723 files changed, 7751 insertions, 3854 deletions
diff --git a/.clang-format b/.clang-format
index e6080f5834a3..bc2ffb2a0b53 100644
--- a/.clang-format
+++ b/.clang-format
@@ -72,6 +72,10 @@ ForEachMacros:
  - 'apei_estatus_for_each_section'
  - 'ata_for_each_dev'
  - 'ata_for_each_link'
+  - '__ata_qc_for_each'
+  - 'ata_qc_for_each'
+  - 'ata_qc_for_each_raw'
+  - 'ata_qc_for_each_with_internal'
  - 'ax25_for_each'
  - 'ax25_uid_for_each'
  - 'bio_for_each_integrity_vec'
@@ -85,6 +89,7 @@ ForEachMacros:
  - 'blk_queue_for_each_rl'
  - 'bond_for_each_slave'
  - 'bond_for_each_slave_rcu'
+  - 'bpf_for_each_spilled_reg'
  - 'btree_for_each_safe128'
  - 'btree_for_each_safe32'
  - 'btree_for_each_safe64'
@@ -103,6 +108,8 @@ ForEachMacros:
  - 'drm_atomic_crtc_for_each_plane'
  - 'drm_atomic_crtc_state_for_each_plane'
  - 'drm_atomic_crtc_state_for_each_plane_state'
+  - 'drm_atomic_for_each_plane_damage'
+  - 'drm_connector_for_each_possible_encoder'
  - 'drm_for_each_connector_iter'
  - 'drm_for_each_crtc'
  - 'drm_for_each_encoder'
@@ -121,11 +128,21 @@ ForEachMacros:
  - 'for_each_bio'
  - 'for_each_board_func_rsrc'
  - 'for_each_bvec'
+  - 'for_each_card_components'
+  - 'for_each_card_links'
+  - 'for_each_card_links_safe'
+  - 'for_each_card_prelinks'
+  - 'for_each_card_rtds'
+  - 'for_each_card_rtds_safe'
+  - 'for_each_cgroup_storage_type'
  - 'for_each_child_of_node'
  - 'for_each_clear_bit'
  - 'for_each_clear_bit_from'
  - 'for_each_cmsghdr'
  - 'for_each_compatible_node'
+  - 'for_each_component_dais'
+  - 'for_each_component_dais_safe'
+  - 'for_each_comp_order'
  - 'for_each_console'
  - 'for_each_cpu'
  - 'for_each_cpu_and'
@@ -133,6 +150,10 @@ ForEachMacros:
  - 'for_each_cpu_wrap'
  - 'for_each_dev_addr'
  - 'for_each_dma_cap_mask'
+  - 'for_each_dpcm_be'
+  - 'for_each_dpcm_be_rollback'
+  - 'for_each_dpcm_be_safe'
+  - 'for_each_dpcm_fe'
  - 'for_each_drhd_unit'
  - 'for_each_dss_dev'
  - 'for_each_efi_memory_desc'
@@ -149,6 +170,7 @@ ForEachMacros:
  - 'for_each_iommu'
  - 'for_each_ip_tunnel_rcu'
  - 'for_each_irq_nr'
+  - 'for_each_link_codecs'
  - 'for_each_lru'
  - 'for_each_matching_node'
  - 'for_each_matching_node_and_match'
@@ -160,6 +182,7 @@ ForEachMacros:
  - 'for_each_mem_range_rev'
  - 'for_each_migratetype_order'
  - 'for_each_msi_entry'
+  - 'for_each_msi_entry_safe'
  - 'for_each_net'
  - 'for_each_netdev'
  - 'for_each_netdev_continue'
@@ -183,12 +206,14 @@ ForEachMacros:
  - 'for_each_node_with_property'
  - 'for_each_of_allnodes'
  - 'for_each_of_allnodes_from'
+  - 'for_each_of_cpu_node'
  - 'for_each_of_pci_range'
  - 'for_each_old_connector_in_state'
  - 'for_each_old_crtc_in_state'
  - 'for_each_oldnew_connector_in_state'
  - 'for_each_oldnew_crtc_in_state'
  - 'for_each_oldnew_plane_in_state'
+  - 'for_each_oldnew_plane_in_state_reverse'
  - 'for_each_oldnew_private_obj_in_state'
  - 'for_each_old_plane_in_state'
  - 'for_each_old_private_obj_in_state'
@@ -206,14 +231,17 @@ ForEachMacros:
  - 'for_each_process'
  - 'for_each_process_thread'
  - 'for_each_property_of_node'
+  - 'for_each_registered_fb'
  - 'for_each_reserved_mem_region'
-  - 'for_each_resv_unavail_range'
+  - 'for_each_rtd_codec_dai'
+  - 'for_each_rtd_codec_dai_rollback'
  - 'for_each_rtdcom'
  - 'for_each_rtdcom_safe'
  - 'for_each_set_bit'
  - 'for_each_set_bit_from'
  - 'for_each_sg'
  - 'for_each_sg_page'
+  - 'for_each_sibling_event'
  - '__for_each_thread'
  - 'for_each_thread'
  - 'for_each_zone'
@@ -251,6 +279,8 @@ ForEachMacros:
  - 'hlist_nulls_for_each_entry_from'
  - 'hlist_nulls_for_each_entry_rcu'
  - 'hlist_nulls_for_each_entry_safe'
+  - 'i3c_bus_for_each_i2cdev'
+  - 'i3c_bus_for_each_i3cdev'
  - 'ide_host_for_each_port'
  - 'ide_port_for_each_dev'
  - 'ide_port_for_each_present_dev'
@@ -267,11 +297,14 @@ ForEachMacros:
  - 'kvm_for_each_memslot'
  - 'kvm_for_each_vcpu'
  - 'list_for_each'
+  - 'list_for_each_codec'
+  - 'list_for_each_codec_safe'
  - 'list_for_each_entry'
  - 'list_for_each_entry_continue'
  - 'list_for_each_entry_continue_rcu'
