249 files changed, 2314 insertions, 1723 deletions
diff --git a/Documentation/ABI/stable/sysfs-bus-xen-backend b/Documentation/ABI/stable/sysfs-bus-xen-backend
index 3d5951c8bf5f..e8b60bd766f7 100644
--- a/Documentation/ABI/stable/sysfs-bus-xen-backend
+++ b/Documentation/ABI/stable/sysfs-bus-xen-backend
@@ -73,3 +73,12 @@ KernelVersion:	3.0
 Contact:        Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 Description:
                Number of sectors written by the frontend.
+What:           /sys/bus/xen-backend/devices/*/state
+Date:           August 2018
+KernelVersion:  4.19
+Contact:        Joe Jin <joe.jin@oracle.com>
+Description:
+                The state of the device. One of: 'Unknown',
+                'Initialising', 'Initialised', 'Connected', 'Closing',
+                'Closed', 'Reconfiguring', 'Reconfigured'.
diff --git a/Documentation/ABI/testing/sysfs-driver-xen-blkback b/Documentation/ABI/testing/sysfs-driver-xen-blkback
index 8bb43b66eb55..4e7babb3ba1f 100644
--- a/Documentation/ABI/testing/sysfs-driver-xen-blkback
+++ b/Documentation/ABI/testing/sysfs-driver-xen-blkback
@@ -15,3 +15,13 @@ Description:
                blkback. If the frontend tries to use more than
                max_persistent_grants, the LRU kicks in and starts
                removing 5% of max_persistent_grants every 100ms.
+What:           /sys/module/xen_blkback/parameters/persistent_grant_unused_seconds
+Date:           August 2018
+KernelVersion:  4.19
+Contact:        Roger Pau Monné <roger.pau@citrix.com>
+Description:
+                How long a persistent grant is allowed to remain
+                allocated without being in use. The time is in
+                seconds, 0 means indefinitely long.
+                The default is 60 seconds.
diff --git a/Documentation/arm64/sve.txt b/Documentation/arm64/sve.txt
index f128f736b4a5..7169a0ec41d8 100644
--- a/Documentation/arm64/sve.txt
+++ b/Documentation/arm64/sve.txt
@@ -200,7 +200,7 @@ prctl(PR_SVE_SET_VL, unsigned long arg)
      thread.
    * Changing the vector length causes all of P0..P15, FFR and all bits of
-      Z0..V31 except for Z0 bits [127:0] .. Z31 bits [127:0] to become
+      Z0..Z31 except for Z0 bits [127:0] .. Z31 bits [127:0] to become
      unspecified.  Calling PR_SVE_SET_VL with vl equal to the thread's current
      vector length, or calling PR_SVE_SET_VL with the PR_SVE_SET_VL_ONEXEC
      flag, does not constitute a change to the vector length for this purpose.
@@ -500,7 +500,7 @@ References
 [2] arch/arm64/include/uapi/asm/ptrace.h
    AArch64 Linux ptrace ABI definitions
-[3] linux/Documentation/arm64/cpu-feature-registers.txt
+[3] Documentation/arm64/cpu-feature-registers.txt
 [4] ARM IHI0055C
    http://infocenter.arm.com/help/topic/com.arm.doc.ihi0055c/IHI0055C_beta_aapcs64.pdf
diff --git a/Documentation/devicetree/bindings/interrupt-controller/riscv,cpu-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/riscv,cpu-intc.txt
index b0a8af51c388..265b223cd978 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/riscv,cpu-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/riscv,cpu-intc.txt
@@ -11,7 +11,7 @@ The RISC-V supervisor ISA manual specifies three interrupt sources that are
 attached to every HLIC: software interrupts, the timer interrupt, and external
 interrupts.  Software interrupts are used to send IPIs between cores.  The
 timer interrupt comes from an architecturally mandated real-time timer that is
-controller via Supervisor Binary Interface (SBI) calls and CSR reads.  External
+controlled via Supervisor Binary Interface (SBI) calls and CSR reads.  External
 interrupts connect all other device interrupts to the HLIC, which are routed
 via the platform-level interrupt controller (PLIC).
@@ -25,7 +25,15 @@ in the system.
 Required properties:
 - compatible : "riscv,cpu-intc"
- #interrupt-cells : should be <1>
+- #interrupt-cells : should be <1>.  The interrupt sources are defined by the
+  RISC-V supervisor ISA manual, with only the following three interrupts being
+  defined for supervisor mode:
+    - Source 1 is the supervisor software interrupt, which can be sent by an SBI
+      call and is reserved for use by software.
+    - Source 5 is the supervisor timer interrupt, which can be configured by
+      SBI calls and implements a one-shot timer.
+    - Source 9 is the supervisor external interrupt, which chains to all other
+      device interrupts.
 - interrupt-controller : Identifies the node as an interrupt controller
 Furthermore, this interrupt-controller MUST be embedded inside the cpu
@@ -38,7 +46,7 @@ An example device tree entry for a HLIC is show below.
                ...
                cpu1-intc: interrupt-controller {
                        #interrupt-cells = <1>;
-                        compatible = "riscv,cpu-intc", "sifive,fu540-c000-cpu-intc";
+                        compatible = "sifive,fu540-c000-cpu-intc", "riscv,cpu-intc";
                        interrupt-controller;
                };
        };
diff --git a/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt b/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
index 5d47a262474c..9407212a85a8 100644
--- a/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt
@@ -7,6 +7,7 @@ Required properties:
               Examples with soctypes are:
                 - "renesas,r8a7743-wdt" (RZ/G1M)
                 - "renesas,r8a7745-wdt" (RZ/G1E)
+                 - "renesas,r8a774a1-wdt" (RZ/G2M)
                 - "renesas,r8a7790-wdt" (R-Car H2)
                 - "renesas,r8a7791-wdt" (R-Car M2-W)
                 - "renesas,r8a7792-wdt" (R-Car V2H)
@@ -21,8 +22,8 @@ Required properties:
                 - "renesas,r7s72100-wdt" (RZ/A1)
                The generic compatible string must be:
                 - "renesas,rza-wdt" for RZ/A
-                 - "renesas,rcar-gen2-wdt" for R-Car Gen2 and RZ/G
+                 - "renesas,rcar-gen2-wdt" for R-Car Gen2 and RZ/G1
-                 - "renesas,rcar-gen3-wdt" for R-Car Gen3
+                 - "renesas,rcar-gen3-wdt" for R-Car Gen3 and RZ/G2
 - reg : Should contain WDT registers location and length
 - clocks : the clock feeding the watchdog timer.
diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx
index 72d16f08e431..b8df81f6d6bc 100644
--- a/Documentation/hwmon/ina2xx
+++ b/Documentation/hwmon/ina2xx
@@ -32,7 +32,7 @@ Supported chips:
    Datasheet: Publicly available at the Texas Instruments website
               http://www.ti.com/
-Author: Lothar Felten <l-felten@ti.com>
+Author: Lothar Felten <lothar.felten@gmail.com>
 Description
 -----------
diff --git a/Documentation/i2c/DMA-considerations b/Documentation/i2c/DMA-considerations
index 966610aa4620..203002054120 100644
--- a/Documentation/i2c/DMA-considerations
+++ b/Documentation/i2c/DMA-considerations
@@ -50,10 +50,14 @@ bounce buffer. But you don't need to care about that detail, just use the
 returned buffer. If NULL is returned, the threshold was not met or a bounce
 buffer could not be allocated. Fall back to PIO in that case.
-In any case, a buffer obtained from above needs to be released. It ensures data
+In any case, a buffer obtained from above needs to be released. Another helper
-is copied back to the message and a potentially used bounce buffer is freed::
+function ensures a potentially used bounce buffer is freed::
-        i2c_release_dma_safe_msg_buf(msg, dma_buf);
+        i2c_put_dma_safe_msg_buf(dma_buf, msg, xferred);
+The last argument 'xferred' controls if the buffer is synced back to the
+message or not. No syncing is needed in cases setting up DMA had an error and
+there was no data transferred.
 The bounce buffer handling from the core is generic and simple. It will always
 allocate a new bounce buffer. If you want a more sophisticated handling (e.g.
diff --git a/MAINTAINERS b/MAINTAINERS
index a5b256b25905..9ad052aeac39 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8255,9 +8255,9 @@ F:	drivers/ata/pata_arasan_cf.c
 LIBATA PATA DRIVERS
 M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-M:      Jens Axboe <kernel.dk>
+M:      Jens Axboe <axboe@kernel.dk>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      drivers/ata/pata_*.c
 F:      drivers/ata/ata_generic.c
@@ -8275,7 +8275,7 @@ LIBATA SATA AHCI PLATFORM devices support
 M:      Hans de Goede <hdegoede@redhat.com>
 M:      Jens Axboe <axboe@kernel.dk>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      drivers/ata/ahci_platform.c
 F:      drivers/ata/libahci_platform.c
@@ -8291,7 +8291,7 @@ F:	drivers/ata/sata_promise.*
 LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)
 M:      Jens Axboe <axboe@kernel.dk>
 L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
 S:      Maintained
 F:      drivers/ata/
 F:      include/linux/ata.h
diff --git a/Makefile b/Makefile
index 2b458801ba74..19948e556941 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Merciless Moray
 # *DOCUMENTATION*
@@ -807,6 +807,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
 # disable pointer signed / unsigned warnings in gcc 4.0
 KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+# disable stringop warnings in gcc 8+
+KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS   += $(call cc-option,-fno-strict-overflow)
diff --git a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
index 4d969013f99a..4d969013f99a 100755..100644
--- a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
+++ b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index f0cbd86312dc..d4b7c59eec68 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -469,6 +469,7 @@
                        ti,hwmods = "rtc";
                        clocks = <&clk_32768_ck>;
                        clock-names = "int-clk";
+                        system-power-controller;
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
index 9fb47724b9c1..ad2ae25b7b4d 100644
--- a/arch/arm/boot/dts/imx23-evk.dts
+++ b/arch/arm/boot/dts/imx23-evk.dts
@@ -13,6 +13,43 @@
                reg = <0x40000000 0x08000000>;
        };
+        reg_vddio_sd0: regulator-vddio-sd0 {
+                compatible = "regulator-fixed";
+                regulator-name = "vddio-sd0";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio1 29 0>;
+        };
+        reg_lcd_3v3: regulator-lcd-3v3 {
+                compatible = "regulator-fixed";
+                regulator-name = "lcd-3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio1 18 0>;
+                enable-active-high;
+        };
+        reg_lcd_5v: regulator-lcd-5v {
+                compatible = "regulator-fixed";
+                regulator-name = "lcd-5v";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+        };
+        panel {
+                compatible = "sii,43wvf1g";
+                backlight = <&backlight_display>;
+                dvdd-supply = <&reg_lcd_3v3>;
+                avdd-supply = <&reg_lcd_5v>;
+                port {
+                        panel_in: endpoint {
+                                remote-endpoint = <&display_out>;
+                        };
+                };
+        };
        apb@80000000 {
                apbh@80000000 {
                        gpmi-nand@8000c000 {
@@ -52,31 +89,11 @@
                        lcdif@80030000 {
                                pinctrl-names = "default";
                                pinctrl-0 = <&lcdif_24bit_pins_a>;
-                                lcd-supply = <&reg_lcd_3v3>;
-                                display = <&display0>;
                                status = "okay";
-                                display0: display0 {
+                                port {
-                                        bits-per-pixel = <32>;
+                                        display_out: endpoint {
-                                        bus-width = <24>;
+                                                remote-endpoint = <&panel_in>;
-                                        display-timings {
-                                                native-mode = <&timing0>;
-                                                timing0: timing0 {
-                                                        clock-frequency = <9200000>;
-                                                        hactive = <480>;
-                                                        vactive = <272>;
-                                                        hback-porch = <15>;
-                                                        hfront-porch = <8>;
-                                                        vback-porch = <12>;
-                                                        vfront-porch = <4>;
-                                                        hsync-len = <1>;
-                                                        vsync-len = <1>;
-                                                        hsync-active = <0>;
-                                                        vsync-active = <0>;
-                                                        de-active = <1>;
-                                                        pixelclk-active = <0>;
-                                                };
                                        };
                                };
                        };
@@ -118,32 +135,7 @@
                };
        };
-        regulators {
+        backlight_display: backlight {
-                compatible = "simple-bus";
-                #address-cells = <1>;
-                #size-cells = <0>;
-                reg_vddio_sd0: regulator@0 {
-                        compatible = "regulator-fixed";
-                        reg = <0>;
-                        regulator-name = "vddio-sd0";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio1 29 0>;
-                };
-                reg_lcd_3v3: regulator@1 {
-                        compatible = "regulator-fixed";
-                        reg = <1>;
-                        regulator-name = "lcd-3v3";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio1 18 0>;
-                        enable-active-high;
-                };
-        };
-        backlight {
                compatible = "pwm-backlight";
                pwms = <&pwm 2 5000000>;
                brightness-levels = <0 4 8 16 32 64 128 255>;
diff --git a/arch/arm/boot/dts/imx28-evk.dts b/arch/arm/boot/dts/imx28-evk.dts
index 6b0ae667640f..93ab5bdfe068 100644
--- a/arch/arm/boot/dts/imx28-evk.dts
+++ b/arch/arm/boot/dts/imx28-evk.dts
@@ -13,6 +13,87 @@
                reg = <0x40000000 0x08000000>;
        };
+        reg_3p3v: regulator-3p3v {
+                compatible = "regulator-fixed";
+                regulator-name = "3P3V";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                regulator-always-on;
+        };
+        reg_vddio_sd0: regulator-vddio-sd0 {
+                compatible = "regulator-fixed";
+                regulator-name = "vddio-sd0";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio3 28 0>;
+        };
+        reg_fec_3v3: regulator-fec-3v3 {
+                compatible = "regulator-fixed";
+                regulator-name = "fec-3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio2 15 0>;
+        };
+        reg_usb0_vbus: regulator-usb0-vbus {
+                compatible = "regulator-fixed";
+                regulator-name = "usb0_vbus";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                gpio = <&gpio3 9 0>;
+                enable-active-high;
+        };
+        reg_usb1_vbus: regulator-usb1-vbus {
+                compatible = "regulator-fixed";
+                regulator-name = "usb1_vbus";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                gpio = <&gpio3 8 0>;
+                enable-active-high;
+        };
+        reg_lcd_3v3: regulator-lcd-3v3 {
+                compatible = "regulator-fixed";
+                regulator-name = "lcd-3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio3 30 0>;
+                enable-active-high;
+        };
+        reg_can_3v3: regulator-can-3v3 {
+                compatible = "regulator-fixed";
+                regulator-name = "can-3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                gpio = <&gpio2 13 0>;
+                enable-active-high;
+        };
+        reg_lcd_5v: regulator-lcd-5v {
+                compatible = "regulator-fixed";
+                regulator-name = "lcd-5v";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+        };
+        panel {
+                compatible = "sii,43wvf1g";
+                backlight = <&backlight_display>;
+                dvdd-supply = <&reg_lcd_3v3>;
+                avdd-supply = <&reg_lcd_5v>;
+                port {
+                        panel_in: endpoint {
+                                remote-endpoint = <&display_out>;
+                        };
+                };
+        };
        apb@80000000 {
                apbh@80000000 {
                        gpmi-nand@8000c000 {
@@ -116,31 +197,11 @@
                                pinctrl-names = "default";
                                pinctrl-0 = <&lcdif_24bit_pins_a
                                             &lcdif_pins_evk>;
-                                lcd-supply = <&reg_lcd_3v3>;
-                                display = <&display0>;
                                status = "okay";
-                                display0: display0 {
+                                port {
-                                        bits-per-pixel = <32>;
+                                        display_out: endpoint {
-                                        bus-width = <24>;
+                                                remote-endpoint = <&panel_in>;
-                                        display-timings {
-                                                native-mode = <&timing0>;
-                                                timing0: timing0 {
-                                                        clock-frequency = <33500000>;
-                                                        hactive = <800>;
-                                                        vactive = <480>;
-                                                        hback-porch = <89>;
-                                                        hfront-porch = <164>;
-                                                        vback-porch = <23>;
-                                                        vfront-porch = <10>;
-                                                        hsync-len = <10>;
-                                                        vsync-len = <10>;
-                                                        hsync-active = <0>;
-                                                        vsync-active = <0>;
-                                                        de-active = <1>;
-                                                        pixelclk-active = <0>;
-                                                };
                                        };
                                };
                        };
@@ -269,80 +330,6 @@
                };
        };
-        regulators {
-                compatible = "simple-bus";
-                #address-cells = <1>;
-                #size-cells = <0>;
-                reg_3p3v: regulator@0 {
-                        compatible = "regulator-fixed";
-                        reg = <0>;
-                        regulator-name = "3P3V";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        regulator-always-on;
-                };
-                reg_vddio_sd0: regulator@1 {
-                        compatible = "regulator-fixed";
-                        reg = <1>;
-                        regulator-name = "vddio-sd0";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio3 28 0>;
-                };
-                reg_fec_3v3: regulator@2 {
-                        compatible = "regulator-fixed";
-                        reg = <2>;
-                        regulator-name = "fec-3v3";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio2 15 0>;
-                };
-                reg_usb0_vbus: regulator@3 {
-                        compatible = "regulator-fixed";
-                        reg = <3>;
-                        regulator-name = "usb0_vbus";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        gpio = <&gpio3 9 0>;
-                        enable-active-high;
-                };
-                reg_usb1_vbus: regulator@4 {
-                        compatible = "regulator-fixed";
-                        reg = <4>;
-                        regulator-name = "usb1_vbus";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        gpio = <&gpio3 8 0>;
-                        enable-active-high;
-                };
-                reg_lcd_3v3: regulator@5 {
-                        compatible = "regulator-fixed";
-                        reg = <5>;
-                        regulator-name = "lcd-3v3";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio3 30 0>;
-                        enable-active-high;
-                };
-                reg_can_3v3: regulator@6 {
-                        compatible = "regulator-fixed";
-                        reg = <6>;
-                        regulator-name = "can-3v3";
-                        regulator-min-microvolt = <3300000>;
-                        regulator-max-microvolt = <3300000>;
-                        gpio = <&gpio2 13 0>;
-                        enable-active-high;
-                };
-        };
        sound {
                compatible = "fsl,imx28-evk-sgtl5000",
                             "fsl,mxs-audio-sgtl5000";
@@ -363,7 +350,7 @@
                };
        };
-        backlight {
+        backlight_display: backlight {
                compatible = "pwm-backlight";
                pwms = <&pwm 2 5000000>;
                brightness-levels = <0 4 8 16 32 64 128 255>;
diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi
index 7cbc2ffa4b3a..7234e8330a57 100644
--- a/arch/arm/boot/dts/imx7d.dtsi
+++ b/arch/arm/boot/dts/imx7d.dtsi
@@ -126,10 +126,14 @@
                interrupt-names = "msi";
                #interrupt-cells = <1>;
                interrupt-map-mask = <0 0 0 0x7>;
-                interrupt-map = <0 0 0 1 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+                /*
-                                <0 0 0 2 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+                 * Reference manual lists pci irqs incorrectly
-                                <0 0 0 3 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+                 * Real hardware ordering is same as imx6: D+MSI, C, B, A
-                                <0 0 0 4 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
+                 */
+                interrupt-map = <0 0 0 1 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 2 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 3 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 4 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clks IMX7D_PCIE_CTRL_ROOT_CLK>,
                         <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>,
                         <&clks IMX7D_PCIE_PHY_ROOT_CLK>;
diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
index 12d6822f0057..04758a2a87f0 100644
--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
+++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
@@ -354,7 +354,7 @@
 &mmc2 {
        vmmc-supply = <&vsdio>;
        bus-width = <8>;
-        non-removable;
+        ti,non-removable;
 };
 &mmc3 {
@@ -621,15 +621,6 @@
                OMAP4_IOPAD(0x10c, PIN_INPUT | MUX_MODE1)       /* abe_mcbsp3_fsx */
                >;
        };
-};
-&omap4_pmx_wkup {
-        usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
-                /* gpio_wk0 */
-                pinctrl-single,pins = <
-                OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
-                >;
-        };
        vibrator_direction_pin: pinmux_vibrator_direction_pin {
                pinctrl-single,pins = <
@@ -644,6 +635,15 @@
        };
 };
+&omap4_pmx_wkup {
+        usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
+                /* gpio_wk0 */
+                pinctrl-single,pins = <
+                OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
+                >;
+        };
+};
 /*
 * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for
 * uart1 wakeirq.
diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
index e2c127608bcc..7eca43ff69bb 100644
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -257,6 +257,7 @@ CONFIG_IMX_IPUV3_CORE=y
 CONFIG_DRM=y
 CONFIG_DRM_PANEL_LVDS=y
 CONFIG_DRM_PANEL_SIMPLE=y
+CONFIG_DRM_PANEL_SEIKO_43WVF1G=y
 CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
 CONFIG_DRM_DW_HDMI_CEC=y
 CONFIG_DRM_IMX=y
diff --git a/arch/arm/configs/mxs_defconfig b/arch/arm/configs/mxs_defconfig
index 148226e36152..7b8212857535 100644
--- a/arch/arm/configs/mxs_defconfig
+++ b/arch/arm/configs/mxs_defconfig
@@ -95,6 +95,7 @@ CONFIG_MFD_MXS_LRADC=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_DRM=y
+CONFIG_DRM_PANEL_SEIKO_43WVF1G=y
 CONFIG_DRM_MXSFB=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
diff --git a/arch/arm/configs/versatile_defconfig b/arch/arm/configs/versatile_defconfig
index df68dc4056e5..5282324c7cef 100644
--- a/arch/arm/configs/versatile_defconfig
+++ b/arch/arm/configs/versatile_defconfig
@@ -5,19 +5,19 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_PARTITION_ADVANCED=y
 # CONFIG_ARCH_MULTI_V7 is not set
 CONFIG_ARCH_VERSATILE=y
 CONFIG_AEABI=y
 CONFIG_OABI_COMPAT=y
-CONFIG_CMA=y
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_CMDLINE="root=1f03 mem=32M"
 CONFIG_FPE_NWFPE=y
 CONFIG_VFP=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_CMA=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -59,6 +59,7 @@ CONFIG_GPIO_PL061=y
 CONFIG_DRM=y
 CONFIG_DRM_PANEL_ARM_VERSATILE=y
 CONFIG_DRM_PANEL_SIMPLE=y
+CONFIG_DRM_DUMB_VGA_DAC=y
 CONFIG_DRM_PL111=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
@@ -89,9 +90,10 @@ CONFIG_NFSD=y
 CONFIG_NFSD_V3=y
 CONFIG_NLS_CODEPAGE_850=m
 CONFIG_NLS_ISO8859_1=m
+CONFIG_FONTS=y
+CONFIG_FONT_ACORN_8x8=y
+CONFIG_DEBUG_FS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_USER=y
 CONFIG_DEBUG_LL=y
-CONFIG_FONTS=y
-CONFIG_FONT_ACORN_8x8=y
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 2ceffd85dd3d..cd65ea4e9c54 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2161,6 +2161,37 @@ static int of_dev_hwmod_lookup(struct device_node *np,
 }
 /**
+ * omap_hwmod_fix_mpu_rt_idx - fix up mpu_rt_idx register offsets
+ *
+ * @oh: struct omap_hwmod *
+ * @np: struct device_node *
+ *
+ * Fix up module register offsets for modules with mpu_rt_idx.
+ * Only needed for cpsw with interconnect target module defined
+ * in device tree while still using legacy hwmod platform data
+ * for rev, sysc and syss registers.
+ *
+ * Can be removed when all cpsw hwmod platform data has been
+ * dropped.
+ */
+static void omap_hwmod_fix_mpu_rt_idx(struct omap_hwmod *oh,
+                                      struct device_node *np,
+                                      struct resource *res)
+{
+        struct device_node *child = NULL;
+        int error;
+        child = of_get_next_child(np, child);
+        if (!child)
+                return;
+        error = of_address_to_resource(child, oh->mpu_rt_idx, res);
+        if (error)
+                pr_err("%s: error mapping mpu_rt_idx: %i\n",
+                       __func__, error);
+}
+/**
 * omap_hwmod_parse_module_range - map module IO range from device tree
 * @oh: struct omap_hwmod *
 * @np: struct device_node *
@@ -2220,7 +2251,13 @@ int omap_hwmod_parse_module_range(struct omap_hwmod *oh,
        size = be32_to_cpup(ranges);
        pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n",
-                 oh->name, np->name, base, size);
+                 oh ? oh->name : "", np->name, base, size);
+        if (oh && oh->mpu_rt_idx) {
+                omap_hwmod_fix_mpu_rt_idx(oh, np, res);
+                return 0;
+        }
        res->start = base;
        res->end = base + size - 1;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 29e75b47becd..1b1a0e95c751 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -763,7 +763,6 @@ config NEED_PER_CPU_EMBED_FIRST_CHUNK
 config HOLES_IN_ZONE
        def_bool y
-        depends on NUMA
 source kernel/Kconfig.hz
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index f67e8d5e93ad..db8d364f8476 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -38,6 +38,7 @@ CONFIG_ARCH_BCM_IPROC=y
 CONFIG_ARCH_BERLIN=y
 CONFIG_ARCH_BRCMSTB=y
 CONFIG_ARCH_EXYNOS=y
+CONFIG_ARCH_K3=y
 CONFIG_ARCH_LAYERSCAPE=y
 CONFIG_ARCH_LG1K=y
 CONFIG_ARCH_HISI=y
@@ -605,6 +606,8 @@ CONFIG_ARCH_TEGRA_132_SOC=y
 CONFIG_ARCH_TEGRA_210_SOC=y
 CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_ARCH_TEGRA_194_SOC=y
+CONFIG_ARCH_K3_AM6_SOC=y
+CONFIG_SOC_TI=y
 CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_EXTCON_USBC_CROS_EC=y
diff --git a/arch/arm64/crypto/ghash-ce-glue.c b/arch/arm64/crypto/ghash-ce-glue.c
index 6e9f33d14930..067d8937d5af 100644
--- a/arch/arm64/crypto/ghash-ce-glue.c
+++ b/arch/arm64/crypto/ghash-ce-glue.c
@@ -417,7 +417,7 @@ static int gcm_encrypt(struct aead_request *req)
                __aes_arm64_encrypt(ctx->aes_key.key_enc, tag, iv, nrounds);
                put_unaligned_be32(2, iv + GCM_IV_SIZE);
-                while (walk.nbytes >= AES_BLOCK_SIZE) {
+                while (walk.nbytes >= (2 * AES_BLOCK_SIZE)) {
                        int blocks = walk.nbytes / AES_BLOCK_SIZE;
                        u8 *dst = walk.dst.virt.addr;
                        u8 *src = walk.src.virt.addr;
@@ -437,11 +437,18 @@ static int gcm_encrypt(struct aead_request *req)
                                        NULL);
                        err = skcipher_walk_done(&walk,
-                                                 walk.nbytes % AES_BLOCK_SIZE);
+                                                 walk.nbytes % (2 * AES_BLOCK_SIZE));
                }
-                if (walk.nbytes)
+                if (walk.nbytes) {
                        __aes_arm64_encrypt(ctx->aes_key.key_enc, ks, iv,
                                            nrounds);
+                        if (walk.nbytes > AES_BLOCK_SIZE) {
+                                crypto_inc(iv, AES_BLOCK_SIZE);
+                                __aes_arm64_encrypt(ctx->aes_key.key_enc,
+                                                    ks + AES_BLOCK_SIZE, iv,
+                                                    nrounds);
+                        }
+                }
        }
        /* handle the tail */
@@ -545,7 +552,7 @@ static int gcm_decrypt(struct aead_request *req)
                __aes_arm64_encrypt(ctx->aes_key.key_enc, tag, iv, nrounds);
                put_unaligned_be32(2, iv + GCM_IV_SIZE);
-                while (walk.nbytes >= AES_BLOCK_SIZE) {
+                while (walk.nbytes >= (2 * AES_BLOCK_SIZE)) {
                        int blocks = walk.nbytes / AES_BLOCK_SIZE;
                        u8 *dst = walk.dst.virt.addr;
                        u8 *src = walk.src.virt.addr;
@@ -564,11 +571,21 @@ static int gcm_decrypt(struct aead_request *req)
                        } while (--blocks > 0);
                        err = skcipher_walk_done(&walk,
-                                                 walk.nbytes % AES_BLOCK_SIZE);
+                                                 walk.nbytes % (2 * AES_BLOCK_SIZE));
                }
-                if (walk.nbytes)
+                if (walk.nbytes) {
+                        if (walk.nbytes > AES_BLOCK_SIZE) {
+                                u8 *iv2 = iv + AES_BLOCK_SIZE;
+                                memcpy(iv2, iv, AES_BLOCK_SIZE);
+                                crypto_inc(iv2, AES_BLOCK_SIZE);
+                                __aes_arm64_encrypt(ctx->aes_key.key_enc, iv2,
+                                                    iv2, nrounds);
+                        }
                        __aes_arm64_encrypt(ctx->aes_key.key_enc, iv, iv,
                                            nrounds);
+                }
        }
        /* handle the tail */
diff --git a/arch/arm64/crypto/sm4-ce-glue.c b/arch/arm64/crypto/sm4-ce-glue.c
index b7fb5274b250..0c4fc223f225 100644
--- a/arch/arm64/crypto/sm4-ce-glue.c
+++ b/arch/arm64/crypto/sm4-ce-glue.c
@@ -69,5 +69,5 @@ static void __exit sm4_ce_mod_fini(void)
        crypto_unregister_alg(&sm4_ce_alg);
 }
-module_cpu_feature_match(SM3, sm4_ce_mod_init);
+module_cpu_feature_match(SM4, sm4_ce_mod_init);
 module_exit(sm4_ce_mod_fini);
diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c
index 3534aa6a4dc2..1b083c500b9a 100644
--- a/arch/m68k/mac/misc.c
+++ b/arch/m68k/mac/misc.c
@@ -98,11 +98,10 @@ static time64_t pmu_read_time(void)
        if (pmu_request(&req, NULL, 1, PMU_READ_RTC) < 0)
                return 0;
-        while (!req.complete)
+        pmu_wait_complete(&req);
-                pmu_poll();
-        time = (u32)((req.reply[1] << 24) | (req.reply[2] << 16) |
+        time = (u32)((req.reply[0] << 24) | (req.reply[1] << 16) |
-                     (req.reply[3] << 8) | req.reply[4]);
+                     (req.reply[2] << 8) | req.reply[3]);
        return time - RTC_OFFSET;
 }
@@ -116,8 +115,7 @@ static void pmu_write_time(time64_t time)
                        (data >> 24) & 0xFF, (data >> 16) & 0xFF,
                        (data >> 8) & 0xFF, data & 0xFF) < 0)
                return;
-        while (!req.complete)
+        pmu_wait_complete(&req);
-                pmu_poll();
 }
 static __u8 pmu_read_pram(int offset)
diff --git a/arch/nios2/Kconfig.debug b/arch/nios2/Kconfig.debug
index 7a49f0d28d14..f1da8a7b17ff 100644
--- a/arch/nios2/Kconfig.debug
+++ b/arch/nios2/Kconfig.debug
@@ -3,15 +3,6 @@
 config TRACE_IRQFLAGS_SUPPORT
        def_bool y
-config DEBUG_STACK_USAGE
-        bool "Enable stack utilization instrumentation"
-        depends on DEBUG_KERNEL
-        help
-          Enables the display of the minimum amount of free stack which each
-          task has ever had available in the sysrq-T and sysrq-P debug output.
-          This option will slow down process creation somewhat.
 config EARLY_PRINTK
        bool "Activate early kernel debugging"
        default y
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index db0b6eebbfa5..a80669209155 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -177,7 +177,6 @@ config PPC
        select HAVE_ARCH_KGDB
        select HAVE_ARCH_MMAP_RND_BITS
        select HAVE_ARCH_MMAP_RND_COMPAT_BITS   if COMPAT
-        select HAVE_ARCH_PREL32_RELOCATIONS
        select HAVE_ARCH_SECCOMP_FILTER
        select HAVE_ARCH_TRACEHOOK
        select HAVE_CBPF_JIT                    if !PPC64
diff --git a/arch/riscv/include/asm/tlb.h b/arch/riscv/include/asm/tlb.h
index c229509288ea..439dc7072e05 100644
--- a/arch/riscv/include/asm/tlb.h
+++ b/arch/riscv/include/asm/tlb.h
@@ -14,6 +14,10 @@
 #ifndef _ASM_RISCV_TLB_H
 #define _ASM_RISCV_TLB_H
+struct mmu_gather;
+static void tlb_flush(struct mmu_gather *tlb);
 #include <asm-generic/tlb.h>
 static inline void tlb_flush(struct mmu_gather *tlb)
diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index 568026ccf6e8..fb03a4482ad6 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -65,24 +65,11 @@ SYSCALL_DEFINE6(mmap2, unsigned long, addr, unsigned long, len,
 SYSCALL_DEFINE3(riscv_flush_icache, uintptr_t, start, uintptr_t, end,
        uintptr_t, flags)
 {
-#ifdef CONFIG_SMP
-        struct mm_struct *mm = current->mm;
-        bool local = (flags & SYS_RISCV_FLUSH_ICACHE_LOCAL) != 0;
-#endif
        /* Check the reserved flags. */
        if (unlikely(flags & ~SYS_RISCV_FLUSH_ICACHE_ALL))
                return -EINVAL;
-        /*
+        flush_icache_mm(current->mm, flags & SYS_RISCV_FLUSH_ICACHE_LOCAL);
-         * Without CONFIG_SMP flush_icache_mm is a just a flush_icache_all(),
-         * which generates unused variable warnings all over this function.
-         */
-#ifdef CONFIG_SMP
-        flush_icache_mm(mm, local);
-#else
-        flush_icache_all();
-#endif
        return 0;
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c5ff296bc5d1..1a0be022f91d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2843,7 +2843,7 @@ config X86_SYSFB
          This option, if enabled, marks VGA/VBE/EFI framebuffers as generic
          framebuffers so the new generic system-framebuffer drivers can be
          used on x86. If the framebuffer is not compatible with the generic
-          modes, it is adverticed as fallback platform framebuffer so legacy
+          modes, it is advertised as fallback platform framebuffer so legacy
          drivers like efifb, vesafb and uvesafb can pick it up.
          If this option is not selected, all system framebuffers are always
          marked as fallback platform framebuffers as usual.
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 94859241bc3e..8f6e7eb8ae9f 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -175,22 +175,6 @@ ifdef CONFIG_FUNCTION_GRAPH_TRACER
  endif
 endif
-ifndef CC_HAVE_ASM_GOTO
-  $(error Compiler lacks asm-goto support.)
-endif
-#
-# Jump labels need '-maccumulate-outgoing-args' for gcc < 4.5.2 to prevent a
-# GCC bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=46226).  There's no way
-# to test for this bug at compile-time because the test case needs to execute,
-# which is a no-go for cross compilers.  So check the GCC version instead.
-#
-ifdef CONFIG_JUMP_LABEL
-  ifneq ($(ACCUMULATE_OUTGOING_ARGS), 1)
-        ACCUMULATE_OUTGOING_ARGS = $(call cc-if-fullversion, -lt, 040502, 1)
-  endif
-endif
 ifeq ($(ACCUMULATE_OUTGOING_ARGS), 1)
        # This compiler flag is not supported by Clang:
        KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args,)
@@ -312,6 +296,13 @@ PHONY += vdso_install
 vdso_install:
        $(Q)$(MAKE) $(build)=arch/x86/entry/vdso $@
+archprepare: checkbin
+checkbin:
+ifndef CC_HAVE_ASM_GOTO
+        @echo Compiler lacks asm-goto support.
+        @exit 1
+endif
 archclean:
        $(Q)rm -rf $(objtree)/arch/i386
        $(Q)rm -rf $(objtree)/arch/x86_64
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index 9bd139569b41..cb2deb61c5d9 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -223,34 +223,34 @@ ALL_F:      .octa 0xffffffffffffffffffffffffffffffff
        pcmpeqd TWOONE(%rip), \TMP2
        pand    POLY(%rip), \TMP2
        pxor    \TMP2, \TMP3
-        movdqa  \TMP3, HashKey(%arg2)
+        movdqu  \TMP3, HashKey(%arg2)
        movdqa     \TMP3, \TMP5
        pshufd     $78, \TMP3, \TMP1
        pxor       \TMP3, \TMP1
-        movdqa     \TMP1, HashKey_k(%arg2)
+        movdqu     \TMP1, HashKey_k(%arg2)
        GHASH_MUL  \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
 # TMP5 = HashKey^2<<1 (mod poly)
-        movdqa     \TMP5, HashKey_2(%arg2)
+        movdqu     \TMP5, HashKey_2(%arg2)
 # HashKey_2 = HashKey^2<<1 (mod poly)
        pshufd     $78, \TMP5, \TMP1
        pxor       \TMP5, \TMP1
-        movdqa     \TMP1, HashKey_2_k(%arg2)
+        movdqu     \TMP1, HashKey_2_k(%arg2)
        GHASH_MUL  \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
 # TMP5 = HashKey^3<<1 (mod poly)
-        movdqa     \TMP5, HashKey_3(%arg2)
+        movdqu     \TMP5, HashKey_3(%arg2)
        pshufd     $78, \TMP5, \TMP1
        pxor       \TMP5, \TMP1
-        movdqa     \TMP1, HashKey_3_k(%arg2)
+        movdqu     \TMP1, HashKey_3_k(%arg2)
        GHASH_MUL  \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
 # TMP5 = HashKey^3<<1 (mod poly)
-        movdqa     \TMP5, HashKey_4(%arg2)
+        movdqu     \TMP5, HashKey_4(%arg2)
        pshufd     $78, \TMP5, \TMP1
        pxor       \TMP5, \TMP1
-        movdqa     \TMP1, HashKey_4_k(%arg2)
+        movdqu     \TMP1, HashKey_4_k(%arg2)
 .endm
 # GCM_INIT initializes a gcm_context struct to prepare for encoding/decoding.
@@ -271,7 +271,7 @@ ALL_F:      .octa 0xffffffffffffffffffffffffffffffff
        movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv
        PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
-        movdqa HashKey(%arg2), %xmm13
+        movdqu HashKey(%arg2), %xmm13
        CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \
        %xmm4, %xmm5, %xmm6
@@ -997,7 +997,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        pshufd    $78, \XMM5, \TMP6
        pxor      \XMM5, \TMP6
        paddd     ONE(%rip), \XMM0              # INCR CNT
-        movdqa    HashKey_4(%arg2), \TMP5
+        movdqu    HashKey_4(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP4           # TMP4 = a1*b1
        movdqa    \XMM0, \XMM1
        paddd     ONE(%rip), \XMM0              # INCR CNT
@@ -1016,7 +1016,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        pxor      (%arg1), \XMM2
        pxor      (%arg1), \XMM3
        pxor      (%arg1), \XMM4
-        movdqa    HashKey_4_k(%arg2), \TMP5
+        movdqu    HashKey_4_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP6           # TMP6 = (a1+a0)*(b1+b0)
        movaps 0x10(%arg1), \TMP1
        AESENC    \TMP1, \XMM1              # Round 1
@@ -1031,7 +1031,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM6, \TMP1
        pshufd    $78, \XMM6, \TMP2
        pxor      \XMM6, \TMP2
-        movdqa    HashKey_3(%arg2), \TMP5
+        movdqu    HashKey_3(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1           # TMP1 = a1 * b1
        movaps 0x30(%arg1), \TMP3
        AESENC    \TMP3, \XMM1              # Round 3
@@ -1044,7 +1044,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        AESENC    \TMP3, \XMM2
        AESENC    \TMP3, \XMM3
        AESENC    \TMP3, \XMM4
-        movdqa    HashKey_3_k(%arg2), \TMP5
+        movdqu    HashKey_3_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2           # TMP2 = (a1+a0)*(b1+b0)
        movaps 0x50(%arg1), \TMP3
        AESENC    \TMP3, \XMM1              # Round 5
@@ -1058,7 +1058,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM7, \TMP1
        pshufd    $78, \XMM7, \TMP2
        pxor      \XMM7, \TMP2
-        movdqa    HashKey_2(%arg2), \TMP5
+        movdqu    HashKey_2(%arg2), \TMP5
        # Multiply TMP5 * HashKey using karatsuba
@@ -1074,7 +1074,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        AESENC    \TMP3, \XMM2
        AESENC    \TMP3, \XMM3
        AESENC    \TMP3, \XMM4
-        movdqa    HashKey_2_k(%arg2), \TMP5
+        movdqu    HashKey_2_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2           # TMP2 = (a1+a0)*(b1+b0)
        movaps 0x80(%arg1), \TMP3
        AESENC    \TMP3, \XMM1             # Round 8
@@ -1092,7 +1092,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM8, \TMP1
        pshufd    $78, \XMM8, \TMP2
        pxor      \XMM8, \TMP2
-        movdqa    HashKey(%arg2), \TMP5
+        movdqu    HashKey(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1          # TMP1 = a1*b1
        movaps 0x90(%arg1), \TMP3
        AESENC    \TMP3, \XMM1            # Round 9
@@ -1121,7 +1121,7 @@ aes_loop_par_enc_done\@:
        AESENCLAST \TMP3, \XMM2
        AESENCLAST \TMP3, \XMM3
        AESENCLAST \TMP3, \XMM4
-        movdqa    HashKey_k(%arg2), \TMP5
+        movdqu    HashKey_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2          # TMP2 = (a1+a0)*(b1+b0)
        movdqu    (%arg4,%r11,1), \TMP3
        pxor      \TMP3, \XMM1                 # Ciphertext/Plaintext XOR EK
@@ -1205,7 +1205,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        pshufd    $78, \XMM5, \TMP6
        pxor      \XMM5, \TMP6
        paddd     ONE(%rip), \XMM0              # INCR CNT
-        movdqa    HashKey_4(%arg2), \TMP5
+        movdqu    HashKey_4(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP4           # TMP4 = a1*b1
        movdqa    \XMM0, \XMM1
        paddd     ONE(%rip), \XMM0              # INCR CNT
@@ -1224,7 +1224,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        pxor      (%arg1), \XMM2
        pxor      (%arg1), \XMM3
        pxor      (%arg1), \XMM4
-        movdqa    HashKey_4_k(%arg2), \TMP5
+        movdqu    HashKey_4_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP6           # TMP6 = (a1+a0)*(b1+b0)
        movaps 0x10(%arg1), \TMP1
        AESENC    \TMP1, \XMM1              # Round 1
@@ -1239,7 +1239,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM6, \TMP1
        pshufd    $78, \XMM6, \TMP2
        pxor      \XMM6, \TMP2
-        movdqa    HashKey_3(%arg2), \TMP5
+        movdqu    HashKey_3(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1           # TMP1 = a1 * b1
        movaps 0x30(%arg1), \TMP3
        AESENC    \TMP3, \XMM1              # Round 3
@@ -1252,7 +1252,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        AESENC    \TMP3, \XMM2
        AESENC    \TMP3, \XMM3
        AESENC    \TMP3, \XMM4
-        movdqa    HashKey_3_k(%arg2), \TMP5
+        movdqu    HashKey_3_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2           # TMP2 = (a1+a0)*(b1+b0)
        movaps 0x50(%arg1), \TMP3
        AESENC    \TMP3, \XMM1              # Round 5
@@ -1266,7 +1266,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM7, \TMP1
        pshufd    $78, \XMM7, \TMP2
        pxor      \XMM7, \TMP2
-        movdqa    HashKey_2(%arg2), \TMP5
+        movdqu    HashKey_2(%arg2), \TMP5
        # Multiply TMP5 * HashKey using karatsuba
@@ -1282,7 +1282,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        AESENC    \TMP3, \XMM2
        AESENC    \TMP3, \XMM3
        AESENC    \TMP3, \XMM4
-        movdqa    HashKey_2_k(%arg2), \TMP5
+        movdqu    HashKey_2_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2           # TMP2 = (a1+a0)*(b1+b0)
        movaps 0x80(%arg1), \TMP3
        AESENC    \TMP3, \XMM1             # Round 8
@@ -1300,7 +1300,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
        movdqa    \XMM8, \TMP1
        pshufd    $78, \XMM8, \TMP2
        pxor      \XMM8, \TMP2
-        movdqa    HashKey(%arg2), \TMP5
+        movdqu    HashKey(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1          # TMP1 = a1*b1
        movaps 0x90(%arg1), \TMP3
        AESENC    \TMP3, \XMM1            # Round 9
@@ -1329,7 +1329,7 @@ aes_loop_par_dec_done\@:
        AESENCLAST \TMP3, \XMM2
        AESENCLAST \TMP3, \XMM3
        AESENCLAST \TMP3, \XMM4
-        movdqa    HashKey_k(%arg2), \TMP5
+        movdqu    HashKey_k(%arg2), \TMP5
        PCLMULQDQ 0x00, \TMP5, \TMP2          # TMP2 = (a1+a0)*(b1+b0)
        movdqu    (%arg4,%r11,1), \TMP3
        pxor      \TMP3, \XMM1                 # Ciphertext/Plaintext XOR EK
@@ -1405,10 +1405,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
        movdqa    \XMM1, \TMP6
        pshufd    $78, \XMM1, \TMP2
        pxor      \XMM1, \TMP2
-        movdqa    HashKey_4(%arg2), \TMP5
+        movdqu    HashKey_4(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP6       # TMP6 = a1*b1
        PCLMULQDQ 0x00, \TMP5, \XMM1       # XMM1 = a0*b0
-        movdqa    HashKey_4_k(%arg2), \TMP4
+        movdqu    HashKey_4_k(%arg2), \TMP4
        PCLMULQDQ 0x00, \TMP4, \TMP2       # TMP2 = (a1+a0)*(b1+b0)
        movdqa    \XMM1, \XMMDst
        movdqa    \TMP2, \XMM1              # result in TMP6, XMMDst, XMM1
@@ -1418,10 +1418,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
        movdqa    \XMM2, \TMP1
        pshufd    $78, \XMM2, \TMP2
        pxor      \XMM2, \TMP2
-        movdqa    HashKey_3(%arg2), \TMP5
+        movdqu    HashKey_3(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1       # TMP1 = a1*b1
        PCLMULQDQ 0x00, \TMP5, \XMM2       # XMM2 = a0*b0
-        movdqa    HashKey_3_k(%arg2), \TMP4
+        movdqu    HashKey_3_k(%arg2), \TMP4
        PCLMULQDQ 0x00, \TMP4, \TMP2       # TMP2 = (a1+a0)*(b1+b0)
        pxor      \TMP1, \TMP6
        pxor      \XMM2, \XMMDst
@@ -1433,10 +1433,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
        movdqa    \XMM3, \TMP1
        pshufd    $78, \XMM3, \TMP2
        pxor      \XMM3, \TMP2
-        movdqa    HashKey_2(%arg2), \TMP5
+        movdqu    HashKey_2(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1       # TMP1 = a1*b1
        PCLMULQDQ 0x00, \TMP5, \XMM3       # XMM3 = a0*b0
-        movdqa    HashKey_2_k(%arg2), \TMP4
+        movdqu    HashKey_2_k(%arg2), \TMP4
        PCLMULQDQ 0x00, \TMP4, \TMP2       # TMP2 = (a1+a0)*(b1+b0)
        pxor      \TMP1, \TMP6
        pxor      \XMM3, \XMMDst
@@ -1446,10 +1446,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
        movdqa    \XMM4, \TMP1
        pshufd    $78, \XMM4, \TMP2
        pxor      \XMM4, \TMP2
-        movdqa    HashKey(%arg2), \TMP5
+        movdqu    HashKey(%arg2), \TMP5
        PCLMULQDQ 0x11, \TMP5, \TMP1        # TMP1 = a1*b1
        PCLMULQDQ 0x00, \TMP5, \XMM4       # XMM4 = a0*b0
-        movdqa    HashKey_k(%arg2), \TMP4
+        movdqu    HashKey_k(%arg2), \TMP4
        PCLMULQDQ 0x00, \TMP4, \TMP2       # TMP2 = (a1+a0)*(b1+b0)
        pxor      \TMP1, \TMP6
        pxor      \XMM4, \XMMDst
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 5f4829f10129..dfb2f7c0d019 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2465,7 +2465,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
        perf_callchain_store(entry, regs->ip);
-        if (!current->mm)
+        if (!nmi_uaccess_okay())
                return;
        if (perf_callchain_user32(regs, entry))
diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
index c14f2a74b2be..15450a675031 100644
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -33,7 +33,8 @@ extern inline unsigned long native_save_fl(void)
        return flags;
 }
-static inline void native_restore_fl(unsigned long flags)
+extern inline void native_restore_fl(unsigned long flags);
+extern inline void native_restore_fl(unsigned long flags)
 {
        asm volatile("push %0 ; popf"
                     : /* no output */
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index a564084c6141..f8b1ad2c3828 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -2,6 +2,8 @@
 #ifndef _ASM_X86_PGTABLE_3LEVEL_H
 #define _ASM_X86_PGTABLE_3LEVEL_H
+#include <asm/atomic64_32.h>
 /*
 * Intel Physical Address Extension (PAE) Mode - three-level page
 * tables on PPro+ CPUs.
