304 files changed, 2911 insertions, 1776 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 9871e649ffef..64a3bf54b974 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3523,6 +3523,12 @@
         ramdisk_size=   [RAM] Sizes of RAM disks in kilobytes
                         See Documentation/blockdev/ramdisk.txt.
 
+        random.trust_cpu={on,off}
+                        [KNL] Enable or disable trusting the use of the
+                        CPU's random number generator (if available) to
+                        fully seed the kernel's CRNG. Default is controlled
+                        by CONFIG_RANDOM_TRUST_CPU.
+
         ras=option[,option,...] [KNL] RAS-specific options
 
                 cec_disable     [X86]
diff --git a/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt b/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
index 00e4365d7206..091c8dfd3229 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-imx-lpi2c.txt
@@ -3,7 +3,6 @@
 Required properties:
 - compatible :
   - "fsl,imx7ulp-lpi2c" for LPI2C compatible with the one integrated on i.MX7ULP soc
-  - "fsl,imx8dv-lpi2c" for LPI2C compatible with the one integrated on i.MX8DV soc
 - reg : address and length of the lpi2c master registers
 - interrupts : lpi2c interrupt
 - clocks : lpi2c clock specifier
@@ -11,7 +10,7 @@ Required properties:
 Examples:
 
 lpi2c7: lpi2c7@40a50000 {
-        compatible = "fsl,imx8dv-lpi2c";
+        compatible = "fsl,imx7ulp-lpi2c";
         reg = <0x40A50000 0x10000>;
         interrupt-parent = <&intc>;
         interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/net/cpsw.txt b/Documentation/devicetree/bindings/net/cpsw.txt
index 41089369f891..b3acebe08eb0 100644
--- a/Documentation/devicetree/bindings/net/cpsw.txt
+++ b/Documentation/devicetree/bindings/net/cpsw.txt
@@ -19,6 +19,10 @@ Required properties:
 - slaves                : Specifies number for slaves
 - active_slave          : Specifies the slave to use for time stamping,
                           ethtool and SIOCGMIIPHY
+- cpsw-phy-sel          : Specifies the phandle to the CPSW phy mode selection
+                          device. See also cpsw-phy-sel.txt for it's binding.
+                          Note that in legacy cases cpsw-phy-sel may be
+                          a child device instead of a phandle.
 
 Optional properties:
 - ti,hwmods             : Must be "cpgmac0"
@@ -75,6 +79,7 @@ Examples:
                 cpts_clock_mult = <0x80000000>;
                 cpts_clock_shift = <29>;
                 syscon = <&cm>;
+                cpsw-phy-sel = <&phy_sel>;
                 cpsw_emac0: slave@0 {
                         phy_id = <&davinci_mdio>, <0>;
                         phy-mode = "rgmii-txid";
@@ -103,6 +108,7 @@ Examples:
                 cpts_clock_mult = <0x80000000>;
                 cpts_clock_shift = <29>;
                 syscon = <&cm>;
+                cpsw-phy-sel = <&phy_sel>;
                 cpsw_emac0: slave@0 {
                         phy_id = <&davinci_mdio>, <0>;
                         phy-mode = "rgmii-txid";
diff --git a/Documentation/devicetree/bindings/net/sh_eth.txt b/Documentation/devicetree/bindings/net/sh_eth.txt
index 76db9f13ad96..abc36274227c 100644
--- a/Documentation/devicetree/bindings/net/sh_eth.txt
+++ b/Documentation/devicetree/bindings/net/sh_eth.txt
@@ -16,6 +16,7 @@ Required properties:
               "renesas,ether-r8a7794"  if the device is a part of R8A7794 SoC.
               "renesas,gether-r8a77980" if the device is a part of R8A77980 SoC.
               "renesas,ether-r7s72100" if the device is a part of R7S72100 SoC.
+              "renesas,ether-r7s9210" if the device is a part of R7S9210 SoC.
               "renesas,rcar-gen1-ether" for a generic R-Car Gen1 device.
               "renesas,rcar-gen2-ether" for a generic R-Car Gen2 or RZ/G1
                                         device.
diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
index 61f918b10a0c..d1bf143b446f 100644
--- a/Documentation/process/changes.rst
+++ b/Documentation/process/changes.rst
@@ -86,7 +86,7 @@ pkg-config
 
 The build system, as of 4.18, requires pkg-config to check for installed
 kconfig tools and to determine flags settings for use in
-'make {menu,n,g,x}config'.  Previously pkg-config was being used but not
+'make {g,x}config'.  Previously pkg-config was being used but not
 verified or documented.
 
 Flex
diff --git a/Documentation/scsi/scsi-parameters.txt b/Documentation/scsi/scsi-parameters.txt
index 25a4b4cf04a6..92999d4e0cb8 100644
--- a/Documentation/scsi/scsi-parameters.txt
+++ b/Documentation/scsi/scsi-parameters.txt
@@ -97,6 +97,11 @@ parameters may be changed at runtime by the command
                         allowing boot to proceed.  none ignores them, expecting
                         user space to do the scan.
 
+        scsi_mod.use_blk_mq=
+                        [SCSI] use blk-mq I/O path by default
+                        See SCSI_MQ_DEFAULT in drivers/scsi/Kconfig.
+                        Format: <y/n>
+
         sim710=         [SCSI,HW]
                         See header of drivers/scsi/sim710.c.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 9ad052aeac39..d870cb57c887 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2311,6 +2311,7 @@ F:	drivers/clocksource/cadence_ttc_timer.c
 F:      drivers/i2c/busses/i2c-cadence.c
 F:      drivers/mmc/host/sdhci-of-arasan.c
 F:      drivers/edac/synopsys_edac.c
+F:      drivers/i2c/busses/i2c-xiic.c
 
 ARM64 PORT (AARCH64 ARCHITECTURE)
 M:      Catalin Marinas <catalin.marinas@arm.com>
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 6d5eb8267e42..b4441b0764d7 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -9,6 +9,7 @@
 config ARC
         def_bool y
         select ARC_TIMERS
+        select ARCH_HAS_PTE_SPECIAL
         select ARCH_HAS_SYNC_DMA_FOR_CPU
         select ARCH_HAS_SYNC_DMA_FOR_DEVICE
         select ARCH_HAS_SG_CHAIN
@@ -28,8 +29,12 @@ config ARC
         select GENERIC_SMP_IDLE_THREAD
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
+        select HAVE_DEBUG_STACKOVERFLOW
         select HAVE_FUTEX_CMPXCHG if FUTEX
+        select HAVE_GENERIC_DMA_COHERENT
         select HAVE_IOREMAP_PROT
+        select HAVE_KERNEL_GZIP
+        select HAVE_KERNEL_LZMA
         select HAVE_KPROBES
         select HAVE_KRETPROBES
         select HAVE_MEMBLOCK
@@ -44,11 +49,6 @@ config ARC
         select OF_EARLY_FLATTREE
         select OF_RESERVED_MEM
         select PERF_USE_VMALLOC if ARC_CACHE_VIPT_ALIASING
-        select HAVE_DEBUG_STACKOVERFLOW
-        select HAVE_GENERIC_DMA_COHERENT
-        select HAVE_KERNEL_GZIP
-        select HAVE_KERNEL_LZMA
-        select ARCH_HAS_PTE_SPECIAL
 
 config ARCH_HAS_CACHE_LINE_SIZE
         def_bool y
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index fb026196aaab..99cce77ab98f 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -43,10 +43,7 @@ ifdef CONFIG_ARC_CURR_IN_REG
 LINUXINCLUDE    +=  -include ${src}/arch/arc/include/asm/current.h
 endif
 
-upto_gcc44    :=  $(call cc-ifversion, -le, 0404, y)
-atleast_gcc44 :=  $(call cc-ifversion, -ge, 0404, y)
-
-cflags-$(atleast_gcc44)                 += -fsection-anchors
+cflags-y                                += -fsection-anchors
 
 cflags-$(CONFIG_ARC_HAS_LLSC)           += -mlock
 cflags-$(CONFIG_ARC_HAS_SWAPE)          += -mswape
@@ -82,11 +79,6 @@ cflags-$(disable_small_data)		+= -mno-sdata -fcall-used-gp
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += -mbig-endian
 ldflags-$(CONFIG_CPU_BIG_ENDIAN)        += -EB
 
-# STAR 9000518362: (fixed with binutils shipping with gcc 4.8)
-# arc-linux-uclibc-ld (buildroot) or arceb-elf32-ld (EZChip) don't accept
-# --build-id w/o "-marclinux". Default arc-elf32-ld is OK
-ldflags-$(upto_gcc44)                   += -marclinux
-
 LIBGCC  := $(shell $(CC) $(cflags-y) --print-libgcc-file-name)
 
 # Modules with short calls might break for calls into builtin-kernel
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index dc91c663bcc0..d75d65ddf8e3 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -94,6 +94,32 @@
         };
 
         /*
+         * Mark DMA peripherals connected via IOC port as dma-coherent. We do
+         * it via overlay because peripherals defined in axs10x_mb.dtsi are
+         * used for both AXS101 and AXS103 boards and only AXS103 has IOC (so
+         * only AXS103 board has HW-coherent DMA peripherals)
+         * We don't need to mark pgu@17000 as dma-coherent because it uses
+         * external DMA buffer located outside of IOC aperture.
+         */
+        axs10x_mb {
+                ethernet@0x18000 {
+                        dma-coherent;
+                };
+
+                ehci@0x40000 {
+                        dma-coherent;
+                };
+
+                ohci@0x60000 {
+                        dma-coherent;
+                };
+
+                mmc@0x15000 {
+                        dma-coherent;
+                };
+        };
+
+        /*
          * The DW APB ICTL intc on MB is connected to CPU intc via a
          * DT "invisible" DW APB GPIO block, configured to simply pass thru
          * interrupts - setup accordinly in platform init (plat-axs10x/ax10x.c)
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 69ff4895f2ba..a05bb737ea63 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -101,6 +101,32 @@
         };
 
         /*
+         * Mark DMA peripherals connected via IOC port as dma-coherent. We do
+         * it via overlay because peripherals defined in axs10x_mb.dtsi are
+         * used for both AXS101 and AXS103 boards and only AXS103 has IOC (so
+         * only AXS103 board has HW-coherent DMA peripherals)
+         * We don't need to mark pgu@17000 as dma-coherent because it uses
+         * external DMA buffer located outside of IOC aperture.
+         */
+        axs10x_mb {
+                ethernet@0x18000 {
+                        dma-coherent;
+                };
+
+                ehci@0x40000 {
+                        dma-coherent;
+                };
+
+                ohci@0x60000 {
+                        dma-coherent;
+                };
+
+                mmc@0x15000 {
+                        dma-coherent;
+                };
+        };
+
+        /*
          * This INTC is actually connected to DW APB GPIO
          * which acts as a wire between MB INTC and CPU INTC.
          * GPIO INTC is configured in platform init code
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 47b74fbc403c..37bafd44e36d 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -9,6 +9,10 @@
  */
 
 / {
+        aliases {
+                ethernet = &gmac;
+        };
+
         axs10x_mb {
                 compatible = "simple-bus";
                 #address-cells = <1>;
@@ -68,7 +72,7 @@
                         };
                 };
 
-                ethernet@0x18000 {
+                gmac: ethernet@0x18000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = < 0x18000 0x2000 >;
@@ -81,6 +85,7 @@
                         max-speed = <100>;
                         resets = <&creg_rst 5>;
                         reset-names = "stmmaceth";
+                        mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
                 };
 
                 ehci@0x40000 {
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 006aa3de5348..ef149f59929a 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -25,6 +25,10 @@
                 bootargs = "earlycon=uart8250,mmio32,0xf0005000,115200n8 console=ttyS0,115200n8 debug print-fatal-signals=1";
         };
 
+        aliases {
+                ethernet = &gmac;
+        };
+
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -163,7 +167,7 @@
                         #clock-cells = <0>;
                 };
 
-                ethernet@8000 {
+                gmac: ethernet@8000 {
                         #interrupt-cells = <1>;
                         compatible = "snps,dwmac";
                         reg = <0x8000 0x2000>;
@@ -176,6 +180,8 @@
                         phy-handle = <&phy0>;
                         resets = <&cgu_rst HSDK_ETH_RESET>;
                         reset-names = "stmmaceth";
+                        mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
+                        dma-coherent;
 
                         mdio {
                                 #address-cells = <1>;
@@ -194,12 +200,14 @@
                         compatible = "snps,hsdk-v1.0-ohci", "generic-ohci";
                         reg = <0x60000 0x100>;
                         interrupts = <15>;
+                        dma-coherent;
                 };
 
                 ehci@40000 {
                         compatible = "snps,hsdk-v1.0-ehci", "generic-ehci";
                         reg = <0x40000 0x100>;
                         interrupts = <15>;
+                        dma-coherent;
                 };
 
                 mmc@a000 {
@@ -212,6 +220,7 @@
                         clock-names = "biu", "ciu";
                         interrupts = <12>;
                         bus-width = <4>;
+                        dma-coherent;
                 };
         };
 
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index a635ea972304..41bc08be6a3b 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -63,7 +61,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index aa507e423075..1e1c4a8011b5 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -64,7 +62,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index eba07f468654..6b0c0cfd5c30 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -1,5 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
-# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -65,7 +63,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_MOUSE_SERIAL=y
 CONFIG_MOUSE_SYNAPTICS_USB=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
index 098b19fbaa51..240dd2cd5148 100644
--- a/arch/arc/configs/haps_hs_defconfig
+++ b/arch/arc/configs/haps_hs_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -57,7 +56,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index 0104c404d897..14ae7e5acc7c 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -60,7 +59,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 6491be0ddbc9..1dec2b4bc5e6 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_NO_HZ_IDLE=y
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index 7c9c706ae7f6..31ba224bbfb4 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -59,7 +59,6 @@ CONFIG_NETCONSOLE=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index 99e05cf63fca..8e0b8b134cd9 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -44,7 +43,6 @@ CONFIG_LXT_PHY=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index 0dc4f9b737e7..739b90e5e893 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -45,7 +44,6 @@ CONFIG_DEVTMPFS=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index be3c30a15e54..b5895bdf3a93 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
@@ -44,7 +43,6 @@ CONFIG_DEVTMPFS=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_ARC=y
 CONFIG_SERIAL_ARC_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index 3a74b9b21772..f14eeff7d308 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -48,7 +47,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index ea2834b4dc1d..025298a48305 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -47,7 +46,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index 80a5a1b4924b..df7b77b13b82 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -1,4 +1,3 @@
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 # CONFIG_CROSS_MEMORY_ATTACH is not set
@@ -58,7 +57,6 @@ CONFIG_MOUSE_PS2_TOUCHKIT=y
 # CONFIG_SERIO_SERPORT is not set
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index 2cc87f909747..a7f65313f84a 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -57,7 +57,6 @@ CONFIG_STMMAC_ETH=y
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=1
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index f629493929ea..db47c3541f15 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
@@ -53,7 +52,6 @@ CONFIG_NATIONAL_PHY=y
 CONFIG_MOUSE_PS2_TOUCHKIT=y
 CONFIG_SERIO_ARC_PS2=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_DW=y
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index 21f0ca26a05d..a8ac5e917d9a 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_DEFAULT_HOSTNAME="ARCLinux"
 # CONFIG_CROSS_MEMORY_ATTACH is not set
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 4e0072730241..158af079838d 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -84,7 +84,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
         "1:     llock   %[orig], [%[ctr]]               \n"             \
         "       " #asm_op " %[val], %[orig], %[i]       \n"             \
         "       scond   %[val], [%[ctr]]                \n"             \
-        "                                               \n"             \
+        "       bnz     1b                              \n"             \
         : [val] "=&r"   (val),                                          \
           [orig] "=&r" (orig)                                           \
         : [ctr] "r"     (&v->counter),                                  \
diff --git a/arch/arc/include/asm/dma-mapping.h b/arch/arc/include/asm/dma-mapping.h
new file mode 100644
index 000000000000..c946c0a83e76
--- /dev/null
+++ b/arch/arc/include/asm/dma-mapping.h
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier:  GPL-2.0
+// (C) 2018 Synopsys, Inc. (www.synopsys.com)
+
+#ifndef ASM_ARC_DMA_MAPPING_H
+#define ASM_ARC_DMA_MAPPING_H
+
+#include <asm-generic/dma-mapping.h>
+
+void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                        const struct iommu_ops *iommu, bool coherent);
+#define arch_setup_dma_ops arch_setup_dma_ops
+
+#endif
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 783b20354f8b..e8d9fb452346 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -83,9 +83,6 @@ done:
 static void show_faulting_vma(unsigned long address, char *buf)
 {
         struct vm_area_struct *vma;
-        struct inode *inode;
-        unsigned long ino = 0;
-        dev_t dev = 0;
         char *nm = buf;
         struct mm_struct *active_mm = current->active_mm;
 
@@ -99,12 +96,10 @@ static void show_faulting_vma(unsigned long address, char *buf)
          * if the container VMA is not found
          */
         if (vma && (vma->vm_start <= address)) {
-                struct file *file = vma->vm_file;
-                if (file) {
-                        nm = file_path(file, buf, PAGE_SIZE - 1);
-                        inode = file_inode(vma->vm_file);
-                        dev = inode->i_sb->s_dev;
-                        ino = inode->i_ino;
+                if (vma->vm_file) {
+                        nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
+                        if (IS_ERR(nm))
+                                nm = "?";
                 }
                 pr_info("    @off 0x%lx in [%s]\n"
                         "    VMA: 0x%08lx to 0x%08lx\n",
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 25c631942500..f2701c13a66b 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -65,7 +65,7 @@ char *arc_cache_mumbojumbo(int c, char *buf, int len)
 
         n += scnprintf(buf + n, len - n, "Peripherals\t: %#lx%s%s\n",
                        perip_base,
-                       IS_AVAIL3(ioc_exists, ioc_enable, ", IO-Coherency "));
+                       IS_AVAIL3(ioc_exists, ioc_enable, ", IO-Coherency (per-device) "));
 
         return buf;
 }
@@ -897,15 +897,6 @@ static void __dma_cache_wback_slc(phys_addr_t start, unsigned long sz)
 }
 
 /*
- * DMA ops for systems with IOC
- * IOC hardware snoops all DMA traffic keeping the caches consistent with
- * memory - eliding need for any explicit cache maintenance of DMA buffers
- */
-static void __dma_cache_wback_inv_ioc(phys_addr_t start, unsigned long sz) {}
-static void __dma_cache_inv_ioc(phys_addr_t start, unsigned long sz) {}
-static void __dma_cache_wback_ioc(phys_addr_t start, unsigned long sz) {}
-
-/*
  * Exported DMA API
  */
 void dma_cache_wback_inv(phys_addr_t start, unsigned long sz)
@@ -1153,6 +1144,19 @@ noinline void __init arc_ioc_setup(void)
 {
         unsigned int ioc_base, mem_sz;
 
+        /*
+         * As for today we don't support both IOC and ZONE_HIGHMEM enabled
+         * simultaneously. This happens because as of today IOC aperture covers
+         * only ZONE_NORMAL (low mem) and any dma transactions outside this
+         * region won't be HW coherent.
+         * If we want to use both IOC and ZONE_HIGHMEM we can use
+         * bounce_buffer to handle dma transactions to HIGHMEM.
+         * Also it is possible to modify dma_direct cache ops or increase IOC
+         * aperture size if we are planning to use HIGHMEM without PAE.
+         */
+        if (IS_ENABLED(CONFIG_HIGHMEM))
+                panic("IOC and HIGHMEM can't be used simultaneously");
+
         /* Flush + invalidate + disable L1 dcache */
         __dc_disable();
 
@@ -1264,11 +1268,7 @@ void __init arc_cache_init_master(void)
         if (is_isa_arcv2() && ioc_enable)
                 arc_ioc_setup();
 
-        if (is_isa_arcv2() && ioc_enable) {
-                __dma_cache_wback_inv = __dma_cache_wback_inv_ioc;
-                __dma_cache_inv = __dma_cache_inv_ioc;
-                __dma_cache_wback = __dma_cache_wback_ioc;
-        } else if (is_isa_arcv2() && l2_line_sz && slc_enable) {
+        if (is_isa_arcv2() && l2_line_sz && slc_enable) {
                 __dma_cache_wback_inv = __dma_cache_wback_inv_slc;
                 __dma_cache_inv = __dma_cache_inv_slc;
                 __dma_cache_wback = __dma_cache_wback_slc;
@@ -1277,6 +1277,12 @@ void __init arc_cache_init_master(void)
                 __dma_cache_inv = __dma_cache_inv_l1;
                 __dma_cache_wback = __dma_cache_wback_l1;
         }
+        /*
+         * In case of IOC (say IOC+SLC case), pointers above could still be set
+         * but end up not being relevant as the first function in chain is not
+         * called at all for @dma_direct_ops
+         *     arch_sync_dma_for_cpu() -> dma_cache_*() -> __dma_cache_*()
+         */
 }
 
 void __ref arc_cache_init(void)
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index ec47e6079f5d..c75d5c3470e3 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -6,20 +6,17 @@
  * published by the Free Software Foundation.
  */
 
-/*
- * DMA Coherent API Notes
- *
- * I/O is inherently non-coherent on ARC. So a coherent DMA buffer is
- * implemented by accessing it using a kernel virtual address, with
- * Cache bit off in the TLB entry.
- *
- * The default DMA address == Phy address which is 0x8000_0000 based.
- */
-
 #include <linux/dma-noncoherent.h>
 #include <asm/cache.h>
 #include <asm/cacheflush.h>
 
+/*
+ * ARCH specific callbacks for generic noncoherent DMA ops (dma/noncoherent.c)
+ *  - hardware IOC not available (or "dma-coherent" not set for device in DT)
+ *  - But still handle both coherent and non-coherent requests from caller
+ *
+ * For DMA coherent hardware (IOC) generic code suffices
+ */
 void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
                 gfp_t gfp, unsigned long attrs)
 {
@@ -27,42 +24,29 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
         struct page *page;
         phys_addr_t paddr;
         void *kvaddr;
-        int need_coh = 1, need_kvaddr = 0;
-
-        page = alloc_pages(gfp, order);
-        if (!page)
-                return NULL;
+        bool need_coh = !(attrs & DMA_ATTR_NON_CONSISTENT);
 
         /*
-         * IOC relies on all data (even coherent DMA data) being in cache
-         * Thus allocate normal cached memory
-         *
-         * The gains with IOC are two pronged:
-         *   -For streaming data, elides need for cache maintenance, saving
-         *    cycles in flush code, and bus bandwidth as all the lines of a
-         *    buffer need to be flushed out to memory
-         *   -For coherent data, Read/Write to buffers terminate early in cache
-         *   (vs. always going to memory - thus are faster)
+         * __GFP_HIGHMEM flag is cleared by upper layer functions
+         * (in include/linux/dma-mapping.h) so we should never get a
+         * __GFP_HIGHMEM here.
          */
-        if ((is_isa_arcv2() && ioc_enable) ||
-            (attrs & DMA_ATTR_NON_CONSISTENT))
-                need_coh = 0;
+        BUG_ON(gfp & __GFP_HIGHMEM);
 
-        /*
-         * - A coherent buffer needs MMU mapping to enforce non-cachability
-         * - A highmem page needs a virtual handle (hence MMU mapping)
-         *   independent of cachability
-         */
-        if (PageHighMem(page) || need_coh)
-                need_kvaddr = 1;
+        page = alloc_pages(gfp, order);
+        if (!page)
+                return NULL;
 
         /* This is linear addr (0x8000_0000 based) */
         paddr = page_to_phys(page);
 
         *dma_handle = paddr;
 
-        /* This is kernel Virtual address (0x7000_0000 based) */
-        if (need_kvaddr) {
+        /*
+         * A coherent buffer needs MMU mapping to enforce non-cachability.
+         * kvaddr is kernel Virtual address (0x7000_0000 based).
+         */
+        if (need_coh) {
                 kvaddr = ioremap_nocache(paddr, size);
                 if (kvaddr == NULL) {
                         __free_pages(page, order);
@@ -93,12 +77,8 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr,
 {
         phys_addr_t paddr = dma_handle;
         struct page *page = virt_to_page(paddr);
-        int is_non_coh = 1;
-
-        is_non_coh = (attrs & DMA_ATTR_NON_CONSISTENT) ||
-                        (is_isa_arcv2() && ioc_enable);
 
-        if (PageHighMem(page) || !is_non_coh)
+        if (!(attrs & DMA_ATTR_NON_CONSISTENT))
                 iounmap((void __force __iomem *)vaddr);
 
         __free_pages(page, get_order(size));
@@ -185,3 +165,23 @@ void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr,
                 break;
         }
 }
+
+/*
+ * Plug in coherent or noncoherent dma ops
+ */
+void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                        const struct iommu_ops *iommu, bool coherent)
+{
+        /*
+         * IOC hardware snoops all DMA traffic keeping the caches consistent
+         * with memory - eliding need for any explicit cache maintenance of
+         * DMA buffers - so we can use dma_direct cache ops.
+         */
+        if (is_isa_arcv2() && ioc_enable && coherent) {
+                set_dma_ops(dev, &dma_direct_ops);
+                dev_info(dev, "use dma_direct_ops cache ops\n");
+        } else {
+                set_dma_ops(dev, &dma_noncoherent_ops);
+                dev_info(dev, "use dma_noncoherent_ops cache ops\n");
+        }
+}
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 79906cecb091..3ad482d2f1eb 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -223,7 +223,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
                               struct kvm_vcpu_events *events);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
index ceffc40810ee..48daec7f78ba 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
@@ -46,6 +46,7 @@
         pinctrl-0 = <&mmc0_pins>;
         vmmc-supply = <&reg_cldo1>;
         cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>;
+        bus-width = <4>;
         status = "okay";
 };
 
@@ -56,6 +57,7 @@
         vqmmc-supply = <&reg_bldo2>;
         non-removable;
         cap-mmc-hw-reset;
+        bus-width = <8>;
         status = "okay";
 };
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index f26055f2306e..3d6d7336f871 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -61,8 +61,7 @@ struct kvm_arch {
         u64    vmid_gen;
         u32    vmid;
 
-        /* 1-level 2nd stage table and lock */
-        spinlock_t pgd_lock;
+        /* 1-level 2nd stage table, protected by kvm->mmu_lock */
         pgd_t *pgd;
 
         /* VTTBR value associated with above pgd and vmid */
@@ -357,7 +356,6 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
                               struct kvm_vcpu_events *events);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index d496ef579859..ca46153d7915 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -98,8 +98,10 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)
         val = read_sysreg(cpacr_el1);
         val |= CPACR_EL1_TTA;
         val &= ~CPACR_EL1_ZEN;
-        if (!update_fp_enabled(vcpu))
+        if (!update_fp_enabled(vcpu)) {
                 val &= ~CPACR_EL1_FPEN;
+                __activate_traps_fpsimd32(vcpu);
+        }
 
         write_sysreg(val, cpacr_el1);
 
@@ -114,8 +116,10 @@ static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu)
 
         val = CPTR_EL2_DEFAULT;
         val |= CPTR_EL2_TTA | CPTR_EL2_TZ;
-        if (!update_fp_enabled(vcpu))
+        if (!update_fp_enabled(vcpu)) {
                 val |= CPTR_EL2_TFP;
+                __activate_traps_fpsimd32(vcpu);
+        }
 
         write_sysreg(val, cptr_el2);
 }
@@ -129,7 +133,6 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
         if (cpus_have_const_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
                 write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2);
 
-        __activate_traps_fpsimd32(vcpu);
         if (has_vhe())
                 activate_traps_vhe(vcpu);
         else
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 65f86271f02b..8080c9f489c3 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -985,8 +985,9 @@ int pmd_free_pte_page(pmd_t *pmdp, unsigned long addr)
 
         pmd = READ_ONCE(*pmdp);
 
-        /* No-op for empty entry and WARN_ON for valid entry */
-        if (!pmd_present(pmd) || !pmd_table(pmd)) {
+        if (!pmd_present(pmd))
+                return 1;
+        if (!pmd_table(pmd)) {
                 VM_WARN_ON(!pmd_table(pmd));
                 return 1;
         }
@@ -1007,8 +1008,9 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr)
 
         pud = READ_ONCE(*pudp);
 
-        /* No-op for empty entry and WARN_ON for valid entry */
-        if (!pud_present(pud) || !pud_table(pud)) {
+        if (!pud_present(pud))
+                return 1;
+        if (!pud_table(pud)) {
                 VM_WARN_ON(!pud_table(pud));
                 return 1;
         }
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index 70dde040779b..f5453d944ff5 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -172,7 +172,7 @@ void __init cf_bootmem_alloc(void)
         high_memory = (void *)_ramend;
 
         /* Reserve kernel text/data/bss */
-        memblock_reserve(memstart, memstart - _rambase);
+        memblock_reserve(_rambase, memstart - _rambase);
 
         m68k_virt_to_node_shift = fls(_ramend - 1) - 6;
         module_fixup(NULL, __start_fixup, __stop_fixup);
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index a9af1d2dcd69..2c1c53d12179 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -931,7 +931,6 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu,
                                                    bool write);
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end);
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 019035d7225c..8f845f6e5f42 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -13,6 +13,7 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -20,6 +21,7 @@
 
 #include <asm/abi.h>
 #include <asm/mips-cps.h>
+#include <asm/page.h>
 #include <asm/vdso.h>
 
 /* Kernel-provided data used by the VDSO. */
@@ -128,12 +130,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         vvar_size = gic_size + PAGE_SIZE;
         size = vvar_size + image->size;
 
+        /*
+         * Find a region that's large enough for us to perform the
+         * colour-matching alignment below.
+         */
+        if (cpu_has_dc_aliases)
+                size += shm_align_mask + 1;
+
         base = get_unmapped_area(NULL, 0, size, 0, 0);
         if (IS_ERR_VALUE(base)) {
                 ret = base;
                 goto out;
         }
 
+        /*
+         * If we suffer from dcache aliasing, ensure that the VDSO data page
+         * mapping is coloured the same as the kernel's mapping of that memory.
+         * This ensures that when the kernel updates the VDSO data userland
+         * will observe it without requiring cache invalidations.
+         */
+        if (cpu_has_dc_aliases) {
+                base = __ALIGN_MASK(base, shm_align_mask);
+                base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask;
+        }
+
         data_addr = base + gic_size;
         vdso_addr = data_addr + PAGE_SIZE;
 
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index ee64db032793..d8dcdb350405 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -512,16 +512,6 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end,
         return 1;
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        unsigned long end = hva + PAGE_SIZE;
-
-        handle_hva_to_gpa(kvm, hva, end, &kvm_unmap_hva_handler, NULL);
-
-        kvm_mips_callbacks->flush_shadow_all(kvm);
-        return 0;
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
 {
         handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
diff --git a/arch/nds32/Kconfig b/arch/nds32/Kconfig
index 1d4248fa55e9..7068f341133d 100644
--- a/arch/nds32/Kconfig
+++ b/arch/nds32/Kconfig
@@ -40,6 +40,10 @@ config NDS32
         select NO_IOPORT_MAP
         select RTC_LIB
         select THREAD_INFO_IN_TASK
+        select HAVE_FUNCTION_TRACER
+        select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_FTRACE_MCOUNT_RECORD
+        select HAVE_DYNAMIC_FTRACE
         help
           Andes(nds32) Linux support.
 
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 63f4f173e5f4..3509fac10491 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -5,6 +5,10 @@ KBUILD_DEFCONFIG := defconfig
 
 comma = ,
 
+ifdef CONFIG_FUNCTION_TRACER
+arch-y += -malways-save-lp -mno-relax
+endif
+
 KBUILD_CFLAGS   += $(call cc-option, -mno-sched-prolog-epilog)
 KBUILD_CFLAGS   += -mcmodel=large
 
diff --git a/arch/nds32/include/asm/elf.h b/arch/nds32/include/asm/elf.h
index 56c479058802..f5f9cf7e0544 100644
--- a/arch/nds32/include/asm/elf.h
+++ b/arch/nds32/include/asm/elf.h
@@ -121,9 +121,9 @@ struct elf32_hdr;
  */
 #define ELF_CLASS       ELFCLASS32
 #ifdef __NDS32_EB__
-#define ELF_DATA        ELFDATA2MSB;
+#define ELF_DATA        ELFDATA2MSB
 #else
-#define ELF_DATA        ELFDATA2LSB;
+#define ELF_DATA        ELFDATA2LSB
 #endif
 #define ELF_ARCH        EM_NDS32
 #define USE_ELF_CORE_DUMP
diff --git a/arch/nds32/include/asm/ftrace.h b/arch/nds32/include/asm/ftrace.h
new file mode 100644
index 000000000000..2f96cc96aa35
--- /dev/null
+++ b/arch/nds32/include/asm/ftrace.h
@@ -0,0 +1,46 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __ASM_NDS32_FTRACE_H
+#define __ASM_NDS32_FTRACE_H
+
+#ifdef CONFIG_FUNCTION_TRACER
+
+#define HAVE_FUNCTION_GRAPH_FP_TEST
+
+#define MCOUNT_ADDR ((unsigned long)(_mcount))
+/* mcount call is composed of three instructions:
+ * sethi + ori + jral
+ */
+#define MCOUNT_INSN_SIZE 12
+
+extern void _mcount(unsigned long parent_ip);
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+
+#define FTRACE_ADDR ((unsigned long)_ftrace_caller)
+
+#ifdef __NDS32_EL__
+#define INSN_NOP                0x09000040
+#define INSN_SIZE(insn)         (((insn & 0x00000080) == 0) ? 4 : 2)
+#define IS_SETHI(insn)          ((insn & 0x000000fe) == 0x00000046)
+#define ENDIAN_CONVERT(insn)    be32_to_cpu(insn)
+#else /* __NDS32_EB__ */
+#define INSN_NOP                0x40000009
+#define INSN_SIZE(insn)         (((insn & 0x80000000) == 0) ? 4 : 2)
+#define IS_SETHI(insn)          ((insn & 0xfe000000) == 0x46000000)
+#define ENDIAN_CONVERT(insn)    (insn)
+#endif
+
+extern void _ftrace_caller(unsigned long parent_ip);
+static inline unsigned long ftrace_call_adjust(unsigned long addr)
+{
+        return addr;
+}
+struct dyn_arch_ftrace {
+};
+
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#endif /* CONFIG_FUNCTION_TRACER */
+
+#endif /* __ASM_NDS32_FTRACE_H */
diff --git a/arch/nds32/include/asm/nds32.h b/arch/nds32/include/asm/nds32.h
index 19b19394a936..68c38151c3e4 100644
--- a/arch/nds32/include/asm/nds32.h
+++ b/arch/nds32/include/asm/nds32.h
@@ -17,6 +17,7 @@
 #else
 #define FP_OFFSET (-2)
 #endif
+#define LP_OFFSET (-1)
 
 extern void __init early_trap_init(void);
 static inline void GIE_ENABLE(void)
diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h
index 18a009f3804d..362a32d9bd16 100644
--- a/arch/nds32/include/asm/uaccess.h
+++ b/arch/nds32/include/asm/uaccess.h
@@ -38,7 +38,7 @@ struct exception_table_entry {
 extern int fixup_exception(struct pt_regs *regs);
 
 #define KERNEL_DS       ((mm_segment_t) { ~0UL })
-#define USER_DS         ((mm_segment_t) {TASK_SIZE - 1})
+#define USER_DS         ((mm_segment_t) {TASK_SIZE - 1})
 
 #define get_ds()        (KERNEL_DS)
 #define get_fs()        (current_thread_info()->addr_limit)
@@ -49,11 +49,11 @@ static inline void set_fs(mm_segment_t fs)
         current_thread_info()->addr_limit = fs;
 }
 
-#define segment_eq(a, b)    ((a) == (b))
+#define segment_eq(a, b)        ((a) == (b))
 
 #define __range_ok(addr, size) (size <= get_fs() && addr <= (get_fs() -size))
 
-#define access_ok(type, addr, size)                 \
+#define access_ok(type, addr, size)     \
         __range_ok((unsigned long)addr, (unsigned long)size)
 /*
  * Single-value transfer routines.  They automatically use the right
@@ -75,70 +75,73 @@ static inline void set_fs(mm_segment_t fs)
  * versions are void (ie, don't return a value as such).
  */
 
-#define get_user(x,p)                                                   \
-({                                                                      \
-        long __e = -EFAULT;                                             \
-        if(likely(access_ok(VERIFY_READ,  p, sizeof(*p)))) {            \
-                __e = __get_user(x,p);                                  \
-        } else                                                          \
-                x = 0;                                                  \
-        __e;                                                            \
-})
-#define __get_user(x,ptr)                                               \
+#define get_user        __get_user                                      \
+
+#define __get_user(x, ptr)                                              \
 ({                                                                      \
         long __gu_err = 0;                                              \
-        __get_user_err((x),(ptr),__gu_err);                             \
+        __get_user_check((x), (ptr), __gu_err);                         \
         __gu_err;                                                       \
 })
 
-#define __get_user_error(x,ptr,err)                                     \
+#define __get_user_error(x, ptr, err)                                   \
 ({                                                                      \
-        __get_user_err((x),(ptr),err);                                  \
-        (void) 0;                                                       \
+        __get_user_check((x), (ptr), (err));                            \
+        (void)0;                                                        \
 })
 
-#define __get_user_err(x,ptr,err)                                       \
+#define __get_user_check(x, ptr, err)                                   \
+({                                                                      \
+        const __typeof__(*(ptr)) __user *__p = (ptr);                   \
+        might_fault();                                                  \
+        if (access_ok(VERIFY_READ, __p, sizeof(*__p))) {                \
+                __get_user_err((x), __p, (err));                        \
+        } else {                                                        \
+                (x) = 0; (err) = -EFAULT;                               \
+        }                                                               \
+})
+
+#define __get_user_err(x, ptr, err)                                     \
 do {                                                                    \
-        unsigned long __gu_addr = (unsigned long)(ptr);                 \
         unsigned long __gu_val;                                         \
         __chk_user_ptr(ptr);                                            \
         switch (sizeof(*(ptr))) {                                       \
         case 1:                                                         \
-                __get_user_asm("lbi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lbi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 2:                                                         \
-                __get_user_asm("lhi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lhi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 4:                                                         \
-                __get_user_asm("lwi",__gu_val,__gu_addr,err);           \
+                __get_user_asm("lwi", __gu_val, (ptr), (err));          \
                 break;                                                  \
         case 8:                                                         \
-                __get_user_asm_dword(__gu_val,__gu_addr,err);           \
+                __get_user_asm_dword(__gu_val, (ptr), (err));           \
                 break;                                                  \
         default:                                                        \
                 BUILD_BUG();                                            \
                 break;                                                  \
         }                                                               \
-        (x) = (__typeof__(*(ptr)))__gu_val;                             \
+        (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
 } while (0)
 
-#define __get_user_asm(inst,x,addr,err)                                 \
-        asm volatile(                                                   \
-        "1:     "inst"  %1,[%2]\n"                                      \
-        "2:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "3:     move %0, %3\n"                                          \
-        "       move %1, #0\n"                                          \
-        "       b       2b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 3b\n"                                       \
-        "       .previous"                                              \
-        : "+r" (err), "=&r" (x)                                         \
-        : "r" (addr), "i" (-EFAULT)                                     \
-        : "cc")
+#define __get_user_asm(inst, x, addr, err)                              \
+        __asm__ __volatile__ (                                          \
+                "1:     "inst"  %1,[%2]\n"                              \
+                "2:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "3:     move %0, %3\n"                                  \
+                "       move %1, #0\n"                                  \
+                "       b       2b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 3b\n"                               \
+                "       .previous"                                      \
+                : "+r" (err), "=&r" (x)                                 \
+                : "r" (addr), "i" (-EFAULT)                             \
+                : "cc")
 
 #ifdef __NDS32_EB__
 #define __gu_reg_oper0 "%H1"
@@ -149,61 +152,66 @@ do {									\
 #endif
 
 #define __get_user_asm_dword(x, addr, err)                              \
-        asm volatile(                                                   \
-        "\n1:\tlwi " __gu_reg_oper0 ",[%2]\n"                           \
-        "\n2:\tlwi " __gu_reg_oper1 ",[%2+4]\n"                         \
-        "3:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "4:     move    %0, %3\n"                                       \
-        "       b       3b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 4b\n"                                       \
-        "       .long   2b, 4b\n"                                       \
-        "       .previous"                                              \
-        : "+r"(err), "=&r"(x)                                           \
-        : "r"(addr), "i"(-EFAULT)                                       \
-        : "cc")
-#define put_user(x,p)                                                   \
-({                                                                      \
-        long __e = -EFAULT;                                             \
-        if(likely(access_ok(VERIFY_WRITE,  p, sizeof(*p)))) {           \
-                __e = __put_user(x,p);                                  \
-        }                                                               \
-        __e;                                                            \
-})
-#define __put_user(x,ptr)                                               \
+        __asm__ __volatile__ (                                          \
+                "\n1:\tlwi " __gu_reg_oper0 ",[%2]\n"                   \
+                "\n2:\tlwi " __gu_reg_oper1 ",[%2+4]\n"                 \
+                "3:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "4:     move    %0, %3\n"                               \
+                "       b       3b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 4b\n"                               \
+                "       .long   2b, 4b\n"                               \
+                "       .previous"                                      \
+                : "+r"(err), "=&r"(x)                                   \
+                : "r"(addr), "i"(-EFAULT)                               \
+                : "cc")
+
+#define put_user        __put_user                                      \
+
+#define __put_user(x, ptr)                                              \
 ({                                                                      \
         long __pu_err = 0;                                              \
-        __put_user_err((x),(ptr),__pu_err);                             \
+        __put_user_err((x), (ptr), __pu_err);                           \
         __pu_err;                                                       \
 })
 
-#define __put_user_error(x,ptr,err)                                     \
+#define __put_user_error(x, ptr, err)                                   \
+({                                                                      \
+        __put_user_err((x), (ptr), (err));                              \
+        (void)0;                                                        \
+})
+
+#define __put_user_check(x, ptr, err)                                   \
 ({                                                                      \
-        __put_user_err((x),(ptr),err);                                  \
-        (void) 0;                                                       \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
+        might_fault();                                                  \
+        if (access_ok(VERIFY_WRITE, __p, sizeof(*__p))) {               \
+                __put_user_err((x), __p, (err));                        \
+        } else  {                                                       \
+                (err) = -EFAULT;                                        \
+        }                                                               \
 })
 