  - 'list_for_each_entry_continue_reverse'
  - 'list_for_each_entry_from'
+  - 'list_for_each_entry_from_rcu'
  - 'list_for_each_entry_from_reverse'
  - 'list_for_each_entry_lockless'
  - 'list_for_each_entry_rcu'
@@ -291,6 +324,7 @@ ForEachMacros:
  - 'media_device_for_each_intf'
  - 'media_device_for_each_link'
  - 'media_device_for_each_pad'
+  - 'nanddev_io_for_each_page'
  - 'netdev_for_each_lower_dev'
  - 'netdev_for_each_lower_private'
  - 'netdev_for_each_lower_private_rcu'
@@ -357,12 +391,14 @@ ForEachMacros:
  - 'sk_nulls_for_each'
  - 'sk_nulls_for_each_from'
  - 'sk_nulls_for_each_rcu'
+  - 'snd_array_for_each'
  - 'snd_pcm_group_for_each_entry'
  - 'snd_soc_dapm_widget_for_each_path'
  - 'snd_soc_dapm_widget_for_each_path_safe'
  - 'snd_soc_dapm_widget_for_each_sink_path'
  - 'snd_soc_dapm_widget_for_each_source_path'
  - 'tb_property_for_each'
+  - 'tcf_exts_for_each_action'
  - 'udp_portaddr_for_each_entry'
  - 'udp_portaddr_for_each_entry_rcu'
  - 'usb_hub_for_each_child'
@@ -371,6 +407,11 @@ ForEachMacros:
  - 'v4l2_m2m_for_each_dst_buf_safe'
  - 'v4l2_m2m_for_each_src_buf'
  - 'v4l2_m2m_for_each_src_buf_safe'
+  - 'virtio_device_for_each_vq'
+  - 'xa_for_each'
+  - 'xas_for_each'
+  - 'xas_for_each_conflict'
+  - 'xas_for_each_marked'
  - 'zorro_for_each_dev'
 #IncludeBlocks: Preserve # Unknown to clang-format-5.0
diff --git a/Documentation/bpf/bpf_design_QA.rst b/Documentation/bpf/bpf_design_QA.rst
index 6780a6d81745..7cc9e368c1e9 100644
--- a/Documentation/bpf/bpf_design_QA.rst
+++ b/Documentation/bpf/bpf_design_QA.rst
@@ -157,12 +157,11 @@ Q: Does BPF have a stable ABI?
 ------------------------------
 A: YES. BPF instructions, arguments to BPF programs, set of helper
 functions and their arguments, recognized return codes are all part
-of ABI. However when tracing programs are using bpf_probe_read() helper
+of ABI. However there is one specific exception to tracing programs
-to walk kernel internal datastructures and compile with kernel
+which are using helpers like bpf_probe_read() to walk kernel internal
-internal headers these accesses can and will break with newer
+data structures and compile with kernel internal headers. Both of these
-kernels. The union bpf_attr -> kern_version is checked at load time
+kernel internals are subject to change and can break with newer kernels
-to prevent accidentally loading kprobe-based bpf programs written
+such that the program needs to be adapted accordingly.
-for a different kernel. Networking programs don't do kern_version check.
 Q: How much stack space a BPF program uses?
 -------------------------------------------
diff --git a/Documentation/core-api/xarray.rst b/Documentation/core-api/xarray.rst
index 6a6d67acaf69..5d54b27c6eba 100644
--- a/Documentation/core-api/xarray.rst
+++ b/Documentation/core-api/xarray.rst
@@ -108,12 +108,13 @@ some, but not all of the other indices changing.
 Sometimes you need to ensure that a subsequent call to :c:func:`xa_store`
 will not need to allocate memory.  The :c:func:`xa_reserve` function
-will store a reserved entry at the indicated index.  Users of the normal
+will store a reserved entry at the indicated index.  Users of the
-API will see this entry as containing ``NULL``.  If you do not need to
+normal API will see this entry as containing ``NULL``.  If you do
-use the reserved entry, you can call :c:func:`xa_release` to remove the
+not need to use the reserved entry, you can call :c:func:`xa_release`
-unused entry.  If another user has stored to the entry in the meantime,
+to remove the unused entry.  If another user has stored to the entry
-:c:func:`xa_release` will do nothing; if instead you want the entry to
+in the meantime, :c:func:`xa_release` will do nothing; if instead you
-become ``NULL``, you should use :c:func:`xa_erase`.
+want the entry to become ``NULL``, you should use :c:func:`xa_erase`.
+Using :c:func:`xa_insert` on a reserved entry will fail.
 If all entries in the array are ``NULL``, the :c:func:`xa_empty` function
 will return ``true``.