@@ -150,10 +152,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
 {
        pte_t res;
-        /* xchg acts as a barrier before the setting of the high bits */
+        res.pte = (pteval_t)arch_atomic64_xchg((atomic64_t *)ptep, 0);
-        res.pte_low = xchg(&ptep->pte_low, 0);
-        res.pte_high = ptep->pte_high;
-        ptep->pte_high = 0;
        return res;
 }
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index c24297268ebc..d53c54b842da 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -132,6 +132,8 @@ struct cpuinfo_x86 {
        /* Index into per_cpu list: */
        u16                     cpu_index;
        u32                     microcode;
+        /* Address space bits used by the cache internally */
+        u8                      x86_cache_bits;
        unsigned                initialized : 1;
 } __randomize_layout;
@@ -183,7 +185,7 @@ extern void cpu_detect(struct cpuinfo_x86 *c);
 static inline unsigned long long l1tf_pfn_limit(void)
 {
-        return BIT_ULL(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT);
+        return BIT_ULL(boot_cpu_data.x86_cache_bits - 1 - PAGE_SHIFT);
 }
 extern void early_cpu_init(void);
diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h
index 5f9012ff52ed..33d3c88a7225 100644
--- a/arch/x86/include/asm/signal.h
+++ b/arch/x86/include/asm/signal.h
@@ -39,6 +39,7 @@ extern void do_signal(struct pt_regs *regs);
 #define __ARCH_HAS_SA_RESTORER
+#include <asm/asm.h>
 #include <uapi/asm/sigcontext.h>
 #ifdef __i386__
@@ -86,9 +87,9 @@ static inline int __const_sigismember(sigset_t *set, int _sig)
 static inline int __gen_sigismember(sigset_t *set, int _sig)
 {
-        unsigned char ret;
+        bool ret;
-        asm("btl %2,%1\n\tsetc %0"
+        asm("btl %2,%1" CC_SET(c)
-            : "=qm"(ret) : "m"(*set), "Ir"(_sig-1) : "cc");
+            : CC_OUT(c) (ret) : "m"(*set), "Ir"(_sig-1));
        return ret;
 }
diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
index b6dc698f992a..f335aad404a4 100644
--- a/arch/x86/include/asm/stacktrace.h
+++ b/arch/x86/include/asm/stacktrace.h
@@ -111,6 +111,6 @@ static inline unsigned long caller_frame_pointer(void)
        return (unsigned long)frame;
 }
-void show_opcodes(u8 *rip, const char *loglvl);
+void show_opcodes(struct pt_regs *regs, const char *loglvl);
 void show_ip(struct pt_regs *regs, const char *loglvl);
 #endif /* _ASM_X86_STACKTRACE_H */
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 29c9da6c62fc..58ce5288878e 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -175,8 +175,16 @@ struct tlb_state {
         * are on.  This means that it may not match current->active_mm,
         * which will contain the previous user mm when we're in lazy TLB
         * mode even if we've already switched back to swapper_pg_dir.
+         *
+         * During switch_mm_irqs_off(), loaded_mm will be set to
+         * LOADED_MM_SWITCHING during the brief interrupts-off window
+         * when CR3 and loaded_mm would otherwise be inconsistent.  This
+         * is for nmi_uaccess_okay()'s benefit.
         */
        struct mm_struct *loaded_mm;
+#define LOADED_MM_SWITCHING ((struct mm_struct *)1)
        u16 loaded_mm_asid;
        u16 next_asid;
        /* last user mm's ctx id */
@@ -246,6 +254,38 @@ struct tlb_state {
 };
 DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
+/*
+ * Blindly accessing user memory from NMI context can be dangerous
+ * if we're in the middle of switching the current user task or
+ * switching the loaded mm.  It can also be dangerous if we
+ * interrupted some kernel code that was temporarily using a
+ * different mm.
+ */
+static inline bool nmi_uaccess_okay(void)
+{
+        struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
+        struct mm_struct *current_mm = current->mm;
+        VM_WARN_ON_ONCE(!loaded_mm);
+        /*
+         * The condition we want to check is
+         * current_mm->pgd == __va(read_cr3_pa()).  This may be slow, though,
+         * if we're running in a VM with shadow paging, and nmi_uaccess_okay()
+         * is supposed to be reasonably fast.
+         *
+         * Instead, we check the almost equivalent but somewhat conservative
+         * condition below, and we rely on the fact that switch_mm_irqs_off()
+         * sets loaded_mm to LOADED_MM_SWITCHING before writing to CR3.
+         */
+        if (loaded_mm != current_mm)
+                return false;
+        VM_WARN_ON_ONCE(current_mm->pgd != __va(read_cr3_pa()));
+        return true;
+}
 /* Initialize cr4 shadow for this CPU. */
 static inline void cr4_init_shadow(void)
 {
diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
index fb856c9f0449..53748541c487 100644
--- a/arch/x86/include/asm/vgtod.h
+++ b/arch/x86/include/asm/vgtod.h
@@ -93,7 +93,7 @@ static inline unsigned int __getcpu(void)
         *
         * If RDPID is available, use it.
         */
-        alternative_io ("lsl %[p],%[seg]",
+        alternative_io ("lsl %[seg],%[p]",
                        ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
                        X86_FEATURE_RDPID,
                        [p] "=a" (p), [seg] "r" (__PER_CPU_SEG));
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 014f214da581..b9d5e7c9ef43 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -684,8 +684,6 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
 * It means the size must be writable atomically and the address must be aligned
 * in a way that permits an atomic write. It also makes sure we fit on a single
 * page.
- *
- * Note: Must be called under text_mutex.
 */
 void *text_poke(void *addr, const void *opcode, size_t len)
 {
@@ -700,6 +698,8 @@ void *text_poke(void *addr, const void *opcode, size_t len)
         */
        BUG_ON(!after_bootmem);
+        lockdep_assert_held(&text_mutex);
        if (!core_kernel_text((unsigned long)addr)) {
                pages[0] = vmalloc_to_page(addr);
                pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
@@ -782,8 +782,6 @@ int poke_int3_handler(struct pt_regs *regs)
 *      - replace the first byte (int3) by the first byte of
 *        replacing opcode
 *      - sync cores
- *
- * Note: must be called under text_mutex.
 */
 void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
 {
@@ -792,6 +790,9 @@ void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
        bp_int3_handler = handler;
        bp_int3_addr = (u8 *)addr + sizeof(int3);
        bp_patching_in_progress = true;
+        lockdep_assert_held(&text_mutex);
        /*
         * Corresponding read barrier in int3 notifier for making sure the
         * in_progress and handler are correctly ordered wrt. patching.
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 4c2313d0b9ca..40bdaea97fe7 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -668,6 +668,45 @@ EXPORT_SYMBOL_GPL(l1tf_mitigation);
 enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
 EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation);
+/*
+ * These CPUs all support 44bits physical address space internally in the
+ * cache but CPUID can report a smaller number of physical address bits.
+ *
+ * The L1TF mitigation uses the top most address bit for the inversion of
+ * non present PTEs. When the installed memory reaches into the top most
+ * address bit due to memory holes, which has been observed on machines
+ * which report 36bits physical address bits and have 32G RAM installed,
+ * then the mitigation range check in l1tf_select_mitigation() triggers.
+ * This is a false positive because the mitigation is still possible due to
+ * the fact that the cache uses 44bit internally. Use the cache bits
+ * instead of the reported physical bits and adjust them on the affected
+ * machines to 44bit if the reported bits are less than 44.
+ */
+static void override_cache_bits(struct cpuinfo_x86 *c)
+{
+        if (c->x86 != 6)
+                return;
+        switch (c->x86_model) {
+        case INTEL_FAM6_NEHALEM:
+        case INTEL_FAM6_WESTMERE:
+        case INTEL_FAM6_SANDYBRIDGE:
+        case INTEL_FAM6_IVYBRIDGE:
+        case INTEL_FAM6_HASWELL_CORE:
+        case INTEL_FAM6_HASWELL_ULT:
+        case INTEL_FAM6_HASWELL_GT3E:
+        case INTEL_FAM6_BROADWELL_CORE:
+        case INTEL_FAM6_BROADWELL_GT3E:
+        case INTEL_FAM6_SKYLAKE_MOBILE:
+        case INTEL_FAM6_SKYLAKE_DESKTOP:
+        case INTEL_FAM6_KABYLAKE_MOBILE:
+        case INTEL_FAM6_KABYLAKE_DESKTOP:
+                if (c->x86_cache_bits < 44)
+                        c->x86_cache_bits = 44;
+                break;
+        }
+}
 static void __init l1tf_select_mitigation(void)
 {
        u64 half_pa;
@@ -675,6 +714,8 @@ static void __init l1tf_select_mitigation(void)
        if (!boot_cpu_has_bug(X86_BUG_L1TF))
                return;
+        override_cache_bits(&boot_cpu_data);
        switch (l1tf_mitigation) {
        case L1TF_MITIGATION_OFF:
        case L1TF_MITIGATION_FLUSH_NOWARN:
@@ -694,11 +735,6 @@ static void __init l1tf_select_mitigation(void)
        return;
 #endif
-        /*
-         * This is extremely unlikely to happen because almost all
-         * systems have far more MAX_PA/2 than RAM can be fit into
-         * DIMM slots.
-         */
        half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
        if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
                pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 84dee5ab745a..44c4ef3d989b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -919,6 +919,7 @@ void get_cpu_address_sizes(struct cpuinfo_x86 *c)
        else if (cpu_has(c, X86_FEATURE_PAE) || cpu_has(c, X86_FEATURE_PSE36))
                c->x86_phys_bits = 36;
 #endif
+        c->x86_cache_bits = c->x86_phys_bits;
 }
 static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 401e8c133108..fc3c07fe7df5 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -150,6 +150,9 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
        if (cpu_has(c, X86_FEATURE_HYPERVISOR))
                return false;
+        if (c->x86 != 6)
+                return false;
        for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                if (c->x86_model == spectre_bad_microcodes[i].model &&
                    c->x86_stepping == spectre_bad_microcodes[i].stepping)
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 9c8652974f8e..f56895106ccf 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -17,6 +17,7 @@
 #include <linux/bug.h>
 #include <linux/nmi.h>
 #include <linux/sysfs.h>
+#include <linux/kasan.h>
 #include <asm/cpu_entry_area.h>
 #include <asm/stacktrace.h>
@@ -89,14 +90,24 @@ static void printk_stack_address(unsigned long address, int reliable,
 * Thus, the 2/3rds prologue and 64 byte OPCODE_BUFSIZE is just a random
 * guesstimate in attempt to achieve all of the above.
 */
-void show_opcodes(u8 *rip, const char *loglvl)
+void show_opcodes(struct pt_regs *regs, const char *loglvl)
 {
 #define PROLOGUE_SIZE 42
 #define EPILOGUE_SIZE 21
 #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)
        u8 opcodes[OPCODE_BUFSIZE];
+        unsigned long prologue = regs->ip - PROLOGUE_SIZE;
+        bool bad_ip;
-        if (probe_kernel_read(opcodes, rip - PROLOGUE_SIZE, OPCODE_BUFSIZE)) {
+        /*
+         * Make sure userspace isn't trying to trick us into dumping kernel
+         * memory by pointing the userspace instruction pointer at it.
+         */
+        bad_ip = user_mode(regs) &&
+                __chk_range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX);
+        if (bad_ip || probe_kernel_read(opcodes, (u8 *)prologue,
+                                        OPCODE_BUFSIZE)) {
                printk("%sCode: Bad RIP value.\n", loglvl);
        } else {
                printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
@@ -112,7 +123,7 @@ void show_ip(struct pt_regs *regs, const char *loglvl)
 #else
        printk("%sRIP: %04x:%pS\n", loglvl, (int)regs->cs, (void *)regs->ip);
 #endif
-        show_opcodes((u8 *)regs->ip, loglvl);
+        show_opcodes(regs, loglvl);
 }
 void show_iret_regs(struct pt_regs *regs)
@@ -346,7 +357,10 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
         * We're not going to return, but we might be on an IST stack or
         * have very little stack space left.  Rewind the stack and kill
         * the task.
+         * Before we rewind the stack, we have to tell KASAN that we're going to
+         * reuse the task stack and that existing poisons are invalid.
         */
+        kasan_unpoison_task_stack(current);
        rewind_stack_do_exit(signr);
 }
 NOKPROBE_SYMBOL(oops_end);
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index c8c6ad0d58b8..3f435d7fca5e 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -7,6 +7,8 @@
 #include <linux/uaccess.h>
 #include <linux/export.h>
+#include <asm/tlbflush.h>
 /*
 * We rely on the nested NMI work to allow atomic faults from the NMI path; the
 * nested NMI paths are careful to preserve CR2.
@@ -19,6 +21,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
        if (__range_not_ok(from, n, TASK_SIZE))
                return n;
+        if (!nmi_uaccess_okay())
+                return n;
        /*
         * Even though this function is typically called from NMI/IRQ context
         * disable pagefaults so that its behaviour is consistent even when
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index b9123c497e0a..47bebfe6efa7 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -837,7 +837,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
        printk(KERN_CONT "\n");
-        show_opcodes((u8 *)regs->ip, loglvl);
+        show_opcodes(regs, loglvl);
 }
 static void
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 8d6c34fe49be..51a5a69ecac9 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1420,6 +1420,29 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
        return 0;
 }
+/*
+ * Machine check recovery code needs to change cache mode of poisoned
+ * pages to UC to avoid speculative access logging another error. But
+ * passing the address of the 1:1 mapping to set_memory_uc() is a fine
+ * way to encourage a speculative access. So we cheat and flip the top
+ * bit of the address. This works fine for the code that updates the
+ * page tables. But at the end of the process we need to flush the cache
+ * and the non-canonical address causes a #GP fault when used by the
+ * CLFLUSH instruction.
+ *
+ * But in the common case we already have a canonical address. This code
+ * will fix the top bit if needed and is a no-op otherwise.
+ */
+static inline unsigned long make_addr_canonical_again(unsigned long addr)
+{
+#ifdef CONFIG_X86_64
+        return (long)(addr << 1) >> 1;
+#else
+        return addr;
+#endif
+}
 static int change_page_attr_set_clr(unsigned long *addr, int numpages,
                                    pgprot_t mask_set, pgprot_t mask_clr,
                                    int force_split, int in_flag,
@@ -1465,7 +1488,7 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
                 * Save address for cache flush. *addr is modified in the call
                 * to __change_page_attr_set_clr() below.
                 */
-                baddr = *addr;
+                baddr = make_addr_canonical_again(*addr);
        }
        /* Must avoid aliasing mappings in the highmem code */
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 31341ae7309f..c1fc1ae6b429 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -248,7 +248,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 *
 * Returns a pointer to a PTE on success, or NULL on failure.
 */
-static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
 {
        gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
        pmd_t *pmd;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 9517d1b2a281..e96b99eb800c 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -305,6 +305,10 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
+                /* Let nmi_uaccess_okay() know that we're changing CR3. */
+                this_cpu_write(cpu_tlbstate.loaded_mm, LOADED_MM_SWITCHING);
+                barrier();
                if (need_flush) {
                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
@@ -335,6 +339,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                if (next != &init_mm)
                        this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
+                /* Make sure we write CR3 before loaded_mm. */
+                barrier();
                this_cpu_write(cpu_tlbstate.loaded_mm, next);
                this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid);
        }
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 324b93328b37..05ca14222463 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -85,14 +85,10 @@ pgd_t * __init efi_call_phys_prolog(void)
 void __init efi_call_phys_epilog(pgd_t *save_pgd)
 {
-        struct desc_ptr gdt_descr;
-        gdt_descr.address = (unsigned long)get_cpu_gdt_rw(0);
-        gdt_descr.size = GDT_SIZE - 1;
-        load_gdt(&gdt_descr);
        load_cr3(save_pgd);
        __flush_tlb_all();
+        load_fixmap_gdt(0);
 }
 void __init efi_runtime_update_mappings(void)
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 45b700ac5fe7..2fe5c9b1816b 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -435,14 +435,13 @@ static void xen_set_pud(pud_t *ptr, pud_t val)
 static void xen_set_pte_atomic(pte_t *ptep, pte_t pte)
 {
        trace_xen_mmu_set_pte_atomic(ptep, pte);
-        set_64bit((u64 *)ptep, native_pte_val(pte));
+        __xen_set_pte(ptep, pte);
 }
 static void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
        trace_xen_mmu_pte_clear(mm, addr, ptep);
-        if (!xen_batched_set_pte(ptep, native_make_pte(0)))
+        __xen_set_pte(ptep, native_make_pte(0));
-                native_pte_clear(mm, addr, ptep);
 }
 static void xen_pmd_clear(pmd_t *pmdp)
@@ -1570,7 +1569,7 @@ static void __init xen_set_pte_init(pte_t *ptep, pte_t pte)
                pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
                               pte_val_ma(pte));
 #endif
-        native_set_pte(ptep, pte);
+        __xen_set_pte(ptep, pte);
 }
 /* Early in boot, while setting up the initial pagetable, assume
@@ -2061,7 +2060,6 @@ void __init xen_relocate_p2m(void)
        pud_t *pud;
        pgd_t *pgd;
        unsigned long *new_p2m;
-        int save_pud;
        size = PAGE_ALIGN(xen_start_info->nr_pages * sizeof(unsigned long));
        n_pte = roundup(size, PAGE_SIZE) >> PAGE_SHIFT;
@@ -2091,7 +2089,6 @@ void __init xen_relocate_p2m(void)
        pgd = __va(read_cr3_pa());
        new_p2m = (unsigned long *)(2 * PGDIR_SIZE);
-        save_pud = n_pud;
        for (idx_pud = 0; idx_pud < n_pud; idx_pud++) {
                pud = early_memremap(pud_phys, PAGE_SIZE);
                clear_page(pud);
diff --git a/block/blk-wbt.c b/block/blk-wbt.c
index 84507d3e9a98..8e20a0677dcf 100644
--- a/block/blk-wbt.c
+++ b/block/blk-wbt.c
@@ -123,16 +123,11 @@ static void rwb_wake_all(struct rq_wb *rwb)
        }
 }
-static void __wbt_done(struct rq_qos *rqos, enum wbt_flags wb_acct)
+static void wbt_rqw_done(struct rq_wb *rwb, struct rq_wait *rqw,
+                         enum wbt_flags wb_acct)
 {
-        struct rq_wb *rwb = RQWB(rqos);
-        struct rq_wait *rqw;
        int inflight, limit;
-        if (!(wb_acct & WBT_TRACKED))
-                return;
-        rqw = get_rq_wait(rwb, wb_acct);
        inflight = atomic_dec_return(&rqw->inflight);
        /*
@@ -166,10 +161,22 @@ static void __wbt_done(struct rq_qos *rqos, enum wbt_flags wb_acct)
                int diff = limit - inflight;
                if (!inflight || diff >= rwb->wb_background / 2)
-                        wake_up(&rqw->wait);
+                        wake_up_all(&rqw->wait);
        }
 }
+static void __wbt_done(struct rq_qos *rqos, enum wbt_flags wb_acct)
+{
+        struct rq_wb *rwb = RQWB(rqos);
+        struct rq_wait *rqw;
+        if (!(wb_acct & WBT_TRACKED))
+                return;
+        rqw = get_rq_wait(rwb, wb_acct);
+        wbt_rqw_done(rwb, rqw, wb_acct);
+}
 /*
 * Called on completion of a request. Note that it's also called when
 * a request is merged, when the request gets freed.
@@ -481,6 +488,34 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw)
        return limit;
 }
+struct wbt_wait_data {
+        struct wait_queue_entry wq;
+        struct task_struct *task;
+        struct rq_wb *rwb;
+        struct rq_wait *rqw;
+        unsigned long rw;
+        bool got_token;
+};
+static int wbt_wake_function(struct wait_queue_entry *curr, unsigned int mode,
+                             int wake_flags, void *key)
+{
+        struct wbt_wait_data *data = container_of(curr, struct wbt_wait_data,
+                                                        wq);
+        /*
+         * If we fail to get a budget, return -1 to interrupt the wake up
+         * loop in __wake_up_common.
+         */
+        if (!rq_wait_inc_below(data->rqw, get_limit(data->rwb, data->rw)))
+                return -1;
+        data->got_token = true;
+        list_del_init(&curr->entry);
+        wake_up_process(data->task);
+        return 1;
+}
 /*
 * Block if we will exceed our limit, or if we are currently waiting for
 * the timer to kick off queuing again.
@@ -491,19 +526,40 @@ static void __wbt_wait(struct rq_wb *rwb, enum wbt_flags wb_acct,
        __acquires(lock)
 {
        struct rq_wait *rqw = get_rq_wait(rwb, wb_acct);
-        DECLARE_WAITQUEUE(wait, current);
+        struct wbt_wait_data data = {
+                .wq = {
+                        .func   = wbt_wake_function,
+                        .entry  = LIST_HEAD_INIT(data.wq.entry),
+                },
+                .task = current,
+                .rwb = rwb,
+                .rqw = rqw,
+                .rw = rw,
+        };
        bool has_sleeper;
        has_sleeper = wq_has_sleeper(&rqw->wait);
        if (!has_sleeper && rq_wait_inc_below(rqw, get_limit(rwb, rw)))
                return;
-        add_wait_queue_exclusive(&rqw->wait, &wait);
+        prepare_to_wait_exclusive(&rqw->wait, &data.wq, TASK_UNINTERRUPTIBLE);
        do {
-                set_current_state(TASK_UNINTERRUPTIBLE);
+                if (data.got_token)
+                        break;
-                if (!has_sleeper && rq_wait_inc_below(rqw, get_limit(rwb, rw)))
+                if (!has_sleeper &&
+                    rq_wait_inc_below(rqw, get_limit(rwb, rw))) {
+                        finish_wait(&rqw->wait, &data.wq);
+                        /*
+                         * We raced with wbt_wake_function() getting a token,
+                         * which means we now have two. Put our local token
+                         * and wake anyone else potentially waiting for one.
+                         */
+                        if (data.got_token)
+                                wbt_rqw_done(rwb, rqw, wb_acct);
                        break;
+                }
                if (lock) {
                        spin_unlock_irq(lock);
@@ -511,11 +567,11 @@ static void __wbt_wait(struct rq_wb *rwb, enum wbt_flags wb_acct,
                        spin_lock_irq(lock);
                } else
                        io_schedule();
                has_sleeper = false;
        } while (1);
-        __set_current_state(TASK_RUNNING);
+        finish_wait(&rqw->wait, &data.wq);
-        remove_wait_queue(&rqw->wait, &wait);
 }
 static inline bool wbt_should_throttle(struct rq_wb *rwb, struct bio *bio)
@@ -580,11 +636,6 @@ static void wbt_wait(struct rq_qos *rqos, struct bio *bio, spinlock_t *lock)
                return;
        }
-        if (current_is_kswapd())
-                flags |= WBT_KSWAPD;
-        if (bio_op(bio) == REQ_OP_DISCARD)
-                flags |= WBT_DISCARD;
        __wbt_wait(rwb, flags, bio->bi_opf, lock);
        if (!blk_stat_is_active(rwb->cb))
diff --git a/block/bsg.c b/block/bsg.c
index db588add6ba6..9a442c23a715 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -37,7 +37,7 @@ struct bsg_device {
        struct request_queue *queue;
        spinlock_t lock;
        struct hlist_node dev_list;
-        atomic_t ref_count;
+        refcount_t ref_count;
        char name[20];
        int max_queue;
 };
@@ -252,7 +252,7 @@ static int bsg_put_device(struct bsg_device *bd)
        mutex_lock(&bsg_mutex);
-        if (!atomic_dec_and_test(&bd->ref_count)) {
+        if (!refcount_dec_and_test(&bd->ref_count)) {
                mutex_unlock(&bsg_mutex);
                return 0;
        }
@@ -290,7 +290,7 @@ static struct bsg_device *bsg_add_device(struct inode *inode,
        bd->queue = rq;
-        atomic_set(&bd->ref_count, 1);
+        refcount_set(&bd->ref_count, 1);
        hlist_add_head(&bd->dev_list, bsg_dev_idx_hash(iminor(inode)));
        strncpy(bd->name, dev_name(rq->bsg_dev.class_dev), sizeof(bd->name) - 1);
@@ -308,7 +308,7 @@ static struct bsg_device *__bsg_get_device(int minor, struct request_queue *q)
        hlist_for_each_entry(bd, bsg_dev_idx_hash(minor), dev_list) {
                if (bd->queue == q) {
-                        atomic_inc(&bd->ref_count);
+                        refcount_inc(&bd->ref_count);
                        goto found;
                }
        }
diff --git a/block/elevator.c b/block/elevator.c
index 5ea6e7d600e4..6a06b5d040e5 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -895,8 +895,7 @@ int elv_register(struct elevator_type *e)
        spin_lock(&elv_list_lock);
        if (elevator_find(e->elevator_name, e->uses_mq)) {
                spin_unlock(&elv_list_lock);
-                if (e->icq_cache)
+                kmem_cache_destroy(e->icq_cache);
-                        kmem_cache_destroy(e->icq_cache);
                return -EBUSY;
        }
        list_add_tail(&e->list, &elv_list);
diff --git a/drivers/ata/pata_ftide010.c b/drivers/ata/pata_ftide010.c
index 5d4b72e21161..569a4a662dcd 100644
--- a/drivers/ata/pata_ftide010.c
+++ b/drivers/ata/pata_ftide010.c
@@ -256,14 +256,12 @@ static struct ata_port_operations pata_ftide010_port_ops = {
        .qc_issue       = ftide010_qc_issue,
 };
-static struct ata_port_info ftide010_port_info[] = {
+static struct ata_port_info ftide010_port_info = {
-        {
+        .flags          = ATA_FLAG_SLAVE_POSS,
-                .flags          = ATA_FLAG_SLAVE_POSS,
+        .mwdma_mask     = ATA_MWDMA2,
-                .mwdma_mask     = ATA_MWDMA2,
+        .udma_mask      = ATA_UDMA6,
-                .udma_mask      = ATA_UDMA6,
+        .pio_mask       = ATA_PIO4,
-                .pio_mask       = ATA_PIO4,
+        .port_ops       = &pata_ftide010_port_ops,
-                .port_ops       = &pata_ftide010_port_ops,
-        },
 };
 #if IS_ENABLED(CONFIG_SATA_GEMINI)
@@ -349,6 +347,7 @@ static int pata_ftide010_gemini_cable_detect(struct ata_port *ap)
 }
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+                                     struct ata_port_info *pi,
                                     bool is_ata1)
 {
        struct device *dev = ftide->dev;
@@ -373,7 +372,13 @@ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
        /* Flag port as SATA-capable */
        if (gemini_sata_bridge_enabled(sg, is_ata1))
-                ftide010_port_info[0].flags |= ATA_FLAG_SATA;
+                pi->flags |= ATA_FLAG_SATA;
+        /* This device has broken DMA, only PIO works */
+        if (of_machine_is_compatible("itian,sq201")) {
+                pi->mwdma_mask = 0;
+                pi->udma_mask = 0;
+        }
        /*
         * We assume that a simple 40-wire cable is used in the PATA mode.
@@ -435,6 +440,7 @@ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
 }
 #else
 static int pata_ftide010_gemini_init(struct ftide010 *ftide,
+                                     struct ata_port_info *pi,
                                     bool is_ata1)
 {
        return -ENOTSUPP;
@@ -446,7 +452,7 @@ static int pata_ftide010_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
        struct device_node *np = dev->of_node;
-        const struct ata_port_info pi = ftide010_port_info[0];
+        struct ata_port_info pi = ftide010_port_info;
        const struct ata_port_info *ppi[] = { &pi, NULL };
        struct ftide010 *ftide;
        struct resource *res;
@@ -490,6 +496,7 @@ static int pata_ftide010_probe(struct platform_device *pdev)
                 * are ATA0. This will also set up the cable types.
                 */
                ret = pata_ftide010_gemini_init(ftide,
+                                &pi,
                                (res->start == 0x63400000));
                if (ret)
                        goto err_dis_clk;
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index 8e2e4757adcb..5a42ae4078c2 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -185,7 +185,7 @@ EXPORT_SYMBOL_GPL(of_pm_clk_add_clk);
 int of_pm_clk_add_clks(struct device *dev)
 {
        struct clk **clks;
-        unsigned int i, count;
+        int i, count;
        int ret;
        if (!dev || !dev->of_node)
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index b55b245e8052..fd1e19f1a49f 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -84,6 +84,18 @@ MODULE_PARM_DESC(max_persistent_grants,
                 "Maximum number of grants to map persistently");
 /*
+ * How long a persistent grant is allowed to remain allocated without being in
+ * use. The time is in seconds, 0 means indefinitely long.
+ */
+static unsigned int xen_blkif_pgrant_timeout = 60;
+module_param_named(persistent_grant_unused_seconds, xen_blkif_pgrant_timeout,
+                   uint, 0644);
+MODULE_PARM_DESC(persistent_grant_unused_seconds,
+                 "Time in seconds an unused persistent grant is allowed to "
+                 "remain allocated. Default is 60, 0 means unlimited.");
+/*
 * Maximum number of rings/queues blkback supports, allow as many queues as there
 * are CPUs if user has not specified a value.
 */
@@ -123,6 +135,13 @@ module_param(log_stats, int, 0644);
 /* Number of free pages to remove on each call to gnttab_free_pages */
 #define NUM_BATCH_FREE_PAGES 10
+static inline bool persistent_gnt_timeout(struct persistent_gnt *persistent_gnt)
+{
+        return xen_blkif_pgrant_timeout &&
+               (jiffies - persistent_gnt->last_used >=
+                HZ * xen_blkif_pgrant_timeout);
+}
 static inline int get_free_page(struct xen_blkif_ring *ring, struct page **page)
 {
        unsigned long flags;
@@ -236,8 +255,7 @@ static int add_persistent_gnt(struct xen_blkif_ring *ring,
                }
        }
-        bitmap_zero(persistent_gnt->flags, PERSISTENT_GNT_FLAGS_SIZE);
+        persistent_gnt->active = true;
-        set_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags);
        /* Add new node and rebalance tree. */
        rb_link_node(&(persistent_gnt->node), parent, new);
        rb_insert_color(&(persistent_gnt->node), &ring->persistent_gnts);
@@ -261,11 +279,11 @@ static struct persistent_gnt *get_persistent_gnt(struct xen_blkif_ring *ring,
                else if (gref > data->gnt)
                        node = node->rb_right;
                else {
-                        if(test_bit(PERSISTENT_GNT_ACTIVE, data->flags)) {
+                        if (data->active) {
                                pr_alert_ratelimited("requesting a grant already in use\n");
                                return NULL;
                        }
-                        set_bit(PERSISTENT_GNT_ACTIVE, data->flags);
+                        data->active = true;
                        atomic_inc(&ring->persistent_gnt_in_use);
                        return data;
                }
@@ -276,10 +294,10 @@ static struct persistent_gnt *get_persistent_gnt(struct xen_blkif_ring *ring,
 static void put_persistent_gnt(struct xen_blkif_ring *ring,
                               struct persistent_gnt *persistent_gnt)
 {
-        if(!test_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags))
+        if (!persistent_gnt->active)
                pr_alert_ratelimited("freeing a grant already unused\n");
-        set_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags);
+        persistent_gnt->last_used = jiffies;
-        clear_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags);
+        persistent_gnt->active = false;
        atomic_dec(&ring->persistent_gnt_in_use);
 }
@@ -371,26 +389,26 @@ static void purge_persistent_gnt(struct xen_blkif_ring *ring)
        struct persistent_gnt *persistent_gnt;
        struct rb_node *n;
        unsigned int num_clean, total;
-        bool scan_used = false, clean_used = false;
+        bool scan_used = false;
        struct rb_root *root;
-        if (ring->persistent_gnt_c < xen_blkif_max_pgrants ||
-            (ring->persistent_gnt_c == xen_blkif_max_pgrants &&
-            !ring->blkif->vbd.overflow_max_grants)) {
-                goto out;
-        }
        if (work_busy(&ring->persistent_purge_work)) {
                pr_alert_ratelimited("Scheduled work from previous purge is still busy, cannot purge list\n");
                goto out;
        }
-        num_clean = (xen_blkif_max_pgrants / 100) * LRU_PERCENT_CLEAN;
+        if (ring->persistent_gnt_c < xen_blkif_max_pgrants ||
-        num_clean = ring->persistent_gnt_c - xen_blkif_max_pgrants + num_clean;
+            (ring->persistent_gnt_c == xen_blkif_max_pgrants &&
-        num_clean = min(ring->persistent_gnt_c, num_clean);
+            !ring->blkif->vbd.overflow_max_grants)) {
-        if ((num_clean == 0) ||
+                num_clean = 0;
-            (num_clean > (ring->persistent_gnt_c - atomic_read(&ring->persistent_gnt_in_use))))
+        } else {
-                goto out;
+                num_clean = (xen_blkif_max_pgrants / 100) * LRU_PERCENT_CLEAN;
+                num_clean = ring->persistent_gnt_c - xen_blkif_max_pgrants +
+                            num_clean;
+                num_clean = min(ring->persistent_gnt_c, num_clean);
+                pr_debug("Going to purge at least %u persistent grants\n",
+                         num_clean);
+        }
        /*
         * At this point, we can assure that there will be no calls
@@ -401,9 +419,7 @@ static void purge_persistent_gnt(struct xen_blkif_ring *ring)
         * number of grants.
         */
-        total = num_clean;
+        total = 0;
-        pr_debug("Going to purge %u persistent grants\n", num_clean);
        BUG_ON(!list_empty(&ring->persistent_purge_list));
        root = &ring->persistent_gnts;
@@ -412,46 +428,37 @@ purge_list:
                BUG_ON(persistent_gnt->handle ==
                        BLKBACK_INVALID_HANDLE);
-                if (clean_used) {
+                if (persistent_gnt->active)
-                        clear_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags);
                        continue;
-                }
+                if (!scan_used && !persistent_gnt_timeout(persistent_gnt))
-                if (test_bit(PERSISTENT_GNT_ACTIVE, persistent_gnt->flags))
                        continue;
-                if (!scan_used &&
+                if (scan_used && total >= num_clean)
-                    (test_bit(PERSISTENT_GNT_WAS_ACTIVE, persistent_gnt->flags)))
                        continue;
                rb_erase(&persistent_gnt->node, root);
                list_add(&persistent_gnt->remove_node,
                         &ring->persistent_purge_list);
-                if (--num_clean == 0)
+                total++;
-                        goto finished;
        }
        /*
-         * If we get here it means we also need to start cleaning
+         * Check whether we also need to start cleaning
         * grants that were used since last purge in order to cope
         * with the requested num
         */
-        if (!scan_used && !clean_used) {
+        if (!scan_used && total < num_clean) {
-                pr_debug("Still missing %u purged frames\n", num_clean);
+                pr_debug("Still missing %u purged frames\n", num_clean - total);
                scan_used = true;
                goto purge_list;
        }
-finished:
-        if (!clean_used) {
-                pr_debug("Finished scanning for grants to clean, removing used flag\n");
-                clean_used = true;
-                goto purge_list;
-        }
-        ring->persistent_gnt_c -= (total - num_clean);
+        if (total) {
-        ring->blkif->vbd.overflow_max_grants = 0;
+                ring->persistent_gnt_c -= total;
+                ring->blkif->vbd.overflow_max_grants = 0;
-        /* We can defer this work */
+                /* We can defer this work */
-        schedule_work(&ring->persistent_purge_work);
+                schedule_work(&ring->persistent_purge_work);
-        pr_debug("Purged %u/%u\n", (total - num_clean), total);
+                pr_debug("Purged %u/%u\n", num_clean, total);
+        }
 out:
        return;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index ecb35fe8ca8d..1d3002d773f7 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -233,16 +233,6 @@ struct xen_vbd {
 struct backend_info;
-/* Number of available flags */
-#define PERSISTENT_GNT_FLAGS_SIZE       2
-/* This persistent grant is currently in use */
-#define PERSISTENT_GNT_ACTIVE           0
-/*
- * This persistent grant has been used, this flag is set when we remove the
- * PERSISTENT_GNT_ACTIVE, to know that this grant has been used recently.