-#define __put_user_err(x,ptr,err)                                       \
+#define __put_user_err(x, ptr, err)                                     \
 do {                                                                    \
-        unsigned long __pu_addr = (unsigned long)(ptr);                 \
         __typeof__(*(ptr)) __pu_val = (x);                              \
         __chk_user_ptr(ptr);                                            \
         switch (sizeof(*(ptr))) {                                       \
         case 1:                                                         \
-                __put_user_asm("sbi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("sbi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 2:                                                         \
-                __put_user_asm("shi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("shi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 4:                                                         \
-                __put_user_asm("swi",__pu_val,__pu_addr,err);           \
+                __put_user_asm("swi", __pu_val, (ptr), (err));          \
                 break;                                                  \
         case 8:                                                         \
-                __put_user_asm_dword(__pu_val,__pu_addr,err);           \
+                __put_user_asm_dword(__pu_val, (ptr), (err));           \
                 break;                                                  \
         default:                                                        \
                 BUILD_BUG();                                            \
@@ -211,22 +219,22 @@ do {									\
         }                                                               \
 } while (0)
 
-#define __put_user_asm(inst,x,addr,err)                                 \
-        asm volatile(                                                   \
-        "1:     "inst"  %1,[%2]\n"                                      \
-        "2:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "3:     move    %0, %3\n"                                       \
-        "       b       2b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 3b\n"                                       \
-        "       .previous"                                              \
-        : "+r" (err)                                                    \
-        : "r" (x), "r" (addr), "i" (-EFAULT)                            \
-        : "cc")
+#define __put_user_asm(inst, x, addr, err)                              \
+        __asm__ __volatile__ (                                          \
+                "1:     "inst"  %1,[%2]\n"                              \
+                "2:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "3:     move    %0, %3\n"                               \
+                "       b       2b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 3b\n"                               \
+                "       .previous"                                      \
+                : "+r" (err)                                            \
+                : "r" (x), "r" (addr), "i" (-EFAULT)                    \
+                : "cc")
 
 #ifdef __NDS32_EB__
 #define __pu_reg_oper0 "%H2"
@@ -237,23 +245,24 @@ do {									\
 #endif
 
 #define __put_user_asm_dword(x, addr, err)                              \
-        asm volatile(                                                   \
-        "\n1:\tswi " __pu_reg_oper0 ",[%1]\n"                           \
-        "\n2:\tswi " __pu_reg_oper1 ",[%1+4]\n"                         \
-        "3:\n"                                                          \
-        "       .section .fixup,\"ax\"\n"                               \
-        "       .align  2\n"                                            \
-        "4:     move    %0, %3\n"                                       \
-        "       b       3b\n"                                           \
-        "       .previous\n"                                            \
-        "       .section __ex_table,\"a\"\n"                            \
-        "       .align  3\n"                                            \
-        "       .long   1b, 4b\n"                                       \
-        "       .long   2b, 4b\n"                                       \
-        "       .previous"                                              \
-        : "+r"(err)                                                     \
-        : "r"(addr), "r"(x), "i"(-EFAULT)                               \
-        : "cc")
+        __asm__ __volatile__ (                                          \
+                "\n1:\tswi " __pu_reg_oper0 ",[%1]\n"                   \
+                "\n2:\tswi " __pu_reg_oper1 ",[%1+4]\n"                 \
+                "3:\n"                                                  \
+                "       .section .fixup,\"ax\"\n"                       \
+                "       .align  2\n"                                    \
+                "4:     move    %0, %3\n"                               \
+                "       b       3b\n"                                   \
+                "       .previous\n"                                    \
+                "       .section __ex_table,\"a\"\n"                    \
+                "       .align  3\n"                                    \
+                "       .long   1b, 4b\n"                               \
+                "       .long   2b, 4b\n"                               \
+                "       .previous"                                      \
+                : "+r"(err)                                             \
+                : "r"(addr), "r"(x), "i"(-EFAULT)                       \
+                : "cc")
+
 extern unsigned long __arch_clear_user(void __user * addr, unsigned long n);
 extern long strncpy_from_user(char *dest, const char __user * src, long count);
 extern __must_check long strlen_user(const char __user * str);
diff --git a/arch/nds32/kernel/Makefile b/arch/nds32/kernel/Makefile
index 42792743e8b9..27cded39fa66 100644
--- a/arch/nds32/kernel/Makefile
+++ b/arch/nds32/kernel/Makefile
@@ -21,3 +21,9 @@ extra-y := head.o vmlinux.lds
 
 
 obj-y                           += vdso/
+
+obj-$(CONFIG_FUNCTION_TRACER)   += ftrace.o
+
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
+endif
diff --git a/arch/nds32/kernel/atl2c.c b/arch/nds32/kernel/atl2c.c
index 0c6d031a1c4a..0c5386e72098 100644
--- a/arch/nds32/kernel/atl2c.c
+++ b/arch/nds32/kernel/atl2c.c
@@ -9,7 +9,8 @@
 
 void __iomem *atl2c_base;
 static const struct of_device_id atl2c_ids[] __initconst = {
-        {.compatible = "andestech,atl2c",}
+        {.compatible = "andestech,atl2c",},
+        {}
 };
 
 static int __init atl2c_of_init(void)
diff --git a/arch/nds32/kernel/ex-entry.S b/arch/nds32/kernel/ex-entry.S
index b8ae4e9a6b93..21a144071566 100644
--- a/arch/nds32/kernel/ex-entry.S
+++ b/arch/nds32/kernel/ex-entry.S
@@ -118,7 +118,7 @@ common_exception_handler:
         /* interrupt */
 2:
 #ifdef CONFIG_TRACE_IRQFLAGS
-        jal     trace_hardirqs_off
+        jal     __trace_hardirqs_off
 #endif
         move    $r0, $sp
         sethi   $lp, hi20(ret_from_intr)
diff --git a/arch/nds32/kernel/ex-exit.S b/arch/nds32/kernel/ex-exit.S
index 03e4f7788a18..f00af92f7e22 100644
--- a/arch/nds32/kernel/ex-exit.S
+++ b/arch/nds32/kernel/ex-exit.S
@@ -138,8 +138,8 @@ no_work_pending:
 #ifdef CONFIG_TRACE_IRQFLAGS
         lwi     $p0, [$sp+(#IPSW_OFFSET)]
         andi    $p0, $p0, #0x1
-        la      $r10, trace_hardirqs_off
-        la      $r9, trace_hardirqs_on
+        la      $r10, __trace_hardirqs_off
+        la      $r9, __trace_hardirqs_on
         cmovz   $r9, $p0, $r10
         jral    $r9
 #endif
diff --git a/arch/nds32/kernel/ftrace.c b/arch/nds32/kernel/ftrace.c
new file mode 100644
index 000000000000..a0a9679ad5de
--- /dev/null
+++ b/arch/nds32/kernel/ftrace.c
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/ftrace.h>
+#include <linux/uaccess.h>
+#include <asm/cacheflush.h>
+
+#ifndef CONFIG_DYNAMIC_FTRACE
+extern void (*ftrace_trace_function)(unsigned long, unsigned long,
+                                     struct ftrace_ops*, struct pt_regs*);
+extern int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace);
+extern void ftrace_graph_caller(void);
+
+noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip,
+                                  struct ftrace_ops *op, struct pt_regs *regs)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+
+noinline void _mcount(unsigned long parent_ip)
+{
+        /* save all state by the compiler prologue */
+
+        unsigned long ip = (unsigned long)__builtin_return_address(0);
+
+        if (ftrace_trace_function != ftrace_stub)
+                ftrace_trace_function(ip - MCOUNT_INSN_SIZE, parent_ip,
+                                      NULL, NULL);
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        if (ftrace_graph_return != (trace_func_graph_ret_t)ftrace_stub
+            || ftrace_graph_entry != ftrace_graph_entry_stub)
+                ftrace_graph_caller();
+#endif
+
+        /* restore all state by the compiler epilogue */
+}
+EXPORT_SYMBOL(_mcount);
+
+#else /* CONFIG_DYNAMIC_FTRACE */
+
+noinline void __naked ftrace_stub(unsigned long ip, unsigned long parent_ip,
+                                  struct ftrace_ops *op, struct pt_regs *regs)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+
+noinline void __naked _mcount(unsigned long parent_ip)
+{
+        __asm__ ("");  /* avoid to optimize as pure function */
+}
+EXPORT_SYMBOL(_mcount);
+
+#define XSTR(s) STR(s)
+#define STR(s) #s
+void _ftrace_caller(unsigned long parent_ip)
+{
+        /* save all state needed by the compiler prologue */
+
+        /*
+         * prepare arguments for real tracing function
+         * first  arg : __builtin_return_address(0) - MCOUNT_INSN_SIZE
+         * second arg : parent_ip
+         */
+        __asm__ __volatile__ (
+                "move $r1, %0                              \n\t"
+                "addi $r0, %1, #-" XSTR(MCOUNT_INSN_SIZE) "\n\t"
+                :
+                : "r" (parent_ip), "r" (__builtin_return_address(0)));
+
+        /* a placeholder for the call to a real tracing function */
+        __asm__ __volatile__ (
+                "ftrace_call:           \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t");
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* a placeholder for the call to ftrace_graph_caller */
+        __asm__ __volatile__ (
+                "ftrace_graph_call:     \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t"
+                "nop                    \n\t");
+#endif
+        /* restore all state needed by the compiler epilogue */
+}
+
+int __init ftrace_dyn_arch_init(void)
+{
+        return 0;
+}
+
+int ftrace_arch_code_modify_prepare(void)
+{
+        set_all_modules_text_rw();
+        return 0;
+}
+
+int ftrace_arch_code_modify_post_process(void)
+{
+        set_all_modules_text_ro();
+        return 0;
+}
+
+static unsigned long gen_sethi_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x46000000;
+        unsigned long imm = addr >> 12;
+        unsigned long rt_num = 0xf << 20;
+
+        return ENDIAN_CONVERT(opcode | rt_num | imm);
+}
+
+static unsigned long gen_ori_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x58000000;
+        unsigned long imm = addr & 0x0000fff;
+        unsigned long rt_num = 0xf << 20;
+        unsigned long ra_num = 0xf << 15;
+
+        return ENDIAN_CONVERT(opcode | rt_num | ra_num | imm);
+}
+
+static unsigned long gen_jral_insn(unsigned long addr)
+{
+        unsigned long opcode = 0x4a000001;
+        unsigned long rt_num = 0x1e << 20;
+        unsigned long rb_num = 0xf << 10;
+
+        return ENDIAN_CONVERT(opcode | rt_num | rb_num);
+}
+
+static void ftrace_gen_call_insn(unsigned long *call_insns,
+                                 unsigned long addr)
+{
+        call_insns[0] = gen_sethi_insn(addr); /* sethi $r15, imm20u       */
+        call_insns[1] = gen_ori_insn(addr);   /* ori   $r15, $r15, imm15u */
+        call_insns[2] = gen_jral_insn(addr);  /* jral  $lp,  $r15         */
+}
+
+static int __ftrace_modify_code(unsigned long pc, unsigned long *old_insn,
+                                unsigned long *new_insn, bool validate)
+{
+        unsigned long orig_insn[3];
+
+        if (validate) {
+                if (probe_kernel_read(orig_insn, (void *)pc, MCOUNT_INSN_SIZE))
+                        return -EFAULT;
+                if (memcmp(orig_insn, old_insn, MCOUNT_INSN_SIZE))
+                        return -EINVAL;
+        }
+
+        if (probe_kernel_write((void *)pc, new_insn, MCOUNT_INSN_SIZE))
+                return -EPERM;
+
+        return 0;
+}
+
+static int ftrace_modify_code(unsigned long pc, unsigned long *old_insn,
+                              unsigned long *new_insn, bool validate)
+{
+        int ret;
+
+        ret = __ftrace_modify_code(pc, old_insn, new_insn, validate);
+        if (ret)
+                return ret;
+
+        flush_icache_range(pc, pc + MCOUNT_INSN_SIZE);
+
+        return ret;
+}
+
+int ftrace_update_ftrace_func(ftrace_func_t func)
+{
+        unsigned long pc = (unsigned long)&ftrace_call;
+        unsigned long old_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long new_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        if (func != ftrace_stub)
+                ftrace_gen_call_insn(new_insn, (unsigned long)func);
+
+        return ftrace_modify_code(pc, old_insn, new_insn, false);
+}
+
+int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+{
+        unsigned long pc = rec->ip;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, addr);
+
+        return ftrace_modify_code(pc, nop_insn, call_insn, true);
+}
+
+int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+                    unsigned long addr)
+{
+        unsigned long pc = rec->ip;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, addr);
+
+        return ftrace_modify_code(pc, call_insn, nop_insn, true);
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+                           unsigned long frame_pointer)
+{
+        unsigned long return_hooker = (unsigned long)&return_to_handler;
+        struct ftrace_graph_ent trace;
+        unsigned long old;
+        int err;
+
+        if (unlikely(atomic_read(&current->tracing_graph_pause)))
+                return;
+
+        old = *parent;
+
+        trace.func = self_addr;
+        trace.depth = current->curr_ret_stack + 1;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace))
+                return;
+
+        err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+                                       frame_pointer, NULL);
+
+        if (err == -EBUSY)
+                return;
+
+        *parent = return_hooker;
+}
+
+noinline void ftrace_graph_caller(void)
+{
+        unsigned long *parent_ip =
+                (unsigned long *)(__builtin_frame_address(2) - 4);
+
+        unsigned long selfpc =
+                (unsigned long)(__builtin_return_address(1) - MCOUNT_INSN_SIZE);
+
+        unsigned long frame_pointer =
+                (unsigned long)__builtin_frame_address(3);
+
+        prepare_ftrace_return(parent_ip, selfpc, frame_pointer);
+}
+
+extern unsigned long ftrace_return_to_handler(unsigned long frame_pointer);
+void __naked return_to_handler(void)
+{
+        __asm__ __volatile__ (
+                /* save state needed by the ABI     */
+                "smw.adm $r0,[$sp],$r1,#0x0  \n\t"
+
+                /* get original return address      */
+                "move $r0, $fp               \n\t"
+                "bal ftrace_return_to_handler\n\t"
+                "move $lp, $r0               \n\t"
+
+                /* restore state nedded by the ABI  */
+                "lmw.bim $r0,[$sp],$r1,#0x0  \n\t");
+}
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+extern unsigned long ftrace_graph_call;
+
+static int ftrace_modify_graph_caller(bool enable)
+{
+        unsigned long pc = (unsigned long)&ftrace_graph_call;
+        unsigned long nop_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+        unsigned long call_insn[3] = {INSN_NOP, INSN_NOP, INSN_NOP};
+
+        ftrace_gen_call_insn(call_insn, (unsigned long)ftrace_graph_caller);
+
+        if (enable)
+                return ftrace_modify_code(pc, nop_insn, call_insn, true);
+        else
+                return ftrace_modify_code(pc, call_insn, nop_insn, true);
+}
+
+int ftrace_enable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(true);
+}
+
+int ftrace_disable_ftrace_graph_caller(void)
+{
+        return ftrace_modify_graph_caller(false);
+}
+#endif /* CONFIG_DYNAMIC_FTRACE */
+
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+
+#ifdef CONFIG_TRACE_IRQFLAGS
+noinline void __trace_hardirqs_off(void)
+{
+        trace_hardirqs_off();
+}
+noinline void __trace_hardirqs_on(void)
+{
+        trace_hardirqs_on();
+}
+#endif /* CONFIG_TRACE_IRQFLAGS */
diff --git a/arch/nds32/kernel/module.c b/arch/nds32/kernel/module.c
index 4167283d8293..1e31829cbc2a 100644
--- a/arch/nds32/kernel/module.c
+++ b/arch/nds32/kernel/module.c
@@ -40,7 +40,7 @@ void do_reloc16(unsigned int val, unsigned int *loc, unsigned int val_mask,
 
         tmp2 = tmp & loc_mask;
         if (partial_in_place) {
-                tmp &= (!loc_mask);
+                tmp &= (~loc_mask);
                 tmp =
                     tmp2 | ((tmp + ((val & val_mask) >> val_shift)) & val_mask);
         } else {
@@ -70,7 +70,7 @@ void do_reloc32(unsigned int val, unsigned int *loc, unsigned int val_mask,
 
         tmp2 = tmp & loc_mask;
         if (partial_in_place) {
-                tmp &= (!loc_mask);
+                tmp &= (~loc_mask);
                 tmp =
                     tmp2 | ((tmp + ((val & val_mask) >> val_shift)) & val_mask);
         } else {
diff --git a/arch/nds32/kernel/stacktrace.c b/arch/nds32/kernel/stacktrace.c
index 8b231e910ea6..d974c0c1c65f 100644
--- a/arch/nds32/kernel/stacktrace.c
+++ b/arch/nds32/kernel/stacktrace.c
@@ -4,6 +4,7 @@
 #include <linux/sched/debug.h>
 #include <linux/sched/task_stack.h>
 #include <linux/stacktrace.h>
+#include <linux/ftrace.h>
 
 void save_stack_trace(struct stack_trace *trace)
 {
@@ -16,6 +17,7 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
         unsigned long *fpn;
         int skip = trace->skip;
         int savesched;
+        int graph_idx = 0;
 
         if (tsk == current) {
                 __asm__ __volatile__("\tori\t%0, $fp, #0\n":"=r"(fpn));
@@ -29,10 +31,12 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
                && (fpn >= (unsigned long *)TASK_SIZE)) {
                 unsigned long lpp, fpp;
 
-                lpp = fpn[-1];
+                lpp = fpn[LP_OFFSET];
                 fpp = fpn[FP_OFFSET];
                 if (!__kernel_text_address(lpp))
                         break;
+                else
+                        lpp = ftrace_graph_ret_addr(tsk, &graph_idx, lpp, NULL);
 
                 if (savesched || !in_sched_functions(lpp)) {
                         if (skip) {
diff --git a/arch/nds32/kernel/traps.c b/arch/nds32/kernel/traps.c
index a6205fd4db52..1496aab48998 100644
--- a/arch/nds32/kernel/traps.c
+++ b/arch/nds32/kernel/traps.c
@@ -8,6 +8,7 @@
 #include <linux/kdebug.h>
 #include <linux/sched/task_stack.h>
 #include <linux/uaccess.h>
+#include <linux/ftrace.h>
 
 #include <asm/proc-fns.h>
 #include <asm/unistd.h>
@@ -94,28 +95,6 @@ static void dump_instr(struct pt_regs *regs)
         set_fs(fs);
 }
 
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-#include <linux/ftrace.h>
-static void
-get_real_ret_addr(unsigned long *addr, struct task_struct *tsk, int *graph)
-{
-        if (*addr == (unsigned long)return_to_handler) {
-                int index = tsk->curr_ret_stack;
-
-                if (tsk->ret_stack && index >= *graph) {
-                        index -= *graph;
-                        *addr = tsk->ret_stack[index].ret;
-                        (*graph)++;
-                }
-        }
-}
-#else
-static inline void
-get_real_ret_addr(unsigned long *addr, struct task_struct *tsk, int *graph)
-{
-}
-#endif
-
 #define LOOP_TIMES (100)
 static void __dump(struct task_struct *tsk, unsigned long *base_reg)
 {
@@ -126,7 +105,8 @@ static void __dump(struct task_struct *tsk, unsigned long *base_reg)
                 while (!kstack_end(base_reg)) {
                         ret_addr = *base_reg++;
                         if (__kernel_text_address(ret_addr)) {
-                                get_real_ret_addr(&ret_addr, tsk, &graph);
+                                ret_addr = ftrace_graph_ret_addr(
+                                                tsk, &graph, ret_addr, NULL);
                                 print_ip_sym(ret_addr);
                         }
                         if (--cnt < 0)
@@ -137,15 +117,12 @@ static void __dump(struct task_struct *tsk, unsigned long *base_reg)
                        !((unsigned long)base_reg & 0x3) &&
                        ((unsigned long)base_reg >= TASK_SIZE)) {
                         unsigned long next_fp;
-#if !defined(NDS32_ABI_2)
-                        ret_addr = base_reg[0];
-                        next_fp = base_reg[1];
-#else
-                        ret_addr = base_reg[-1];
+                        ret_addr = base_reg[LP_OFFSET];
                         next_fp = base_reg[FP_OFFSET];
-#endif
                         if (__kernel_text_address(ret_addr)) {
-                                get_real_ret_addr(&ret_addr, tsk, &graph);
+
+                                ret_addr = ftrace_graph_ret_addr(
+                                                tsk, &graph, ret_addr, NULL);
                                 print_ip_sym(ret_addr);
                         }
                         if (--cnt < 0)
@@ -196,11 +173,10 @@ void die(const char *str, struct pt_regs *regs, int err)
         pr_emerg("CPU: %i\n", smp_processor_id());
         show_regs(regs);
         pr_emerg("Process %s (pid: %d, stack limit = 0x%p)\n",
-                 tsk->comm, tsk->pid, task_thread_info(tsk) + 1);
+                 tsk->comm, tsk->pid, end_of_stack(tsk));
 
         if (!user_mode(regs) || in_interrupt()) {
-                dump_mem("Stack: ", regs->sp,
-                         THREAD_SIZE + (unsigned long)task_thread_info(tsk));
+                dump_mem("Stack: ", regs->sp, (regs->sp + PAGE_SIZE) & PAGE_MASK);
                 dump_instr(regs);
                 dump_stack();
         }
diff --git a/arch/nds32/kernel/vmlinux.lds.S b/arch/nds32/kernel/vmlinux.lds.S
index 288313b886ef..9e90f30a181d 100644
--- a/arch/nds32/kernel/vmlinux.lds.S
+++ b/arch/nds32/kernel/vmlinux.lds.S
@@ -13,14 +13,26 @@ OUTPUT_ARCH(nds32)
 ENTRY(_stext_lma)
 jiffies = jiffies_64;
 
+#if defined(CONFIG_GCOV_KERNEL)
+#define NDS32_EXIT_KEEP(x)      x
+#else
+#define NDS32_EXIT_KEEP(x)
+#endif
+
 SECTIONS
 {
         _stext_lma = TEXTADDR - LOAD_OFFSET;
         . = TEXTADDR;
         __init_begin = .;
         HEAD_TEXT_SECTION
+        .exit.text : {
+                NDS32_EXIT_KEEP(EXIT_TEXT)
+        }
         INIT_TEXT_SECTION(PAGE_SIZE)
         INIT_DATA_SECTION(16)
+        .exit.data : {
+                NDS32_EXIT_KEEP(EXIT_DATA)
+        }
         PERCPU_SECTION(L1_CACHE_BYTES)
         __init_end = .;
 
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 3c0e8fb2b773..68e14afecac8 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -358,7 +358,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
         unsigned long pp, key;
         unsigned long v, orig_v, gr;
         __be64 *hptep;
-        int index;
+        long int index;
         int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR);
 
         if (kvm_is_radix(vcpu->kvm))
diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index 0af1c0aea1fe..fd6e8c13685f 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -725,10 +725,10 @@ int kvm_unmap_radix(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                               gpa, shift);
                 kvmppc_radix_tlbie_page(kvm, gpa, shift);
                 if ((old & _PAGE_DIRTY) && memslot->dirty_bitmap) {
-                        unsigned long npages = 1;
+                        unsigned long psize = PAGE_SIZE;
                         if (shift)
-                                npages = 1ul << (shift - PAGE_SHIFT);
-                        kvmppc_update_dirty_map(memslot, gfn, npages);
+                                psize = 1ul << shift;
+                        kvmppc_update_dirty_map(memslot, gfn, psize);
                 }
         }
         return 0;                               
diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
index f31a15044c24..a8418e1379eb 100644
--- a/arch/s390/include/asm/mmu.h
+++ b/arch/s390/include/asm/mmu.h
@@ -16,7 +16,13 @@ typedef struct {
         unsigned long asce;
         unsigned long asce_limit;
         unsigned long vdso_base;
-        /* The mmu context allocates 4K page tables. */
+        /*
+         * The following bitfields need a down_write on the mm
+         * semaphore when they are written to. As they are only
+         * written once, they can be read without a lock.
+         *
+         * The mmu context allocates 4K page tables.
+         */
         unsigned int alloc_pgste:1;
         /* The mmu context uses extended page tables. */
         unsigned int has_pgste:1;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 91ad4a9425c0..f69333fd2fa3 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -695,7 +695,9 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                         r = -EINVAL;
                 else {
                         r = 0;
+                        down_write(&kvm->mm->mmap_sem);
                         kvm->mm->context.allow_gmap_hpage_1m = 1;
+                        up_write(&kvm->mm->mmap_sem);
                         /*
                          * We might have to create fake 4k page
                          * tables. To avoid that the hardware works on
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index d68f10441a16..8679bd74d337 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -280,9 +280,11 @@ retry:
                         goto retry;
                 }
         }
-        if (rc)
-                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
         up_read(&current->mm->mmap_sem);
+        if (rc == -EFAULT)
+                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        if (rc < 0)
+                return rc;
         vcpu->run->s.regs.gprs[reg1] &= ~0xff;
         vcpu->run->s.regs.gprs[reg1] |= key;
         return 0;
@@ -324,9 +326,11 @@ retry:
                         goto retry;
                 }
         }
-        if (rc < 0)
-                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
         up_read(&current->mm->mmap_sem);
+        if (rc == -EFAULT)
+                return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        if (rc < 0)
+                return rc;
         kvm_s390_set_psw_cc(vcpu, rc);
         return 0;
 }
@@ -390,12 +394,12 @@ static int handle_sske(struct kvm_vcpu *vcpu)
                                               FAULT_FLAG_WRITE, &unlocked);
                         rc = !rc ? -EAGAIN : rc;
                 }
+                up_read(&current->mm->mmap_sem);
                 if (rc == -EFAULT)
                         return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-
-                up_read(&current->mm->mmap_sem);
-                if (rc >= 0)
-                        start += PAGE_SIZE;
+                if (rc < 0)
+                        return rc;
+                start += PAGE_SIZE;
         }
 
         if (m3 & (SSKE_MC | SSKE_MR)) {
@@ -1002,13 +1006,15 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                                                       FAULT_FLAG_WRITE, &unlocked);
                                 rc = !rc ? -EAGAIN : rc;
                         }
+                        up_read(&current->mm->mmap_sem);
                         if (rc == -EFAULT)
                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
-
-                        up_read(&current->mm->mmap_sem);
-                        if (rc >= 0)
-                                start += PAGE_SIZE;
+                        if (rc == -EAGAIN)
+                                continue;
+                        if (rc < 0)
+                                return rc;
                 }
+                start += PAGE_SIZE;
         }
         if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
                 if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_64BIT) {
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 63844b95c22c..a2b28cd1e3fe 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -173,7 +173,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 return set_validity_icpt(scb_s, 0x0039U);
 
         /* copy only the wrapping keys */
-        if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56))
+        if (read_guest_real(vcpu, crycb_addr + 72,
+                            vsie_page->crycb.dea_wrapping_key_mask, 56))
                 return set_validity_icpt(scb_s, 0x0035U);
 
         scb_s->ecb3 |= ecb3_flags;
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 00ddb0c9e612..8e90488c3d56 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1237,19 +1237,12 @@ enum emulation_result {
 #define EMULTYPE_NO_DECODE          (1 << 0)
 #define EMULTYPE_TRAP_UD            (1 << 1)
 #define EMULTYPE_SKIP               (1 << 2)
-#define EMULTYPE_RETRY              (1 << 3)
-#define EMULTYPE_NO_REEXECUTE       (1 << 4)
-#define EMULTYPE_NO_UD_ON_FAIL      (1 << 5)
-#define EMULTYPE_VMWARE             (1 << 6)
-int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
-                            int emulation_type, void *insn, int insn_len);
-
-static inline int emulate_instruction(struct kvm_vcpu *vcpu,
-                        int emulation_type)
-{
-        return x86_emulate_instruction(vcpu, 0,
-                        emulation_type | EMULTYPE_NO_REEXECUTE, NULL, 0);
-}
+#define EMULTYPE_ALLOW_RETRY        (1 << 3)
+#define EMULTYPE_NO_UD_ON_FAIL      (1 << 4)
+#define EMULTYPE_VMWARE             (1 << 5)
+int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type);
+int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+                                        void *insn, int insn_len);
 
 void kvm_enable_efer_bits(u64);
 bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer);
@@ -1450,7 +1443,6 @@ asmlinkage void kvm_spurious_fault(void);
         ____kvm_handle_fault_on_reboot(insn, "")
 
 #define KVM_ARCH_WANT_MMU_NOTIFIER
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva);
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
@@ -1463,7 +1455,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
 void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu);
 
 int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
-                    unsigned long ipi_bitmap_high, int min,
+                    unsigned long ipi_bitmap_high, u32 min,
                     unsigned long icr, int op_64_bit);
 
 u64 kvm_get_arch_capabilities(void);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 0cefba28c864..17c0472c5b34 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -548,7 +548,7 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
 }
 
 int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
-                    unsigned long ipi_bitmap_high, int min,
+                    unsigned long ipi_bitmap_high, u32 min,
                     unsigned long icr, int op_64_bit)
 {
         int i;
@@ -571,18 +571,31 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
         rcu_read_lock();
         map = rcu_dereference(kvm->arch.apic_map);
 
+        if (min > map->max_apic_id)
+                goto out;
         /* Bits above cluster_size are masked in the caller.  */
-        for_each_set_bit(i, &ipi_bitmap_low, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+        for_each_set_bit(i, &ipi_bitmap_low,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
         min += cluster_size;
-        for_each_set_bit(i, &ipi_bitmap_high, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+
+        if (min > map->max_apic_id)
+                goto out;
+
+        for_each_set_bit(i, &ipi_bitmap_high,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
+out:
         rcu_read_unlock();
         return count;
 }
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index a282321329b5..e24ea7067373 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1853,11 +1853,6 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
         return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        return kvm_handle_hva(kvm, hva, 0, kvm_unmap_rmapp);
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
 {
         return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
@@ -5217,7 +5212,7 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu)
 int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
                        void *insn, int insn_len)
 {
-        int r, emulation_type = EMULTYPE_RETRY;
+        int r, emulation_type = 0;
         enum emulation_result er;
         bool direct = vcpu->arch.mmu.direct_map;
 
@@ -5230,10 +5225,8 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
         r = RET_PF_INVALID;
         if (unlikely(error_code & PFERR_RSVD_MASK)) {
                 r = handle_mmio_page_fault(vcpu, cr2, direct);
-                if (r == RET_PF_EMULATE) {
-                        emulation_type = 0;
+                if (r == RET_PF_EMULATE)
                         goto emulate;
-                }
         }
 
         if (r == RET_PF_INVALID) {
@@ -5260,8 +5253,19 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
                 return 1;
         }
 
-        if (mmio_info_in_cache(vcpu, cr2, direct))
-                emulation_type = 0;
+        /*
+         * vcpu->arch.mmu.page_fault returned RET_PF_EMULATE, but we can still
+         * optimistically try to just unprotect the page and let the processor
+         * re-execute the instruction that caused the page fault.  Do not allow
+         * retrying MMIO emulation, as it's not only pointless but could also
+         * cause us to enter an infinite loop because the processor will keep
+         * faulting on the non-existent MMIO address.  Retrying an instruction
+         * from a nested guest is also pointless and dangerous as we are only
+         * explicitly shadowing L1's page tables, i.e. unprotecting something
+         * for L1 isn't going to magically fix whatever issue cause L2 to fail.
+         */
+        if (!mmio_info_in_cache(vcpu, cr2, direct) && !is_guest_mode(vcpu))
+                emulation_type = EMULTYPE_ALLOW_RETRY;
 emulate:
         /*
          * On AMD platforms, under certain conditions insn_len may be zero on #NPF.
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 6276140044d0..89c4c5aa15f1 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -776,7 +776,7 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
         }
 
         if (!svm->next_rip) {
-                if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
+                if (kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) !=
                                 EMULATE_DONE)
                         printk(KERN_DEBUG "%s: NOP\n", __func__);
                 return;
@@ -2715,7 +2715,7 @@ static int gp_interception(struct vcpu_svm *svm)
 
         WARN_ON_ONCE(!enable_vmware_backdoor);
 
-        er = emulate_instruction(vcpu,
+        er = kvm_emulate_instruction(vcpu,
                 EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
         if (er == EMULATE_USER_EXIT)
                 return 0;
@@ -2819,7 +2819,7 @@ static int io_interception(struct vcpu_svm *svm)
         string = (io_info & SVM_IOIO_STR_MASK) != 0;
         in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
         if (string)
-                return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 
         port = io_info >> 16;
         size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
@@ -3861,7 +3861,7 @@ static int iret_interception(struct vcpu_svm *svm)
 static int invlpg_interception(struct vcpu_svm *svm)
 {
         if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
-                return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
 
         kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
         return kvm_skip_emulated_instruction(&svm->vcpu);
@@ -3869,13 +3869,13 @@ static int invlpg_interception(struct vcpu_svm *svm)
 
 static int emulate_on_interception(struct vcpu_svm *svm)
 {
-        return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
 }
 
 static int rsm_interception(struct vcpu_svm *svm)
 {
-        return x86_emulate_instruction(&svm->vcpu, 0, 0,
-                                       rsm_ins_bytes, 2) == EMULATE_DONE;
+        return kvm_emulate_instruction_from_buffer(&svm->vcpu,
+                                        rsm_ins_bytes, 2) == EMULATE_DONE;
 }
 
 static int rdpmc_interception(struct vcpu_svm *svm)
@@ -4700,7 +4700,7 @@ static int avic_unaccelerated_access_interception(struct vcpu_svm *svm)
                 ret = avic_unaccel_trap_write(svm);
         } else {
                 /* Handling Fault */
-                ret = (emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
+                ret = (kvm_emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
         }
 
         return ret;
@@ -6747,7 +6747,7 @@ e_free:
 static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
 {
         unsigned long vaddr, vaddr_end, next_vaddr;
-        unsigned long dst_vaddr, dst_vaddr_end;
+        unsigned long dst_vaddr;
         struct page **src_p, **dst_p;
         struct kvm_sev_dbg debug;
         unsigned long n;
@@ -6763,7 +6763,6 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
         size = debug.len;
         vaddr_end = vaddr + size;
         dst_vaddr = debug.dst_uaddr;
-        dst_vaddr_end = dst_vaddr + size;
 
         for (; vaddr < vaddr_end; vaddr = next_vaddr) {
                 int len, s_off, d_off;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 1d26f3c4985b..533a327372c8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6983,7 +6983,7 @@ static int handle_rmode_exception(struct kvm_vcpu *vcpu,
          * Cause the #SS fault with 0 error code in VM86 mode.
          */
         if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
-                if (emulate_instruction(vcpu, 0) == EMULATE_DONE) {
+                if (kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE) {
                         if (vcpu->arch.halt_request) {
                                 vcpu->arch.halt_request = 0;
                                 return kvm_vcpu_halt(vcpu);
@@ -7054,7 +7054,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
 
         if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
                 WARN_ON_ONCE(!enable_vmware_backdoor);
-                er = emulate_instruction(vcpu,
+                er = kvm_emulate_instruction(vcpu,
                         EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
                 if (er == EMULATE_USER_EXIT)
                         return 0;
@@ -7157,7 +7157,7 @@ static int handle_io(struct kvm_vcpu *vcpu)
         ++vcpu->stat.io_exits;
 
         if (string)
-                return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+                return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 
         port = exit_qualification >> 16;
         size = (exit_qualification & 7) + 1;
@@ -7231,7 +7231,7 @@ static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
 static int handle_desc(struct kvm_vcpu *vcpu)
 {
         WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_cr(struct kvm_vcpu *vcpu)
@@ -7480,7 +7480,7 @@ static int handle_vmcall(struct kvm_vcpu *vcpu)
 
 static int handle_invd(struct kvm_vcpu *vcpu)
 {
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_invlpg(struct kvm_vcpu *vcpu)
@@ -7547,7 +7547,7 @@ static int handle_apic_access(struct kvm_vcpu *vcpu)
                         return kvm_skip_emulated_instruction(vcpu);
                 }
         }
-        return emulate_instruction(vcpu, 0) == EMULATE_DONE;
+        return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
 }
 
 static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
@@ -7704,8 +7704,8 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
                 if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
                         return kvm_skip_emulated_instruction(vcpu);
                 else
-                        return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP,
-                                                       NULL, 0) == EMULATE_DONE;
+                        return kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) ==
+                                                                EMULATE_DONE;
         }
 
         return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
@@ -7748,7 +7748,7 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
                 if (kvm_test_request(KVM_REQ_EVENT, vcpu))
                         return 1;
 
-                err = emulate_instruction(vcpu, 0);
+                err = kvm_emulate_instruction(vcpu, 0);
 
                 if (err == EMULATE_USER_EXIT) {
                         ++vcpu->stat.mmio_exits;
@@ -12537,8 +12537,11 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
         struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
         bool from_vmentry = !!exit_qual;
         u32 dummy_exit_qual;
+        u32 vmcs01_cpu_exec_ctrl;
         int r = 0;
 
+        vmcs01_cpu_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+
         enter_guest_mode(vcpu);
 
         if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
@@ -12575,6 +12578,25 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
         }
 
         /*
+         * If L1 had a pending IRQ/NMI until it executed
+         * VMLAUNCH/VMRESUME which wasn't delivered because it was
+         * disallowed (e.g. interrupts disabled), L0 needs to
+         * evaluate if this pending event should cause an exit from L2
+         * to L1 or delivered directly to L2 (e.g. In case L1 don't
+         * intercept EXTERNAL_INTERRUPT).
+         *
+         * Usually this would be handled by L0 requesting a
+         * IRQ/NMI window by setting VMCS accordingly. However,
+         * this setting was done on VMCS01 and now VMCS02 is active
+         * instead. Thus, we force L0 to perform pending event
+         * evaluation by requesting a KVM_REQ_EVENT.
+         */
+        if (vmcs01_cpu_exec_ctrl &
+                (CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING)) {
+                kvm_make_request(KVM_REQ_EVENT, vcpu);
+        }
+
+        /*
          * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
          * we are no longer running L1, and VMLAUNCH/VMRESUME has not yet
          * returned as far as L1 is concerned. It will only return (and set
@@ -13988,9 +14010,6 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
             check_vmentry_postreqs(vcpu, vmcs12, &exit_qual))
                 return -EINVAL;
 
-        if (kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING)
-                vmx->nested.nested_run_pending = 1;
-
         vmx->nested.dirty_vmcs12 = true;
         ret = enter_vmx_non_root_mode(vcpu, NULL);
         if (ret)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 506bd2b4b8bb..542f6315444d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4987,7 +4987,7 @@ int handle_ud(struct kvm_vcpu *vcpu)
                 emul_type = 0;
         }
 
-        er = emulate_instruction(vcpu, emul_type);
+        er = kvm_emulate_instruction(vcpu, emul_type);
         if (er == EMULATE_USER_EXIT)
                 return 0;
         if (er != EMULATE_DONE)
@@ -5870,7 +5870,10 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,
         gpa_t gpa = cr2;
         kvm_pfn_t pfn;
 
-        if (emulation_type & EMULTYPE_NO_REEXECUTE)
+        if (!(emulation_type & EMULTYPE_ALLOW_RETRY))
+                return false;
+
+        if (WARN_ON_ONCE(is_guest_mode(vcpu)))
                 return false;
 
         if (!vcpu->arch.mmu.direct_map) {
@@ -5958,7 +5961,10 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
          */
         vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr = 0;
 
-        if (!(emulation_type & EMULTYPE_RETRY))
+        if (!(emulation_type & EMULTYPE_ALLOW_RETRY))
+                return false;
+
+        if (WARN_ON_ONCE(is_guest_mode(vcpu)))
                 return false;
 
         if (x86_page_table_writing_insn(ctxt))
@@ -6276,7 +6282,19 @@ restart:
 
         return r;
 }
-EXPORT_SYMBOL_GPL(x86_emulate_instruction);
+
+int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type)
+{
+        return x86_emulate_instruction(vcpu, 0, emulation_type, NULL, 0);
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_instruction);
+
+int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+                                        void *insn, int insn_len)
+{
+        return x86_emulate_instruction(vcpu, 0, 0, insn, insn_len);
+}
+EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
 
 static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
                             unsigned short port)
@@ -7734,7 +7752,7 @@ static inline int complete_emulated_io(struct kvm_vcpu *vcpu)
 {
         int r;
         vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
-        r = emulate_instruction(vcpu, EMULTYPE_NO_DECODE);
+        r = kvm_emulate_instruction(vcpu, EMULTYPE_NO_DECODE);
         srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
         if (r != EMULATE_DONE)
                 return 0;
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 257f27620bc2..67b9568613f3 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -274,6 +274,8 @@ int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata);
 bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
                                           int page_num);
 bool kvm_vector_hashing_enabled(void);
+int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
+                            int emulation_type, void *insn, int insn_len);
 
 #define KVM_SUPPORTED_XCR0     (XFEATURE_MASK_FP | XFEATURE_MASK_SSE \
                                 | XFEATURE_MASK_YMM | XFEATURE_MASK_BNDREGS \
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 58c6efa9f9a9..9fe5952d117d 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -275,9 +275,9 @@ static void bfqg_and_blkg_get(struct bfq_group *bfqg)
 
 void bfqg_and_blkg_put(struct bfq_group *bfqg)
 {
-        bfqg_put(bfqg);
-
         blkg_put(bfqg_to_blkg(bfqg));
+
+        bfqg_put(bfqg);
 }
 
 /* @stats = 0 */
diff --git a/block/bio.c b/block/bio.c
index b12966e415d3..8c680a776171 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -2015,7 +2015,8 @@ int bio_associate_blkg(struct bio *bio, struct blkcg_gq *blkg)
 {
         if (unlikely(bio->bi_blkg))
                 return -EBUSY;
-        blkg_get(blkg);
+        if (!blkg_try_get(blkg))
+                return -ENODEV;
         bio->bi_blkg = blkg;
         return 0;
 }
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 694595b29b8f..c19f9078da1e 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -310,28 +310,11 @@ struct blkcg_gq *blkg_lookup_create(struct blkcg *blkcg,
         }
 }
 
-static void blkg_pd_offline(struct blkcg_gq *blkg)
-{
-        int i;
-
-        lockdep_assert_held(blkg->q->queue_lock);
-        lockdep_assert_held(&blkg->blkcg->lock);
-
-        for (i = 0; i < BLKCG_MAX_POLS; i++) {
-                struct blkcg_policy *pol = blkcg_policy[i];
-
-                if (blkg->pd[i] && !blkg->pd[i]->offline &&
-                    pol->pd_offline_fn) {
-                        pol->pd_offline_fn(blkg->pd[i]);
-                        blkg->pd[i]->offline = true;
-                }
-        }
-}
-
 static void blkg_destroy(struct blkcg_gq *blkg)
 {
         struct blkcg *blkcg = blkg->blkcg;
         struct blkcg_gq *parent = blkg->parent;
+        int i;
 
         lockdep_assert_held(blkg->q->queue_lock);
         lockdep_assert_held(&blkcg->lock);
@@ -340,6 +323,13 @@ static void blkg_destroy(struct blkcg_gq *blkg)
         WARN_ON_ONCE(list_empty(&blkg->q_node));
         WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node));
 