@@ -183,6 +184,8 @@ Takes xa_lock internally:
 * :c:func:`xa_store_bh`
 * :c:func:`xa_store_irq`
 * :c:func:`xa_insert`
+ * :c:func:`xa_insert_bh`
+ * :c:func:`xa_insert_irq`
 * :c:func:`xa_erase`
 * :c:func:`xa_erase_bh`
 * :c:func:`xa_erase_irq`
diff --git a/Documentation/devicetree/bindings/arm/cpu-capacity.txt b/Documentation/devicetree/bindings/arm/cpu-capacity.txt
index 84262cdb8d29..96fa46cb133c 100644
--- a/Documentation/devicetree/bindings/arm/cpu-capacity.txt
+++ b/Documentation/devicetree/bindings/arm/cpu-capacity.txt
@@ -235,4 +235,4 @@ cpus {
 ===========================================
 [1] ARM Linux Kernel documentation - CPUs bindings
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
diff --git a/Documentation/devicetree/bindings/arm/idle-states.txt b/Documentation/devicetree/bindings/arm/idle-states.txt
index 8f0937db55c5..45730ba60af5 100644
--- a/Documentation/devicetree/bindings/arm/idle-states.txt
+++ b/Documentation/devicetree/bindings/arm/idle-states.txt
@@ -684,7 +684,7 @@ cpus {
 ===========================================
 [1] ARM Linux Kernel documentation - CPUs bindings
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
 [2] ARM Linux Kernel documentation - PSCI bindings
    Documentation/devicetree/bindings/arm/psci.txt
diff --git a/Documentation/devicetree/bindings/arm/sp810.txt b/Documentation/devicetree/bindings/arm/sp810.txt
index 1b2ab1ff5587..46652bf65147 100644
--- a/Documentation/devicetree/bindings/arm/sp810.txt
+++ b/Documentation/devicetree/bindings/arm/sp810.txt
@@ -4,7 +4,7 @@ SP810 System Controller
 Required properties:
 - compatible:   standard compatible string for a Primecell peripheral,
-                see Documentation/devicetree/bindings/arm/primecell.txt
+                see Documentation/devicetree/bindings/arm/primecell.yaml
                for more details
                should be: "arm,sp810", "arm,primecell"
diff --git a/Documentation/devicetree/bindings/arm/topology.txt b/Documentation/devicetree/bindings/arm/topology.txt
index de9eb0486630..b0d80c0fb265 100644
--- a/Documentation/devicetree/bindings/arm/topology.txt
+++ b/Documentation/devicetree/bindings/arm/topology.txt
@@ -472,4 +472,4 @@ cpus {
 ===============================================================================
 [1] ARM Linux kernel documentation
-    Documentation/devicetree/bindings/arm/cpus.txt
+    Documentation/devicetree/bindings/arm/cpus.yaml
diff --git a/Documentation/devicetree/bindings/clock/marvell,mmp2.txt b/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
index af376a01f2b7..23b52dc02266 100644
--- a/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
+++ b/Documentation/devicetree/bindings/clock/marvell,mmp2.txt
@@ -18,4 +18,4 @@ Required Properties:
 Each clock is assigned an identifier and client nodes use this identifier
 to specify the clock which they consume.
-All these identifier could be found in <dt-bindings/clock/marvell-mmp2.h>.
+All these identifiers could be found in <dt-bindings/clock/marvell,mmp2.h>.
diff --git a/Documentation/devicetree/bindings/display/arm,pl11x.txt b/Documentation/devicetree/bindings/display/arm,pl11x.txt
index ef89ab46b2c9..572fa2773ec4 100644
--- a/Documentation/devicetree/bindings/display/arm,pl11x.txt
+++ b/Documentation/devicetree/bindings/display/arm,pl11x.txt
@@ -1,6 +1,6 @@
 * ARM PrimeCell Color LCD Controller PL110/PL111
-See also Documentation/devicetree/bindings/arm/primecell.txt
+See also Documentation/devicetree/bindings/arm/primecell.yaml
 Required properties:
diff --git a/Documentation/devicetree/bindings/display/msm/gpu.txt b/Documentation/devicetree/bindings/display/msm/gpu.txt
index ac8df3b871f9..f8759145ce1a 100644
--- a/Documentation/devicetree/bindings/display/msm/gpu.txt
+++ b/Documentation/devicetree/bindings/display/msm/gpu.txt
@@ -27,7 +27,6 @@ Example:
                reg = <0x04300000 0x20000>;
                reg-names = "kgsl_3d0_reg_memory";
                interrupts = <GIC_SPI 80 0>;
-                interrupt-names = "kgsl_3d0_irq";
                clock-names =
                    "core",
                    "iface",
diff --git a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
index 38ca2201e8ae..2e097b57f170 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
@@ -14,8 +14,6 @@ Required properties:
    "marvell,armada-8k-gpio" should be used for the Armada 7K and 8K
    SoCs (either from AP or CP), see
-    Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
-    and
    Documentation/devicetree/bindings/arm/marvell/ap806-system-controller.txt
    for specific details about the offset property.
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
index b83bb8249074..a3be5298a5eb 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
@@ -78,7 +78,7 @@ Sub-nodes:
 PPI affinity can be expressed as a single "ppi-partitions" node,
 containing a set of sub-nodes, each with the following property:
 - affinity: Should be a list of phandles to CPU nodes (as described in
-Documentation/devicetree/bindings/arm/cpus.txt).
+  Documentation/devicetree/bindings/arm/cpus.yaml).
 GICv3 has one or more Interrupt Translation Services (ITS) that are
 used to route Message Signalled Interrupts (MSI) to the CPUs.
diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt b/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
index 0b8cc533ca83..cf759e5f9b10 100644
--- a/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
+++ b/Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt
@@ -55,7 +55,7 @@ of these nodes are defined by the individual bindings for the specific function
 = EXAMPLE
 The following example represents the GLINK RPM node on a MSM8996 device, with
 the function for the "rpm_request" channel defined, which is used for
-regualtors and root clocks.