- */
-#define PERSISTENT_GNT_WAS_ACTIVE       1
 /* Number of requests that we can fit in a ring */
 #define XEN_BLKIF_REQS_PER_PAGE         32
@@ -250,7 +240,8 @@ struct persistent_gnt {
        struct page *page;
        grant_ref_t gnt;
        grant_handle_t handle;
-        DECLARE_BITMAP(flags, PERSISTENT_GNT_FLAGS_SIZE);
+        unsigned long last_used;
+        bool active;
        struct rb_node node;
        struct list_head remove_node;
 };
@@ -278,7 +269,6 @@ struct xen_blkif_ring {
        wait_queue_head_t       pending_free_wq;
        /* Tree to store persistent grants. */
-        spinlock_t              pers_gnts_lock;
        struct rb_root          persistent_gnts;
        unsigned int            persistent_gnt_c;
        atomic_t                persistent_gnt_in_use;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8986adab9bf5..a71d817e900d 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -46,6 +46,7 @@
 #include <linux/scatterlist.h>
 #include <linux/bitmap.h>
 #include <linux/list.h>
+#include <linux/workqueue.h>
 #include <xen/xen.h>
 #include <xen/xenbus.h>
@@ -121,6 +122,8 @@ static inline struct blkif_req *blkif_req(struct request *rq)
 static DEFINE_MUTEX(blkfront_mutex);
 static const struct block_device_operations xlvbd_block_fops;
+static struct delayed_work blkfront_work;
+static LIST_HEAD(info_list);
 /*
 * Maximum number of segments in indirect requests, the actual value used by
@@ -216,6 +219,7 @@ struct blkfront_info
        /* Save uncomplete reqs and bios for migration. */
        struct list_head requests;
        struct bio_list bio_list;
+        struct list_head info_list;
 };
 static unsigned int nr_minors;
@@ -1759,6 +1763,12 @@ abort_transaction:
        return err;
 }
+static void free_info(struct blkfront_info *info)
+{
+        list_del(&info->info_list);
+        kfree(info);
+}
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_blkback(struct xenbus_device *dev,
                           struct blkfront_info *info)
@@ -1880,7 +1890,10 @@ again:
 destroy_blkring:
        blkif_free(info, 0);
-        kfree(info);
+        mutex_lock(&blkfront_mutex);
+        free_info(info);
+        mutex_unlock(&blkfront_mutex);
        dev_set_drvdata(&dev->dev, NULL);
        return err;
@@ -1991,6 +2004,10 @@ static int blkfront_probe(struct xenbus_device *dev,
        info->handle = simple_strtoul(strrchr(dev->nodename, '/')+1, NULL, 0);
        dev_set_drvdata(&dev->dev, info);
+        mutex_lock(&blkfront_mutex);
+        list_add(&info->info_list, &info_list);
+        mutex_unlock(&blkfront_mutex);
        return 0;
 }
@@ -2301,6 +2318,12 @@ static void blkfront_gather_backend_features(struct blkfront_info *info)
        if (indirect_segments <= BLKIF_MAX_SEGMENTS_PER_REQUEST)
                indirect_segments = 0;
        info->max_indirect_segments = indirect_segments;
+        if (info->feature_persistent) {
+                mutex_lock(&blkfront_mutex);
+                schedule_delayed_work(&blkfront_work, HZ * 10);
+                mutex_unlock(&blkfront_mutex);
+        }
 }
 /*
@@ -2482,7 +2505,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
        mutex_unlock(&info->mutex);
        if (!bdev) {
-                kfree(info);
+                mutex_lock(&blkfront_mutex);
+                free_info(info);
+                mutex_unlock(&blkfront_mutex);
                return 0;
        }
@@ -2502,7 +2527,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
        if (info && !bdev->bd_openers) {
                xlvbd_release_gendisk(info);
                disk->private_data = NULL;
-                kfree(info);
+                mutex_lock(&blkfront_mutex);
+                free_info(info);
+                mutex_unlock(&blkfront_mutex);
        }
        mutex_unlock(&bdev->bd_mutex);
@@ -2585,7 +2612,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
                dev_info(disk_to_dev(bdev->bd_disk), "releasing disk\n");
                xlvbd_release_gendisk(info);
                disk->private_data = NULL;
-                kfree(info);
+                free_info(info);
        }
 out:
@@ -2618,6 +2645,61 @@ static struct xenbus_driver blkfront_driver = {
        .is_ready = blkfront_is_ready,
 };
+static void purge_persistent_grants(struct blkfront_info *info)
+{
+        unsigned int i;
+        unsigned long flags;
+        for (i = 0; i < info->nr_rings; i++) {
+                struct blkfront_ring_info *rinfo = &info->rinfo[i];
+                struct grant *gnt_list_entry, *tmp;
+                spin_lock_irqsave(&rinfo->ring_lock, flags);
+                if (rinfo->persistent_gnts_c == 0) {
+                        spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+                        continue;
+                }
+                list_for_each_entry_safe(gnt_list_entry, tmp, &rinfo->grants,
+                                         node) {
+                        if (gnt_list_entry->gref == GRANT_INVALID_REF ||
+                            gnttab_query_foreign_access(gnt_list_entry->gref))
+                                continue;
+                        list_del(&gnt_list_entry->node);
+                        gnttab_end_foreign_access(gnt_list_entry->gref, 0, 0UL);
+                        rinfo->persistent_gnts_c--;
+                        __free_page(gnt_list_entry->page);
+                        kfree(gnt_list_entry);
+                }
+                spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+        }
+}
+static void blkfront_delay_work(struct work_struct *work)
+{
+        struct blkfront_info *info;
+        bool need_schedule_work = false;
+        mutex_lock(&blkfront_mutex);
+        list_for_each_entry(info, &info_list, info_list) {
+                if (info->feature_persistent) {
+                        need_schedule_work = true;
+                        mutex_lock(&info->mutex);
+                        purge_persistent_grants(info);
+                        mutex_unlock(&info->mutex);
+                }
+        }
+        if (need_schedule_work)
+                schedule_delayed_work(&blkfront_work, HZ * 10);
+        mutex_unlock(&blkfront_mutex);
+}
 static int __init xlblk_init(void)
 {
        int ret;
@@ -2626,6 +2708,15 @@ static int __init xlblk_init(void)
        if (!xen_domain())
                return -ENODEV;
+        if (!xen_has_pv_disk_devices())
+                return -ENODEV;
+        if (register_blkdev(XENVBD_MAJOR, DEV_NAME)) {
+                pr_warn("xen_blk: can't get major %d with name %s\n",
+                        XENVBD_MAJOR, DEV_NAME);
+                return -ENODEV;
+        }
        if (xen_blkif_max_segments < BLKIF_MAX_SEGMENTS_PER_REQUEST)
                xen_blkif_max_segments = BLKIF_MAX_SEGMENTS_PER_REQUEST;
@@ -2641,14 +2732,7 @@ static int __init xlblk_init(void)
                xen_blkif_max_queues = nr_cpus;
        }
-        if (!xen_has_pv_disk_devices())
+        INIT_DELAYED_WORK(&blkfront_work, blkfront_delay_work);
-                return -ENODEV;
-        if (register_blkdev(XENVBD_MAJOR, DEV_NAME)) {
-                printk(KERN_WARNING "xen_blk: can't get major %d with name %s\n",
-                       XENVBD_MAJOR, DEV_NAME);
-                return -ENODEV;
-        }
        ret = xenbus_register_frontend(&blkfront_driver);
        if (ret) {
@@ -2663,6 +2747,8 @@ module_init(xlblk_init);
 static void __exit xlblk_exit(void)
 {
+        cancel_delayed_work_sync(&blkfront_work);
        xenbus_unregister_driver(&blkfront_driver);
        unregister_blkdev(XENVBD_MAJOR, DEV_NAME);
        kfree(minors);
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 2df11cc08a46..845b0314ce3a 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -200,6 +200,7 @@ config BT_HCIUART_RTL
        depends on BT_HCIUART
        depends on BT_HCIUART_SERDEV
        depends on GPIOLIB
+        depends on ACPI
        select BT_HCIUART_3WIRE
        select BT_RTL
        help
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index ed2a5c7cb77f..4593baff2bc9 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -144,8 +144,10 @@ static int mtk_setup_fw(struct hci_dev *hdev)
        fw_size = fw->size;
        /* The size of patch header is 30 bytes, should be skip */
-        if (fw_size < 30)
+        if (fw_size < 30) {
-                return -EINVAL;
+                err = -EINVAL;
+                goto free_fw;
+        }
        fw_size -= 30;
        fw_ptr += 30;
@@ -172,8 +174,8 @@ static int mtk_setup_fw(struct hci_dev *hdev)
                fw_ptr += dlen;
        }
+free_fw:
        release_firmware(fw);
        return err;
 }
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index c9bac9dc4637..e4fe954e63a9 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -498,32 +498,29 @@ static int sysc_check_registers(struct sysc *ddata)
 /**
 * syc_ioremap - ioremap register space for the interconnect target module
- * @ddata: deviec driver data
+ * @ddata: device driver data
 *
 * Note that the interconnect target module registers can be anywhere
- * within the first child device address space. For example, SGX has
+ * within the interconnect target module range. For example, SGX has
- * them at offset 0x1fc00 in the 32MB module address space. We just
+ * them at offset 0x1fc00 in the 32MB module address space. And cpsw
- * what we need around the interconnect target module registers.
+ * has them at offset 0x1200 in the CPSW_WR child. Usually the
+ * the interconnect target module registers are at the beginning of
+ * the module range though.
 */
 static int sysc_ioremap(struct sysc *ddata)
 {
-        u32 size = 0;
+        int size;
-        if (ddata->offsets[SYSC_SYSSTATUS] >= 0)
-                size = ddata->offsets[SYSC_SYSSTATUS];
-        else if (ddata->offsets[SYSC_SYSCONFIG] >= 0)
-                size = ddata->offsets[SYSC_SYSCONFIG];
-        else if (ddata->offsets[SYSC_REVISION] >= 0)
-                size = ddata->offsets[SYSC_REVISION];
-        else
-                return -EINVAL;
-        size &= 0xfff00;
+        size = max3(ddata->offsets[SYSC_REVISION],
-        size += SZ_256;
+                    ddata->offsets[SYSC_SYSCONFIG],
+                    ddata->offsets[SYSC_SYSSTATUS]);
+        if (size < 0 || (size + sizeof(u32)) > ddata->module_size)
+                return -EINVAL;
        ddata->module_va = devm_ioremap(ddata->dev,
                                        ddata->module_pa,
-                                        size);
+                                        size + sizeof(u32));
        if (!ddata->module_va)
                return -EIO;
@@ -1224,10 +1221,10 @@ static int sysc_child_suspend_noirq(struct device *dev)
        if (!pm_runtime_status_suspended(dev)) {
                error = pm_generic_runtime_suspend(dev);
                if (error) {
-                        dev_err(dev, "%s error at %i: %i\n",
+                        dev_warn(dev, "%s busy at %i: %i\n",
-                                __func__, __LINE__, error);
+                                 __func__, __LINE__, error);
-                        return error;
+                        return 0;
                }
                error = sysc_runtime_suspend(ddata->dev);
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 113fc6edb2b0..a5d5a96479bf 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2546,7 +2546,7 @@ static int cdrom_ioctl_drive_status(struct cdrom_device_info *cdi,
        if (!CDROM_CAN(CDC_SELECT_DISC) ||
            (arg == CDSL_CURRENT || arg == CDSL_NONE))
                return cdi->ops->drive_status(cdi, CDSL_CURRENT);
-        if (((int)arg >= cdi->capacity))
+        if (arg >= cdi->capacity)
                return -EINVAL;
        return cdrom_slot_status(cdi, arg);
 }
diff --git a/drivers/clk/clk-npcm7xx.c b/drivers/clk/clk-npcm7xx.c
index 740af90a9508..c5edf8f2fd19 100644
--- a/drivers/clk/clk-npcm7xx.c
+++ b/drivers/clk/clk-npcm7xx.c
@@ -558,8 +558,8 @@ static void __init npcm7xx_clk_init(struct device_node *clk_np)
        if (!clk_base)
                goto npcm7xx_init_error;
-        npcm7xx_clk_data = kzalloc(sizeof(*npcm7xx_clk_data->hws) *
+        npcm7xx_clk_data = kzalloc(struct_size(npcm7xx_clk_data, hws,
-                NPCM7XX_NUM_CLOCKS + sizeof(npcm7xx_clk_data), GFP_KERNEL);
+                                   NPCM7XX_NUM_CLOCKS), GFP_KERNEL);
        if (!npcm7xx_clk_data)
                goto npcm7xx_init_np_err;
diff --git a/drivers/clk/x86/clk-st.c b/drivers/clk/x86/clk-st.c
index fb62f3938008..3a0996f2d556 100644
--- a/drivers/clk/x86/clk-st.c
+++ b/drivers/clk/x86/clk-st.c
@@ -46,7 +46,7 @@ static int st_clk_probe(struct platform_device *pdev)
                clk_oscout1_parents, ARRAY_SIZE(clk_oscout1_parents),
                0, st_data->base + CLKDRVSTR2, OSCOUT1CLK25MHZ, 3, 0, NULL);
-        clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_25M]->clk);
+        clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_48M]->clk);
        hws[ST_CLK_GATE] = clk_hw_register_gate(NULL, "oscout1", "oscout1_mux",
                0, st_data->base + MISCCLKCNTL1, OSCCLKENB,
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 110483f0e3fb..e26a40971b26 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -379,9 +379,20 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
                if (idx == -1)
                        idx = i; /* first enabled state */
                if (s->target_residency > data->predicted_us) {
-                        if (!tick_nohz_tick_stopped())
+                        if (data->predicted_us < TICK_USEC)
                                break;
+                        if (!tick_nohz_tick_stopped()) {
+                                /*
+                                 * If the state selected so far is shallow,
+                                 * waking up early won't hurt, so retain the
+                                 * tick in that case and let the governor run
+                                 * again in the next iteration of the loop.
+                                 */
+                                expected_interval = drv->states[idx].target_residency;
+                                break;
+                        }
                        /*
                         * If the state selected so far is shallow and this
                         * state's target residency matches the time till the
diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
index 6e61cc93c2b0..d7aa7d7ff102 100644
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -679,10 +679,8 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
        int ret = 0;
        if (keylen != 2 * AES_MIN_KEY_SIZE  && keylen != 2 * AES_MAX_KEY_SIZE) {
-                crypto_ablkcipher_set_flags(ablkcipher,
-                                            CRYPTO_TFM_RES_BAD_KEY_LEN);
                dev_err(jrdev, "key size mismatch\n");
-                return -EINVAL;
+                goto badkey;
        }
        ctx->cdata.keylen = keylen;
@@ -715,7 +713,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
        return ret;
 badkey:
        crypto_ablkcipher_set_flags(ablkcipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
-        return 0;
+        return -EINVAL;
 }
 /*
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 578ea63a3109..f26d62e5533a 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -71,8 +71,8 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc,
        dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE);
        dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE);
        dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
-        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
 }
 static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
@@ -90,8 +90,8 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
        dma_unmap_single(dev, pdb->dp_dma, p_sz, DMA_TO_DEVICE);
        dma_unmap_single(dev, pdb->dq_dma, q_sz, DMA_TO_DEVICE);
        dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
-        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
 }
 /* RSA Job Completion handler */
@@ -417,13 +417,13 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
                goto unmap_p;
        }
-        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
+        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(dev, pdb->tmp1_dma)) {
                dev_err(dev, "Unable to map RSA tmp1 memory\n");
                goto unmap_q;
        }
-        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
+        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(dev, pdb->tmp2_dma)) {
                dev_err(dev, "Unable to map RSA tmp2 memory\n");
                goto unmap_tmp1;
@@ -451,7 +451,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
        return 0;
 unmap_tmp1:
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
 unmap_q:
        dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
 unmap_p:
@@ -504,13 +504,13 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
                goto unmap_dq;
        }
-        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
+        pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(dev, pdb->tmp1_dma)) {
                dev_err(dev, "Unable to map RSA tmp1 memory\n");
                goto unmap_qinv;
        }
-        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
+        pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
        if (dma_mapping_error(dev, pdb->tmp2_dma)) {
                dev_err(dev, "Unable to map RSA tmp2 memory\n");
                goto unmap_tmp1;
@@ -538,7 +538,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
        return 0;
 unmap_tmp1:
-        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+        dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
 unmap_qinv:
        dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
 unmap_dq:
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index f4f258075b89..acdd72016ffe 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -190,7 +190,8 @@ static void caam_jr_dequeue(unsigned long devarg)
                BUG_ON(CIRC_CNT(head, tail + i, JOBR_DEPTH) <= 0);
                /* Unmap just-run descriptor so we can post-process */
-                dma_unmap_single(dev, jrp->outring[hw_idx].desc,
+                dma_unmap_single(dev,
+                                 caam_dma_to_cpu(jrp->outring[hw_idx].desc),
                                 jrp->entinfo[sw_idx].desc_size,
                                 DMA_TO_DEVICE);
diff --git a/drivers/crypto/cavium/nitrox/nitrox_dev.h b/drivers/crypto/cavium/nitrox/nitrox_dev.h
index 9a476bb6d4c7..af596455b420 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_dev.h
+++ b/drivers/crypto/cavium/nitrox/nitrox_dev.h
@@ -35,6 +35,7 @@ struct nitrox_cmdq {
        /* requests in backlog queues */
        atomic_t backlog_count;
+        int write_idx;
        /* command size 32B/64B */
        u8 instr_size;
        u8 qno;
@@ -87,7 +88,7 @@ struct nitrox_bh {
        struct bh_data *slc;
 };
-/* NITROX-5 driver state */
+/* NITROX-V driver state */
 #define NITROX_UCODE_LOADED     0
 #define NITROX_READY            1
diff --git a/drivers/crypto/cavium/nitrox/nitrox_lib.c b/drivers/crypto/cavium/nitrox/nitrox_lib.c
index ebe267379ac9..4d31df07777f 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c
@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitrox_cmdq *cmdq)
        cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN);
        cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN);
        cmdq->qsize = (qsize + PKT_IN_ALIGN);
+        cmdq->write_idx = 0;
        spin_lock_init(&cmdq->response_lock);
        spin_lock_init(&cmdq->cmdq_lock);
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index deaefd532aaa..4a362fc22f62 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -42,6 +42,16 @@
 *   Invalid flag options in AES-CCM IV.
 */
+static inline int incr_index(int index, int count, int max)
+{
+        if ((index + count) >= max)
+                index = index + count - max;
+        else
+                index += count;
+        return index;
+}
 /**
 * dma_free_sglist - unmap and free the sg lists.
 * @ndev: N5 device
@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_softreq *sr,
                          struct nitrox_cmdq *cmdq)
 {
        struct nitrox_device *ndev = sr->ndev;
-        union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell;
+        int idx;
-        u64 offset;
        u8 *ent;
        spin_lock_bh(&cmdq->cmdq_lock);
-        /* get the next write offset */
+        idx = cmdq->write_idx;
-        offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno);
-        pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset);
        /* copy the instruction */
-        ent = cmdq->head + pkt_in_baoff_dbell.s.aoff;
+        ent = cmdq->head + (idx * cmdq->instr_size);
        memcpy(ent, &sr->instr, cmdq->instr_size);
-        /* flush the command queue updates */
-        dma_wmb();
-        sr->tstamp = jiffies;
        atomic_set(&sr->status, REQ_POSTED);
        response_list_add(sr, cmdq);
+        sr->tstamp = jiffies;
+        /* flush the command queue updates */
+        dma_wmb();
        /* Ring doorbell with count 1 */
        writeq(1, cmdq->dbell_csr_addr);
        /* orders the doorbell rings */
        mmiowb();
+        cmdq->write_idx = incr_index(idx, 1, ndev->qlen);
        spin_unlock_bh(&cmdq->cmdq_lock);
 }
@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
        struct nitrox_softreq *sr, *tmp;
        int ret = 0;
+        if (!atomic_read(&cmdq->backlog_count))
+                return 0;
        spin_lock_bh(&cmdq->backlog_lock);
        list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) {
@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitrox_cmdq *cmdq)
                /* submit until space available */
                if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
-                        ret = -EBUSY;
+                        ret = -ENOSPC;
                        break;
                }
                /* delete from backlog list */
@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct nitrox_softreq *sr)
 {
        struct nitrox_cmdq *cmdq = sr->cmdq;
        struct nitrox_device *ndev = sr->ndev;
-        int ret = -EBUSY;
+        /* try to post backlog requests */
+        post_backlog_cmds(cmdq);
        if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
                if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG))
-                        return -EAGAIN;
+                        return -ENOSPC;
+                /* add to backlog list */
                backlog_list_add(sr, cmdq);
-        } else {
+                return -EBUSY;
-                ret = post_backlog_cmds(cmdq);
-                if (ret) {
-                        backlog_list_add(sr, cmdq);
-                        return ret;
-                }
-                post_se_instr(sr, cmdq);
-                ret = -EINPROGRESS;
        }
-        return ret;
+        post_se_instr(sr, cmdq);
+        return -EINPROGRESS;
 }
 /**
@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nitrox_device *ndev,
         */
        sr->instr.fdata[0] = *((u64 *)&req->gph);
        sr->instr.fdata[1] = 0;
-        /* flush the soft_req changes before posting the cmd */
-        wmb();
        ret = nitrox_enqueue_request(sr);
-        if (ret == -EAGAIN)
+        if (ret == -ENOSPC)
                goto send_fail;
        return ret;
diff --git a/drivers/crypto/chelsio/chtls/chtls.h b/drivers/crypto/chelsio/chtls/chtls.h
index a53a0e6ba024..7725b6ee14ef 100644
--- a/drivers/crypto/chelsio/chtls/chtls.h
+++ b/drivers/crypto/chelsio/chtls/chtls.h
@@ -96,6 +96,10 @@ enum csk_flags {
        CSK_CONN_INLINE,        /* Connection on HW */
 };
+enum chtls_cdev_state {
+        CHTLS_CDEV_STATE_UP = 1
+};
 struct listen_ctx {
        struct sock *lsk;
        struct chtls_dev *cdev;
@@ -146,6 +150,7 @@ struct chtls_dev {
        unsigned int send_page_order;
        int max_host_sndbuf;
        struct key_map kmap;
+        unsigned int cdev_state;
 };
 struct chtls_hws {
diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c
index 9b07f9165658..f59b044ebd25 100644
--- a/drivers/crypto/chelsio/chtls/chtls_main.c
+++ b/drivers/crypto/chelsio/chtls/chtls_main.c
@@ -160,6 +160,7 @@ static void chtls_register_dev(struct chtls_dev *cdev)
        tlsdev->hash = chtls_create_hash;
        tlsdev->unhash = chtls_destroy_hash;
        tls_register_device(&cdev->tlsdev);
+        cdev->cdev_state = CHTLS_CDEV_STATE_UP;
 }
 static void chtls_unregister_dev(struct chtls_dev *cdev)
@@ -281,8 +282,10 @@ static void chtls_free_all_uld(void)
        struct chtls_dev *cdev, *tmp;
        mutex_lock(&cdev_mutex);
-        list_for_each_entry_safe(cdev, tmp, &cdev_list, list)
+        list_for_each_entry_safe(cdev, tmp, &cdev_list, list) {
-                chtls_free_uld(cdev);
+                if (cdev->cdev_state == CHTLS_CDEV_STATE_UP)
+                        chtls_free_uld(cdev);
+        }
        mutex_unlock(&cdev_mutex);
 }
diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
index 5285ece4f33a..b71895871be3 100644
--- a/drivers/crypto/vmx/aes_cbc.c
+++ b/drivers/crypto/vmx/aes_cbc.c
@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc,
                ret = crypto_skcipher_encrypt(req);
                skcipher_request_zero(req);
        } else {
-                preempt_disable();
-                pagefault_disable();
-                enable_kernel_vsx();
                blkcipher_walk_init(&walk, dst, src, nbytes);
                ret = blkcipher_walk_virt(desc, &walk);
                while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                        aes_p8_cbc_encrypt(walk.src.virt.addr,
                                           walk.dst.virt.addr,
                                           nbytes & AES_BLOCK_MASK,
                                           &ctx->enc_key, walk.iv, 1);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
                        nbytes &= AES_BLOCK_SIZE - 1;
                        ret = blkcipher_walk_done(desc, &walk, nbytes);
                }
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
        }
        return ret;
@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc,
                ret = crypto_skcipher_decrypt(req);
                skcipher_request_zero(req);
        } else {
-                preempt_disable();
-                pagefault_disable();
-                enable_kernel_vsx();
                blkcipher_walk_init(&walk, dst, src, nbytes);
                ret = blkcipher_walk_virt(desc, &walk);
                while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                        aes_p8_cbc_encrypt(walk.src.virt.addr,
                                           walk.dst.virt.addr,
                                           nbytes & AES_BLOCK_MASK,
                                           &ctx->dec_key, walk.iv, 0);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
                        nbytes &= AES_BLOCK_SIZE - 1;
                        ret = blkcipher_walk_done(desc, &walk, nbytes);
                }
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
        }
        return ret;
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index 8bd9aff0f55f..e9954a7d4694 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
                ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
                skcipher_request_zero(req);
        } else {
+                blkcipher_walk_init(&walk, dst, src, nbytes);
+                ret = blkcipher_walk_virt(desc, &walk);
                preempt_disable();
                pagefault_disable();
                enable_kernel_vsx();
-                blkcipher_walk_init(&walk, dst, src, nbytes);
-                ret = blkcipher_walk_virt(desc, &walk);
                iv = walk.iv;
                memset(tweak, 0, AES_BLOCK_SIZE);
                aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
+                disable_kernel_vsx();
+                pagefault_enable();
+                preempt_enable();
                while ((nbytes = walk.nbytes)) {
+                        preempt_disable();
+                        pagefault_disable();
+                        enable_kernel_vsx();
                        if (enc)
                                aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
                                                nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak);
                        else
                                aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
                                                nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak);
+                        disable_kernel_vsx();
+                        pagefault_enable();
+                        preempt_enable();
                        nbytes &= AES_BLOCK_SIZE - 1;
                        ret = blkcipher_walk_done(desc, &walk, nbytes);
                }
-                disable_kernel_vsx();
-                pagefault_enable();
-                preempt_enable();
        }
        return ret;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 502b94fb116a..b6e9df11115d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -1012,13 +1012,9 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
                if (r)
                        return r;
-                if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) {
+                if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE)
-                        parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT;
+                        parser->job->preamble_status |=
-                        if (!parser->ctx->preamble_presented) {
+                                AMDGPU_PREAMBLE_IB_PRESENT;
-                                parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
-                                parser->ctx->preamble_presented = true;
-                        }
-                }
                if (parser->ring && parser->ring != ring)
                        return -EINVAL;
@@ -1207,26 +1203,24 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
        int r;
+        job = p->job;
+        p->job = NULL;
+        r = drm_sched_job_init(&job->base, entity, p->filp);
+        if (r)
+                goto error_unlock;
+        /* No memory allocation is allowed while holding the mn lock */
        amdgpu_mn_lock(p->mn);
        amdgpu_bo_list_for_each_userptr_entry(e, p->bo_list) {
                struct amdgpu_bo *bo = e->robj;
                if (amdgpu_ttm_tt_userptr_needs_pages(bo->tbo.ttm)) {
-                        amdgpu_mn_unlock(p->mn);
+                        r = -ERESTARTSYS;
-                        return -ERESTARTSYS;
+                        goto error_abort;
                }
        }
-        job = p->job;
-        p->job = NULL;
-        r = drm_sched_job_init(&job->base, entity, p->filp);
-        if (r) {
-                amdgpu_job_free(job);
-                amdgpu_mn_unlock(p->mn);
-                return r;
-        }
        job->owner = p->filp;
        p->fence = dma_fence_get(&job->base.s_fence->finished);
@@ -1241,6 +1235,12 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
        amdgpu_cs_post_dependencies(p);
+        if ((job->preamble_status & AMDGPU_PREAMBLE_IB_PRESENT) &&
+            !p->ctx->preamble_presented) {
+                job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
+                p->ctx->preamble_presented = true;
+        }
        cs->out.handle = seq;
        job->uf_sequence = seq;
@@ -1258,6 +1258,15 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
        amdgpu_mn_unlock(p->mn);
        return 0;
+error_abort:
+        dma_fence_put(&job->base.s_fence->finished);
+        job->base.s_fence = NULL;
+error_unlock:
+        amdgpu_job_free(job);
+        amdgpu_mn_unlock(p->mn);
+        return r;
 }
 int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index 5518e623fed2..51b5e977ca88 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -164,8 +164,10 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
                return r;
        }
+        need_ctx_switch = ring->current_ctx != fence_ctx;
        if (ring->funcs->emit_pipeline_sync && job &&
            ((tmp = amdgpu_sync_get_fence(&job->sched_sync, NULL)) ||
+             (amdgpu_sriov_vf(adev) && need_ctx_switch) ||
             amdgpu_vm_need_pipeline_sync(ring, job))) {
                need_pipe_sync = true;
                dma_fence_put(tmp);
@@ -196,7 +198,6 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
        }
        skip_preamble = ring->current_ctx == fence_ctx;
-        need_ctx_switch = ring->current_ctx != fence_ctx;
        if (job && ring->funcs->emit_cntxcntl) {
                if (need_ctx_switch)
                        status |= AMDGPU_HAVE_CTX_SWITCH;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 8f98629fbe59..7b4e657a95c7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1932,14 +1932,6 @@ void amdgpu_pm_compute_clocks(struct amdgpu_device *adev)
                        amdgpu_fence_wait_empty(ring);
        }
-        mutex_lock(&adev->pm.mutex);
-        /* update battery/ac status */
-        if (power_supply_is_system_supplied() > 0)
-                adev->pm.ac_power = true;
-        else
-                adev->pm.ac_power = false;
-        mutex_unlock(&adev->pm.mutex);
        if (adev->powerplay.pp_funcs->dispatch_tasks) {
                if (!amdgpu_device_has_dc_support(adev)) {
                        mutex_lock(&adev->pm.mutex);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index ece0ac703e27..b17771dd5ce7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -172,6 +172,7 @@ static void amdgpu_vm_bo_base_init(struct amdgpu_vm_bo_base *base,
         * is validated on next vm use to avoid fault.
         * */
        list_move_tail(&base->vm_status, &vm->evicted);
+        base->moved = true;
 }
 /**
@@ -369,7 +370,6 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
        uint64_t addr;
        int r;
-        addr = amdgpu_bo_gpu_offset(bo);
        entries = amdgpu_bo_size(bo) / 8;
        if (pte_support_ats) {
@@ -401,6 +401,7 @@ static int amdgpu_vm_clear_bo(struct amdgpu_device *adev,
        if (r)
                goto error;
+        addr = amdgpu_bo_gpu_offset(bo);
        if (ats_entries) {
                uint64_t ats_value;
@@ -2483,28 +2484,52 @@ static uint32_t amdgpu_vm_get_block_size(uint64_t vm_size)
 * amdgpu_vm_adjust_size - adjust vm size, block size and fragment size
 *
 * @adev: amdgpu_device pointer
- * @vm_size: the default vm size if it's set auto
+ * @min_vm_size: the minimum vm size in GB if it's set auto
 * @fragment_size_default: Default PTE fragment size
 * @max_level: max VMPT level
 * @max_bits: max address space size in bits
 *
 */
-void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t vm_size,
+void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
                           uint32_t fragment_size_default, unsigned max_level,
                           unsigned max_bits)
 {
+        unsigned int max_size = 1 << (max_bits - 30);
+        unsigned int vm_size;
        uint64_t tmp;
        /* adjust vm size first */
        if (amdgpu_vm_size != -1) {
-                unsigned max_size = 1 << (max_bits - 30);
                vm_size = amdgpu_vm_size;
                if (vm_size > max_size) {
                        dev_warn(adev->dev, "VM size (%d) too large, max is %u GB\n",
                                 amdgpu_vm_size, max_size);
                        vm_size = max_size;
                }
+        } else {
+                struct sysinfo si;
+                unsigned int phys_ram_gb;
+                /* Optimal VM size depends on the amount of physical
+                 * RAM available. Underlying requirements and
+                 * assumptions:
+                 *
+                 *  - Need to map system memory and VRAM from all GPUs
+                 *     - VRAM from other GPUs not known here
+                 *     - Assume VRAM <= system memory
+                 *  - On GFX8 and older, VM space can be segmented for
+                 *    different MTYPEs
+                 *  - Need to allow room for fragmentation, guard pages etc.
+                 *
+                 * This adds up to a rough guess of system memory x3.
+                 * Round up to power of two to maximize the available
+                 * VM size with the given page table size.
+                 */
+                si_meminfo(&si);
+                phys_ram_gb = ((uint64_t)si.totalram * si.mem_unit +
+                               (1 << 30) - 1) >> 30;
+                vm_size = roundup_pow_of_two(
+                        min(max(phys_ram_gb * 3, min_vm_size), max_size));
        }
        adev->vm_manager.max_pfn = (uint64_t)vm_size << 18;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index 67a15d439ac0..9fa9df0c5e7f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -321,7 +321,7 @@ struct amdgpu_bo_va_mapping *amdgpu_vm_bo_lookup_mapping(struct amdgpu_vm *vm,
 void amdgpu_vm_bo_trace_cs(struct amdgpu_vm *vm, struct ww_acquire_ctx *ticket);
 void amdgpu_vm_bo_rmv(struct amdgpu_device *adev,
                      struct amdgpu_bo_va *bo_va);
-void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t vm_size,
+void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
                           uint32_t fragment_size_default, unsigned max_level,
                           unsigned max_bits);
 int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 5cd45210113f..5a9534a82d40 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -5664,6 +5664,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
        if (amdgpu_sriov_vf(adev))
                return 0;
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+                                AMD_PG_SUPPORT_RLC_SMU_HS |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_GFX_DMG))
+                adev->gfx.rlc.funcs->enter_safe_mode(adev);
        switch (adev->asic_type) {
        case CHIP_CARRIZO:
        case CHIP_STONEY:
@@ -5713,7 +5718,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
        default:
                break;
        }
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
+                                AMD_PG_SUPPORT_RLC_SMU_HS |
+                                AMD_PG_SUPPORT_CP |
+                                AMD_PG_SUPPORT_GFX_DMG))
+                adev->gfx.rlc.funcs->exit_safe_mode(adev);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 75317f283c69..ad151fefa41f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -632,12 +632,6 @@ static void gmc_v6_0_gart_disable(struct amdgpu_device *adev)
        amdgpu_gart_table_vram_unpin(adev);
 }
-static void gmc_v6_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
 static void gmc_v6_0_vm_decode_fault(struct amdgpu_device *adev,
                                     u32 status, u32 addr, u32 mc_client)
 {
@@ -935,8 +929,9 @@ static int gmc_v6_0_sw_fini(void *handle)
        amdgpu_gem_force_release(adev);
        amdgpu_vm_manager_fini(adev);
-        gmc_v6_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
        amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
        release_firmware(adev->gmc.fw);
        adev->gmc.fw = NULL;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 36dc367c4b45..f8d8a3a73e42 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -747,19 +747,6 @@ static void gmc_v7_0_gart_disable(struct amdgpu_device *adev)
 }
 /**
- * gmc_v7_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v7_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-/**
 * gmc_v7_0_vm_decode_fault - print human readable fault info
 *
 * @adev: amdgpu_device pointer
@@ -1095,8 +1082,9 @@ static int gmc_v7_0_sw_fini(void *handle)
        amdgpu_gem_force_release(adev);
        amdgpu_vm_manager_fini(adev);
        kfree(adev->gmc.vm_fault_info);
-        gmc_v7_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
        amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
        release_firmware(adev->gmc.fw);
        adev->gmc.fw = NULL;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 70fc97b59b4f..9333109b210d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -969,19 +969,6 @@ static void gmc_v8_0_gart_disable(struct amdgpu_device *adev)
 }
 /**
- * gmc_v8_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v8_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
-/**
 * gmc_v8_0_vm_decode_fault - print human readable fault info
 *
 * @adev: amdgpu_device pointer
@@ -1199,8 +1186,9 @@ static int gmc_v8_0_sw_fini(void *handle)
        amdgpu_gem_force_release(adev);
        amdgpu_vm_manager_fini(adev);
        kfree(adev->gmc.vm_fault_info);
-        gmc_v8_0_gart_fini(adev);
+        amdgpu_gart_table_vram_free(adev);
        amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
        release_firmware(adev->gmc.fw);
        adev->gmc.fw = NULL;
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 399a5db27649..72f8018fa2a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -942,26 +942,12 @@ static int gmc_v9_0_sw_init(void *handle)
        return 0;
 }
-/**
- * gmc_v9_0_gart_fini - vm fini callback
- *
- * @adev: amdgpu_device pointer
- *
- * Tears down the driver GART/VM setup (CIK).
- */
-static void gmc_v9_0_gart_fini(struct amdgpu_device *adev)
-{
-        amdgpu_gart_table_vram_free(adev);
-        amdgpu_gart_fini(adev);
-}
 static int gmc_v9_0_sw_fini(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        amdgpu_gem_force_release(adev);
        amdgpu_vm_manager_fini(adev);
-        gmc_v9_0_gart_fini(adev);
        /*
        * TODO:
@@ -974,7 +960,9 @@ static int gmc_v9_0_sw_fini(void *handle)
        */
        amdgpu_bo_free_kernel(&adev->stolen_vga_memory, NULL, NULL);
+        amdgpu_gart_table_vram_free(adev);
        amdgpu_bo_fini(adev);
+        amdgpu_gart_fini(adev);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 3f57f6463dc8..cb79a93c2eb7 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -65,8 +65,6 @@ static int kv_set_thermal_temperature_range(struct amdgpu_device *adev,
                                            int min_temp, int max_temp);
 static int kv_init_fps_limits(struct amdgpu_device *adev);
-static void kv_dpm_powergate_uvd(void *handle, bool gate);
-static void kv_dpm_powergate_vce(struct amdgpu_device *adev, bool gate);
 static void kv_dpm_powergate_samu(struct amdgpu_device *adev, bool gate);
 static void kv_dpm_powergate_acp(struct amdgpu_device *adev, bool gate);
@@ -1354,8 +1352,6 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
                return ret;
        }
-        kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
        if (adev->irq.installed &&
            amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
                ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
@@ -1374,6 +1370,8 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
 static void kv_dpm_disable(struct amdgpu_device *adev)
 {
+        struct kv_power_info *pi = kv_get_pi(adev);
        amdgpu_irq_put(adev, &adev->pm.dpm.thermal.irq,
                       AMDGPU_THERMAL_IRQ_LOW_TO_HIGH);
        amdgpu_irq_put(adev, &adev->pm.dpm.thermal.irq,
@@ -1387,8 +1385,10 @@ static void kv_dpm_disable(struct amdgpu_device *adev)
        /* powerup blocks */
        kv_dpm_powergate_acp(adev, false);
        kv_dpm_powergate_samu(adev, false);
-        kv_dpm_powergate_vce(adev, false);
+        if (pi->caps_vce_pg) /* power on the VCE block */
-        kv_dpm_powergate_uvd(adev, false);
+                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+        if (pi->caps_uvd_pg) /* power on the UVD block */
+                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_UVDPowerON);
        kv_enable_smc_cac(adev, false);
        kv_enable_didt(adev, false);
@@ -1551,7 +1551,6 @@ static int kv_update_vce_dpm(struct amdgpu_device *adev,
        int ret;
        if (amdgpu_new_state->evclk > 0 && amdgpu_current_state->evclk == 0) {
-                kv_dpm_powergate_vce(adev, false);
                if (pi->caps_stable_p_state)
                        pi->vce_boot_level = table->count - 1;
                else
@@ -1573,7 +1572,6 @@ static int kv_update_vce_dpm(struct amdgpu_device *adev,
                kv_enable_vce_dpm(adev, true);
        } else if (amdgpu_new_state->evclk == 0 && amdgpu_current_state->evclk > 0) {
                kv_enable_vce_dpm(adev, false);
-                kv_dpm_powergate_vce(adev, true);
        }
        return 0;
@@ -1702,24 +1700,32 @@ static void kv_dpm_powergate_uvd(void *handle, bool gate)
        }
 }
-static void kv_dpm_powergate_vce(struct amdgpu_device *adev, bool gate)
+static void kv_dpm_powergate_vce(void *handle, bool gate)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
        struct kv_power_info *pi = kv_get_pi(adev);
+        int ret;
-        if (pi->vce_power_gated == gate)
-                return;
        pi->vce_power_gated = gate;
-        if (!pi->caps_vce_pg)
+        if (gate) {
-                return;
+                /* stop the VCE block */
+                ret = amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
-        if (gate)
+                                                             AMD_PG_STATE_GATE);
-                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerOFF);
+                kv_enable_vce_dpm(adev, false);
-        else
+                if (pi->caps_vce_pg) /* power off the VCE block */
-                amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+                        amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerOFF);
+        } else {
+                if (pi->caps_vce_pg) /* power on the VCE block */
+                        amdgpu_kv_notify_message_to_smu(adev, PPSMC_MSG_VCEPowerON);
+                kv_enable_vce_dpm(adev, true);
+                /* re-init the VCE block */
+                ret = amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
+                                                             AMD_PG_STATE_UNGATE);
+        }
 }
 static void kv_dpm_powergate_samu(struct amdgpu_device *adev, bool gate)
 {
        struct kv_power_info *pi = kv_get_pi(adev);
@@ -3061,7 +3067,7 @@ static int kv_dpm_hw_init(void *handle)
        else
                adev->pm.dpm_enabled = true;
        mutex_unlock(&adev->pm.mutex);
+        amdgpu_pm_compute_clocks(adev);
        return ret;
 }
@@ -3313,6 +3319,9 @@ static int kv_set_powergating_by_smu(void *handle,
        case AMD_IP_BLOCK_TYPE_UVD:
                kv_dpm_powergate_uvd(handle, gate);
                break;
+        case AMD_IP_BLOCK_TYPE_VCE:
+                kv_dpm_powergate_vce(handle, gate);
+                break;
        default:
                break;
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index db327b412562..1de96995e690 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -6887,7 +6887,6 @@ static int si_dpm_enable(struct amdgpu_device *adev)
        si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
        si_thermal_start_thermal_controller(adev);
-        ni_update_current_ps(adev, boot_ps);
        return 0;
 }
@@ -7763,7 +7762,7 @@ static int si_dpm_hw_init(void *handle)
        else
                adev->pm.dpm_enabled = true;
        mutex_unlock(&adev->pm.mutex);
+        amdgpu_pm_compute_clocks(adev);
        return ret;
 }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
index fbe878ae1e8c..4ba0003a9d32 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c
@@ -480,12 +480,20 @@ void pp_rv_set_display_requirement(struct pp_smu *pp,
 {
        struct dc_context *ctx = pp->ctx;
        struct amdgpu_device *adev = ctx->driver_context;
+        void *pp_handle = adev->powerplay.pp_handle;
        const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
+        struct pp_display_clock_request clock = {0};
-        if (!pp_funcs || !pp_funcs->display_configuration_changed)
+        if (!pp_funcs || !pp_funcs->display_clock_voltage_request)
                return;
-        amdgpu_dpm_display_configuration_changed(adev);
+        clock.clock_type = amd_pp_dcf_clock;
+        clock.clock_freq_in_khz = req->hard_min_dcefclk_khz;
+        pp_funcs->display_clock_voltage_request(pp_handle, &clock);
+        clock.clock_type = amd_pp_f_clock;
+        clock.clock_freq_in_khz = req->hard_min_fclk_khz;
+        pp_funcs->display_clock_voltage_request(pp_handle, &clock);
 }
 void pp_rv_set_wm_ranges(struct pp_smu *pp,
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 567867915d32..37eaf72ace54 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -754,8 +754,12 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
                         * fail-safe mode
                         */
                        if (dc_is_hdmi_signal(link->connector_signal) ||
-                            dc_is_dvi_signal(link->connector_signal))
+                            dc_is_dvi_signal(link->connector_signal)) {
+                                if (prev_sink != NULL)
+                                        dc_sink_release(prev_sink);
                                return false;
+                        }
                default:
                        break;
                }
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 11d834f94220..98358b4b36de 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -199,7 +199,6 @@ vma_create(struct drm_i915_gem_object *obj,
                vma->flags |= I915_VMA_GGTT;
                list_add(&vma->obj_link, &obj->vma_list);
        } else {
-                i915_ppgtt_get(i915_vm_to_ppgtt(vm));
                list_add_tail(&vma->obj_link, &obj->vma_list);
        }
@@ -807,9 +806,6 @@ static void __i915_vma_destroy(struct i915_vma *vma)
        if (vma->obj)
                rb_erase(&vma->obj_node, &vma->obj->vma_tree);
-        if (!i915_vma_is_ggtt(vma))
-                i915_ppgtt_put(i915_vm_to_ppgtt(vma->vm));
        rbtree_postorder_for_each_entry_safe(iter, n, &vma->active, node) {
                GEM_BUG_ON(i915_gem_active_isset(&iter->base));
                kfree(iter);
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index b725835b47ef..769f3f586661 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -962,9 +962,6 @@ void i915_audio_component_init(struct drm_i915_private *dev_priv)
 {
        int ret;
-        if (INTEL_INFO(dev_priv)->num_pipes == 0)
-                return;
        ret = component_add(dev_priv->drm.dev, &i915_audio_component_bind_ops);
        if (ret < 0) {
                DRM_ERROR("failed to add audio component (%d)\n", ret);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index ed3fa1c8a983..4a3c8ee9a973 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2988,6 +2988,7 @@ static int skl_check_main_surface(const struct intel_crtc_state *crtc_state,
        int w = drm_rect_width(&plane_state->base.src) >> 16;
        int h = drm_rect_height(&plane_state->base.src) >> 16;
        int dst_x = plane_state->base.dst.x1;
+        int dst_w = drm_rect_width(&plane_state->base.dst);
        int pipe_src_w = crtc_state->pipe_src_w;
        int max_width = skl_max_plane_width(fb, 0, rotation);
        int max_height = 4096;
@@ -3009,10 +3010,10 @@ static int skl_check_main_surface(const struct intel_crtc_state *crtc_state,
         * screen may cause FIFO underflow and display corruption.
