqa->irq_lock);
+        raw_spin_unlock(&irqb->irq_lock);
+        raw_spin_unlock(&irqa->irq_lock);
         return ret;
 }
 
@@ -325,7 +325,7 @@ retry:
                  * not need to be inserted into an ap_list and there is also
                  * no more work for us to do.
                  */
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
                 /*
                  * We have to kick the VCPU here, because we could be
@@ -347,12 +347,12 @@ retry:
          * We must unlock the irq lock to take the ap_list_lock where
          * we are going to insert this new pending interrupt.
          */
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         /* someone can do stuff here, which we re-check below */
 
-        spin_lock_irqsave(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
-        spin_lock(&irq->irq_lock);
+        raw_spin_lock_irqsave(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
+        raw_spin_lock(&irq->irq_lock);
 
         /*
          * Did something change behind our backs?
@@ -367,10 +367,11 @@ retry:
          */
 
         if (unlikely(irq->vcpu || vcpu != vgic_target_oracle(irq))) {
-                spin_unlock(&irq->irq_lock);
-                spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
+                raw_spin_unlock(&irq->irq_lock);
+                raw_spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock,
+                                           flags);
 
-                spin_lock_irqsave(&irq->irq_lock, flags);
+                raw_spin_lock_irqsave(&irq->irq_lock, flags);
                 goto retry;
         }
 
@@ -382,8 +383,8 @@ retry:
         list_add_tail(&irq->ap_list, &vcpu->arch.vgic_cpu.ap_list_head);
         irq->vcpu = vcpu;
 
-        spin_unlock(&irq->irq_lock);
-        spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
+        raw_spin_unlock(&irq->irq_lock);
+        raw_spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
 
         kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
         kvm_vcpu_kick(vcpu);
@@ -430,11 +431,11 @@ int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int intid,
         if (!irq)
                 return -EINVAL;
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
         if (!vgic_validate_injection(irq, level, owner)) {
                 /* Nothing to see here, move along... */
-                spin_unlock_irqrestore(&irq->irq_lock, flags);
+                raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
                 vgic_put_irq(kvm, irq);
                 return 0;
         }
@@ -494,9 +495,9 @@ int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, unsigned int host_irq,
 
         BUG_ON(!irq);
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         ret = kvm_vgic_map_irq(vcpu, irq, host_irq, get_input_level);
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
         vgic_put_irq(vcpu->kvm, irq);
 
         return ret;
@@ -519,11 +520,11 @@ void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid)
         if (!irq->hw)
                 goto out;
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         irq->active = false;
         irq->pending_latch = false;
         irq->line_level = false;
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 out:
         vgic_put_irq(vcpu->kvm, irq);
 }
@@ -539,9 +540,9 @@ int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int vintid)
         irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
         BUG_ON(!irq);
 
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         kvm_vgic_unmap_irq(irq);
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
         vgic_put_irq(vcpu->kvm, irq);
 
         return 0;
@@ -571,12 +572,12 @@ int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
                 return -EINVAL;
 
         irq = vgic_get_irq(vcpu->kvm, vcpu, intid);
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         if (irq->owner && irq->owner != owner)
                 ret = -EEXIST;
         else
                 irq->owner = owner;
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         return ret;
 }
@@ -597,13 +598,13 @@ static void vgic_prune_ap_list(struct kvm_vcpu *vcpu)
         DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
 
 retry:
-        spin_lock(&vgic_cpu->ap_list_lock);
+        raw_spin_lock(&vgic_cpu->ap_list_lock);
 
         list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
                 struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB;
                 bool target_vcpu_needs_kick = false;
 
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
 
                 BUG_ON(vcpu != irq->vcpu);
 
@@ -616,7 +617,7 @@ retry:
                          */
                         list_del(&irq->ap_list);
                         irq->vcpu = NULL;
-                        spin_unlock(&irq->irq_lock);
+                        raw_spin_unlock(&irq->irq_lock);
 
                         /*
                          * This vgic_put_irq call matches the
@@ -631,14 +632,14 @@ retry:
 
                 if (target_vcpu == vcpu) {
                         /* We're on the right CPU */
-                        spin_unlock(&irq->irq_lock);
+                        raw_spin_unlock(&irq->irq_lock);
                         continue;
                 }
 