+regulators and root clocks.
        apcs_glb: mailbox@9820000 {
                compatible = "qcom,msm8996-apcs-hmss-global";
diff --git a/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt b/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
index a35af2dafdad..49e1d72d3648 100644
--- a/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
+++ b/Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt
@@ -41,12 +41,12 @@ processor ID) and a string identifier.
 - qcom,local-pid:
        Usage: required
        Value type: <u32>
-        Definition: specifies the identfier of the local endpoint of this edge
+        Definition: specifies the identifier of the local endpoint of this edge
 - qcom,remote-pid:
        Usage: required
        Value type: <u32>
-        Definition: specifies the identfier of the remote endpoint of this edge
+        Definition: specifies the identifier of the remote endpoint of this edge
 = SUBNODES
 Each SMP2P pair contain a set of inbound and outbound entries, these are
diff --git a/Documentation/fb/fbcon.txt b/Documentation/fb/fbcon.txt
index 62af30511a95..60a5ec04e8f0 100644
--- a/Documentation/fb/fbcon.txt
+++ b/Documentation/fb/fbcon.txt
@@ -163,6 +163,14 @@ C. Boot options
        be preserved until there actually is some text is output to the console.
        This option causes fbcon to bind immediately to the fbdev device.
+7. fbcon=logo-pos:<location>
+        The only possible 'location' is 'center' (without quotes), and when
+        given, the bootup logo is moved from the default top-left corner
+        location to the center of the framebuffer. If more than one logo is
+        displayed due to multiple CPUs, the collected line of logos is moved
+        as a whole.
 C. Attaching, Detaching and Unloading
 Before going on to how to attach, detach and unload the framebuffer console, an
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 6a47629ef8ed..59e86de662cd 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -11,19 +11,19 @@ Contents:
   batman-adv
   can
   can_ucan_protocol
-   dpaa2/index
+   device_drivers/freescale/dpaa2/index
-   e100
+   device_drivers/intel/e100
-   e1000
+   device_drivers/intel/e1000
-   e1000e
+   device_drivers/intel/e1000e
-   fm10k
+   device_drivers/intel/fm10k
-   igb
+   device_drivers/intel/igb
-   igbvf
+   device_drivers/intel/igbvf
-   ixgb
+   device_drivers/intel/ixgb
-   ixgbe
+   device_drivers/intel/ixgbe
-   ixgbevf
+   device_drivers/intel/ixgbevf
-   i40e
+   device_drivers/intel/i40e
-   iavf
+   device_drivers/intel/iavf
-   ice
+   device_drivers/intel/ice
   kapi
   z8530book
   msg_zerocopy
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index c9d052e0cf51..2df5894353d6 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -1000,51 +1000,6 @@ The kernel interface functions are as follows:
     size should be set when the call is begun.  tx_total_len may not be less
     than zero.
- (*) Check to see the completion state of a call so that the caller can assess
-     whether it needs to be retried.
-        enum rxrpc_call_completion {
-                RXRPC_CALL_SUCCEEDED,
-                RXRPC_CALL_REMOTELY_ABORTED,
-                RXRPC_CALL_LOCALLY_ABORTED,
-                RXRPC_CALL_LOCAL_ERROR,
-                RXRPC_CALL_NETWORK_ERROR,
-        };
-        int rxrpc_kernel_check_call(struct socket *sock, struct rxrpc_call *call,
-                                    enum rxrpc_call_completion *_compl,
-                                    u32 *_abort_code);
-     On return, -EINPROGRESS will be returned if the call is still ongoing; if
-     it is finished, *_compl will be set to indicate the manner of completion,
-     *_abort_code will be set to any abort code that occurred.  0 will be
-     returned on a successful completion, -ECONNABORTED will be returned if the
-     client failed due to a remote abort and anything else will return an
-     appropriate error code.
-     The caller should look at this information to decide if it's worth
-     retrying the call.
- (*) Retry a client call.
-        int rxrpc_kernel_retry_call(struct socket *sock,
-                                    struct rxrpc_call *call,
-                                    struct sockaddr_rxrpc *srx,
-                                    struct key *key);
-     This attempts to partially reinitialise a call and submit it again while
-     reusing the original call's Tx queue to avoid the need to repackage and
-     re-encrypt the data to be sent.  call indicates the call to retry, srx the
-     new address to send it to and key the encryption key to use for signing or
-     encrypting the packets.
-     For this to work, the first Tx data packet must still be in the transmit
-     queue, and currently this is only permitted for local and network errors
-     and the call must not have been aborted.  Any partially constructed Tx
-     packet is left as is and can continue being filled afterwards.
-     It returns 0 if the call was requeued and an error otherwise.
 (*) Get call RTT.
        u64 rxrpc_kernel_get_rtt(struct socket *sock, struct rxrpc_call *call);
diff --git a/Documentation/networking/snmp_counter.rst b/Documentation/networking/snmp_counter.rst
index b0dfdaaca512..fe8f741193be 100644
--- a/Documentation/networking/snmp_counter.rst
+++ b/Documentation/networking/snmp_counter.rst
@@ -336,7 +336,26 @@ time client replies ACK, this socket will get another chance to move
 to the accept queue.
-TCP Fast Open
+* TcpEstabResets
+Defined in `RFC1213 tcpEstabResets`_.
+.. _RFC1213 tcpEstabResets: https://tools.ietf.org/html/rfc1213#page-48
+* TcpAttemptFails
+Defined in `RFC1213 tcpAttemptFails`_.
+.. _RFC1213 tcpAttemptFails: https://tools.ietf.org/html/rfc1213#page-48
+* TcpOutRsts
+Defined in `RFC1213 tcpOutRsts`_. The RFC says this counter indicates
+the 'segments sent containing the RST flag', but in linux kernel, this
+couner indicates the segments kerenl tried to send. The sending
+process might be failed due to some errors (e.g. memory alloc failed).