         */
        if ((IS_GEMINILAKE(dev_priv) || IS_CANNONLAKE(dev_priv)) &&
-            (dst_x + w < 4 || dst_x > pipe_src_w - 4)) {
+            (dst_x + dst_w < 4 || dst_x > pipe_src_w - 4)) {
                DRM_DEBUG_KMS("requested plane X %s position %d invalid (valid range %d-%d)\n",
-                              dst_x + w < 4 ? "end" : "start",
+                              dst_x + dst_w < 4 ? "end" : "start",
-                              dst_x + w < 4 ? dst_x + w : dst_x,
+                              dst_x + dst_w < 4 ? dst_x + dst_w : dst_x,
                              4, pipe_src_w - 4);
                return -ERANGE;
        }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index a9076402dcb0..192972a7d287 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -943,8 +943,12 @@ static int intel_hdmi_hdcp_write(struct intel_digital_port *intel_dig_port,
        ret = i2c_transfer(adapter, &msg, 1);
        if (ret == 1)
-                return 0;
+                ret = 0;
-        return ret >= 0 ? -EIO : ret;
+        else if (ret >= 0)
+                ret = -EIO;
+        kfree(write_buf);
+        return ret;
 }
 static
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 5dae16ccd9f1..3e085c5f2b81 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -74,7 +74,7 @@ static enum drm_lspcon_mode lspcon_wait_mode(struct intel_lspcon *lspcon,
        DRM_DEBUG_KMS("Waiting for LSPCON mode %s to settle\n",
                      lspcon_mode_name(mode));
-        wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 100);
+        wait_for((current_mode = lspcon_get_current_mode(lspcon)) == mode, 400);
        if (current_mode != mode)
                DRM_ERROR("LSPCON mode hasn't settled\n");
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index 978782a77629..28d191192945 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -132,6 +132,11 @@ static void mtk_ovl_config(struct mtk_ddp_comp *comp, unsigned int w,
        writel(0x0, comp->regs + DISP_REG_OVL_RST);
 }
+static unsigned int mtk_ovl_layer_nr(struct mtk_ddp_comp *comp)
+{
+        return 4;
+}
 static void mtk_ovl_layer_on(struct mtk_ddp_comp *comp, unsigned int idx)
 {
        unsigned int reg;
@@ -157,6 +162,11 @@ static void mtk_ovl_layer_off(struct mtk_ddp_comp *comp, unsigned int idx)
 static unsigned int ovl_fmt_convert(struct mtk_disp_ovl *ovl, unsigned int fmt)
 {
+        /* The return value in switch "MEM_MODE_INPUT_FORMAT_XXX"
+         * is defined in mediatek HW data sheet.
+         * The alphabet order in XXX is no relation to data
+         * arrangement in memory.
+         */
        switch (fmt) {
        default:
        case DRM_FORMAT_RGB565:
@@ -221,6 +231,7 @@ static const struct mtk_ddp_comp_funcs mtk_disp_ovl_funcs = {
        .stop = mtk_ovl_stop,
        .enable_vblank = mtk_ovl_enable_vblank,
        .disable_vblank = mtk_ovl_disable_vblank,
+        .layer_nr = mtk_ovl_layer_nr,
        .layer_on = mtk_ovl_layer_on,
        .layer_off = mtk_ovl_layer_off,
        .layer_config = mtk_ovl_layer_config,
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
index 585943c81e1f..b0a5cffe345a 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_rdma.c
@@ -31,14 +31,31 @@
 #define RDMA_REG_UPDATE_INT                             BIT(0)
 #define DISP_REG_RDMA_GLOBAL_CON                0x0010
 #define RDMA_ENGINE_EN                                  BIT(0)
+#define RDMA_MODE_MEMORY                                BIT(1)
 #define DISP_REG_RDMA_SIZE_CON_0                0x0014
+#define RDMA_MATRIX_ENABLE                              BIT(17)
+#define RDMA_MATRIX_INT_MTX_SEL                         GENMASK(23, 20)
+#define RDMA_MATRIX_INT_MTX_BT601_to_RGB                (6 << 20)
 #define DISP_REG_RDMA_SIZE_CON_1                0x0018
 #define DISP_REG_RDMA_TARGET_LINE               0x001c
+#define DISP_RDMA_MEM_CON                       0x0024
+#define MEM_MODE_INPUT_FORMAT_RGB565                    (0x000 << 4)
+#define MEM_MODE_INPUT_FORMAT_RGB888                    (0x001 << 4)
+#define MEM_MODE_INPUT_FORMAT_RGBA8888                  (0x002 << 4)
+#define MEM_MODE_INPUT_FORMAT_ARGB8888                  (0x003 << 4)
+#define MEM_MODE_INPUT_FORMAT_UYVY                      (0x004 << 4)
+#define MEM_MODE_INPUT_FORMAT_YUYV                      (0x005 << 4)
+#define MEM_MODE_INPUT_SWAP                             BIT(8)
+#define DISP_RDMA_MEM_SRC_PITCH                 0x002c
+#define DISP_RDMA_MEM_GMC_SETTING_0             0x0030
 #define DISP_REG_RDMA_FIFO_CON                  0x0040
 #define RDMA_FIFO_UNDERFLOW_EN                          BIT(31)
 #define RDMA_FIFO_PSEUDO_SIZE(bytes)                    (((bytes) / 16) << 16)
 #define RDMA_OUTPUT_VALID_FIFO_THRESHOLD(bytes)         ((bytes) / 16)
 #define RDMA_FIFO_SIZE(rdma)                    ((rdma)->data->fifo_size)
+#define DISP_RDMA_MEM_START_ADDR                0x0f00
+#define RDMA_MEM_GMC                            0x40402020
 struct mtk_disp_rdma_data {
        unsigned int fifo_size;
@@ -138,12 +155,87 @@ static void mtk_rdma_config(struct mtk_ddp_comp *comp, unsigned int width,
        writel(reg, comp->regs + DISP_REG_RDMA_FIFO_CON);
 }
+static unsigned int rdma_fmt_convert(struct mtk_disp_rdma *rdma,
+                                     unsigned int fmt)
+{
+        /* The return value in switch "MEM_MODE_INPUT_FORMAT_XXX"
+         * is defined in mediatek HW data sheet.
+         * The alphabet order in XXX is no relation to data
+         * arrangement in memory.
+         */
+        switch (fmt) {
+        default:
+        case DRM_FORMAT_RGB565:
+                return MEM_MODE_INPUT_FORMAT_RGB565;
+        case DRM_FORMAT_BGR565:
+                return MEM_MODE_INPUT_FORMAT_RGB565 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_RGB888:
+                return MEM_MODE_INPUT_FORMAT_RGB888;
+        case DRM_FORMAT_BGR888:
+                return MEM_MODE_INPUT_FORMAT_RGB888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_RGBX8888:
+        case DRM_FORMAT_RGBA8888:
+                return MEM_MODE_INPUT_FORMAT_ARGB8888;
+        case DRM_FORMAT_BGRX8888:
+        case DRM_FORMAT_BGRA8888:
+                return MEM_MODE_INPUT_FORMAT_ARGB8888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_XRGB8888:
+        case DRM_FORMAT_ARGB8888:
+                return MEM_MODE_INPUT_FORMAT_RGBA8888;
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
+                return MEM_MODE_INPUT_FORMAT_RGBA8888 | MEM_MODE_INPUT_SWAP;
+        case DRM_FORMAT_UYVY:
+                return MEM_MODE_INPUT_FORMAT_UYVY;
+        case DRM_FORMAT_YUYV:
+                return MEM_MODE_INPUT_FORMAT_YUYV;
+        }
+}
+static unsigned int mtk_rdma_layer_nr(struct mtk_ddp_comp *comp)
+{
+        return 1;
+}
+static void mtk_rdma_layer_config(struct mtk_ddp_comp *comp, unsigned int idx,
+                                  struct mtk_plane_state *state)
+{
+        struct mtk_disp_rdma *rdma = comp_to_rdma(comp);
+        struct mtk_plane_pending_state *pending = &state->pending;
+        unsigned int addr = pending->addr;
+        unsigned int pitch = pending->pitch & 0xffff;
+        unsigned int fmt = pending->format;
+        unsigned int con;
+        con = rdma_fmt_convert(rdma, fmt);
+        writel_relaxed(con, comp->regs + DISP_RDMA_MEM_CON);
+        if (fmt == DRM_FORMAT_UYVY || fmt == DRM_FORMAT_YUYV) {
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_ENABLE, RDMA_MATRIX_ENABLE);
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_INT_MTX_SEL,
+                                 RDMA_MATRIX_INT_MTX_BT601_to_RGB);
+        } else {
+                rdma_update_bits(comp, DISP_REG_RDMA_SIZE_CON_0,
+                                 RDMA_MATRIX_ENABLE, 0);
+        }
+        writel_relaxed(addr, comp->regs + DISP_RDMA_MEM_START_ADDR);
+        writel_relaxed(pitch, comp->regs + DISP_RDMA_MEM_SRC_PITCH);
+        writel(RDMA_MEM_GMC, comp->regs + DISP_RDMA_MEM_GMC_SETTING_0);
+        rdma_update_bits(comp, DISP_REG_RDMA_GLOBAL_CON,
+                         RDMA_MODE_MEMORY, RDMA_MODE_MEMORY);
+}
 static const struct mtk_ddp_comp_funcs mtk_disp_rdma_funcs = {
        .config = mtk_rdma_config,
        .start = mtk_rdma_start,
        .stop = mtk_rdma_stop,
        .enable_vblank = mtk_rdma_enable_vblank,
        .disable_vblank = mtk_rdma_disable_vblank,
+        .layer_nr = mtk_rdma_layer_nr,
+        .layer_config = mtk_rdma_layer_config,
 };
 static int mtk_disp_rdma_bind(struct device *dev, struct device *master,
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 2d6aa150a9ff..0b976dfd04df 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -45,7 +45,8 @@ struct mtk_drm_crtc {
        bool                            pending_needs_vblank;
        struct drm_pending_vblank_event *event;
-        struct drm_plane                planes[OVL_LAYER_NR];
+        struct drm_plane                *planes;
+        unsigned int                    layer_nr;
        bool                            pending_planes;
        void __iomem                    *config_regs;
@@ -171,9 +172,9 @@ static void mtk_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
 static int mtk_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
-        mtk_ddp_comp_enable_vblank(ovl, &mtk_crtc->base);
+        mtk_ddp_comp_enable_vblank(comp, &mtk_crtc->base);
        return 0;
 }
@@ -181,9 +182,9 @@ static int mtk_drm_crtc_enable_vblank(struct drm_crtc *crtc)
 static void mtk_drm_crtc_disable_vblank(struct drm_crtc *crtc)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
-        mtk_ddp_comp_disable_vblank(ovl);
+        mtk_ddp_comp_disable_vblank(comp);
 }
 static int mtk_crtc_ddp_clk_enable(struct mtk_drm_crtc *mtk_crtc)
@@ -286,7 +287,7 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc)
        }
        /* Initially configure all planes */
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                struct drm_plane *plane = &mtk_crtc->planes[i];
                struct mtk_plane_state *plane_state;
@@ -334,7 +335,7 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
        struct mtk_crtc_state *state = to_mtk_crtc_state(mtk_crtc->base.state);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
        unsigned int i;
        /*
@@ -343,7 +344,7 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
         * queue update module registers on vblank.
         */
        if (state->pending_config) {
-                mtk_ddp_comp_config(ovl, state->pending_width,
+                mtk_ddp_comp_config(comp, state->pending_width,
                                    state->pending_height,
                                    state->pending_vrefresh, 0);
@@ -351,14 +352,14 @@ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
        }
        if (mtk_crtc->pending_planes) {
-                for (i = 0; i < OVL_LAYER_NR; i++) {
+                for (i = 0; i < mtk_crtc->layer_nr; i++) {
                        struct drm_plane *plane = &mtk_crtc->planes[i];
                        struct mtk_plane_state *plane_state;
                        plane_state = to_mtk_plane_state(plane->state);
                        if (plane_state->pending.config) {
-                                mtk_ddp_comp_layer_config(ovl, i, plane_state);
+                                mtk_ddp_comp_layer_config(comp, i, plane_state);
                                plane_state->pending.config = false;
                        }
                }
@@ -370,12 +371,12 @@ static void mtk_drm_crtc_atomic_enable(struct drm_crtc *crtc,
                                       struct drm_crtc_state *old_state)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
        int ret;
        DRM_DEBUG_DRIVER("%s %d\n", __func__, crtc->base.id);
-        ret = mtk_smi_larb_get(ovl->larb_dev);
+        ret = mtk_smi_larb_get(comp->larb_dev);
        if (ret) {
                DRM_ERROR("Failed to get larb: %d\n", ret);
                return;
@@ -383,7 +384,7 @@ static void mtk_drm_crtc_atomic_enable(struct drm_crtc *crtc,
        ret = mtk_crtc_ddp_hw_init(mtk_crtc);
        if (ret) {
-                mtk_smi_larb_put(ovl->larb_dev);
+                mtk_smi_larb_put(comp->larb_dev);
                return;
        }
@@ -395,7 +396,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
                                        struct drm_crtc_state *old_state)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
-        struct mtk_ddp_comp *ovl = mtk_crtc->ddp_comp[0];
+        struct mtk_ddp_comp *comp = mtk_crtc->ddp_comp[0];
        int i;
        DRM_DEBUG_DRIVER("%s %d\n", __func__, crtc->base.id);
@@ -403,7 +404,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
                return;
        /* Set all pending plane state to disabled */
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                struct drm_plane *plane = &mtk_crtc->planes[i];
                struct mtk_plane_state *plane_state;
@@ -418,7 +419,7 @@ static void mtk_drm_crtc_atomic_disable(struct drm_crtc *crtc,
        drm_crtc_vblank_off(crtc);
        mtk_crtc_ddp_hw_fini(mtk_crtc);
-        mtk_smi_larb_put(ovl->larb_dev);
+        mtk_smi_larb_put(comp->larb_dev);
        mtk_crtc->enabled = false;
 }
@@ -450,7 +451,7 @@ static void mtk_drm_crtc_atomic_flush(struct drm_crtc *crtc,
        if (mtk_crtc->event)
                mtk_crtc->pending_needs_vblank = true;
-        for (i = 0; i < OVL_LAYER_NR; i++) {
+        for (i = 0; i < mtk_crtc->layer_nr; i++) {
                struct drm_plane *plane = &mtk_crtc->planes[i];
                struct mtk_plane_state *plane_state;
@@ -516,7 +517,7 @@ err_cleanup_crtc:
        return ret;
 }
-void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *ovl)
+void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *comp)
 {
        struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
        struct mtk_drm_private *priv = crtc->dev->dev_private;
@@ -598,7 +599,12 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
                mtk_crtc->ddp_comp[i] = comp;
        }
-        for (zpos = 0; zpos < OVL_LAYER_NR; zpos++) {
+        mtk_crtc->layer_nr = mtk_ddp_comp_layer_nr(mtk_crtc->ddp_comp[0]);
+        mtk_crtc->planes = devm_kzalloc(dev, mtk_crtc->layer_nr *
+                                        sizeof(struct drm_plane),
+                                        GFP_KERNEL);
+        for (zpos = 0; zpos < mtk_crtc->layer_nr; zpos++) {
                type = (zpos == 0) ? DRM_PLANE_TYPE_PRIMARY :
                                (zpos == 1) ? DRM_PLANE_TYPE_CURSOR :
                                                DRM_PLANE_TYPE_OVERLAY;
@@ -609,7 +615,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
        }
        ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0],
-                                &mtk_crtc->planes[1], pipe);
+                                mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] :
+                                NULL, pipe);
        if (ret < 0)
                goto unprepare;
        drm_mode_crtc_set_gamma_size(&mtk_crtc->base, MTK_LUT_SIZE);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.h b/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
index 9d9410c67ae9..091adb2087eb 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.h
@@ -18,13 +18,12 @@
 #include "mtk_drm_ddp_comp.h"
 #include "mtk_drm_plane.h"
-#define OVL_LAYER_NR    4
 #define MTK_LUT_SIZE    512
 #define MTK_MAX_BPC     10
 #define MTK_MIN_BPC     3
 void mtk_drm_crtc_commit(struct drm_crtc *crtc);
-void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *ovl);
+void mtk_crtc_ddp_irq(struct drm_crtc *crtc, struct mtk_ddp_comp *comp);
 int mtk_drm_crtc_create(struct drm_device *drm_dev,
                        const enum mtk_ddp_comp_id *path,
                        unsigned int path_len);
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
index 87e4191c250e..546b3e3b300b 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp.c
@@ -106,6 +106,8 @@
 #define OVL1_MOUT_EN_COLOR1             0x1
 #define GAMMA_MOUT_EN_RDMA1             0x1
 #define RDMA0_SOUT_DPI0                 0x2
+#define RDMA0_SOUT_DPI1                 0x3
+#define RDMA0_SOUT_DSI1                 0x1
 #define RDMA0_SOUT_DSI2                 0x4
 #define RDMA0_SOUT_DSI3                 0x5
 #define RDMA1_SOUT_DPI0                 0x2
@@ -122,6 +124,8 @@
 #define DPI0_SEL_IN_RDMA2               0x3
 #define DPI1_SEL_IN_RDMA1               (0x1 << 8)
 #define DPI1_SEL_IN_RDMA2               (0x3 << 8)
+#define DSI0_SEL_IN_RDMA1               0x1
+#define DSI0_SEL_IN_RDMA2               0x4
 #define DSI1_SEL_IN_RDMA1               0x1
 #define DSI1_SEL_IN_RDMA2               0x4
 #define DSI2_SEL_IN_RDMA1               (0x1 << 16)
@@ -224,6 +228,12 @@ static unsigned int mtk_ddp_mout_en(enum mtk_ddp_comp_id cur,
        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DPI0) {
                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
                value = RDMA0_SOUT_DPI0;
+        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DPI1) {
+                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
+                value = RDMA0_SOUT_DPI1;
+        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DSI1) {
+                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
+                value = RDMA0_SOUT_DSI1;
        } else if (cur == DDP_COMPONENT_RDMA0 && next == DDP_COMPONENT_DSI2) {
                *addr = DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN;
                value = RDMA0_SOUT_DSI2;
@@ -282,6 +292,9 @@ static unsigned int mtk_ddp_sel_in(enum mtk_ddp_comp_id cur,
        } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DPI1) {
                *addr = DISP_REG_CONFIG_DPI_SEL_IN;
                value = DPI1_SEL_IN_RDMA1;
+        } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DSI0) {
+                *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
+                value = DSI0_SEL_IN_RDMA1;
        } else if (cur == DDP_COMPONENT_RDMA1 && next == DDP_COMPONENT_DSI1) {
                *addr = DISP_REG_CONFIG_DSIO_SEL_IN;
                value = DSI1_SEL_IN_RDMA1;
@@ -297,8 +310,11 @@ static unsigned int mtk_ddp_sel_in(enum mtk_ddp_comp_id cur,
        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DPI1) {
                *addr = DISP_REG_CONFIG_DPI_SEL_IN;
                value = DPI1_SEL_IN_RDMA2;
-        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI1) {
+        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI0) {
                *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
+                value = DSI0_SEL_IN_RDMA2;
+        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI1) {
+                *addr = DISP_REG_CONFIG_DSIO_SEL_IN;
                value = DSI1_SEL_IN_RDMA2;
        } else if (cur == DDP_COMPONENT_RDMA2 && next == DDP_COMPONENT_DSI2) {
                *addr = DISP_REG_CONFIG_DSIE_SEL_IN;
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
index 7413ffeb3c9d..8399229e6ad2 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
+++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h
@@ -78,6 +78,7 @@ struct mtk_ddp_comp_funcs {
        void (*stop)(struct mtk_ddp_comp *comp);
        void (*enable_vblank)(struct mtk_ddp_comp *comp, struct drm_crtc *crtc);
        void (*disable_vblank)(struct mtk_ddp_comp *comp);
+        unsigned int (*layer_nr)(struct mtk_ddp_comp *comp);
        void (*layer_on)(struct mtk_ddp_comp *comp, unsigned int idx);
        void (*layer_off)(struct mtk_ddp_comp *comp, unsigned int idx);
        void (*layer_config)(struct mtk_ddp_comp *comp, unsigned int idx,
@@ -128,6 +129,14 @@ static inline void mtk_ddp_comp_disable_vblank(struct mtk_ddp_comp *comp)
                comp->funcs->disable_vblank(comp);
 }
+static inline unsigned int mtk_ddp_comp_layer_nr(struct mtk_ddp_comp *comp)
+{
+        if (comp->funcs && comp->funcs->layer_nr)
+                return comp->funcs->layer_nr(comp);
+        return 0;
+}
 static inline void mtk_ddp_comp_layer_on(struct mtk_ddp_comp *comp,
                                         unsigned int idx)
 {
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index 39721119713b..47ec604289b7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -381,7 +381,7 @@ static int mtk_drm_bind(struct device *dev)
 err_deinit:
        mtk_drm_kms_deinit(drm);
 err_free:
-        drm_dev_unref(drm);
+        drm_dev_put(drm);
        return ret;
 }
@@ -390,7 +390,7 @@ static void mtk_drm_unbind(struct device *dev)
        struct mtk_drm_private *private = dev_get_drvdata(dev);
        drm_dev_unregister(private->drm);
-        drm_dev_unref(private->drm);
+        drm_dev_put(private->drm);
        private->drm = NULL;
 }
@@ -564,7 +564,7 @@ static int mtk_drm_remove(struct platform_device *pdev)
        drm_dev_unregister(drm);
        mtk_drm_kms_deinit(drm);
-        drm_dev_unref(drm);
+        drm_dev_put(drm);
        component_master_del(&pdev->dev, &mtk_drm_ops);
        pm_runtime_disable(&pdev->dev);
@@ -580,29 +580,24 @@ static int mtk_drm_sys_suspend(struct device *dev)
 {
        struct mtk_drm_private *private = dev_get_drvdata(dev);
        struct drm_device *drm = private->drm;
+        int ret;
-        drm_kms_helper_poll_disable(drm);
+        ret = drm_mode_config_helper_suspend(drm);
-        private->suspend_state = drm_atomic_helper_suspend(drm);
-        if (IS_ERR(private->suspend_state)) {
-                drm_kms_helper_poll_enable(drm);
-                return PTR_ERR(private->suspend_state);
-        }
        DRM_DEBUG_DRIVER("mtk_drm_sys_suspend\n");
-        return 0;
+        return ret;
 }
 static int mtk_drm_sys_resume(struct device *dev)
 {
        struct mtk_drm_private *private = dev_get_drvdata(dev);
        struct drm_device *drm = private->drm;
+        int ret;
-        drm_atomic_helper_resume(drm, private->suspend_state);
+        ret = drm_mode_config_helper_resume(drm);
-        drm_kms_helper_poll_enable(drm);
        DRM_DEBUG_DRIVER("mtk_drm_sys_resume\n");
-        return 0;
+        return ret;
 }
 #endif
diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
index 90837f7c7d0f..f4c7516eb989 100644
--- a/drivers/hwmon/adt7475.c
+++ b/drivers/hwmon/adt7475.c
@@ -302,14 +302,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
        return clamp_val(reg, 0, 1023) & (0xff << 2);
 }
-static u16 adt7475_read_word(struct i2c_client *client, int reg)
+static int adt7475_read_word(struct i2c_client *client, int reg)
 {
-        u16 val;
+        int val1, val2;
-        val = i2c_smbus_read_byte_data(client, reg);
+        val1 = i2c_smbus_read_byte_data(client, reg);
-        val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
+        if (val1 < 0)
+                return val1;
+        val2 = i2c_smbus_read_byte_data(client, reg + 1);
+        if (val2 < 0)
+                return val2;
-        return val;
+        return val1 | (val2 << 8);
 }
 static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
@@ -962,13 +966,14 @@ static ssize_t show_pwmfreq(struct device *dev, struct device_attribute *attr,
 {
        struct adt7475_data *data = adt7475_update_device(dev);
        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
-        int i = clamp_val(data->range[sattr->index] & 0xf, 0,
+        int idx;
-                          ARRAY_SIZE(pwmfreq_table) - 1);
        if (IS_ERR(data))
                return PTR_ERR(data);
+        idx = clamp_val(data->range[sattr->index] & 0xf, 0,
+                        ARRAY_SIZE(pwmfreq_table) - 1);
-        return sprintf(buf, "%d\n", pwmfreq_table[i]);
+        return sprintf(buf, "%d\n", pwmfreq_table[idx]);
 }
 static ssize_t set_pwmfreq(struct device *dev, struct device_attribute *attr,
@@ -1004,6 +1009,10 @@ static ssize_t pwm_use_point2_pwm_at_crit_show(struct device *dev,
                                        char *buf)
 {
        struct adt7475_data *data = adt7475_update_device(dev);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
        return sprintf(buf, "%d\n", !!(data->config4 & CONFIG4_MAXDUTY));
 }
diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
index e9e6aeabbf84..71d3445ba869 100644
--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -17,7 +17,7 @@
 * Bi-directional Current/Power Monitor with I2C Interface
 * Datasheet: http://www.ti.com/product/ina230
 *
- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
+ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
 * Thanks to Jan Volkering
 *
 * This program is free software; you can redistribute it and/or modify
@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
        return 0;
 }
+static ssize_t ina2xx_show_shunt(struct device *dev,
+                              struct device_attribute *da,
+                              char *buf)
+{
+        struct ina2xx_data *data = dev_get_drvdata(dev);
+        return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
+}
 static ssize_t ina2xx_store_shunt(struct device *dev,
                                  struct device_attribute *da,
                                  const char *buf, size_t count)
@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
 /* shunt resistance */
 static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
-                          ina2xx_show_value, ina2xx_store_shunt,
+                          ina2xx_show_shunt, ina2xx_store_shunt,
                          INA2XX_CALIBRATION);
 /* update interval (ina226 only) */
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index c6bd61e4695a..944f5b63aecd 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -63,6 +63,7 @@
 #include <linux/bitops.h>
 #include <linux/dmi.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 #include "lm75.h"
 #define USE_ALTERNATE
@@ -2689,6 +2690,7 @@ store_pwm_weight_temp_sel(struct device *dev, struct device_attribute *attr,
                return err;
        if (val > NUM_TEMP)
                return -EINVAL;
+        val = array_index_nospec(val, NUM_TEMP + 1);
        if (val && (!(data->have_temp & BIT(val - 1)) ||
                    !data->temp_src[val - 1]))
                return -EINVAL;
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 6ec65adaba49..c33dcfb87993 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -110,8 +110,8 @@ static int sclhi(struct i2c_algo_bit_data *adap)
        }
 #ifdef DEBUG
        if (jiffies != start && i2c_debug >= 3)
-                pr_debug("i2c-algo-bit: needed %ld jiffies for SCL to go "
+                pr_debug("i2c-algo-bit: needed %ld jiffies for SCL to go high\n",
-                         "high\n", jiffies - start);
+                         jiffies - start);
 #endif
 done:
@@ -171,8 +171,9 @@ static int i2c_outb(struct i2c_adapter *i2c_adap, unsigned char c)
                setsda(adap, sb);
                udelay((adap->udelay + 1) / 2);
                if (sclhi(adap) < 0) { /* timed out */
-                        bit_dbg(1, &i2c_adap->dev, "i2c_outb: 0x%02x, "
+                        bit_dbg(1, &i2c_adap->dev,
-                                "timeout at bit #%d\n", (int)c, i);
+                                "i2c_outb: 0x%02x, timeout at bit #%d\n",
+                                (int)c, i);
                        return -ETIMEDOUT;
                }
                /* FIXME do arbitration here:
@@ -185,8 +186,8 @@ static int i2c_outb(struct i2c_adapter *i2c_adap, unsigned char c)
        }
        sdahi(adap);
        if (sclhi(adap) < 0) { /* timeout */
-                bit_dbg(1, &i2c_adap->dev, "i2c_outb: 0x%02x, "
+                bit_dbg(1, &i2c_adap->dev,
-                        "timeout at ack\n", (int)c);
+                        "i2c_outb: 0x%02x, timeout at ack\n", (int)c);
                return -ETIMEDOUT;
        }
@@ -215,8 +216,9 @@ static int i2c_inb(struct i2c_adapter *i2c_adap)
        sdahi(adap);
        for (i = 0; i < 8; i++) {
                if (sclhi(adap) < 0) { /* timeout */
-                        bit_dbg(1, &i2c_adap->dev, "i2c_inb: timeout at bit "
+                        bit_dbg(1, &i2c_adap->dev,
-                                "#%d\n", 7 - i);
+                                "i2c_inb: timeout at bit #%d\n",
+                                7 - i);
                        return -ETIMEDOUT;
                }
                indata *= 2;
@@ -265,8 +267,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                goto bailout;
        }
        if (!scl) {
-                printk(KERN_WARNING "%s: SCL unexpected low "
+                printk(KERN_WARNING
-                       "while pulling SDA low!\n", name);
+                       "%s: SCL unexpected low while pulling SDA low!\n",
+                       name);
                goto bailout;
        }
@@ -278,8 +281,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                goto bailout;
        }
        if (!scl) {
-                printk(KERN_WARNING "%s: SCL unexpected low "
+                printk(KERN_WARNING
-                       "while pulling SDA high!\n", name);
+                       "%s: SCL unexpected low while pulling SDA high!\n",
+                       name);
                goto bailout;
        }
@@ -291,8 +295,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                goto bailout;
        }
        if (!sda) {
-                printk(KERN_WARNING "%s: SDA unexpected low "
+                printk(KERN_WARNING
-                       "while pulling SCL low!\n", name);
+                       "%s: SDA unexpected low while pulling SCL low!\n",
+                       name);
                goto bailout;
        }
@@ -304,8 +309,9 @@ static int test_bus(struct i2c_adapter *i2c_adap)
                goto bailout;
        }
        if (!sda) {
-                printk(KERN_WARNING "%s: SDA unexpected low "
+                printk(KERN_WARNING
-                       "while pulling SCL high!\n", name);
+                       "%s: SDA unexpected low while pulling SCL high!\n",
+                       name);
                goto bailout;
        }
@@ -352,8 +358,8 @@ static int try_address(struct i2c_adapter *i2c_adap,
                i2c_start(adap);
        }
        if (i && ret)
-                bit_dbg(1, &i2c_adap->dev, "Used %d tries to %s client at "
+                bit_dbg(1, &i2c_adap->dev,
-                        "0x%02x: %s\n", i + 1,
+                        "Used %d tries to %s client at 0x%02x: %s\n", i + 1,
                        addr & 1 ? "read from" : "write to", addr >> 1,
                        ret == 1 ? "success" : "failed, timeout?");
        return ret;
@@ -442,8 +448,9 @@ static int readbytes(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
                        if (inval <= 0 || inval > I2C_SMBUS_BLOCK_MAX) {
                                if (!(flags & I2C_M_NO_RD_ACK))
                                        acknak(i2c_adap, 0);
-                                dev_err(&i2c_adap->dev, "readbytes: invalid "
+                                dev_err(&i2c_adap->dev,
-                                        "block length (%d)\n", inval);
+                                        "readbytes: invalid block length (%d)\n",
+                                        inval);
                                return -EPROTO;
                        }
                        /* The original count value accounts for the extra
@@ -506,8 +513,8 @@ static int bit_doAddress(struct i2c_adapter *i2c_adap, struct i2c_msg *msg)
                        return -ENXIO;
                }
                if (flags & I2C_M_RD) {
-                        bit_dbg(3, &i2c_adap->dev, "emitting repeated "
+                        bit_dbg(3, &i2c_adap->dev,
-                                "start condition\n");
+                                "emitting repeated start condition\n");
                        i2c_repstart(adap);
                        /* okay, now switch into reading mode */
                        addr |= 0x01;
@@ -564,8 +571,8 @@ static int bit_xfer(struct i2c_adapter *i2c_adap,
                        }
                        ret = bit_doAddress(i2c_adap, pmsg);
                        if ((ret != 0) && !nak_ok) {
-                                bit_dbg(1, &i2c_adap->dev, "NAK from "
+                                bit_dbg(1, &i2c_adap->dev,
-                                        "device addr 0x%02x msg #%d\n",
+                                        "NAK from device addr 0x%02x msg #%d\n",
                                        msgs[i].addr, i);
                                goto bailout;
                        }
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index e18442b9973a..94d94b4a9a0d 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -708,7 +708,6 @@ int i2c_dw_probe(struct dw_i2c_dev *dev)
        i2c_set_adapdata(adap, dev);
        if (dev->pm_disabled) {
-                dev_pm_syscore_device(dev->dev, true);
                irq_flags = IRQF_NO_SUSPEND;
        } else {
                irq_flags = IRQF_SHARED | IRQF_COND_SUSPEND;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 1a8d2da5b000..b5750fd85125 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -434,6 +434,9 @@ static int dw_i2c_plat_suspend(struct device *dev)
 {
        struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
+        if (i_dev->pm_disabled)
+                return 0;
        i_dev->disable(i_dev);
        i2c_dw_prepare_clk(i_dev, false);
@@ -444,7 +447,9 @@ static int dw_i2c_plat_resume(struct device *dev)
 {
        struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
-        i2c_dw_prepare_clk(i_dev, true);
+        if (!i_dev->pm_disabled)
+                i2c_dw_prepare_clk(i_dev, true);
        i_dev->init(i_dev);
        return 0;
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 941c223f6491..04b60a349d7e 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1415,6 +1415,13 @@ static void i801_add_tco(struct i801_priv *priv)
 }
 #ifdef CONFIG_ACPI
+static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
+                                      acpi_physical_address address)
+{
+        return address >= priv->smba &&
+               address <= pci_resource_end(priv->pci_dev, SMBBAR);
+}
 static acpi_status
 i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
                     u64 *value, void *handler_context, void *region_context)
@@ -1430,7 +1437,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
         */
        mutex_lock(&priv->acpi_lock);
-        if (!priv->acpi_reserved) {
+        if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
                priv->acpi_reserved = true;
                dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 439e8778f849..818cab14e87c 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -507,8 +507,6 @@ static void sh_mobile_i2c_dma_callback(void *data)
        pd->pos = pd->msg->len;
        pd->stop_after_dma = true;
-        i2c_release_dma_safe_msg_buf(pd->msg, pd->dma_buf);
        iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
@@ -602,8 +600,8 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
        dma_async_issue_pending(chan);
 }
-static int start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
+static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
-                    bool do_init)
+                     bool do_init)
 {
        if (do_init) {
                /* Initialize channel registers */
@@ -627,7 +625,6 @@ static int start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
        /* Enable all interrupts to begin with */
        iic_wr(pd, ICIC, ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
-        return 0;
 }
 static int poll_dte(struct sh_mobile_i2c_data *pd)
@@ -698,9 +695,7 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                pd->send_stop = i == num - 1 || msg->flags & I2C_M_STOP;
                pd->stop_after_dma = false;
-                err = start_ch(pd, msg, do_start);
+                start_ch(pd, msg, do_start);
-                if (err)
-                        break;
                if (do_start)
                        i2c_op(pd, OP_START, 0);
@@ -709,6 +704,10 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
                timeout = wait_event_timeout(pd->wait,
                                       pd->sr & (ICSR_TACK | SW_DONE),
                                       adapter->timeout);
+                /* 'stop_after_dma' tells if DMA transfer was complete */
+                i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma);
                if (!timeout) {
                        dev_err(pd->dev, "Transfer request timed out\n");
                        if (pd->dma_direction != DMA_NONE)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index f15737763608..9ee9a15e7134 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -2293,21 +2293,22 @@ u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold)
 EXPORT_SYMBOL_GPL(i2c_get_dma_safe_msg_buf);
 /**
- * i2c_release_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
+ * i2c_put_dma_safe_msg_buf - release DMA safe buffer and sync with i2c_msg
- * @msg: the message to be synced with
 * @buf: the buffer obtained from i2c_get_dma_safe_msg_buf(). May be NULL.