                 /* This interrupt looks like it has to be migrated. */
 
-                spin_unlock(&irq->irq_lock);
-                spin_unlock(&vgic_cpu->ap_list_lock);
+                raw_spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&vgic_cpu->ap_list_lock);
 
                 /*
                  * Ensure locking order by always locking the smallest
@@ -652,10 +653,10 @@ retry:
                         vcpuB = vcpu;
                 }
 
-                spin_lock(&vcpuA->arch.vgic_cpu.ap_list_lock);
-                spin_lock_nested(&vcpuB->arch.vgic_cpu.ap_list_lock,
-                                 SINGLE_DEPTH_NESTING);
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&vcpuA->arch.vgic_cpu.ap_list_lock);
+                raw_spin_lock_nested(&vcpuB->arch.vgic_cpu.ap_list_lock,
+                                      SINGLE_DEPTH_NESTING);
+                raw_spin_lock(&irq->irq_lock);
 
                 /*
                  * If the affinity has been preserved, move the
@@ -675,9 +676,9 @@ retry:
                         target_vcpu_needs_kick = true;
                 }
 
-                spin_unlock(&irq->irq_lock);
-                spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
-                spin_unlock(&vcpuA->arch.vgic_cpu.ap_list_lock);
+                raw_spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
+                raw_spin_unlock(&vcpuA->arch.vgic_cpu.ap_list_lock);
 
                 if (target_vcpu_needs_kick) {
                         kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu);
@@ -687,7 +688,7 @@ retry:
                 goto retry;
         }
 
-        spin_unlock(&vgic_cpu->ap_list_lock);
+        raw_spin_unlock(&vgic_cpu->ap_list_lock);
 }
 
 static inline void vgic_fold_lr_state(struct kvm_vcpu *vcpu)
@@ -741,10 +742,10 @@ static int compute_ap_list_depth(struct kvm_vcpu *vcpu,
         list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
                 int w;
 
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
                 /* GICv2 SGIs can count for more than one... */
                 w = vgic_irq_get_lr_count(irq);
-                spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&irq->irq_lock);
 
                 count += w;
                 *multi_sgi |= (w > 1);
@@ -770,7 +771,7 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
         count = 0;
 
         list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
 
                 /*
                  * If we have multi-SGIs in the pipeline, we need to
@@ -780,7 +781,7 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                  * the AP list has been sorted already.
                  */
                 if (multi_sgi && irq->priority > prio) {
-                        spin_unlock(&irq->irq_lock);
+                        _raw_spin_unlock(&irq->irq_lock);
                         break;
                 }
 
@@ -791,7 +792,7 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
                                 prio = irq->priority;
                 }
 
-                spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&irq->irq_lock);
 
                 if (count == kvm_vgic_global_state.nr_lr) {
                         if (!list_is_last(&irq->ap_list,
@@ -872,9 +873,9 @@ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
 
         DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
 
-        spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
+        raw_spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
         vgic_flush_lr_state(vcpu);
-        spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
+        raw_spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
 
         if (can_access_vgic_from_kernel())
                 vgic_restore_state(vcpu);
@@ -918,20 +919,20 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
 
         vgic_get_vmcr(vcpu, &vmcr);
 
-        spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);
+        raw_spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);
 
         list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
-                spin_lock(&irq->irq_lock);
+                raw_spin_lock(&irq->irq_lock);
                 pending = irq_is_pending(irq) && irq->enabled &&
                           !irq->active &&
                           irq->priority < vmcr.pmr;
-                spin_unlock(&irq->irq_lock);
+                raw_spin_unlock(&irq->irq_lock);
 
                 if (pending)
                         break;
         }
 
-        spin_unlock_irqrestore(&vgic_cpu->ap_list_lock, flags);
+        raw_spin_unlock_irqrestore(&vgic_cpu->ap_list_lock, flags);
 
         return pending;
 }
@@ -963,11 +964,10 @@ bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, unsigned int vintid)
                 return false;
 
         irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
-        spin_lock_irqsave(&irq->irq_lock, flags);
+        raw_spin_lock_irqsave(&irq->irq_lock, flags);
         map_is_active = irq->hw && irq->active;
-        spin_unlock_irqrestore(&irq->irq_lock, flags);
+        raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
         vgic_put_irq(vcpu->kvm, irq);
 
         return map_is_active;
 }
-