+.. _RFC1213 tcpOutRsts: https://tools.ietf.org/html/rfc1213#page-52
+TCP Fast Path
 ============
 When kernel receives a TCP packet, it has two paths to handler the
 packet, one is fast path, another is slow path. The comment in kernel
@@ -383,8 +402,6 @@ increase 1.
 TCP abort
 ========
 * TcpExtTCPAbortOnData
 It means TCP layer has data in flight, but need to close the
 connection. So TCP layer sends a RST to the other side, indicate the
@@ -545,7 +562,6 @@ packet yet, the sender would know packet 4 is out of order. The TCP
 stack of kernel will increase TcpExtTCPSACKReorder for both of the
 above scenarios.
 DSACK
 =====
 The DSACK is defined in `RFC2883`_. The receiver uses DSACK to report
@@ -566,13 +582,63 @@ The TCP stack receives an out of order duplicate packet, so it sends a
 DSACK to the sender.
 * TcpExtTCPDSACKRecv
-The TCP stack receives a DSACK, which indicate an acknowledged
+The TCP stack receives a DSACK, which indicates an acknowledged
 duplicate packet is received.
 * TcpExtTCPDSACKOfoRecv
 The TCP stack receives a DSACK, which indicate an out of order
 duplicate packet is received.
+invalid SACK and DSACK
+====================
+When a SACK (or DSACK) block is invalid, a corresponding counter would
+be updated. The validation method is base on the start/end sequence
+number of the SACK block. For more details, please refer the comment
+of the function tcp_is_sackblock_valid in the kernel source code. A
+SACK option could have up to 4 blocks, they are checked
+individually. E.g., if 3 blocks of a SACk is invalid, the
+corresponding counter would be updated 3 times. The comment of the
+`Add counters for discarded SACK blocks`_ patch has additional
+explaination:
+.. _Add counters for discarded SACK blocks: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=18f02545a9a16c9a89778b91a162ad16d510bb32
+* TcpExtTCPSACKDiscard
+This counter indicates how many SACK blocks are invalid. If the invalid
+SACK block is caused by ACK recording, the TCP stack will only ignore
+it and won't update this counter.
+* TcpExtTCPDSACKIgnoredOld and TcpExtTCPDSACKIgnoredNoUndo
+When a DSACK block is invalid, one of these two counters would be
+updated. Which counter will be updated depends on the undo_marker flag
+of the TCP socket. If the undo_marker is not set, the TCP stack isn't
+likely to re-transmit any packets, and we still receive an invalid
+DSACK block, the reason might be that the packet is duplicated in the
+middle of the network. In such scenario, TcpExtTCPDSACKIgnoredNoUndo
+will be updated. If the undo_marker is set, TcpExtTCPDSACKIgnoredOld
+will be updated. As implied in its name, it might be an old packet.
+SACK shift
+=========
+The linux networking stack stores data in sk_buff struct (skb for
+short). If a SACK block acrosses multiple skb, the TCP stack will try
+to re-arrange data in these skb. E.g. if a SACK block acknowledges seq
+10 to 15, skb1 has seq 10 to 13, skb2 has seq 14 to 20. The seq 14 and
+15 in skb2 would be moved to skb1. This operation is 'shift'. If a
+SACK block acknowledges seq 10 to 20, skb1 has seq 10 to 13, skb2 has
+seq 14 to 20. All data in skb2 will be moved to skb1, and skb2 will be
+discard, this operation is 'merge'.
+* TcpExtTCPSackShifted
+A skb is shifted
+* TcpExtTCPSackMerged
+A skb is merged
+* TcpExtTCPSackShiftFallback
+A skb should be shifted or merged, but the TCP stack doesn't do it for
+some reasons.
 TCP out of order
 ===============
 * TcpExtTCPOFOQueue
@@ -662,6 +728,60 @@ unacknowledged number (more strict than `RFC 5961 section 5.2`_).
 .. _RFC 5961 section 4.2: https://tools.ietf.org/html/rfc5961#page-9
 .. _RFC 5961 section 5.2: https://tools.ietf.org/html/rfc5961#page-11
+TCP receive window
+=================
+* TcpExtTCPWantZeroWindowAdv
+Depending on current memory usage, the TCP stack tries to set receive
+window to zero. But the receive window might still be a no-zero
+value. For example, if the previous window size is 10, and the TCP
+stack receives 3 bytes, the current window size would be 7 even if the
+window size calculated by the memory usage is zero.
+* TcpExtTCPToZeroWindowAdv
+The TCP receive window is set to zero from a no-zero value.
+* TcpExtTCPFromZeroWindowAdv
+The TCP receive window is set to no-zero value from zero.
+Delayed ACK
+==========
+The TCP Delayed ACK is a technique which is used for reducing the
+packet count in the network. For more details, please refer the
+`Delayed ACK wiki`_
+.. _Delayed ACK wiki: https://en.wikipedia.org/wiki/TCP_delayed_acknowledgment
+* TcpExtDelayedACKs
+A delayed ACK timer expires. The TCP stack will send a pure ACK packet
+and exit the delayed ACK mode.
+* TcpExtDelayedACKLocked
+A delayed ACK timer expires, but the TCP stack can't send an ACK
+immediately due to the socket is locked by a userspace program. The
+TCP stack will send a pure ACK later (after the userspace program
+unlock the socket). When the TCP stack sends the pure ACK later, the
+TCP stack will also update TcpExtDelayedACKs and exit the delayed ACK
+mode.