+ * @msg: the message which the buffer corresponds to
+ * @xferred: bool saying if the message was transferred
 */
-void i2c_release_dma_safe_msg_buf(struct i2c_msg *msg, u8 *buf)
+void i2c_put_dma_safe_msg_buf(u8 *buf, struct i2c_msg *msg, bool xferred)
 {
        if (!buf || buf == msg->buf)
                return;
-        if (msg->flags & I2C_M_RD)
+        if (xferred && msg->flags & I2C_M_RD)
                memcpy(msg->buf, buf, msg->len);
        kfree(buf);
 }
-EXPORT_SYMBOL_GPL(i2c_release_dma_safe_msg_buf);
+EXPORT_SYMBOL_GPL(i2c_put_dma_safe_msg_buf);
 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
 MODULE_DESCRIPTION("I2C-Bus main module");
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 6eb64c6f0802..c4118bcd5103 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
                WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
                if (!uverbs_destroy_uobject(obj, reason))
                        ret = 0;
+                else
+                        atomic_set(&obj->usecnt, 0);
        }
        return ret;
 }
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 62351b3fcafc..0b04dbff884f 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1183,7 +1183,7 @@ err_put:
        return ret;
 }
-static ssize_t show_node_type(struct device *device,
+static ssize_t node_type_show(struct device *device,
                              struct device_attribute *attr, char *buf)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1198,8 +1198,9 @@ static ssize_t show_node_type(struct device *device,
        default:                  return sprintf(buf, "%d: <unknown>\n", dev->node_type);
        }
 }
+static DEVICE_ATTR_RO(node_type);
-static ssize_t show_sys_image_guid(struct device *device,
+static ssize_t sys_image_guid_show(struct device *device,
                                   struct device_attribute *dev_attr, char *buf)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1210,8 +1211,9 @@ static ssize_t show_sys_image_guid(struct device *device,
                       be16_to_cpu(((__be16 *) &dev->attrs.sys_image_guid)[2]),
                       be16_to_cpu(((__be16 *) &dev->attrs.sys_image_guid)[3]));
 }
+static DEVICE_ATTR_RO(sys_image_guid);
-static ssize_t show_node_guid(struct device *device,
+static ssize_t node_guid_show(struct device *device,
                              struct device_attribute *attr, char *buf)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1222,8 +1224,9 @@ static ssize_t show_node_guid(struct device *device,
                       be16_to_cpu(((__be16 *) &dev->node_guid)[2]),
                       be16_to_cpu(((__be16 *) &dev->node_guid)[3]));
 }
+static DEVICE_ATTR_RO(node_guid);
-static ssize_t show_node_desc(struct device *device,
+static ssize_t node_desc_show(struct device *device,
                              struct device_attribute *attr, char *buf)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1231,9 +1234,9 @@ static ssize_t show_node_desc(struct device *device,
        return sprintf(buf, "%.64s\n", dev->node_desc);
 }
-static ssize_t set_node_desc(struct device *device,
+static ssize_t node_desc_store(struct device *device,
-                             struct device_attribute *attr,
+                               struct device_attribute *attr,
-                             const char *buf, size_t count)
+                               const char *buf, size_t count)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
        struct ib_device_modify desc = {};
@@ -1249,8 +1252,9 @@ static ssize_t set_node_desc(struct device *device,
        return count;
 }
+static DEVICE_ATTR_RW(node_desc);
-static ssize_t show_fw_ver(struct device *device, struct device_attribute *attr,
+static ssize_t fw_ver_show(struct device *device, struct device_attribute *attr,
                           char *buf)
 {
        struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1259,19 +1263,19 @@ static ssize_t show_fw_ver(struct device *device, struct device_attribute *attr,
        strlcat(buf, "\n", IB_FW_VERSION_NAME_MAX);
        return strlen(buf);
 }
+static DEVICE_ATTR_RO(fw_ver);
+static struct attribute *ib_dev_attrs[] = {
+        &dev_attr_node_type.attr,
+        &dev_attr_node_guid.attr,
+        &dev_attr_sys_image_guid.attr,
+        &dev_attr_fw_ver.attr,
+        &dev_attr_node_desc.attr,
+        NULL,
+};
-static DEVICE_ATTR(node_type, S_IRUGO, show_node_type, NULL);
+static const struct attribute_group dev_attr_group = {
-static DEVICE_ATTR(sys_image_guid, S_IRUGO, show_sys_image_guid, NULL);
+        .attrs = ib_dev_attrs,
-static DEVICE_ATTR(node_guid, S_IRUGO, show_node_guid, NULL);
-static DEVICE_ATTR(node_desc, S_IRUGO | S_IWUSR, show_node_desc, set_node_desc);
-static DEVICE_ATTR(fw_ver, S_IRUGO, show_fw_ver, NULL);
-static struct device_attribute *ib_class_attributes[] = {
-        &dev_attr_node_type,
-        &dev_attr_sys_image_guid,
-        &dev_attr_node_guid,
-        &dev_attr_node_desc,
-        &dev_attr_fw_ver,
 };
 static void free_port_list_attributes(struct ib_device *device)
@@ -1311,16 +1315,13 @@ int ib_device_register_sysfs(struct ib_device *device,
        if (ret)
                return ret;
+        device->groups[0] = &dev_attr_group;
+        class_dev->groups = device->groups;
        ret = device_add(class_dev);
        if (ret)
                goto err;
-        for (i = 0; i < ARRAY_SIZE(ib_class_attributes); ++i) {
-                ret = device_create_file(class_dev, ib_class_attributes[i]);
-                if (ret)
-                        goto err_unregister;
-        }
        device->ports_parent = kobject_create_and_add("ports",
                                                      &class_dev->kobj);
        if (!device->ports_parent) {
@@ -1347,18 +1348,13 @@ int ib_device_register_sysfs(struct ib_device *device,
 err_put:
        free_port_list_attributes(device);
-err_unregister:
        device_del(class_dev);
 err:
        return ret;
 }
 void ib_device_unregister_sysfs(struct ib_device *device)
 {
-        int i;
        /* Hold device until ib_dealloc_device() */
        get_device(&device->dev);
@@ -1369,8 +1365,5 @@ void ib_device_unregister_sysfs(struct ib_device *device)
                free_hsag(&device->dev.kobj, device->hw_stats_ag);
        }
-        for (i = 0; i < ARRAY_SIZE(ib_class_attributes); ++i)
-                device_remove_file(&device->dev, ib_class_attributes[i]);
        device_unregister(&device->dev);
 }
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ec8fb289621f..5f437d1570fb 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut);
 static DEFINE_IDR(ctx_idr);
 static DEFINE_IDR(multicast_idr);
+static const struct file_operations ucma_fops;
 static inline struct ucma_context *_ucma_find_context(int id,
                                                      struct ucma_file *file)
 {
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
        f = fdget(cmd.fd);
        if (!f.file)
                return -ENOENT;
+        if (f.file->f_op != &ucma_fops) {
+                ret = -EINVAL;
+                goto file_put;
+        }
        /* Validate current fd and prevent destruction of id. */
        ctx = ucma_get_ctx(f.file->private_data, cmd.id);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 5df8e548cc14..7199c275ab79 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -100,13 +100,14 @@ struct ib_uverbs_device {
        atomic_t                                refcount;
        int                                     num_comp_vectors;
        struct completion                       comp;
-        struct device                          *dev;
+        struct device                           dev;
+        /* First group for device attributes, NULL terminated array */
+        const struct attribute_group            *groups[2];
        struct ib_device        __rcu          *ib_dev;
        int                                     devnum;
        struct cdev                             cdev;
        struct rb_root                          xrcd_tree;
        struct mutex                            xrcd_tree_mutex;
-        struct kobject                          kobj;
        struct srcu_struct                      disassociate_srcu;
        struct mutex                            lists_mutex; /* protect lists */
        struct list_head                        uverbs_file_list;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 823beca448e1..16e5f714ca53 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -169,20 +169,16 @@ int uverbs_dealloc_mw(struct ib_mw *mw)
        return ret;
 }
-static void ib_uverbs_release_dev(struct kobject *kobj)
+static void ib_uverbs_release_dev(struct device *device)
 {
        struct ib_uverbs_device *dev =
-                container_of(kobj, struct ib_uverbs_device, kobj);
+                        container_of(device, struct ib_uverbs_device, dev);
        uverbs_destroy_api(dev->uapi);
        cleanup_srcu_struct(&dev->disassociate_srcu);
        kfree(dev);
 }
-static struct kobj_type ib_uverbs_dev_ktype = {
-        .release = ib_uverbs_release_dev,
-};
 static void ib_uverbs_release_async_event_file(struct kref *ref)
 {
        struct ib_uverbs_async_event_file *file =
@@ -265,7 +261,7 @@ void ib_uverbs_release_file(struct kref *ref)
        if (atomic_dec_and_test(&file->device->refcount))
                ib_uverbs_comp_dev(file->device);
-        kobject_put(&file->device->kobj);
+        put_device(&file->device->dev);
        kfree(file);
 }
@@ -838,6 +834,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
        if (!atomic_inc_not_zero(&dev->refcount))
                return -ENXIO;
+        get_device(&dev->dev);
        srcu_key = srcu_read_lock(&dev->disassociate_srcu);
        mutex_lock(&dev->lists_mutex);
        ib_dev = srcu_dereference(dev->ib_dev,
@@ -877,7 +874,6 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
        init_rwsem(&file->hw_destroy_rwsem);
        filp->private_data = file;
-        kobject_get(&dev->kobj);
        list_add_tail(&file->list, &dev->uverbs_file_list);
        mutex_unlock(&dev->lists_mutex);
        srcu_read_unlock(&dev->disassociate_srcu, srcu_key);
@@ -898,6 +894,7 @@ err:
        if (atomic_dec_and_test(&dev->refcount))
                ib_uverbs_comp_dev(dev);
+        put_device(&dev->dev);
        return ret;
 }
@@ -950,17 +947,15 @@ static struct ib_client uverbs_client = {
        .remove = ib_uverbs_remove_one
 };
-static ssize_t show_ibdev(struct device *device, struct device_attribute *attr,
+static ssize_t ibdev_show(struct device *device, struct device_attribute *attr,
                          char *buf)
 {
+        struct ib_uverbs_device *dev =
+                        container_of(device, struct ib_uverbs_device, dev);
        int ret = -ENODEV;
        int srcu_key;
-        struct ib_uverbs_device *dev = dev_get_drvdata(device);
        struct ib_device *ib_dev;
-        if (!dev)
-                return -ENODEV;
        srcu_key = srcu_read_lock(&dev->disassociate_srcu);
        ib_dev = srcu_dereference(dev->ib_dev, &dev->disassociate_srcu);
        if (ib_dev)
@@ -969,18 +964,17 @@ static ssize_t show_ibdev(struct device *device, struct device_attribute *attr,
        return ret;
 }
-static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
+static DEVICE_ATTR_RO(ibdev);
-static ssize_t show_dev_abi_version(struct device *device,
+static ssize_t abi_version_show(struct device *device,
-                                    struct device_attribute *attr, char *buf)
+                                struct device_attribute *attr, char *buf)
 {
-        struct ib_uverbs_device *dev = dev_get_drvdata(device);
+        struct ib_uverbs_device *dev =
+                        container_of(device, struct ib_uverbs_device, dev);
        int ret = -ENODEV;
        int srcu_key;
        struct ib_device *ib_dev;
-        if (!dev)
-                return -ENODEV;
        srcu_key = srcu_read_lock(&dev->disassociate_srcu);
        ib_dev = srcu_dereference(dev->ib_dev, &dev->disassociate_srcu);
        if (ib_dev)
@@ -989,7 +983,17 @@ static ssize_t show_dev_abi_version(struct device *device,
        return ret;
 }
-static DEVICE_ATTR(abi_version, S_IRUGO, show_dev_abi_version, NULL);
+static DEVICE_ATTR_RO(abi_version);
+static struct attribute *ib_dev_attrs[] = {
+        &dev_attr_abi_version.attr,
+        &dev_attr_ibdev.attr,
+        NULL,
+};
+static const struct attribute_group dev_attr_group = {
+        .attrs = ib_dev_attrs,
+};
 static CLASS_ATTR_STRING(abi_version, S_IRUGO,
                         __stringify(IB_USER_VERBS_ABI_VERSION));
@@ -1031,7 +1035,6 @@ static void ib_uverbs_add_one(struct ib_device *device)
        init_completion(&uverbs_dev->comp);
        uverbs_dev->xrcd_tree = RB_ROOT;
        mutex_init(&uverbs_dev->xrcd_tree_mutex);
-        kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
        mutex_init(&uverbs_dev->lists_mutex);
        INIT_LIST_HEAD(&uverbs_dev->uverbs_file_list);
        INIT_LIST_HEAD(&uverbs_dev->uverbs_events_file_list);
@@ -1050,43 +1053,37 @@ static void ib_uverbs_add_one(struct ib_device *device)
        uverbs_dev->num_comp_vectors = device->num_comp_vectors;
        if (ib_uverbs_create_uapi(device, uverbs_dev))
-                goto err;
+                goto err_uapi;
-        cdev_init(&uverbs_dev->cdev, NULL);
+        device_initialize(&uverbs_dev->dev);
+        uverbs_dev->dev.class = uverbs_class;
+        uverbs_dev->dev.parent = device->dev.parent;
+        uverbs_dev->dev.devt = base;
+        uverbs_dev->dev.release = ib_uverbs_release_dev;
+        uverbs_dev->groups[0] = &dev_attr_group;
+        uverbs_dev->dev.groups = uverbs_dev->groups;
+        dev_set_name(&uverbs_dev->dev, "uverbs%d", uverbs_dev->devnum);
+        cdev_init(&uverbs_dev->cdev,
+                  device->mmap ? &uverbs_mmap_fops : &uverbs_fops);
        uverbs_dev->cdev.owner = THIS_MODULE;
-        uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
-        cdev_set_parent(&uverbs_dev->cdev, &uverbs_dev->kobj);
-        kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
-        if (cdev_add(&uverbs_dev->cdev, base, 1))
-                goto err_cdev;
-        uverbs_dev->dev = device_create(uverbs_class, device->dev.parent,
+        ret = cdev_device_add(&uverbs_dev->cdev, &uverbs_dev->dev);
-                                        uverbs_dev->cdev.dev, uverbs_dev,
+        if (ret)
-                                        "uverbs%d", uverbs_dev->devnum);
-        if (IS_ERR(uverbs_dev->dev))
                goto err_cdev;
-        if (device_create_file(uverbs_dev->dev, &dev_attr_ibdev))
-                goto err_class;
-        if (device_create_file(uverbs_dev->dev, &dev_attr_abi_version))
-                goto err_class;
        ib_set_client_data(device, &uverbs_client, uverbs_dev);
        return;
-err_class:
-        device_destroy(uverbs_class, uverbs_dev->cdev.dev);
 err_cdev:
        cdev_del(&uverbs_dev->cdev);
+        put_device(&uverbs_dev->dev);
+err_uapi:
        clear_bit(devnum, dev_map);
 err:
        if (atomic_dec_and_test(&uverbs_dev->refcount))
                ib_uverbs_comp_dev(uverbs_dev);
        wait_for_completion(&uverbs_dev->comp);
-        kobject_put(&uverbs_dev->kobj);
        return;
 }
@@ -1156,9 +1153,7 @@ static void ib_uverbs_remove_one(struct ib_device *device, void *client_data)
        if (!uverbs_dev)
                return;
-        dev_set_drvdata(uverbs_dev->dev, NULL);
+        cdev_device_del(&uverbs_dev->cdev, &uverbs_dev->dev);
-        device_destroy(uverbs_class, uverbs_dev->cdev.dev);
-        cdev_del(&uverbs_dev->cdev);
        clear_bit(uverbs_dev->devnum, dev_map);
        if (device->disassociate_ucontext) {
@@ -1182,7 +1177,7 @@ static void ib_uverbs_remove_one(struct ib_device *device, void *client_data)
        if (wait_clients)
                wait_for_completion(&uverbs_dev->comp);
-        kobject_put(&uverbs_dev->kobj);
+        put_device(&uverbs_dev->dev);
 }
 static char *uverbs_devnode(struct device *dev, umode_t *mode)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index bbfb86eb2d24..bc2b9e038439 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                                "Failed to destroy Shadow QP");
                        return rc;
                }
+                bnxt_qplib_free_qp_res(&rdev->qplib_res,
+                                       &rdev->qp1_sqp->qplib_qp);
                mutex_lock(&rdev->qp_lock);
                list_del(&rdev->qp1_sqp->list);
                atomic_dec(&rdev->qp_count);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index f92605aa42b4..6eaa4b2abb78 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qplib_res *res,
                                       struct bnxt_qplib_qp *qp)
 {
        struct bnxt_qplib_q *rq = &qp->rq;
-        struct bnxt_qplib_q *sq = &qp->rq;
+        struct bnxt_qplib_q *sq = &qp->sq;
        int rc = 0;
        if (qp->sq_hdr_buf_size && sq->hwq.max_elements) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index b3203afa3b1d..347fe18b1a41 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1685,6 +1685,12 @@ static void flush_qp(struct c4iw_qp *qhp)
        schp = to_c4iw_cq(qhp->ibqp.send_cq);
        if (qhp->ibqp.uobject) {
+                /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+                if (qhp->wq.flushed)
+                        return;
+                qhp->wq.flushed = 1;
                t4_set_wq_in_error(&qhp->wq, 0);
                t4_set_cq_in_error(&rchp->cq);
                spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index ea01b8dd2be6..3d5424f335cb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1027,12 +1027,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id,
        skb_queue_head_init(&skqueue);
+        netif_tx_lock_bh(p->dev);
        spin_lock_irq(&priv->lock);
        set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
        if (p->neigh)
                while ((skb = __skb_dequeue(&p->neigh->queue)))
                        __skb_queue_tail(&skqueue, skb);
        spin_unlock_irq(&priv->lock);
+        netif_tx_unlock_bh(p->dev);
        while ((skb = __skb_dequeue(&skqueue))) {
                skb->dev = p->dev;
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 648eb6743ed5..6edffeed9953 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -238,10 +238,6 @@ static void mmc_mq_exit_request(struct blk_mq_tag_set *set, struct request *req,
        mmc_exit_request(mq->queue, req);
 }
-/*
- * We use BLK_MQ_F_BLOCKING and have only 1 hardware queue, which means requests
- * will not be dispatched in parallel.
- */
 static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                                    const struct blk_mq_queue_data *bd)
 {
@@ -264,7 +260,7 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
        spin_lock_irq(q->queue_lock);
-        if (mq->recovery_needed) {
+        if (mq->recovery_needed || mq->busy) {
                spin_unlock_irq(q->queue_lock);
                return BLK_STS_RESOURCE;
        }
@@ -291,6 +287,9 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                break;
        }
+        /* Parallel dispatch of requests is not supported at the moment */
+        mq->busy = true;
        mq->in_flight[issue_type] += 1;
        get_card = (mmc_tot_in_flight(mq) == 1);
        cqe_retune_ok = (mmc_cqe_qcnt(mq) == 1);
@@ -333,9 +332,12 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                mq->in_flight[issue_type] -= 1;
                if (mmc_tot_in_flight(mq) == 0)
                        put_card = true;
+                mq->busy = false;
                spin_unlock_irq(q->queue_lock);
                if (put_card)
                        mmc_put_card(card, &mq->ctx);
+        } else {
+                WRITE_ONCE(mq->busy, false);
        }
        return ret;
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 17e59d50b496..9bf3c9245075 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -81,6 +81,7 @@ struct mmc_queue {
        unsigned int            cqe_busy;
 #define MMC_CQE_DCMD_BUSY       BIT(0)
 #define MMC_CQE_QUEUE_FULL      BIT(1)
+        bool                    busy;
        bool                    use_cqe;
        bool                    recovery_needed;
        bool                    in_recovery;
diff --git a/drivers/mmc/host/android-goldfish.c b/drivers/mmc/host/android-goldfish.c
index 294de177632c..61e4e2a213c9 100644
--- a/drivers/mmc/host/android-goldfish.c
+++ b/drivers/mmc/host/android-goldfish.c
@@ -217,7 +217,7 @@ static void goldfish_mmc_xfer_done(struct goldfish_mmc_host *host,
                         * We don't really have DMA, so we need
                         * to copy from our platform driver buffer
                         */
-                        sg_copy_to_buffer(data->sg, 1, host->virt_base,
+                        sg_copy_from_buffer(data->sg, 1, host->virt_base,
                                        data->sg->length);
                }
                host->data->bytes_xfered += data->sg->length;
@@ -393,7 +393,7 @@ static void goldfish_mmc_prepare_data(struct goldfish_mmc_host *host,
                 * We don't really have DMA, so we need to copy to our
                 * platform driver buffer
                 */
-                sg_copy_from_buffer(data->sg, 1, host->virt_base,
+                sg_copy_to_buffer(data->sg, 1, host->virt_base,
                                data->sg->length);
        }
 }
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 5aa2c9404e92..be53044086c7 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1976,7 +1976,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
        do {
                value = atmci_readl(host, ATMCI_RDR);
                if (likely(offset + 4 <= sg->length)) {
-                        sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
+                        sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
                        offset += 4;
                        nbytes += 4;
@@ -1993,7 +1993,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
                } else {
                        unsigned int remaining = sg->length - offset;
-                        sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
+                        sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
                        nbytes += remaining;
                        flush_dcache_page(sg_page(sg));
@@ -2003,7 +2003,7 @@ static void atmci_read_data_pio(struct atmel_mci *host)
                                goto done;
                        offset = 4 - remaining;
-                        sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
+                        sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
                                        offset, 0);
                        nbytes += offset;
                }
@@ -2042,7 +2042,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
        do {
                if (likely(offset + 4 <= sg->length)) {
-                        sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
+                        sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
                        atmci_writel(host, ATMCI_TDR, value);
                        offset += 4;
@@ -2059,7 +2059,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
                        unsigned int remaining = sg->length - offset;
                        value = 0;
-                        sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
+                        sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
                        nbytes += remaining;
                        host->sg = sg = sg_next(sg);
@@ -2070,7 +2070,7 @@ static void atmci_write_data_pio(struct atmel_mci *host)
                        }
                        offset = 4 - remaining;
-                        sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
+                        sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
                                        offset, 0);
                        atmci_writel(host, ATMCI_TDR, value);
                        nbytes += offset;
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 35cc0de6be67..ca0b43973769 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -45,14 +45,16 @@
 /* DM_CM_RST */
 #define RST_DTRANRST1           BIT(9)
 #define RST_DTRANRST0           BIT(8)
-#define RST_RESERVED_BITS       GENMASK_ULL(32, 0)
+#define RST_RESERVED_BITS       GENMASK_ULL(31, 0)
 /* DM_CM_INFO1 and DM_CM_INFO1_MASK */
 #define INFO1_CLEAR             0
+#define INFO1_MASK_CLEAR        GENMASK_ULL(31, 0)
 #define INFO1_DTRANEND1         BIT(17)
 #define INFO1_DTRANEND0         BIT(16)
 /* DM_CM_INFO2 and DM_CM_INFO2_MASK */
+#define INFO2_MASK_CLEAR        GENMASK_ULL(31, 0)
 #define INFO2_DTRANERR1         BIT(17)
 #define INFO2_DTRANERR0         BIT(16)
@@ -252,6 +254,12 @@ renesas_sdhi_internal_dmac_request_dma(struct tmio_mmc_host *host,
 {
        struct renesas_sdhi *priv = host_to_priv(host);
+        /* Disable DMAC interrupts, we don't use them */
+        renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO1_MASK,
+                                            INFO1_MASK_CLEAR);
+        renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO2_MASK,
+                                            INFO2_MASK_CLEAR);
        /* Each value is set to non-zero to assume "enabling" each DMA */
        host->chan_rx = host->chan_tx = (void *)0xdeadbeaf;
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index ca18612c4201..67b2065e7a19 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -1338,6 +1338,11 @@ int denali_init(struct denali_nand_info *denali)
        denali_enable_irq(denali);
        denali_reset_banks(denali);
+        if (!denali->max_banks) {
+                /* Error out earlier if no chip is found for some reasons. */
+                ret = -ENODEV;
+                goto disable_irq;
+        }
        denali->active_bank = DENALI_INVALID_BANK;
diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c
index a3f04315c05c..427fcbc1b71c 100644
--- a/drivers/mtd/nand/raw/docg4.c
+++ b/drivers/mtd/nand/raw/docg4.c
@@ -1218,7 +1218,7 @@ static int docg4_resume(struct platform_device *pdev)
        return 0;
 }
-static void __init init_mtd_structs(struct mtd_info *mtd)
+static void init_mtd_structs(struct mtd_info *mtd)
 {
        /* initialize mtd and nand data structures */
@@ -1290,7 +1290,7 @@ static void __init init_mtd_structs(struct mtd_info *mtd)
 }
-static int __init read_id_reg(struct mtd_info *mtd)
+static int read_id_reg(struct mtd_info *mtd)
 {
        struct nand_chip *nand = mtd_to_nand(mtd);
        struct docg4_priv *doc = nand_get_controller_data(nand);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 139d96c5a023..092c817f8f11 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -110,16 +110,14 @@ static int bnxt_tc_parse_actions(struct bnxt *bp,
                                 struct tcf_exts *tc_exts)
 {
        const struct tc_action *tc_act;
-        LIST_HEAD(tc_actions);
+        int i, rc;
-        int rc;
        if (!tcf_exts_has_actions(tc_exts)) {
                netdev_info(bp->dev, "no actions");
                return -EINVAL;
        }
-        tcf_exts_to_list(tc_exts, &tc_actions);
+        tcf_exts_for_each_action(i, tc_act, tc_exts) {
-        list_for_each_entry(tc_act, &tc_actions, list) {
                /* Drop action */
                if (is_tcf_gact_shot(tc_act)) {
                        actions->flags |= BNXT_TC_ACTION_FLAG_DROP;
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index dc09f9a8a49b..c6707ea2d751 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -482,11 +482,6 @@ static int macb_mii_probe(struct net_device *dev)
        if (np) {
                if (of_phy_is_fixed_link(np)) {
-                        if (of_phy_register_fixed_link(np) < 0) {
-                                dev_err(&bp->pdev->dev,
-                                        "broken fixed-link specification\n");
-                                return -ENODEV;
-                        }
                        bp->phy_node = of_node_get(np);
                } else {
                        bp->phy_node = of_parse_phandle(np, "phy-handle", 0);
@@ -569,7 +564,7 @@ static int macb_mii_init(struct macb *bp)
 {
        struct macb_platform_data *pdata;
        struct device_node *np;
-        int err;
+        int err = -ENXIO;
        /* Enable management port */
        macb_writel(bp, NCR, MACB_BIT(MPE));
@@ -592,12 +587,23 @@ static int macb_mii_init(struct macb *bp)
        dev_set_drvdata(&bp->dev->dev, bp->mii_bus);
        np = bp->pdev->dev.of_node;
-        if (pdata)
+        if (np && of_phy_is_fixed_link(np)) {
-                bp->mii_bus->phy_mask = pdata->phy_mask;
+                if (of_phy_register_fixed_link(np) < 0) {
+                        dev_err(&bp->pdev->dev,
+                                "broken fixed-link specification %pOF\n", np);
+                        goto err_out_free_mdiobus;
+                }
+                err = mdiobus_register(bp->mii_bus);
+        } else {
+                if (pdata)
+                        bp->mii_bus->phy_mask = pdata->phy_mask;
+                err = of_mdiobus_register(bp->mii_bus, np);
+        }
-        err = of_mdiobus_register(bp->mii_bus, np);
        if (err)
-                goto err_out_free_mdiobus;
+                goto err_out_free_fixed_link;
        err = macb_mii_probe(bp->dev);
        if (err)
@@ -607,6 +613,7 @@ static int macb_mii_init(struct macb *bp)
 err_out_unregister_bus:
        mdiobus_unregister(bp->mii_bus);
+err_out_free_fixed_link:
        if (np && of_phy_is_fixed_link(np))
                of_phy_deregister_fixed_link(np);
 err_out_free_mdiobus:
@@ -2028,14 +2035,17 @@ static void macb_reset_hw(struct macb *bp)
 {
        struct macb_queue *queue;
        unsigned int q;
+        u32 ctrl = macb_readl(bp, NCR);
        /* Disable RX and TX (XXX: Should we halt the transmission
         * more gracefully?)
         */
-        macb_writel(bp, NCR, 0);
+        ctrl &= ~(MACB_BIT(RE) | MACB_BIT(TE));
        /* Clear the stats registers (XXX: Update stats first?) */
-        macb_writel(bp, NCR, MACB_BIT(CLRSTAT));
+        ctrl |= MACB_BIT(CLRSTAT);
+        macb_writel(bp, NCR, ctrl);
        /* Clear all status flags */
        macb_writel(bp, TSR, -1);
@@ -2223,7 +2233,7 @@ static void macb_init_hw(struct macb *bp)
        }
        /* Enable TX and RX */
-        macb_writel(bp, NCR, MACB_BIT(RE) | MACB_BIT(TE) | MACB_BIT(MPE));
+        macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(RE) | MACB_BIT(TE));
 }
 /* The hash address register is 64 bits long and takes up two
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
index 623f73dd7738..c116f96956fe 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -417,10 +417,9 @@ static void cxgb4_process_flow_actions(struct net_device *in,
                                       struct ch_filter_specification *fs)
 {
        const struct tc_action *a;
-        LIST_HEAD(actions);
+        int i;
-        tcf_exts_to_list(cls->exts, &actions);
+        tcf_exts_for_each_action(i, a, cls->exts) {
-        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_ok(a)) {
                        fs->action = FILTER_PASS;
                } else if (is_tcf_gact_shot(a)) {
@@ -591,10 +590,9 @@ static int cxgb4_validate_flow_actions(struct net_device *dev,
        bool act_redir = false;
        bool act_pedit = false;
        bool act_vlan = false;
-        LIST_HEAD(actions);
+        int i;
-        tcf_exts_to_list(cls->exts, &actions);
+        tcf_exts_for_each_action(i, a, cls->exts) {
-        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_ok(a)) {
                        /* Do nothing */
                } else if (is_tcf_gact_shot(a)) {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
index 18eb2aedd4cb..c7d2b4dc7568 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
@@ -93,14 +93,13 @@ static int fill_action_fields(struct adapter *adap,
        unsigned int num_actions = 0;
        const struct tc_action *a;
        struct tcf_exts *exts;
-        LIST_HEAD(actions);
+        int i;
        exts = cls->knode.exts;
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                /* Don't allow more than one action per rule. */
                if (num_actions)
                        return -EINVAL;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index fa5b30f547f6..cad52bd331f7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -220,10 +220,10 @@ struct hnae_desc_cb {
        /* priv data for the desc, e.g. skb when use with ip stack*/
        void *priv;
-        u16 page_offset;
+        u32 page_offset;
-        u16 reuse_flag;
+        u32 length;     /* length of the buffer */
-        u16 length;     /* length of the buffer */
+        u16 reuse_flag;
       /* desc type, used by the ring user to mark the type of the priv data */
        u16 type;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 9f2b552aee33..02a0ba20fad5 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -406,113 +406,13 @@ out_net_tx_busy:
        return NETDEV_TX_BUSY;
 }
-/**
- * hns_nic_get_headlen - determine size of header for RSC/LRO/GRO/FCOE
- * @data: pointer to the start of the headers
- * @max: total length of section to find headers in
- *
- * This function is meant to determine the length of headers that will
- * be recognized by hardware for LRO, GRO, and RSC offloads.  The main
- * motivation of doing this is to only perform one pull for IPv4 TCP
- * packets so that we can do basic things like calculating the gso_size
- * based on the average data per packet.
- **/
-static unsigned int hns_nic_get_headlen(unsigned char *data, u32 flag,
-                                        unsigned int max_size)
-{
-        unsigned char *network;
-        u8 hlen;
-        /* this should never happen, but better safe than sorry */
-        if (max_size < ETH_HLEN)
-                return max_size;
-        /* initialize network frame pointer */
-        network = data;
-        /* set first protocol and move network header forward */
-        network += ETH_HLEN;
-        /* handle any vlan tag if present */
-        if (hnae_get_field(flag, HNS_RXD_VLAN_M, HNS_RXD_VLAN_S)
-                == HNS_RX_FLAG_VLAN_PRESENT) {
-                if ((typeof(max_size))(network - data) > (max_size - VLAN_HLEN))
-                        return max_size;
-                network += VLAN_HLEN;
-        }
-        /* handle L3 protocols */
-        if (hnae_get_field(flag, HNS_RXD_L3ID_M, HNS_RXD_L3ID_S)
-                == HNS_RX_FLAG_L3ID_IPV4) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct iphdr)))
-                        return max_size;
-                /* access ihl as a u8 to avoid unaligned access on ia64 */
-                hlen = (network[0] & 0x0F) << 2;
-                /* verify hlen meets minimum size requirements */
-                if (hlen < sizeof(struct iphdr))
-                        return network - data;
-                /* record next protocol if header is present */
-        } else if (hnae_get_field(flag, HNS_RXD_L3ID_M, HNS_RXD_L3ID_S)
-                == HNS_RX_FLAG_L3ID_IPV6) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct ipv6hdr)))
-                        return max_size;
-                /* record next protocol */
-                hlen = sizeof(struct ipv6hdr);
-        } else {
-                return network - data;
-        }
-        /* relocate pointer to start of L4 header */
-        network += hlen;
-        /* finally sort out TCP/UDP */
-        if (hnae_get_field(flag, HNS_RXD_L4ID_M, HNS_RXD_L4ID_S)
-                == HNS_RX_FLAG_L4ID_TCP) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct tcphdr)))
-                        return max_size;
-                /* access doff as a u8 to avoid unaligned access on ia64 */
-                hlen = (network[12] & 0xF0) >> 2;
-                /* verify hlen meets minimum size requirements */
-                if (hlen < sizeof(struct tcphdr))
-                        return network - data;
-                network += hlen;
-        } else if (hnae_get_field(flag, HNS_RXD_L4ID_M, HNS_RXD_L4ID_S)
-                == HNS_RX_FLAG_L4ID_UDP) {
-                if ((typeof(max_size))(network - data) >
-                    (max_size - sizeof(struct udphdr)))
-                        return max_size;
-                network += sizeof(struct udphdr);
-        }
-        /* If everything has gone correctly network should be the
-         * data section of the packet and will be the end of the header.
-         * If not then it probably represents the end of the last recognized
-         * header.
-         */
-        if ((typeof(max_size))(network - data) < max_size)
-                return network - data;
-        else
-                return max_size;
-}
 static void hns_nic_reuse_page(struct sk_buff *skb, int i,
                               struct hnae_ring *ring, int pull_len,
                               struct hnae_desc_cb *desc_cb)
 {
        struct hnae_desc *desc;
-        int truesize, size;
+        u32 truesize;
+        int size;
        int last_offset;
        bool twobufs;
@@ -530,7 +430,7 @@ static void hns_nic_reuse_page(struct sk_buff *skb, int i,
        }
        skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
-                        size - pull_len, truesize - pull_len);
+                        size - pull_len, truesize);
         /* avoid re-using remote pages,flag default unreuse */
        if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
@@ -695,7 +595,7 @@ static int hns_nic_poll_rx_skb(struct hns_nic_ring_data *ring_data,
        } else {
                ring->stats.seg_pkt_cnt++;
-                pull_len = hns_nic_get_headlen(va, bnum_flag, HNS_RX_HEAD_SIZE);
+                pull_len = eth_get_headlen(va, HNS_RX_HEAD_SIZE);
                memcpy(__skb_put(skb, pull_len), va,
                       ALIGN(pull_len, sizeof(long)));
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 3554dca7a680..955c4ab18b03 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2019,7 +2019,8 @@ static void hns3_nic_reuse_page(struct sk_buff *skb, int i,
                                struct hns3_desc_cb *desc_cb)
 {
        struct hns3_desc *desc;
-        int truesize, size;
+        u32 truesize;
+        int size;
        int last_offset;
        bool twobufs;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index a02a96aee2a2..cb450d7ec8c1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -284,11 +284,11 @@ struct hns3_desc_cb {
        /* priv data for the desc, e.g. skb when use with ip stack*/
        void *priv;
-        u16 page_offset;
+        u32 page_offset;
-        u16 reuse_flag;
        u32 length;     /* length of the buffer */
+        u16 reuse_flag;
       /* desc type, used by the ring user to mark the type of the priv data */
        u16 type;
 };
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index bdb3f8e65ed4..2569a168334c 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -624,14 +624,14 @@ static int e1000_set_ringparam(struct net_device *netdev,
                adapter->tx_ring = tx_old;
                e1000_free_all_rx_resources(adapter);
                e1000_free_all_tx_resources(adapter);
-                kfree(tx_old);
-                kfree(rx_old);
                adapter->rx_ring = rxdr;
                adapter->tx_ring = txdr;
                err = e1000_up(adapter);
                if (err)
                        goto err_setup;
        }
+        kfree(tx_old);
+        kfree(rx_old);
        clear_bit(__E1000_RESETTING, &adapter->flags);
        return 0;
@@ -644,7 +644,8 @@ err_setup_rx:
 err_alloc_rx:
        kfree(txdr);
 err_alloc_tx:
-        e1000_up(adapter);
+        if (netif_running(adapter->netdev))
+                e1000_up(adapter);
 err_setup:
        clear_bit(__E1000_RESETTING, &adapter->flags);
        return err;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index abcd096ede14..5ff6caa83948 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2013,7 +2013,7 @@ static void i40e_get_stat_strings(struct net_device *netdev, u8 *data)
        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++)
                i40e_add_stat_strings(&data, i40e_gstrings_pfc_stats, i);
-        WARN_ONCE(p - data != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
+        WARN_ONCE(data - p != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
                  "stat strings count mismatch!");
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index f2c622e78802..ac685ad4d877 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5122,15 +5122,17 @@ static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
                                       u8 *bw_share)
 {
        struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
+        struct i40e_pf *pf = vsi->back;
        i40e_status ret;
        int i;
-        if (vsi->back->flags & I40E_FLAG_TC_MQPRIO)
+        /* There is no need to reset BW when mqprio mode is on.  */
+        if (pf->flags & I40E_FLAG_TC_MQPRIO)
                return 0;
-        if (!vsi->mqprio_qopt.qopt.hw) {
+        if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) {
                ret = i40e_set_bw_limit(vsi, vsi->seid, 0);
                if (ret)
-                        dev_info(&vsi->back->pdev->dev,
+                        dev_info(&pf->pdev->dev,
                                 "Failed to reset tx rate for vsi->seid %u\n",
                                 vsi->seid);
                return ret;
@@ -5139,12 +5141,11 @@ static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                bw_data.tc_bw_credits[i] = bw_share[i];
-        ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
+        ret = i40e_aq_config_vsi_tc_bw(&pf->hw, vsi->seid, &bw_data, NULL);
-                                       NULL);
        if (ret) {
-                dev_info(&vsi->back->pdev->dev,
+                dev_info(&pf->pdev->dev,
                         "AQ command Config VSI BW allocation per TC failed = %d\n",
-                         vsi->back->hw.aq.asq_last_status);
+                         pf->hw.aq.asq_last_status);
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index d8b5fff581e7..868f4a1d0f72 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -89,6 +89,13 @@ extern const char ice_drv_ver[];
 #define ice_for_each_rxq(vsi, i) \
        for ((i) = 0; (i) < (vsi)->num_rxq; (i)++)
+/* Macros for each allocated tx/rx ring whether used or not in a VSI */
+#define ice_for_each_alloc_txq(vsi, i) \
+        for ((i) = 0; (i) < (vsi)->alloc_txq; (i)++)
+#define ice_for_each_alloc_rxq(vsi, i) \
+        for ((i) = 0; (i) < (vsi)->alloc_rxq; (i)++)
 struct ice_tc_info {
        u16 qoffset;
        u16 qcount;
@@ -189,9 +196,9 @@ struct ice_vsi {
        struct list_head tmp_sync_list;         /* MAC filters to be synced */
        struct list_head tmp_unsync_list;       /* MAC filters to be unsynced */
-        bool irqs_ready;
+        u8 irqs_ready;
-        bool current_isup;               /* Sync 'link up' logging */
+        u8 current_isup;                 /* Sync 'link up' logging */
-        bool stat_offsets_loaded;
+        u8 stat_offsets_loaded;
        /* queue information */
        u8 tx_mapping_mode;              /* ICE_MAP_MODE_[CONTIG|SCATTER] */
@@ -262,7 +269,7 @@ struct ice_pf {
        struct ice_hw_port_stats stats;
        struct ice_hw_port_stats stats_prev;
        struct ice_hw hw;
-        bool stat_prev_loaded;  /* has previous stats been loaded */
+        u8 stat_prev_loaded;    /* has previous stats been loaded */
        char int_name[ICE_INT_NAME_STR_LEN];
 };
diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
index 7541ec2270b3..a0614f472658 100644
--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
@@ -329,19 +329,19 @@ struct ice_aqc_vsi_props {
        /* VLAN section */
        __le16 pvid; /* VLANS include priority bits */
        u8 pvlan_reserved[2];
-        u8 port_vlan_flags;
+        u8 vlan_flags;
-#define ICE_AQ_VSI_PVLAN_MODE_S 0
+#define ICE_AQ_VSI_VLAN_MODE_S  0
-#define ICE_AQ_VSI_PVLAN_MODE_M (0x3 << ICE_AQ_VSI_PVLAN_MODE_S)
+#define ICE_AQ_VSI_VLAN_MODE_M  (0x3 << ICE_AQ_VSI_VLAN_MODE_S)
-#define ICE_AQ_VSI_PVLAN_MODE_UNTAGGED  0x1
+#define ICE_AQ_VSI_VLAN_MODE_UNTAGGED   0x1
-#define ICE_AQ_VSI_PVLAN_MODE_TAGGED    0x2
+#define ICE_AQ_VSI_VLAN_MODE_TAGGED     0x2
-#define ICE_AQ_VSI_PVLAN_MODE_ALL       0x3
+#define ICE_AQ_VSI_VLAN_MODE_ALL        0x3
 #define ICE_AQ_VSI_PVLAN_INSERT_PVID    BIT(2)
-#define ICE_AQ_VSI_PVLAN_EMOD_S 3
+#define ICE_AQ_VSI_VLAN_EMOD_S          3
-#define ICE_AQ_VSI_PVLAN_EMOD_M (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_M          (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH  (0x0 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_BOTH   (0x0 << ICE_AQ_VSI_VLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR_UP    (0x1 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR_UP     (0x1 << ICE_AQ_VSI_VLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_STR       (0x2 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_STR        (0x2 << ICE_AQ_VSI_VLAN_EMOD_S)
-#define ICE_AQ_VSI_PVLAN_EMOD_NOTHING   (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
+#define ICE_AQ_VSI_VLAN_EMOD_NOTHING    (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
        u8 pvlan_reserved2[3];
        /* ingress egress up sections */
        __le32 ingress_table; /* bitmap, 3 bits per up */
@@ -594,6 +594,7 @@ struct ice_sw_rule_lg_act {
 #define ICE_LG_ACT_GENERIC_OFFSET_M     (0x7 << ICE_LG_ACT_GENERIC_OFFSET_S)
 #define ICE_LG_ACT_GENERIC_PRIORITY_S   22
 #define ICE_LG_ACT_GENERIC_PRIORITY_M   (0x7 << ICE_LG_ACT_GENERIC_PRIORITY_S)
+#define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX 7
        /* Action = 7 - Set Stat count */
 #define ICE_LG_ACT_STAT_COUNT           0x7
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 71d032cc5fa7..661beea6af79 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -45,6 +45,9 @@ static enum ice_status ice_set_mac_type(struct ice_hw *hw)
 /**
 * ice_clear_pf_cfg - Clear PF configuration
 * @hw: pointer to the hardware structure
+ *
+ * Clears any existing PF configuration (VSIs, VSI lists, switch rules, port
+ * configuration, flow director filters, etc.).
 */
 enum ice_status ice_clear_pf_cfg(struct ice_hw *hw)
 {
@@ -1483,7 +1486,7 @@ enum ice_status ice_get_link_status(struct ice_port_info *pi, bool *link_up)
        struct ice_phy_info *phy_info;
        enum ice_status status = 0;
-        if (!pi)
+        if (!pi || !link_up)
                return ICE_ERR_PARAM;
        phy_info = &pi->phy;
@@ -1619,20 +1622,23 @@ __ice_aq_get_set_rss_lut(struct ice_hw *hw, u16 vsi_id, u8 lut_type, u8 *lut,
        }
        /* LUT size is only valid for Global and PF table types */
-        if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128) {
+        switch (lut_size) {
-                flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG <<
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128:
-                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+                break;
-                         ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512:
-        } else if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512) {
                flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512_FLAG <<
                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
                         ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
-        } else if ((lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K) &&
+                break;
-                   (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF)) {
+        case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K:
-                flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
+                if (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF) {
-                          ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+                        flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
-                         ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+                                  ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
-        } else {
+                                 ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+                        break;
+                }
+                /* fall-through */
+        default:
                status = ICE_ERR_PARAM;
                goto ice_aq_get_set_rss_lut_exit;
        }
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
index 7c511f144ed6..62be72fdc8f3 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
@@ -597,10 +597,14 @@ static enum ice_status ice_init_check_adminq(struct ice_hw *hw)
        return 0;
 init_ctrlq_free_rq:
-        ice_shutdown_rq(hw, cq);
+        if (cq->rq.head) {
-        ice_shutdown_sq(hw, cq);
+                ice_shutdown_rq(hw, cq);
-        mutex_destroy(&cq->sq_lock);
+                mutex_destroy(&cq->rq_lock);
-        mutex_destroy(&cq->rq_lock);
+        }
+        if (cq->sq.head) {
+                ice_shutdown_sq(hw, cq);
+                mutex_destroy(&cq->sq_lock);
+        }
        return status;
 }
@@ -706,10 +710,14 @@ static void ice_shutdown_ctrlq(struct ice_hw *hw, enum ice_ctl_q q_type)
                return;
        }
-        ice_shutdown_sq(hw, cq);
+        if (cq->sq.head) {
-        ice_shutdown_rq(hw, cq);
+                ice_shutdown_sq(hw, cq);
-        mutex_destroy(&cq->sq_lock);
+                mutex_destroy(&cq->sq_lock);
-        mutex_destroy(&cq->rq_lock);
+        }
+        if (cq->rq.head) {
+                ice_shutdown_rq(hw, cq);
+                mutex_destroy(&cq->rq_lock);
+        }
 }
 /**
@@ -1057,8 +1065,11 @@ ice_clean_rq_elem(struct ice_hw *hw, struct ice_ctl_q_info *cq,
 clean_rq_elem_out:
        /* Set pending if needed, unlock and return */
-        if (pending)
+        if (pending) {
+                /* re-read HW head to calculate actual pending messages */
+                ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
                *pending = (u16)((ntc > ntu ? cq->rq.count : 0) + (ntu - ntc));
+        }
 clean_rq_elem_err:
        mutex_unlock(&cq->rq_lock);
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 1db304c01d10..c71a9b528d6d 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -26,7 +26,7 @@ static int ice_q_stats_len(struct net_device *netdev)
 {
        struct ice_netdev_priv *np = netdev_priv(netdev);
-        return ((np->vsi->num_txq + np->vsi->num_rxq) *
+        return ((np->vsi->alloc_txq + np->vsi->alloc_rxq) *
                (sizeof(struct ice_q_stats) / sizeof(u64)));
 }
@@ -218,7 +218,7 @@ static void ice_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
                        p += ETH_GSTRING_LEN;
                }
-                ice_for_each_txq(vsi, i) {
+                ice_for_each_alloc_txq(vsi, i) {
                        snprintf(p, ETH_GSTRING_LEN,
                                 "tx-queue-%u.tx_packets", i);
                        p += ETH_GSTRING_LEN;
@@ -226,7 +226,7 @@ static void ice_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
                        p += ETH_GSTRING_LEN;
                }
-                ice_for_each_rxq(vsi, i) {
+                ice_for_each_alloc_rxq(vsi, i) {
                        snprintf(p, ETH_GSTRING_LEN,
                                 "rx-queue-%u.rx_packets", i);
                        p += ETH_GSTRING_LEN;
@@ -253,6 +253,24 @@ static int ice_get_sset_count(struct net_device *netdev, int sset)
 {
        switch (sset) {
        case ETH_SS_STATS:
+                /* The number (and order) of strings reported *must* remain
+                 * constant for a given netdevice. This function must not
+                 * report a different number based on run time parameters
+                 * (such as the number of queues in use, or the setting of
+                 * a private ethtool flag). This is due to the nature of the
+                 * ethtool stats API.
+                 *
+                 * User space programs such as ethtool must make 3 separate
+                 * ioctl requests, one for size, one for the strings, and
+                 * finally one for the stats. Since these cross into
+                 * user space, changes to the number or size could result in
+                 * undefined memory access or incorrect string<->value
+                 * correlations for statistics.
+                 *
+                 * Even if it appears to be safe, changes to the size or
+                 * order of strings will suffer from race conditions and are
+                 * not safe.