+        for (i = 0; i < BLKCG_MAX_POLS; i++) {
+                struct blkcg_policy *pol = blkcg_policy[i];
+
+                if (blkg->pd[i] && pol->pd_offline_fn)
+                        pol->pd_offline_fn(blkg->pd[i]);
+        }
+
         if (parent) {
                 blkg_rwstat_add_aux(&parent->stat_bytes, &blkg->stat_bytes);
                 blkg_rwstat_add_aux(&parent->stat_ios, &blkg->stat_ios);
@@ -382,7 +372,6 @@ static void blkg_destroy_all(struct request_queue *q)
                 struct blkcg *blkcg = blkg->blkcg;
 
                 spin_lock(&blkcg->lock);
-                blkg_pd_offline(blkg);
                 blkg_destroy(blkg);
                 spin_unlock(&blkcg->lock);
         }
@@ -1053,59 +1042,64 @@ static struct cftype blkcg_legacy_files[] = {
         { }     /* terminate */
 };
 
+/*
+ * blkcg destruction is a three-stage process.
+ *
+ * 1. Destruction starts.  The blkcg_css_offline() callback is invoked
+ *    which offlines writeback.  Here we tie the next stage of blkg destruction
+ *    to the completion of writeback associated with the blkcg.  This lets us
+ *    avoid punting potentially large amounts of outstanding writeback to root
+ *    while maintaining any ongoing policies.  The next stage is triggered when
+ *    the nr_cgwbs count goes to zero.
+ *
+ * 2. When the nr_cgwbs count goes to zero, blkcg_destroy_blkgs() is called
+ *    and handles the destruction of blkgs.  Here the css reference held by
+ *    the blkg is put back eventually allowing blkcg_css_free() to be called.
+ *    This work may occur in cgwb_release_workfn() on the cgwb_release
+ *    workqueue.  Any submitted ios that fail to get the blkg ref will be
+ *    punted to the root_blkg.
+ *
+ * 3. Once the blkcg ref count goes to zero, blkcg_css_free() is called.
+ *    This finally frees the blkcg.
+ */
+
 /**
  * blkcg_css_offline - cgroup css_offline callback
  * @css: css of interest
  *
- * This function is called when @css is about to go away and responsible
- * for offlining all blkgs pd and killing all wbs associated with @css.
- * blkgs pd offline should be done while holding both q and blkcg locks.
- * As blkcg lock is nested inside q lock, this function performs reverse
- * double lock dancing.
- *
- * This is the blkcg counterpart of ioc_release_fn().
+ * This function is called when @css is about to go away.  Here the cgwbs are
+ * offlined first and only once writeback associated with the blkcg has
+ * finished do we start step 2 (see above).
  */
 static void blkcg_css_offline(struct cgroup_subsys_state *css)
 {
         struct blkcg *blkcg = css_to_blkcg(css);
-        struct blkcg_gq *blkg;
-
-        spin_lock_irq(&blkcg->lock);
-
-        hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
-                struct request_queue *q = blkg->q;
-
-                if (spin_trylock(q->queue_lock)) {
-                        blkg_pd_offline(blkg);
-                        spin_unlock(q->queue_lock);
-                } else {
-                        spin_unlock_irq(&blkcg->lock);
-                        cpu_relax();
-                        spin_lock_irq(&blkcg->lock);
-                }
-        }
-
-        spin_unlock_irq(&blkcg->lock);
 
+        /* this prevents anyone from attaching or migrating to this blkcg */
         wb_blkcg_offline(blkcg);
+
+        /* put the base cgwb reference allowing step 2 to be triggered */
+        blkcg_cgwb_put(blkcg);
 }
 
 /**
- * blkcg_destroy_all_blkgs - destroy all blkgs associated with a blkcg
+ * blkcg_destroy_blkgs - responsible for shooting down blkgs
  * @blkcg: blkcg of interest
  *
- * This function is called when blkcg css is about to free and responsible for
- * destroying all blkgs associated with @blkcg.
- * blkgs should be removed while holding both q and blkcg locks. As blkcg lock
+ * blkgs should be removed while holding both q and blkcg locks.  As blkcg lock
  * is nested inside q lock, this function performs reverse double lock dancing.
+ * Destroying the blkgs releases the reference held on the blkcg's css allowing
+ * blkcg_css_free to eventually be called.
+ *
+ * This is the blkcg counterpart of ioc_release_fn().
  */
-static void blkcg_destroy_all_blkgs(struct blkcg *blkcg)
+void blkcg_destroy_blkgs(struct blkcg *blkcg)
 {
         spin_lock_irq(&blkcg->lock);
+
         while (!hlist_empty(&blkcg->blkg_list)) {
                 struct blkcg_gq *blkg = hlist_entry(blkcg->blkg_list.first,
-                                                    struct blkcg_gq,
-                                                    blkcg_node);
+                                                struct blkcg_gq, blkcg_node);
                 struct request_queue *q = blkg->q;
 
                 if (spin_trylock(q->queue_lock)) {
@@ -1117,6 +1111,7 @@ static void blkcg_destroy_all_blkgs(struct blkcg *blkcg)
                         spin_lock_irq(&blkcg->lock);
                 }
         }
+
         spin_unlock_irq(&blkcg->lock);
 }
 
@@ -1125,8 +1120,6 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
         struct blkcg *blkcg = css_to_blkcg(css);
         int i;
 
-        blkcg_destroy_all_blkgs(blkcg);
-
         mutex_lock(&blkcg_pol_mutex);
 
         list_del(&blkcg->all_blkcgs_node);
@@ -1189,6 +1182,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
         INIT_HLIST_HEAD(&blkcg->blkg_list);
 #ifdef CONFIG_CGROUP_WRITEBACK
         INIT_LIST_HEAD(&blkcg->cgwb_list);
+        refcount_set(&blkcg->cgwb_refcnt, 1);
 #endif
         list_add_tail(&blkcg->all_blkcgs_node, &all_blkcgs);
 
@@ -1480,11 +1474,8 @@ void blkcg_deactivate_policy(struct request_queue *q,
 
         list_for_each_entry(blkg, &q->blkg_list, q_node) {
                 if (blkg->pd[pol->plid]) {
-                        if (!blkg->pd[pol->plid]->offline &&
-                            pol->pd_offline_fn) {
+                        if (pol->pd_offline_fn)
                                 pol->pd_offline_fn(blkg->pd[pol->plid]);
-                                blkg->pd[pol->plid]->offline = true;
-                        }
                         pol->pd_free_fn(blkg->pd[pol->plid]);
                         blkg->pd[pol->plid] = NULL;
                 }
diff --git a/block/blk-core.c b/block/blk-core.c
index dee56c282efb..4dbc93f43b38 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2163,9 +2163,12 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
 {
         const int op = bio_op(bio);
 
-        if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
+        if (part->policy && op_is_write(op)) {
                 char b[BDEVNAME_SIZE];
 
+                if (op_is_flush(bio->bi_opf) && !bio_sectors(bio))
+                        return false;
+
                 WARN_ONCE(1,
                        "generic_make_request: Trying to write "
                         "to read-only block-device %s (partno %d)\n",
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index a3eede00d302..01d0620a4e4a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2129,8 +2129,9 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td)
 static void blk_throtl_assoc_bio(struct throtl_grp *tg, struct bio *bio)
 {
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
-        if (bio->bi_css)
-                bio_associate_blkg(bio, tg_to_blkg(tg));
+        /* fallback to root_blkg if we fail to get a blkg ref */
+        if (bio->bi_css && (bio_associate_blkg(bio, tg_to_blkg(tg)) == -ENODEV))
+                bio_associate_blkg(bio, bio->bi_disk->queue->root_blkg);
         bio_issue_init(&bio->bi_issue, bio_sectors(bio));
 #endif
 }
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 9706613eecf9..bf64cfa30feb 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -879,7 +879,7 @@ static void acpi_lpss_dismiss(struct device *dev)
 #define LPSS_GPIODEF0_DMA_LLP           BIT(13)
 
 static DEFINE_MUTEX(lpss_iosf_mutex);
-static bool lpss_iosf_d3_entered;
+static bool lpss_iosf_d3_entered = true;
 
 static void lpss_iosf_enter_d3_state(void)
 {
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 292088fcc624..d2e29a19890d 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -35,11 +35,11 @@
 #include <linux/delay.h>
 #ifdef CONFIG_X86
 #include <asm/mpspec.h>
+#include <linux/dmi.h>
 #endif
 #include <linux/acpi_iort.h>
 #include <linux/pci.h>
 #include <acpi/apei.h>
-#include <linux/dmi.h>
 #include <linux/suspend.h>
 
 #include "internal.h"
@@ -82,10 +82,6 @@ static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
         },
         {}
 };
-#else
-static const struct dmi_system_id dsdt_dmi_table[] __initconst = {
-        {}
-};
 #endif
 
 /* --------------------------------------------------------------------------
@@ -1033,11 +1029,16 @@ void __init acpi_early_init(void)
 
         acpi_permanent_mmap = true;
 
+#ifdef CONFIG_X86
         /*
          * If the machine falls into the DMI check table,
-         * DSDT will be copied to memory
+         * DSDT will be copied to memory.
+         * Note that calling dmi_check_system() here on other architectures
+         * would not be OK because only x86 initializes dmi early enough.
+         * Thankfully only x86 systems need such quirks for now.
          */
         dmi_check_system(dsdt_dmi_table);
+#endif
 
         status = acpi_reallocate_root_table();
         if (ACPI_FAILURE(status)) {
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 172e32840256..599e01bcdef2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -7394,4 +7394,4 @@ EXPORT_SYMBOL_GPL(ata_cable_unknown);
 EXPORT_SYMBOL_GPL(ata_cable_ignore);
 EXPORT_SYMBOL_GPL(ata_cable_sata);
 EXPORT_SYMBOL_GPL(ata_host_get);
-EXPORT_SYMBOL_GPL(ata_host_put);
\ No newline at end of file
+EXPORT_SYMBOL_GPL(ata_host_put);
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index c8a1cb0b6136..817320c7c4c1 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -417,25 +417,23 @@ static ssize_t show_valid_zones(struct device *dev,
         int nid;
 
         /*
-         * The block contains more than one zone can not be offlined.
-         * This can happen e.g. for ZONE_DMA and ZONE_DMA32
-         */
-        if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages, &valid_start_pfn, &valid_end_pfn))
-                return sprintf(buf, "none\n");
-
-        start_pfn = valid_start_pfn;
-        nr_pages = valid_end_pfn - start_pfn;
-
-        /*
          * Check the existing zone. Make sure that we do that only on the
          * online nodes otherwise the page_zone is not reliable
          */
         if (mem->state == MEM_ONLINE) {
+                /*
+                 * The block contains more than one zone can not be offlined.
+                 * This can happen e.g. for ZONE_DMA and ZONE_DMA32
+                 */
+                if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages,
+                                          &valid_start_pfn, &valid_end_pfn))
+                        return sprintf(buf, "none\n");
+                start_pfn = valid_start_pfn;
                 strcat(buf, page_zone(pfn_to_page(start_pfn))->name);
                 goto out;
         }
 
-        nid = pfn_to_nid(start_pfn);
+        nid = mem->nid;
         default_zone = zone_for_pfn_range(MMOP_ONLINE_KEEP, nid, start_pfn, nr_pages);
         strcat(buf, default_zone->name);
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3863c00372bb..14a51254c3db 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1239,6 +1239,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
         case NBD_SET_SOCK:
                 return nbd_add_socket(nbd, arg, false);
         case NBD_SET_BLKSIZE:
+                if (!arg || !is_power_of_2(arg) || arg < 512 ||
+                    arg > PAGE_SIZE)
+                        return -EINVAL;
                 nbd_size_set(nbd, arg,
                              div_s64(config->bytesize, arg));
                 return 0;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 7915f3b03736..73ed5f3a862d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4207,11 +4207,13 @@ static ssize_t rbd_parent_show(struct device *dev,
 
                 count += sprintf(&buf[count], "%s"
                             "pool_id %llu\npool_name %s\n"
+                            "pool_ns %s\n"
                             "image_id %s\nimage_name %s\n"
                             "snap_id %llu\nsnap_name %s\n"
                             "overlap %llu\n",
                             !count ? "" : "\n", /* first? */
                             spec->pool_id, spec->pool_name,
+                            spec->pool_ns ?: "",
                             spec->image_id, spec->image_name ?: "(unknown)",
                             spec->snap_id, spec->snap_name,
                             rbd_dev->parent_overlap);
@@ -4584,47 +4586,177 @@ static int rbd_dev_v2_features(struct rbd_device *rbd_dev)
                                                 &rbd_dev->header.features);
 }
 
+struct parent_image_info {
+        u64             pool_id;
+        const char      *pool_ns;
+        const char      *image_id;
+        u64             snap_id;
+
+        bool            has_overlap;
+        u64             overlap;
+};
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int decode_parent_image_spec(void **p, void *end,
+                                    struct parent_image_info *pii)
+{
+        u8 struct_v;
+        u32 struct_len;
+        int ret;
+
+        ret = ceph_start_decoding(p, end, 1, "ParentImageSpec",
+                                  &struct_v, &struct_len);
+        if (ret)
+                return ret;
+
+        ceph_decode_64_safe(p, end, pii->pool_id, e_inval);
+        pii->pool_ns = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->pool_ns)) {
+                ret = PTR_ERR(pii->pool_ns);
+                pii->pool_ns = NULL;
+                return ret;
+        }
+        pii->image_id = ceph_extract_encoded_string(p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(p, end, pii->snap_id, e_inval);
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int __get_parent_info(struct rbd_device *rbd_dev,
+                             struct page *req_page,
+                             struct page *reply_page,
+                             struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret == -EOPNOTSUPP ? 1 : ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ret = decode_parent_image_spec(&p, end, pii);
+        if (ret)
+                return ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "parent_overlap_get", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_8_safe(&p, end, pii->has_overlap, e_inval);
+        if (pii->has_overlap)
+                ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+/*
+ * The caller is responsible for @pii.
+ */
+static int __get_parent_info_legacy(struct rbd_device *rbd_dev,
+                                    struct page *req_page,
+                                    struct page *reply_page,
+                                    struct parent_image_info *pii)
+{
+        struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
+        size_t reply_len = PAGE_SIZE;
+        void *p, *end;
+        int ret;
+
+        ret = ceph_osdc_call(osdc, &rbd_dev->header_oid, &rbd_dev->header_oloc,
+                             "rbd", "get_parent", CEPH_OSD_FLAG_READ,
+                             req_page, sizeof(u64), reply_page, &reply_len);
+        if (ret)
+                return ret;
+
+        p = page_address(reply_page);
+        end = p + reply_len;
+        ceph_decode_64_safe(&p, end, pii->pool_id, e_inval);
+        pii->image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
+        if (IS_ERR(pii->image_id)) {
+                ret = PTR_ERR(pii->image_id);
+                pii->image_id = NULL;
+                return ret;
+        }
+        ceph_decode_64_safe(&p, end, pii->snap_id, e_inval);
+        pii->has_overlap = true;
+        ceph_decode_64_safe(&p, end, pii->overlap, e_inval);
+
+        return 0;
+
+e_inval:
+        return -EINVAL;
+}
+
+static int get_parent_info(struct rbd_device *rbd_dev,
+                           struct parent_image_info *pii)
+{
+        struct page *req_page, *reply_page;
+        void *p;
+        int ret;
+
+        req_page = alloc_page(GFP_KERNEL);
+        if (!req_page)
+                return -ENOMEM;
+
+        reply_page = alloc_page(GFP_KERNEL);
+        if (!reply_page) {
+                __free_page(req_page);
+                return -ENOMEM;
+        }
+
+        p = page_address(req_page);
+        ceph_encode_64(&p, rbd_dev->spec->snap_id);
+        ret = __get_parent_info(rbd_dev, req_page, reply_page, pii);
+        if (ret > 0)
+                ret = __get_parent_info_legacy(rbd_dev, req_page, reply_page,
+                                               pii);
+
+        __free_page(req_page);
+        __free_page(reply_page);
+        return ret;
+}
+
 static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
 {
         struct rbd_spec *parent_spec;
-        size_t size;
-        void *reply_buf = NULL;
-        __le64 snapid;
-        void *p;
-        void *end;
-        u64 pool_id;
-        char *image_id;
-        u64 snap_id;
-        u64 overlap;
+        struct parent_image_info pii = { 0 };
         int ret;
 
         parent_spec = rbd_spec_alloc();
         if (!parent_spec)
                 return -ENOMEM;
 
-        size = sizeof (__le64) +                                /* pool_id */
-                sizeof (__le32) + RBD_IMAGE_ID_LEN_MAX +        /* image_id */
-                sizeof (__le64) +                               /* snap_id */
-                sizeof (__le64);                                /* overlap */
-        reply_buf = kmalloc(size, GFP_KERNEL);
-        if (!reply_buf) {
-                ret = -ENOMEM;
+        ret = get_parent_info(rbd_dev, &pii);
+        if (ret)
                 goto out_err;
-        }
 
-        snapid = cpu_to_le64(rbd_dev->spec->snap_id);
-        ret = rbd_obj_method_sync(rbd_dev, &rbd_dev->header_oid,
-                                  &rbd_dev->header_oloc, "get_parent",
-                                  &snapid, sizeof(snapid), reply_buf, size);
-        dout("%s: rbd_obj_method_sync returned %d\n", __func__, ret);
-        if (ret < 0)
-                goto out_err;
+        dout("%s pool_id %llu pool_ns %s image_id %s snap_id %llu has_overlap %d overlap %llu\n",
+             __func__, pii.pool_id, pii.pool_ns, pii.image_id, pii.snap_id,
+             pii.has_overlap, pii.overlap);
 
-        p = reply_buf;
-        end = reply_buf + ret;
-        ret = -ERANGE;
-        ceph_decode_64_safe(&p, end, pool_id, out_err);
-        if (pool_id == CEPH_NOPOOL) {
+        if (pii.pool_id == CEPH_NOPOOL || !pii.has_overlap) {
                 /*
                  * Either the parent never existed, or we have
                  * record of it but the image got flattened so it no
@@ -4633,6 +4765,10 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                  * overlap to 0.  The effect of this is that all new
                  * requests will be treated as if the image had no
                  * parent.
+                 *
+                 * If !pii.has_overlap, the parent image spec is not
+                 * applicable.  It's there to avoid duplication in each
+                 * snapshot record.
                  */
                 if (rbd_dev->parent_overlap) {
                         rbd_dev->parent_overlap = 0;
@@ -4647,51 +4783,36 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
         /* The ceph file layout needs to fit pool id in 32 bits */
 
         ret = -EIO;
-        if (pool_id > (u64)U32_MAX) {
+        if (pii.pool_id > (u64)U32_MAX) {
                 rbd_warn(NULL, "parent pool id too large (%llu > %u)",
-                        (unsigned long long)pool_id, U32_MAX);
+                        (unsigned long long)pii.pool_id, U32_MAX);
                 goto out_err;
         }
 
-        image_id = ceph_extract_encoded_string(&p, end, NULL, GFP_KERNEL);
-        if (IS_ERR(image_id)) {
-                ret = PTR_ERR(image_id);
-                goto out_err;
-        }
-        ceph_decode_64_safe(&p, end, snap_id, out_err);
-        ceph_decode_64_safe(&p, end, overlap, out_err);
-
         /*
          * The parent won't change (except when the clone is
          * flattened, already handled that).  So we only need to
          * record the parent spec we have not already done so.
          */
         if (!rbd_dev->parent_spec) {
-                parent_spec->pool_id = pool_id;
-                parent_spec->image_id = image_id;
-                parent_spec->snap_id = snap_id;
-
-                /* TODO: support cloning across namespaces */
-                if (rbd_dev->spec->pool_ns) {
-                        parent_spec->pool_ns = kstrdup(rbd_dev->spec->pool_ns,
-                                                       GFP_KERNEL);
-                        if (!parent_spec->pool_ns) {
-                                ret = -ENOMEM;
-                                goto out_err;
-                        }
+                parent_spec->pool_id = pii.pool_id;
+                if (pii.pool_ns && *pii.pool_ns) {
+                        parent_spec->pool_ns = pii.pool_ns;
+                        pii.pool_ns = NULL;
                 }
+                parent_spec->image_id = pii.image_id;
+                pii.image_id = NULL;
+                parent_spec->snap_id = pii.snap_id;
 
                 rbd_dev->parent_spec = parent_spec;
                 parent_spec = NULL;     /* rbd_dev now owns this */
-        } else {
-                kfree(image_id);
         }
 
         /*
          * We always update the parent overlap.  If it's zero we issue
          * a warning, as we will proceed as if there was no parent.
          */
-        if (!overlap) {
+        if (!pii.overlap) {
                 if (parent_spec) {
                         /* refresh, careful to warn just once */
                         if (rbd_dev->parent_overlap)
@@ -4702,14 +4823,14 @@ static int rbd_dev_v2_parent_info(struct rbd_device *rbd_dev)
                         rbd_warn(rbd_dev, "clone is standalone (overlap 0)");
                 }
         }
-        rbd_dev->parent_overlap = overlap;
+        rbd_dev->parent_overlap = pii.overlap;
 
 out:
         ret = 0;
 out_err:
-        kfree(reply_buf);
+        kfree(pii.pool_ns);
+        kfree(pii.image_id);
         rbd_spec_put(parent_spec);
-
         return ret;
 }
 
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index ce277ee0a28a..40728491f37b 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -566,5 +566,5 @@ config RANDOM_TRUST_CPU
         that CPU manufacturer (perhaps with the insistence or mandate
         of a Nation State's intelligence or law enforcement agencies)
         has not installed a hidden back door to compromise the CPU's
-        random number generation facilities.
-
+        random number generation facilities. This can also be configured
+        at boot with "random.trust_cpu=on/off".
diff --git a/drivers/char/random.c b/drivers/char/random.c
index bf5f99fc36f1..c75b6cdf0053 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -779,6 +779,13 @@ static struct crng_state **crng_node_pool __read_mostly;
 
 static void invalidate_batched_entropy(void);
 
+static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+static int __init parse_trust_cpu(char *arg)
+{
+        return kstrtobool(arg, &trust_cpu);
+}
+early_param("random.trust_cpu", parse_trust_cpu);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -799,12 +806,10 @@ static void crng_initialize(struct crng_state *crng)
                 }
                 crng->state[i] ^= rv;
         }
-#ifdef CONFIG_RANDOM_TRUST_CPU
-        if (arch_init) {
+        if (trust_cpu && arch_init) {
                 crng_init = 2;
                 pr_notice("random: crng done (trusting CPU's manufacturer)\n");
         }
-#endif
         crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
 }
 
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index 6fd46083e629..bbe4d72ca105 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -392,7 +392,8 @@ static vm_fault_t dev_dax_huge_fault(struct vm_fault *vmf,
 {
         struct file *filp = vmf->vma->vm_file;
         unsigned long fault_size;
-        int rc, id;
+        vm_fault_t rc = VM_FAULT_SIGBUS;
+        int id;
         pfn_t pfn;
         struct dev_dax *dev_dax = filp->private_data;
 
diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
index 721e6c57beae..64342944d917 100644
--- a/drivers/firmware/arm_scmi/perf.c
+++ b/drivers/firmware/arm_scmi/perf.c
@@ -166,7 +166,13 @@ scmi_perf_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
                                         le32_to_cpu(attr->sustained_freq_khz);
                 dom_info->sustained_perf_level =
                                         le32_to_cpu(attr->sustained_perf_level);
-                dom_info->mult_factor = (dom_info->sustained_freq_khz * 1000) /
+                if (!dom_info->sustained_freq_khz ||
+                    !dom_info->sustained_perf_level)
+                        /* CPUFreq converts to kHz, hence default 1000 */
+                        dom_info->mult_factor = 1000;
+                else
+                        dom_info->mult_factor =
+                                        (dom_info->sustained_freq_khz * 1000) /
                                         dom_info->sustained_perf_level;
                 memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
         }
diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
index 3530ccd17e04..da9781a2ef4a 100644
--- a/drivers/gpio/gpio-adp5588.c
+++ b/drivers/gpio/gpio-adp5588.c
@@ -41,6 +41,8 @@ struct adp5588_gpio {
         uint8_t int_en[3];
         uint8_t irq_mask[3];
         uint8_t irq_stat[3];
+        uint8_t int_input_en[3];
+        uint8_t int_lvl_cached[3];
 };
 
 static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d)
         struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
         int i;
 
-        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
+        for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
+                if (dev->int_input_en[i]) {
+                        mutex_lock(&dev->lock);
+                        dev->dir[i] &= ~dev->int_input_en[i];
+                        dev->int_input_en[i] = 0;
+                        adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
+                                           dev->dir[i]);
+                        mutex_unlock(&dev->lock);
+                }
+
+                if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
+                        dev->int_lvl_cached[i] = dev->int_lvl[i];
+                        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
+                                           dev->int_lvl[i]);
+                }
+
                 if (dev->int_en[i] ^ dev->irq_mask[i]) {
                         dev->int_en[i] = dev->irq_mask[i];
                         adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
                                            dev->int_en[i]);
                 }
+        }
 
         mutex_unlock(&dev->irq_lock);
 }
@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type)
         else
                 return -EINVAL;
 
-        adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
-        adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
-                           dev->int_lvl[bank]);
+        dev->int_input_en[bank] |= bit;
 
         return 0;
 }
diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
index 28da700f5f52..044888fd96a1 100644
--- a/drivers/gpio/gpio-dwapb.c
+++ b/drivers/gpio/gpio-dwapb.c
@@ -728,6 +728,7 @@ static int dwapb_gpio_probe(struct platform_device *pdev)
 out_unregister:
         dwapb_gpio_unregister(gpio);
         dwapb_irq_teardown(gpio);
+        clk_disable_unprepare(gpio->clk);
 
         return err;
 }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index c48ed9d89ff5..8b9d7e42c600 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -25,7 +25,6 @@
 
 struct acpi_gpio_event {
         struct list_head node;
-        struct list_head initial_sync_list;
         acpi_handle handle;
         unsigned int pin;
         unsigned int irq;
@@ -49,10 +48,19 @@ struct acpi_gpio_chip {
         struct mutex conn_lock;
         struct gpio_chip *chip;
         struct list_head events;
+        struct list_head deferred_req_irqs_list_entry;
 };
 
-static LIST_HEAD(acpi_gpio_initial_sync_list);
-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
+/*
+ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
+ * (so builtin drivers) we register the ACPI GpioInt event handlers from a
+ * late_initcall_sync handler, so that other builtin drivers can register their
+ * OpRegions before the event handlers can run.  This list contains gpiochips
+ * for which the acpi_gpiochip_request_interrupts() has been deferred.
+ */
+static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
+static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
+static bool acpi_gpio_deferred_req_irqs_done;
 
 static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
 {
@@ -89,21 +97,6 @@ static struct gpio_desc *acpi_get_gpiod(char *path, int pin)
         return gpiochip_get_desc(chip, pin);
 }
 
-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
-{
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        if (!list_empty(&event->initial_sync_list))
-                list_del_init(&event->initial_sync_list);
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
-}
-
 static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
 {
         struct acpi_gpio_event *event = data;
@@ -186,7 +179,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         gpiod_direction_input(desc);
 
-        value = gpiod_get_value(desc);
+        value = gpiod_get_value_cansleep(desc);
 
         ret = gpiochip_lock_as_irq(chip, pin);
         if (ret) {
@@ -229,7 +222,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
         event->irq = irq;
         event->pin = pin;
         event->desc = desc;
-        INIT_LIST_HEAD(&event->initial_sync_list);
 
         ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
                                    "ACPI:Event", event);
@@ -251,10 +243,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
          * may refer to OperationRegions from other (builtin) drivers which
          * may be probed after us.
          */
-        if (handler == acpi_gpio_irq_handler &&
-            (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
-             ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
-                acpi_gpio_add_to_initial_sync_list(event);
+        if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+            ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+                handler(event->irq, event);
 
         return AE_OK;
 
@@ -283,6 +274,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         struct acpi_gpio_chip *acpi_gpio;
         acpi_handle handle;
         acpi_status status;
+        bool defer;
 
         if (!chip->parent || !chip->to_irq)
                 return;
@@ -295,6 +287,16 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        defer = !acpi_gpio_deferred_req_irqs_done;
+        if (defer)
+                list_add(&acpi_gpio->deferred_req_irqs_list_entry,
+                         &acpi_gpio_deferred_req_irqs_list);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
+        if (defer)
+                return;
+
         acpi_walk_resources(handle, "_AEI",
                             acpi_gpiochip_request_interrupt, acpi_gpio);
 }
@@ -325,11 +327,14 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         if (ACPI_FAILURE(status))
                 return;
 
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry))
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
-                acpi_gpio_del_from_initial_sync_list(event);
-
                 if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
                         disable_irq_wake(event->irq);
 
@@ -1052,6 +1057,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
 
         acpi_gpio->chip = chip;
         INIT_LIST_HEAD(&acpi_gpio->events);
+        INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry);
 
         status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio);
         if (ACPI_FAILURE(status)) {
@@ -1198,20 +1204,28 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
         return con_id == NULL;
 }
 
-/* Sync the initial state of handlers after all builtin drivers have probed */
-static int acpi_gpio_initial_sync(void)
+/* Run deferred acpi_gpiochip_request_interrupts() */
+static int acpi_gpio_handle_deferred_request_interrupts(void)
 {
-        struct acpi_gpio_event *event, *ep;
+        struct acpi_gpio_chip *acpi_gpio, *tmp;
+
+        mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+        list_for_each_entry_safe(acpi_gpio, tmp,
+                                 &acpi_gpio_deferred_req_irqs_list,
+                                 deferred_req_irqs_list_entry) {
+                acpi_handle handle;
 
-        mutex_lock(&acpi_gpio_initial_sync_list_lock);
-        list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
-                                 initial_sync_list) {
-                acpi_evaluate_object(event->handle, NULL, NULL, NULL);
-                list_del_init(&event->initial_sync_list);
+                handle = ACPI_HANDLE(acpi_gpio->chip->parent);
+                acpi_walk_resources(handle, "_AEI",
+                                    acpi_gpiochip_request_interrupt, acpi_gpio);
+
+                list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
         }
-        mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+
+        acpi_gpio_deferred_req_irqs_done = true;
+        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
 
         return 0;
 }
 /* We must use _sync so that this runs after the first deferred_probe run */
-late_initcall_sync(acpi_gpio_initial_sync);
+late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index a4f1157d6aa0..d4e7a09598fa 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
         struct of_phandle_args *gpiospec = data;
 
         return chip->gpiodev->dev.of_node == gpiospec->np &&
+                                chip->of_xlate &&
                                 chip->of_xlate(chip, gpiospec, NULL) >= 0;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 6e3f56684f4e..51ed99a37803 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -170,20 +170,22 @@ static struct drm_i915_gem_object *vgpu_create_gem(struct drm_device *dev,
                 unsigned int tiling_mode = 0;
                 unsigned int stride = 0;
 
-                switch (info->drm_format_mod << 10) {
-                case PLANE_CTL_TILED_LINEAR:
+                switch (info->drm_format_mod) {
+                case DRM_FORMAT_MOD_LINEAR:
                         tiling_mode = I915_TILING_NONE;
                         break;
-                case PLANE_CTL_TILED_X:
+                case I915_FORMAT_MOD_X_TILED:
                         tiling_mode = I915_TILING_X;
                         stride = info->stride;
                         break;
-                case PLANE_CTL_TILED_Y:
+                case I915_FORMAT_MOD_Y_TILED:
+                case I915_FORMAT_MOD_Yf_TILED:
                         tiling_mode = I915_TILING_Y;
                         stride = info->stride;
                         break;
                 default:
-                        gvt_dbg_core("not supported tiling mode\n");
+                        gvt_dbg_core("invalid drm_format_mod %llx for tiling\n",
+                                     info->drm_format_mod);
                 }
                 obj->tiling_and_stride = tiling_mode | stride;
         } else {
@@ -222,9 +224,26 @@ static int vgpu_get_plane_info(struct drm_device *dev,
                 info->height = p.height;
                 info->stride = p.stride;
                 info->drm_format = p.drm_format;
-                info->drm_format_mod = p.tiled;
+
+                switch (p.tiled) {
+                case PLANE_CTL_TILED_LINEAR:
+                        info->drm_format_mod = DRM_FORMAT_MOD_LINEAR;
+                        break;
+                case PLANE_CTL_TILED_X:
+                        info->drm_format_mod = I915_FORMAT_MOD_X_TILED;
+                        break;
+                case PLANE_CTL_TILED_Y:
+                        info->drm_format_mod = I915_FORMAT_MOD_Y_TILED;
+                        break;
+                case PLANE_CTL_TILED_YF:
+                        info->drm_format_mod = I915_FORMAT_MOD_Yf_TILED;
+                        break;
+                default:
+                        gvt_vgpu_err("invalid tiling mode: %x\n", p.tiled);
+                }
+
                 info->size = (((p.stride * p.height * p.bpp) / 8) +
-                                (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+                              (PAGE_SIZE - 1)) >> PAGE_SHIFT;
         } else if (plane_id == DRM_PLANE_TYPE_CURSOR) {
                 ret = intel_vgpu_decode_cursor_plane(vgpu, &c);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
index face664be3e8..481896fb712a 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
@@ -220,8 +220,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
         if (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) {
-                plane->tiled = (val & PLANE_CTL_TILED_MASK) >>
-                _PLANE_CTL_TILED_SHIFT;
+                plane->tiled = val & PLANE_CTL_TILED_MASK;
                 fmt = skl_format_to_drm(
                         val & PLANE_CTL_FORMAT_MASK,
                         val & PLANE_CTL_ORDER_RGBX,
@@ -260,7 +259,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
                 return  -EINVAL;
         }
 
-        plane->stride = intel_vgpu_get_stride(vgpu, pipe, (plane->tiled << 10),
+        plane->stride = intel_vgpu_get_stride(vgpu, pipe, plane->tiled,
                 (IS_SKYLAKE(dev_priv)
                 || IS_KABYLAKE(dev_priv)
                 || IS_BROXTON(dev_priv)) ?
diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.h b/drivers/gpu/drm/i915/gvt/fb_decoder.h
index cb055f3c81a2..60c155085029 100644
--- a/drivers/gpu/drm/i915/gvt/fb_decoder.h
+++ b/drivers/gpu/drm/i915/gvt/fb_decoder.h
@@ -101,7 +101,7 @@ struct intel_gvt;
 /* color space conversion and gamma correction are not included */
 struct intel_vgpu_primary_plane_format {
         u8      enabled;        /* plane is enabled */
-        u8      tiled;          /* X-tiled */
+        u32     tiled;          /* tiling mode: linear, X-tiled, Y tiled, etc */
         u8      bpp;            /* bits per pixel */
         u32     hw_format;      /* format field in the PRI_CTL register */
         u32     drm_format;     /* format in DRM definition */
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 7a58ca555197..72afa518edd9 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1296,6 +1296,19 @@ static int power_well_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int gen9_dbuf_ctl_mmio_write(struct intel_vgpu *vgpu,
+                unsigned int offset, void *p_data, unsigned int bytes)
+{
+        write_vreg(vgpu, offset, p_data, bytes);
+
+        if (vgpu_vreg(vgpu, offset) & DBUF_POWER_REQUEST)
+                vgpu_vreg(vgpu, offset) |= DBUF_POWER_STATE;
+        else
+                vgpu_vreg(vgpu, offset) &= ~DBUF_POWER_STATE;
+
+        return 0;
+}
+
 static int fpga_dbg_mmio_write(struct intel_vgpu *vgpu,
         unsigned int offset, void *p_data, unsigned int bytes)
 {
@@ -1525,9 +1538,15 @@ static int bxt_phy_ctl_family_write(struct intel_vgpu *vgpu,
         u32 v = *(u32 *)p_data;
         u32 data = v & COMMON_RESET_DIS ? BXT_PHY_LANE_ENABLED : 0;
 
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
-        vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+        switch (offset) {
+        case _PHY_CTL_FAMILY_EDP:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_A) = data;
+                break;
+        case _PHY_CTL_FAMILY_DDI:
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_B) = data;
+                vgpu_vreg(vgpu, _BXT_PHY_CTL_DDI_C) = data;
+                break;
+        }
 
         vgpu_vreg(vgpu, offset) = v;
 
@@ -2812,6 +2831,8 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(HSW_PWR_WELL_CTL_DRIVER(SKL_DISP_PW_MISC_IO), D_SKL_PLUS, NULL,
                 skl_power_well_ctl_write);
 
+        MMIO_DH(DBUF_CTL, D_SKL_PLUS, NULL, gen9_dbuf_ctl_mmio_write);
+
         MMIO_D(_MMIO(0xa210), D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2987,8 +3008,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
                 NULL, gen9_trtte_write);
         MMIO_DH(_MMIO(0x4dfc), D_SKL_PLUS, NULL, gen9_trtt_chicken_write);
 
-        MMIO_D(_MMIO(0x45008), D_SKL_PLUS);
-
         MMIO_D(_MMIO(0x46430), D_SKL_PLUS);
 
         MMIO_D(_MMIO(0x46520), D_SKL_PLUS);
@@ -3025,7 +3044,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_MMIO(0x44500), D_SKL_PLUS);
         MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
-                NULL, NULL);
+                 NULL, NULL);
+        MMIO_DFH(GEN9_WM_CHICKEN3, D_SKL_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                 NULL, NULL);
 
         MMIO_D(_MMIO(0x4ab8), D_KBL);
         MMIO_D(_MMIO(0x2248), D_KBL | D_SKL);
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 42e1e6bdcc2c..e872f4847fbe 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -562,11 +562,9 @@ void intel_gvt_switch_mmio(struct intel_vgpu *pre,
          * performace for batch mmio read/write, so we need
          * handle forcewake mannually.
          */
-        intel_runtime_pm_get(dev_priv);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
         switch_mmio(pre, next, ring_id);
         intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
-        intel_runtime_pm_put(dev_priv);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 09d7bb72b4ff..c32e7d5e8629 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -47,11 +47,15 @@ static bool vgpu_has_pending_workload(struct intel_vgpu *vgpu)
         return false;
 }
 
+/* We give 2 seconds higher prio for vGPU during start */
+#define GVT_SCHED_VGPU_PRI_TIME  2
+
 struct vgpu_sched_data {
         struct list_head lru_list;
         struct intel_vgpu *vgpu;
         bool active;
-
+        bool pri_sched;
+        ktime_t pri_time;
         ktime_t sched_in_time;
         ktime_t sched_time;
         ktime_t left_ts;
@@ -183,6 +187,14 @@ static struct intel_vgpu *find_busy_vgpu(struct gvt_sched_data *sched_data)
                 if (!vgpu_has_pending_workload(vgpu_data->vgpu))
                         continue;
 
+                if (vgpu_data->pri_sched) {
+                        if (ktime_before(ktime_get(), vgpu_data->pri_time)) {
+                                vgpu = vgpu_data->vgpu;
+                                break;
+                        } else
+                                vgpu_data->pri_sched = false;
+                }
+
                 /* Return the vGPU only if it has time slice left */
                 if (vgpu_data->left_ts > 0) {
                         vgpu = vgpu_data->vgpu;
@@ -202,6 +214,7 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct vgpu_sched_data *vgpu_data;
         struct intel_vgpu *vgpu = NULL;
+
         /* no active vgpu or has already had a target */
         if (list_empty(&sched_data->lru_runq_head) || scheduler->next_vgpu)
                 goto out;
@@ -209,12 +222,13 @@ static void tbs_sched_func(struct gvt_sched_data *sched_data)
         vgpu = find_busy_vgpu(sched_data);
         if (vgpu) {
                 scheduler->next_vgpu = vgpu;
-
-                /* Move the last used vGPU to the tail of lru_list */
                 vgpu_data = vgpu->sched_data;
-                list_del_init(&vgpu_data->lru_list);
-                list_add_tail(&vgpu_data->lru_list,
-                                &sched_data->lru_runq_head);
+                if (!vgpu_data->pri_sched) {
+                        /* Move the last used vGPU to the tail of lru_list */
+                        list_del_init(&vgpu_data->lru_list);
+                        list_add_tail(&vgpu_data->lru_list,
+                                      &sched_data->lru_runq_head);
+                }
         } else {
                 scheduler->next_vgpu = gvt->idle_vgpu;
         }
@@ -328,11 +342,17 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
 {
         struct gvt_sched_data *sched_data = vgpu->gvt->scheduler.sched_data;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        ktime_t now;
 
         if (!list_empty(&vgpu_data->lru_list))
                 return;
 
-        list_add_tail(&vgpu_data->lru_list, &sched_data->lru_runq_head);
+        now = ktime_get();
+        vgpu_data->pri_time = ktime_add(now,
+                                        ktime_set(GVT_SCHED_VGPU_PRI_TIME, 0));
+        vgpu_data->pri_sched = true;
+
+        list_add(&vgpu_data->lru_list, &sched_data->lru_runq_head);
 
         if (!hrtimer_active(&sched_data->timer))
                 hrtimer_start(&sched_data->timer, ktime_add_ns(ktime_get(),
@@ -426,6 +446,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 &vgpu->gvt->scheduler;
         int ring_id;
         struct vgpu_sched_data *vgpu_data = vgpu->sched_data;
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         if (!vgpu_data->active)
                 return;
@@ -444,6 +465,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 scheduler->current_vgpu = NULL;
         }
 