+* TcpExtDelayedACKLost
+It will be updated when the TCP stack receives a packet which has been
+ACKed. A Delayed ACK loss might cause this issue, but it would also be
+triggered by other reasons, such as a packet is duplicated in the
+network.
+Tail Loss Probe (TLP)
+===================
+TLP is an algorithm which is used to detect TCP packet loss. For more
+details, please refer the `TLP paper`_.
+.. _TLP paper: https://tools.ietf.org/html/draft-dukkipati-tcpm-tcp-loss-probe-01
+* TcpExtTCPLossProbes
+A TLP probe packet is sent.
+* TcpExtTCPLossProbeRecovery
+A packet loss is detected and recovered by TLP.
 examples
 =======
diff --git a/Documentation/networking/timestamping.txt b/Documentation/networking/timestamping.txt
index 1be0b6f9e0cb..9d1432e0aaa8 100644
--- a/Documentation/networking/timestamping.txt
+++ b/Documentation/networking/timestamping.txt
@@ -417,7 +417,7 @@ is again deprecated and ts[2] holds a hardware timestamp if set.
 Hardware time stamping must also be initialized for each device driver
 that is expected to do hardware time stamping. The parameter is defined in
-/include/linux/net_tstamp.h as:
+include/uapi/linux/net_tstamp.h as:
 struct hwtstamp_config {
        int flags;      /* no flags defined right now, must be zero */
@@ -487,7 +487,7 @@ enum {
        HWTSTAMP_FILTER_PTP_V1_L4_EVENT,
        /* for the complete list of values, please check
-         * the include file /include/linux/net_tstamp.h
+         * the include file include/uapi/linux/net_tstamp.h
         */
 };
diff --git a/MAINTAINERS b/MAINTAINERS
index 3b9e50a50c14..d20cf119ec1d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3052,8 +3052,8 @@ F:	include/linux/bcm963xx_nvram.h
 F:      include/linux/bcm963xx_tag.h
 BROADCOM BNX2 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
+M:      Rasesh Mody <rmody@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2.*
@@ -3072,9 +3072,9 @@ S:	Supported
 F:      drivers/scsi/bnx2i/
 BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-M:      Ariel Elior <ariel.elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
-M:      everest-linux-l2@cavium.com
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bnx2x/
@@ -3249,9 +3249,9 @@ S:	Supported
 F:      drivers/scsi/bfa/
 BROCADE BNA 10 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
+M:      Rasesh Mody <rmody@marvell.com>
-M:      Sudarsana Kalluru <sudarsana.kalluru@cavium.com>
+M:      Sudarsana Kalluru <skalluru@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/brocade/bna/
@@ -3471,10 +3471,9 @@ F:	drivers/i2c/busses/i2c-octeon*
 F:      drivers/i2c/busses/i2c-thunderx*
 CAVIUM LIQUIDIO NETWORK DRIVER
-M:      Derek Chickles <derek.chickles@caviumnetworks.com>
+M:      Derek Chickles <dchickles@marvell.com>
-M:      Satanand Burla <satananda.burla@caviumnetworks.com>
+M:      Satanand Burla <sburla@marvell.com>
-M:      Felix Manlunas <felix.manlunas@caviumnetworks.com>
+M:      Felix Manlunas <fmanlunas@marvell.com>
-M:      Raghu Vatsavayi <raghu.vatsavayi@caviumnetworks.com>
 L:      netdev@vger.kernel.org
 W:      http://www.cavium.com
 S:      Supported
@@ -3979,6 +3978,7 @@ F:	drivers/cpufreq/arm_big_little.c
 CPU POWER MONITORING SUBSYSTEM
 M:      Thomas Renninger <trenn@suse.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
 F:      tools/power/cpupower/
@@ -8260,6 +8260,7 @@ F:	include/uapi/linux/sunrpc/
 KERNEL SELFTEST FRAMEWORK
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-kselftest@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest.git
 Q:      https://patchwork.kernel.org/project/linux-kselftest/list/
@@ -10688,9 +10689,9 @@ S:	Maintained
 F:      drivers/net/netdevsim/*
 NETXEN (1/10) GbE SUPPORT
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Rahul Verma <rahul.verma@cavium.com>
+M:      Rahul Verma <rahulv@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/netxen/
@@ -12474,8 +12475,8 @@ S:	Supported
 F:      drivers/scsi/qedi/
 QLOGIC QL4xxx ETHERNET DRIVER
-M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
-M:      everest-linux-l2@cavium.com
+M:      GR-everest-linux-l2@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qed/
@@ -12483,8 +12484,8 @@ F:	include/linux/qed/
 F:      drivers/net/ethernet/qlogic/qede/
 QLOGIC QL4xxx RDMA DRIVER
-M:      Michal Kalderon <Michal.Kalderon@cavium.com>
+M:      Michal Kalderon <mkalderon@marvell.com>
-M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      Ariel Elior <aelior@marvell.com>
 L:      linux-rdma@vger.kernel.org
 S:      Supported
 F:      drivers/infiniband/hw/qedr/
@@ -12504,7 +12505,7 @@ F:	Documentation/scsi/LICENSE.qla2xxx
 F:      drivers/scsi/qla2xxx/
 QLOGIC QLA3XXX NETWORK DRIVER
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      Documentation/networking/device_drivers/qlogic/LICENSE.qla3xxx
@@ -12518,16 +12519,16 @@ F:	Documentation/scsi/LICENSE.qla4xxx
 F:      drivers/scsi/qla4xxx/
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
-M:      Shahed Shaikh <Shahed.Shaikh@cavium.com>
+M:      Shahed Shaikh <shshaikh@marvell.com>
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlcnic/
 QLOGIC QLGE 10Gb ETHERNET DRIVER
-M:      Manish Chopra <manish.chopra@cavium.com>
+M:      Manish Chopra <manishc@marvell.com>
-M:      Dept-GELinuxNICDev@cavium.com
+M:      GR-Linux-NIC-Dev@marvell.com
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlge/
@@ -15841,6 +15842,7 @@ F:	drivers/usb/common/usb-otg-fsm.c
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
 M:      Shuah Khan <shuah@kernel.org>
+M:      Shuah Khan <skhan@linuxfoundation.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/usbip_protocol.txt
diff --git a/Makefile b/Makefile
index 499b96810995..141653226f3c 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Shy Crocodile
 # *DOCUMENTATION*
@@ -955,6 +955,7 @@ ifdef CONFIG_STACK_VALIDATION
  endif
 endif
+PHONY += prepare0
 ifeq ($(KBUILD_EXTMOD),)