+                 */
                return ICE_ALL_STATS_LEN(netdev);
        default:
                return -EOPNOTSUPP;
@@ -280,18 +298,26 @@ ice_get_ethtool_stats(struct net_device *netdev,
        /* populate per queue stats */
        rcu_read_lock();
-        ice_for_each_txq(vsi, j) {
+        ice_for_each_alloc_txq(vsi, j) {
                ring = READ_ONCE(vsi->tx_rings[j]);
-                if (!ring)
+                if (ring) {
-                        continue;
+                        data[i++] = ring->stats.pkts;
-                data[i++] = ring->stats.pkts;
+                        data[i++] = ring->stats.bytes;
-                data[i++] = ring->stats.bytes;
+                } else {
+                        data[i++] = 0;
+                        data[i++] = 0;
+                }
        }
-        ice_for_each_rxq(vsi, j) {
+        ice_for_each_alloc_rxq(vsi, j) {
                ring = READ_ONCE(vsi->rx_rings[j]);
-                data[i++] = ring->stats.pkts;
+                if (ring) {
-                data[i++] = ring->stats.bytes;
+                        data[i++] = ring->stats.pkts;
+                        data[i++] = ring->stats.bytes;
+                } else {
+                        data[i++] = 0;
+                        data[i++] = 0;
+                }
        }
        rcu_read_unlock();
@@ -519,7 +545,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
                goto done;
        }
-        for (i = 0; i < vsi->num_txq; i++) {
+        for (i = 0; i < vsi->alloc_txq; i++) {
                /* clone ring and setup updated count */
                tx_rings[i] = *vsi->tx_rings[i];
                tx_rings[i].count = new_tx_cnt;
@@ -551,7 +577,7 @@ process_rx:
                goto done;
        }
-        for (i = 0; i < vsi->num_rxq; i++) {
+        for (i = 0; i < vsi->alloc_rxq; i++) {
                /* clone ring and setup updated count */
                rx_rings[i] = *vsi->rx_rings[i];
                rx_rings[i].count = new_rx_cnt;
diff --git a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
index 499904874b3f..6076fc87df9d 100644
--- a/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
+++ b/drivers/net/ethernet/intel/ice/ice_hw_autogen.h
@@ -121,10 +121,6 @@
 #define PFINT_FW_CTL_CAUSE_ENA_S        30
 #define PFINT_FW_CTL_CAUSE_ENA_M        BIT(PFINT_FW_CTL_CAUSE_ENA_S)
 #define PFINT_OICR                      0x0016CA00
-#define PFINT_OICR_HLP_RDY_S            14
-#define PFINT_OICR_HLP_RDY_M            BIT(PFINT_OICR_HLP_RDY_S)
-#define PFINT_OICR_CPM_RDY_S            15
-#define PFINT_OICR_CPM_RDY_M            BIT(PFINT_OICR_CPM_RDY_S)
 #define PFINT_OICR_ECC_ERR_S            16
 #define PFINT_OICR_ECC_ERR_M            BIT(PFINT_OICR_ECC_ERR_S)
 #define PFINT_OICR_MAL_DETECT_S         19
@@ -133,10 +129,6 @@
 #define PFINT_OICR_GRST_M               BIT(PFINT_OICR_GRST_S)
 #define PFINT_OICR_PCI_EXCEPTION_S      21
 #define PFINT_OICR_PCI_EXCEPTION_M      BIT(PFINT_OICR_PCI_EXCEPTION_S)
-#define PFINT_OICR_GPIO_S               22
-#define PFINT_OICR_GPIO_M               BIT(PFINT_OICR_GPIO_S)
-#define PFINT_OICR_STORM_DETECT_S       24
-#define PFINT_OICR_STORM_DETECT_M       BIT(PFINT_OICR_STORM_DETECT_S)
 #define PFINT_OICR_HMC_ERR_S            26
 #define PFINT_OICR_HMC_ERR_M            BIT(PFINT_OICR_HMC_ERR_S)
 #define PFINT_OICR_PE_CRITERR_S         28
diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
index d23a91665b46..068dbc740b76 100644
--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
+++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
@@ -265,6 +265,7 @@ enum ice_rx_flex_desc_status_error_0_bits {
 struct ice_rlan_ctx {
        u16 head;
        u16 cpuid; /* bigger than needed, see above for reason */
+#define ICE_RLAN_BASE_S 7
        u64 base;
        u16 qlen;
 #define ICE_RLAN_CTX_DBUF_S 7
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 5299caf55a7f..f1e80eed2fd6 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -901,7 +901,7 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type)
                case ice_aqc_opc_get_link_status:
                        if (ice_handle_link_event(pf))
                                dev_err(&pf->pdev->dev,
-                                        "Could not handle link event");
+                                        "Could not handle link event\n");
                        break;
                default:
                        dev_dbg(&pf->pdev->dev,
@@ -917,13 +917,27 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type)
 }
 /**
+ * ice_ctrlq_pending - check if there is a difference between ntc and ntu
+ * @hw: pointer to hardware info
+ * @cq: control queue information
+ *
+ * returns true if there are pending messages in a queue, false if there aren't
+ */
+static bool ice_ctrlq_pending(struct ice_hw *hw, struct ice_ctl_q_info *cq)
+{
+        u16 ntu;
+        ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
+        return cq->rq.next_to_clean != ntu;
+}
+/**
 * ice_clean_adminq_subtask - clean the AdminQ rings
 * @pf: board private structure
 */
 static void ice_clean_adminq_subtask(struct ice_pf *pf)
 {
        struct ice_hw *hw = &pf->hw;
-        u32 val;
        if (!test_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state))
                return;
@@ -933,9 +947,13 @@ static void ice_clean_adminq_subtask(struct ice_pf *pf)
        clear_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state);
-        /* re-enable Admin queue interrupt causes */
+        /* There might be a situation where new messages arrive to a control
-        val = rd32(hw, PFINT_FW_CTL);
+         * queue between processing the last message and clearing the
-        wr32(hw, PFINT_FW_CTL, (val | PFINT_FW_CTL_CAUSE_ENA_M));
+         * EVENT_PENDING bit. So before exiting, check queue head again (using
+         * ice_ctrlq_pending) and process new messages if any.
+         */
+        if (ice_ctrlq_pending(hw, &hw->adminq))
+                __ice_clean_ctrlq(pf, ICE_CTL_Q_ADMIN);
        ice_flush(hw);
 }
@@ -1295,11 +1313,8 @@ static void ice_vsi_setup_q_map(struct ice_vsi *vsi, struct ice_vsi_ctx *ctxt)
                qcount = numq_tc;
        }
-        /* find higher power-of-2 of qcount */
+        /* find the (rounded up) power-of-2 of qcount */
-        pow = ilog2(qcount);
+        pow = order_base_2(qcount);
-        if (!is_power_of_2(qcount))
-                pow++;
        for (i = 0; i < ICE_MAX_TRAFFIC_CLASS; i++) {
                if (!(vsi->tc_cfg.ena_tc & BIT(i))) {
@@ -1352,14 +1367,15 @@ static void ice_set_dflt_vsi_ctx(struct ice_vsi_ctx *ctxt)
        ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE;
        /* Traffic from VSI can be sent to LAN */
        ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA;
-        /* Allow all packets untagged/tagged */
-        ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL &
+        /* By default bits 3 and 4 in vlan_flags are 0's which results in legacy
-                                       ICE_AQ_VSI_PVLAN_MODE_M) >>
+         * behavior (show VLAN, DEI, and UP) in descriptor. Also, allow all
-                                      ICE_AQ_VSI_PVLAN_MODE_S);
+         * packets untagged/tagged.
-        /* Show VLAN/UP from packets in Rx descriptors */
+         */
-        ctxt->info.port_vlan_flags |= ((ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH &
+        ctxt->info.vlan_flags = ((ICE_AQ_VSI_VLAN_MODE_ALL &
-                                        ICE_AQ_VSI_PVLAN_EMOD_M) >>
+                                  ICE_AQ_VSI_VLAN_MODE_M) >>
-                                       ICE_AQ_VSI_PVLAN_EMOD_S);
+                                 ICE_AQ_VSI_VLAN_MODE_S);
        /* Have 1:1 UP mapping for both ingress/egress tables */
        table |= ICE_UP_TABLE_TRANSLATE(0, 0);
        table |= ICE_UP_TABLE_TRANSLATE(1, 1);
@@ -1688,15 +1704,12 @@ static void ice_ena_misc_vector(struct ice_pf *pf)
        wr32(hw, PFINT_OICR_ENA, 0);    /* disable all */
        rd32(hw, PFINT_OICR);           /* read to clear */
-        val = (PFINT_OICR_HLP_RDY_M |
+        val = (PFINT_OICR_ECC_ERR_M |
-               PFINT_OICR_CPM_RDY_M |
-               PFINT_OICR_ECC_ERR_M |
               PFINT_OICR_MAL_DETECT_M |
               PFINT_OICR_GRST_M |
               PFINT_OICR_PCI_EXCEPTION_M |
-               PFINT_OICR_GPIO_M |
+               PFINT_OICR_HMC_ERR_M |
-               PFINT_OICR_STORM_DETECT_M |
+               PFINT_OICR_PE_CRITERR_M);
-               PFINT_OICR_HMC_ERR_M);
        wr32(hw, PFINT_OICR_ENA, val);
@@ -2058,15 +2071,13 @@ static int ice_req_irq_msix_misc(struct ice_pf *pf)
 skip_req_irq:
        ice_ena_misc_vector(pf);
-        val = (pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
+        val = ((pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
-              (ICE_RX_ITR & PFINT_OICR_CTL_ITR_INDX_M) |
+               PFINT_OICR_CTL_CAUSE_ENA_M);
-              PFINT_OICR_CTL_CAUSE_ENA_M;
        wr32(hw, PFINT_OICR_CTL, val);
        /* This enables Admin queue Interrupt causes */
-        val = (pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
+        val = ((pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
-              (ICE_RX_ITR & PFINT_FW_CTL_ITR_INDX_M) |
+               PFINT_FW_CTL_CAUSE_ENA_M);
-              PFINT_FW_CTL_CAUSE_ENA_M;
        wr32(hw, PFINT_FW_CTL, val);
        itr_gran = hw->itr_gran_200;
@@ -3246,8 +3257,10 @@ static void ice_clear_interrupt_scheme(struct ice_pf *pf)
        if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
                ice_dis_msix(pf);
-        devm_kfree(&pf->pdev->dev, pf->irq_tracker);
+        if (pf->irq_tracker) {
-        pf->irq_tracker = NULL;
+                devm_kfree(&pf->pdev->dev, pf->irq_tracker);
+                pf->irq_tracker = NULL;
+        }
 }
 /**
@@ -3271,7 +3284,7 @@ static int ice_probe(struct pci_dev *pdev,
        err = pcim_iomap_regions(pdev, BIT(ICE_BAR0), pci_name(pdev));
        if (err) {
-                dev_err(&pdev->dev, "I/O map error %d\n", err);
+                dev_err(&pdev->dev, "BAR0 I/O map error %d\n", err);
                return err;
        }
@@ -3720,10 +3733,10 @@ static int ice_vsi_manage_vlan_insertion(struct ice_vsi *vsi)
        enum ice_status status;
        /* Here we are configuring the VSI to let the driver add VLAN tags by
-         * setting port_vlan_flags to ICE_AQ_VSI_PVLAN_MODE_ALL. The actual VLAN
+         * setting vlan_flags to ICE_AQ_VSI_VLAN_MODE_ALL. The actual VLAN tag
-         * tag insertion happens in the Tx hot path, in ice_tx_map.
+         * insertion happens in the Tx hot path, in ice_tx_map.
         */
-        ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_MODE_ALL;
+        ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_ALL;
        ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
        ctxt.vsi_num = vsi->vsi_num;
@@ -3735,7 +3748,7 @@ static int ice_vsi_manage_vlan_insertion(struct ice_vsi *vsi)
                return -EIO;
        }
-        vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+        vsi->info.vlan_flags = ctxt.info.vlan_flags;
        return 0;
 }
@@ -3757,12 +3770,15 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
         */
        if (ena) {
                /* Strip VLAN tag from Rx packet and put it in the desc */
-                ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH;
+                ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_STR_BOTH;
        } else {
                /* Disable stripping. Leave tag in packet */
-                ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_NOTHING;
+                ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_NOTHING;
        }
+        /* Allow all packets untagged/tagged */
+        ctxt.info.vlan_flags |= ICE_AQ_VSI_VLAN_MODE_ALL;
        ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
        ctxt.vsi_num = vsi->vsi_num;
@@ -3773,7 +3789,7 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
                return -EIO;
        }
-        vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
+        vsi->info.vlan_flags = ctxt.info.vlan_flags;
        return 0;
 }
@@ -3986,7 +4002,7 @@ static int ice_setup_rx_ctx(struct ice_ring *ring)
        /* clear the context structure first */
        memset(&rlan_ctx, 0, sizeof(rlan_ctx));
-        rlan_ctx.base = ring->dma >> 7;
+        rlan_ctx.base = ring->dma >> ICE_RLAN_BASE_S;
        rlan_ctx.qlen = ring->count;
@@ -4098,11 +4114,12 @@ static int ice_vsi_cfg(struct ice_vsi *vsi)
 {
        int err;
-        ice_set_rx_mode(vsi->netdev);
+        if (vsi->netdev) {
+                ice_set_rx_mode(vsi->netdev);
-        err = ice_restore_vlan(vsi);
+                err = ice_restore_vlan(vsi);
-        if (err)
+                if (err)
-                return err;
+                        return err;
+        }
        err = ice_vsi_cfg_txqs(vsi);
        if (!err)
@@ -4868,7 +4885,7 @@ int ice_down(struct ice_vsi *vsi)
 */
 static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
 {
-        int i, err;
+        int i, err = 0;
        if (!vsi->num_txq) {
                dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Tx queues\n",
@@ -4893,7 +4910,7 @@ static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
 */
 static int ice_vsi_setup_rx_rings(struct ice_vsi *vsi)
 {
-        int i, err;
+        int i, err = 0;
        if (!vsi->num_rxq) {
                dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Rx queues\n",
@@ -5235,7 +5252,7 @@ static int ice_change_mtu(struct net_device *netdev, int new_mtu)
        u8 count = 0;
        if (new_mtu == netdev->mtu) {
-                netdev_warn(netdev, "mtu is already %d\n", netdev->mtu);
+                netdev_warn(netdev, "mtu is already %u\n", netdev->mtu);
                return 0;
        }
diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.c b/drivers/net/ethernet/intel/ice/ice_nvm.c
index 92da0a626ce0..295a8cd87fc1 100644
--- a/drivers/net/ethernet/intel/ice/ice_nvm.c
+++ b/drivers/net/ethernet/intel/ice/ice_nvm.c
@@ -131,9 +131,8 @@ ice_read_sr_word_aq(struct ice_hw *hw, u16 offset, u16 *data)
 *
 * This function will request NVM ownership.
 */
-static enum
+static enum ice_status
-ice_status ice_acquire_nvm(struct ice_hw *hw,
+ice_acquire_nvm(struct ice_hw *hw, enum ice_aq_res_access_type access)
-                           enum ice_aq_res_access_type access)
 {
        if (hw->nvm.blank_nvm_mode)
                return 0;
diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index 2e6c1d92cc88..eeae199469b6 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -1576,8 +1576,7 @@ ice_sched_update_vsi_child_nodes(struct ice_port_info *pi, u16 vsi_id, u8 tc,
                        return status;
        }
-        if (owner == ICE_SCHED_NODE_OWNER_LAN)
+        vsi->max_lanq[tc] = new_numqs;
-                vsi->max_lanq[tc] = new_numqs;
        return status;
 }
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
index 723d15f1e90b..6b7ec2ae5ad6 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.c
+++ b/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -645,14 +645,14 @@ ice_add_marker_act(struct ice_hw *hw, struct ice_fltr_mgmt_list_entry *m_ent,
        act |= (1 << ICE_LG_ACT_GENERIC_VALUE_S) & ICE_LG_ACT_GENERIC_VALUE_M;
        lg_act->pdata.lg_act.act[1] = cpu_to_le32(act);
-        act = (7 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
+        act = (ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX <<
+               ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_OFFSET_M;
        /* Third action Marker value */
        act |= ICE_LG_ACT_GENERIC;
        act |= (sw_marker << ICE_LG_ACT_GENERIC_VALUE_S) &
                ICE_LG_ACT_GENERIC_VALUE_M;
-        act |= (0 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
        lg_act->pdata.lg_act.act[2] = cpu_to_le32(act);
        /* call the fill switch rule to fill the lookup tx rx structure */
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h
index 6f4a0d159dbf..9b8ec128ee31 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.h
+++ b/drivers/net/ethernet/intel/ice/ice_switch.h
@@ -17,7 +17,7 @@ struct ice_vsi_ctx {
        u16 vsis_unallocated;
        u16 flags;
        struct ice_aqc_vsi_props info;
-        bool alloc_from_pool;
+        u8 alloc_from_pool;
 };
 enum ice_sw_fwd_act_type {
@@ -94,8 +94,8 @@ struct ice_fltr_info {
        u8 qgrp_size;
        /* Rule creations populate these indicators basing on the switch type */
-        bool lb_en;     /* Indicate if packet can be looped back */
+        u8 lb_en;       /* Indicate if packet can be looped back */
-        bool lan_en;    /* Indicate if packet can be forwarded to the uplink */
+        u8 lan_en;      /* Indicate if packet can be forwarded to the uplink */
 };
 /* Bookkeeping structure to hold bitmap of VSIs corresponding to VSI list id */
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
index 567067b650c4..31bc998fe200 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
@@ -143,7 +143,7 @@ struct ice_ring {
        u16 next_to_use;
        u16 next_to_clean;
-        bool ring_active;               /* is ring online or not */
+        u8 ring_active;                 /* is ring online or not */
        /* stats structs */
        struct ice_q_stats      stats;
diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
index 99c8a9a71b5e..97c366e0ca59 100644
--- a/drivers/net/ethernet/intel/ice/ice_type.h
+++ b/drivers/net/ethernet/intel/ice/ice_type.h
@@ -83,7 +83,7 @@ struct ice_link_status {
        u64 phy_type_low;
        u16 max_frame_size;
        u16 link_speed;
-        bool lse_ena;   /* Link Status Event notification */
+        u8 lse_ena;     /* Link Status Event notification */
        u8 link_info;
        u8 an_info;
        u8 ext_info;
@@ -101,7 +101,7 @@ struct ice_phy_info {
        struct ice_link_status link_info_old;
        u64 phy_type_low;
        enum ice_media_type media_type;
-        bool get_link_info;
+        u8 get_link_info;
 };
 /* Common HW capabilities for SW use */
@@ -167,7 +167,7 @@ struct ice_nvm_info {
        u32 oem_ver;              /* OEM version info */
        u16 sr_words;             /* Shadow RAM size in words */
        u16 ver;                  /* NVM package version */
-        bool blank_nvm_mode;      /* is NVM empty (no FW present) */
+        u8 blank_nvm_mode;        /* is NVM empty (no FW present) */
 };
 /* Max number of port to queue branches w.r.t topology */
@@ -181,7 +181,7 @@ struct ice_sched_node {
        struct ice_aqc_txsched_elem_data info;
        u32 agg_id;                     /* aggregator group id */
        u16 vsi_id;
-        bool in_use;                    /* suspended or in use */
+        u8 in_use;                      /* suspended or in use */
        u8 tx_sched_layer;              /* Logical Layer (1-9) */
        u8 num_children;
        u8 tc_num;
@@ -218,7 +218,7 @@ struct ice_sched_vsi_info {
 struct ice_sched_tx_policy {
        u16 max_num_vsis;
        u8 max_num_lan_qs_per_tc[ICE_MAX_TRAFFIC_CLASS];
-        bool rdma_ena;
+        u8 rdma_ena;
 };
 struct ice_port_info {
@@ -243,7 +243,7 @@ struct ice_port_info {
        struct list_head agg_list;      /* lists all aggregator */
        u8 lport;
 #define ICE_LPORT_MASK          0xff
-        bool is_vf;
+        u8 is_vf;
 };
 struct ice_switch_info {
@@ -287,7 +287,7 @@ struct ice_hw {
        u8 max_cgds;
        u8 sw_entry_point_layer;
-        bool evb_veb;           /* true for VEB, false for VEPA */
+        u8 evb_veb;             /* true for VEB, false for VEPA */
        struct ice_bus_info bus;
        struct ice_nvm_info nvm;
        struct ice_hw_dev_caps dev_caps;        /* device capabilities */
@@ -318,7 +318,7 @@ struct ice_hw {
        u8 itr_gran_100;
        u8 itr_gran_50;
        u8 itr_gran_25;
-        bool ucast_shared;      /* true if VSIs can share unicast addr */
+        u8 ucast_shared;        /* true if VSIs can share unicast addr */
 };
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index f92f7918112d..5acf3b743876 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1649,7 +1649,7 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
        if (hw->phy.type == e1000_phy_m88)
                igb_phy_disable_receiver(adapter);
-        mdelay(500);
+        msleep(500);
        return 0;
 }
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index d03c2f0d7592..a32c576c1e65 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3873,7 +3873,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
        adapter->mac_table = kcalloc(hw->mac.rar_entry_count,
                                     sizeof(struct igb_mac_addr),
-                                     GFP_ATOMIC);
+                                     GFP_KERNEL);
        if (!adapter->mac_table)
                return -ENOMEM;
@@ -3883,7 +3883,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
        /* Setup and initialize a copy of the hw vlan table array */
        adapter->shadow_vfta = kcalloc(E1000_VLAN_FILTER_TBL_SIZE, sizeof(u32),
-                                       GFP_ATOMIC);
+                                       GFP_KERNEL);
        if (!adapter->shadow_vfta)
                return -ENOMEM;
@@ -5816,7 +5816,8 @@ static void igb_tx_csum(struct igb_ring *tx_ring, struct igb_tx_buffer *first)
        if (skb->ip_summed != CHECKSUM_PARTIAL) {
 csum_failed:
-                if (!(first->tx_flags & IGB_TX_FLAGS_VLAN))
+                if (!(first->tx_flags & IGB_TX_FLAGS_VLAN) &&
+                    !tx_ring->launchtime_enable)
                        return;
                goto no_csum;
        }
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 43664adf7a3c..d3e72d0f66ef 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -771,14 +771,13 @@ ixgb_setup_rx_resources(struct ixgb_adapter *adapter)
        rxdr->size = rxdr->count * sizeof(struct ixgb_rx_desc);
        rxdr->size = ALIGN(rxdr->size, 4096);
-        rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
+        rxdr->desc = dma_zalloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
-                                        GFP_KERNEL);
+                                         GFP_KERNEL);
        if (!rxdr->desc) {
                vfree(rxdr->buffer_info);
                return -ENOMEM;
        }
-        memset(rxdr->desc, 0, rxdr->size);
        rxdr->next_to_clean = 0;
        rxdr->next_to_use = 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 94b3165ff543..ccd852ad62a4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
        }
        /* alloc the udl from per cpu ddp pool */
-        ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
+        ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
        if (!ddp->udl) {
                e_err(drv, "failed allocated ddp context\n");
                goto out_noddp_unmap;
@@ -760,7 +760,7 @@ int ixgbe_setup_fcoe_ddp_resources(struct ixgbe_adapter *adapter)
                return 0;
        /* Extra buffer to be shared by all DDPs for HW work around */
-        buffer = kmalloc(IXGBE_FCBUFF_MIN, GFP_ATOMIC);
+        buffer = kmalloc(IXGBE_FCBUFF_MIN, GFP_KERNEL);
        if (!buffer)
                return -ENOMEM;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 447098005490..9a23d33a47ed 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6201,7 +6201,7 @@ static int ixgbe_sw_init(struct ixgbe_adapter *adapter,
        adapter->mac_table = kcalloc(hw->mac.num_rar_entries,
                                     sizeof(struct ixgbe_mac_addr),
-                                     GFP_ATOMIC);
+                                     GFP_KERNEL);
        if (!adapter->mac_table)
                return -ENOMEM;
@@ -6620,8 +6620,18 @@ static int ixgbe_change_mtu(struct net_device *netdev, int new_mtu)
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
        if (adapter->xdp_prog) {
-                e_warn(probe, "MTU cannot be changed while XDP program is loaded\n");
+                int new_frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN +
-                return -EPERM;
+                                     VLAN_HLEN;
+                int i;
+                for (i = 0; i < adapter->num_rx_queues; i++) {
+                        struct ixgbe_ring *ring = adapter->rx_ring[i];
+                        if (new_frame_size > ixgbe_rx_bufsz(ring)) {
+                                e_warn(probe, "Requested MTU size is not supported with XDP\n");
+                                return -EINVAL;
+                        }
+                }
        }
        /*
@@ -8983,6 +8993,15 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
 #ifdef CONFIG_IXGBE_DCB
        if (tc) {
+                if (adapter->xdp_prog) {
+                        e_warn(probe, "DCB is not supported with XDP\n");
+                        ixgbe_init_interrupt_scheme(adapter);
+                        if (netif_running(dev))
+                                ixgbe_open(dev);
+                        return -EINVAL;
+                }
                netdev_set_num_tc(dev, tc);
                ixgbe_set_prio_tc_map(adapter);
@@ -9171,14 +9190,12 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                            struct tcf_exts *exts, u64 *action, u8 *queue)
 {
        const struct tc_action *a;
-        LIST_HEAD(actions);
+        int i;
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                /* Drop action */
                if (is_tcf_gact_shot(a)) {
                        *action = IXGBE_FDIR_DROP_QUEUE;
@@ -9936,6 +9953,11 @@ static void *ixgbe_fwd_add(struct net_device *pdev, struct net_device *vdev)
        int tcs = adapter->hw_tcs ? : 1;
        int pool, err;
+        if (adapter->xdp_prog) {
+                e_warn(probe, "L2FW offload is not supported with XDP\n");
+                return ERR_PTR(-EINVAL);
+        }
        /* The hardware supported by ixgbe only filters on the destination MAC
         * address. In order to avoid issues we only support offloading modes
         * where the hardware can actually provide the functionality.
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 6f59933cdff7..3c6f01c41b78 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -53,6 +53,11 @@ static int __ixgbe_enable_sriov(struct ixgbe_adapter *adapter,
        struct ixgbe_hw *hw = &adapter->hw;
        int i;
+        if (adapter->xdp_prog) {
+                e_warn(probe, "SRIOV is not supported with XDP\n");
+                return -EINVAL;
+        }
        /* Enable VMDq flag so device will be set in VM mode */
        adapter->flags |= IXGBE_FLAG_SRIOV_ENABLED |
                          IXGBE_FLAG_VMDQ_ENABLED;
@@ -688,8 +693,13 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
 static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 {
        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ];
        struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
+        u32 q_per_pool = __ALIGN_MASK(1, ~vmdq->mask);
        u8 num_tcs = adapter->hw_tcs;
+        u32 reg_val;
+        u32 queue;
+        u32 word;
        /* remove VLAN filters beloning to this VF */
        ixgbe_clear_vf_vlans(adapter, vf);
@@ -726,6 +736,27 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
        /* reset VF api back to unknown */
        adapter->vfinfo[vf].vf_api = ixgbe_mbox_api_10;
+        /* Restart each queue for given VF */
+        for (queue = 0; queue < q_per_pool; queue++) {
+                unsigned int reg_idx = (vf * q_per_pool) + queue;
+                reg_val = IXGBE_READ_REG(hw, IXGBE_PVFTXDCTL(reg_idx));
+                /* Re-enabling only configured queues */
+                if (reg_val) {
+                        reg_val |= IXGBE_TXDCTL_ENABLE;
+                        IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+                        reg_val &= ~IXGBE_TXDCTL_ENABLE;
+                        IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
+                }
+        }
+        /* Clear VF's mailbox memory */
+        for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
+                IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
+        IXGBE_WRITE_FLUSH(hw);
 }
 static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 44cfb2021145..41bcbb337e83 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -2518,6 +2518,7 @@ enum {
 /* Translated register #defines */
 #define IXGBE_PVFTDH(P)         (0x06010 + (0x40 * (P)))
 #define IXGBE_PVFTDT(P)         (0x06018 + (0x40 * (P)))
+#define IXGBE_PVFTXDCTL(P)      (0x06028 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAL(P)      (0x06038 + (0x40 * (P)))
 #define IXGBE_PVFTDWBAH(P)      (0x0603C + (0x40 * (P)))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 8cac8e9c8c63..25a9b8a8f63e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1978,14 +1978,15 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
                goto out_ok;
        modify_ip_header = false;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
+                int k;
                if (!is_tcf_pedit(a))
                        continue;
                nkeys = tcf_pedit_nkeys(a);
-                for (i = 0; i < nkeys; i++) {
+                for (k = 0; k < nkeys; k++) {
-                        htype = tcf_pedit_htype(a, i);
+                        htype = tcf_pedit_htype(a, k);
                        if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
                            htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
                                modify_ip_header = true;
@@ -2049,15 +2050,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
        const struct tc_action *a;
        LIST_HEAD(actions);
        u32 action = 0;
-        int err;
+        int err, i;
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
        attr->flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_shot(a)) {
                        action |= MLX5_FLOW_CONTEXT_ACTION_DROP;
                        if (MLX5_CAP_FLOWTABLE(priv->mdev,
@@ -2666,7 +2666,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
        LIST_HEAD(actions);
        bool encap = false;
        u32 action = 0;
-        int err;
+        int err, i;
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
@@ -2674,8 +2674,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
        attr->in_rep = rpriv->rep;
        attr->in_mdev = priv->mdev;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_shot(a)) {
                        action |= MLX5_FLOW_CONTEXT_ACTION_DROP |
                                  MLX5_FLOW_CONTEXT_ACTION_COUNT;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 6070d1591d1e..930700413b1d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -1346,8 +1346,7 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                return -ENOMEM;
        mall_tc_entry->cookie = f->cookie;
-        tcf_exts_to_list(f->exts, &actions);
+        a = tcf_exts_first_action(f->exts);
-        a = list_first_entry(&actions, struct tc_action, list);
        if (is_tcf_mirred_egress_mirror(a) && protocol == htons(ETH_P_ALL)) {
                struct mlxsw_sp_port_mall_mirror_tc_entry *mirror;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 3ae930196741..3cdb7aca90b7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -414,6 +414,8 @@ mlxsw_sp_netdevice_ipip_ul_event(struct mlxsw_sp *mlxsw_sp,
 void
 mlxsw_sp_port_vlan_router_leave(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan);
 void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif);
+void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
+                                 struct net_device *dev);
 /* spectrum_kvdl.c */
 enum mlxsw_sp_kvdl_entry_type {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index ebd1b24ebaa5..8d211972c5e9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -21,8 +21,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
                                         struct netlink_ext_ack *extack)
 {
        const struct tc_action *a;
-        LIST_HEAD(actions);
+        int err, i;
-        int err;
        if (!tcf_exts_has_actions(exts))
                return 0;
@@ -32,8 +31,7 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
        if (err)
                return err;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                if (is_tcf_gact_ok(a)) {
                        err = mlxsw_sp_acl_rulei_act_terminate(rulei);
                        if (err) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 3a96307f51b0..2ab9cf25a08a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -6234,6 +6234,17 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
        mlxsw_sp_vr_put(mlxsw_sp, vr);
 }
+void mlxsw_sp_rif_destroy_by_dev(struct mlxsw_sp *mlxsw_sp,
+                                 struct net_device *dev)
+{
+        struct mlxsw_sp_rif *rif;
+        rif = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        if (!rif)
+                return;
+        mlxsw_sp_rif_destroy(rif);
+}
 static void
 mlxsw_sp_rif_subport_params_init(struct mlxsw_sp_rif_params *params,
                                 struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 0d8444aaba01..db715da7bab7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -127,6 +127,24 @@ bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp,
        return !!mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
 }
+static int mlxsw_sp_bridge_device_upper_rif_destroy(struct net_device *dev,
+                                                    void *data)
+{
+        struct mlxsw_sp *mlxsw_sp = data;
+        mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
+        return 0;
+}
+static void mlxsw_sp_bridge_device_rifs_destroy(struct mlxsw_sp *mlxsw_sp,
+                                                struct net_device *dev)
+{
+        mlxsw_sp_rif_destroy_by_dev(mlxsw_sp, dev);
+        netdev_walk_all_upper_dev_rcu(dev,
+                                      mlxsw_sp_bridge_device_upper_rif_destroy,
+                                      mlxsw_sp);
+}
 static struct mlxsw_sp_bridge_device *
 mlxsw_sp_bridge_device_create(struct mlxsw_sp_bridge *bridge,
                              struct net_device *br_dev)
@@ -165,6 +183,8 @@ static void
 mlxsw_sp_bridge_device_destroy(struct mlxsw_sp_bridge *bridge,
                               struct mlxsw_sp_bridge_device *bridge_device)
 {
+        mlxsw_sp_bridge_device_rifs_destroy(bridge->mlxsw_sp,
+                                            bridge_device->dev);
        list_del(&bridge_device->list);
        if (bridge_device->vlan_enabled)
                bridge->vlan_enabled_exists = false;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index 0ba0356ec4e6..9044496803e6 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -796,11 +796,10 @@ int nfp_flower_compile_action(struct nfp_app *app,
                              struct net_device *netdev,
                              struct nfp_fl_payload *nfp_flow)
 {
-        int act_len, act_cnt, err, tun_out_cnt, out_cnt;
+        int act_len, act_cnt, err, tun_out_cnt, out_cnt, i;
        enum nfp_flower_tun_type tun_type;
        const struct tc_action *a;
        u32 csum_updated = 0;
-        LIST_HEAD(actions);
        memset(nfp_flow->action_data, 0, NFP_FL_MAX_A_SIZ);
        nfp_flow->meta.act_len = 0;
@@ -810,8 +809,7 @@ int nfp_flower_compile_action(struct nfp_app *app,
        tun_out_cnt = 0;
        out_cnt = 0;
-        tcf_exts_to_list(flow->exts, &actions);
+        tcf_exts_for_each_action(i, a, flow->exts) {
-        list_for_each_entry(a, &actions, list) {
                err = nfp_flower_loop_action(app, a, flow, nfp_flow, &act_len,
                                             netdev, &tun_type, &tun_out_cnt,
                                             &out_cnt, &csum_updated);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
index d9ab5add27a8..34193c2f1699 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_ops.c
@@ -407,7 +407,7 @@ static void qed_init_cmd_rd(struct qed_hwfn *p_hwfn,
        if (i == QED_INIT_MAX_POLL_COUNT) {
                DP_ERR(p_hwfn,
-                       "Timeout when polling reg: 0x%08x [ Waiting-for: %08x Got: %08x (comparsion %08x)]\n",
+                       "Timeout when polling reg: 0x%08x [ Waiting-for: %08x Got: %08x (comparison %08x)]\n",
                       addr, le32_to_cpu(cmd->expected_val),
                       val, le32_to_cpu(cmd->op_data));
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index d89a0e22f6e4..5d37ec7e9b0b 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -48,7 +48,7 @@
 #include "qed_reg_addr.h"
 #include "qed_sriov.h"
-#define CHIP_MCP_RESP_ITER_US 10
+#define QED_MCP_RESP_ITER_US    10
 #define QED_DRV_MB_MAX_RETRIES  (500 * 1000)    /* Account for 5 sec */
 #define QED_MCP_RESET_RETRIES   (50 * 1000)     /* Account for 500 msec */
@@ -183,18 +183,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn)
        return 0;
 }
+/* Maximum of 1 sec to wait for the SHMEM ready indication */
+#define QED_MCP_SHMEM_RDY_MAX_RETRIES   20
+#define QED_MCP_SHMEM_RDY_ITER_MS       50
 static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
        struct qed_mcp_info *p_info = p_hwfn->mcp_info;
+        u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
+        u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
        u32 drv_mb_offsize, mfw_mb_offsize;
        u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
        p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
-        if (!p_info->public_base)
+        if (!p_info->public_base) {
-                return 0;
+                DP_NOTICE(p_hwfn,
+                          "The address of the MCP scratch-pad is not configured\n");
+                return -EINVAL;
+        }
        p_info->public_base |= GRCBASE_MCP;
+        /* Get the MFW MB address and number of supported messages */
+        mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
+                                SECTION_OFFSIZE_ADDR(p_info->public_base,
+                                                     PUBLIC_MFW_MB));
+        p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
+        p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
+                                            p_info->mfw_mb_addr +
+                                            offsetof(struct public_mfw_mb,
+                                                     sup_msgs));
+        /* The driver can notify that there was an MCP reset, and might read the
+         * SHMEM values before the MFW has completed initializing them.
+         * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
+         * data ready indication.
+         */
+        while (!p_info->mfw_mb_length && --cnt) {
+                msleep(msec);
+                p_info->mfw_mb_length =
+                        (u16)qed_rd(p_hwfn, p_ptt,
+                                    p_info->mfw_mb_addr +
+                                    offsetof(struct public_mfw_mb, sup_msgs));
+        }
+        if (!cnt) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to get the SHMEM ready notification after %d msec\n",
+                          QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
+                return -EBUSY;
+        }
        /* Calculate the driver and MFW mailbox address */
        drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
                                SECTION_OFFSIZE_ADDR(p_info->public_base,
@@ -204,13 +243,6 @@ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
                   "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
                   drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
-        /* Set the MFW MB address */
-        mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
-                                SECTION_OFFSIZE_ADDR(p_info->public_base,
-                                                     PUBLIC_MFW_MB));
-        p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
-        p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
        /* Get the current driver mailbox sequence before sending
         * the first command
         */
@@ -285,9 +317,15 @@ static void qed_mcp_reread_offsets(struct qed_hwfn *p_hwfn,
 int qed_mcp_reset(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 org_mcp_reset_seq, seq, delay = CHIP_MCP_RESP_ITER_US, cnt = 0;
+        u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0;
        int rc = 0;
+        if (p_hwfn->mcp_info->b_block_cmd) {
+                DP_NOTICE(p_hwfn,
+                          "The MFW is not responsive. Avoid sending MCP_RESET mailbox command.\n");
+                return -EBUSY;
+        }
        /* Ensure that only a single thread is accessing the mailbox */
        spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
@@ -413,14 +451,41 @@ static void __qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                   (p_mb_params->cmd | seq_num), p_mb_params->param);
 }
+static void qed_mcp_cmd_set_blocking(struct qed_hwfn *p_hwfn, bool block_cmd)
+{
+        p_hwfn->mcp_info->b_block_cmd = block_cmd;
+        DP_INFO(p_hwfn, "%s sending of mailbox commands to the MFW\n",
+                block_cmd ? "Block" : "Unblock");
+}
+static void qed_mcp_print_cpu_info(struct qed_hwfn *p_hwfn,
+                                   struct qed_ptt *p_ptt)
+{
+        u32 cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2;
+        u32 delay = QED_MCP_RESP_ITER_US;
+        cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+        cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+        cpu_pc_0 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+        udelay(delay);
+        cpu_pc_1 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+        udelay(delay);
+        cpu_pc_2 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
+        DP_NOTICE(p_hwfn,
+                  "MCP CPU info: mode 0x%08x, state 0x%08x, pc {0x%08x, 0x%08x, 0x%08x}\n",
+                  cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2);
+}
 static int
 _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                       struct qed_ptt *p_ptt,
                       struct qed_mcp_mb_params *p_mb_params,
-                       u32 max_retries, u32 delay)
+                       u32 max_retries, u32 usecs)
 {
+        u32 cnt = 0, msecs = DIV_ROUND_UP(usecs, 1000);
        struct qed_mcp_cmd_elem *p_cmd_elem;
-        u32 cnt = 0;
        u16 seq_num;
        int rc = 0;
@@ -443,7 +508,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                        goto err;
                spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
-                udelay(delay);
+                if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+                        msleep(msecs);
+                else
+                        udelay(usecs);
        } while (++cnt < max_retries);
        if (cnt >= max_retries) {
@@ -472,7 +541,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                 * The spinlock stays locked until the list element is removed.
                 */
-                udelay(delay);
+                if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
+                        msleep(msecs);
+                else
+                        udelay(usecs);
                spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
                if (p_cmd_elem->b_is_completed)
@@ -491,11 +564,15 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                DP_NOTICE(p_hwfn,
                          "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
                          p_mb_params->cmd, p_mb_params->param);
+                qed_mcp_print_cpu_info(p_hwfn, p_ptt);
                spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
                qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
                spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+                if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
+                        qed_mcp_cmd_set_blocking(p_hwfn, true);
                return -EAGAIN;
        }
@@ -507,7 +584,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                   "MFW mailbox: response 0x%08x param 0x%08x [after %d.%03d ms]\n",
                   p_mb_params->mcp_resp,
                   p_mb_params->mcp_param,
-                   (cnt * delay) / 1000, (cnt * delay) % 1000);
+                   (cnt * usecs) / 1000, (cnt * usecs) % 1000);
        /* Clear the sequence number from the MFW response */
        p_mb_params->mcp_resp &= FW_MSG_CODE_MASK;
@@ -525,7 +602,7 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
 {
        size_t union_data_size = sizeof(union drv_union_data);
        u32 max_retries = QED_DRV_MB_MAX_RETRIES;
-        u32 delay = CHIP_MCP_RESP_ITER_US;
+        u32 usecs = QED_MCP_RESP_ITER_US;
        /* MCP not initialized */
        if (!qed_mcp_is_init(p_hwfn)) {
@@ -533,6 +610,13 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                return -EBUSY;
        }
+        if (p_hwfn->mcp_info->b_block_cmd) {
+                DP_NOTICE(p_hwfn,
+                          "The MFW is not responsive. Avoid sending mailbox command 0x%08x [param 0x%08x].\n",
+                          p_mb_params->cmd, p_mb_params->param);
+                return -EBUSY;
+        }
        if (p_mb_params->data_src_size > union_data_size ||
            p_mb_params->data_dst_size > union_data_size) {
                DP_ERR(p_hwfn,
@@ -542,8 +626,13 @@ static int qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
                return -EINVAL;
        }
+        if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) {
+                max_retries = DIV_ROUND_UP(max_retries, 1000);
+                usecs *= 1000;
+        }
        return _qed_mcp_cmd_and_union(p_hwfn, p_ptt, p_mb_params, max_retries,
-                                      delay);
+                                      usecs);
 }
 int qed_mcp_cmd(struct qed_hwfn *p_hwfn,
@@ -761,6 +850,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hwfn,
        mb_params.data_src_size = sizeof(load_req);
        mb_params.p_data_dst = &load_rsp;
        mb_params.data_dst_size = sizeof(load_rsp);
+        mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
        DP_VERBOSE(p_hwfn, QED_MSG_SP,
                   "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n",
@@ -982,7 +1072,8 @@ int qed_mcp_load_req(struct qed_hwfn *p_hwfn,
 int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 wol_param, mcp_resp, mcp_param;
+        struct qed_mcp_mb_params mb_params;
+        u32 wol_param;
        switch (p_hwfn->cdev->wol_config) {
        case QED_OV_WOL_DISABLED:
@@ -1000,8 +1091,12 @@ int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
                wol_param = DRV_MB_PARAM_UNLOAD_WOL_MCP;
        }
-        return qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_UNLOAD_REQ, wol_param,
+        memset(&mb_params, 0, sizeof(mb_params));
-                           &mcp_resp, &mcp_param);
+        mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ;
+        mb_params.param = wol_param;
+        mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
+        return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params);
 }
 int qed_mcp_unload_done(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
@@ -2077,31 +2172,65 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
        return rc;
 }
+/* A maximal 100 msec waiting time for the MCP to halt */
+#define QED_MCP_HALT_SLEEP_MS           10
+#define QED_MCP_HALT_MAX_RETRIES        10
 int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 resp = 0, param = 0;
+        u32 resp = 0, param = 0, cpu_state, cnt = 0;
        int rc;
        rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
                         &param);
-        if (rc)
+        if (rc) {
                DP_ERR(p_hwfn, "MCP response failure, aborting\n");
+                return rc;
+        }
-        return rc;
+        do {
+                msleep(QED_MCP_HALT_SLEEP_MS);
+                cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+                if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
+                        break;
+        } while (++cnt < QED_MCP_HALT_MAX_RETRIES);
+        if (cnt == QED_MCP_HALT_MAX_RETRIES) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+                          qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
+                return -EBUSY;
+        }
+        qed_mcp_cmd_set_blocking(p_hwfn, true);
+        return 0;
 }
+#define QED_MCP_RESUME_SLEEP_MS 10
 int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
 {
-        u32 value, cpu_mode;
+        u32 cpu_mode, cpu_state;
        qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
-        value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
-        value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
-        qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
        cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+        cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
+        qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
+        msleep(QED_MCP_RESUME_SLEEP_MS);
+        cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
-        return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
+        if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
+                DP_NOTICE(p_hwfn,
+                          "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
+                          cpu_mode, cpu_state);
+                return -EBUSY;
+        }
+        qed_mcp_cmd_set_blocking(p_hwfn, false);
+        return 0;
 }
 int qed_mcp_ov_update_current_config(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.h b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
index 047976d5c6e9..85e6b3989e7a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
@@ -635,11 +635,14 @@ struct qed_mcp_info {
         */
        spinlock_t                              cmd_lock;
+        /* Flag to indicate whether sending a MFW mailbox command is blocked */
+        bool                                    b_block_cmd;
        /* Spinlock used for syncing SW link-changes and link-changes
         * originating from attention context.