+        intel_runtime_pm_get(dev_priv);
         spin_lock_bh(&scheduler->mmio_context_lock);
         for (ring_id = 0; ring_id < I915_NUM_ENGINES; ring_id++) {
                 if (scheduler->engine_owner[ring_id] == vgpu) {
@@ -452,5 +474,6 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 }
         }
         spin_unlock_bh(&scheduler->mmio_context_lock);
+        intel_runtime_pm_put(dev_priv);
         mutex_unlock(&vgpu->gvt->sched_lock);
 }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 08ec7446282e..9e63cd47b60f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -10422,7 +10422,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_4_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_4(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC0_PICTURE_PARAMETER_SET_4_PB, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_4_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_4_PC)
 #define  DSC_INITIAL_DEC_DELAY(dec_delay)       ((dec_delay) << 16)
 #define  DSC_INITIAL_XMIT_DELAY(xmit_delay)     ((xmit_delay) << 0)
@@ -10437,7 +10437,7 @@ enum skl_power_gate {
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC0_PICTURE_PARAMETER_SET_5_PC)
 #define ICL_DSC1_PICTURE_PARAMETER_SET_5(pipe)  _MMIO_PIPE((pipe) - PIPE_B, \
-                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC, \
+                                                           _ICL_DSC1_PICTURE_PARAMETER_SET_5_PB, \
                                                            _ICL_DSC1_PICTURE_PARAMETER_SET_5_PC)
 #define  DSC_SCALE_DEC_INTINT(scale_dec)        ((scale_dec) << 16)
 #define  DSC_SCALE_INC_INT(scale_inc)           ((scale_inc) << 0)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8761513f3532..c9af34861d9e 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2708,7 +2708,8 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
         if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
                 intel_dp_stop_link_train(intel_dp);
 
-        intel_ddi_enable_pipe_clock(crtc_state);
+        if (!is_mst)
+                intel_ddi_enable_pipe_clock(crtc_state);
 }
 
 static void intel_ddi_pre_enable_hdmi(struct intel_encoder *encoder,
@@ -2810,14 +2811,14 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
         bool is_mst = intel_crtc_has_type(old_crtc_state,
                                           INTEL_OUTPUT_DP_MST);
 
-        intel_ddi_disable_pipe_clock(old_crtc_state);
-
-        /*
-         * Power down sink before disabling the port, otherwise we end
-         * up getting interrupts from the sink on detecting link loss.
-         */
-        if (!is_mst)
+        if (!is_mst) {
+                intel_ddi_disable_pipe_clock(old_crtc_state);
+                /*
+                 * Power down sink before disabling the port, otherwise we end
+                 * up getting interrupts from the sink on detecting link loss.
+                 */
                 intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+        }
 
         intel_disable_ddi_buf(encoder);
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cd0f649b57a5..1193202766a2 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4160,18 +4160,6 @@ intel_dp_needs_link_retrain(struct intel_dp *intel_dp)
         return !drm_dp_channel_eq_ok(link_status, intel_dp->lane_count);
 }
 
-/*
- * If display is now connected check links status,
- * there has been known issues of link loss triggering
- * long pulse.
- *
- * Some sinks (eg. ASUS PB287Q) seem to perform some
- * weird HPD ping pong during modesets. So we can apparently
- * end up with HPD going low during a modeset, and then
- * going back up soon after. And once that happens we must
- * retrain the link to get a picture. That's in case no
- * userspace component reacted to intermittent HPD dip.
- */
 int intel_dp_retrain_link(struct intel_encoder *encoder,
                           struct drm_modeset_acquire_ctx *ctx)
 {
@@ -4661,7 +4649,8 @@ intel_dp_unset_edid(struct intel_dp *intel_dp)
 }
 
 static int
-intel_dp_long_pulse(struct intel_connector *connector)
+intel_dp_long_pulse(struct intel_connector *connector,
+                    struct drm_modeset_acquire_ctx *ctx)
 {
         struct drm_i915_private *dev_priv = to_i915(connector->base.dev);
         struct intel_dp *intel_dp = intel_attached_dp(&connector->base);
@@ -4720,6 +4709,22 @@ intel_dp_long_pulse(struct intel_connector *connector)
                  */
                 status = connector_status_disconnected;
                 goto out;
+        } else {
+                /*
+                 * If display is now connected check links status,
+                 * there has been known issues of link loss triggering
+                 * long pulse.
+                 *
+                 * Some sinks (eg. ASUS PB287Q) seem to perform some
+                 * weird HPD ping pong during modesets. So we can apparently
+                 * end up with HPD going low during a modeset, and then
+                 * going back up soon after. And once that happens we must
+                 * retrain the link to get a picture. That's in case no
+                 * userspace component reacted to intermittent HPD dip.
+                 */
+                struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+                intel_dp_retrain_link(encoder, ctx);
         }
 
         /*
@@ -4781,7 +4786,7 @@ intel_dp_detect(struct drm_connector *connector,
                                 return ret;
                 }
 
-                status = intel_dp_long_pulse(intel_dp->attached_connector);
+                status = intel_dp_long_pulse(intel_dp->attached_connector, ctx);
         }
 
         intel_dp->detect_done = false;
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index 7e3e01607643..4ecd65375603 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -166,6 +166,8 @@ static void intel_mst_post_disable_dp(struct intel_encoder *encoder,
         struct intel_connector *connector =
                 to_intel_connector(old_conn_state->connector);
 
+        intel_ddi_disable_pipe_clock(old_crtc_state);
+
         /* this can fail */
         drm_dp_check_act_status(&intel_dp->mst_mgr);
         /* and this can also fail */
@@ -252,6 +254,8 @@ static void intel_mst_pre_enable_dp(struct intel_encoder *encoder,
         I915_WRITE(DP_TP_STATUS(port), temp);
 
         ret = drm_dp_update_payload_part1(&intel_dp->mst_mgr);
+
+        intel_ddi_enable_pipe_clock(pipe_config);
 }
 
 static void intel_mst_enable_dp(struct intel_encoder *encoder,
diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
index fb4e4a6bb1f6..be5ba4690895 100644
--- a/drivers/hwmon/raspberrypi-hwmon.c
+++ b/drivers/hwmon/raspberrypi-hwmon.c
@@ -164,3 +164,4 @@ module_platform_driver(rpi_hwmon_driver);
 MODULE_AUTHOR("Stefan Wahren <stefan.wahren@i2se.com>");
 MODULE_DESCRIPTION("Raspberry Pi voltage sensor driver");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:raspberrypi-hwmon");
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 04b60a349d7e..c91e145ef5a5 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -140,6 +140,7 @@
 
 #define SBREG_BAR               0x10
 #define SBREG_SMBCTRL           0xc6000c
+#define SBREG_SMBCTRL_DNV       0xcf000c
 
 /* Host status bits for SMBPCISTS */
 #define SMBPCISTS_INTS          BIT(3)
@@ -1399,7 +1400,11 @@ static void i801_add_tco(struct i801_priv *priv)
         spin_unlock(&p2sb_spinlock);
 
         res = &tco_res[ICH_RES_MEM_OFF];
-        res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+        if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
+        else
+                res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
+
         res->end = res->start + 3;
         res->flags = IORESOURCE_MEM;
 
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index 6d975f5221ca..06c4c767af32 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -538,7 +538,6 @@ static const struct i2c_algorithm lpi2c_imx_algo = {
 
 static const struct of_device_id lpi2c_imx_of_match[] = {
         { .compatible = "fsl,imx7ulp-lpi2c" },
-        { .compatible = "fsl,imx8dv-lpi2c" },
         { },
 };
 MODULE_DEVICE_TABLE(of, lpi2c_imx_of_match);
diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
index 9918bdd81619..a403e8579b65 100644
--- a/drivers/i2c/busses/i2c-uniphier-f.c
+++ b/drivers/i2c/busses/i2c-uniphier-f.c
@@ -401,11 +401,8 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
index bb181b088291..454f914ae66d 100644
--- a/drivers/i2c/busses/i2c-uniphier.c
+++ b/drivers/i2c/busses/i2c-uniphier.c
@@ -248,11 +248,8 @@ static int uniphier_i2c_master_xfer(struct i2c_adapter *adap,
                 return ret;
 
         for (msg = msgs; msg < emsg; msg++) {
-                /* If next message is read, skip the stop condition */
-                bool stop = !(msg + 1 < emsg && msg[1].flags & I2C_M_RD);
-                /* but, force it if I2C_M_STOP is set */
-                if (msg->flags & I2C_M_STOP)
-                        stop = true;
+                /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+                bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
 
                 ret = uniphier_i2c_master_xfer_one(adap, msg, stop);
                 if (ret)
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index 9a71e50d21f1..0c51c0ffdda9 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -532,6 +532,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 {
         u8 rx_watermark;
         struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg;
+        unsigned long flags;
 
         /* Clear and enable Rx full interrupt. */
         xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK);
@@ -547,6 +548,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
                 rx_watermark = IIC_RX_FIFO_DEPTH;
         xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1);
 
+        local_irq_save(flags);
         if (!(msg->flags & I2C_M_NOSTART))
                 /* write the address */
                 xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
@@ -556,6 +558,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
 
         xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
                 msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0));
+        local_irq_restore(flags);
+
         if (i2c->nmsgs == 1)
                 /* very last, enable bus not busy as well */
                 xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 316a57530f6d..c2df341ff6fa 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1439,6 +1439,7 @@ static struct irq_chip its_irq_chip = {
  * The consequence of the above is that allocation is cost is low, but
  * freeing is expensive. We assumes that freeing rarely occurs.
  */
+#define ITS_MAX_LPI_NRBITS      16 /* 64K LPIs */
 
 static DEFINE_MUTEX(lpi_range_lock);
 static LIST_HEAD(lpi_range_list);
@@ -1625,7 +1626,8 @@ static int __init its_alloc_lpi_tables(void)
 {
         phys_addr_t paddr;
 
-        lpi_id_bits = GICD_TYPER_ID_BITS(gic_rdists->gicd_typer);
+        lpi_id_bits = min_t(u32, GICD_TYPER_ID_BITS(gic_rdists->gicd_typer),
+                                ITS_MAX_LPI_NRBITS);
         gic_rdists->prop_page = its_allocate_prop_table(GFP_NOWAIT);
         if (!gic_rdists->prop_page) {
                 pr_err("Failed to allocate PROPBASE\n");
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 94329e03001e..0b2af6e74fc3 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1276,18 +1276,18 @@ static int resync_info_update(struct mddev *mddev, sector_t lo, sector_t hi)
 static int resync_finish(struct mddev *mddev)
 {
         struct md_cluster_info *cinfo = mddev->cluster_info;
+        int ret = 0;
 
         clear_bit(MD_RESYNCING_REMOTE, &mddev->recovery);
-        dlm_unlock_sync(cinfo->resync_lockres);
 
         /*
          * If resync thread is interrupted so we can't say resync is finished,
          * another node will launch resync thread to continue.
          */
-        if (test_bit(MD_CLOSING, &mddev->flags))
-                return 0;
-        else
-                return resync_info_update(mddev, 0, 0);
+        if (!test_bit(MD_CLOSING, &mddev->flags))
+                ret = resync_info_update(mddev, 0, 0);
+        dlm_unlock_sync(cinfo->resync_lockres);
+        return ret;
 }
 
 static int area_resyncing(struct mddev *mddev, int direction,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 981898049491..d6f7978b4449 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4529,11 +4529,12 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
                 allow_barrier(conf);
         }
 
+        raise_barrier(conf, 0);
 read_more:
         /* Now schedule reads for blocks from sector_nr to last */
         r10_bio = raid10_alloc_init_r10buf(conf);
         r10_bio->state = 0;
-        raise_barrier(conf, sectors_done != 0);
+        raise_barrier(conf, 1);
         atomic_set(&r10_bio->remaining, 0);
         r10_bio->mddev = mddev;
         r10_bio->sector = sector_nr;
@@ -4629,6 +4630,8 @@ read_more:
         if (sector_nr <= last)
                 goto read_more;
 
+        lower_barrier(conf);
+
         /* Now that we have done the whole section we can
          * update reshape_progress
          */
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index a001808a2b77..bfb811407061 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -46,6 +46,11 @@ extern int ppl_modify_log(struct r5conf *conf, struct md_rdev *rdev, bool add);
 extern void ppl_quiesce(struct r5conf *conf, int quiesce);
 extern int ppl_handle_flush_request(struct r5l_log *log, struct bio *bio);
 
+static inline bool raid5_has_log(struct r5conf *conf)
+{
+        return test_bit(MD_HAS_JOURNAL, &conf->mddev->flags);
+}
+
 static inline bool raid5_has_ppl(struct r5conf *conf)
 {
         return test_bit(MD_HAS_PPL, &conf->mddev->flags);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4ce0d7502fad..e4e98f47865d 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -733,7 +733,7 @@ static bool stripe_can_batch(struct stripe_head *sh)
 {
         struct r5conf *conf = sh->raid_conf;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return false;
         return test_bit(STRIPE_BATCH_READY, &sh->state) &&
                 !test_bit(STRIPE_BITMAP_PENDING, &sh->state) &&
@@ -7737,7 +7737,7 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
         sector_t newsize;
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         sectors &= ~((sector_t)conf->chunk_sectors - 1);
         newsize = raid5_size(mddev, sectors, mddev->raid_disks);
@@ -7788,7 +7788,7 @@ static int check_reshape(struct mddev *mddev)
 {
         struct r5conf *conf = mddev->private;
 
-        if (conf->log || raid5_has_ppl(conf))
+        if (raid5_has_log(conf) || raid5_has_ppl(conf))
                 return -EINVAL;
         if (mddev->delta_disks == 0 &&
             mddev->new_layout == mddev->layout &&
diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
index 31112f622b88..475e5b3790ed 100644
--- a/drivers/memory/ti-aemif.c
+++ b/drivers/memory/ti-aemif.c
@@ -411,7 +411,7 @@ static int aemif_probe(struct platform_device *pdev)
                         if (ret < 0)
                                 goto error;
                 }
-        } else {
+        } else if (pdata) {
                 for (i = 0; i < pdata->num_sub_devices; i++) {
                         pdata->sub_devices[i].dev.parent = dev;
                         ret = platform_device_register(&pdata->sub_devices[i]);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 8bb1e38b1681..cecbb1d1f587 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5913,12 +5913,12 @@ unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp)
         return bp->hw_resc.max_cp_rings;
 }
 
-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max)
+unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp)
 {
-        bp->hw_resc.max_cp_rings = max;
+        return bp->hw_resc.max_cp_rings - bnxt_get_ulp_msix_num(bp);
 }
 
-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
+static unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
 {
         struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
 
@@ -6684,6 +6684,8 @@ static int bnxt_hwrm_if_change(struct bnxt *bp, bool up)
                 hw_resc->resv_rx_rings = 0;
                 hw_resc->resv_hw_ring_grps = 0;
                 hw_resc->resv_vnics = 0;
+                bp->tx_nr_rings = 0;
+                bp->rx_nr_rings = 0;
         }
         return rc;
 }
@@ -8629,7 +8631,8 @@ static void _bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx,
 
         *max_tx = hw_resc->max_tx_rings;
         *max_rx = hw_resc->max_rx_rings;
-        *max_cp = min_t(int, hw_resc->max_irqs, hw_resc->max_cp_rings);
+        *max_cp = min_t(int, bnxt_get_max_func_cp_rings_for_en(bp),
+                        hw_resc->max_irqs);
         *max_cp = min_t(int, *max_cp, hw_resc->max_stat_ctxs);
         max_ring_grps = hw_resc->max_hw_ring_grps;
         if (BNXT_CHIP_TYPE_NITRO_A0(bp) && BNXT_PF(bp)) {
@@ -8769,20 +8772,25 @@ static int bnxt_init_dflt_ring_mode(struct bnxt *bp)
         if (bp->tx_nr_rings)
                 return 0;
 
+        bnxt_ulp_irq_stop(bp);
+        bnxt_clear_int_mode(bp);
         rc = bnxt_set_dflt_rings(bp, true);
         if (rc) {
                 netdev_err(bp->dev, "Not enough rings available.\n");
-                return rc;
+                goto init_dflt_ring_err;
         }
         rc = bnxt_init_int_mode(bp);
         if (rc)
-                return rc;
+                goto init_dflt_ring_err;
+
         bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
         if (bnxt_rfs_supported(bp) && bnxt_rfs_capable(bp)) {
                 bp->flags |= BNXT_FLAG_RFS;
                 bp->dev->features |= NETIF_F_NTUPLE;
         }
-        return 0;
+init_dflt_ring_err:
+        bnxt_ulp_irq_restart(bp, rc);
+        return rc;
 }
 
 int bnxt_restore_pf_fw_resources(struct bnxt *bp)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index fefa011320e0..bde384630a75 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1481,8 +1481,7 @@ int bnxt_hwrm_set_coal(struct bnxt *);
 unsigned int bnxt_get_max_func_stat_ctxs(struct bnxt *bp);
 void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
-void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
-unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
+unsigned int bnxt_get_max_func_cp_rings_for_en(struct bnxt *bp);
 int bnxt_get_avail_msix(struct bnxt *bp, int num);
 int bnxt_reserve_rings(struct bnxt *bp);
 void bnxt_tx_disable(struct bnxt *bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 6d583bcd2a81..fcd085a9853a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -451,7 +451,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_RESOURCE_CFG, -1, -1);
 
-        vf_cp_rings = hw_resc->max_cp_rings - bp->cp_nr_rings;
+        vf_cp_rings = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
         vf_stat_ctx = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 vf_rx_rings = hw_resc->max_rx_rings - bp->rx_nr_rings * 2;
@@ -549,7 +549,8 @@ static int bnxt_hwrm_func_cfg(struct bnxt *bp, int num_vfs)
         max_stat_ctxs = hw_resc->max_stat_ctxs;
 
         /* Remaining rings are distributed equally amongs VF's for now */
-        vf_cp_rings = (hw_resc->max_cp_rings - bp->cp_nr_rings) / num_vfs;
+        vf_cp_rings = (bnxt_get_max_func_cp_rings_for_en(bp) -
+                       bp->cp_nr_rings) / num_vfs;
         vf_stat_ctx = (max_stat_ctxs - bp->num_stat_ctxs) / num_vfs;
         if (bp->flags & BNXT_FLAG_AGG_RINGS)
                 vf_rx_rings = (hw_resc->max_rx_rings - bp->rx_nr_rings * 2) /
@@ -643,7 +644,7 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
          */
         vfs_supported = *num_vfs;
 
-        avail_cp = hw_resc->max_cp_rings - bp->cp_nr_rings;
+        avail_cp = bnxt_get_max_func_cp_rings_for_en(bp) - bp->cp_nr_rings;
         avail_stat = hw_resc->max_stat_ctxs - bp->num_stat_ctxs;
         avail_cp = min_t(int, avail_cp, avail_stat);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index c37b2842f972..beee61292d5e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
                 edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
         }
         bnxt_fill_msix_vecs(bp, ent);
-        bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
         edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
         return avail_msix;
 }
@@ -178,7 +177,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
 {
         struct net_device *dev = edev->net;
         struct bnxt *bp = netdev_priv(dev);
-        int max_cp_rings, msix_requested;
 
         ASSERT_RTNL();
         if (ulp_id != BNXT_ROCE_ULP)
@@ -187,9 +185,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
         if (!(edev->flags & BNXT_EN_FLAG_MSIX_REQUESTED))
                 return 0;
 
-        max_cp_rings = bnxt_get_max_func_cp_rings(bp);
-        msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
-        bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
         edev->ulp_tbl[ulp_id].msix_requested = 0;
         edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
         if (netif_running(dev)) {
@@ -220,21 +215,6 @@ int bnxt_get_ulp_msix_base(struct bnxt *bp)
         return 0;
 }
 
-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id)
-{
-        ASSERT_RTNL();
-        if (bnxt_ulp_registered(bp->edev, ulp_id)) {
-                struct bnxt_en_dev *edev = bp->edev;
-                unsigned int msix_req, max;
-
-                msix_req = edev->ulp_tbl[ulp_id].msix_requested;
-                max = bnxt_get_max_func_cp_rings(bp);
-                bnxt_set_max_func_cp_rings(bp, max - msix_req);
-                max = bnxt_get_max_func_stat_ctxs(bp);
-                bnxt_set_max_func_stat_ctxs(bp, max - 1);
-        }
-}
-
 static int bnxt_send_msg(struct bnxt_en_dev *edev, int ulp_id,
                          struct bnxt_fw_msg *fw_msg)
 {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
index df48ac71729f..d9bea37cd211 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.h
@@ -90,7 +90,6 @@ static inline bool bnxt_ulp_registered(struct bnxt_en_dev *edev, int ulp_id)
 
 int bnxt_get_ulp_msix_num(struct bnxt *bp);
 int bnxt_get_ulp_msix_base(struct bnxt *bp);
-void bnxt_subtract_ulp_resources(struct bnxt *bp, int ulp_id);
 void bnxt_ulp_stop(struct bnxt *bp);
 void bnxt_ulp_start(struct bnxt *bp);
 void bnxt_ulp_sriov_cfg(struct bnxt *bp, int num_vfs);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index b773bc07edf7..14b49612aa86 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -186,6 +186,9 @@ struct bcmgenet_mib_counters {
 #define UMAC_MAC1                       0x010
 #define UMAC_MAX_FRAME_LEN              0x014
 
+#define UMAC_MODE                       0x44
+#define  MODE_LINK_STATUS               (1 << 5)
+
 #define UMAC_EEE_CTRL                   0x064
 #define  EN_LPI_RX_PAUSE                (1 << 0)
 #define  EN_LPI_TX_PFC                  (1 << 1)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 5333274a283c..4241ae928d4a 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -115,8 +115,14 @@ void bcmgenet_mii_setup(struct net_device *dev)
 static int bcmgenet_fixed_phy_link_update(struct net_device *dev,
                                           struct fixed_phy_status *status)
 {
-        if (dev && dev->phydev && status)
-                status->link = dev->phydev->link;
+        struct bcmgenet_priv *priv;
+        u32 reg;
+
+        if (dev && dev->phydev && status) {
+                priv = netdev_priv(dev);
+                reg = bcmgenet_umac_readl(priv, UMAC_MODE);
+                status->link = !!(reg & MODE_LINK_STATUS);
+        }
 
         return 0;
 }
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index c6707ea2d751..16e4ef7d7185 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -649,7 +649,7 @@ static int macb_halt_tx(struct macb *bp)
                 if (!(status & MACB_BIT(TGO)))
                         return 0;
 
-                usleep_range(10, 250);
+                udelay(250);
         } while (time_before(halt_time, timeout));
 
         return -ETIMEDOUT;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index cad52bd331f7..08a750fb60c4 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -486,6 +486,8 @@ struct hnae_ae_ops {
                         u8 *auto_neg, u16 *speed, u8 *duplex);
         void (*toggle_ring_irq)(struct hnae_ring *ring, u32 val);
         void (*adjust_link)(struct hnae_handle *handle, int speed, int duplex);
+        bool (*need_adjust_link)(struct hnae_handle *handle,
+                                 int speed, int duplex);
         int (*set_loopback)(struct hnae_handle *handle,
                             enum hnae_loop loop_mode, int en);
         void (*get_ring_bdnum_limit)(struct hnae_queue *queue,
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index e6aad30e7e69..b52029e26d15 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -155,6 +155,41 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
                 hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
 }
 
+static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+{
+        struct dsaf_device *dsaf_dev;
+        struct hns_ppe_cb *ppe_cb;
+        struct hnae_vf_cb *vf_cb;
+        int ret;
+        int i;
+
+        for (i = 0; i < handle->q_num; i++) {
+                ret = hns_rcb_wait_tx_ring_clean(handle->qs[i]);
+                if (ret)
+                        return ret;
+        }
+
+        ppe_cb = hns_get_ppe_cb(handle);
+        ret = hns_ppe_wait_tx_fifo_clean(ppe_cb);
+        if (ret)
+                return ret;
+
+        dsaf_dev = hns_ae_get_dsaf_dev(handle->dev);
+        if (!dsaf_dev)
+                return -EINVAL;
+        ret = hns_dsaf_wait_pkt_clean(dsaf_dev, handle->dport_id);
+        if (ret)
+                return ret;
+
+        vf_cb = hns_ae_get_vf_cb(handle);
+        ret = hns_mac_wait_fifo_clean(vf_cb->mac_cb);
+        if (ret)
+                return ret;
+
+        mdelay(10);
+        return 0;
+}
+
 static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val)
 {
         int q_num = handle->q_num;
@@ -399,12 +434,41 @@ static int hns_ae_get_mac_info(struct hnae_handle *handle,
         return hns_mac_get_port_info(mac_cb, auto_neg, speed, duplex);
 }
 
+static bool hns_ae_need_adjust_link(struct hnae_handle *handle, int speed,
+                                    int duplex)
+{
+        struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
+
+        return hns_mac_need_adjust_link(mac_cb, speed, duplex);
+}
+
 static void hns_ae_adjust_link(struct hnae_handle *handle, int speed,
                                int duplex)
 {
         struct hns_mac_cb *mac_cb = hns_get_mac_cb(handle);
 
-        hns_mac_adjust_link(mac_cb, speed, duplex);
+        switch (mac_cb->dsaf_dev->dsaf_ver) {
+        case AE_VERSION_1:
+                hns_mac_adjust_link(mac_cb, speed, duplex);
+                break;
+
+        case AE_VERSION_2:
+                /* chip need to clear all pkt inside */
+                hns_mac_disable(mac_cb, MAC_COMM_MODE_RX);
+                if (hns_ae_wait_flow_down(handle)) {
+                        hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
+                        break;
+                }
+
+                hns_mac_adjust_link(mac_cb, speed, duplex);
+                hns_mac_enable(mac_cb, MAC_COMM_MODE_RX);
+                break;
+
+        default:
+                break;
+        }
+
+        return;
 }
 
 static void hns_ae_get_ring_bdnum_limit(struct hnae_queue *queue,
@@ -902,6 +966,7 @@ static struct hnae_ae_ops hns_dsaf_ops = {
         .get_status = hns_ae_get_link_status,
         .get_info = hns_ae_get_mac_info,
         .adjust_link = hns_ae_adjust_link,
+        .need_adjust_link = hns_ae_need_adjust_link,
         .set_loopback = hns_ae_config_loopback,
         .get_ring_bdnum_limit = hns_ae_get_ring_bdnum_limit,
         .get_pauseparam = hns_ae_get_pauseparam,
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 5488c6e89f21..09e4061d1fa6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -257,6 +257,16 @@ static void hns_gmac_get_pausefrm_cfg(void *mac_drv, u32 *rx_pause_en,
         *tx_pause_en = dsaf_get_bit(pause_en, GMAC_PAUSE_EN_TX_FDFC_B);
 }
 
+static bool hns_gmac_need_adjust_link(void *mac_drv, enum mac_speed speed,
+                                      int duplex)
+{
+        struct mac_driver *drv = (struct mac_driver *)mac_drv;
+        struct hns_mac_cb *mac_cb = drv->mac_cb;
+
+        return (mac_cb->speed != speed) ||
+                (mac_cb->half_duplex == duplex);
+}
+
 static int hns_gmac_adjust_link(void *mac_drv, enum mac_speed speed,
                                 u32 full_duplex)
 {
@@ -309,6 +319,30 @@ static void hns_gmac_set_promisc(void *mac_drv, u8 en)
                 hns_gmac_set_uc_match(mac_drv, en);
 }
 
+int hns_gmac_wait_fifo_clean(void *mac_drv)
+{
+        struct mac_driver *drv = (struct mac_driver *)mac_drv;
+        int wait_cnt;
+        u32 val;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(drv, GMAC_FIFO_STATE_REG);
+                /* bit5~bit0 is not send complete pkts */
+                if ((val & 0x3f) == 0)
+                        break;
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(drv->dev,
+                        "hns ge %d fifo was not idle.\n", drv->mac_id);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 static void hns_gmac_init(void *mac_drv)
 {
         u32 port;
@@ -690,6 +724,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
         mac_drv->mac_disable = hns_gmac_disable;
         mac_drv->mac_free = hns_gmac_free;
         mac_drv->adjust_link = hns_gmac_adjust_link;
+        mac_drv->need_adjust_link = hns_gmac_need_adjust_link;
         mac_drv->set_tx_auto_pause_frames = hns_gmac_set_tx_auto_pause_frames;
         mac_drv->config_max_frame_length = hns_gmac_config_max_frame_length;
         mac_drv->mac_pausefrm_cfg = hns_gmac_pause_frm_cfg;
@@ -717,6 +752,7 @@ void *hns_gmac_config(struct hns_mac_cb *mac_cb, struct mac_params *mac_param)
         mac_drv->get_strings = hns_gmac_get_strings;
         mac_drv->update_stats = hns_gmac_update_stats;
         mac_drv->set_promiscuous = hns_gmac_set_promisc;
+        mac_drv->wait_fifo_clean = hns_gmac_wait_fifo_clean;
 
         return (void *)mac_drv;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index 1c2326bd76e2..6ed6f142427e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -114,6 +114,26 @@ int hns_mac_get_port_info(struct hns_mac_cb *mac_cb,
         return 0;
 }
 
+/**
+ *hns_mac_is_adjust_link - check is need change mac speed and duplex register
+ *@mac_cb: mac device
+ *@speed: phy device speed
+ *@duplex:phy device duplex
+ *
+ */
+bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
+{
+        struct mac_driver *mac_ctrl_drv;
+
+        mac_ctrl_drv = (struct mac_driver *)(mac_cb->priv.mac);
+
+        if (mac_ctrl_drv->need_adjust_link)
+                return mac_ctrl_drv->need_adjust_link(mac_ctrl_drv,
+                        (enum mac_speed)speed, duplex);
+        else
+                return true;
+}
+
 void hns_mac_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex)
 {
         int ret;
@@ -430,6 +450,16 @@ int hns_mac_vm_config_bc_en(struct hns_mac_cb *mac_cb, u32 vmid, bool enable)
         return 0;
 }
 
+int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb)
+{
+        struct mac_driver *drv = hns_mac_get_drv(mac_cb);
+
+        if (drv->wait_fifo_clean)
+                return drv->wait_fifo_clean(drv);
+
+        return 0;
+}
+
 void hns_mac_reset(struct hns_mac_cb *mac_cb)
 {
         struct mac_driver *drv = hns_mac_get_drv(mac_cb);
@@ -998,6 +1028,20 @@ static int hns_mac_get_max_port_num(struct dsaf_device *dsaf_dev)
                 return  DSAF_MAX_PORT_NUM;
 }
 
+void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
+{
+        struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
+
+        mac_ctrl_drv->mac_enable(mac_cb->priv.mac, mode);
+}
+
+void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode)
+{
+        struct mac_driver *mac_ctrl_drv = hns_mac_get_drv(mac_cb);
+
+        mac_ctrl_drv->mac_disable(mac_cb->priv.mac, mode);
+}
+
 /**
  * hns_mac_init - init mac
  * @dsaf_dev: dsa fabric device struct pointer
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
index bbc0a98e7ca3..fbc75341bef7 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h
@@ -356,6 +356,9 @@ struct mac_driver {
         /*adjust mac mode of port,include speed and duplex*/
         int (*adjust_link)(void *mac_drv, enum mac_speed speed,
                            u32 full_duplex);
+        /* need adjust link */
+        bool (*need_adjust_link)(void *mac_drv, enum mac_speed speed,
+                                 int duplex);
         /* config autoegotaite mode of port*/
         void (*set_an_mode)(void *mac_drv, u8 enable);
         /* config loopbank mode */
@@ -394,6 +397,7 @@ struct mac_driver {
         void (*get_info)(void *mac_drv, struct mac_info *mac_info);
 
         void (*update_stats)(void *mac_drv);
+        int (*wait_fifo_clean)(void *mac_drv);
 
         enum mac_mode mac_mode;
         u8 mac_id;
@@ -427,6 +431,7 @@ void *hns_xgmac_config(struct hns_mac_cb *mac_cb,
 
 int hns_mac_init(struct dsaf_device *dsaf_dev);
 void mac_adjust_link(struct net_device *net_dev);
+bool hns_mac_need_adjust_link(struct hns_mac_cb *mac_cb, int speed, int duplex);
 void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status);
 int hns_mac_change_vf_addr(struct hns_mac_cb *mac_cb, u32 vmid, char *addr);
 int hns_mac_set_multi(struct hns_mac_cb *mac_cb,
@@ -463,5 +468,8 @@ int hns_mac_add_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
 int hns_mac_rm_uc_addr(struct hns_mac_cb *mac_cb, u8 vf_id,
                        const unsigned char *addr);
 int hns_mac_clr_multicast(struct hns_mac_cb *mac_cb, int vfn);
+void hns_mac_enable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
+void hns_mac_disable(struct hns_mac_cb *mac_cb, enum mac_commom_mode mode);
+int hns_mac_wait_fifo_clean(struct hns_mac_cb *mac_cb);
 
 #endif /* _HNS_DSAF_MAC_H */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index ca50c2553a9c..e557a4ef5996 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -2727,6 +2727,35 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
         soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
 }
 
+int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
+{
+        u32 val, val_tmp;
+        int wait_cnt;
+
+        if (port >= DSAF_SERVICE_NW_NUM)
+                return 0;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(dsaf_dev, DSAF_VOQ_IN_PKT_NUM_0_REG +
+                        (port + DSAF_XGE_NUM) * 0x40);
+                val_tmp = dsaf_read_dev(dsaf_dev, DSAF_VOQ_OUT_PKT_NUM_0_REG +
+                        (port + DSAF_XGE_NUM) * 0x40);
+                if (val == val_tmp)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(dsaf_dev->dev, "hns dsaf clean wait timeout(%u - %u).\n",
+                        val, val_tmp);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  * dsaf_probe - probo dsaf dev
  * @pdev: dasf platform device
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
index 4507e8222683..0e1cd99831a6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.h
@@ -44,6 +44,8 @@ struct hns_mac_cb;
 #define DSAF_ROCE_CREDIT_CHN    8
 #define DSAF_ROCE_CHAN_MODE     3
 
+#define HNS_MAX_WAIT_CNT 10000
+
 enum dsaf_roce_port_mode {
         DSAF_ROCE_6PORT_MODE,
         DSAF_ROCE_4PORT_MODE,
@@ -463,5 +465,6 @@ int hns_dsaf_rm_mac_addr(
 
 int hns_dsaf_clr_mac_mc_port(struct dsaf_device *dsaf_dev,
                              u8 mac_id, u8 port_num);
+int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port);
 
 #endif /* __HNS_DSAF_MAIN_H__ */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index d160d8c9e45b..0942e4916d9d 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -275,6 +275,29 @@ static void hns_ppe_exc_irq_en(struct hns_ppe_cb *ppe_cb, int en)
         dsaf_write_dev(ppe_cb, PPE_INTEN_REG, msk_vlue & vld_msk);
 }
 
+int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb)
+{
+        int wait_cnt;
+        u32 val;
+
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                val = dsaf_read_dev(ppe_cb, PPE_CURR_TX_FIFO0_REG) & 0x3ffU;
+                if (!val)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(ppe_cb->dev, "hns ppe tx fifo clean wait timeout, still has %u pkt.\n",
+                        val);
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  * ppe_init_hw - init ppe
  * @ppe_cb: ppe device
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
index 9d8e643e8aa6..f670e63a5a01 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h
@@ -100,6 +100,7 @@ struct ppe_common_cb {
 
 };
 
+int hns_ppe_wait_tx_fifo_clean(struct hns_ppe_cb *ppe_cb);
 int hns_ppe_init(struct dsaf_device *dsaf_dev);
 
 void hns_ppe_uninit(struct dsaf_device *dsaf_dev);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
index 9d76e2e54f9d..5d64519b9b1d 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
@@ -66,6 +66,29 @@ void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag)
                         "queue(%d) wait fbd(%d) clean fail!!\n", i, fbd_num);
 }
 
+int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs)
+{
+        u32 head, tail;
+        int wait_cnt;
+
+        tail = dsaf_read_dev(&qs->tx_ring, RCB_REG_TAIL);
+        wait_cnt = 0;
+        while (wait_cnt++ < HNS_MAX_WAIT_CNT) {
+                head = dsaf_read_dev(&qs->tx_ring, RCB_REG_HEAD);
+                if (tail == head)
+                        break;
+
+                usleep_range(100, 200);
+        }
+
+        if (wait_cnt >= HNS_MAX_WAIT_CNT) {
+                dev_err(qs->dev->dev, "rcb wait timeout, head not equal to tail.\n");
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
 /**
  *hns_rcb_reset_ring_hw - ring reset
  *@q: ring struct pointer
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
index 602816498c8d..2319b772a271 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h
@@ -136,6 +136,7 @@ void hns_rcbv2_int_clr_hw(struct hnae_queue *q, u32 flag);
 void hns_rcb_init_hw(struct ring_pair_cb *ring);
 void hns_rcb_reset_ring_hw(struct hnae_queue *q);
 void hns_rcb_wait_fbd_clean(struct hnae_queue **qs, int q_num, u32 flag);
+int hns_rcb_wait_tx_ring_clean(struct hnae_queue *qs);
 u32 hns_rcb_get_rx_coalesced_frames(
         struct rcb_common_cb *rcb_common, u32 port_idx);
 u32 hns_rcb_get_tx_coalesced_frames(
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index 886cbbf25761..74d935d82cbc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -464,6 +464,7 @@
 #define RCB_RING_INTMSK_TX_OVERTIME_REG         0x000C4
 #define RCB_RING_INTSTS_TX_OVERTIME_REG         0x000C8
 
+#define GMAC_FIFO_STATE_REG                     0x0000UL
 #define GMAC_DUPLEX_TYPE_REG                    0x0008UL
 #define GMAC_FD_FC_TYPE_REG                     0x000CUL
 #define GMAC_TX_WATER_LINE_REG                  0x0010UL
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 02a0ba20fad5..f56855e63c96 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -1112,11 +1112,26 @@ static void hns_nic_adjust_link(struct net_device *ndev)
         struct hnae_handle *h = priv->ae_handle;
         int state = 1;
 
+        /* If there is no phy, do not need adjust link */
         if (ndev->phydev) {
-                h->dev->ops->adjust_link(h, ndev->phydev->speed,
-                                         ndev->phydev->duplex);
-                state = ndev->phydev->link;
+                /* When phy link down, do nothing */
+                if (ndev->phydev->link == 0)
+                        return;
+
+                if (h->dev->ops->need_adjust_link(h, ndev->phydev->speed,
+                                                  ndev->phydev->duplex)) {
+                        /* because Hi161X chip don't support to change gmac
+                         * speed and duplex with traffic. Delay 200ms to
+                         * make sure there is no more data in chip FIFO.
+                         */
+                        netif_carrier_off(ndev);
+                        msleep(200);
+                        h->dev->ops->adjust_link(h, ndev->phydev->speed,
+                                                 ndev->phydev->duplex);
+                        netif_carrier_on(ndev);
+                }
         }
+
         state = state && h->dev->ops->get_status(h);
 
         if (state != priv->link) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 08f3c4743f74..774beda040a1 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -243,7 +243,9 @@ static int hns_nic_set_link_ksettings(struct net_device *net_dev,
         }
 
         if (h->dev->ops->adjust_link) {
+                netif_carrier_off(net_dev);
                 h->dev->ops->adjust_link(h, (int)speed, cmd->base.duplex);
+                netif_carrier_on(net_dev);
                 return 0;
         }
 
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 354c0982847b..372664686309 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -494,9 +494,6 @@ static u32 __emac_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_s
         case 16384:
                 ret |= EMAC_MR1_RFS_16K;
                 break;
-        case 8192:
-                ret |= EMAC4_MR1_RFS_8K;
-                break;
         case 4096:
                 ret |= EMAC_MR1_RFS_4K;
                 break;
@@ -537,6 +534,9 @@ static u32 __emac4_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_
         case 16384:
                 ret |= EMAC4_MR1_RFS_16K;
                 break;
+        case 8192:
+                ret |= EMAC4_MR1_RFS_8K;
+                break;
         case 4096:
                 ret |= EMAC4_MR1_RFS_4K;
                 break;
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index dafdd4ade705..4f0daf67b18d 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1823,11 +1823,17 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         adapter->map_id = 1;
                         release_rx_pools(adapter);
                         release_tx_pools(adapter);
-                        init_rx_pools(netdev);
-                        init_tx_pools(netdev);
+                        rc = init_rx_pools(netdev);
+                        if (rc)
+                                return rc;
+                        rc = init_tx_pools(netdev);
+                        if (rc)
+                                return rc;
 
                         release_napi(adapter);
-                        init_napi(adapter);
+                        rc = init_napi(adapter);
+                        if (rc)
+                                return rc;
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 32d785b616e1..28500417843e 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -4803,6 +4803,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         dev->min_mtu = ETH_MIN_MTU;
         /* 9704 == 9728 - 20 and rounding to 8 */
         dev->max_mtu = MVPP2_BM_JUMBO_PKT_SIZE;
+        dev->dev.of_node = port_node;
 
         /* Phylink isn't used w/ ACPI as of now */
         if (port_node) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index 86478a6b99c5..c8c315eb5128 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -139,14 +139,15 @@ int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
                       struct mlx5_wq_ctrl *wq_ctrl)
 {
         u32 sq_strides_offset;
+        u32 rq_pg_remainder;
         int err;
 
         mlx5_fill_fbc(MLX5_GET(qpc, qpc, log_rq_stride) + 4,
                       MLX5_GET(qpc, qpc, log_rq_size),
                       &wq->rq.fbc);
 
-        sq_strides_offset =
-                ((wq->rq.fbc.frag_sz_m1 + 1) % PAGE_SIZE) / MLX5_SEND_WQE_BB;
+        rq_pg_remainder   = mlx5_wq_cyc_get_byte_size(&wq->rq) % PAGE_SIZE;
+        sq_strides_offset = rq_pg_remainder / MLX5_SEND_WQE_BB;
 
         mlx5_fill_fbc_offset(ilog2(MLX5_SEND_WQE_BB),
                              MLX5_GET(qpc, qpc, log_sq_size),
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index a8b9fbab5f73..253bdaef1505 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -229,29 +229,16 @@ done:
         spin_unlock_bh(&nn->reconfig_lock);
 }
 
-/**
- * nfp_net_reconfig() - Reconfigure the firmware
- * @nn:      NFP Net device to reconfigure
- * @update:  The value for the update field in the BAR config
- *
- * Write the update word to the BAR and ping the reconfig queue.  The
- * poll until the firmware has acknowledged the update by zeroing the
- * update word.
- *
- * Return: Negative errno on error, 0 on success
- */
-int nfp_net_reconfig(struct nfp_net *nn, u32 update)
+static void nfp_net_reconfig_sync_enter(struct nfp_net *nn)
 {
         bool cancelled_timer = false;
         u32 pre_posted_requests;
-        int ret;
 
         spin_lock_bh(&nn->reconfig_lock);
 
         nn->reconfig_sync_present = true;
 
         if (nn->reconfig_timer_active) {
-                del_timer(&nn->reconfig_timer);
                 nn->reconfig_timer_active = false;
                 cancelled_timer = true;
         }
@@ -260,14 +247,43 @@ int nfp_net_reconfig(struct nfp_net *nn, u32 update)
 
         spin_unlock_bh(&nn->reconfig_lock);
 