 core-y          += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
@@ -1061,8 +1062,7 @@ scripts: scripts_basic scripts_dtc
 # archprepare is used in arch Makefiles and when processed asm symlink,
 # version.h and scripts_basic is processed / created.
-# Listed in dependency order
+PHONY += prepare archprepare prepare1 prepare2 prepare3
-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
 # prepare3 is used to check if we are building in a separate output directory,
 # and if so do:
@@ -1360,11 +1360,11 @@ mrproper: rm-dirs  := $(wildcard $(MRPROPER_DIRS))
 mrproper: rm-files := $(wildcard $(MRPROPER_FILES))
 mrproper-dirs      := $(addprefix _mrproper_,scripts)
-PHONY += $(mrproper-dirs) mrproper archmrproper
+PHONY += $(mrproper-dirs) mrproper
 $(mrproper-dirs):
        $(Q)$(MAKE) $(clean)=$(patsubst _mrproper_%,%,$@)
-mrproper: clean archmrproper $(mrproper-dirs)
+mrproper: clean $(mrproper-dirs)
        $(call cmd,rmdirs)
        $(call cmd,rmfiles)
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index feed50ce89fa..caa270261521 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -3,23 +3,19 @@ generic-y += bugs.h
 generic-y += compat.h
 generic-y += device.h
 generic-y += div64.h
-generic-y += dma-mapping.h
 generic-y += emergency-restart.h
 generic-y += extable.h
-generic-y += fb.h
 generic-y += ftrace.h
 generic-y += hardirq.h
 generic-y += hw_irq.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
-generic-y += kmap_types.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += msi.h
 generic-y += parport.h
-generic-y += pci.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += topology.h
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index 49bfbd879caa..f1b86cef0905 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -216,6 +216,14 @@ struct bcr_fp_arcv2 {
 #endif
 };
+struct bcr_actionpoint {
+#ifdef CONFIG_CPU_BIG_ENDIAN
+        unsigned int pad:21, min:1, num:2, ver:8;
+#else
+        unsigned int ver:8, num:2, min:1, pad:21;
+#endif
+};
 #include <soc/arc/timers.h>
 struct bcr_bpu_arcompact {
@@ -283,7 +291,7 @@ struct cpuinfo_arc_cache {
 };
 struct cpuinfo_arc_bpu {
-        unsigned int ver, full, num_cache, num_pred;
+        unsigned int ver, full, num_cache, num_pred, ret_stk;
 };
 struct cpuinfo_arc_ccm {
@@ -302,7 +310,7 @@ struct cpuinfo_arc {
        struct {
                unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
                             fpu_sp:1, fpu_dp:1, dual:1, dual_enb:1, pad2:4,
-                             debug:1, ap:1, smart:1, rtt:1, pad3:4,
+                             ap_num:4, ap_full:1, smart:1, rtt:1, pad3:1,
                             timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
        } extn;
        struct bcr_mpy extn_mpy;
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index ee9246184033..202b74c339f0 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)
 /*
 * __ffs: Similar to ffs, but zero based (0-31)
 */
-static inline __attribute__ ((const)) int __ffs(unsigned long word)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word)
 {
        if (!word)
                return word;
@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)
 /*
 * __ffs: Similar to ffs, but zero based (0-31)
 */
-static inline __attribute__ ((const)) int __ffs(unsigned long x)
+static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x)
 {
-        int n;
+        unsigned long n;
        asm volatile(
        "       ffs.f   %0, %1          \n"  /* 0:31; 31(Z) if src 0 */
diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
index 9185541035cc..6958545390f0 100644
--- a/arch/arc/include/asm/perf_event.h
+++ b/arch/arc/include/asm/perf_event.h
@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = {
        /* counts condition */
        [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
-        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */
+        /* All jump instructions that are taken */
+        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak",
        [PERF_COUNT_ARC_BPOK]         = "bpok",   /* NP-NT, PT-T, PNT-NT */
 #ifdef CONFIG_ISA_ARCV2
        [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp",
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 8aec462d90fb..861a8aea51f9 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -1,15 +1,10 @@
-/*
+// SPDX-License-Identifier: GPL-2.0+
- * Linux performance counter support for ARC700 series
+//
- *
+// Linux performance counter support for ARC CPUs.
- * Copyright (C) 2013-2015 Synopsys, Inc. (www.synopsys.com)
+// This code is inspired by the perf support of various other architectures.
- *
+//
- * This code is inspired by the perf support of various other architectures.