         */
        spinlock_t                              link_lock;
-        bool                                    block_mb_sending;
        u32                                     public_base;
        u32                                     drv_mb_addr;
        u32                                     mfw_mb_addr;
@@ -660,14 +663,20 @@ struct qed_mcp_info {
 };
 struct qed_mcp_mb_params {
-        u32                     cmd;
+        u32 cmd;
-        u32                     param;
+        u32 param;
-        void                    *p_data_src;
+        void *p_data_src;
-        u8                      data_src_size;
+        void *p_data_dst;
-        void                    *p_data_dst;
+        u8 data_src_size;
-        u8                      data_dst_size;
+        u8 data_dst_size;
-        u32                     mcp_resp;
+        u32 mcp_resp;
-        u32                     mcp_param;
+        u32 mcp_param;
+        u32 flags;
+#define QED_MB_FLAG_CAN_SLEEP   (0x1 << 0)
+#define QED_MB_FLAG_AVOID_BLOCK (0x1 << 1)
+#define QED_MB_FLAGS_IS_SET(params, flag) \
+        ({ typeof(params) __params = (params); \
+           (__params && (__params->flags & QED_MB_FLAG_ ## flag)); })
 };
 struct qed_drv_tlv_hdr {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
index d8ad2dcad8d5..f736f70956fd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
@@ -562,8 +562,10 @@
        0
 #define MCP_REG_CPU_STATE \
        0xe05004UL
+#define MCP_REG_CPU_STATE_SOFT_HALTED   (0x1UL << 10)
 #define MCP_REG_CPU_EVENT_MASK \
        0xe05008UL
+#define MCP_REG_CPU_PROGRAM_COUNTER     0xe0501cUL
 #define PGLUE_B_REG_PF_BAR0_SIZE \
        0x2aae60UL
 #define PGLUE_B_REG_PF_BAR1_SIZE \
diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
index 9673d19308e6..b16ce7d93caf 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
@@ -2006,18 +2006,16 @@ unlock:
 static int qede_parse_actions(struct qede_dev *edev,
                              struct tcf_exts *exts)
 {
-        int rc = -EINVAL, num_act = 0;
+        int rc = -EINVAL, num_act = 0, i;
        const struct tc_action *a;
        bool is_drop = false;
-        LIST_HEAD(actions);
        if (!tcf_exts_has_actions(exts)) {
                DP_NOTICE(edev, "No tc actions received\n");
                return rc;
        }
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, a, exts) {
-        list_for_each_entry(a, &actions, list) {
                num_act++;
                if (is_tcf_gact_shot(a))
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 353f1c129af1..059ba9429e51 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2384,26 +2384,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev,
        return status;
 }
-static netdev_features_t qlge_fix_features(struct net_device *ndev,
-        netdev_features_t features)
-{
-        int err;
-        /* Update the behavior of vlan accel in the adapter */
-        err = qlge_update_hw_vlan_features(ndev, features);
-        if (err)
-                return err;
-        return features;
-}
 static int qlge_set_features(struct net_device *ndev,
        netdev_features_t features)
 {
        netdev_features_t changed = ndev->features ^ features;
+        int err;
+        if (changed & NETIF_F_HW_VLAN_CTAG_RX) {
+                /* Update the behavior of vlan accel in the adapter */
+                err = qlge_update_hw_vlan_features(ndev, features);
+                if (err)
+                        return err;
-        if (changed & NETIF_F_HW_VLAN_CTAG_RX)
                qlge_vlan_mode(ndev, features);
+        }
        return 0;
 }
@@ -4719,7 +4713,6 @@ static const struct net_device_ops qlge_netdev_ops = {
        .ndo_set_mac_address    = qlge_set_mac_address,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_tx_timeout         = qlge_tx_timeout,
-        .ndo_fix_features       = qlge_fix_features,
        .ndo_set_features       = qlge_set_features,
        .ndo_vlan_rx_add_vid    = qlge_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = qlge_vlan_rx_kill_vid,
diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
index b81f4faf7b10..1470fc12282b 100644
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /* Renesas Ethernet AVB device driver
 *
 * Copyright (C) 2014-2015 Renesas Electronics Corporation
@@ -5,10 +6,6 @@
 * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
 *
 * Based on the SuperH Ethernet driver
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License version 2,
- * as published by the Free Software Foundation.
 */
 #ifndef __RAVB_H__
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index c06f2df895c2..aff5516b781e 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /* Renesas Ethernet AVB device driver
 *
 * Copyright (C) 2014-2015 Renesas Electronics Corporation
@@ -5,10 +6,6 @@
 * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
 *
 * Based on the SuperH Ethernet driver
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License version 2,
- * as published by the Free Software Foundation.
 */
 #include <linux/cache.h>
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5573199c4536..ad4433d59237 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*  SuperH Ethernet device driver
 *
 *  Copyright (C) 2014 Renesas Electronics Corporation
@@ -5,18 +6,6 @@
 *  Copyright (C) 2008-2014 Renesas Solutions Corp.
 *  Copyright (C) 2013-2017 Cogent Embedded, Inc.
 *  Copyright (C) 2014 Codethink Limited
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
 */
 #include <linux/module.h>
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index f94be99cf400..0c18650bbfe6 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -1,19 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*  SuperH Ethernet device driver
 *
 *  Copyright (C) 2006-2012 Nobuhiro Iwamatsu
 *  Copyright (C) 2008-2012 Renesas Solutions Corp.
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
 */
 #ifndef __SH_ETH_H__
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index edf20361ea5f..bf4acebb6bcd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -33,7 +33,7 @@ config DWMAC_DWC_QOS_ETH
        select PHYLIB
        select CRC32
        select MII
-        depends on OF && COMMON_CLK && HAS_DMA
+        depends on OF && HAS_DMA
        help
          Support for chips using the snps,dwc-qos-ethernet.txt DT binding.
@@ -57,7 +57,7 @@ config DWMAC_ANARION
 config DWMAC_IPQ806X
        tristate "QCA IPQ806x DWMAC support"
        default ARCH_QCOM
-        depends on OF && COMMON_CLK && (ARCH_QCOM || COMPILE_TEST)
+        depends on OF && (ARCH_QCOM || COMPILE_TEST)
        select MFD_SYSCON
        help
          Support for QCA IPQ806X DWMAC Ethernet.
@@ -100,7 +100,7 @@ config DWMAC_OXNAS
 config DWMAC_ROCKCHIP
        tristate "Rockchip dwmac support"
        default ARCH_ROCKCHIP
-        depends on OF && COMMON_CLK && (ARCH_ROCKCHIP || COMPILE_TEST)
+        depends on OF && (ARCH_ROCKCHIP || COMPILE_TEST)
        select MFD_SYSCON
        help
          Support for Ethernet controller on Rockchip RK3288 SoC.
@@ -123,7 +123,7 @@ config DWMAC_SOCFPGA
 config DWMAC_STI
        tristate "STi GMAC support"
        default ARCH_STI
-        depends on OF && COMMON_CLK && (ARCH_STI || COMPILE_TEST)
+        depends on OF && (ARCH_STI || COMPILE_TEST)
        select MFD_SYSCON
        ---help---
          Support for ethernet controller on STi SOCs.
@@ -147,7 +147,7 @@ config DWMAC_STM32
 config DWMAC_SUNXI
        tristate "Allwinner GMAC support"
        default ARCH_SUNXI
-        depends on OF && COMMON_CLK && (ARCH_SUNXI || COMPILE_TEST)
+        depends on OF && (ARCH_SUNXI || COMPILE_TEST)
        ---help---
          Support for Allwinner A20/A31 GMAC ethernet controllers.
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 1a96dd9c1091..531294f4978b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -61,7 +61,7 @@ static int tc_fill_actions(struct stmmac_tc_entry *entry,
        struct stmmac_tc_entry *action_entry = entry;
        const struct tc_action *act;
        struct tcf_exts *exts;
-        LIST_HEAD(actions);
+        int i;
        exts = cls->knode.exts;
        if (!tcf_exts_has_actions(exts))
@@ -69,8 +69,7 @@ static int tc_fill_actions(struct stmmac_tc_entry *entry,
        if (frag)
                action_entry = frag;
-        tcf_exts_to_list(exts, &actions);
+        tcf_exts_for_each_action(i, act, exts) {
-        list_for_each_entry(act, &actions, list) {
                /* Accept */
                if (is_tcf_gact_ok(act)) {
                        action_entry->val.af = 1;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 507f68190cb1..1121a1ec407c 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -29,6 +29,7 @@
 #include <linux/netdevice.h>
 #include <linux/inetdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/pci.h>
 #include <linux/skbuff.h>
 #include <linux/if_vlan.h>
 #include <linux/in.h>
@@ -2039,12 +2040,16 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
 {
        struct net_device *ndev;
        struct net_device_context *net_device_ctx;
+        struct device *pdev = vf_netdev->dev.parent;
        struct netvsc_device *netvsc_dev;
        int ret;
        if (vf_netdev->addr_len != ETH_ALEN)
                return NOTIFY_DONE;
+        if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev))
+                return NOTIFY_DONE;
        /*
         * We will use the MAC address to locate the synthetic interface to
         * associate with the VF interface. If we don't find a matching
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 97742708460b..2cd71bdb6484 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -5217,8 +5217,8 @@ static int rtl8152_probe(struct usb_interface *intf,
                netdev->hw_features &= ~NETIF_F_RXCSUM;
        }
-        if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 &&
+        if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 && udev->serial &&
-            udev->serial && !strcmp(udev->serial, "000001000000")) {
+            (!strcmp(udev->serial, "000001000000") || !strcmp(udev->serial, "000002000000"))) {
                dev_info(&udev->dev, "Dell TB16 Dock, disable RX aggregation");
                set_bit(DELL_TB_RX_AGG_BUG, &tp->flags);
        }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 1b9951d2067e..d668682f91df 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -316,6 +316,14 @@ static bool nvme_dbbuf_update_and_check_event(u16 value, u32 *dbbuf_db,
                old_value = *dbbuf_db;
                *dbbuf_db = value;
+                /*
+                 * Ensure that the doorbell is updated before reading the event
+                 * index from memory.  The controller needs to provide similar
+                 * ordering to ensure the envent index is updated before reading
+                 * the doorbell.
+                 */
+                mb();
                if (!nvme_dbbuf_need_event(*dbbuf_ei, value, old_value))
                        return false;
        }
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index ebf3e7a6c49e..b5ec96abd048 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1210,7 +1210,7 @@ static int __init nvmet_init(void)
        error = nvmet_init_discovery();
        if (error)
-                goto out;
+                goto out_free_work_queue;
        error = nvmet_init_configfs();
        if (error)
@@ -1219,6 +1219,8 @@ static int __init nvmet_init(void)
 out_exit_discovery:
        nvmet_exit_discovery();
+out_free_work_queue:
+        destroy_workqueue(buffered_io_wq);
 out:
        return error;
 }
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 34712def81b1..5251689a1d9a 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -311,7 +311,7 @@ fcloop_tgt_lsrqst_done_work(struct work_struct *work)
        struct fcloop_tport *tport = tls_req->tport;
        struct nvmefc_ls_req *lsreq = tls_req->lsreq;
-        if (tport->remoteport)
+        if (!tport || tport->remoteport)
                lsreq->done(lsreq, tls_req->status);
 }
@@ -329,6 +329,7 @@ fcloop_ls_req(struct nvme_fc_local_port *localport,
        if (!rport->targetport) {
                tls_req->status = -ECONNREFUSED;
+                tls_req->tport = NULL;
                schedule_work(&tls_req->work);
                return ret;
        }
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 466e3c8582f0..9095b8290150 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -54,6 +54,28 @@ DEFINE_MUTEX(of_mutex);
 */
 DEFINE_RAW_SPINLOCK(devtree_lock);
+bool of_node_name_eq(const struct device_node *np, const char *name)
+{
+        const char *node_name;
+        size_t len;
+        if (!np)
+                return false;
+        node_name = kbasename(np->full_name);
+        len = strchrnul(node_name, '@') - node_name;
+        return (strlen(name) == len) && (strncmp(node_name, name, len) == 0);
+}
+bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+{
+        if (!np)
+                return false;
+        return strncmp(kbasename(np->full_name), prefix, strlen(prefix)) == 0;
+}
 int of_n_addr_cells(struct device_node *np)
 {
        u32 cells;
@@ -720,6 +742,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
 EXPORT_SYMBOL(of_get_next_available_child);
 /**
+ * of_get_compatible_child - Find compatible child node
+ * @parent:     parent node
+ * @compatible: compatible string
+ *
+ * Lookup child node whose compatible property contains the given compatible
+ * string.
+ *
+ * Returns a node pointer with refcount incremented, use of_node_put() on it
+ * when done; or NULL if not found.
+ */
+struct device_node *of_get_compatible_child(const struct device_node *parent,
+                                const char *compatible)
+{
+        struct device_node *child;
+        for_each_child_of_node(parent, child) {
+                if (of_device_is_compatible(child, compatible))
+                        break;
+        }
+        return child;
+}
+EXPORT_SYMBOL(of_get_compatible_child);
+/**
 *      of_get_child_by_name - Find the child node by name for a given parent
 *      @node:  parent node
 *      @name:  child name to look for.
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 977a8307fbb1..4f2816559205 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz,
        mutex_lock(&tz->lock);
-        if (mode == THERMAL_DEVICE_ENABLED)
+        if (mode == THERMAL_DEVICE_ENABLED) {
                tz->polling_delay = data->polling_delay;
-        else
+                tz->passive_delay = data->passive_delay;
+        } else {
                tz->polling_delay = 0;
+                tz->passive_delay = 0;
+        }
        mutex_unlock(&tz->lock);
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index c866cc165960..450ed66edf58 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -1,16 +1,6 @@
-/*
+// SPDX-License-Identifier: GPL-2.0
- * Copyright 2016 Freescale Semiconductor, Inc.
+//
- *
+// Copyright 2016 Freescale Semiconductor, Inc.
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- */
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -197,7 +187,7 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
        int ret;
        struct qoriq_tmu_data *data;
        struct device_node *np = pdev->dev.of_node;
-        u32 site = 0;
+        u32 site;
        if (!np) {
                dev_err(&pdev->dev, "Device OF-Node is NULL");
@@ -233,8 +223,9 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
        if (ret < 0)
                goto err_tmu;
-        data->tz = thermal_zone_of_sensor_register(&pdev->dev, data->sensor_id,
+        data->tz = devm_thermal_zone_of_sensor_register(&pdev->dev,
-                                data, &tmu_tz_ops);
+                                                        data->sensor_id,
+                                                        data, &tmu_tz_ops);
        if (IS_ERR(data->tz)) {
                ret = PTR_ERR(data->tz);
                dev_err(&pdev->dev,
@@ -243,7 +234,7 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
        }
        /* Enable monitoring */
-        site |= 0x1 << (15 - data->sensor_id);
+        site = 0x1 << (15 - data->sensor_id);
        tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
        return 0;
@@ -261,8 +252,6 @@ static int qoriq_tmu_remove(struct platform_device *pdev)
 {
        struct qoriq_tmu_data *data = platform_get_drvdata(pdev);
-        thermal_zone_of_sensor_unregister(&pdev->dev, data->tz);
        /* Disable monitoring */
        tmu_write(data, TMR_DISABLE, &data->regs->tmr);
diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
index 766521eb7071..7aed5337bdd3 100644
--- a/drivers/thermal/rcar_gen3_thermal.c
+++ b/drivers/thermal/rcar_gen3_thermal.c
@@ -1,19 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 *  R-Car Gen3 THS thermal sensor driver
 *  Based on rcar_thermal.c and work from Hien Dang and Khiem Nguyen.
 *
 * Copyright (C) 2016 Renesas Electronics Corporation.
 * Copyright (C) 2016 Sang Engineering
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; version 2 of the License.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
 */
 #include <linux/delay.h>
 #include <linux/err.h>
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index e77e63070e99..78f932822d38 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -1,21 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 *  R-Car THS/TSC thermal sensor driver
 *
 * Copyright (C) 2012 Renesas Solutions Corp.
 * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; version 2 of the License.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
 */
 #include <linux/delay.h>
 #include <linux/err.h>
@@ -660,6 +648,6 @@ static struct platform_driver rcar_thermal_driver = {
 };
 module_platform_driver(rcar_thermal_driver);
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("R-Car THS/TSC thermal sensor driver");
 MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 96c1d8400822..b13c6b4b2c66 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -952,7 +952,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d,
        list_for_each_entry_safe(node, n, &d->pending_list, node) {
                struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb;
                if (msg->iova <= vq_msg->iova &&
-                    msg->iova + msg->size - 1 > vq_msg->iova &&
+                    msg->iova + msg->size - 1 >= vq_msg->iova &&
                    vq_msg->type == VHOST_IOTLB_MISS) {
                        vhost_poll_queue(&node->vq->poll);
                        list_del(&node->node);
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index f2088838f690..5b471889d723 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -402,10 +402,19 @@ static ssize_t modalias_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(modalias);
+static ssize_t state_show(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%s\n",
+                        xenbus_strstate(to_xenbus_device(dev)->state));
+}
+static DEVICE_ATTR_RO(state);
 static struct attribute *xenbus_dev_attrs[] = {
        &dev_attr_nodename.attr,
        &dev_attr_devtype.attr,
        &dev_attr_modalias.attr,
+        &dev_attr_state.attr,
        NULL,
 };
diff --git a/fs/buffer.c b/fs/buffer.c
index 4cc679d5bf58..6f1ae3ac9789 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -39,7 +39,6 @@
 #include <linux/buffer_head.h>
 #include <linux/task_io_accounting_ops.h>
 #include <linux/bio.h>
-#include <linux/notifier.h>
 #include <linux/cpu.h>
 #include <linux/bitops.h>
 #include <linux/mpage.h>
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index ec3fba7d492f..488a9e7f8f66 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -24,6 +24,7 @@
 #include <linux/mpage.h>
 #include <linux/user_namespace.h>
 #include <linux/seq_file.h>
+#include <linux/blkdev.h>
 #include "isofs.h"
 #include "zisofs.h"
@@ -653,6 +654,12 @@ static int isofs_fill_super(struct super_block *s, void *data, int silent)
        /*
         * What if bugger tells us to go beyond page size?
         */
+        if (bdev_logical_block_size(s->s_bdev) > 2048) {
+                printk(KERN_WARNING
+                       "ISOFS: unsupported/invalid hardware sector size %d\n",
+                        bdev_logical_block_size(s->s_bdev));
+                goto out_freesbi;
+        }
        opt.blocksize = sb_min_blocksize(s, opt.blocksize);
        sbi->s_high_sierra = 0; /* default is iso9660 */
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 05506d60131c..59cdb27826de 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -132,13 +132,13 @@ static void __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)
        struct fsnotify_mark *mark;
        assert_spin_locked(&conn->lock);
+        /* We can get detached connector here when inode is getting unlinked. */
+        if (!fsnotify_valid_obj_type(conn->type))
+                return;
        hlist_for_each_entry(mark, &conn->list, obj_list) {
                if (mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED)
                        new_mask |= mark->mask;
        }
-        if (WARN_ON(!fsnotify_valid_obj_type(conn->type)))
-                return;
        *fsnotify_conn_mask_p(conn) = new_mask;
 }
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 860bfbe7a07a..f0cbf58ad4da 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -18,6 +18,7 @@
 #include <linux/quotaops.h>
 #include <linux/types.h>
 #include <linux/writeback.h>
+#include <linux/nospec.h>
 static int check_quotactl_permission(struct super_block *sb, int type, int cmd,
                                     qid_t id)
@@ -120,8 +121,6 @@ static int quota_getinfo(struct super_block *sb, int type, void __user *addr)
        struct if_dqinfo uinfo;
        int ret;
-        /* This checks whether qc_state has enough entries... */
-        BUILD_BUG_ON(MAXQUOTAS > XQM_MAXQUOTAS);
        if (!sb->s_qcop->get_state)
                return -ENOSYS;
        ret = sb->s_qcop->get_state(sb, &state);
@@ -354,10 +353,10 @@ static int quota_getstate(struct super_block *sb, struct fs_quota_stat *fqs)
         * GETXSTATE quotactl has space for just one set of time limits so
         * report them for the first enabled quota type
         */
-        for (type = 0; type < XQM_MAXQUOTAS; type++)
+        for (type = 0; type < MAXQUOTAS; type++)
                if (state.s_state[type].flags & QCI_ACCT_ENABLED)
                        break;
-        BUG_ON(type == XQM_MAXQUOTAS);
+        BUG_ON(type == MAXQUOTAS);
        fqs->qs_btimelimit = state.s_state[type].spc_timelimit;
        fqs->qs_itimelimit = state.s_state[type].ino_timelimit;
        fqs->qs_rtbtimelimit = state.s_state[type].rt_spc_timelimit;
@@ -427,10 +426,10 @@ static int quota_getstatev(struct super_block *sb, struct fs_quota_statv *fqs)
         * GETXSTATV quotactl has space for just one set of time limits so
         * report them for the first enabled quota type
         */
-        for (type = 0; type < XQM_MAXQUOTAS; type++)
+        for (type = 0; type < MAXQUOTAS; type++)
                if (state.s_state[type].flags & QCI_ACCT_ENABLED)
                        break;
-        BUG_ON(type == XQM_MAXQUOTAS);
+        BUG_ON(type == MAXQUOTAS);
        fqs->qs_btimelimit = state.s_state[type].spc_timelimit;
        fqs->qs_itimelimit = state.s_state[type].ino_timelimit;
        fqs->qs_rtbtimelimit = state.s_state[type].rt_spc_timelimit;
@@ -701,8 +700,9 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
 {
        int ret;
-        if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS))
+        if (type >= MAXQUOTAS)
                return -EINVAL;
+        type = array_index_nospec(type, MAXQUOTAS);
        /*
         * Quota not supported on this fs? Check this before s_quota_types
         * since they needn't be set if quota is not supported at all.
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 3040dc2a32f6..6f515651a2c2 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -764,9 +764,7 @@ static int udf_find_fileset(struct super_block *sb,
                            struct kernel_lb_addr *root)
 {
        struct buffer_head *bh = NULL;
-        long lastblock;
        uint16_t ident;
-        struct udf_sb_info *sbi;
        if (fileset->logicalBlockNum != 0xFFFFFFFF ||
            fileset->partitionReferenceNum != 0xFFFF) {
@@ -779,69 +777,11 @@ static int udf_find_fileset(struct super_block *sb,
                        return 1;
                }
-        }
-        sbi = UDF_SB(sb);
-        if (!bh) {
-                /* Search backwards through the partitions */
-                struct kernel_lb_addr newfileset;
-/* --> cvg: FIXME - is it reasonable? */
-                return 1;
-                for (newfileset.partitionReferenceNum = sbi->s_partitions - 1;
-                     (newfileset.partitionReferenceNum != 0xFFFF &&
-                      fileset->logicalBlockNum == 0xFFFFFFFF &&
-                      fileset->partitionReferenceNum == 0xFFFF);
-                     newfileset.partitionReferenceNum--) {
-                        lastblock = sbi->s_partmaps
-                                        [newfileset.partitionReferenceNum]
-                                                .s_partition_len;
-                        newfileset.logicalBlockNum = 0;
-                        do {
-                                bh = udf_read_ptagged(sb, &newfileset, 0,
-                                                      &ident);
-                                if (!bh) {
-                                        newfileset.logicalBlockNum++;
-                                        continue;
-                                }
-                                switch (ident) {
-                                case TAG_IDENT_SBD:
-                                {
-                                        struct spaceBitmapDesc *sp;
-                                        sp = (struct spaceBitmapDesc *)
-                                                                bh->b_data;
-                                        newfileset.logicalBlockNum += 1 +
-                                                ((le32_to_cpu(sp->numOfBytes) +
-                                                  sizeof(struct spaceBitmapDesc)
-                                                  - 1) >> sb->s_blocksize_bits);
-                                        brelse(bh);
-                                        break;
-                                }
-                                case TAG_IDENT_FSD:
-                                        *fileset = newfileset;
-                                        break;
-                                default:
-                                        newfileset.logicalBlockNum++;
-                                        brelse(bh);
-                                        bh = NULL;
-                                        break;
-                                }
-                        } while (newfileset.logicalBlockNum < lastblock &&
-                                 fileset->logicalBlockNum == 0xFFFFFFFF &&
-                                 fileset->partitionReferenceNum == 0xFFFF);
-                }
-        }
-        if ((fileset->logicalBlockNum != 0xFFFFFFFF ||
-             fileset->partitionReferenceNum != 0xFFFF) && bh) {
                udf_debug("Fileset at block=%u, partition=%u\n",
                          fileset->logicalBlockNum,
                          fileset->partitionReferenceNum);
-                sbi->s_partition = fileset->partitionReferenceNum;
+                UDF_SB(sb)->s_partition = fileset->partitionReferenceNum;
                udf_load_fileset(sb, bh, root);
                brelse(bh);
                return 0;
@@ -1570,10 +1510,16 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
 */
 #define PART_DESC_ALLOC_STEP 32
+struct part_desc_seq_scan_data {
+        struct udf_vds_record rec;
+        u32 partnum;
+};
 struct desc_seq_scan_data {
        struct udf_vds_record vds[VDS_POS_LENGTH];
        unsigned int size_part_descs;
-        struct udf_vds_record *part_descs_loc;
+        unsigned int num_part_descs;
+        struct part_desc_seq_scan_data *part_descs_loc;
 };
 static struct udf_vds_record *handle_partition_descriptor(
@@ -1582,10 +1528,14 @@ static struct udf_vds_record *handle_partition_descriptor(
 {
        struct partitionDesc *desc = (struct partitionDesc *)bh->b_data;
        int partnum;
+        int i;
        partnum = le16_to_cpu(desc->partitionNumber);
-        if (partnum >= data->size_part_descs) {
+        for (i = 0; i < data->num_part_descs; i++)
-                struct udf_vds_record *new_loc;
+                if (partnum == data->part_descs_loc[i].partnum)
+                        return &(data->part_descs_loc[i].rec);
+        if (data->num_part_descs >= data->size_part_descs) {
+                struct part_desc_seq_scan_data *new_loc;
                unsigned int new_size = ALIGN(partnum, PART_DESC_ALLOC_STEP);
                new_loc = kcalloc(new_size, sizeof(*new_loc), GFP_KERNEL);
@@ -1597,7 +1547,7 @@ static struct udf_vds_record *handle_partition_descriptor(
                data->part_descs_loc = new_loc;
                data->size_part_descs = new_size;
        }
-        return &(data->part_descs_loc[partnum]);
+        return &(data->part_descs_loc[data->num_part_descs++].rec);
 }
@@ -1647,6 +1597,7 @@ static noinline int udf_process_sequence(
        memset(data.vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH);
        data.size_part_descs = PART_DESC_ALLOC_STEP;
+        data.num_part_descs = 0;
        data.part_descs_loc = kcalloc(data.size_part_descs,
                                      sizeof(*data.part_descs_loc),
                                      GFP_KERNEL);
@@ -1658,7 +1609,6 @@ static noinline int udf_process_sequence(
         * are in it.
         */
        for (; (!done && block <= lastblock); block++) {
                bh = udf_read_tagged(sb, block, block, &ident);
                if (!bh)
                        break;
@@ -1730,13 +1680,10 @@ static noinline int udf_process_sequence(
        }
        /* Now handle prevailing Partition Descriptors */
-        for (i = 0; i < data.size_part_descs; i++) {
+        for (i = 0; i < data.num_part_descs; i++) {
-                if (data.part_descs_loc[i].block) {
+                ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
-                        ret = udf_load_partdesc(sb,
+                if (ret < 0)
-                                                data.part_descs_loc[i].block);
+                        return ret;
-                        if (ret < 0)
-                                return ret;
-                }
        }
        return 0;
diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
index ca1d2cc2cdfa..18863d56273c 100644
--- a/include/linux/arm-smccc.h
+++ b/include/linux/arm-smccc.h
@@ -199,47 +199,57 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
 #define __declare_arg_0(a0, res)                                        \
        struct arm_smccc_res   *___res = res;                           \
-        register u32           r0 asm("r0") = a0;                       \
+        register unsigned long r0 asm("r0") = (u32)a0;                  \
        register unsigned long r1 asm("r1");                            \
        register unsigned long r2 asm("r2");                            \
        register unsigned long r3 asm("r3")
 #define __declare_arg_1(a0, a1, res)                                    \
+        typeof(a1) __a1 = a1;                                           \
        struct arm_smccc_res   *___res = res;                           \
-        register u32           r0 asm("r0") = a0;                       \
+        register unsigned long r0 asm("r0") = (u32)a0;                  \
-        register typeof(a1)    r1 asm("r1") = a1;                       \
+        register unsigned long r1 asm("r1") = __a1;                     \
        register unsigned long r2 asm("r2");                            \
        register unsigned long r3 asm("r3")
 #define __declare_arg_2(a0, a1, a2, res)                                \
+        typeof(a1) __a1 = a1;                                           \
+        typeof(a2) __a2 = a2;                                           \
        struct arm_smccc_res   *___res = res;                           \
-        register u32           r0 asm("r0") = a0;                       \
+        register unsigned long r0 asm("r0") = (u32)a0;                  \
-        register typeof(a1)    r1 asm("r1") = a1;                       \
+        register unsigned long r1 asm("r1") = __a1;                     \
-        register typeof(a2)    r2 asm("r2") = a2;                       \
+        register unsigned long r2 asm("r2") = __a2;                     \
        register unsigned long r3 asm("r3")
 #define __declare_arg_3(a0, a1, a2, a3, res)                            \
+        typeof(a1) __a1 = a1;                                           \
+        typeof(a2) __a2 = a2;                                           \
+        typeof(a3) __a3 = a3;                                           \
        struct arm_smccc_res   *___res = res;                           \
-        register u32           r0 asm("r0") = a0;                       \
+        register unsigned long r0 asm("r0") = (u32)a0;                  \
-        register typeof(a1)    r1 asm("r1") = a1;                       \
+        register unsigned long r1 asm("r1") = __a1;                     \
-        register typeof(a2)    r2 asm("r2") = a2;                       \
+        register unsigned long r2 asm("r2") = __a2;                     \
-        register typeof(a3)    r3 asm("r3") = a3
+        register unsigned long r3 asm("r3") = __a3
 #define __declare_arg_4(a0, a1, a2, a3, a4, res)                        \
+        typeof(a4) __a4 = a4;                                           \
        __declare_arg_3(a0, a1, a2, a3, res);                           \
-        register typeof(a4) r4 asm("r4") = a4
+        register unsigned long r4 asm("r4") = __a4
 #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res)                    \
+        typeof(a5) __a5 = a5;                                           \
        __declare_arg_4(a0, a1, a2, a3, a4, res);                       \
-        register typeof(a5) r5 asm("r5") = a5
+        register unsigned long r5 asm("r5") = __a5
 #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res)                \
+        typeof(a6) __a6 = a6;                                           \
        __declare_arg_5(a0, a1, a2, a3, a4, a5, res);                   \
-        register typeof(a6) r6 asm("r6") = a6
+        register unsigned long r6 asm("r6") = __a6
 #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res)            \
+        typeof(a7) __a7 = a7;                                           \
        __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res);               \
-        register typeof(a7) r7 asm("r7") = a7
+        register unsigned long r7 asm("r7") = __a7
 #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
 #define __declare_args(count, ...)  ___declare_args(count, __VA_ARGS__)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index b79387fd57da..65b4eaed1d96 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -855,7 +855,7 @@ static inline u8 i2c_8bit_addr_from_msg(const struct i2c_msg *msg)
 }
 u8 *i2c_get_dma_safe_msg_buf(struct i2c_msg *msg, unsigned int threshold);
-void i2c_release_dma_safe_msg_buf(struct i2c_msg *msg, u8 *buf);
+void i2c_put_dma_safe_msg_buf(u8 *buf, struct i2c_msg *msg, bool xferred);
 int i2c_handle_smbus_host_notify(struct i2c_adapter *adap, unsigned short addr);
 /**
diff --git a/include/linux/of.h b/include/linux/of.h
index 4d25e4f952d9..99b0ebf49632 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -256,6 +256,9 @@ static inline unsigned long of_read_ulong(const __be32 *cell, int size)
 #define OF_IS_DYNAMIC(x) test_bit(OF_DYNAMIC, &x->_flags)
 #define OF_MARK_DYNAMIC(x) set_bit(OF_DYNAMIC, &x->_flags)
+extern bool of_node_name_eq(const struct device_node *np, const char *name);
+extern bool of_node_name_prefix(const struct device_node *np, const char *prefix);
 static inline const char *of_node_full_name(const struct device_node *np)
 {
        return np ? np->full_name : "<no-node>";
@@ -290,6 +293,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node,
 extern struct device_node *of_get_next_available_child(
        const struct device_node *node, struct device_node *prev);
+extern struct device_node *of_get_compatible_child(const struct device_node *parent,
+                                        const char *compatible);
 extern struct device_node *of_get_child_by_name(const struct device_node *node,
                                        const char *name);
@@ -561,6 +566,16 @@ static inline struct device_node *to_of_node(const struct fwnode_handle *fwnode)
        return NULL;
 }
+static inline bool of_node_name_eq(const struct device_node *np, const char *name)
+{
+        return false;
+}
+static inline bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+{
+        return false;
+}
 static inline const char* of_node_full_name(const struct device_node *np)
 {
        return "<no-node>";
@@ -632,6 +647,12 @@ static inline bool of_have_populated_dt(void)
        return false;
 }
+static inline struct device_node *of_get_compatible_child(const struct device_node *parent,
+                                        const char *compatible)
+{
+        return NULL;
+}
 static inline struct device_node *of_get_child_by_name(
                                        const struct device_node *node,
                                        const char *name)
@@ -967,6 +988,18 @@ static inline struct device_node *of_find_matching_node(
        return of_find_matching_node_and_match(from, matches, NULL);
 }
+static inline const char *of_node_get_device_type(const struct device_node *np)
+{
+        return of_get_property(np, "type", NULL);
+}
+static inline bool of_node_is_type(const struct device_node *np, const char *type)
+{
+        const char *match = of_node_get_device_type(np);
+        return np && match && type && !strcmp(match, type);
+}
 /**
 * of_property_count_u8_elems - Count the number of u8 elements in a property
 *
diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h
index 9abc0ca7259b..9f0aa1b48c78 100644
--- a/include/linux/platform_data/ina2xx.h
+++ b/include/linux/platform_data/ina2xx.h
@@ -1,7 +1,7 @@
 /*
 * Driver for Texas Instruments INA219, INA226 power monitor chips
 *
- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
+ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
diff --git a/include/linux/quota.h b/include/linux/quota.h
index ca9772c8e48b..f32dd270b8e3 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -408,13 +408,7 @@ struct qc_type_state {
 struct qc_state {
        unsigned int s_incoredqs;       /* Number of dquots in core */
-        /*
+        struct qc_type_state s_state[MAXQUOTAS];  /* Per quota type information */
-         * Per quota type information. The array should really have
-         * max(MAXQUOTAS, XQM_MAXQUOTAS) entries. BUILD_BUG_ON in
-         * quota_getinfo() makes sure XQM_MAXQUOTAS is large enough.  Once VFS
-         * supports project quotas, this can be changed to MAXQUOTAS
-         */
-        struct qc_type_state s_state[XQM_MAXQUOTAS];
 };
 /* Structure for communicating via ->set_info */
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 1ad5b19e83a9..970303448c90 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -23,13 +23,11 @@ struct tc_action {
        const struct tc_action_ops      *ops;
        __u32                           type; /* for backward compat(TCA_OLD_COMPAT) */
        __u32                           order;
-        struct list_head                list;
        struct tcf_idrinfo              *idrinfo;
        u32                             tcfa_index;
        refcount_t                      tcfa_refcnt;
        atomic_t                        tcfa_bindcnt;
-        u32                             tcfa_capab;
        int                             tcfa_action;
        struct tcf_t                    tcfa_tm;
        struct gnet_stats_basic_packed  tcfa_bstats;
@@ -44,7 +42,6 @@ struct tc_action {
 #define tcf_index       common.tcfa_index
 #define tcf_refcnt      common.tcfa_refcnt
 #define tcf_bindcnt     common.tcfa_bindcnt
-#define tcf_capab       common.tcfa_capab
 #define tcf_action      common.tcfa_action
 #define tcf_tm          common.tcfa_tm
 #define tcf_bstats      common.tcfa_bstats
@@ -102,7 +99,6 @@ struct tc_action_ops {
        size_t  (*get_fill_size)(const struct tc_action *act);
        struct net_device *(*get_dev)(const struct tc_action *a);
        void    (*put_dev)(struct net_device *dev);
-        int     (*delete)(struct net *net, u32 index);
 };
 struct tc_action_net {
@@ -148,8 +144,6 @@ int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
                       const struct tc_action_ops *ops,
                       struct netlink_ext_ack *extack);
 int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index);
-bool tcf_idr_check(struct tc_action_net *tn, u32 index, struct tc_action **a,
-                    int bind);
 int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
                   struct tc_action **a, const struct tc_action_ops *ops,
                   int bind, bool cpustats);
@@ -158,7 +152,6 @@ void tcf_idr_insert(struct tc_action_net *tn, struct tc_action *a);
 void tcf_idr_cleanup(struct tc_action_net *tn, u32 index);
 int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,
                        struct tc_action **a, int bind);
-int tcf_idr_delete_index(struct tc_action_net *tn, u32 index);
 int __tcf_idr_release(struct tc_action *a, bool bind, bool strict);
 static inline int tcf_idr_release(struct tc_action *a, bool bind)
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index ef727f71336e..75a3f3fdb359 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -298,19 +298,13 @@ static inline void tcf_exts_put_net(struct tcf_exts *exts)
 #endif
 }
-static inline void tcf_exts_to_list(const struct tcf_exts *exts,
-                                    struct list_head *actions)
-{
 #ifdef CONFIG_NET_CLS_ACT
-        int i;
+#define tcf_exts_for_each_action(i, a, exts) \
+        for (i = 0; i < TCA_ACT_MAX_PRIO && ((a) = (exts)->actions[i]); i++)
-        for (i = 0; i < exts->nr_actions; i++) {
+#else
-                struct tc_action *a = exts->actions[i];
+#define tcf_exts_for_each_action(i, a, exts) \
+        for (; 0; (void)(i), (void)(a), (void)(exts))
-                list_add_tail(&a->list, actions);
-        }
 #endif
-}
 static inline void
 tcf_exts_stats_update(const struct tcf_exts *exts,
@@ -361,6 +355,15 @@ static inline bool tcf_exts_has_one_action(struct tcf_exts *exts)
 #endif
 }
+static inline struct tc_action *tcf_exts_first_action(struct tcf_exts *exts)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        return exts->actions[0];
+#else
+        return NULL;
+#endif
+}
 /**
 * tcf_exts_exec - execute tc filter extensions
 * @skb: socket buffer
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a4c3a09a91bc..ddc7c317e136 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2539,6 +2539,9 @@ struct ib_device {
        struct module               *owner;
        struct device                dev;
+        /* First group for device attributes, NULL terminated array */
+        const struct attribute_group    *groups[2];
        struct kobject               *ports_parent;
        struct list_head             port_list;
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 04b8eda94e7d..03cc59ee9c95 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -15,6 +15,7 @@
 #include <linux/jhash.h>
 #include <linux/filter.h>
 #include <linux/rculist_nulls.h>
+#include <linux/random.h>
 #include <uapi/linux/btf.h>
 #include "percpu_freelist.h"
 #include "bpf_lru_list.h"
@@ -41,6 +42,7 @@ struct bpf_htab {
        atomic_t count; /* number of elements in this hashtable */
        u32 n_buckets;  /* number of hash buckets */
        u32 elem_size;  /* size of each element in bytes */
+        u32 hashrnd;
 };
 /* each htab element is struct htab_elem + key + value */
@@ -371,6 +373,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
        if (!htab->buckets)
                goto free_htab;
+        htab->hashrnd = get_random_int();
        for (i = 0; i < htab->n_buckets; i++) {
                INIT_HLIST_NULLS_HEAD(&htab->buckets[i].head, i);
                raw_spin_lock_init(&htab->buckets[i].lock);
@@ -402,9 +405,9 @@ free_htab:
        return ERR_PTR(err);
 }
-static inline u32 htab_map_hash(const void *key, u32 key_len)
+static inline u32 htab_map_hash(const void *key, u32 key_len, u32 hashrnd)
 {
-        return jhash(key, key_len, 0);
+        return jhash(key, key_len, hashrnd);
 }
 static inline struct bucket *__select_bucket(struct bpf_htab *htab, u32 hash)
@@ -470,7 +473,7 @@ static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        head = select_bucket(htab, hash);
@@ -597,7 +600,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
        if (!key)
                goto find_first_elem;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        head = select_bucket(htab, hash);
@@ -824,7 +827,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
@@ -880,7 +883,7 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
@@ -945,7 +948,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
@@ -998,7 +1001,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
@@ -1071,7 +1074,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
@@ -1103,7 +1106,7 @@ static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
        key_size = map->key_size;
-        hash = htab_map_hash(key, key_size);
+        hash = htab_map_hash(key, key_size, htab->hashrnd);
        b = __select_bucket(htab, hash);
        head = &b->head;
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 98e621a29e8e..cf5195c7c331 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1427,12 +1427,15 @@ out:
 static void smap_write_space(struct sock *sk)
 {
        struct smap_psock *psock;
+        void (*write_space)(struct sock *sk);
        rcu_read_lock();
        psock = smap_psock_sk(sk);
        if (likely(psock && test_bit(SMAP_TX_RUNNING, &psock->state)))
                schedule_work(&psock->tx_work);
+        write_space = psock->save_write_space;
        rcu_read_unlock();
+        write_space(sk);
 }
 static void smap_stop_sock(struct smap_psock *psock, struct sock *sk)
@@ -2140,7 +2143,9 @@ static struct bpf_map *sock_hash_alloc(union bpf_attr *attr)
                return ERR_PTR(-EPERM);
        /* check sanity of attributes */
-        if (attr->max_entries == 0 || attr->value_size != 4 ||
+        if (attr->max_entries == 0 ||
+            attr->key_size == 0 ||
+            attr->value_size != 4 ||
            attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
                return ERR_PTR(-EINVAL);
@@ -2267,8 +2272,10 @@ static struct htab_elem *alloc_sock_hash_elem(struct bpf_htab *htab,
        }
        l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
                             htab->map.numa_node);
-        if (!l_new)
+        if (!l_new) {
+                atomic_dec(&htab->count);
                return ERR_PTR(-ENOMEM);
+        }
        memcpy(l_new->key, key, key_size);
        l_new->sk = sk;
diff --git a/kernel/cpu.c b/kernel/cpu.c
index ed44d7d34c2d..aa7fe85ad62e 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -102,8 +102,6 @@ static inline void cpuhp_lock_release(bool bringup) { }
 * @name:       Name of the step
 * @startup:    Startup function of the step
 * @teardown:   Teardown function of the step
- * @skip_onerr: Do not invoke the functions on error rollback
- *              Will go away once the notifiers are gone
 * @cant_stop:  Bringup/teardown can't be stopped at this step
 */
 struct cpuhp_step {
@@ -119,7 +117,6 @@ struct cpuhp_step {
                                         struct hlist_node *node);
        } teardown;
        struct hlist_head       list;
-        bool                    skip_onerr;
        bool                    cant_stop;
        bool                    multi_instance;
 };
@@ -550,12 +547,8 @@ static int bringup_cpu(unsigned int cpu)
 static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
 {
-        for (st->state--; st->state > st->target; st->state--) {
+        for (st->state--; st->state > st->target; st->state--)
-                struct cpuhp_step *step = cpuhp_get_step(st->state);
+                cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
-                if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
-        }
 }
 static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
@@ -644,12 +637,6 @@ static void cpuhp_thread_fun(unsigned int cpu)
        WARN_ON_ONCE(!cpuhp_is_ap_state(state));
-        if (st->rollback) {
-                struct cpuhp_step *step = cpuhp_get_step(state);
-                if (step->skip_onerr)
-                        goto next;
-        }
        if (cpuhp_is_atomic_state(state)) {
                local_irq_disable();
                st->result = cpuhp_invoke_callback(cpu, state, bringup, st->node, &st->last);
@@ -673,7 +660,6 @@ static void cpuhp_thread_fun(unsigned int cpu)
                st->should_run = false;
        }
-next:
        cpuhp_lock_release(bringup);
        if (!st->should_run)
@@ -916,12 +902,8 @@ void cpuhp_report_idle_dead(void)
 static void undo_cpu_down(unsigned int cpu, struct cpuhp_cpu_state *st)
 {
-        for (st->state++; st->state < st->target; st->state++) {
+        for (st->state++; st->state < st->target; st->state++)
-                struct cpuhp_step *step = cpuhp_get_step(st->state);
+                cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
-                if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
-        }
 }
 static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 924e37fb1620..fd6f8ed28e01 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -38,7 +38,6 @@
 #include <linux/kmsg_dump.h>
 #include <linux/syslog.h>
 #include <linux/cpu.h>
-#include <linux/notifier.h>
 #include <linux/rculist.h>
 #include <linux/poll.h>
 #include <linux/irq_work.h>
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 5470dce212c0..977918d5d350 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -261,7 +261,7 @@ static void __touch_watchdog(void)
 * entering idle state.  This should only be used for scheduler events.