-        if (cancelled_timer)
+        if (cancelled_timer) {
+                del_timer_sync(&nn->reconfig_timer);
                 nfp_net_reconfig_wait(nn, nn->reconfig_timer.expires);
+        }
 
         /* Run the posted reconfigs which were issued before we started */
         if (pre_posted_requests) {
                 nfp_net_reconfig_start(nn, pre_posted_requests);
                 nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
         }
+}
+
+static void nfp_net_reconfig_wait_posted(struct nfp_net *nn)
+{
+        nfp_net_reconfig_sync_enter(nn);
+
+        spin_lock_bh(&nn->reconfig_lock);
+        nn->reconfig_sync_present = false;
+        spin_unlock_bh(&nn->reconfig_lock);
+}
+
+/**
+ * nfp_net_reconfig() - Reconfigure the firmware
+ * @nn:      NFP Net device to reconfigure
+ * @update:  The value for the update field in the BAR config
+ *
+ * Write the update word to the BAR and ping the reconfig queue.  The
+ * poll until the firmware has acknowledged the update by zeroing the
+ * update word.
+ *
+ * Return: Negative errno on error, 0 on success
+ */
+int nfp_net_reconfig(struct nfp_net *nn, u32 update)
+{
+        int ret;
+
+        nfp_net_reconfig_sync_enter(nn);
 
         nfp_net_reconfig_start(nn, update);
         ret = nfp_net_reconfig_wait(nn, jiffies + HZ * NFP_NET_POLL_TIMEOUT);
@@ -3633,6 +3649,7 @@ struct nfp_net *nfp_net_alloc(struct pci_dev *pdev, bool needs_netdev,
  */
 void nfp_net_free(struct nfp_net *nn)
 {
+        WARN_ON(timer_pending(&nn->reconfig_timer) || nn->reconfig_posted);
         if (nn->dp.netdev)
                 free_netdev(nn->dp.netdev);
         else
@@ -3920,4 +3937,5 @@ void nfp_net_clean(struct nfp_net *nn)
                 return;
 
         unregister_netdev(nn->dp.netdev);
+        nfp_net_reconfig_wait_posted(nn);
 }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 0efa977c422d..b08d51bf7a20 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -218,6 +218,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8161), 0, 0, RTL_CFG_1 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8167), 0, 0, RTL_CFG_0 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8168), 0, 0, RTL_CFG_1 },
+        { PCI_DEVICE(PCI_VENDOR_ID_NCUBE,       0x8168), 0, 0, RTL_CFG_1 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8169), 0, 0, RTL_CFG_0 },
         { PCI_VENDOR_ID_DLINK,                  0x4300,
                 PCI_VENDOR_ID_DLINK, 0x4b10,             0, 0, RTL_CFG_1 },
@@ -4522,7 +4523,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
         rtl_hw_reset(tp);
 }
 
-static void rtl_set_rx_tx_config_registers(struct rtl8169_private *tp)
+static void rtl_set_tx_config_registers(struct rtl8169_private *tp)
 {
         /* Set DMA burst size and Interframe Gap Time */
         RTL_W32(tp, TxConfig, (TX_DMA_BURST << TxDMAShift) |
@@ -4633,12 +4634,14 @@ static void rtl_hw_start(struct  rtl8169_private *tp)
 
         rtl_set_rx_max_size(tp);
         rtl_set_rx_tx_desc_registers(tp);
-        rtl_set_rx_tx_config_registers(tp);
+        rtl_set_tx_config_registers(tp);
         RTL_W8(tp, Cfg9346, Cfg9346_Lock);
 
         /* Initially a 10 us delay. Turned it into a PCI commit. - FR */
         RTL_R8(tp, IntrMask);
         RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
+        rtl_init_rxcfg(tp);
+
         rtl_set_rx_mode(tp->dev);
         /* no early-rx interrupts */
         RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index ad4433d59237..f27a0dc8c563 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -798,6 +798,41 @@ static struct sh_eth_cpu_data r8a77980_data = {
         .magic          = 1,
         .cexcr          = 1,
 };
+
+/* R7S9210 */
+static struct sh_eth_cpu_data r7s9210_data = {
+        .soft_reset     = sh_eth_soft_reset,
+
+        .set_duplex     = sh_eth_set_duplex,
+        .set_rate       = sh_eth_set_rate_rcar,
+
+        .register_type  = SH_ETH_REG_FAST_SH4,
+
+        .edtrr_trns     = EDTRR_TRNS_ETHER,
+        .ecsr_value     = ECSR_ICD,
+        .ecsipr_value   = ECSIPR_ICDIP,
+        .eesipr_value   = EESIPR_TWBIP | EESIPR_TABTIP | EESIPR_RABTIP |
+                          EESIPR_RFCOFIP | EESIPR_ECIIP | EESIPR_FTCIP |
+                          EESIPR_TDEIP | EESIPR_TFUFIP | EESIPR_FRIP |
+                          EESIPR_RDEIP | EESIPR_RFOFIP | EESIPR_CNDIP |
+                          EESIPR_DLCIP | EESIPR_CDIP | EESIPR_TROIP |
+                          EESIPR_RMAFIP | EESIPR_RRFIP | EESIPR_RTLFIP |
+                          EESIPR_RTSFIP | EESIPR_PREIP | EESIPR_CERFIP,
+
+        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_TRO,
+        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
+                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE,
+
+        .fdr_value      = 0x0000070f,
+
+        .apr            = 1,
+        .mpr            = 1,
+        .tpauser        = 1,
+        .hw_swap        = 1,
+        .rpadir         = 1,
+        .no_ade         = 1,
+        .xdfar_rw       = 1,
+};
 #endif /* CONFIG_OF */
 
 static void sh_eth_set_rate_sh7724(struct net_device *ndev)
@@ -3121,6 +3156,7 @@ static const struct of_device_id sh_eth_match_table[] = {
         { .compatible = "renesas,ether-r8a7794", .data = &rcar_gen2_data },
         { .compatible = "renesas,gether-r8a77980", .data = &r8a77980_data },
         { .compatible = "renesas,ether-r7s72100", .data = &r7s72100_data },
+        { .compatible = "renesas,ether-r7s9210", .data = &r7s9210_data },
         { .compatible = "renesas,rcar-gen1-ether", .data = &rcar_gen1_data },
         { .compatible = "renesas,rcar-gen2-ether", .data = &rcar_gen2_data },
         { }
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index bf4acebb6bcd..324049eebb9b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -110,7 +110,7 @@ config DWMAC_ROCKCHIP
 
 config DWMAC_SOCFPGA
         tristate "SOCFPGA dwmac support"
-        default ARCH_SOCFPGA
+        default (ARCH_SOCFPGA || ARCH_STRATIX10)
         depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
         select MFD_SYSCON
         help
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 76649adf8fb0..c0a855b7ab3b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -112,7 +112,6 @@ struct stmmac_priv {
         u32 tx_count_frames;
         u32 tx_coal_frames;
         u32 tx_coal_timer;
-        bool tx_timer_armed;
 
         int tx_coalesce;
         int hwts_tx_en;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ff1ffb46198a..9f458bb16f2a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3147,16 +3147,13 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
          * element in case of no SG.
          */
         priv->tx_count_frames += nfrags + 1;
-        if (likely(priv->tx_coal_frames > priv->tx_count_frames) &&
-            !priv->tx_timer_armed) {
+        if (likely(priv->tx_coal_frames > priv->tx_count_frames)) {
                 mod_timer(&priv->txtimer,
                           STMMAC_COAL_TIMER(priv->tx_coal_timer));
-                priv->tx_timer_armed = true;
         } else {
                 priv->tx_count_frames = 0;
                 stmmac_set_tx_ic(priv, desc);
                 priv->xstats.tx_set_ic_bit++;
-                priv->tx_timer_armed = false;
         }
 
         skb_tx_timestamp(skb);
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index 0c1adad7415d..396e1cd10667 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -170,10 +170,13 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
         struct device_node *node;
         struct cpsw_phy_sel_priv *priv;
 
-        node = of_get_child_by_name(dev->of_node, "cpsw-phy-sel");
+        node = of_parse_phandle(dev->of_node, "cpsw-phy-sel", 0);
         if (!node) {
-                dev_err(dev, "Phy mode driver DT not found\n");
-                return;
+                node = of_get_child_by_name(dev->of_node, "cpsw-phy-sel");
+                if (!node) {
+                        dev_err(dev, "Phy mode driver DT not found\n");
+                        return;
+                }
         }
 
         dev = bus_find_device(&platform_bus_type, NULL, node, match);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 1121a1ec407c..70921bbe0e28 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2206,6 +2206,16 @@ static int netvsc_probe(struct hv_device *dev,
 
         memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
 
+        /* We must get rtnl lock before scheduling nvdev->subchan_work,
+         * otherwise netvsc_subchan_work() can get rtnl lock first and wait
+         * all subchannels to show up, but that may not happen because
+         * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
+         * -> ... -> device_add() -> ... -> __device_attach() can't get
+         * the device lock, so all the subchannels can't be processed --
+         * finally netvsc_subchan_work() hangs for ever.
+         */
+        rtnl_lock();
+
         if (nvdev->num_chn > 1)
                 schedule_work(&nvdev->subchan_work);
 
@@ -2224,7 +2234,6 @@ static int netvsc_probe(struct hv_device *dev,
         else
                 net->max_mtu = ETH_DATA_LEN;
 
-        rtnl_lock();
         ret = register_netdevice(net);
         if (ret != 0) {
                 pr_err("Unable to register netdev.\n");
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 4637d980310e..52fffb98fde9 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -398,7 +398,6 @@ static umode_t sfp_hwmon_is_visible(const void *data,
         switch (type) {
         case hwmon_temp:
                 switch (attr) {
-                case hwmon_temp_input:
                 case hwmon_temp_min_alarm:
                 case hwmon_temp_max_alarm:
                 case hwmon_temp_lcrit_alarm:
@@ -407,13 +406,16 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_temp_max:
                 case hwmon_temp_lcrit:
                 case hwmon_temp_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_temp_input:
                         return 0444;
                 default:
                         return 0;
                 }
         case hwmon_in:
                 switch (attr) {
-                case hwmon_in_input:
                 case hwmon_in_min_alarm:
                 case hwmon_in_max_alarm:
                 case hwmon_in_lcrit_alarm:
@@ -422,13 +424,16 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_in_max:
                 case hwmon_in_lcrit:
                 case hwmon_in_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_in_input:
                         return 0444;
                 default:
                         return 0;
                 }
         case hwmon_curr:
                 switch (attr) {
-                case hwmon_curr_input:
                 case hwmon_curr_min_alarm:
                 case hwmon_curr_max_alarm:
                 case hwmon_curr_lcrit_alarm:
@@ -437,6 +442,10 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_curr_max:
                 case hwmon_curr_lcrit:
                 case hwmon_curr_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_curr_input:
                         return 0444;
                 default:
                         return 0;
@@ -452,7 +461,6 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                     channel == 1)
                         return 0;
                 switch (attr) {
-                case hwmon_power_input:
                 case hwmon_power_min_alarm:
                 case hwmon_power_max_alarm:
                 case hwmon_power_lcrit_alarm:
@@ -461,6 +469,10 @@ static umode_t sfp_hwmon_is_visible(const void *data,
                 case hwmon_power_max:
                 case hwmon_power_lcrit:
                 case hwmon_power_crit:
+                        if (!(sfp->id.ext.enhopts & SFP_ENHOPTS_ALARMWARN))
+                                return 0;
+                        /* fall through */
+                case hwmon_power_input:
                         return 0444;
                 default:
                         return 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index b4c3a957c102..73969dbeb5c5 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -985,15 +985,12 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd, *copy_rd;
-        int size_of_regd, regd_to_copy, wmms_to_copy;
-        int size_of_wmms = 0;
+        int size_of_regd, regd_to_copy;
         struct ieee80211_reg_rule *rule;
-        struct ieee80211_wmm_rule *wmm_rule, *d_wmm, *s_wmm;
         struct regdb_ptrs *regdb_ptrs;
         enum nl80211_band band;
         int center_freq, prev_center_freq = 0;
-        int valid_rules = 0, n_wmms = 0;
-        int i;
+        int valid_rules = 0;
         bool new_rule;
         int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
                          IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
@@ -1012,11 +1009,7 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 sizeof(struct ieee80211_regdomain) +
                 num_of_ch * sizeof(struct ieee80211_reg_rule);
 
-        if (geo_info & GEO_WMM_ETSI_5GHZ_INFO)
-                size_of_wmms =
-                        num_of_ch * sizeof(struct ieee80211_wmm_rule);
-
-        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!regd)
                 return ERR_PTR(-ENOMEM);
 
@@ -1030,8 +1023,6 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         regd->alpha2[0] = fw_mcc >> 8;
         regd->alpha2[1] = fw_mcc & 0xff;
 
-        wmm_rule = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
-
         for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                 ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
                 band = (ch_idx < NUM_2GHZ_CHANNELS) ?
@@ -1085,26 +1076,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                     band == NL80211_BAND_2GHZ)
                         continue;
 
-                if (!reg_query_regdb_wmm(regd->alpha2, center_freq,
-                                         &regdb_ptrs[n_wmms].token, wmm_rule)) {
-                        /* Add only new rules */
-                        for (i = 0; i < n_wmms; i++) {
-                                if (regdb_ptrs[i].token ==
-                                    regdb_ptrs[n_wmms].token) {
-                                        rule->wmm_rule = regdb_ptrs[i].rule;
-                                        break;
-                                }
-                        }
-                        if (i == n_wmms) {
-                                rule->wmm_rule = wmm_rule;
-                                regdb_ptrs[n_wmms++].rule = wmm_rule;
-                                wmm_rule++;
-                        }
-                }
+                reg_query_regdb_wmm(regd->alpha2, center_freq, rule);
         }
 
         regd->n_reg_rules = valid_rules;
-        regd->n_wmm_rules = n_wmms;
 
         /*
          * Narrow down regdom for unused regulatory rules to prevent hole
@@ -1113,28 +1088,13 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         regd_to_copy = sizeof(struct ieee80211_regdomain) +
                 valid_rules * sizeof(struct ieee80211_reg_rule);
 
-        wmms_to_copy = sizeof(struct ieee80211_wmm_rule) * n_wmms;
-
-        copy_rd = kzalloc(regd_to_copy + wmms_to_copy, GFP_KERNEL);
+        copy_rd = kzalloc(regd_to_copy, GFP_KERNEL);
         if (!copy_rd) {
                 copy_rd = ERR_PTR(-ENOMEM);
                 goto out;
         }
 
         memcpy(copy_rd, regd, regd_to_copy);
-        memcpy((u8 *)copy_rd + regd_to_copy, (u8 *)regd + size_of_regd,
-               wmms_to_copy);
-
-        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)copy_rd + regd_to_copy);
-        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
-
-        for (i = 0; i < regd->n_reg_rules; i++) {
-                if (!regd->reg_rules[i].wmm_rule)
-                        continue;
-
-                copy_rd->reg_rules[i].wmm_rule = d_wmm +
-                        (regd->reg_rules[i].wmm_rule - s_wmm);
-        }
 
 out:
         kfree(regdb_ptrs);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 998dfac0fcff..1068757ec42e 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -34,6 +34,7 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <linux/rhashtable.h>
+#include <linux/nospec.h>
 #include "mac80211_hwsim.h"
 
 #define WARN_QUEUE 100
@@ -2820,9 +2821,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                 IEEE80211_VHT_CAP_SHORT_GI_80 |
                                 IEEE80211_VHT_CAP_SHORT_GI_160 |
                                 IEEE80211_VHT_CAP_TXSTBC |
-                                IEEE80211_VHT_CAP_RXSTBC_1 |
-                                IEEE80211_VHT_CAP_RXSTBC_2 |
-                                IEEE80211_VHT_CAP_RXSTBC_3 |
                                 IEEE80211_VHT_CAP_RXSTBC_4 |
                                 IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
                         sband->vht_cap.vht_mcs.rx_mcs_map =
@@ -3317,6 +3315,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
         if (info->attrs[HWSIM_ATTR_CHANNELS])
                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
 
+        if (param.channels < 1) {
+                GENL_SET_ERR_MSG(info, "must have at least one channel");
+                return -EINVAL;
+        }
+
         if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
                 GENL_SET_ERR_MSG(info, "too many channels specified");
                 return -EINVAL;
@@ -3350,6 +3353,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
                         kfree(hwname);
                         return -EINVAL;
                 }
+
+                idx = array_index_nospec(idx,
+                                         ARRAY_SIZE(hwsim_world_regdom_custom));
                 param.regd = hwsim_world_regdom_custom[idx];
         }
 
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8fc851a9e116..7c097006c54d 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -52,12 +52,12 @@ config SCSI_MQ_DEFAULT
         default y
         depends on SCSI
         ---help---
-          This option enables the new blk-mq based I/O path for SCSI
-          devices by default.  With the option the scsi_mod.use_blk_mq
-          module/boot option defaults to Y, without it to N, but it can
-          still be overridden either way.
+          This option enables the blk-mq based I/O path for SCSI devices by
+          default.  With this option the scsi_mod.use_blk_mq module/boot
+          option defaults to Y, without it to N, but it can still be
+          overridden either way.
 
-          If unsure say N.
+          If unsure say Y.
 
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 29bf1e60f542..39eb415987fc 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1346,7 +1346,7 @@ struct fib {
 struct aac_hba_map_info {
         __le32  rmw_nexus;              /* nexus for native HBA devices */
         u8              devtype;        /* device type */
-        u8              reset_state;    /* 0 - no reset, 1..x - */
+        s8              reset_state;    /* 0 - no reset, 1..x - */
                                         /* after xth TM LUN reset */
         u16             qd_limit;
         u32             scan_counter;
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 23d07e9f87d0..e51923886475 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1602,6 +1602,46 @@ fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16)
 }
 
 /**
+ *      fwcaps32_to_caps16 - convert 32-bit Port Capabilities to 16-bits
+ *      @caps32: a 32-bit Port Capabilities value
+ *
+ *      Returns the equivalent 16-bit Port Capabilities value.  Note that
+ *      not all 32-bit Port Capabilities can be represented in the 16-bit
+ *      Port Capabilities and some fields/values may not make it.
+ */
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32)
+{
+        fw_port_cap16_t caps16 = 0;
+
+        #define CAP32_TO_CAP16(__cap) \
+                do { \
+                        if (caps32 & FW_PORT_CAP32_##__cap) \
+                                caps16 |= FW_PORT_CAP_##__cap; \
+                } while (0)
+
+        CAP32_TO_CAP16(SPEED_100M);
+        CAP32_TO_CAP16(SPEED_1G);
+        CAP32_TO_CAP16(SPEED_10G);
+        CAP32_TO_CAP16(SPEED_25G);
+        CAP32_TO_CAP16(SPEED_40G);
+        CAP32_TO_CAP16(SPEED_100G);
+        CAP32_TO_CAP16(FC_RX);
+        CAP32_TO_CAP16(FC_TX);
+        CAP32_TO_CAP16(802_3_PAUSE);
+        CAP32_TO_CAP16(802_3_ASM_DIR);
+        CAP32_TO_CAP16(ANEG);
+        CAP32_TO_CAP16(FORCE_PAUSE);
+        CAP32_TO_CAP16(MDIAUTO);
+        CAP32_TO_CAP16(MDISTRAIGHT);
+        CAP32_TO_CAP16(FEC_RS);
+        CAP32_TO_CAP16(FEC_BASER_RS);
+
+        #undef CAP32_TO_CAP16
+
+        return caps16;
+}
+
+/**
  *      lstatus_to_fwcap - translate old lstatus to 32-bit Port Capabilities
  *      @lstatus: old FW_PORT_ACTION_GET_PORT_INFO lstatus value
  *
@@ -1759,7 +1799,7 @@ csio_enable_ports(struct csio_hw *hw)
                         val = 1;
 
                         csio_mb_params(hw, mbp, CSIO_MB_DEFAULT_TMO,
-                                       hw->pfn, 0, 1, &param, &val, false,
+                                       hw->pfn, 0, 1, &param, &val, true,
                                        NULL);
 
                         if (csio_mb_issue(hw, mbp)) {
@@ -1769,16 +1809,9 @@ csio_enable_ports(struct csio_hw *hw)
                                 return -EINVAL;
                         }
 
-                        csio_mb_process_read_params_rsp(hw, mbp, &retval, 1,
-                                                        &val);
-                        if (retval != FW_SUCCESS) {
-                                csio_err(hw, "FW_PARAMS_CMD(r) port:%d failed: 0x%x\n",
-                                         portid, retval);
-                                mempool_free(mbp, hw->mb_mempool);
-                                return -EINVAL;
-                        }
-
-                        fw_caps = val;
+                        csio_mb_process_read_params_rsp(hw, mbp, &retval,
+                                                        0, NULL);
+                        fw_caps = retval ? FW_CAPS16 : FW_CAPS32;
                 }
 
                 /* Read PORT information */
@@ -2364,8 +2397,8 @@ bye:
 }
 
 /*
- * Returns -EINVAL if attempts to flash the firmware failed
- * else returns 0,
+ * Returns -EINVAL if attempts to flash the firmware failed,
+ * -ENOMEM if memory allocation failed else returns 0,
  * if flashing was not attempted because the card had the
  * latest firmware ECANCELED is returned
  */
@@ -2393,6 +2426,13 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 return -EINVAL;
         }
 
+        /* allocate memory to read the header of the firmware on the
+         * card
+         */
+        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
+        if (!card_fw)
+                return -ENOMEM;
+
         if (csio_is_t5(pci_dev->device & CSIO_HW_CHIP_MASK))
                 fw_bin_file = FW_FNAME_T5;
         else
@@ -2406,11 +2446,6 @@ csio_hw_flash_fw(struct csio_hw *hw, int *reset)
                 fw_size = fw->size;
         }
 
-        /* allocate memory to read the header of the firmware on the
-         * card
-         */
-        card_fw = kmalloc(sizeof(*card_fw), GFP_KERNEL);
-
         /* upgrade FW logic */
         ret = csio_hw_prep_fw(hw, fw_info, fw_data, fw_size, card_fw,
                          hw->fw_state, reset);
diff --git a/drivers/scsi/csiostor/csio_hw.h b/drivers/scsi/csiostor/csio_hw.h
index 9e73ef771eb7..e351af6e7c81 100644
--- a/drivers/scsi/csiostor/csio_hw.h
+++ b/drivers/scsi/csiostor/csio_hw.h
@@ -639,6 +639,7 @@ int csio_handle_intr_status(struct csio_hw *, unsigned int,
 
 fw_port_cap32_t fwcap_to_fwspeed(fw_port_cap32_t acaps);
 fw_port_cap32_t fwcaps16_to_caps32(fw_port_cap16_t caps16);
+fw_port_cap16_t fwcaps32_to_caps16(fw_port_cap32_t caps32);
 fw_port_cap32_t lstatus_to_fwcap(u32 lstatus);
 
 int csio_hw_start(struct csio_hw *);
diff --git a/drivers/scsi/csiostor/csio_mb.c b/drivers/scsi/csiostor/csio_mb.c
index c026417269c3..6f13673d6aa0 100644
--- a/drivers/scsi/csiostor/csio_mb.c
+++ b/drivers/scsi/csiostor/csio_mb.c
@@ -368,7 +368,7 @@ csio_mb_port(struct csio_hw *hw, struct csio_mb *mbp, uint32_t tmo,
                         FW_CMD_LEN16_V(sizeof(*cmdp) / 16));
 
         if (fw_caps == FW_CAPS16)
-                cmdp->u.l1cfg.rcap = cpu_to_be32(fc);
+                cmdp->u.l1cfg.rcap = cpu_to_be32(fwcaps32_to_caps16(fc));
         else
                 cmdp->u.l1cfg32.rcap32 = cpu_to_be32(fc);
 }
@@ -395,8 +395,8 @@ csio_mb_process_read_port_rsp(struct csio_hw *hw, struct csio_mb *mbp,
                         *pcaps = fwcaps16_to_caps32(ntohs(rsp->u.info.pcap));
                         *acaps = fwcaps16_to_caps32(ntohs(rsp->u.info.acap));
                 } else {
-                        *pcaps = ntohs(rsp->u.info32.pcaps32);
-                        *acaps = ntohs(rsp->u.info32.acaps32);
+                        *pcaps = be32_to_cpu(rsp->u.info32.pcaps32);
+                        *acaps = be32_to_cpu(rsp->u.info32.acaps32);
                 }
         }
 }
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f02dcc875a09..ea4b0bb0c1cd 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -563,35 +563,13 @@ struct Scsi_Host *scsi_host_get(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(scsi_host_get);
 
-struct scsi_host_mq_in_flight {
-        int cnt;
-};
-
-static void scsi_host_check_in_flight(struct request *rq, void *data,
-                bool reserved)
-{
-        struct scsi_host_mq_in_flight *in_flight = data;
-
-        if (blk_mq_request_started(rq))
-                in_flight->cnt++;
-}
-
 /**
  * scsi_host_busy - Return the host busy counter
  * @shost:      Pointer to Scsi_Host to inc.
  **/
 int scsi_host_busy(struct Scsi_Host *shost)
 {
-        struct scsi_host_mq_in_flight in_flight = {
-                .cnt = 0,
-        };
-
-        if (!shost->use_blk_mq)
-                return atomic_read(&shost->host_busy);
-
-        blk_mq_tagset_busy_iter(&shost->tag_set, scsi_host_check_in_flight,
-                        &in_flight);
-        return in_flight.cnt;
+        return atomic_read(&shost->host_busy);
 }
 EXPORT_SYMBOL(scsi_host_busy);
 
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 58bb70b886d7..c120929d4ffe 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -976,7 +976,7 @@ static struct scsi_host_template hpsa_driver_template = {
 #endif
         .sdev_attrs = hpsa_sdev_attrs,
         .shost_attrs = hpsa_shost_attrs,
-        .max_sectors = 1024,
+        .max_sectors = 2048,
         .no_write_same = 1,
 };
 
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index e0d0da5f43d6..43732e8d1347 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -672,7 +672,7 @@ struct lpfc_hba {
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
 #define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
-#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
+#define LS_MDS_LOOPBACK      0x10       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5a25553415f8..057a60abe664 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -5122,16 +5122,16 @@ LPFC_ATTR_R(enable_SmartSAN, 0, 0, 1, "Enable SmartSAN functionality");
 
 /*
 # lpfc_fdmi_on: Controls FDMI support.
-#       0       No FDMI support (default)
-#       1       Traditional FDMI support
+#       0       No FDMI support
+#       1       Traditional FDMI support (default)
 # Traditional FDMI support means the driver will assume FDMI-2 support;
 # however, if that fails, it will fallback to FDMI-1.
 # If lpfc_enable_SmartSAN is set to 1, the driver ignores lpfc_fdmi_on.
 # If lpfc_enable_SmartSAN is set 0, the driver uses the current value of
 # lpfc_fdmi_on.
-# Value range [0,1]. Default value is 0.
+# Value range [0,1]. Default value is 1.
 */
-LPFC_ATTR_R(fdmi_on, 0, 0, 1, "Enable FDMI support");
+LPFC_ATTR_R(fdmi_on, 1, 0, 1, "Enable FDMI support");
 
 /*
 # Specifies the maximum number of ELS cmds we can have outstanding (for
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 0adfb3bce0fd..eb97d2dd3651 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -345,8 +345,7 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost)
         unsigned long flags;
 
         rcu_read_lock();
-        if (!shost->use_blk_mq)
-                atomic_dec(&shost->host_busy);
+        atomic_dec(&shost->host_busy);
         if (unlikely(scsi_host_in_recovery(shost))) {
                 spin_lock_irqsave(shost->host_lock, flags);
                 if (shost->host_failed || shost->host_eh_scheduled)
@@ -445,12 +444,7 @@ static inline bool scsi_target_is_busy(struct scsi_target *starget)
 
 static inline bool scsi_host_is_busy(struct Scsi_Host *shost)
 {
-        /*
-         * blk-mq can handle host queue busy efficiently via host-wide driver
-         * tag allocation
-         */
-
-        if (!shost->use_blk_mq && shost->can_queue > 0 &&
+        if (shost->can_queue > 0 &&
             atomic_read(&shost->host_busy) >= shost->can_queue)
                 return true;
         if (atomic_read(&shost->host_blocked) > 0)
@@ -1606,10 +1600,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
         if (scsi_host_in_recovery(shost))
                 return 0;
 
-        if (!shost->use_blk_mq)
-                busy = atomic_inc_return(&shost->host_busy) - 1;
-        else
-                busy = 0;
+        busy = atomic_inc_return(&shost->host_busy) - 1;
         if (atomic_read(&shost->host_blocked) > 0) {
                 if (busy)
                         goto starved;
@@ -1625,7 +1616,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
                                      "unblocking host at zero depth\n"));
         }
 
-        if (!shost->use_blk_mq && shost->can_queue > 0 && busy >= shost->can_queue)
+        if (shost->can_queue > 0 && busy >= shost->can_queue)
                 goto starved;
         if (shost->host_self_blocked)
                 goto starved;
@@ -1711,9 +1702,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
          * with the locks as normal issue path does.
          */
         atomic_inc(&sdev->device_busy);
-
-        if (!shost->use_blk_mq)
-                atomic_inc(&shost->host_busy);
+        atomic_inc(&shost->host_busy);
         if (starget->can_queue > 0)
                 atomic_inc(&starget->target_busy);
 
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
index 768cce0ccb80..76a262674c8d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_ddp.c
@@ -207,8 +207,8 @@ cxgbit_ddp_reserve(struct cxgbit_sock *csk, struct cxgbi_task_tag_info *ttinfo,
         ret = dma_map_sg(&ppm->pdev->dev, sgl, sgcnt, DMA_FROM_DEVICE);
         sgl->offset = sg_offset;
         if (!ret) {
-                pr_info("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
-                        __func__, 0, xferlen, sgcnt);
+                pr_debug("%s: 0x%x, xfer %u, sgl %u dma mapping err.\n",
+                         __func__, 0, xferlen, sgcnt);
                 goto rel_ppods;
         }
 
@@ -250,8 +250,8 @@ cxgbit_get_r2t_ttt(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
 
         ret = cxgbit_ddp_reserve(csk, ttinfo, cmd->se_cmd.data_length);
         if (ret < 0) {
-                pr_info("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
-                        csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
+                pr_debug("csk 0x%p, cmd 0x%p, xfer len %u, sgcnt %u no ddp.\n",
+                         csk, cmd, cmd->se_cmd.data_length, ttinfo->nents);
 
                 ttinfo->sgl = NULL;
                 ttinfo->nents = 0;
diff --git a/fs/afs/proc.c b/fs/afs/proc.c
index 0c3285c8db95..476dcbb79713 100644
--- a/fs/afs/proc.c
+++ b/fs/afs/proc.c
@@ -98,13 +98,13 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size)
                 goto inval;
 
         args = strchr(name, ' ');
-        if (!args)
-                goto inval;
-        do {
-                *args++ = 0;
-        } while(*args == ' ');
-        if (!*args)
-                goto inval;
+        if (args) {
+                do {
+                        *args++ = 0;
+                } while(*args == ' ');
+                if (!*args)
+                        goto inval;
+        }
 
         /* determine command to perform */
         _debug("cmd=%s name=%s args=%s", buf, name, args);
@@ -120,7 +120,6 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size)
 
                 if (test_and_set_bit(AFS_CELL_FL_NO_GC, &cell->flags))
                         afs_put_cell(net, cell);
-                printk("kAFS: Added new cell '%s'\n", name);
         } else {
                 goto inval;
         }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 53af9f5253f4..2cddfe7806a4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1280,6 +1280,7 @@ struct btrfs_root {
         int send_in_progress;
         struct btrfs_subvolume_writers *subv_writers;
         atomic_t will_be_snapshotted;
+        atomic_t snapshot_force_cow;
 
         /* For qgroup metadata reserved space */
         spinlock_t qgroup_meta_rsv_lock;
@@ -3390,9 +3391,9 @@ do {									\
 #define btrfs_debug(fs_info, fmt, args...) \
         btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_in_rcu(fs_info, fmt, args...) \
-        btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
+        btrfs_no_printk_in_rcu(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_rl_in_rcu(fs_info, fmt, args...) \
-        btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
+        btrfs_no_printk_in_rcu(fs_info, KERN_DEBUG fmt, ##args)
 #define btrfs_debug_rl(fs_info, fmt, args...) \
         btrfs_no_printk(fs_info, KERN_DEBUG fmt, ##args)
 #endif
@@ -3404,6 +3405,13 @@ do {							\
         rcu_read_unlock();                              \
 } while (0)
 
+#define btrfs_no_printk_in_rcu(fs_info, fmt, args...)   \
+do {                                                    \
+        rcu_read_lock();                                \
+        btrfs_no_printk(fs_info, fmt, ##args);          \
+        rcu_read_unlock();                              \
+} while (0)
+
 #define btrfs_printk_ratelimited(fs_info, fmt, args...)         \
 do {                                                            \
         static DEFINE_RATELIMIT_STATE(_rs,                      \
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 5124c15705ce..05dc3c17cb62 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1187,6 +1187,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
         atomic_set(&root->log_batch, 0);
         refcount_set(&root->refs, 1);
         atomic_set(&root->will_be_snapshotted, 0);
+        atomic_set(&root->snapshot_force_cow, 0);
         root->log_transid = 0;
         root->log_transid_committed = -1;
         root->last_log_commit = 0;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index de6f75f5547b..2d9074295d7f 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5800,7 +5800,7 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans)
  * root: the root of the parent directory
  * rsv: block reservation
  * items: the number of items that we need do reservation
- * qgroup_reserved: used to return the reserved size in qgroup
+ * use_global_rsv: allow fallback to the global block reservation
  *
  * This function is used to reserve the space for snapshot/subvolume
  * creation and deletion. Those operations are different with the
@@ -5810,10 +5810,10 @@ void btrfs_trans_release_chunk_metadata(struct btrfs_trans_handle *trans)
  * the space reservation mechanism in start_transaction().
  */
 int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
-                                     struct btrfs_block_rsv *rsv,
-                                     int items,
+                                     struct btrfs_block_rsv *rsv, int items,
                                      bool use_global_rsv)
 {
+        u64 qgroup_num_bytes = 0;
         u64 num_bytes;
         int ret;
         struct btrfs_fs_info *fs_info = root->fs_info;
@@ -5821,12 +5821,11 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
 
         if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) {
                 /* One for parent inode, two for dir entries */
-                num_bytes = 3 * fs_info->nodesize;
-                ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true);
+                qgroup_num_bytes = 3 * fs_info->nodesize;
+                ret = btrfs_qgroup_reserve_meta_prealloc(root,
+                                qgroup_num_bytes, true);
                 if (ret)
                         return ret;
-        } else {
-                num_bytes = 0;
         }
 
         num_bytes = btrfs_calc_trans_metadata_size(fs_info, items);
@@ -5838,8 +5837,8 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
         if (ret == -ENOSPC && use_global_rsv)
                 ret = btrfs_block_rsv_migrate(global_rsv, rsv, num_bytes, 1);
 
-        if (ret && num_bytes)
-                btrfs_qgroup_free_meta_prealloc(root, num_bytes);
+        if (ret && qgroup_num_bytes)
+                btrfs_qgroup_free_meta_prealloc(root, qgroup_num_bytes);
 
         return ret;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9357a19d2bff..3ea5339603cf 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1271,7 +1271,7 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         u64 disk_num_bytes;
         u64 ram_bytes;
         int extent_type;
-        int ret, err;
+        int ret;
         int type;
         int nocow;
         int check_prev = 1;
@@ -1403,11 +1403,8 @@ next_slot:
                          * if there are pending snapshots for this root,
                          * we fall into common COW way.
                          */
-                        if (!nolock) {
-                                err = btrfs_start_write_no_snapshotting(root);
-                                if (!err)
-                                        goto out_check;
-                        }
+                        if (!nolock && atomic_read(&root->snapshot_force_cow))
+                                goto out_check;
                         /*
                          * force cow if csum exists in the range.
                          * this ensure that csum for a given extent are
@@ -1416,9 +1413,6 @@ next_slot:
                         ret = csum_exist_in_range(fs_info, disk_bytenr,
                                                   num_bytes);
                         if (ret) {
-                                if (!nolock)
-                                        btrfs_end_write_no_snapshotting(root);
-
                                 /*
                                  * ret could be -EIO if the above fails to read
                                  * metadata.
@@ -1431,11 +1425,8 @@ next_slot:
                                 WARN_ON_ONCE(nolock);
                                 goto out_check;
                         }
-                        if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) {
-                                if (!nolock)
-                                        btrfs_end_write_no_snapshotting(root);
+                        if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr))
                                 goto out_check;
-                        }
                         nocow = 1;
                 } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
                         extent_end = found_key.offset +
@@ -1448,8 +1439,6 @@ next_slot:
 out_check:
                 if (extent_end <= start) {
                         path->slots[0]++;
-                        if (!nolock && nocow)
-                                btrfs_end_write_no_snapshotting(root);
                         if (nocow)
                                 btrfs_dec_nocow_writers(fs_info, disk_bytenr);
                         goto next_slot;
@@ -1471,8 +1460,6 @@ out_check:
                                              end, page_started, nr_written, 1,
                                              NULL);
                         if (ret) {
-                                if (!nolock && nocow)
-                                        btrfs_end_write_no_snapshotting(root);
                                 if (nocow)
                                         btrfs_dec_nocow_writers(fs_info,
                                                                 disk_bytenr);
@@ -1492,8 +1479,6 @@ out_check:
                                           ram_bytes, BTRFS_COMPRESS_NONE,
                                           BTRFS_ORDERED_PREALLOC);
                         if (IS_ERR(em)) {
-                                if (!nolock && nocow)
-                                        btrfs_end_write_no_snapshotting(root);
                                 if (nocow)
                                         btrfs_dec_nocow_writers(fs_info,
                                                                 disk_bytenr);
@@ -1532,8 +1517,6 @@ out_check:
                                              EXTENT_CLEAR_DATA_RESV,
                                              PAGE_UNLOCK | PAGE_SET_PRIVATE2);
 
-                if (!nolock && nocow)
-                        btrfs_end_write_no_snapshotting(root);
                 cur_offset = extent_end;
 
                 /*
@@ -6639,6 +6622,8 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 drop_inode = 1;
         } else {
                 struct dentry *parent = dentry->d_parent;
+                int ret;
+
                 err = btrfs_update_inode(trans, root, inode);
                 if (err)
                         goto fail;
@@ -6652,7 +6637,12 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                                 goto fail;
                 }
                 d_instantiate(dentry, inode);
-                btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent);
+                ret = btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent,
+                                         true, NULL);
+                if (ret == BTRFS_NEED_TRANS_COMMIT) {
+                        err = btrfs_commit_transaction(trans);
+                        trans = NULL;
+                }
         }
 
 fail:
@@ -9388,14 +9378,21 @@ static int btrfs_rename_exchange(struct inode *old_dir,
         u64 new_idx = 0;
         u64 root_objectid;
         int ret;
-        int ret2;
         bool root_log_pinned = false;
         bool dest_log_pinned = false;
+        struct btrfs_log_ctx ctx_root;
+        struct btrfs_log_ctx ctx_dest;
+        bool sync_log_root = false;
+        bool sync_log_dest = false;
+        bool commit_transaction = false;
 
         /* we only allow rename subvolume link between subvolumes */
         if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest)
                 return -EXDEV;
 
+        btrfs_init_log_ctx(&ctx_root, old_inode);
+        btrfs_init_log_ctx(&ctx_dest, new_inode);
+
         /* close the race window with snapshot create/destroy ioctl */
         if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
                 down_read(&fs_info->subvol_sem);
@@ -9542,15 +9539,29 @@ static int btrfs_rename_exchange(struct inode *old_dir,
 
         if (root_log_pinned) {
                 parent = new_dentry->d_parent;
-                btrfs_log_new_name(trans, BTRFS_I(old_inode), BTRFS_I(old_dir),
-                                parent);
+                ret = btrfs_log_new_name(trans, BTRFS_I(old_inode),
+                                         BTRFS_I(old_dir), parent,
+                                         false, &ctx_root);
+                if (ret == BTRFS_NEED_LOG_SYNC)
+                        sync_log_root = true;
+                else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                        commit_transaction = true;
+                ret = 0;
                 btrfs_end_log_trans(root);
                 root_log_pinned = false;
         }
         if (dest_log_pinned) {
-                parent = old_dentry->d_parent;
-                btrfs_log_new_name(trans, BTRFS_I(new_inode), BTRFS_I(new_dir),
-                                parent);
+                if (!commit_transaction) {
+                        parent = old_dentry->d_parent;
+                        ret = btrfs_log_new_name(trans, BTRFS_I(new_inode),
+                                                 BTRFS_I(new_dir), parent,
+                                                 false, &ctx_dest);
+                        if (ret == BTRFS_NEED_LOG_SYNC)
+                                sync_log_dest = true;
+                        else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                                commit_transaction = true;
+                        ret = 0;
+                }
                 btrfs_end_log_trans(dest);
                 dest_log_pinned = false;
         }
@@ -9583,8 +9594,26 @@ out_fail:
                         dest_log_pinned = false;
                 }
         }
-        ret2 = btrfs_end_transaction(trans);
-        ret = ret ? ret : ret2;
+        if (!ret && sync_log_root && !commit_transaction) {
+                ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root,
+                                     &ctx_root);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (!ret && sync_log_dest && !commit_transaction) {
+                ret = btrfs_sync_log(trans, BTRFS_I(new_inode)->root,
+                                     &ctx_dest);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (commit_transaction) {
+                ret = btrfs_commit_transaction(trans);
+        } else {
+                int ret2;
+
+                ret2 = btrfs_end_transaction(trans);
+                ret = ret ? ret : ret2;
+        }
 out_notrans:
         if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&fs_info->subvol_sem);
@@ -9661,6 +9690,9 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         int ret;
         u64 old_ino = btrfs_ino(BTRFS_I(old_inode));
         bool log_pinned = false;
+        struct btrfs_log_ctx ctx;
+        bool sync_log = false;
+        bool commit_transaction = false;
 
         if (btrfs_ino(BTRFS_I(new_dir)) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)
                 return -EPERM;
@@ -9818,8 +9850,15 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (log_pinned) {
                 struct dentry *parent = new_dentry->d_parent;
 
-                btrfs_log_new_name(trans, BTRFS_I(old_inode), BTRFS_I(old_dir),
-                                parent);
+                btrfs_init_log_ctx(&ctx, old_inode);
+                ret = btrfs_log_new_name(trans, BTRFS_I(old_inode),
+                                         BTRFS_I(old_dir), parent,
+                                         false, &ctx);
+                if (ret == BTRFS_NEED_LOG_SYNC)
+                        sync_log = true;
+                else if (ret == BTRFS_NEED_TRANS_COMMIT)
+                        commit_transaction = true;
+                ret = 0;
                 btrfs_end_log_trans(root);
                 log_pinned = false;
         }
@@ -9856,7 +9895,19 @@ out_fail:
                 btrfs_end_log_trans(root);
                 log_pinned = false;
         }
-        btrfs_end_transaction(trans);
+        if (!ret && sync_log) {
+                ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root, &ctx);
+                if (ret)
+                        commit_transaction = true;
+        }
+        if (commit_transaction) {
+                ret = btrfs_commit_transaction(trans);
+        } else {
+                int ret2;
+
+                ret2 = btrfs_end_transaction(trans);
+                ret = ret ? ret : ret2;
+        }
 out_notrans:
         if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&fs_info->subvol_sem);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 63600dc2ac4c..d60b6caf09e8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -747,6 +747,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         struct btrfs_pending_snapshot *pending_snapshot;
         struct btrfs_trans_handle *trans;
         int ret;
+        bool snapshot_force_cow = false;
 
         if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state))
                 return -EINVAL;
@@ -763,6 +764,11 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
                 goto free_pending;
         }
 
+        /*
+         * Force new buffered writes to reserve space even when NOCOW is
+         * possible. This is to avoid later writeback (running dealloc) to
+         * fallback to COW mode and unexpectedly fail with ENOSPC.
+         */
         atomic_inc(&root->will_be_snapshotted);
         smp_mb__after_atomic();
         /* wait for no snapshot writes */
@@ -773,6 +779,14 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
         if (ret)
                 goto dec_and_free;
 
+        /*
+         * All previous writes have started writeback in NOCOW mode, so now
+         * we force future writes to fallback to COW mode during snapshot
+         * creation.
+         */
+        atomic_inc(&root->snapshot_force_cow);
+        snapshot_force_cow = true;
+
         btrfs_wait_ordered_extents(root, U64_MAX, 0, (u64)-1);
 
         btrfs_init_block_rsv(&pending_snapshot->block_rsv,
@@ -837,6 +851,8 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
 fail:
         btrfs_subvolume_release_metadata(fs_info, &pending_snapshot->block_rsv);
 dec_and_free:
+        if (snapshot_force_cow)
+                atomic_dec(&root->snapshot_force_cow);
         if (atomic_dec_and_test(&root->will_be_snapshotted))
                 wake_up_var(&root->will_be_snapshotted);
 free_pending:
@@ -3453,6 +3469,25 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen,
 
                 same_lock_start = min_t(u64, loff, dst_loff);
                 same_lock_len = max_t(u64, loff, dst_loff) + len - same_lock_start;
+        } else {
+                /*
+                 * If the source and destination inodes are different, the
+                 * source's range end offset matches the source's i_size, that
+                 * i_size is not a multiple of the sector size, and the
+                 * destination range does not go past the destination's i_size,
+                 * we must round down the length to the nearest sector size
+                 * multiple. If we don't do this adjustment we end replacing
+                 * with zeroes the bytes in the range that starts at the
+                 * deduplication range's end offset and ends at the next sector
+                 * size multiple.
+                 */
+                if (loff + olen == i_size_read(src) &&
+                    dst_loff + len < i_size_read(dst)) {
+                        const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+                        len = round_down(i_size_read(src), sz) - loff;
+                        olen = len;
+                }
         }
 
 again:
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 4353bb69bb86..d4917c0cddf5 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1019,10 +1019,9 @@ out_add_root:
         spin_unlock(&fs_info->qgroup_lock);
 
         ret = btrfs_commit_transaction(trans);
-        if (ret) {
-                trans = NULL;
+        trans = NULL;
+        if (ret)
                 goto out_free_path;
-        }
 
         ret = qgroup_rescan_init(fs_info, 0, 1);
         if (!ret) {
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 1650dc44a5e3..3c2ae0e4f25a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -6025,14 +6025,25 @@ void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans,
  * Call this after adding a new name for a file and it will properly
  * update the log to reflect the new name.
  *
- * It will return zero if all goes well, and it will return 1 if a
- * full transaction commit is required.
+ * @ctx can not be NULL when @sync_log is false, and should be NULL when it's
+ * true (because it's not used).
+ *
+ * Return value depends on whether @sync_log is true or false.
+ * When true: returns BTRFS_NEED_TRANS_COMMIT if the transaction needs to be
+ *            committed by the caller, and BTRFS_DONT_NEED_TRANS_COMMIT
+ *            otherwise.
+ * When false: returns BTRFS_DONT_NEED_LOG_SYNC if the caller does not need to
+ *             to sync the log, BTRFS_NEED_LOG_SYNC if it needs to sync the log,
+ *             or BTRFS_NEED_TRANS_COMMIT if the transaction needs to be
+ *             committed (without attempting to sync the log).
  */
 int btrfs_log_new_name(struct btrfs_trans_handle *trans,
                         struct btrfs_inode *inode, struct btrfs_inode *old_dir,
-                        struct dentry *parent)
+                        struct dentry *parent,
+                        bool sync_log, struct btrfs_log_ctx *ctx)
 {
         struct btrfs_fs_info *fs_info = trans->fs_info;
+        int ret;
 
         /*
          * this will force the logging code to walk the dentry chain
@@ -6047,9 +6058,34 @@ int btrfs_log_new_name(struct btrfs_trans_handle *trans,
          */
         if (inode->logged_trans <= fs_info->last_trans_committed &&
             (!old_dir || old_dir->logged_trans <= fs_info->last_trans_committed))
-                return 0;
+                return sync_log ? BTRFS_DONT_NEED_TRANS_COMMIT :
+                        BTRFS_DONT_NEED_LOG_SYNC;
+
+        if (sync_log) {
+                struct btrfs_log_ctx ctx2;
+
+                btrfs_init_log_ctx(&ctx2, &inode->vfs_inode);
+                ret = btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
+                                             LOG_INODE_EXISTS, &ctx2);
+                if (ret == BTRFS_NO_LOG_SYNC)
+                        return BTRFS_DONT_NEED_TRANS_COMMIT;
+                else if (ret)
+                        return BTRFS_NEED_TRANS_COMMIT;
+
+                ret = btrfs_sync_log(trans, inode->root, &ctx2);
+                if (ret)
+                        return BTRFS_NEED_TRANS_COMMIT;
+                return BTRFS_DONT_NEED_TRANS_COMMIT;
+        }
+
+        ASSERT(ctx);
+        ret = btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
+                                     LOG_INODE_EXISTS, ctx);
+        if (ret == BTRFS_NO_LOG_SYNC)
+                return BTRFS_DONT_NEED_LOG_SYNC;
+        else if (ret)
+                return BTRFS_NEED_TRANS_COMMIT;
 
-        return btrfs_log_inode_parent(trans, inode, parent, 0, LLONG_MAX,
-                                      LOG_INODE_EXISTS, NULL);
+        return BTRFS_NEED_LOG_SYNC;
 }
 
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index 122e68b89a5a..7ab9bb88a639 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -71,8 +71,16 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans,
                              int for_rename);
 void btrfs_record_snapshot_destroy(struct btrfs_trans_handle *trans,
                                    struct btrfs_inode *dir);
+/* Return values for btrfs_log_new_name() */
+enum {
+        BTRFS_DONT_NEED_TRANS_COMMIT,
+        BTRFS_NEED_TRANS_COMMIT,
+        BTRFS_DONT_NEED_LOG_SYNC,
+        BTRFS_NEED_LOG_SYNC,
+};
 int btrfs_log_new_name(struct btrfs_trans_handle *trans,
                         struct btrfs_inode *inode, struct btrfs_inode *old_dir,
-                        struct dentry *parent);
+                        struct dentry *parent,
+                        bool sync_log, struct btrfs_log_ctx *ctx);
 
 #endif
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index da86706123ff..f4405e430da6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4491,7 +4491,12 @@ again:
 
         /* Now btrfs_update_device() will change the on-disk size. */
         ret = btrfs_update_device(trans, device);
-        btrfs_end_transaction(trans);
+        if (ret < 0) {
+                btrfs_abort_transaction(trans, ret);
+                btrfs_end_transaction(trans);
+        } else {
+                ret = btrfs_commit_transaction(trans);
+        }
 done:
         btrfs_free_path(path);
         if (ret) {
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 43ca3b763875..eab1359d0553 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -602,6 +602,8 @@ static int extra_mon_dispatch(struct ceph_client *client, struct ceph_msg *msg)
 
 /*
  * create a new fs client
+ *
+ * Success or not, this function consumes @fsopt and @opt.
  */
 static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
                                         struct ceph_options *opt)
@@ -609,17 +611,20 @@ static struct ceph_fs_client *create_fs_client(struct ceph_mount_options *fsopt,
         struct ceph_fs_client *fsc;
         int page_count;
         size_t size;
-        int err = -ENOMEM;
+        int err;
 
         fsc = kzalloc(sizeof(*fsc), GFP_KERNEL);
-        if (!fsc)
-                return ERR_PTR(-ENOMEM);
+        if (!fsc) {
+                err = -ENOMEM;
+                goto fail;
+        }
 
         fsc->client = ceph_create_client(opt, fsc);
         if (IS_ERR(fsc->client)) {
                 err = PTR_ERR(fsc->client);
                 goto fail;
         }
+        opt = NULL; /* fsc->client now owns this */
 
         fsc->client->extra_mon_dispatch = extra_mon_dispatch;
         fsc->client->osdc.abort_on_full = true;
@@ -677,6 +682,9 @@ fail_client:
         ceph_destroy_client(fsc->client);
 fail:
         kfree(fsc);
+        if (opt)
+                ceph_destroy_options(opt);
+        destroy_mount_options(fsopt);
         return ERR_PTR(err);
 }
 
@@ -1042,8 +1050,6 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
         fsc = create_fs_client(fsopt, opt);
         if (IS_ERR(fsc)) {
                 res = ERR_CAST(fsc);
-                destroy_mount_options(fsopt);
-                ceph_destroy_options(opt);
                 goto out_final;
         }
 
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index b380e0871372..a2b2355e7f01 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -105,9 +105,6 @@ convert_sfm_char(const __u16 src_char, char *target)
         case SFM_LESSTHAN:
                 *target = '<';
                 break;
-        case SFM_SLASH:
-                *target = '\\';
-                break;
         case SFM_SPACE:
                 *target = ' ';
                 break;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c832a8a1970a..7aa08dba4719 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2547,7 +2547,7 @@ cifs_setup_ipc(struct cifs_ses *ses, struct smb_vol *volume_info)
         if (tcon == NULL)
                 return -ENOMEM;
 
-        snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->serverName);
+        snprintf(unc, sizeof(unc), "\\\\%s\\IPC$", ses->server->hostname);
 
         /* cannot fail */
         nls_codepage = load_nls_default();
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index d32eaa4b2437..6e8765f44508 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -467,6 +467,8 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path,
         oparms.cifs_sb = cifs_sb;
         oparms.desired_access = GENERIC_READ;
         oparms.create_options = CREATE_NOT_DIR;
+        if (backup_cred(cifs_sb))
+                oparms.create_options |= CREATE_OPEN_BACKUP_INTENT;
         oparms.disposition = FILE_OPEN;
         oparms.path = path;
         oparms.fid = &fid;
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index db0453660ff6..6a9c47541c53 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -248,16 +248,20 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
                  * MacOS server pads after SMB2.1 write response with 3 bytes
                  * of junk. Other servers match RFC1001 len to actual
                  * SMB2/SMB3 frame length (header + smb2 response specific data)
-                 * Some windows servers do too when compounding is used.
-                 * Log the server error (once), but allow it and continue
+                 * Some windows servers also pad up to 8 bytes when compounding.
+                 * If pad is longer than eight bytes, log the server behavior
+                 * (once), since may indicate a problem but allow it and continue
                  * since the frame is parseable.
                  */
                 if (clc_len < len) {
-                        printk_once(KERN_WARNING
-                                "SMB2 server sent bad RFC1001 len %d not %d\n",
-                                len, clc_len);
+                        pr_warn_once(
+                             "srv rsp padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
+                             len, clc_len, command, mid);
                         return 0;
                 }
+                pr_warn_once(
+                        "srv rsp too short, len %d not %d. cmd:%d mid:%llu\n",
+                        len, clc_len, command, mid);
 
                 return 1;
         }
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 247a98e6c856..d954ce36b473 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -630,7 +630,10 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -779,7 +782,10 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_EA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -858,7 +864,10 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_WRITE_EA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -1453,7 +1462,10 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = fid;
         oparms.reconnect = false;
 
@@ -1857,7 +1869,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
         oparms.tcon = tcon;
         oparms.desired_access = FILE_READ_ATTRIBUTES;
         oparms.disposition = FILE_OPEN;
-        oparms.create_options = 0;
+        if (backup_cred(cifs_sb))
+                oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+        else
+                oparms.create_options = 0;
         oparms.fid = &fid;
         oparms.reconnect = false;
 
@@ -3639,7 +3654,7 @@ struct smb_version_values smb21_values = {
 struct smb_version_values smb3any_values = {
         .version_string = SMB3ANY_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3660,7 +3675,7 @@ struct smb_version_values smb3any_values = {
 struct smb_version_values smbdefault_values = {
         .version_string = SMBDEFAULT_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3681,7 +3696,7 @@ struct smb_version_values smbdefault_values = {
 struct smb_version_values smb30_values = {
         .version_string = SMB30_VERSION_STRING,
         .protocol_id = SMB30_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3702,7 +3717,7 @@ struct smb_version_values smb30_values = {
 struct smb_version_values smb302_values = {
         .version_string = SMB302_VERSION_STRING,
         .protocol_id = SMB302_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
@@ -3723,7 +3738,7 @@ struct smb_version_values smb302_values = {
 struct smb_version_values smb311_values = {
         .version_string = SMB311_VERSION_STRING,
         .protocol_id = SMB311_PROT_ID,
-        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION | SMB2_GLOBAL_CAP_DIRECTORY_LEASING,
         .large_lock_type = 0,
         .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
         .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5740aa809be6..c08acfc77abc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2178,6 +2178,9 @@ SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, __u8 *oplock,
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
             *oplock == SMB2_OPLOCK_LEVEL_NONE)
                 req->RequestedOplockLevel = *oplock;
+        else if (!(server->capabilities & SMB2_GLOBAL_CAP_DIRECTORY_LEASING) &&
+                  (oparms->create_options & CREATE_NOT_FILE))
+                req->RequestedOplockLevel = *oplock; /* no srv lease support */
         else {
                 rc = add_lease_context(server, iov, &n_iov,
                                        oparms->fid->lease_key, oplock);
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 03b8ba933eb2..235b959fc2b3 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * alloc.c - NILFS dat/inode allocator
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Koji Sato.
  * Two allocators were unified by Ryusuke Konishi and Amagai Yoshiji.
  */
diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h
index 05149e606a78..0303c3968cee 100644
--- a/fs/nilfs2/alloc.h
+++ b/fs/nilfs2/alloc.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * alloc.h - persistent object (dat entry/disk inode) allocator/deallocator
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Koji Sato.
  * Two allocators were unified by Ryusuke Konishi and Amagai Yoshiji.
  */
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index 01fb1831ca25..fb5a9a8a13cf 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * bmap.c - NILFS block mapping.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/bmap.h b/fs/nilfs2/bmap.h
index 2b6ffbe5997a..2c63858e81c9 100644
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * bmap.h - NILFS block mapping.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index dec98cab729d..ebb24a314f43 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * btnode.c - NILFS B-tree node cache
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Originally written by Seiji Kihara.
  * Fully revised by Ryusuke Konishi for stabilization and simplification.
  *
diff --git a/fs/nilfs2/btnode.h b/fs/nilfs2/btnode.h
index 4e8aaa1aeb65..0f88dbc9bcb3 100644
--- a/fs/nilfs2/btnode.h
+++ b/fs/nilfs2/btnode.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * btnode.h - NILFS B-tree node cache
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Seiji Kihara.
  * Revised by Ryusuke Konishi.
  */
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 16a7a67a11c9..23e043eca237 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * btree.c - NILFS B-tree.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/btree.h b/fs/nilfs2/btree.h
index 2184e47fa4bf..d1421b646ce4 100644
--- a/fs/nilfs2/btree.h
+++ b/fs/nilfs2/btree.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * btree.h - NILFS B-tree.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index a15a1601e931..8d41311b5db4 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * cpfile.c - NILFS checkpoint file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/cpfile.h b/fs/nilfs2/cpfile.h
index 6eca972f9673..6336222df24a 100644
--- a/fs/nilfs2/cpfile.h
+++ b/fs/nilfs2/cpfile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * cpfile.h - NILFS checkpoint file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index dffedb2f8817..6f4066636be9 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * dat.c - NILFS disk address translation.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dat.h b/fs/nilfs2/dat.h
index 57dc6cf466d0..b17ee34580ae 100644
--- a/fs/nilfs2/dat.h
+++ b/fs/nilfs2/dat.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * dat.h - NILFS disk address translation.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 582831ab3eb9..81394e22d0a0 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * dir.c - NILFS directory entry operations
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Modified for NILFS by Amagai Yoshiji.
  */
 /*
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index 96e3ed0d9652..533e24ea3a88 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * direct.c - NILFS direct block pointer.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/direct.h b/fs/nilfs2/direct.h
index cfe85e848bba..ec9a23c77994 100644
--- a/fs/nilfs2/direct.h
+++ b/fs/nilfs2/direct.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * direct.h - NILFS direct block pointer.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/file.c b/fs/nilfs2/file.c
index 7da0fac71dc2..64bc81363c6c 100644
--- a/fs/nilfs2/file.c
+++ b/fs/nilfs2/file.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * file.c - NILFS regular file handling primitives including fsync().
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji and Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index 853a831dcde0..aa3c328ee189 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * gcinode.c - dummy inodes to buffer blocks for garbage collection
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Seiji Kihara, Amagai Yoshiji, and Ryusuke Konishi.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c
index b8fa45c20c63..4140d232cadc 100644
--- a/fs/nilfs2/ifile.c
+++ b/fs/nilfs2/ifile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * ifile.c - NILFS inode file
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/ifile.h b/fs/nilfs2/ifile.h
index 188b94fe0ec5..a1e1e5711a05 100644
--- a/fs/nilfs2/ifile.h
+++ b/fs/nilfs2/ifile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * ifile.h - NILFS inode file
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Amagai Yoshiji.
  * Revised by Ryusuke Konishi.
  *
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 6a612d832e7d..671085512e0f 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * inode.c - NILFS inode operations.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 1d2c3d7711fe..9b96d79eea6c 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * ioctl.c - NILFS ioctl operations.
  *
  * Copyright (C) 2007, 2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index c6bc1033e7d2..700870a92bc4 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * mdt.c - meta data file for NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/mdt.h b/fs/nilfs2/mdt.h
index 3f67f3932097..e77aea4bb921 100644
--- a/fs/nilfs2/mdt.h
+++ b/fs/nilfs2/mdt.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * mdt.h - NILFS meta data file prototype and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index dd52d3f82e8d..9fe6d4ab74f0 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * namei.c - NILFS pathname lookup operations.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Modified for NILFS by Amagai Yoshiji and Ryusuke Konishi.
  */
 /*
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 33f8c8fc96e8..a2f247b6a209 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * nilfs.h - NILFS local header file.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato and Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 4cb850a6f1c2..329a056b73b1 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * page.c - buffer/page management specific to NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi and Seiji Kihara.
  */
 
diff --git a/fs/nilfs2/page.h b/fs/nilfs2/page.h
index f3687c958fa8..62b9bb469e92 100644
--- a/fs/nilfs2/page.h
+++ b/fs/nilfs2/page.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * page.h - buffer/page management specific to NILFS
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi and Seiji Kihara.
  */
 
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index 5139efed1888..140b663e91c7 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * recovery.c - NILFS recovery logic
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 68cb9e4740b4..20c479b5e41b 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * segbuf.c - NILFS segment buffer
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segbuf.h b/fs/nilfs2/segbuf.h
index 10e16935fff6..9bea1bd59041 100644
--- a/fs/nilfs2/segbuf.h
+++ b/fs/nilfs2/segbuf.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * segbuf.h - NILFS Segment buffer prototypes and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 0953635e7d48..445eef41bfaf 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * segment.c - NILFS segment constructor.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 04634e3e3d58..f5cf5308f3fc 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * segment.h - NILFS Segment constructor prototypes and definitions
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index c7fa139d50e8..bf3f8f05c89b 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * sufile.c - NILFS segment usage file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  * Revised by Ryusuke Konishi.
  */
diff --git a/fs/nilfs2/sufile.h b/fs/nilfs2/sufile.h
index 673a891350f4..c4e2c7a7add1 100644
--- a/fs/nilfs2/sufile.h
+++ b/fs/nilfs2/sufile.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * sufile.h - NILFS segment usage file.
  *
  * Copyright (C) 2006-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Koji Sato.
  */
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 1b9067cf4511..26290aa1023f 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * super.c - NILFS module and super block management.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  */
 /*
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 4b25837e7724..e60be7bb55b0 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -1,19 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * sysfs.c - sysfs support implementation.
  *
  * Copyright (C) 2005-2014 Nippon Telegraph and Telephone Corporation.
  * Copyright (C) 2014 HGST, Inc., a Western Digital Company.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Vyacheslav Dubeyko <Vyacheslav.Dubeyko@hgst.com>
  */
 
diff --git a/fs/nilfs2/sysfs.h b/fs/nilfs2/sysfs.h
index 648cedf9c06e..d001eb862dae 100644
--- a/fs/nilfs2/sysfs.h
+++ b/fs/nilfs2/sysfs.h
@@ -1,19 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * sysfs.h - sysfs support declarations.
  *
  * Copyright (C) 2005-2014 Nippon Telegraph and Telephone Corporation.
  * Copyright (C) 2014 HGST, Inc., a Western Digital Company.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Vyacheslav Dubeyko <Vyacheslav.Dubeyko@hgst.com>
  */
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 1a85317e83f0..484785cdf96e 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -1,18 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * the_nilfs.c - the_nilfs shared structure.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 36da1779f976..380a543c5b19 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -1,18 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
 /*
  * the_nilfs.h - the_nilfs shared structure.
  *
  * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
  * Written by Ryusuke Konishi.
  *
  */
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index f174397b63a0..ababdbfab537 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -351,16 +351,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
 
         iter_info.srcu_idx = srcu_read_lock(&fsnotify_mark_srcu);
 
-        if ((mask & FS_MODIFY) ||
-            (test_mask & to_tell->i_fsnotify_mask)) {
-                iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
-                        fsnotify_first_mark(&to_tell->i_fsnotify_marks);
-        }
-
-        if (mnt && ((mask & FS_MODIFY) ||
-                    (test_mask & mnt->mnt_fsnotify_mask))) {
-                iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
-                        fsnotify_first_mark(&to_tell->i_fsnotify_marks);
+        iter_info.marks[FSNOTIFY_OBJ_TYPE_INODE] =
+                fsnotify_first_mark(&to_tell->i_fsnotify_marks);
+        if (mnt) {
                 iter_info.marks[FSNOTIFY_OBJ_TYPE_VFSMOUNT] =
                         fsnotify_first_mark(&mnt->mnt_fsnotify_marks);
         }
diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
index 34aec30e06c7..6d766a19f2bb 100644
--- a/include/linux/blk-cgroup.h
+++ b/include/linux/blk-cgroup.h
@@ -56,6 +56,7 @@ struct blkcg {
         struct list_head                all_blkcgs_node;
 #ifdef CONFIG_CGROUP_WRITEBACK
         struct list_head                cgwb_list;
+        refcount_t                      cgwb_refcnt;
 #endif
 };
 
@@ -89,7 +90,6 @@ struct blkg_policy_data {
         /* the blkg and policy id this per-policy data belongs to */
         struct blkcg_gq                 *blkg;
         int                             plid;
-        bool                            offline;
 };
 
 /*
@@ -387,6 +387,49 @@ static inline struct blkcg *cpd_to_blkcg(struct blkcg_policy_data *cpd)
         return cpd ? cpd->blkcg : NULL;
 }
 
+extern void blkcg_destroy_blkgs(struct blkcg *blkcg);
+
+#ifdef CONFIG_CGROUP_WRITEBACK
+
+/**
+ * blkcg_cgwb_get - get a reference for blkcg->cgwb_list
+ * @blkcg: blkcg of interest
+ *
+ * This is used to track the number of active wb's related to a blkcg.
+ */
+static inline void blkcg_cgwb_get(struct blkcg *blkcg)
+{
+        refcount_inc(&blkcg->cgwb_refcnt);
+}
+
+/**
+ * blkcg_cgwb_put - put a reference for @blkcg->cgwb_list
+ * @blkcg: blkcg of interest
+ *
+ * This is used to track the number of active wb's related to a blkcg.
+ * When this count goes to zero, all active wb has finished so the
+ * blkcg can continue destruction by calling blkcg_destroy_blkgs().
+ * This work may occur in cgwb_release_workfn() on the cgwb_release
+ * workqueue.
+ */
+static inline void blkcg_cgwb_put(struct blkcg *blkcg)
+{
+        if (refcount_dec_and_test(&blkcg->cgwb_refcnt))
+                blkcg_destroy_blkgs(blkcg);
+}
+
+#else
+
+static inline void blkcg_cgwb_get(struct blkcg *blkcg) { }
+
+static inline void blkcg_cgwb_put(struct blkcg *blkcg)
+{
+        /* wb isn't being accounted, so trigger destruction right away */
+        blkcg_destroy_blkgs(blkcg);
+}
+
+#endif
+
 /**
  * blkg_path - format cgroup path of blkg
  * @blkg: blkg of interest
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 99d366cb0e9f..d157983b84cf 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -3084,4 +3084,6 @@
 
 #define PCI_VENDOR_ID_OCZ               0x1b85
 
+#define PCI_VENDOR_ID_NCUBE             0x10ff
+
 #endif /* _LINUX_PCI_IDS_H */
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 7f2e16e76ac4..041f7e56a289 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -158,8 +158,10 @@ extern void syscall_unregfunc(void);
                  * For rcuidle callers, use srcu since sched-rcu        \
                  * doesn't work from the idle path.                     \
                  */                                                     \
-                if (rcuidle)                                            \
+                if (rcuidle) {                                          \
                         idx = srcu_read_lock_notrace(&tracepoint_srcu); \
+                        rcu_irq_enter_irqson();                         \
+                }                                                       \
                                                                         \
                 it_func_ptr = rcu_dereference_raw((tp)->funcs);         \
                                                                         \
@@ -171,8 +173,10 @@ extern void syscall_unregfunc(void);
                         } while ((++it_func_ptr)->func);                \
                 }                                                       \
                                                                         \
-                if (rcuidle)                                            \
+                if (rcuidle) {                                          \
+                        rcu_irq_exit_irqson();                          \
                         srcu_read_unlock_notrace(&tracepoint_srcu, idx);\
+                }                                                       \
                                                                         \
                 preempt_enable_notrace();                               \
         } while (0)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9a850973e09a..8ebabc9873d1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4865,8 +4865,8 @@ const char *reg_initiator_name(enum nl80211_reg_initiator initiator);
  *
  * Return: 0 on success. -ENODATA.
  */
-int reg_query_regdb_wmm(char *alpha2, int freq, u32 *ptr,
-                        struct ieee80211_wmm_rule *rule);
+int reg_query_regdb_wmm(char *alpha2, int freq,
+                        struct ieee80211_reg_rule *rule);
 
 /*
  * callbacks for asynchronous cfg80211 methods, notification
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 60f8cc86a447..3469750df0f4 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -217,15 +217,15 @@ struct ieee80211_wmm_rule {
 struct ieee80211_reg_rule {
         struct ieee80211_freq_range freq_range;
         struct ieee80211_power_rule power_rule;
-        struct ieee80211_wmm_rule *wmm_rule;
+        struct ieee80211_wmm_rule wmm_rule;
         u32 flags;
         u32 dfs_cac_ms;
+        bool has_wmm;
 };
 
 struct ieee80211_regdomain {
         struct rcu_head rcu_head;
         u32 n_reg_rules;
-        u32 n_wmm_rules;
         char alpha2[3];
         enum nl80211_dfs_regions dfs_region;
         struct ieee80211_reg_rule reg_rules[];
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 7b8c9e19bad1..910cc4334b21 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -65,7 +65,7 @@
 
 /* keyctl structures */
 struct keyctl_dh_params {
-        __s32 private;
+        __s32 dh_private;
         __s32 prime;
         __s32 base;
 };
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index dc520e1a4123..8b73cb603c5f 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -37,6 +37,7 @@
 
 #include <linux/types.h>
 #include <linux/socket.h>               /* For __kernel_sockaddr_storage. */
+#include <linux/in6.h>                  /* For struct in6_addr. */
 
 #define RDS_IB_ABI_VERSION              0x301
 
diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h
index b1e22c40c4b6..84c3de89696a 100644
--- a/include/uapi/linux/vhost.h
+++ b/include/uapi/linux/vhost.h
@@ -176,7 +176,7 @@ struct vhost_memory {
 #define VHOST_BACKEND_F_IOTLB_MSG_V2 0x1
 
 #define VHOST_SET_BACKEND_FEATURES _IOW(VHOST_VIRTIO, 0x25, __u64)
-#define VHOST_GET_BACKEND_FEATURES _IOW(VHOST_VIRTIO, 0x26, __u64)
+#define VHOST_GET_BACKEND_FEATURES _IOR(VHOST_VIRTIO, 0x26, __u64)
 
 /* VHOST_NET specific defines */
 
diff --git a/ipc/shm.c b/ipc/shm.c
index b0eb3757ab89..4cd402e4cfeb 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -199,6 +199,7 @@ static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
         }
 
         ipc_unlock_object(ipcp);
+        ipcp = ERR_PTR(-EIDRM);
 err:
         rcu_read_unlock();
         /*
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index cf5195c7c331..488ef9663c01 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -236,7 +236,7 @@ static int bpf_tcp_init(struct sock *sk)
 }
 
 static void smap_release_sock(struct smap_psock *psock, struct sock *sock);
-static int free_start_sg(struct sock *sk, struct sk_msg_buff *md);
+static int free_start_sg(struct sock *sk, struct sk_msg_buff *md, bool charge);
 
 static void bpf_tcp_release(struct sock *sk)
 {
@@ -248,7 +248,7 @@ static void bpf_tcp_release(struct sock *sk)
                 goto out;
 
         if (psock->cork) {
-                free_start_sg(psock->sock, psock->cork);
+                free_start_sg(psock->sock, psock->cork, true);
                 kfree(psock->cork);
                 psock->cork = NULL;
         }
@@ -330,14 +330,14 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
         close_fun = psock->save_close;
 
         if (psock->cork) {
-                free_start_sg(psock->sock, psock->cork);
+                free_start_sg(psock->sock, psock->cork, true);
                 kfree(psock->cork);
                 psock->cork = NULL;
         }
 
         list_for_each_entry_safe(md, mtmp, &psock->ingress, list) {
                 list_del(&md->list);
-                free_start_sg(psock->sock, md);
+                free_start_sg(psock->sock, md, true);
                 kfree(md);
         }
 
@@ -369,7 +369,7 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
                         /* If another thread deleted this object skip deletion.
                          * The refcnt on psock may or may not be zero.
                          */
-                        if (l) {
+                        if (l && l == link) {
                                 hlist_del_rcu(&link->hash_node);
                                 smap_release_sock(psock, link->sk);
                                 free_htab_elem(htab, link);
@@ -570,14 +570,16 @@ static void free_bytes_sg(struct sock *sk, int bytes,
         md->sg_start = i;
 }
 
-static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
+static int free_sg(struct sock *sk, int start,
+                   struct sk_msg_buff *md, bool charge)
 {
         struct scatterlist *sg = md->sg_data;
         int i = start, free = 0;
 
         while (sg[i].length) {
                 free += sg[i].length;
-                sk_mem_uncharge(sk, sg[i].length);
+                if (charge)
+                        sk_mem_uncharge(sk, sg[i].length);
                 if (!md->skb)
                         put_page(sg_page(&sg[i]));
                 sg[i].length = 0;
@@ -594,9 +596,9 @@ static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
         return free;
 }
 
-static int free_start_sg(struct sock *sk, struct sk_msg_buff *md)
+static int free_start_sg(struct sock *sk, struct sk_msg_buff *md, bool charge)
 {
-        int free = free_sg(sk, md->sg_start, md);
+        int free = free_sg(sk, md->sg_start, md, charge);
 
         md->sg_start = md->sg_end;
         return free;
@@ -604,7 +606,7 @@ static int free_start_sg(struct sock *sk, struct sk_msg_buff *md)
 
 static int free_curr_sg(struct sock *sk, struct sk_msg_buff *md)
 {
-        return free_sg(sk, md->sg_curr, md);
+        return free_sg(sk, md->sg_curr, md, true);
 }
 
 static int bpf_map_msg_verdict(int _rc, struct sk_msg_buff *md)
@@ -718,7 +720,7 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
                 list_add_tail(&r->list, &psock->ingress);
                 sk->sk_data_ready(sk);
         } else {
-                free_start_sg(sk, r);
+                free_start_sg(sk, r, true);
                 kfree(r);
         }
 
@@ -752,14 +754,10 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
                 release_sock(sk);
         }
         smap_release_sock(psock, sk);
-        if (unlikely(err))
-                goto out;
-        return 0;
+        return err;
 out_rcu:
         rcu_read_unlock();
-out:
-        free_bytes_sg(NULL, send, md, false);
-        return err;
+        return 0;
 }
 
 static inline void bpf_md_init(struct smap_psock *psock)
@@ -822,7 +820,7 @@ more_data:
         case __SK_PASS:
                 err = bpf_tcp_push(sk, send, m, flags, true);
                 if (unlikely(err)) {
-                        *copied -= free_start_sg(sk, m);
+                        *copied -= free_start_sg(sk, m, true);
                         break;
                 }
 
@@ -845,16 +843,17 @@ more_data:
                 lock_sock(sk);
 
                 if (unlikely(err < 0)) {
-                        free_start_sg(sk, m);
+                        int free = free_start_sg(sk, m, false);
+
                         psock->sg_size = 0;
                         if (!cork)
-                                *copied -= send;
+                                *copied -= free;
                 } else {
                         psock->sg_size -= send;
                 }
 
                 if (cork) {
-                        free_start_sg(sk, m);
+                        free_start_sg(sk, m, true);
                         psock->sg_size = 0;
                         kfree(m);
                         m = NULL;
@@ -912,6 +911,8 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
 
         if (unlikely(flags & MSG_ERRQUEUE))
                 return inet_recv_error(sk, msg, len, addr_len);
+        if (!skb_queue_empty(&sk->sk_receive_queue))
+                return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
 
         rcu_read_lock();
         psock = smap_psock_sk(sk);
@@ -922,9 +923,6 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 goto out;
         rcu_read_unlock();
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
-                return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
-
         lock_sock(sk);
 bytes_ready:
         while (copied != len) {
@@ -1122,7 +1120,7 @@ wait_for_memory:
                 err = sk_stream_wait_memory(sk, &timeo);
                 if (err) {
                         if (m && m != psock->cork)
-                                free_start_sg(sk, m);
+                                free_start_sg(sk, m, true);
                         goto out_err;
                 }
         }
@@ -1464,10 +1462,16 @@ static void smap_destroy_psock(struct rcu_head *rcu)
         schedule_work(&psock->gc_work);
 }
 
+static bool psock_is_smap_sk(struct sock *sk)
+{
+        return inet_csk(sk)->icsk_ulp_ops == &bpf_tcp_ulp_ops;
+}
+
 static void smap_release_sock(struct smap_psock *psock, struct sock *sock)
 {
         if (refcount_dec_and_test(&psock->refcnt)) {
-                tcp_cleanup_ulp(sock);
+                if (psock_is_smap_sk(sock))
+                        tcp_cleanup_ulp(sock);
                 write_lock_bh(&sock->sk_callback_lock);
                 smap_stop_sock(psock, sock);
                 write_unlock_bh(&sock->sk_callback_lock);
@@ -1581,13 +1585,13 @@ static void smap_gc_work(struct work_struct *w)
                 bpf_prog_put(psock->bpf_tx_msg);
 
         if (psock->cork) {
-                free_start_sg(psock->sock, psock->cork);
+                free_start_sg(psock->sock, psock->cork, true);
                 kfree(psock->cork);
         }
 
         list_for_each_entry_safe(md, mtmp, &psock->ingress, list) {
                 list_del(&md->list);
-                free_start_sg(psock->sock, md);
+                free_start_sg(psock->sock, md, true);
                 kfree(md);
         }
 
@@ -1894,6 +1898,10 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
          * doesn't update user data.
          */
         if (psock) {
+                if (!psock_is_smap_sk(sock)) {
+                        err = -EBUSY;
+                        goto out_progs;
+                }
                 if (READ_ONCE(psock->bpf_parse) && parse) {
                         err = -EBUSY;
                         goto out_progs;
diff --git a/kernel/cpu.c b/kernel/cpu.c
index aa7fe85ad62e..0097acec1c71 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -607,15 +607,15 @@ static void cpuhp_thread_fun(unsigned int cpu)
         bool bringup = st->bringup;
         enum cpuhp_state state;
 
+        if (WARN_ON_ONCE(!st->should_run))
+                return;
+
         /*
          * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
          * that if we see ->should_run we also see the rest of the state.
          */
         smp_mb();
 
-        if (WARN_ON_ONCE(!st->should_run))
-                return;
-
         cpuhp_lock_acquire(bringup);
 
         if (st->single) {
@@ -916,7 +916,8 @@ static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
                 ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
                 if (ret) {
                         st->target = prev_state;
-                        undo_cpu_down(cpu, st);
+                        if (st->state < prev_state)
+                                undo_cpu_down(cpu, st);
                         break;
                 }
         }
@@ -969,7 +970,7 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
          * to do the further cleanups.
          */
         ret = cpuhp_down_callbacks(cpu, st, target);
-        if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) {
+        if (ret && st->state == CPUHP_TEARDOWN_CPU && st->state < prev_state) {
                 cpuhp_reset_state(st, prev_state);
                 __cpuhp_kick_ap(st);
         }
diff --git a/kernel/fork.c b/kernel/fork.c
index d896e9ca38b0..f0b58479534f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -550,8 +550,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                         goto out;
         }
         /* a new mm has just been created */
-        arch_dup_mmap(oldmm, mm);
-        retval = 0;
+        retval = arch_dup_mmap(oldmm, mm);
 out:
         up_write(&mm->mmap_sem);
         flush_tlb_mm(oldmm);
diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
index a0a74c533e4b..0913b4d385de 100644
--- a/kernel/printk/printk_safe.c
+++ b/kernel/printk/printk_safe.c
@@ -306,12 +306,12 @@ static __printf(1, 0) int vprintk_nmi(const char *fmt, va_list args)
         return printk_safe_log_store(s, fmt, args);
 }
 
-void printk_nmi_enter(void)
+void notrace printk_nmi_enter(void)
 {
         this_cpu_or(printk_context, PRINTK_NMI_CONTEXT_MASK);
 }
 
-void printk_nmi_exit(void)
+void notrace printk_nmi_exit(void)
 {
         this_cpu_and(printk_context, ~PRINTK_NMI_CONTEXT_MASK);
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 613316724c6a..4966c4fbe7f7 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1277,13 +1277,13 @@ config WARN_ALL_UNSEEDED_RANDOM
           time.  This is really bad from a security perspective, and
           so architecture maintainers really need to do what they can
           to get the CRNG seeded sooner after the system is booted.
-          However, since users can not do anything actionble to
+          However, since users cannot do anything actionable to
           address this, by default the kernel will issue only a single
           warning for the first use of unseeded randomness.
 
           Say Y here if you want to receive warnings for all uses of
           unseeded randomness.  This will be of use primarily for
-          those developers interersted in improving the security of
+          those developers interested in improving the security of
           Linux kernels running on their architecture (or
           subarchitecture).
 