 * Use touch_softlockup_watchdog() for everything else.
 */
-void touch_softlockup_watchdog_sched(void)
+notrace void touch_softlockup_watchdog_sched(void)
 {
        /*
         * Preemption can be enabled.  It doesn't matter which CPU's timestamp
@@ -270,7 +270,7 @@ void touch_softlockup_watchdog_sched(void)
        raw_cpu_write(watchdog_touch_ts, 0);
 }
-void touch_softlockup_watchdog(void)
+notrace void touch_softlockup_watchdog(void)
 {
        touch_softlockup_watchdog_sched();
        wq_watchdog_touch(raw_smp_processor_id());
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 1f7020d65d0a..71381168dede 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -29,7 +29,7 @@ static struct cpumask dead_events_mask;
 static unsigned long hardlockup_allcpu_dumped;
 static atomic_t watchdog_cpus = ATOMIC_INIT(0);
-void arch_touch_nmi_watchdog(void)
+notrace void arch_touch_nmi_watchdog(void)
 {
        /*
         * Using __raw here because some code paths have
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 60e80198c3df..0280deac392e 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5574,7 +5574,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
        mod_timer(&wq_watchdog_timer, jiffies + thresh);
 }
-void wq_watchdog_touch(int cpu)
+notrace void wq_watchdog_touch(int cpu)
 {
        if (cpu >= 0)
                per_cpu(wq_watchdog_touched_cpu, cpu) = jiffies;
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index c72577e472f2..a66595ba5543 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -4,7 +4,6 @@
 */
 #include <linux/percpu_counter.h>
-#include <linux/notifier.h>
 #include <linux/mutex.h>
 #include <linux/init.h>
 #include <linux/cpu.h>
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 310e29b51507..30526afa8343 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -28,7 +28,6 @@
 #include <linux/rhashtable.h>
 #include <linux/err.h>
 #include <linux/export.h>
-#include <linux/rhashtable.h>
 #define HASH_DEFAULT_SIZE       64UL
 #define HASH_MIN_SIZE           4U
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 6551d3b0dc30..84ae9bf5858a 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -27,7 +27,6 @@
 #include <linux/mpage.h>
 #include <linux/rmap.h>
 #include <linux/percpu.h>
-#include <linux/notifier.h>
 #include <linux/smp.h>
 #include <linux/sysctl.h>
 #include <linux/cpu.h>
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e75865d58ba7..05e983f42316 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -32,7 +32,6 @@
 #include <linux/slab.h>
 #include <linux/ratelimit.h>
 #include <linux/oom.h>
-#include <linux/notifier.h>
 #include <linux/topology.h>
 #include <linux/sysctl.h>
 #include <linux/cpu.h>
diff --git a/mm/slub.c b/mm/slub.c
index ce2b9e5cea77..8da34a8af53d 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -19,7 +19,6 @@
 #include <linux/slab.h>
 #include "slab.h"
 #include <linux/proc_fs.h>
-#include <linux/notifier.h>
 #include <linux/seq_file.h>
 #include <linux/kasan.h>
 #include <linux/cpu.h>
diff --git a/net/core/dev.c b/net/core/dev.c
index 325fc5088370..82114e1111e6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -93,7 +93,6 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
-#include <linux/notifier.h>
 #include <linux/skbuff.h>
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 962c4fd338ba..1c45c1d6d241 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -767,7 +767,6 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
        const struct tc_action *a;
        struct dsa_port *to_dp;
        int err = -EOPNOTSUPP;
-        LIST_HEAD(actions);
        if (!ds->ops->port_mirror_add)
                return err;
@@ -775,8 +774,7 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
        if (!tcf_exts_has_one_action(cls->exts))
                return err;
-        tcf_exts_to_list(cls->exts, &actions);
+        a = tcf_exts_first_action(cls->exts);
-        a = list_first_entry(&actions, struct tc_action, list);
        if (is_tcf_mirred_egress_mirror(a) && protocol == htons(ETH_P_ALL)) {
                struct dsa_mall_mirror_tc_entry *mirror;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 13d34427ca3d..02ff2dde9609 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -95,11 +95,10 @@ struct bbr {
        u32     mode:3,              /* current bbr_mode in state machine */
                prev_ca_state:3,     /* CA state on previous ACK */
                packet_conservation:1,  /* use packet conservation? */
-                restore_cwnd:1,      /* decided to revert cwnd to old value */
                round_start:1,       /* start of packet-timed tx->ack round? */
                idle_restart:1,      /* restarting after idle? */
                probe_rtt_round_done:1,  /* a BBR_PROBE_RTT round at 4 pkts? */
-                unused:12,
+                unused:13,
                lt_is_sampling:1,    /* taking long-term ("LT") samples now? */
                lt_rtt_cnt:7,        /* round trips in long-term interval */
                lt_use_bw:1;         /* use lt_bw as our bw estimate? */
@@ -175,6 +174,8 @@ static const u32 bbr_lt_bw_diff = 4000 / 8;
 /* If we estimate we're policed, use lt_bw for this many round trips: */
 static const u32 bbr_lt_bw_max_rtts = 48;
+static void bbr_check_probe_rtt_done(struct sock *sk);
 /* Do we estimate that STARTUP filled the pipe? */
 static bool bbr_full_bw_reached(const struct sock *sk)
 {
@@ -309,6 +310,8 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event)
                 */
                if (bbr->mode == BBR_PROBE_BW)
                        bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT);
+                else if (bbr->mode == BBR_PROBE_RTT)
+                        bbr_check_probe_rtt_done(sk);
        }
 }
@@ -396,17 +399,11 @@ static bool bbr_set_cwnd_to_recover_or_restore(
                cwnd = tcp_packets_in_flight(tp) + acked;
        } else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) {
                /* Exiting loss recovery; restore cwnd saved before recovery. */
-                bbr->restore_cwnd = 1;
+                cwnd = max(cwnd, bbr->prior_cwnd);
                bbr->packet_conservation = 0;
        }
        bbr->prev_ca_state = state;
-        if (bbr->restore_cwnd) {
-                /* Restore cwnd after exiting loss recovery or PROBE_RTT. */
-                cwnd = max(cwnd, bbr->prior_cwnd);
-                bbr->restore_cwnd = 0;
-        }
        if (bbr->packet_conservation) {
                *new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked);
                return true;    /* yes, using packet conservation */
@@ -423,10 +420,10 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs,
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct bbr *bbr = inet_csk_ca(sk);
-        u32 cwnd = 0, target_cwnd = 0;
+        u32 cwnd = tp->snd_cwnd, target_cwnd = 0;
        if (!acked)
-                return;
+                goto done;  /* no packet fully ACKed; just apply caps */
        if (bbr_set_cwnd_to_recover_or_restore(sk, rs, acked, &cwnd))
                goto done;
@@ -748,6 +745,20 @@ static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs)
                bbr_reset_probe_bw_mode(sk);  /* we estimate queue is drained */
 }
+static void bbr_check_probe_rtt_done(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bbr *bbr = inet_csk_ca(sk);
+        if (!(bbr->probe_rtt_done_stamp &&
+              after(tcp_jiffies32, bbr->probe_rtt_done_stamp)))
+                return;
+        bbr->min_rtt_stamp = tcp_jiffies32;  /* wait a while until PROBE_RTT */
+        tp->snd_cwnd = max(tp->snd_cwnd, bbr->prior_cwnd);
+        bbr_reset_mode(sk);
+}
 /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and
 * periodically drain the bottleneck queue, to converge to measure the true
 * min_rtt (unloaded propagation delay). This allows the flows to keep queues
@@ -806,12 +817,8 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
                } else if (bbr->probe_rtt_done_stamp) {
                        if (bbr->round_start)
                                bbr->probe_rtt_round_done = 1;
-                        if (bbr->probe_rtt_round_done &&
+                        if (bbr->probe_rtt_round_done)
-                            after(tcp_jiffies32, bbr->probe_rtt_done_stamp)) {
+                                bbr_check_probe_rtt_done(sk);
-                                bbr->min_rtt_stamp = tcp_jiffies32;
-                                bbr->restore_cwnd = 1;  /* snap to prior_cwnd */
-                                bbr_reset_mode(sk);
-                        }
                }
        }
        /* Restart after idle ends only once we process a new S/ACK for data */
@@ -862,7 +869,6 @@ static void bbr_init(struct sock *sk)
        bbr->has_seen_rtt = 0;
        bbr_init_pacing_rate_from_rtt(sk);
-        bbr->restore_cwnd = 0;
        bbr->round_start = 0;
        bbr->idle_restart = 0;
        bbr->full_bw_reached = 0;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9e041fa5c545..44c09eddbb78 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2517,6 +2517,12 @@ static int __net_init tcp_sk_init(struct net *net)
                if (res)
                        goto fail;
                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
+                /* Please enforce IP_DF and IPID==0 for RST and
+                 * ACK sent in SYN-RECV and TIME-WAIT state.
+                 */
+                inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;
                *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
        }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2fac4ad74867..d51a8c0b3372 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2398,7 +2398,7 @@ static void addrconf_add_mroute(struct net_device *dev)
        ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
-        ip6_route_add(&cfg, GFP_ATOMIC, NULL);
+        ip6_route_add(&cfg, GFP_KERNEL, NULL);
 }
 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
@@ -3062,7 +3062,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
        if (addr.s6_addr32[3]) {
                add_addr(idev, &addr, plen, scope);
                addrconf_prefix_route(&addr, plen, 0, idev->dev, 0, pflags,
-                                      GFP_ATOMIC);
+                                      GFP_KERNEL);
                return;
        }
@@ -3087,7 +3087,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                                add_addr(idev, &addr, plen, flag);
                                addrconf_prefix_route(&addr, plen, 0, idev->dev,
-                                                      0, pflags, GFP_ATOMIC);
+                                                      0, pflags, GFP_KERNEL);
                        }
                }
        }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d212738e9d10..c861a6d4671d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -198,6 +198,8 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
                }
        }
+        lwtstate_put(f6i->fib6_nh.nh_lwtstate);
        if (f6i->fib6_nh.nh_dev)
                dev_put(f6i->fib6_nh.nh_dev);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 38dec9da90d3..5095367c7204 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1094,7 +1094,8 @@ static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n,
        }
        t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, list);
+        if (t)
+                unregister_netdevice_queue(t->dev, list);
 }
 static int __net_init vti6_init_net(struct net *net)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7208c16302f6..c4ea13e8360b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -956,7 +956,7 @@ static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort)
        rt->dst.error = 0;
        rt->dst.output = ip6_output;
-        if (ort->fib6_type == RTN_LOCAL) {
+        if (ort->fib6_type == RTN_LOCAL || ort->fib6_type == RTN_ANYCAST) {
                rt->dst.input = ip6_input;
        } else if (ipv6_addr_type(&ort->fib6_dst.addr) & IPV6_ADDR_MULTICAST) {
                rt->dst.input = ip6_mc_input;
diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 82e6edf9c5d9..45f33d6dedf7 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -100,7 +100,7 @@ static int ncsi_write_package_info(struct sk_buff *skb,
        bool found;
        int rc;
-        if (id > ndp->package_num) {
+        if (id > ndp->package_num - 1) {
                netdev_info(ndp->ndev.dev, "NCSI: No package with id %u\n", id);
                return -ENODEV;
        }
@@ -240,7 +240,7 @@ static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
                return 0; /* done */
        hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
-                          &ncsi_genl_family, 0,  NCSI_CMD_PKG_INFO);
+                          &ncsi_genl_family, NLM_F_MULTI,  NCSI_CMD_PKG_INFO);
        if (!hdr) {
                rc = -EMSGSIZE;
                goto err;
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 2c7b7c352d3e..b9bbcf3d6c63 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -37,7 +37,6 @@
 #include <net/tcp.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
-#include <net/tcp.h>
 #include <net/addrconf.h>
 #include "rds.h"
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 229d63c99be2..db83dac1e7f4 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -300,21 +300,17 @@ int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(tcf_generic_walker);
-static bool __tcf_idr_check(struct tc_action_net *tn, u32 index,
+int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index)
-                            struct tc_action **a, int bind)
 {
        struct tcf_idrinfo *idrinfo = tn->idrinfo;
        struct tc_action *p;
        spin_lock(&idrinfo->lock);
        p = idr_find(&idrinfo->action_idr, index);
-        if (IS_ERR(p)) {
+        if (IS_ERR(p))
                p = NULL;
-        } else if (p) {
+        else if (p)
                refcount_inc(&p->tcfa_refcnt);
-                if (bind)
-                        atomic_inc(&p->tcfa_bindcnt);
-        }
        spin_unlock(&idrinfo->lock);
        if (p) {
@@ -323,23 +319,10 @@ static bool __tcf_idr_check(struct tc_action_net *tn, u32 index,
        }
        return false;
 }
-int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index)
-{
-        return __tcf_idr_check(tn, index, a, 0);
-}
 EXPORT_SYMBOL(tcf_idr_search);
-bool tcf_idr_check(struct tc_action_net *tn, u32 index, struct tc_action **a,
+static int tcf_idr_delete_index(struct tcf_idrinfo *idrinfo, u32 index)
-                   int bind)
 {
-        return __tcf_idr_check(tn, index, a, bind);
-}
-EXPORT_SYMBOL(tcf_idr_check);
-int tcf_idr_delete_index(struct tc_action_net *tn, u32 index)
-{
-        struct tcf_idrinfo *idrinfo = tn->idrinfo;
        struct tc_action *p;
        int ret = 0;
@@ -370,7 +353,6 @@ int tcf_idr_delete_index(struct tc_action_net *tn, u32 index)
        spin_unlock(&idrinfo->lock);
        return ret;
 }
-EXPORT_SYMBOL(tcf_idr_delete_index);
 int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
                   struct tc_action **a, const struct tc_action_ops *ops,
@@ -409,7 +391,6 @@ int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
        p->idrinfo = idrinfo;
        p->ops = ops;
-        INIT_LIST_HEAD(&p->list);
        *a = p;
        return 0;
 err3:
@@ -686,14 +667,18 @@ static int tcf_action_put(struct tc_action *p)
        return __tcf_action_put(p, false);
 }
+/* Put all actions in this array, skip those NULL's. */
 static void tcf_action_put_many(struct tc_action *actions[])
 {
        int i;
-        for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
+        for (i = 0; i < TCA_ACT_MAX_PRIO; i++) {
                struct tc_action *a = actions[i];
-                const struct tc_action_ops *ops = a->ops;
+                const struct tc_action_ops *ops;
+                if (!a)
+                        continue;
+                ops = a->ops;
                if (tcf_action_put(a))
                        module_put(ops->owner);
        }
@@ -1175,41 +1160,38 @@ err_out:
        return err;
 }
-static int tcf_action_delete(struct net *net, struct tc_action *actions[],
+static int tcf_action_delete(struct net *net, struct tc_action *actions[])
-                             int *acts_deleted, struct netlink_ext_ack *extack)
 {
-        u32 act_index;
+        int i;
-        int ret, i;
        for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
                struct tc_action *a = actions[i];
                const struct tc_action_ops *ops = a->ops;
                /* Actions can be deleted concurrently so we must save their
                 * type and id to search again after reference is released.
                 */
-                act_index = a->tcfa_index;
+                struct tcf_idrinfo *idrinfo = a->idrinfo;
+                u32 act_index = a->tcfa_index;
                if (tcf_action_put(a)) {
                        /* last reference, action was deleted concurrently */
                        module_put(ops->owner);
                } else  {
+                        int ret;
                        /* now do the delete */
-                        ret = ops->delete(net, act_index);
+                        ret = tcf_idr_delete_index(idrinfo, act_index);
-                        if (ret < 0) {
+                        if (ret < 0)
-                                *acts_deleted = i + 1;
                                return ret;
-                        }
                }
+                actions[i] = NULL;
        }
-        *acts_deleted = i;
        return 0;
 }
 static int
 tcf_del_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],
-               int *acts_deleted, u32 portid, size_t attr_size,
+               u32 portid, size_t attr_size, struct netlink_ext_ack *extack)
-               struct netlink_ext_ack *extack)
 {
        int ret;
        struct sk_buff *skb;
@@ -1227,7 +1209,7 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],
        }
        /* now do the delete */
-        ret = tcf_action_delete(net, actions, acts_deleted, extack);
+        ret = tcf_action_delete(net, actions);
        if (ret < 0) {
                NL_SET_ERR_MSG(extack, "Failed to delete TC action");
                kfree_skb(skb);
@@ -1249,8 +1231,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
        struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
        struct tc_action *act;
        size_t attr_size = 0;
-        struct tc_action *actions[TCA_ACT_MAX_PRIO + 1] = {};
+        struct tc_action *actions[TCA_ACT_MAX_PRIO] = {};
-        int acts_deleted = 0;
        ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, extack);
        if (ret < 0)
@@ -1280,14 +1261,13 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
        if (event == RTM_GETACTION)
                ret = tcf_get_notify(net, portid, n, actions, event, extack);
        else { /* delete */
-                ret = tcf_del_notify(net, n, actions, &acts_deleted, portid,
+                ret = tcf_del_notify(net, n, actions, portid, attr_size, extack);
-                                     attr_size, extack);
                if (ret)
                        goto err;
-                return ret;
+                return 0;
        }
 err:
-        tcf_action_put_many(&actions[acts_deleted]);
+        tcf_action_put_many(actions);
        return ret;
 }
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index d30b23e42436..0c68bc9cf0b4 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -395,13 +395,6 @@ static int tcf_bpf_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_bpf_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, bpf_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_bpf_ops __read_mostly = {
        .kind           =       "bpf",
        .type           =       TCA_ACT_BPF,
@@ -412,7 +405,6 @@ static struct tc_action_ops act_bpf_ops __read_mostly = {
        .init           =       tcf_bpf_init,
        .walk           =       tcf_bpf_walker,
        .lookup         =       tcf_bpf_search,
-        .delete         =       tcf_bpf_delete,
        .size           =       sizeof(struct tcf_bpf),
 };
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 54c0bf54f2ac..6f0f273f1139 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -198,13 +198,6 @@ static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_connmark_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, connmark_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_connmark_ops = {
        .kind           =       "connmark",
        .type           =       TCA_ACT_CONNMARK,
@@ -214,7 +207,6 @@ static struct tc_action_ops act_connmark_ops = {
        .init           =       tcf_connmark_init,
        .walk           =       tcf_connmark_walker,
        .lookup         =       tcf_connmark_search,
-        .delete         =       tcf_connmark_delete,
        .size           =       sizeof(struct tcf_connmark_info),
 };
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index e698d3fe2080..b8a67ae3105a 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -659,13 +659,6 @@ static size_t tcf_csum_get_fill_size(const struct tc_action *act)
        return nla_total_size(sizeof(struct tc_csum));
 }
-static int tcf_csum_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, csum_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_csum_ops = {
        .kind           = "csum",
        .type           = TCA_ACT_CSUM,
@@ -677,7 +670,6 @@ static struct tc_action_ops act_csum_ops = {
        .walk           = tcf_csum_walker,
        .lookup         = tcf_csum_search,
        .get_fill_size  = tcf_csum_get_fill_size,
-        .delete         = tcf_csum_delete,
        .size           = sizeof(struct tcf_csum),
 };
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 6a3f25a8ffb3..cd1d9bd32ef9 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -243,13 +243,6 @@ static size_t tcf_gact_get_fill_size(const struct tc_action *act)
        return sz;
 }
-static int tcf_gact_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, gact_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_gact_ops = {
        .kind           =       "gact",
        .type           =       TCA_ACT_GACT,
@@ -261,7 +254,6 @@ static struct tc_action_ops act_gact_ops = {
        .walk           =       tcf_gact_walker,
        .lookup         =       tcf_gact_search,
        .get_fill_size  =       tcf_gact_get_fill_size,
-        .delete         =       tcf_gact_delete,
        .size           =       sizeof(struct tcf_gact),
 };
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index d1081bdf1bdb..196430aefe87 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -167,16 +167,16 @@ static struct tcf_meta_ops *find_ife_oplist(u16 metaid)
 {
        struct tcf_meta_ops *o;
-        read_lock_bh(&ife_mod_lock);
+        read_lock(&ife_mod_lock);
        list_for_each_entry(o, &ifeoplist, list) {
                if (o->metaid == metaid) {
                        if (!try_module_get(o->owner))
                                o = NULL;
-                        read_unlock_bh(&ife_mod_lock);
+                        read_unlock(&ife_mod_lock);
                        return o;
                }
        }
-        read_unlock_bh(&ife_mod_lock);
+        read_unlock(&ife_mod_lock);
        return NULL;
 }
@@ -190,12 +190,12 @@ int register_ife_op(struct tcf_meta_ops *mops)
            !mops->get || !mops->alloc)
                return -EINVAL;
-        write_lock_bh(&ife_mod_lock);
+        write_lock(&ife_mod_lock);
        list_for_each_entry(m, &ifeoplist, list) {
                if (m->metaid == mops->metaid ||
                    (strcmp(mops->name, m->name) == 0)) {
-                        write_unlock_bh(&ife_mod_lock);
+                        write_unlock(&ife_mod_lock);
                        return -EEXIST;
                }
        }
@@ -204,7 +204,7 @@ int register_ife_op(struct tcf_meta_ops *mops)
                mops->release = ife_release_meta_gen;
        list_add_tail(&mops->list, &ifeoplist);
-        write_unlock_bh(&ife_mod_lock);
+        write_unlock(&ife_mod_lock);
        return 0;
 }
 EXPORT_SYMBOL_GPL(unregister_ife_op);
@@ -214,7 +214,7 @@ int unregister_ife_op(struct tcf_meta_ops *mops)
        struct tcf_meta_ops *m;
        int err = -ENOENT;
-        write_lock_bh(&ife_mod_lock);
+        write_lock(&ife_mod_lock);
        list_for_each_entry(m, &ifeoplist, list) {
                if (m->metaid == mops->metaid) {
                        list_del(&mops->list);
@@ -222,7 +222,7 @@ int unregister_ife_op(struct tcf_meta_ops *mops)
                        break;
                }
        }
-        write_unlock_bh(&ife_mod_lock);
+        write_unlock(&ife_mod_lock);
        return err;
 }
@@ -265,11 +265,8 @@ static const char *ife_meta_id2name(u32 metaid)
 #endif
 /* called when adding new meta information
- * under ife->tcf_lock for existing action
 */
-static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
+static int load_metaops_and_vet(u32 metaid, void *val, int len, bool rtnl_held)
-                                void *val, int len, bool exists,
-                                bool rtnl_held)
 {
        struct tcf_meta_ops *ops = find_ife_oplist(metaid);
        int ret = 0;
@@ -277,15 +274,11 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
        if (!ops) {
                ret = -ENOENT;
 #ifdef CONFIG_MODULES
-                if (exists)
-                        spin_unlock_bh(&ife->tcf_lock);
                if (rtnl_held)
                        rtnl_unlock();
                request_module("ife-meta-%s", ife_meta_id2name(metaid));
                if (rtnl_held)
                        rtnl_lock();
-                if (exists)
-                        spin_lock_bh(&ife->tcf_lock);
                ops = find_ife_oplist(metaid);
 #endif
        }
@@ -302,24 +295,17 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
 }
 /* called when adding new meta information
- * under ife->tcf_lock for existing action
 */
-static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
+static int __add_metainfo(const struct tcf_meta_ops *ops,
-                        int len, bool atomic)
+                          struct tcf_ife_info *ife, u32 metaid, void *metaval,
+                          int len, bool atomic, bool exists)
 {
        struct tcf_meta_info *mi = NULL;
-        struct tcf_meta_ops *ops = find_ife_oplist(metaid);
        int ret = 0;
-        if (!ops)
-                return -ENOENT;
        mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL);
-        if (!mi) {
+        if (!mi)
-                /*put back what find_ife_oplist took */
-                module_put(ops->owner);
                return -ENOMEM;
-        }
        mi->metaid = metaid;
        mi->ops = ops;
@@ -327,29 +313,47 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
                ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL);
                if (ret != 0) {
                        kfree(mi);
-                        module_put(ops->owner);
                        return ret;
                }
        }
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
        list_add_tail(&mi->metalist, &ife->metalist);
+        if (exists)
+                spin_unlock_bh(&ife->tcf_lock);
+        return ret;
+}
+static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
+                        int len, bool exists)
+{
+        const struct tcf_meta_ops *ops = find_ife_oplist(metaid);
+        int ret;
+        if (!ops)
+                return -ENOENT;
+        ret = __add_metainfo(ops, ife, metaid, metaval, len, false, exists);
+        if (ret)
+                /*put back what find_ife_oplist took */
+                module_put(ops->owner);
        return ret;
 }
-static int use_all_metadata(struct tcf_ife_info *ife)
+static int use_all_metadata(struct tcf_ife_info *ife, bool exists)
 {
        struct tcf_meta_ops *o;
        int rc = 0;
        int installed = 0;
-        read_lock_bh(&ife_mod_lock);
+        read_lock(&ife_mod_lock);
        list_for_each_entry(o, &ifeoplist, list) {
-                rc = add_metainfo(ife, o->metaid, NULL, 0, true);
+                rc = __add_metainfo(o, ife, o->metaid, NULL, 0, true, exists);
                if (rc == 0)
                        installed += 1;
        }
-        read_unlock_bh(&ife_mod_lock);
+        read_unlock(&ife_mod_lock);
        if (installed)
                return 0;
@@ -422,7 +426,6 @@ static void tcf_ife_cleanup(struct tc_action *a)
                kfree_rcu(p, rcu);
 }
-/* under ife->tcf_lock for existing action */
 static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
                             bool exists, bool rtnl_held)
 {
@@ -436,8 +439,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
                        val = nla_data(tb[i]);
                        len = nla_len(tb[i]);
-                        rc = load_metaops_and_vet(ife, i, val, len, exists,
+                        rc = load_metaops_and_vet(i, val, len, rtnl_held);
-                                                  rtnl_held);
                        if (rc != 0)
                                return rc;
@@ -540,8 +542,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                p->eth_type = ife_type;
        }
-        if (exists)
-                spin_lock_bh(&ife->tcf_lock);
        if (ret == ACT_P_CREATED)
                INIT_LIST_HEAD(&ife->metalist);
@@ -551,10 +551,7 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                                       NULL, NULL);
                if (err) {
 metadata_parse_err:
-                        if (exists)
-                                spin_unlock_bh(&ife->tcf_lock);
                        tcf_idr_release(*a, bind);
                        kfree(p);
                        return err;
                }
@@ -569,17 +566,16 @@ metadata_parse_err:
                 * as we can. You better have at least one else we are
                 * going to bail out
                 */
-                err = use_all_metadata(ife);
+                err = use_all_metadata(ife, exists);
                if (err) {
-                        if (exists)
-                                spin_unlock_bh(&ife->tcf_lock);
                        tcf_idr_release(*a, bind);
                        kfree(p);
                        return err;
                }
        }
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
        ife->tcf_action = parm->action;
        /* protected by tcf_lock when modifying existing action */
        rcu_swap_protected(ife->params, p, 1);
@@ -853,13 +849,6 @@ static int tcf_ife_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_ife_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, ife_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_ife_ops = {
        .kind = "ife",
        .type = TCA_ACT_IFE,
@@ -870,7 +859,6 @@ static struct tc_action_ops act_ife_ops = {
        .init = tcf_ife_init,
        .walk = tcf_ife_walker,
        .lookup = tcf_ife_search,
-        .delete = tcf_ife_delete,
        .size = sizeof(struct tcf_ife_info),
 };
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 51f235bbeb5b..23273b5303fd 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -337,13 +337,6 @@ static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_ipt_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, ipt_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_ipt_ops = {
        .kind           =       "ipt",
        .type           =       TCA_ACT_IPT,
@@ -354,7 +347,6 @@ static struct tc_action_ops act_ipt_ops = {
        .init           =       tcf_ipt_init,
        .walk           =       tcf_ipt_walker,
        .lookup         =       tcf_ipt_search,
-        .delete         =       tcf_ipt_delete,
        .size           =       sizeof(struct tcf_ipt),
 };
@@ -395,13 +387,6 @@ static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_xt_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, xt_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_xt_ops = {
        .kind           =       "xt",
        .type           =       TCA_ACT_XT,
@@ -412,7 +397,6 @@ static struct tc_action_ops act_xt_ops = {
        .init           =       tcf_xt_init,
        .walk           =       tcf_xt_walker,
        .lookup         =       tcf_xt_search,
-        .delete         =       tcf_xt_delete,
        .size           =       sizeof(struct tcf_ipt),
 };
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 38fd20f10f67..8bf66d0a6800 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -395,13 +395,6 @@ static void tcf_mirred_put_dev(struct net_device *dev)
        dev_put(dev);
 }
-static int tcf_mirred_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, mirred_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_mirred_ops = {
        .kind           =       "mirred",
        .type           =       TCA_ACT_MIRRED,
@@ -416,7 +409,6 @@ static struct tc_action_ops act_mirred_ops = {
        .size           =       sizeof(struct tcf_mirred),
        .get_dev        =       tcf_mirred_get_dev,
        .put_dev        =       tcf_mirred_put_dev,
-        .delete         =       tcf_mirred_delete,
 };
 static __net_init int mirred_init_net(struct net *net)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 822e903bfc25..4313aa102440 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -300,13 +300,6 @@ static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_nat_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, nat_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_nat_ops = {
        .kind           =       "nat",
        .type           =       TCA_ACT_NAT,
@@ -316,7 +309,6 @@ static struct tc_action_ops act_nat_ops = {
        .init           =       tcf_nat_init,
        .walk           =       tcf_nat_walker,
        .lookup         =       tcf_nat_search,
-        .delete         =       tcf_nat_delete,
        .size           =       sizeof(struct tcf_nat),
 };
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 8a7a7cb94e83..107034070019 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -460,13 +460,6 @@ static int tcf_pedit_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_pedit_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, pedit_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_pedit_ops = {
        .kind           =       "pedit",
        .type           =       TCA_ACT_PEDIT,
@@ -477,7 +470,6 @@ static struct tc_action_ops act_pedit_ops = {
        .init           =       tcf_pedit_init,
        .walk           =       tcf_pedit_walker,
        .lookup         =       tcf_pedit_search,
-        .delete         =       tcf_pedit_delete,
        .size           =       sizeof(struct tcf_pedit),
 };
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 06f0742db593..5d8bfa878477 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -320,13 +320,6 @@ static int tcf_police_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_police_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, police_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 MODULE_AUTHOR("Alexey Kuznetsov");
 MODULE_DESCRIPTION("Policing actions");
 MODULE_LICENSE("GPL");
@@ -340,7 +333,6 @@ static struct tc_action_ops act_police_ops = {
        .init           =       tcf_police_init,
        .walk           =       tcf_police_walker,
        .lookup         =       tcf_police_search,
-        .delete         =       tcf_police_delete,
        .size           =       sizeof(struct tcf_police),
 };
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 207b4132d1b0..44e9c00657bc 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -232,13 +232,6 @@ static int tcf_sample_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_sample_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, sample_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_sample_ops = {
        .kind     = "sample",
        .type     = TCA_ACT_SAMPLE,
@@ -249,7 +242,6 @@ static struct tc_action_ops act_sample_ops = {
        .cleanup  = tcf_sample_cleanup,
        .walk     = tcf_sample_walker,
        .lookup   = tcf_sample_search,
-        .delete   = tcf_sample_delete,
        .size     = sizeof(struct tcf_sample),
 };
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index e616523ba3c1..52400d49f81f 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -196,13 +196,6 @@ static int tcf_simp_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_simp_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, simp_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_simp_ops = {
        .kind           =       "simple",
        .type           =       TCA_ACT_SIMP,
@@ -213,7 +206,6 @@ static struct tc_action_ops act_simp_ops = {
        .init           =       tcf_simp_init,
        .walk           =       tcf_simp_walker,
        .lookup         =       tcf_simp_search,
-        .delete         =       tcf_simp_delete,
        .size           =       sizeof(struct tcf_defact),
 };
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 926d7bc4a89d..73e44ce2a883 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -299,13 +299,6 @@ static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_skbedit_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, skbedit_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_skbedit_ops = {
        .kind           =       "skbedit",
        .type           =       TCA_ACT_SKBEDIT,
@@ -316,7 +309,6 @@ static struct tc_action_ops act_skbedit_ops = {
        .cleanup        =       tcf_skbedit_cleanup,
        .walk           =       tcf_skbedit_walker,
        .lookup         =       tcf_skbedit_search,
-        .delete         =       tcf_skbedit_delete,
        .size           =       sizeof(struct tcf_skbedit),
 };
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index d6a1af0c4171..588077fafd6c 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -259,13 +259,6 @@ static int tcf_skbmod_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_skbmod_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, skbmod_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_skbmod_ops = {
        .kind           =       "skbmod",
        .type           =       TCA_ACT_SKBMOD,
@@ -276,7 +269,6 @@ static struct tc_action_ops act_skbmod_ops = {
        .cleanup        =       tcf_skbmod_cleanup,
        .walk           =       tcf_skbmod_walker,
        .lookup         =       tcf_skbmod_search,
-        .delete         =       tcf_skbmod_delete,
        .size           =       sizeof(struct tcf_skbmod),
 };
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 8f09cf08d8fe..420759153d5f 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -548,13 +548,6 @@ static int tunnel_key_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tunnel_key_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_tunnel_key_ops = {
        .kind           =       "tunnel_key",
        .type           =       TCA_ACT_TUNNEL_KEY,
@@ -565,7 +558,6 @@ static struct tc_action_ops act_tunnel_key_ops = {
        .cleanup        =       tunnel_key_release,
        .walk           =       tunnel_key_walker,
        .lookup         =       tunnel_key_search,
-        .delete         =       tunnel_key_delete,
        .size           =       sizeof(struct tcf_tunnel_key),
 };
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 209e70ad2c09..033d273afe50 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -296,13 +296,6 @@ static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index,
        return tcf_idr_search(tn, a, index);
 }
-static int tcf_vlan_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, vlan_net_id);
-        return tcf_idr_delete_index(tn, index);
-}
 static struct tc_action_ops act_vlan_ops = {
        .kind           =       "vlan",
        .type           =       TCA_ACT_VLAN,
@@ -313,7 +306,6 @@ static struct tc_action_ops act_vlan_ops = {
        .cleanup        =       tcf_vlan_cleanup,
        .walk           =       tcf_vlan_walker,
        .lookup         =       tcf_vlan_search,
-        .delete         =       tcf_vlan_delete,
        .size           =       sizeof(struct tcf_vlan),
 };
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d5d2a6dc3921..f218ccf1e2d9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -914,6 +914,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
        struct nlattr *opt = tca[TCA_OPTIONS];
        struct nlattr *tb[TCA_U32_MAX + 1];
        u32 htid, flags = 0;
+        size_t sel_size;
        int err;
 #ifdef CONFIG_CLS_U32_PERF
        size_t size;
@@ -1076,8 +1077,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
        }
        s = nla_data(tb[TCA_U32_SEL]);
+        sel_size = struct_size(s, keys, s->nkeys);
+        if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
+                err = -EINVAL;
+                goto erridr;
+        }
-        n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+        n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);
        if (n == NULL) {
                err = -ENOBUFS;
                goto erridr;
@@ -1092,7 +1098,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
        }
 #endif
-        memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
+        memcpy(&n->sel, s, sel_size);
        RCU_INIT_POINTER(n->ht_up, ht);
        n->handle = handle;
        n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 35fc7252187c..c07c30b916d5 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -64,7 +64,6 @@
 #include <linux/vmalloc.h>
 #include <linux/reciprocal_div.h>
 #include <net/netlink.h>
-#include <linux/version.h>
 #include <linux/if_vlan.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
@@ -621,15 +620,20 @@ static bool cake_ddst(int flow_mode)
 }
 static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
-                     int flow_mode)
+                     int flow_mode, u16 flow_override, u16 host_override)
 {
-        u32 flow_hash = 0, srchost_hash, dsthost_hash;
+        u32 flow_hash = 0, srchost_hash = 0, dsthost_hash = 0;
        u16 reduced_hash, srchost_idx, dsthost_idx;
        struct flow_keys keys, host_keys;
        if (unlikely(flow_mode == CAKE_FLOW_NONE))
                return 0;
+        /* If both overrides are set we can skip packet dissection entirely */
+        if ((flow_override || !(flow_mode & CAKE_FLOW_FLOWS)) &&
+            (host_override || !(flow_mode & CAKE_FLOW_HOSTS)))
+                goto skip_hash;
        skb_flow_dissect_flow_keys(skb, &keys,
                                   FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
@@ -676,6 +680,14 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
        if (flow_mode & CAKE_FLOW_FLOWS)
                flow_hash = flow_hash_from_keys(&keys);
+skip_hash:
+        if (flow_override)
+                flow_hash = flow_override - 1;
+        if (host_override) {
+                dsthost_hash = host_override - 1;
+                srchost_hash = host_override - 1;
+        }
        if (!(flow_mode & CAKE_FLOW_FLOWS)) {
                if (flow_mode & CAKE_FLOW_SRC_IP)
                        flow_hash ^= srchost_hash;
@@ -1571,7 +1583,7 @@ static u32 cake_classify(struct Qdisc *sch, struct cake_tin_data **t,
        struct cake_sched_data *q = qdisc_priv(sch);
        struct tcf_proto *filter;
        struct tcf_result res;
-        u32 flow = 0;
+        u16 flow = 0, host = 0;
        int result;
        filter = rcu_dereference_bh(q->filter_list);
@@ -1595,10 +1607,12 @@ static u32 cake_classify(struct Qdisc *sch, struct cake_tin_data **t,
 #endif
                if (TC_H_MIN(res.classid) <= CAKE_QUEUES)
                        flow = TC_H_MIN(res.classid);
+                if (TC_H_MAJ(res.classid) <= (CAKE_QUEUES << 16))
+                        host = TC_H_MAJ(res.classid) >> 16;
        }
 hash:
        *t = cake_select_tin(sch, skb);
-        return flow ?: cake_hash(*t, skb, flow_mode) + 1;
+        return cake_hash(*t, skb, flow_mode, flow, host) + 1;
 }
 static void cake_reconfigure(struct Qdisc *sch);
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 93c0c225ab34..180b6640e531 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -213,9 +213,14 @@ static void tls_write_space(struct sock *sk)
 {
        struct tls_context *ctx = tls_get_ctx(sk);
-        /* We are already sending pages, ignore notification */
+        /* If in_tcp_sendpages call lower protocol write space handler
-        if (ctx->in_tcp_sendpages)
+         * to ensure we wake up any waiting operations there. For example
+         * if do_tcp_sendpages where to call sk_wait_event.
+         */
+        if (ctx->in_tcp_sendpages) {
+                ctx->sk_write_space(sk);
                return;
+        }
        if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
                gfp_t sk_allocation = sk->sk_allocation;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 911ca6d3cb5a..bfe2dbea480b 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -74,14 +74,14 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
                return 0;
        if (!dev->netdev_ops->ndo_bpf || !dev->netdev_ops->ndo_xsk_async_xmit)
-                return force_zc ? -ENOTSUPP : 0; /* fail or fallback */
+                return force_zc ? -EOPNOTSUPP : 0; /* fail or fallback */
        bpf.command = XDP_QUERY_XSK_UMEM;
        rtnl_lock();
        err = xdp_umem_query(dev, queue_id);
        if (err) {
-                err = err < 0 ? -ENOTSUPP : -EBUSY;
+                err = err < 0 ? -EOPNOTSUPP : -EBUSY;
                goto err_rtnl_unlock;
        }
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index c75413d05a63..ce53639a864a 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -153,10 +153,6 @@ cc-fullversion = $(shell $(CONFIG_SHELL) \
 # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
 cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
-# cc-if-fullversion
-# Usage:  EXTRA_CFLAGS += $(call cc-if-fullversion, -lt, 040502, -O1)
-cc-if-fullversion = $(shell [ $(cc-fullversion) $(1) $(2) ] && echo $(3) || echo $(4))
 # cc-ldoption
 # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
 cc-ldoption = $(call try-run,\
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 1c48572223d1..5a2d1c9578a0 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -246,8 +246,6 @@ objtool_args += --no-fp
 endif
 ifdef CONFIG_GCOV_KERNEL
 objtool_args += --no-unreachable
-else
-objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
 endif
 ifdef CONFIG_RETPOLINE
 ifneq ($(RETPOLINE_CFLAGS),)
diff --git a/tools/bpf/bpftool/map_perf_ring.c b/tools/bpf/bpftool/map_perf_ring.c
index 1832100d1b27..6d41323be291 100644
--- a/tools/bpf/bpftool/map_perf_ring.c
+++ b/tools/bpf/bpftool/map_perf_ring.c
@@ -194,8 +194,10 @@ int do_event_pipe(int argc, char **argv)
        }
        while (argc) {
-                if (argc < 2)
+                if (argc < 2) {
                        BAD_ARG();
+                        goto err_close_map;
+                }
                if (is_prefix(*argv, "cpu")) {
                        char *endptr;
@@ -221,6 +223,7 @@ int do_event_pipe(int argc, char **argv)
                        NEXT_ARG();
                } else {
                        BAD_ARG();
+                        goto err_close_map;
                }
                do_all = false;