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f5981e9d6ae2..8a8bb8796c6c 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -491,6 +491,7 @@ static void cgwb_release_workfn(struct work_struct *work)
 {
         struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
                                                 release_work);
+        struct blkcg *blkcg = css_to_blkcg(wb->blkcg_css);
 
         mutex_lock(&wb->bdi->cgwb_release_mutex);
         wb_shutdown(wb);
@@ -499,6 +500,9 @@ static void cgwb_release_workfn(struct work_struct *work)
         css_put(wb->blkcg_css);
         mutex_unlock(&wb->bdi->cgwb_release_mutex);
 
+        /* triggers blkg destruction if cgwb_refcnt becomes zero */
+        blkcg_cgwb_put(blkcg);
+
         fprop_local_destroy_percpu(&wb->memcg_completions);
         percpu_ref_exit(&wb->refcnt);
         wb_exit(wb);
@@ -597,6 +601,7 @@ static int cgwb_create(struct backing_dev_info *bdi,
                         list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list);
                         list_add(&wb->memcg_node, memcg_cgwb_list);
                         list_add(&wb->blkcg_node, blkcg_cgwb_list);
+                        blkcg_cgwb_get(blkcg);
                         css_get(memcg_css);
                         css_get(blkcg_css);
                 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c3bc7e9c9a2a..533f9b00147d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -821,11 +821,11 @@ vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
          * but we need to be consistent with PTEs and architectures that
          * can't support a 'special' bit.
          */
-        BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
+        BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) &&
+                        !pfn_t_devmap(pfn));
         BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
                                                 (VM_PFNMAP|VM_MIXEDMAP));
         BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
-        BUG_ON(!pfn_t_devmap(pfn));
 
         if (addr < vma->vm_start || addr >= vma->vm_end)
                 return VM_FAULT_SIGBUS;
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 9a085d525bbc..17dd883198ae 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -2097,6 +2097,11 @@ static int __init kmemleak_late_init(void)
 
         kmemleak_initialized = 1;
 
+        dentry = debugfs_create_file("kmemleak", 0644, NULL, NULL,
+                                     &kmemleak_fops);
+        if (!dentry)
+                pr_warn("Failed to create the debugfs kmemleak file\n");
+
         if (kmemleak_error) {
                 /*
                  * Some error occurred and kmemleak was disabled. There is a
@@ -2108,10 +2113,6 @@ static int __init kmemleak_late_init(void)
                 return -ENOMEM;
         }
 
-        dentry = debugfs_create_file("kmemleak", 0644, NULL, NULL,
-                                     &kmemleak_fops);
-        if (!dentry)
-                pr_warn("Failed to create the debugfs kmemleak file\n");
         mutex_lock(&scan_mutex);
         start_scan_thread();
         mutex_unlock(&scan_mutex);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4ead5a4817de..e79cb59552d9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1701,8 +1701,6 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int
         if (mem_cgroup_out_of_memory(memcg, mask, order))
                 return OOM_SUCCESS;
 
-        WARN(1,"Memory cgroup charge failed because of no reclaimable memory! "
-                "This looks like a misconfiguration or a kernel bug.");
         return OOM_FAILED;
 }
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9eea6e809a4e..38d94b703e9d 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1333,7 +1333,8 @@ static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
                         if (__PageMovable(page))
                                 return pfn;
                         if (PageHuge(page)) {
-                                if (page_huge_active(page))
+                                if (hugepage_migration_supported(page_hstate(page)) &&
+                                    page_huge_active(page))
                                         return pfn;
                                 else
                                         pfn = round_up(pfn + 1,
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b5b25e4dcbbb..f10aa5360616 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -522,6 +522,7 @@ bool __oom_reap_task_mm(struct mm_struct *mm)
 
                         tlb_gather_mmu(&tlb, mm, start, end);
                         if (mmu_notifier_invalidate_range_start_nonblock(mm, start, end)) {
+                                tlb_finish_mmu(&tlb, start, end);
                                 ret = false;
                                 continue;
                         }
@@ -1103,10 +1104,17 @@ bool out_of_memory(struct oom_control *oc)
         }
 
         select_bad_process(oc);
-        /* Found nothing?!?! Either we hang forever, or we panic. */
-        if (!oc->chosen && !is_sysrq_oom(oc) && !is_memcg_oom(oc)) {
+        /* Found nothing?!?! */
+        if (!oc->chosen) {
                 dump_header(oc, NULL);
-                panic("Out of memory and no killable processes...\n");
+                pr_warn("Out of memory and no killable processes...\n");
+                /*
+                 * If we got here due to an actual allocation at the
+                 * system level, we cannot survive this and will enter
+                 * an endless loop in the allocator. Bail out now.
+                 */
+                if (!is_sysrq_oom(oc) && !is_memcg_oom(oc))
+                        panic("System is deadlocked on memory\n");
         }
         if (oc->chosen && oc->chosen != (void *)-1UL)
                 oom_kill_process(oc, !is_memcg_oom(oc) ? "Out of memory" :
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 05e983f42316..89d2a2ab3fe6 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -7708,6 +7708,10 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
                  * handle each tail page individually in migration.
                  */
                 if (PageHuge(page)) {
+
+                        if (!hugepage_migration_supported(page_hstate(page)))
+                                goto unmovable;
+
                         iter = round_up(iter + 1, 1<<compound_order(page)) - 1;
                         continue;
                 }
diff --git a/mm/util.c b/mm/util.c
index d2890a407332..9e3ebd2ef65f 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -435,11 +435,14 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node)
 EXPORT_SYMBOL(kvmalloc_node);
 
 /**
- * kvfree - free memory allocated with kvmalloc
- * @addr: pointer returned by kvmalloc
+ * kvfree() - Free memory.
+ * @addr: Pointer to allocated memory.
  *
- * If the memory is allocated from vmalloc area it is freed with vfree().
- * Otherwise kfree() is used.
+ * kvfree frees memory allocated by any of vmalloc(), kmalloc() or kvmalloc().
+ * It is slightly more efficient to use kfree() or vfree() if you are certain
+ * that you know which one to use.
+ *
+ * Context: Any context except NMI.
  */
 void kvfree(const void *addr)
 {
diff --git a/net/core/filter.c b/net/core/filter.c
index c25eb36f1320..aecdeba052d3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2282,14 +2282,21 @@ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
         .arg2_type      = ARG_ANYTHING,
 };
 
+#define sk_msg_iter_var(var)                    \
+        do {                                    \
+                var++;                          \
+                if (var == MAX_SKB_FRAGS)       \
+                        var = 0;                \
+        } while (0)
+
 BPF_CALL_4(bpf_msg_pull_data,
            struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags)
 {
-        unsigned int len = 0, offset = 0, copy = 0;
+        unsigned int len = 0, offset = 0, copy = 0, poffset = 0;
+        int bytes = end - start, bytes_sg_total;
         struct scatterlist *sg = msg->sg_data;
         int first_sg, last_sg, i, shift;
         unsigned char *p, *to, *from;
-        int bytes = end - start;
         struct page *page;
 
         if (unlikely(flags || end <= start))
@@ -2299,21 +2306,22 @@ BPF_CALL_4(bpf_msg_pull_data,
         i = msg->sg_start;
         do {
                 len = sg[i].length;
-                offset += len;
                 if (start < offset + len)
                         break;
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
+                offset += len;
+                sk_msg_iter_var(i);
         } while (i != msg->sg_end);
 
         if (unlikely(start >= offset + len))
                 return -EINVAL;
 
-        if (!msg->sg_copy[i] && bytes <= len)
-                goto out;
-
         first_sg = i;
+        /* The start may point into the sg element so we need to also
+         * account for the headroom.
+         */
+        bytes_sg_total = start - offset + bytes;
+        if (!msg->sg_copy[i] && bytes_sg_total <= len)
+                goto out;
 
         /* At this point we need to linearize multiple scatterlist
          * elements or a single shared page. Either way we need to
@@ -2327,37 +2335,32 @@ BPF_CALL_4(bpf_msg_pull_data,
          */
         do {
                 copy += sg[i].length;
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
-                if (bytes < copy)
+                sk_msg_iter_var(i);
+                if (bytes_sg_total <= copy)
                         break;
         } while (i != msg->sg_end);
         last_sg = i;
 
-        if (unlikely(copy < end - start))
+        if (unlikely(bytes_sg_total > copy))
                 return -EINVAL;
 
         page = alloc_pages(__GFP_NOWARN | GFP_ATOMIC, get_order(copy));
         if (unlikely(!page))
                 return -ENOMEM;
         p = page_address(page);
-        offset = 0;
 
         i = first_sg;
         do {
                 from = sg_virt(&sg[i]);
                 len = sg[i].length;
-                to = p + offset;
+                to = p + poffset;
 
                 memcpy(to, from, len);
-                offset += len;
+                poffset += len;
                 sg[i].length = 0;
                 put_page(sg_page(&sg[i]));
 
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
+                sk_msg_iter_var(i);
         } while (i != last_sg);
 
         sg[first_sg].length = copy;
@@ -2367,11 +2370,15 @@ BPF_CALL_4(bpf_msg_pull_data,
          * had a single entry though we can just replace it and
          * be done. Otherwise walk the ring and shift the entries.
          */
-        shift = last_sg - first_sg - 1;
+        WARN_ON_ONCE(last_sg == first_sg);
+        shift = last_sg > first_sg ?
+                last_sg - first_sg - 1 :
+                MAX_SKB_FRAGS - first_sg + last_sg - 1;
         if (!shift)
                 goto out;
 
-        i = first_sg + 1;
+        i = first_sg;
+        sk_msg_iter_var(i);
         do {
                 int move_from;
 
@@ -2388,15 +2395,13 @@ BPF_CALL_4(bpf_msg_pull_data,
                 sg[move_from].page_link = 0;
                 sg[move_from].offset = 0;
 
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
+                sk_msg_iter_var(i);
         } while (1);
         msg->sg_end -= shift;
         if (msg->sg_end < 0)
                 msg->sg_end += MAX_SKB_FRAGS;
 out:
-        msg->data = sg_virt(&sg[i]) + start - offset;
+        msg->data = sg_virt(&sg[first_sg]) + start - offset;
         msg->data_end = msg->data + bytes;
 
         return 0;
@@ -7281,7 +7286,7 @@ static u32 sk_reuseport_convert_ctx_access(enum bpf_access_type type,
                 break;
 
         case offsetof(struct sk_reuseport_md, ip_protocol):
-                BUILD_BUG_ON(hweight_long(SK_FL_PROTO_MASK) != BITS_PER_BYTE);
+                BUILD_BUG_ON(HWEIGHT32(SK_FL_PROTO_MASK) != BITS_PER_BYTE);
                 SK_REUSEPORT_LOAD_SK_FIELD_SIZE_OFF(__sk_flags_offset,
                                                     BPF_W, 0);
                 *insn++ = BPF_ALU32_IMM(BPF_AND, si->dst_reg, SK_FL_PROTO_MASK);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 24431e578310..60c928894a78 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -324,6 +324,10 @@ void rtnl_unregister_all(int protocol)
 
         rtnl_lock();
         tab = rtnl_msg_handlers[protocol];
+        if (!tab) {
+                rtnl_unlock();
+                return;
+        }
         RCU_INIT_POINTER(rtnl_msg_handlers[protocol], NULL);
         for (msgindex = 0; msgindex < RTM_NR_MSGTYPES; msgindex++) {
                 link = tab[msgindex];
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index e63c554e0623..9f3209ff7ffd 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -19,12 +19,10 @@
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
 #include <linux/of_net.h>
-#include <linux/of_gpio.h>
 #include <linux/netdevice.h>
 #include <linux/sysfs.h>
 #include <linux/phy_fixed.h>
 #include <linux/ptp_classify.h>
-#include <linux/gpio/consumer.h>
 #include <linux/etherdevice.h>
 
 #include "dsa_priv.h"
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index cf75f8944b05..4da39446da2d 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -820,10 +820,9 @@ static void igmp_timer_expire(struct timer_list *t)
         spin_lock(&im->lock);
         im->tm_running = 0;
 
-        if (im->unsolicit_count) {
-                im->unsolicit_count--;
+        if (im->unsolicit_count && --im->unsolicit_count)
                 igmp_start_timer(im, unsolicited_report_interval(in_dev));
-        }
+
         im->reporter = 1;
         spin_unlock(&im->lock);
 
@@ -1308,6 +1307,8 @@ static void igmp_group_added(struct ip_mc_list *im)
 
         if (in_dev->dead)
                 return;
+
+        im->unsolicit_count = net->ipv4.sysctl_igmp_qrv;
         if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
                 spin_lock_bh(&im->lock);
                 igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
@@ -1391,9 +1392,6 @@ static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
                               unsigned int mode)
 {
         struct ip_mc_list *im;
-#ifdef CONFIG_IP_MULTICAST
-        struct net *net = dev_net(in_dev->dev);
-#endif
 
         ASSERT_RTNL();
 
@@ -1420,7 +1418,6 @@ static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
         timer_setup(&im->timer, igmp_timer_expire, 0);
-        im->unsolicit_count = net->ipv4.sysctl_igmp_qrv;
 #endif
 
         im->next_rcu = in_dev->mc_list;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 51a5d06085ac..ae714aecc31c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1508,11 +1508,14 @@ nla_put_failure:
 
 static void erspan_setup(struct net_device *dev)
 {
+        struct ip_tunnel *t = netdev_priv(dev);
+
         ether_setup(dev);
         dev->netdev_ops = &erspan_netdev_ops;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
         ip_tunnel_setup(dev, erspan_net_id);
+        t->erspan_ver = 1;
 }
 
 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 75ef332a7caf..12affb7864d9 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -184,8 +184,9 @@ kill:
                                 inet_twsk_deschedule_put(tw);
                                 return TCP_TW_SUCCESS;
                         }
+                } else {
+                        inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
                 }
-                inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
 
                 if (tmp_opt.saw_tstamp) {
                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 673bba31eb18..9a4261e50272 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -938,14 +938,14 @@ static int __init inet6_init(void)
 
         err = proto_register(&pingv6_prot, 1);
         if (err)
-                goto out_unregister_ping_proto;
+                goto out_unregister_raw_proto;
 
         /* We MUST register RAW sockets before we create the ICMP6,
          * IGMP6, or NDISC control sockets.
          */
         err = rawv6_init();
         if (err)
-                goto out_unregister_raw_proto;
+                goto out_unregister_ping_proto;
 
         /* Register the family here so that the init calls below will
          * be able to create sockets. (?? is this dangerous ??)
@@ -1113,11 +1113,11 @@ netfilter_fail:
 igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
-        ip6_mr_cleanup();
+        icmpv6_cleanup();
 icmp_fail:
-        unregister_pernet_subsys(&inet6_net_ops);
+        ip6_mr_cleanup();
 ipmr_fail:
-        icmpv6_cleanup();
+        unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index c861a6d4671d..5516f55e214b 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -989,7 +989,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                                         fib6_clean_expires(iter);
                                 else
                                         fib6_set_expires(iter, rt->expires);
-                                fib6_metric_set(iter, RTAX_MTU, rt->fib6_pmtu);
+
+                                if (rt->fib6_pmtu)
+                                        fib6_metric_set(iter, RTAX_MTU,
+                                                        rt->fib6_pmtu);
                                 return -EEXIST;
                         }
                         /* If we have the same destination and the same metric,
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 18a3794b0f52..e493b041d4ac 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1778,6 +1778,7 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
         if (data[IFLA_GRE_COLLECT_METADATA])
                 parms->collect_md = true;
 
+        parms->erspan_ver = 1;
         if (data[IFLA_GRE_ERSPAN_VER])
                 parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 5df2a58d945c..419960b0ba16 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1188,7 +1188,15 @@ route_lookup:
                 init_tel_txopt(&opt, encap_limit);
                 ipv6_push_frag_opts(skb, &opt.ops, &proto);
         }
-        hop_limit = hop_limit ? : ip6_dst_hoplimit(dst);
+
+        if (hop_limit == 0) {
+                if (skb->protocol == htons(ETH_P_IP))
+                        hop_limit = ip_hdr(skb)->ttl;
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        hop_limit = ipv6_hdr(skb)->hop_limit;
+                else
+                        hop_limit = ip6_dst_hoplimit(dst);
+        }
 
         /* Calculate max headroom for all the headers and adjust
          * needed_headroom if necessary.
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 5095367c7204..eeaf7455d51e 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -481,7 +481,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         }
 
         mtu = dst_mtu(dst);
-        if (!skb->ignore_df && skb->len > mtu) {
+        if (skb->len > mtu) {
                 skb_dst_update_pmtu(skb, mtu);
 
                 if (skb->protocol == htons(ETH_P_IPV6)) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c4ea13e8360b..18e00ce1719a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
         rt->rt6i_src = ort->fib6_src;
 #endif
         rt->rt6i_prefsrc = ort->fib6_prefsrc;
-        rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate);
 }
 
 static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6449a1c2283b..f0f5fedb8caa 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
         if (len < IEEE80211_DEAUTH_FRAME_LEN)
                 return;
 
-        ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, reason);
+        ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
         sta_info_destroy_addr(sdata, mgmt->sa);
 }
 
@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 
-        ibss_dbg(sdata,
-                 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
+        ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
+                 mgmt->bssid, auth_transaction);
 
         if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                 return;
@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 rx_timestamp = drv_get_tsf(local, sdata);
         }
 
-        ibss_dbg(sdata,
-                 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+        ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
                  mgmt->sa, mgmt->bssid,
-                 (unsigned long long)rx_timestamp,
+                 (unsigned long long)rx_timestamp);
+        ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
                  (unsigned long long)beacon_timestamp,
                  (unsigned long long)(rx_timestamp - beacon_timestamp),
                  jiffies);
@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 
         tx_last_beacon = drv_tx_last_beacon(local);
 
-        ibss_dbg(sdata,
-                 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
-                 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
+        ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+        ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
+                 mgmt->bssid, tx_last_beacon);
 
         if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4fb2709cb527..513627896204 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -256,8 +256,27 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         flush_work(&local->radar_detected_work);
         rtnl_lock();
-        list_for_each_entry(sdata, &local->interfaces, list)
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                /*
+                 * XXX: there may be more work for other vif types and even
+                 * for station mode: a good thing would be to run most of
+                 * the iface type's dependent _stop (ieee80211_mg_stop,
+                 * ieee80211_ibss_stop) etc...
+                 * For now, fix only the specific bug that was seen: race
+                 * between csa_connection_drop_work and us.
+                 */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        /*
+                         * This worker is scheduled from the iface worker that
+                         * runs on mac80211's workqueue, so we can't be
+                         * scheduling this worker after the cancel right here.
+                         * The exception is ieee80211_chswitch_done.
+                         * Then we can have a race...
+                         */
+                        cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+                }
                 flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+        }
         ieee80211_scan_cancel(local);
 
         /* make sure any new ROC will consider local->in_reconfig */
@@ -471,10 +490,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
                 cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
                             IEEE80211_VHT_CAP_SHORT_GI_80 |
                             IEEE80211_VHT_CAP_SHORT_GI_160 |
-                            IEEE80211_VHT_CAP_RXSTBC_1 |
-                            IEEE80211_VHT_CAP_RXSTBC_2 |
-                            IEEE80211_VHT_CAP_RXSTBC_3 |
-                            IEEE80211_VHT_CAP_RXSTBC_4 |
+                            IEEE80211_VHT_CAP_RXSTBC_MASK |
                             IEEE80211_VHT_CAP_TXSTBC |
                             IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
                             IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
@@ -1208,6 +1224,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&local->ifa6_notifier);
 #endif
+        ieee80211_txq_teardown_flows(local);
 
         rtnl_lock();
 
@@ -1236,7 +1253,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
         skb_queue_purge(&local->skb_queue_tdls_chsw);
-        ieee80211_txq_teardown_flows(local);
 
         destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 35ad3983ae4b..daf9db3c8f24 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 forward = false;
                 reply = true;
                 target_metric = 0;
+
+                if (SN_GT(target_sn, ifmsh->sn))
+                        ifmsh->sn = target_sn;
+
                 if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
                     time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7fb9957359a3..3dbecae4be73 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1073,6 +1073,10 @@ static void ieee80211_chswitch_work(struct work_struct *work)
          */
 
         if (sdata->reserved_chanctx) {
+                struct ieee80211_supported_band *sband = NULL;
+                struct sta_info *mgd_sta = NULL;
+                enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
+
                 /*
                  * with multi-vif csa driver may call ieee80211_csa_finish()
                  * many times while waiting for other interfaces to use their
@@ -1081,6 +1085,48 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 if (sdata->reserved_ready)
                         goto out;
 
+                if (sdata->vif.bss_conf.chandef.width !=
+                    sdata->csa_chandef.width) {
+                        /*
+                         * For managed interface, we need to also update the AP
+                         * station bandwidth and align the rate scale algorithm
+                         * on the bandwidth change. Here we only consider the
+                         * bandwidth of the new channel definition (as channel
+                         * switch flow does not have the full HT/VHT/HE
+                         * information), assuming that if additional changes are
+                         * required they would be done as part of the processing
+                         * of the next beacon from the AP.
+                         */
+                        switch (sdata->csa_chandef.width) {
+                        case NL80211_CHAN_WIDTH_20_NOHT:
+                        case NL80211_CHAN_WIDTH_20:
+                        default:
+                                bw = IEEE80211_STA_RX_BW_20;
+                                break;
+                        case NL80211_CHAN_WIDTH_40:
+                                bw = IEEE80211_STA_RX_BW_40;
+                                break;
+                        case NL80211_CHAN_WIDTH_80:
+                                bw = IEEE80211_STA_RX_BW_80;
+                                break;
+                        case NL80211_CHAN_WIDTH_80P80:
+                        case NL80211_CHAN_WIDTH_160:
+                                bw = IEEE80211_STA_RX_BW_160;
+                                break;
+                        }
+
+                        mgd_sta = sta_info_get(sdata, ifmgd->bssid);
+                        sband =
+                                local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
+                }
+
+                if (sdata->vif.bss_conf.chandef.width >
+                    sdata->csa_chandef.width) {
+                        mgd_sta->sta.bandwidth = bw;
+                        rate_control_rate_update(local, sband, mgd_sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                }
+
                 ret = ieee80211_vif_use_reserved_context(sdata);
                 if (ret) {
                         sdata_info(sdata,
@@ -1091,6 +1137,13 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                         goto out;
                 }
 
+                if (sdata->vif.bss_conf.chandef.width <
+                    sdata->csa_chandef.width) {
+                        mgd_sta->sta.bandwidth = bw;
+                        rate_control_rate_update(local, sband, mgd_sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                }
+
                 goto out;
         }
 
@@ -1312,6 +1365,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                          cbss->beacon_interval));
         return;
  drop_connection:
+        /*
+         * This is just so that the disconnect flow will know that
+         * we were trying to switch channel and failed. In case the
+         * mode is 1 (we are not allowed to Tx), we will know not to
+         * send a deauthentication frame. Those two fields will be
+         * reset when the disconnection worker runs.
+         */
+        sdata->vif.csa_active = true;
+        sdata->csa_block_tx = csa_ie.mode;
+
         ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
         mutex_unlock(&local->chanctx_mtx);
         mutex_unlock(&local->mtx);
@@ -2522,6 +2585,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
+        bool tx;
 
         sdata_lock(sdata);
         if (!ifmgd->associated) {
@@ -2529,6 +2593,8 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
+        tx = !sdata->csa_block_tx;
+
         /* AP is probably out of range (or not reachable for another reason) so
          * remove the bss struct for that AP.
          */
@@ -2536,7 +2602,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                               true, frame_buf);
+                               tx, frame_buf);
         mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
         ifmgd->csa_waiting_bcn = false;
@@ -2547,7 +2613,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         }
         mutex_unlock(&local->mtx);
 
-        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
+        ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
                                     WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
 
         sdata_unlock(sdata);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 64742f2765c4..96611d5dfadb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1728,6 +1728,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          */
         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
             !ieee80211_has_morefrags(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1) &&
             (ieee80211_is_mgmt(hdr->frame_control) ||
              ieee80211_is_data(hdr->frame_control)) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index cd332e3e1134..f353d9db54bc 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3078,27 +3078,18 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta)
 }
 
 static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
-                                        struct sk_buff *skb, int headroom,
-                                        int *subframe_len)
+                                        struct sk_buff *skb, int headroom)
 {
-        int amsdu_len = *subframe_len + sizeof(struct ethhdr);
-        int padding = (4 - amsdu_len) & 3;
-
-        if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
+        if (skb_headroom(skb) < headroom) {
                 I802_DEBUG_INC(local->tx_expand_skb_head);
 
-                if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
+                if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
                         wiphy_debug(local->hw.wiphy,
                                     "failed to reallocate TX buffer\n");
                         return false;
                 }
         }
 
-        if (padding) {
-                *subframe_len += padding;
-                skb_put_zero(skb, padding);
-        }
-
         return true;
 }
 
@@ -3122,8 +3113,7 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
         if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
                 return true;
 
-        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
-                                         &subframe_len))
+        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
                 return false;
 
         data = skb_push(skb, sizeof(*amsdu_hdr));
@@ -3189,7 +3179,8 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         void *data;
         bool ret = false;
         unsigned int orig_len;
-        int n = 1, nfrags;
+        int n = 2, nfrags, pad = 0;
+        u16 hdrlen;
 
         if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
                 return false;
@@ -3222,9 +3213,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (skb->len + head->len > max_amsdu_len)
                 goto out;
 
-        if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
-                goto out;
-
         nfrags = 1 + skb_shinfo(skb)->nr_frags;
         nfrags += 1 + skb_shinfo(head)->nr_frags;
         frag_tail = &skb_shinfo(head)->frag_list;
@@ -3240,10 +3228,24 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (max_frags && nfrags > max_frags)
                 goto out;
 
-        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
-                                         &subframe_len))
+        if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
                 goto out;
 
+        /*
+         * Pad out the previous subframe to a multiple of 4 by adding the
+         * padding to the next one, that's being added. Note that head->len
+         * is the length of the full A-MSDU, but that works since each time
+         * we add a new subframe we pad out the previous one to a multiple
+         * of 4 and thus it no longer matters in the next round.
+         */
+        hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
+        if ((head->len - hdrlen) & 3)
+                pad = 4 - ((head->len - hdrlen) & 3);
+
+        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
+                                                     2 + pad))
+                goto out_recalc;
+
         ret = true;
         data = skb_push(skb, ETH_ALEN + 2);
         memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
@@ -3253,15 +3255,19 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         memcpy(data, &len, 2);
         memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
 
+        memset(skb_push(skb, pad), 0, pad);
+
         head->len += skb->len;
         head->data_len += skb->len;
         *frag_tail = skb;
 
-        flow->backlog += head->len - orig_len;
-        tin->backlog_bytes += head->len - orig_len;
-
-        fq_recalc_backlog(fq, tin, flow);
+out_recalc:
+        if (head->len != orig_len) {
+                flow->backlog += head->len - orig_len;
+                tin->backlog_bytes += head->len - orig_len;
 
+                fq_recalc_backlog(fq, tin, flow);
+        }
 out:
         spin_unlock_bh(&fq->lock);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 88efda7c9f8a..716cd6442d86 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1135,7 +1135,7 @@ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_chanctx_conf *chanctx_conf;
         const struct ieee80211_reg_rule *rrule;
-        struct ieee80211_wmm_ac *wmm_ac;
+        const struct ieee80211_wmm_ac *wmm_ac;
         u16 center_freq = 0;
 
         if (sdata->vif.type != NL80211_IFTYPE_AP &&
@@ -1154,20 +1154,19 @@ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
 
         rrule = freq_reg_info(sdata->wdev.wiphy, MHZ_TO_KHZ(center_freq));
 
-        if (IS_ERR_OR_NULL(rrule) || !rrule->wmm_rule) {
+        if (IS_ERR_OR_NULL(rrule) || !rrule->has_wmm) {
                 rcu_read_unlock();
                 return;
         }
 
         if (sdata->vif.type == NL80211_IFTYPE_AP)
-                wmm_ac = &rrule->wmm_rule->ap[ac];
+                wmm_ac = &rrule->wmm_rule.ap[ac];
         else
-                wmm_ac = &rrule->wmm_rule->client[ac];
+                wmm_ac = &rrule->wmm_rule.client[ac];
         qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
         qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
         qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
-        qparam->txop = !qparam->txop ? wmm_ac->cot / 32 :
-                min_t(u16, qparam->txop, wmm_ac->cot / 32);
+        qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
         rcu_read_unlock();
 }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5610061e7f2e..75c92a87e7b2 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4137,36 +4137,52 @@ static const struct vm_operations_struct packet_mmap_ops = {
         .close  =       packet_mm_close,
 };
 
-static void free_pg_vec(struct pgv *pg_vec, unsigned int len)
+static void free_pg_vec(struct pgv *pg_vec, unsigned int order,
+                        unsigned int len)
 {
         int i;
 
         for (i = 0; i < len; i++) {
                 if (likely(pg_vec[i].buffer)) {
-                        kvfree(pg_vec[i].buffer);
+                        if (is_vmalloc_addr(pg_vec[i].buffer))
+                                vfree(pg_vec[i].buffer);
+                        else
+                                free_pages((unsigned long)pg_vec[i].buffer,
+                                           order);
                         pg_vec[i].buffer = NULL;
                 }
         }
         kfree(pg_vec);
 }
 
-static char *alloc_one_pg_vec_page(unsigned long size)
+static char *alloc_one_pg_vec_page(unsigned long order)
 {
         char *buffer;
+        gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP |
+                          __GFP_ZERO | __GFP_NOWARN | __GFP_NORETRY;
 
-        buffer = kvzalloc(size, GFP_KERNEL);
+        buffer = (char *) __get_free_pages(gfp_flags, order);
         if (buffer)
                 return buffer;
 
-        buffer = kvzalloc(size, GFP_KERNEL | __GFP_RETRY_MAYFAIL);
+        /* __get_free_pages failed, fall back to vmalloc */
+        buffer = vzalloc(array_size((1 << order), PAGE_SIZE));
+        if (buffer)
+                return buffer;
 
-        return buffer;
+        /* vmalloc failed, lets dig into swap here */
+        gfp_flags &= ~__GFP_NORETRY;
+        buffer = (char *) __get_free_pages(gfp_flags, order);
+        if (buffer)
+                return buffer;
+
+        /* complete and utter failure */
+        return NULL;
 }
 
-static struct pgv *alloc_pg_vec(struct tpacket_req *req)
+static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
 {
         unsigned int block_nr = req->tp_block_nr;
-        unsigned long size = req->tp_block_size;
         struct pgv *pg_vec;
         int i;
 
@@ -4175,7 +4191,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req)
                 goto out;
 
         for (i = 0; i < block_nr; i++) {
-                pg_vec[i].buffer = alloc_one_pg_vec_page(size);
+                pg_vec[i].buffer = alloc_one_pg_vec_page(order);
                 if (unlikely(!pg_vec[i].buffer))
                         goto out_free_pgvec;
         }
@@ -4184,7 +4200,7 @@ out:
         return pg_vec;
 
 out_free_pgvec:
-        free_pg_vec(pg_vec, block_nr);
+        free_pg_vec(pg_vec, order, block_nr);
         pg_vec = NULL;
         goto out;
 }
@@ -4194,9 +4210,9 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 {
         struct pgv *pg_vec = NULL;
         struct packet_sock *po = pkt_sk(sk);
+        int was_running, order = 0;
         struct packet_ring_buffer *rb;
         struct sk_buff_head *rb_queue;
-        int was_running;
         __be16 num;
         int err = -EINVAL;
         /* Added to avoid minimal code churn */
@@ -4258,7 +4274,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
 
                 err = -ENOMEM;
-                pg_vec = alloc_pg_vec(req);
+                order = get_order(req->tp_block_size);
+                pg_vec = alloc_pg_vec(req, order);
                 if (unlikely(!pg_vec))
                         goto out;
                 switch (po->tp_version) {
@@ -4312,6 +4329,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frame_size = req->tp_frame_size;
                 spin_unlock_bh(&rb_queue->lock);
 
+                swap(rb->pg_vec_order, order);
                 swap(rb->pg_vec_len, req->tp_block_nr);
 
                 rb->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
@@ -4337,7 +4355,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         }
 
         if (pg_vec)
-                free_pg_vec(pg_vec, req->tp_block_nr);
+                free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
         return err;
 }
diff --git a/net/packet/internal.h b/net/packet/internal.h
index 8f50036f62f0..3bb7c5fb3bff 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -64,6 +64,7 @@ struct packet_ring_buffer {
         unsigned int            frame_size;
         unsigned int            frame_max;
 
+        unsigned int            pg_vec_order;
         unsigned int            pg_vec_pages;
         unsigned int            pg_vec_len;
 
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index 01b3bd6a3708..b9092111bc45 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -1,6 +1,6 @@
 
 config RDS
-        tristate "The RDS Protocol"
+        tristate "The Reliable Datagram Sockets Protocol"
         depends on INET
         ---help---
           The RDS (Reliable Datagram Sockets) protocol provides reliable,
diff --git a/net/rds/ib.c b/net/rds/ib.c
index c1d97640c0be..eba75c1ba359 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -341,15 +341,10 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
 
         if (rds_conn_state(conn) == RDS_CONN_UP) {
                 struct rds_ib_device *rds_ibdev;
-                struct rdma_dev_addr *dev_addr;
 
                 ic = conn->c_transport_data;
-                dev_addr = &ic->i_cm_id->route.addr.dev_addr;
-                rdma_addr_get_sgid(dev_addr,
-                                   (union ib_gid *)&iinfo6->src_gid);
-                rdma_addr_get_dgid(dev_addr,
-                                   (union ib_gid *)&iinfo6->dst_gid);
-
+                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo6->src_gid,
+                               (union ib_gid *)&iinfo6->dst_gid);
                 rds_ibdev = ic->rds_ibdev;
                 iinfo6->max_send_wr = ic->i_send_ring.w_nr;
                 iinfo6->max_recv_wr = ic->i_recv_ring.w_nr;
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 00192a996be0..0f8465852254 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mod_devicetable.h>
 #include <linux/rfkill.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index db83dac1e7f4..e12f8ef7baa4 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -662,6 +662,13 @@ int tcf_action_destroy(struct tc_action *actions[], int bind)
         return ret;
 }
 
+static int tcf_action_destroy_1(struct tc_action *a, int bind)
+{
+        struct tc_action *actions[] = { a, NULL };
+
+        return tcf_action_destroy(actions, bind);
+}
+
 static int tcf_action_put(struct tc_action *p)
 {
         return __tcf_action_put(p, false);
@@ -881,17 +888,16 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
         if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN)) {
                 err = tcf_action_goto_chain_init(a, tp);
                 if (err) {
-                        struct tc_action *actions[] = { a, NULL };
-
-                        tcf_action_destroy(actions, bind);
+                        tcf_action_destroy_1(a, bind);
                         NL_SET_ERR_MSG(extack, "Failed to init TC action chain");
                         return ERR_PTR(err);
                 }
         }
 
         if (!tcf_action_valid(a->tcfa_action)) {
-                NL_SET_ERR_MSG(extack, "invalid action value, using TC_ACT_UNSPEC instead");
-                a->tcfa_action = TC_ACT_UNSPEC;
+                tcf_action_destroy_1(a, bind);
+                NL_SET_ERR_MSG(extack, "Invalid control action value");
+                return ERR_PTR(-EINVAL);
         }
 
         return a;
@@ -1173,6 +1179,7 @@ static int tcf_action_delete(struct net *net, struct tc_action *actions[])
                 struct tcf_idrinfo *idrinfo = a->idrinfo;
                 u32 act_index = a->tcfa_index;
 
+                actions[i] = NULL;
                 if (tcf_action_put(a)) {
                         /* last reference, action was deleted concurrently */
                         module_put(ops->owner);
@@ -1184,7 +1191,6 @@ static int tcf_action_delete(struct net *net, struct tc_action *actions[])
                         if (ret < 0)
                                 return ret;
                 }
-                actions[i] = NULL;
         }
         return 0;
 }
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 196430aefe87..06a3d4801878 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -326,6 +326,20 @@ static int __add_metainfo(const struct tcf_meta_ops *ops,
         return ret;
 }
 
+static int add_metainfo_and_get_ops(const struct tcf_meta_ops *ops,
+                                    struct tcf_ife_info *ife, u32 metaid,
+                                    bool exists)
+{
+        int ret;
+
+        if (!try_module_get(ops->owner))
+                return -ENOENT;
+        ret = __add_metainfo(ops, ife, metaid, NULL, 0, true, exists);
+        if (ret)
+                module_put(ops->owner);
+        return ret;
+}
+
 static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
                         int len, bool exists)
 {
@@ -349,7 +363,7 @@ static int use_all_metadata(struct tcf_ife_info *ife, bool exists)
 
         read_lock(&ife_mod_lock);
         list_for_each_entry(o, &ifeoplist, list) {
-                rc = __add_metainfo(o, ife, o->metaid, NULL, 0, true, exists);
+                rc = add_metainfo_and_get_ops(o, ife, o->metaid, exists);
                 if (rc == 0)
                         installed += 1;
         }
@@ -400,7 +414,6 @@ static void _tcf_ife_cleanup(struct tc_action *a)
         struct tcf_meta_info *e, *n;
 
         list_for_each_entry_safe(e, n, &ife->metalist, metalist) {
-                module_put(e->ops->owner);
                 list_del(&e->metalist);
                 if (e->metaval) {
                         if (e->ops->release)
@@ -408,6 +421,7 @@ static void _tcf_ife_cleanup(struct tc_action *a)
                         else
                                 kfree(e->metaval);
                 }
+                module_put(e->ops->owner);
                 kfree(e);
         }
 }
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 107034070019..ad99a99f11f6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -109,16 +109,18 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb,
 {
         struct nlattr *keys_start = nla_nest_start(skb, TCA_PEDIT_KEYS_EX);
 
+        if (!keys_start)
+                goto nla_failure;
         for (; n > 0; n--) {
                 struct nlattr *key_start;
 
                 key_start = nla_nest_start(skb, TCA_PEDIT_KEY_EX);
+                if (!key_start)
+                        goto nla_failure;
 
                 if (nla_put_u16(skb, TCA_PEDIT_KEY_EX_HTYPE, keys_ex->htype) ||
-                    nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd)) {
-                        nlmsg_trim(skb, keys_start);
-                        return -EINVAL;
-                }
+                    nla_put_u16(skb, TCA_PEDIT_KEY_EX_CMD, keys_ex->cmd))
+                        goto nla_failure;
 
                 nla_nest_end(skb, key_start);
 
@@ -128,6 +130,9 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb,
         nla_nest_end(skb, keys_start);
 
         return 0;
+nla_failure:
+        nla_nest_cancel(skb, keys_start);
+        return -EINVAL;
 }
 
 static int tcf_pedit_init(struct net *net, struct nlattr *nla,
@@ -418,7 +423,10 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
         opt->bindcnt = atomic_read(&p->tcf_bindcnt) - bind;
 
         if (p->tcfp_keys_ex) {
-                tcf_pedit_key_ex_dump(skb, p->tcfp_keys_ex, p->tcfp_nkeys);
+                if (tcf_pedit_key_ex_dump(skb,
+                                          p->tcfp_keys_ex,
+                                          p->tcfp_nkeys))
+                        goto nla_put_failure;
 
                 if (nla_put(skb, TCA_PEDIT_PARMS_EX, s, opt))
                         goto nla_put_failure;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 31bd1439cf60..1a67af8a6e8c 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1252,7 +1252,7 @@ replay:
         }
         chain = tcf_chain_get(block, chain_index, true);
         if (!chain) {
-                NL_SET_ERR_MSG(extack, "Cannot find specified filter chain");
+                NL_SET_ERR_MSG(extack, "Cannot create specified filter chain");
                 err = -ENOMEM;
                 goto errout;
         }
@@ -1399,7 +1399,7 @@ static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
                         goto errout;
                 }
                 NL_SET_ERR_MSG(extack, "Cannot find specified filter chain");
-                err = -EINVAL;
+                err = -ENOENT;
                 goto errout;
         }
 
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index ef5c9a82d4e8..a644292f9faf 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -215,7 +215,6 @@ static const struct seq_operations sctp_eps_ops = {
 struct sctp_ht_iter {
         struct seq_net_private p;
         struct rhashtable_iter hti;
-        int start_fail;
 };
 
 static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
@@ -224,7 +223,6 @@ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
 
         sctp_transport_walk_start(&iter->hti);
 
-        iter->start_fail = 0;
         return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos);
 }
 
@@ -232,8 +230,6 @@ static void sctp_transport_seq_stop(struct seq_file *seq, void *v)
 {
         struct sctp_ht_iter *iter = seq->private;
 
-        if (iter->start_fail)
-                return;
         sctp_transport_walk_stop(&iter->hti);
 }
 
@@ -264,8 +260,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         }
 
         transport = (struct sctp_transport *)v;
-        if (!sctp_transport_hold(transport))
-                return 0;
         assoc = transport->asoc;
         epb = &assoc->base;
         sk = epb->sk;
@@ -322,8 +316,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         }
 
         transport = (struct sctp_transport *)v;
-        if (!sctp_transport_hold(transport))
-                return 0;
         assoc = transport->asoc;
 
         list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e96b15a66aba..f73e9d38d5ba 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2658,20 +2658,23 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
         }
 
         if (params->spp_flags & SPP_IPV6_FLOWLABEL) {
-                if (trans && trans->ipaddr.sa.sa_family == AF_INET6) {
-                        trans->flowlabel = params->spp_ipv6_flowlabel &
-                                           SCTP_FLOWLABEL_VAL_MASK;
-                        trans->flowlabel |= SCTP_FLOWLABEL_SET_MASK;
-                } else if (asoc) {
-                        list_for_each_entry(trans,
-                                            &asoc->peer.transport_addr_list,
-                                            transports) {
-                                if (trans->ipaddr.sa.sa_family != AF_INET6)
-                                        continue;
+                if (trans) {
+                        if (trans->ipaddr.sa.sa_family == AF_INET6) {
                                 trans->flowlabel = params->spp_ipv6_flowlabel &
                                                    SCTP_FLOWLABEL_VAL_MASK;
                                 trans->flowlabel |= SCTP_FLOWLABEL_SET_MASK;
                         }
+                } else if (asoc) {
+                        struct sctp_transport *t;
+
+                        list_for_each_entry(t, &asoc->peer.transport_addr_list,
+                                            transports) {
+                                if (t->ipaddr.sa.sa_family != AF_INET6)
+                                        continue;
+                                t->flowlabel = params->spp_ipv6_flowlabel &
+                                               SCTP_FLOWLABEL_VAL_MASK;
+                                t->flowlabel |= SCTP_FLOWLABEL_SET_MASK;
+                        }
                         asoc->flowlabel = params->spp_ipv6_flowlabel &
                                           SCTP_FLOWLABEL_VAL_MASK;
                         asoc->flowlabel |= SCTP_FLOWLABEL_SET_MASK;
@@ -2687,12 +2690,13 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                         trans->dscp = params->spp_dscp & SCTP_DSCP_VAL_MASK;
                         trans->dscp |= SCTP_DSCP_SET_MASK;
                 } else if (asoc) {
-                        list_for_each_entry(trans,
-                                            &asoc->peer.transport_addr_list,
+                        struct sctp_transport *t;
+
+                        list_for_each_entry(t, &asoc->peer.transport_addr_list,
                                             transports) {
-                                trans->dscp = params->spp_dscp &
-                                              SCTP_DSCP_VAL_MASK;
-                                trans->dscp |= SCTP_DSCP_SET_MASK;
+                                t->dscp = params->spp_dscp &
+                                          SCTP_DSCP_VAL_MASK;
+                                t->dscp |= SCTP_DSCP_SET_MASK;
                         }
                         asoc->dscp = params->spp_dscp & SCTP_DSCP_VAL_MASK;
                         asoc->dscp |= SCTP_DSCP_SET_MASK;
@@ -5005,9 +5009,14 @@ struct sctp_transport *sctp_transport_get_next(struct net *net,
                         break;
                 }
 
+                if (!sctp_transport_hold(t))
+                        continue;
+
                 if (net_eq(sock_net(t->asoc->base.sk), net) &&
                     t->asoc->peer.primary_path == t)
                         break;
+
+                sctp_transport_put(t);
         }
 
         return t;
@@ -5017,13 +5026,18 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net,
                                               struct rhashtable_iter *iter,
                                               int pos)
 {
-        void *obj = SEQ_START_TOKEN;
+        struct sctp_transport *t;
 
-        while (pos && (obj = sctp_transport_get_next(net, iter)) &&
-               !IS_ERR(obj))
-                pos--;
+        if (!pos)
+                return SEQ_START_TOKEN;
 
-        return obj;
+        while ((t = sctp_transport_get_next(net, iter)) && !IS_ERR(t)) {
+                if (!--pos)
+                        break;
+                sctp_transport_put(t);
+        }
+
+        return t;
 }
 
 int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
@@ -5082,8 +5096,6 @@ again:
 
         tsp = sctp_transport_get_idx(net, &hti, *pos + 1);
         for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) {
-                if (!sctp_transport_hold(tsp))
-                        continue;
                 ret = cb(tsp, p);
                 if (ret)
                         break;
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 9ee6cfea56dd..d8026543bf4c 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -51,12 +51,12 @@ const char tipc_bclink_name[] = "broadcast-link";
  * struct tipc_bc_base - base structure for keeping broadcast send state
  * @link: broadcast send link structure
  * @inputq: data input queue; will only carry SOCK_WAKEUP messages
- * @dest: array keeping number of reachable destinations per bearer
+ * @dests: array keeping number of reachable destinations per bearer
  * @primary_bearer: a bearer having links to all broadcast destinations, if any
  * @bcast_support: indicates if primary bearer, if any, supports broadcast
  * @rcast_support: indicates if all peer nodes support replicast
  * @rc_ratio: dest count as percentage of cluster size where send method changes
- * @bc_threshold: calculated drom rc_ratio; if dests > threshold use broadcast
+ * @bc_threshold: calculated from rc_ratio; if dests > threshold use broadcast
  */
 struct tipc_bc_base {
         struct tipc_link *link;
diff --git a/net/tipc/diag.c b/net/tipc/diag.c
index aaabb0b776dd..73137f4aeb68 100644
--- a/net/tipc/diag.c
+++ b/net/tipc/diag.c
@@ -84,7 +84,9 @@ static int tipc_sock_diag_handler_dump(struct sk_buff *skb,
 
         if (h->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
+                        .start = tipc_dump_start,
                         .dump = tipc_diag_dump,
+                        .done = tipc_dump_done,
                 };
                 netlink_dump_start(net->diag_nlsk, skb, h, &c);
                 return 0;
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 88f027b502f6..66d5b2c5987a 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -980,20 +980,17 @@ int tipc_nl_name_table_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
 struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port)
 {
-        u64 value = (u64)node << 32 | port;
         struct tipc_dest *dst;
 
         list_for_each_entry(dst, l, list) {
-                if (dst->value != value)
-                        continue;
-                return dst;
+                if (dst->node == node && dst->port == port)
+                        return dst;
         }
         return NULL;
 }
 
 bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
 {
-        u64 value = (u64)node << 32 | port;
         struct tipc_dest *dst;
 
         if (tipc_dest_find(l, node, port))
@@ -1002,7 +999,8 @@ bool tipc_dest_push(struct list_head *l, u32 node, u32 port)
         dst = kmalloc(sizeof(*dst), GFP_ATOMIC);
         if (unlikely(!dst))
                 return false;
-        dst->value = value;
+        dst->node = node;
+        dst->port = port;
         list_add(&dst->list, l);
         return true;
 }
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 0febba41da86..892bd750b85f 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -133,13 +133,8 @@ void tipc_nametbl_stop(struct net *net);
 
 struct tipc_dest {
         struct list_head list;
-        union {
-                struct {
-                        u32 port;
-                        u32 node;
-                };
-                u64 value;
-        };
+        u32 port;
+        u32 node;
 };
 
 struct tipc_dest *tipc_dest_find(struct list_head *l, u32 node, u32 port);
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 6ff2254088f6..99ee419210ba 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -167,7 +167,9 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
         },
         {
                 .cmd    = TIPC_NL_SOCK_GET,
+                .start = tipc_dump_start,
                 .dumpit = tipc_nl_sk_dump,
+                .done   = tipc_dump_done,
                 .policy = tipc_nl_policy,
         },
         {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index c1e93c9515bc..ab7a2a7178f7 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2672,6 +2672,8 @@ void tipc_sk_reinit(struct net *net)
 
                 rhashtable_walk_stop(&iter);
         } while (tsk == ERR_PTR(-EAGAIN));
+
+        rhashtable_walk_exit(&iter);
 }
 
 static struct tipc_sock *tipc_sk_lookup(struct net *net, u32 portid)
@@ -3227,45 +3229,69 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb,
                                        struct netlink_callback *cb,
                                        struct tipc_sock *tsk))
 {
-        struct net *net = sock_net(skb->sk);
-        struct tipc_net *tn = tipc_net(net);
-        const struct bucket_table *tbl;
-        u32 prev_portid = cb->args[1];
-        u32 tbl_id = cb->args[0];
-        struct rhash_head *pos;
+        struct rhashtable_iter *iter = (void *)cb->args[0];
         struct tipc_sock *tsk;
         int err;
 
-        rcu_read_lock();
-        tbl = rht_dereference_rcu((&tn->sk_rht)->tbl, &tn->sk_rht);
-        for (; tbl_id < tbl->size; tbl_id++) {
-                rht_for_each_entry_rcu(tsk, pos, tbl, tbl_id, node) {
-                        spin_lock_bh(&tsk->sk.sk_lock.slock);
-                        if (prev_portid && prev_portid != tsk->portid) {
-                                spin_unlock_bh(&tsk->sk.sk_lock.slock);
+        rhashtable_walk_start(iter);
+        while ((tsk = rhashtable_walk_next(iter)) != NULL) {
+                if (IS_ERR(tsk)) {
+                        err = PTR_ERR(tsk);
+                        if (err == -EAGAIN) {
+                                err = 0;
                                 continue;
                         }
+                        break;
+                }
 
-                        err = skb_handler(skb, cb, tsk);
-                        if (err) {
-                                prev_portid = tsk->portid;
-                                spin_unlock_bh(&tsk->sk.sk_lock.slock);
-                                goto out;
-                        }
-
-                        prev_portid = 0;
-                        spin_unlock_bh(&tsk->sk.sk_lock.slock);
+                sock_hold(&tsk->sk);
+                rhashtable_walk_stop(iter);
+                lock_sock(&tsk->sk);
+                err = skb_handler(skb, cb, tsk);
+                if (err) {
+                        release_sock(&tsk->sk);
+                        sock_put(&tsk->sk);
+                        goto out;
                 }
+                release_sock(&tsk->sk);
+                rhashtable_walk_start(iter);
+                sock_put(&tsk->sk);
         }
+        rhashtable_walk_stop(iter);
 out:
-        rcu_read_unlock();
-        cb->args[0] = tbl_id;
-        cb->args[1] = prev_portid;
-
         return skb->len;
 }
 EXPORT_SYMBOL(tipc_nl_sk_walk);
 
+int tipc_dump_start(struct netlink_callback *cb)
+{
+        struct rhashtable_iter *iter = (void *)cb->args[0];
+        struct net *net = sock_net(cb->skb->sk);
+        struct tipc_net *tn = tipc_net(net);
+
+        if (!iter) {
+                iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+                if (!iter)
+                        return -ENOMEM;
+
+                cb->args[0] = (long)iter;
+        }
+
+        rhashtable_walk_enter(&tn->sk_rht, iter);
+        return 0;
+}
+EXPORT_SYMBOL(tipc_dump_start);
+
+int tipc_dump_done(struct netlink_callback *cb)
+{
+        struct rhashtable_iter *hti = (void *)cb->args[0];
+
+        rhashtable_walk_exit(hti);
+        kfree(hti);
+        return 0;
+}
+EXPORT_SYMBOL(tipc_dump_done);
+
 int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct netlink_callback *cb,
                            struct tipc_sock *tsk, u32 sk_filter_state,
                            u64 (*tipc_diag_gen_cookie)(struct sock *sk))
diff --git a/net/tipc/socket.h b/net/tipc/socket.h
index aff9b2ae5a1f..d43032e26532 100644
--- a/net/tipc/socket.h
+++ b/net/tipc/socket.h
@@ -68,4 +68,6 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb,
                     int (*skb_handler)(struct sk_buff *skb,
                                        struct netlink_callback *cb,
                                        struct tipc_sock *tsk));
+int tipc_dump_start(struct netlink_callback *cb);
+int tipc_dump_done(struct netlink_callback *cb);
 #endif
diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index c8e34ef22c30..2627b5d812e9 100644
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -313,8 +313,8 @@ static void tipc_conn_send_work(struct work_struct *work)
         conn_put(con);
 }
 
-/* tipc_conn_queue_evt() - interrupt level call from a subscription instance
- * The queued work is launched into tipc_send_work()->tipc_send_to_sock()
+/* tipc_topsrv_queue_evt() - interrupt level call from a subscription instance
+ * The queued work is launched into tipc_conn_send_work()->tipc_conn_send_to_sock()
  */
 void tipc_topsrv_queue_evt(struct net *net, int conid,
                            u32 event, struct tipc_event *evt)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5fb9b7dd9831..4b8ec659e797 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -669,13 +669,13 @@ static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
                         goto nla_put_failure;
 
                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
-                                rule->wmm_rule->client[j].cw_min) ||
+                                rule->wmm_rule.client[j].cw_min) ||
                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
-                                rule->wmm_rule->client[j].cw_max) ||
+                                rule->wmm_rule.client[j].cw_max) ||
                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
-                               rule->wmm_rule->client[j].aifsn) ||
-                    nla_put_u8(msg, NL80211_WMMR_TXOP,
-                               rule->wmm_rule->client[j].cot))
+                               rule->wmm_rule.client[j].aifsn) ||
+                    nla_put_u16(msg, NL80211_WMMR_TXOP,
+                                rule->wmm_rule.client[j].cot))
                         goto nla_put_failure;
 
                 nla_nest_end(msg, nl_wmm_rule);
@@ -766,9 +766,9 @@ static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 
         if (large) {
                 const struct ieee80211_reg_rule *rule =
-                        freq_reg_info(wiphy, chan->center_freq);
+                        freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 
-                if (!IS_ERR(rule) && rule->wmm_rule) {
+                if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
                         if (nl80211_msg_put_wmm_rules(msg, rule))
                                 goto nla_put_failure;
                 }
@@ -12205,6 +12205,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_MDID] ||
+            !info->attrs[NL80211_ATTR_IE] ||
             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4fc66a117b7d..2f702adf2912 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -425,36 +425,23 @@ static const struct ieee80211_regdomain *
 reg_copy_regd(const struct ieee80211_regdomain *src_regd)
 {
         struct ieee80211_regdomain *regd;
-        int size_of_regd, size_of_wmms;
+        int size_of_regd;
         unsigned int i;
-        struct ieee80211_wmm_rule *d_wmm, *s_wmm;
 
         size_of_regd =
                 sizeof(struct ieee80211_regdomain) +
                 src_regd->n_reg_rules * sizeof(struct ieee80211_reg_rule);
-        size_of_wmms = src_regd->n_wmm_rules *
-                sizeof(struct ieee80211_wmm_rule);
 
-        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!regd)
                 return ERR_PTR(-ENOMEM);
 
         memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
 
-        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
-        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)src_regd + size_of_regd);
-        memcpy(d_wmm, s_wmm, size_of_wmms);
-
-        for (i = 0; i < src_regd->n_reg_rules; i++) {
+        for (i = 0; i < src_regd->n_reg_rules; i++)
                 memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
                        sizeof(struct ieee80211_reg_rule));
-                if (!src_regd->reg_rules[i].wmm_rule)
-                        continue;
 
-                regd->reg_rules[i].wmm_rule = d_wmm +
-                        (src_regd->reg_rules[i].wmm_rule - s_wmm) /
-                        sizeof(struct ieee80211_wmm_rule);
-        }
         return regd;
 }
 
@@ -860,9 +847,10 @@ static bool valid_regdb(const u8 *data, unsigned int size)
         return true;
 }
 
-static void set_wmm_rule(struct ieee80211_wmm_rule *rule,
+static void set_wmm_rule(struct ieee80211_reg_rule *rrule,
                          struct fwdb_wmm_rule *wmm)
 {
+        struct ieee80211_wmm_rule *rule = &rrule->wmm_rule;
         unsigned int i;
 
         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
@@ -876,11 +864,13 @@ static void set_wmm_rule(struct ieee80211_wmm_rule *rule,
                 rule->ap[i].aifsn = wmm->ap[i].aifsn;
                 rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
         }
+
+        rrule->has_wmm = true;
 }
 
 static int __regdb_query_wmm(const struct fwdb_header *db,
                              const struct fwdb_country *country, int freq,
-                             u32 *dbptr, struct ieee80211_wmm_rule *rule)
+                             struct ieee80211_reg_rule *rule)
 {
         unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
         struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
@@ -901,8 +891,6 @@ static int __regdb_query_wmm(const struct fwdb_header *db,
                         wmm_ptr = be16_to_cpu(rrule->wmm_ptr) << 2;
                         wmm = (void *)((u8 *)db + wmm_ptr);
                         set_wmm_rule(rule, wmm);
-                        if (dbptr)
-                                *dbptr = wmm_ptr;
                         return 0;
                 }
         }
@@ -910,8 +898,7 @@ static int __regdb_query_wmm(const struct fwdb_header *db,
         return -ENODATA;
 }
 
-int reg_query_regdb_wmm(char *alpha2, int freq, u32 *dbptr,
-                        struct ieee80211_wmm_rule *rule)
+int reg_query_regdb_wmm(char *alpha2, int freq, struct ieee80211_reg_rule *rule)
 {
         const struct fwdb_header *hdr = regdb;
         const struct fwdb_country *country;
@@ -925,8 +912,7 @@ int reg_query_regdb_wmm(char *alpha2, int freq, u32 *dbptr,
         country = &hdr->country[0];
         while (country->coll_ptr) {
                 if (alpha2_equal(alpha2, country->alpha2))
-                        return __regdb_query_wmm(regdb, country, freq, dbptr,
-                                                 rule);
+                        return __regdb_query_wmm(regdb, country, freq, rule);
 
                 country++;
         }
@@ -935,32 +921,13 @@ int reg_query_regdb_wmm(char *alpha2, int freq, u32 *dbptr,
 }
 EXPORT_SYMBOL(reg_query_regdb_wmm);
 
-struct wmm_ptrs {
-        struct ieee80211_wmm_rule *rule;
-        u32 ptr;
-};
-
-static struct ieee80211_wmm_rule *find_wmm_ptr(struct wmm_ptrs *wmm_ptrs,
-                                               u32 wmm_ptr, int n_wmms)
-{
-        int i;
-
-        for (i = 0; i < n_wmms; i++) {
-                if (wmm_ptrs[i].ptr == wmm_ptr)
-                        return wmm_ptrs[i].rule;
-        }
-        return NULL;
-}
-
 static int regdb_query_country(const struct fwdb_header *db,
                                const struct fwdb_country *country)
 {
         unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
         struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
         struct ieee80211_regdomain *regdom;
-        struct ieee80211_regdomain *tmp_rd;
-        unsigned int size_of_regd, i, n_wmms = 0;
-        struct wmm_ptrs *wmm_ptrs;
+        unsigned int size_of_regd, i;
 
         size_of_regd = sizeof(struct ieee80211_regdomain) +
                 coll->n_rules * sizeof(struct ieee80211_reg_rule);
@@ -969,12 +936,6 @@ static int regdb_query_country(const struct fwdb_header *db,
         if (!regdom)
                 return -ENOMEM;
 
-        wmm_ptrs = kcalloc(coll->n_rules, sizeof(*wmm_ptrs), GFP_KERNEL);
-        if (!wmm_ptrs) {
-                kfree(regdom);
-                return -ENOMEM;
-        }
-
         regdom->n_reg_rules = coll->n_rules;
         regdom->alpha2[0] = country->alpha2[0];
         regdom->alpha2[1] = country->alpha2[1];
@@ -1013,37 +974,11 @@ static int regdb_query_country(const struct fwdb_header *db,
                                 1000 * be16_to_cpu(rule->cac_timeout);
                 if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr)) {
                         u32 wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
-                        struct ieee80211_wmm_rule *wmm_pos =
-                                find_wmm_ptr(wmm_ptrs, wmm_ptr, n_wmms);
-                        struct fwdb_wmm_rule *wmm;
-                        struct ieee80211_wmm_rule *wmm_rule;
-
-                        if (wmm_pos) {
-                                rrule->wmm_rule = wmm_pos;
-                                continue;
-                        }
-                        wmm = (void *)((u8 *)db + wmm_ptr);
-                        tmp_rd = krealloc(regdom, size_of_regd + (n_wmms + 1) *
-                                          sizeof(struct ieee80211_wmm_rule),
-                                          GFP_KERNEL);
-
-                        if (!tmp_rd) {
-                                kfree(regdom);
-                                kfree(wmm_ptrs);
-                                return -ENOMEM;
-                        }
-                        regdom = tmp_rd;
-
-                        wmm_rule = (struct ieee80211_wmm_rule *)
-                                ((u8 *)regdom + size_of_regd + n_wmms *
-                                sizeof(struct ieee80211_wmm_rule));
+                        struct fwdb_wmm_rule *wmm = (void *)((u8 *)db + wmm_ptr);
 
-                        set_wmm_rule(wmm_rule, wmm);
-                        wmm_ptrs[n_wmms].ptr = wmm_ptr;
-                        wmm_ptrs[n_wmms++].rule = wmm_rule;
+                        set_wmm_rule(rrule, wmm);
                 }
         }
-        kfree(wmm_ptrs);
 
         return reg_schedule_apply(regdom);
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e0825a019e9f..959ed3acd240 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1456,7 +1456,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
                                           u8 *op_class)
 {
         u8 vht_opclass;
-        u16 freq = chandef->center_freq1;
+        u32 freq = chandef->center_freq1;
 
         if (freq >= 2412 && freq <= 2472) {
                 if (chandef->width > NL80211_CHAN_WIDTH_40)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 5219280bf7ff..161b0224d6ae 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -380,6 +380,7 @@ our $Attribute	= qr{
                         __noclone|
                         __deprecated|
                         __read_mostly|
+                        __ro_after_init|
                         __kprobes|
                         $InitAttribute|
                         ____cacheline_aligned|
@@ -3311,7 +3312,7 @@ sub process {
                         # known declaration macros
                       $sline =~ /^\+\s+$declaration_macros/ ||
                         # start of struct or union or enum
-                      $sline =~ /^\+\s+(?:union|struct|enum|typedef)\b/ ||
+                      $sline =~ /^\+\s+(?:static\s+)?(?:const\s+)?(?:union|struct|enum|typedef)\b/ ||
                         # start or end of block or continuation of declaration
                       $sline =~ /^\+\s+(?:$|[\{\}\.\#\"\?\:\(\[])/ ||
                         # bitfield continuation
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index 999d585eaa73..e083bcae343f 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -11,13 +11,14 @@ DEPMOD=$1
 KERNELRELEASE=$2
 
 if ! test -r System.map ; then
+        echo "Warning: modules_install: missing 'System.map' file. Skipping depmod." >&2
         exit 0
 fi
 
 if [ -z $(command -v $DEPMOD) ]; then
-        echo "'make modules_install' requires $DEPMOD. Please install it." >&2
+        echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
         echo "This is probably in the kmod package." >&2
-        exit 1
+        exit 0
 fi
 
 # older versions of depmod require the version string to start with three
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 4a7bd2192073..67ed9f6ccdf8 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -221,7 +221,6 @@ $(obj)/zconf.tab.o: $(obj)/zconf.lex.c
 
 # check if necessary packages are available, and configure build flags
 define filechk_conf_cfg
-        $(CONFIG_SHELL) $(srctree)/scripts/kconfig/check-pkgconfig.sh; \
         $(CONFIG_SHELL) $<
 endef
 
diff --git a/scripts/kconfig/check-pkgconfig.sh b/scripts/kconfig/check-pkgconfig.sh
deleted file mode 100644
index 7a1c40bfb58c..000000000000
--- a/scripts/kconfig/check-pkgconfig.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0
-# Check for pkg-config presence
-
-if [ -z $(command -v pkg-config) ]; then
-        echo "'make *config' requires 'pkg-config'. Please install it." 1>&2
-        exit 1
-fi
diff --git a/scripts/kconfig/gconf-cfg.sh b/scripts/kconfig/gconf-cfg.sh
index 533b3d8f8f08..480ecd8b9f41 100755
--- a/scripts/kconfig/gconf-cfg.sh
+++ b/scripts/kconfig/gconf-cfg.sh
@@ -3,6 +3,13 @@
 
 PKG="gtk+-2.0 gmodule-2.0 libglade-2.0"
 
+if [ -z "$(command -v pkg-config)" ]; then
+        echo >&2 "*"
+        echo >&2 "* 'make gconfig' requires 'pkg-config'. Please install it."
+        echo >&2 "*"
+        exit 1
+fi
+
 if ! pkg-config --exists $PKG; then
         echo >&2 "*"
         echo >&2 "* Unable to find the GTK+ installation. Please make sure that"
diff --git a/scripts/kconfig/mconf-cfg.sh b/scripts/kconfig/mconf-cfg.sh
index e6f9facd0077..c812872d7f9d 100755
--- a/scripts/kconfig/mconf-cfg.sh
+++ b/scripts/kconfig/mconf-cfg.sh
@@ -4,20 +4,23 @@
 PKG="ncursesw"
 PKG2="ncurses"
 
-if pkg-config --exists $PKG; then
-        echo cflags=\"$(pkg-config --cflags $PKG)\"
-        echo libs=\"$(pkg-config --libs $PKG)\"
-        exit 0
-fi
+if [ -n "$(command -v pkg-config)" ]; then
+        if pkg-config --exists $PKG; then
+                echo cflags=\"$(pkg-config --cflags $PKG)\"
+                echo libs=\"$(pkg-config --libs $PKG)\"
+                exit 0
+        fi
 
-if pkg-config --exists $PKG2; then
-        echo cflags=\"$(pkg-config --cflags $PKG2)\"
-        echo libs=\"$(pkg-config --libs $PKG2)\"
-        exit 0
+        if pkg-config --exists $PKG2; then
+                echo cflags=\"$(pkg-config --cflags $PKG2)\"
+                echo libs=\"$(pkg-config --libs $PKG2)\"
+                exit 0
+        fi
 fi
 
-# Unfortunately, some distributions (e.g. openSUSE) cannot find ncurses
-# by pkg-config.
+# Check the default paths in case pkg-config is not installed.
+# (Even if it is installed, some distributions such as openSUSE cannot
+# find ncurses by pkg-config.)
 if [ -f /usr/include/ncursesw/ncurses.h ]; then
         echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
         echo libs=\"-lncursesw\"
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 83b5836615fb..143c05fec161 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -490,7 +490,6 @@ static void build_conf(struct menu *menu)
                         switch (prop->type) {
                         case P_MENU:
                                 child_count++;
-                                prompt = prompt;
                                 if (single_menu_mode) {
                                         item_make("%s%*c%s",
                                                   menu->data ? "-->" : "++>",
diff --git a/scripts/kconfig/nconf-cfg.sh b/scripts/kconfig/nconf-cfg.sh
index 42f5ac73548e..001559ef0a60 100644
--- a/scripts/kconfig/nconf-cfg.sh
+++ b/scripts/kconfig/nconf-cfg.sh
@@ -4,20 +4,23 @@
 PKG="ncursesw menuw panelw"
 PKG2="ncurses menu panel"
 
-if pkg-config --exists $PKG; then
-        echo cflags=\"$(pkg-config --cflags $PKG)\"
-        echo libs=\"$(pkg-config --libs $PKG)\"
-        exit 0
-fi
+if [ -n "$(command -v pkg-config)" ]; then
+        if pkg-config --exists $PKG; then
+                echo cflags=\"$(pkg-config --cflags $PKG)\"
+                echo libs=\"$(pkg-config --libs $PKG)\"
+                exit 0
+        fi
 
-if pkg-config --exists $PKG2; then
-        echo cflags=\"$(pkg-config --cflags $PKG2)\"
-        echo libs=\"$(pkg-config --libs $PKG2)\"
-        exit 0
+        if pkg-config --exists $PKG2; then
+                echo cflags=\"$(pkg-config --cflags $PKG2)\"
+                echo libs=\"$(pkg-config --libs $PKG2)\"
+                exit 0
+        fi
 fi
 
-# Unfortunately, some distributions (e.g. openSUSE) cannot find ncurses
-# by pkg-config.
+# Check the default paths in case pkg-config is not installed.
+# (Even if it is installed, some distributions such as openSUSE cannot
+# find ncurses by pkg-config.)
 if [ -f /usr/include/ncursesw/ncurses.h ]; then
         echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
         echo libs=\"-lncursesw -lmenuw -lpanelw\"
diff --git a/scripts/kconfig/qconf-cfg.sh b/scripts/kconfig/qconf-cfg.sh
index 0862e1562536..02ccc0ae1031 100755
--- a/scripts/kconfig/qconf-cfg.sh
+++ b/scripts/kconfig/qconf-cfg.sh
@@ -4,6 +4,13 @@
 PKG="Qt5Core Qt5Gui Qt5Widgets"
 PKG2="QtCore QtGui"
 
+if [ -z "$(command -v pkg-config)" ]; then
+        echo >&2 "*"
+        echo >&2 "* 'make xconfig' requires 'pkg-config'. Please install it."
+        echo >&2 "*"
+        exit 1
+fi
+
 if pkg-config --exists $PKG; then
         echo cflags=\"-std=c++11 -fPIC $(pkg-config --cflags Qt5Core Qt5Gui Qt5Widgets)\"
         echo libs=\"$(pkg-config --libs $PKG)\"
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index fe06e77c15eb..f599031260d5 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -389,6 +389,9 @@ if ($arch eq "x86_64") {
     $mcount_regex = "^\\s*([0-9a-fA-F]+):\\sR_RISCV_CALL\\s_mcount\$";
     $type = ".quad";
     $alignment = 2;
+} elsif ($arch eq "nds32") {
+    $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_NDS32_HI20_RELA\\s+_mcount\$";
+    $alignment = 2;
 } else {
     die "Arch $arch is not supported with CONFIG_FTRACE_MCOUNT_RECORD";
 }
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 71f39410691b..79f7dd57d571 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -74,7 +74,7 @@ scm_version()
                 fi
 
                 # Check for uncommitted changes
-                if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
+                if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
                         printf '%s' -dirty
                 fi
 
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index f2f22d00db18..4ccec1bcf6f5 100644
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -79,7 +79,6 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
         struct aa_label *label = aa_secid_to_label(secid);
         int len;
 
-        AA_BUG(!secdata);
         AA_BUG(!seclen);
 
         if (!label)
diff --git a/security/keys/dh.c b/security/keys/dh.c
index 711e89d8c415..3b602a1e27fa 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -300,7 +300,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
         }
         dh_inputs.g_size = dlen;
 
-        dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+        dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key);
         if (dlen < 0) {
                 ret = dlen;
                 goto out2;
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 69517e18ef07..08d5662039e3 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
                 runtime->avail = 0;
         else
                 runtime->avail = runtime->buffer_size;
-        runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL);
+        runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
         if (!runtime->buffer) {
                 kfree(runtime);
                 return -ENOMEM;
@@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
         if (params->avail_min < 1 || params->avail_min > params->buffer_size)
                 return -EINVAL;
         if (params->buffer_size != runtime->buffer_size) {
-                newbuf = kvmalloc(params->buffer_size, GFP_KERNEL);
+                newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
                 if (!newbuf)
                         return -ENOMEM;
                 spin_lock_irq(&runtime->lock);
diff --git a/sound/hda/ext/hdac_ext_stream.c b/sound/hda/ext/hdac_ext_stream.c
index 1bd27576db98..a835558ddbc9 100644
--- a/sound/hda/ext/hdac_ext_stream.c
+++ b/sound/hda/ext/hdac_ext_stream.c
@@ -146,7 +146,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_decouple);
  */
 void snd_hdac_ext_link_stream_start(struct hdac_ext_stream *stream)
 {
-        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL, 0, AZX_PPLCCTL_RUN);
+        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL,
+                         AZX_PPLCCTL_RUN, AZX_PPLCCTL_RUN);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_link_stream_start);
 
@@ -171,7 +172,8 @@ void snd_hdac_ext_link_stream_reset(struct hdac_ext_stream *stream)
 
         snd_hdac_ext_link_stream_clear(stream);
 
-        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL, 0, AZX_PPLCCTL_STRST);
+        snd_hdac_updatel(stream->pplc_addr, AZX_REG_PPLCCTL,
+                         AZX_PPLCCTL_STRST, AZX_PPLCCTL_STRST);
         udelay(3);
         timeout = 50;
         do {
@@ -242,7 +244,7 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_link_set_stream_id);
 void snd_hdac_ext_link_clear_stream_id(struct hdac_ext_link *link,
                                  int stream)
 {
-        snd_hdac_updatew(link->ml_addr, AZX_REG_ML_LOSIDV, 0, (1 << stream));
+        snd_hdac_updatew(link->ml_addr, AZX_REG_ML_LOSIDV, (1 << stream), 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_link_clear_stream_id);
 
@@ -415,7 +417,6 @@ void snd_hdac_ext_stream_spbcap_enable(struct hdac_bus *bus,
                                  bool enable, int index)
 {
         u32 mask = 0;
-        u32 register_mask = 0;
 
         if (!bus->spbcap) {
                 dev_err(bus->dev, "Address of SPB capability is NULL\n");
@@ -424,12 +425,8 @@ void snd_hdac_ext_stream_spbcap_enable(struct hdac_bus *bus,
 
         mask |= (1 << index);
 
-        register_mask = readl(bus->spbcap + AZX_REG_SPB_SPBFCCTL);
-
-        mask |= register_mask;
-
         if (enable)
-                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, 0, mask);
+                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, mask);
         else
                 snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, 0);
 }
@@ -503,7 +500,6 @@ void snd_hdac_ext_stream_drsm_enable(struct hdac_bus *bus,
                                 bool enable, int index)
 {
         u32 mask = 0;
-        u32 register_mask = 0;
 
         if (!bus->drsmcap) {
                 dev_err(bus->dev, "Address of DRSM capability is NULL\n");
@@ -512,12 +508,8 @@ void snd_hdac_ext_stream_drsm_enable(struct hdac_bus *bus,
 
         mask |= (1 << index);
 
-        register_mask = readl(bus->drsmcap + AZX_REG_SPB_SPBFCCTL);
-
-        mask |= register_mask;
-
         if (enable)
-                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, 0, mask);
+                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, mask, mask);
         else
                 snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, mask, 0);
 }
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 0a5085537034..26d348b47867 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3935,7 +3935,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus)
 
         list_for_each_codec(codec, bus) {
                 /* FIXME: maybe a better way needed for forced reset */
-                cancel_delayed_work_sync(&codec->jackpoll_work);
+                if (current_work() != &codec->jackpoll_work.work)
+                        cancel_delayed_work_sync(&codec->jackpoll_work);
 #ifdef CONFIG_PM
                 if (hda_codec_is_power_on(codec)) {
                         hda_call_codec_suspend(codec);
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index b2ec20e562bd..b455930a3eaf 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -68,6 +68,7 @@ static const char * const map_type_name[] = {
         [BPF_MAP_TYPE_DEVMAP]           = "devmap",
         [BPF_MAP_TYPE_SOCKMAP]          = "sockmap",
         [BPF_MAP_TYPE_CPUMAP]           = "cpumap",
+        [BPF_MAP_TYPE_XSKMAP]           = "xskmap",
         [BPF_MAP_TYPE_SOCKHASH]         = "sockhash",
         [BPF_MAP_TYPE_CGROUP_STORAGE]   = "cgroup_storage",
 };
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index 56c4b3f8a01b..439b8a27488d 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -759,12 +759,18 @@ class DebugfsProvider(Provider):
             if len(vms) == 0:
                 self.do_read = False
 
-            self.paths = filter(lambda x: "{}-".format(pid) in x, vms)
+            self.paths = list(filter(lambda x: "{}-".format(pid) in x, vms))
 
         else:
             self.paths = []
             self.do_read = True
-        self.reset()
+
+    def _verify_paths(self):
+        """Remove invalid paths"""
+        for path in self.paths:
+            if not os.path.exists(os.path.join(PATH_DEBUGFS_KVM, path)):
+                self.paths.remove(path)
+                continue
 
     def read(self, reset=0, by_guest=0):
         """Returns a dict with format:'file name / field -> current value'.
@@ -780,6 +786,7 @@ class DebugfsProvider(Provider):
         # If no debugfs filtering support is available, then don't read.
         if not self.do_read:
             return results
+        self._verify_paths()
 
         paths = self.paths
         if self._pid == 0:
@@ -1096,15 +1103,16 @@ class Tui(object):
             pid = self.stats.pid_filter
         self.screen.erase()
         gname = self.get_gname_from_pid(pid)
+        self._gname = gname
         if gname:
             gname = ('({})'.format(gname[:MAX_GUEST_NAME_LEN] + '...'
                                    if len(gname) > MAX_GUEST_NAME_LEN
                                    else gname))
         if pid > 0:
-            self.screen.addstr(0, 0, 'kvm statistics - pid {0} {1}'
-                               .format(pid, gname), curses.A_BOLD)
+            self._headline = 'kvm statistics - pid {0} {1}'.format(pid, gname)
         else:
-            self.screen.addstr(0, 0, 'kvm statistics - summary', curses.A_BOLD)
+            self._headline = 'kvm statistics - summary'
+        self.screen.addstr(0, 0, self._headline, curses.A_BOLD)
         if self.stats.fields_filter:
             regex = self.stats.fields_filter
             if len(regex) > MAX_REGEX_LEN:
@@ -1162,6 +1170,19 @@ class Tui(object):
 
             return sorted_items
 
+        if not self._is_running_guest(self.stats.pid_filter):
+            if self._gname:
+                try: # ...to identify the guest by name in case it's back
+                    pids = self.get_pid_from_gname(self._gname)
+                    if len(pids) == 1:
+                        self._refresh_header(pids[0])
+                        self._update_pid(pids[0])
+                        return
+                except:
+                    pass
+            self._display_guest_dead()
+            # leave final data on screen
+            return
         row = 3
         self.screen.move(row, 0)
         self.screen.clrtobot()
@@ -1184,6 +1205,7 @@ class Tui(object):
         # print events
         tavg = 0
         tcur = 0
+        guest_removed = False
         for key, values in get_sorted_events(self, stats):
             if row >= self.screen.getmaxyx()[0] - 1 or values == (0, 0):
                 break
@@ -1191,7 +1213,10 @@ class Tui(object):
                 key = self.get_gname_from_pid(key)
                 if not key:
                     continue
-            cur = int(round(values.delta / sleeptime)) if values.delta else ''
+            cur = int(round(values.delta / sleeptime)) if values.delta else 0
+            if cur < 0:
+                guest_removed = True
+                continue
             if key[0] != ' ':
                 if values.delta:
                     tcur += values.delta
@@ -1204,13 +1229,21 @@ class Tui(object):
                                values.value * 100 / float(ltotal), cur))
             row += 1
         if row == 3:
-            self.screen.addstr(4, 1, 'No matching events reported yet')
+            if guest_removed:
+                self.screen.addstr(4, 1, 'Guest removed, updating...')
+            else:
+                self.screen.addstr(4, 1, 'No matching events reported yet')
         if row > 4:
             tavg = int(round(tcur / sleeptime)) if tcur > 0 else ''
             self.screen.addstr(row, 1, '%-40s %10d        %8s' %
                                ('Total', total, tavg), curses.A_BOLD)
         self.screen.refresh()
 
+    def _display_guest_dead(self):
+        marker = '   Guest is DEAD   '
+        y = min(len(self._headline), 80 - len(marker))
+        self.screen.addstr(0, y, marker, curses.A_BLINK | curses.A_STANDOUT)
+
     def _show_msg(self, text):
         """Display message centered text and exit on key press"""
         hint = 'Press any key to continue'
@@ -1219,10 +1252,10 @@ class Tui(object):
         (x, term_width) = self.screen.getmaxyx()
         row = 2
         for line in text:
-            start = (term_width - len(line)) / 2
+            start = (term_width - len(line)) // 2
             self.screen.addstr(row, start, line)
             row += 1
-        self.screen.addstr(row + 1, (term_width - len(hint)) / 2, hint,
+        self.screen.addstr(row + 1, (term_width - len(hint)) // 2, hint,
                            curses.A_STANDOUT)
         self.screen.getkey()
 
@@ -1319,6 +1352,12 @@ class Tui(object):
                 msg = '"' + str(val) + '": Invalid value'
         self._refresh_header()
 
+    def _is_running_guest(self, pid):
+        """Check if pid is still a running process."""
+        if not pid:
+            return True
+        return os.path.isdir(os.path.join('/proc/', str(pid)))
+
     def _show_vm_selection_by_guest(self):
         """Draws guest selection mask.
 
@@ -1346,7 +1385,7 @@ class Tui(object):
             if not guest or guest == '0':
                 break
             if guest.isdigit():
-                if not os.path.isdir(os.path.join('/proc/', guest)):
+                if not self._is_running_guest(guest):
                     msg = '"' + guest + '": Not a running process'
                     continue
                 pid = int(guest)
diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
index f8cc38afffa2..32a194e3e07a 100755
--- a/tools/testing/selftests/net/pmtu.sh
+++ b/tools/testing/selftests/net/pmtu.sh
@@ -46,6 +46,9 @@
 # Kselftest framework requirement - SKIP code is 4.
 ksft_skip=4
 
+# Some systems don't have a ping6 binary anymore
+which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)
+
 tests="
         pmtu_vti6_exception             vti6: PMTU exceptions
         pmtu_vti4_exception             vti4: PMTU exceptions
@@ -274,7 +277,7 @@ test_pmtu_vti6_exception() {
         mtu "${ns_b}" veth_b 4000
         mtu "${ns_a}" vti6_a 5000
         mtu "${ns_b}" vti6_b 5000
-        ${ns_a} ping6 -q -i 0.1 -w 2 -s 60000 ${vti6_b_addr} > /dev/null
+        ${ns_a} ${ping6} -q -i 0.1 -w 2 -s 60000 ${vti6_b_addr} > /dev/null
 
         # Check that exception was created
         if [ "$(route_get_dst_pmtu_from_exception "${ns_a}" ${vti6_b_addr})" = "" ]; then
@@ -334,7 +337,7 @@ test_pmtu_vti4_link_add_mtu() {
         fail=0
 
         min=68
-        max=$((65528 - 20))
+        max=$((65535 - 20))
         # Check invalid values first
         for v in $((min - 1)) $((max + 1)); do
                 ${ns_a} ip link add vti4_a mtu ${v} type vti local ${veth4_a_addr} remote ${veth4_b_addr} key 10 2>/dev/null
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/police.json b/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
index f03763d81617..30f9b54bd666 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/police.json
@@ -313,6 +313,54 @@
         ]
     },
     {
+        "id": "6aaf",
+        "name": "Add police actions with conform-exceed control pass/pipe [with numeric values]",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 3mbit burst 250k conform-exceed 0/3 index 1",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions get action police index 1",
+        "matchPattern": "action order [0-9]*:  police 0x1 rate 3Mbit burst 250Kb mtu 2Kb action pass/pipe",
+        "matchCount": "1",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
+        "id": "29b1",
+        "name": "Add police actions with conform-exceed control <invalid>/drop",
+        "category": [
+            "actions",
+            "police"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action police",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "$TC actions add action police rate 3mbit burst 250k conform-exceed 10/drop index 1",
+        "expExitCode": "255",
+        "verifyCmd": "$TC actions ls action police",
+        "matchPattern": "action order [0-9]*:  police 0x1 rate 3Mbit burst 250Kb mtu 2Kb action ",
+        "matchCount": "0",
+        "teardown": [
+            "$TC actions flush action police"
+        ]
+    },
+    {
         "id": "c26f",
         "name": "Add police action with invalid peakrate value",
         "category": [
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index 30cb0a0713ff..37908a83ddc2 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -159,12 +159,6 @@ static const char * const page_flag_names[] = {
 };
 
 
-static const char * const debugfs_known_mountpoints[] = {
-        "/sys/kernel/debug",
-        "/debug",
-        0,
-};
-
 /*
  * data structures
  */
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index f82c2eaa859d..334b16db0ebb 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -30,8 +30,8 @@ struct slabinfo {
         int alias;
         int refs;
         int aliases, align, cache_dma, cpu_slabs, destroy_by_rcu;
-        int hwcache_align, object_size, objs_per_slab;
-        int sanity_checks, slab_size, store_user, trace;
+        unsigned int hwcache_align, object_size, objs_per_slab;
+        unsigned int sanity_checks, slab_size, store_user, trace;
         int order, poison, reclaim_account, red_zone;
         unsigned long partial, objects, slabs, objects_partial, objects_total;
         unsigned long alloc_fastpath, alloc_slowpath;
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 91aaf73b00df..ed162a6c57c5 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -1817,18 +1817,6 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *dat
         return 0;
 }
 
-int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
-{
-        unsigned long end = hva + PAGE_SIZE;
-
-        if (!kvm->arch.pgd)
-                return 0;
-
-        trace_kvm_unmap_hva(hva);
-        handle_hva_to_gpa(kvm, hva, end, &kvm_unmap_hva_handler, NULL);
-        return 0;
-}
-
 int kvm_unmap_hva_range(struct kvm *kvm,
                         unsigned long start, unsigned long end)
 {
@@ -1860,13 +1848,20 @@ static int kvm_set_spte_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data
 void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte)
 {
         unsigned long end = hva + PAGE_SIZE;
+        kvm_pfn_t pfn = pte_pfn(pte);
         pte_t stage2_pte;
 
         if (!kvm->arch.pgd)
                 return;
 
         trace_kvm_set_spte_hva(hva);
-        stage2_pte = pfn_pte(pte_pfn(pte), PAGE_S2);
+
+        /*
+         * We've moved a page around, probably through CoW, so let's treat it
+         * just like a translation fault and clean the cache to the PoC.
+         */
+        clean_dcache_guest_page(pfn, PAGE_SIZE);
+        stage2_pte = pfn_pte(pfn, PAGE_S2);
         handle_hva_to_gpa(kvm, hva, end, &kvm_set_spte_handler, &stage2_pte);
 }
 
diff --git a/virt/kvm/arm/trace.h b/virt/kvm/arm/trace.h
index e53b596f483b..57b3edebbb40 100644
--- a/virt/kvm/arm/trace.h
+++ b/virt/kvm/arm/trace.h
@@ -134,21 +134,6 @@ TRACE_EVENT(kvm_mmio_emulate,
                   __entry->vcpu_pc, __entry->instr, __entry->cpsr)
 );
 
-TRACE_EVENT(kvm_unmap_hva,
-        TP_PROTO(unsigned long hva),
-        TP_ARGS(hva),
-
-        TP_STRUCT__entry(
-                __field(        unsigned long,  hva             )
-        ),
-
-        TP_fast_assign(
-                __entry->hva            = hva;
-        ),
-
-        TP_printk("mmu notifier unmap hva: %#08lx", __entry->hva)
-);
-
 TRACE_EVENT(kvm_unmap_hva_range,
         TP_PROTO(unsigned long start, unsigned long end),
         TP_ARGS(start, end),