+// Copyright (C) 2013-2018 Synopsys, Inc. (www.synopsys.com)
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
@@ -19,12 +14,31 @@
 #include <asm/arcregs.h>
 #include <asm/stacktrace.h>
+/* HW holds 8 symbols + one for null terminator */
+#define ARCPMU_EVENT_NAME_LEN   9
+enum arc_pmu_attr_groups {
+        ARCPMU_ATTR_GR_EVENTS,
+        ARCPMU_ATTR_GR_FORMATS,
+        ARCPMU_NR_ATTR_GR
+};
+struct arc_pmu_raw_event_entry {
+        char name[ARCPMU_EVENT_NAME_LEN];
+};
 struct arc_pmu {
        struct pmu      pmu;
        unsigned int    irq;
        int             n_counters;
+        int             n_events;
        u64             max_period;
        int             ev_hw_idx[PERF_COUNT_ARC_HW_MAX];
+        struct arc_pmu_raw_event_entry  *raw_entry;
+        struct attribute                **attrs;
+        struct perf_pmu_events_attr     *attr;
+        const struct attribute_group    *attr_groups[ARCPMU_NR_ATTR_GR + 1];
 };
 struct arc_pmu_cpu {
@@ -49,6 +63,7 @@ static int callchain_trace(unsigned int addr, void *data)
 {
        struct arc_callchain_trace *ctrl = data;
        struct perf_callchain_entry_ctx *entry = ctrl->perf_stuff;
        perf_callchain_store(entry, addr);
        if (ctrl->depth++ < 3)
@@ -57,8 +72,8 @@ static int callchain_trace(unsigned int addr, void *data)
        return -1;
 }
-void
+void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry,
-perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+                           struct pt_regs *regs)
 {
        struct arc_callchain_trace ctrl = {
                .depth = 0,
@@ -68,8 +83,8 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
        arc_unwind_core(NULL, regs, callchain_trace, &ctrl);
 }
-void
+void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
-perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
+                         struct pt_regs *regs)
 {
        /*
         * User stack can't be unwound trivially with kernel dwarf unwinder
@@ -82,10 +97,10 @@ static struct arc_pmu *arc_pmu;
 static DEFINE_PER_CPU(struct arc_pmu_cpu, arc_pmu_cpu);
 /* read counter #idx; note that counter# != event# on ARC! */
-static uint64_t arc_pmu_read_counter(int idx)
+static u64 arc_pmu_read_counter(int idx)
 {
-        uint32_t tmp;
+        u32 tmp;
-        uint64_t result;
+        u64 result;
        /*
         * ARC supports making 'snapshots' of the counters, so we don't
@@ -94,7 +109,7 @@ static uint64_t arc_pmu_read_counter(int idx)
        write_aux_reg(ARC_REG_PCT_INDEX, idx);
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, tmp | ARC_REG_PCT_CONTROL_SN);
-        result = (uint64_t) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
+        result = (u64) (read_aux_reg(ARC_REG_PCT_SNAPH)) << 32;
        result |= read_aux_reg(ARC_REG_PCT_SNAPL);
        return result;
@@ -103,9 +118,9 @@ static uint64_t arc_pmu_read_counter(int idx)
 static void arc_perf_event_update(struct perf_event *event,
                                  struct hw_perf_event *hwc, int idx)
 {
-        uint64_t prev_raw_count = local64_read(&hwc->prev_count);
+        u64 prev_raw_count = local64_read(&hwc->prev_count);
-        uint64_t new_raw_count = arc_pmu_read_counter(idx);
+        u64 new_raw_count = arc_pmu_read_counter(idx);
-        int64_t delta = new_raw_count - prev_raw_count;
+        s64 delta = new_raw_count - prev_raw_count;
        /*
         * We aren't afraid of hwc->prev_count changing beneath our feet
@@ -155,7 +170,7 @@ static int arc_pmu_event_init(struct perf_event *event)
        int ret;
        if (!is_sampling_event(event)) {
-                hwc->sample_period  = arc_pmu->max_period;
+                hwc->sample_period = arc_pmu->max_period;
                hwc->last_period = hwc->sample_period;
                local64_set(&hwc->period_left, hwc->sample_period);
        }
@@ -192,6 +207,18 @@ static int arc_pmu_event_init(struct perf_event *event)
                pr_debug("init cache event with h/w %08x \'%s\'\n",
                         (int)hwc->config, arc_pmu_ev_hw_map[ret]);
                return 0;
+        case PERF_TYPE_RAW:
+                if (event->attr.config >= arc_pmu->n_events)
+                        return -ENOENT;
+                hwc->config |= event->attr.config;
+                pr_debug("init raw event with idx %lld \'%s\'\n",
+                         event->attr.config,
+                         arc_pmu->raw_entry[event->attr.config].name);
+                return 0;
        default:
                return -ENOENT;
        }
@@ -200,7 +227,7 @@ static int arc_pmu_event_init(struct perf_event *event)
 /* starts all counters */
 static void arc_pmu_enable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x1);
 }
@@ -208,7 +235,7 @@ static void arc_pmu_enable(struct pmu *pmu)
 /* stops all counters */
 static void arc_pmu_disable(struct pmu *pmu)
 {
-        uint32_t tmp;
+        u32 tmp;
        tmp = read_aux_reg(ARC_REG_PCT_CONTROL);
        write_aux_reg(ARC_REG_PCT_CONTROL, (tmp & 0xffff0000) | 0x0);
 }
@@ -228,7 +255,7 @@ static int arc_pmu_event_set_period(struct perf_event *event)
                local64_set(&hwc->period_left, left);
                hwc->last_period = period;
                overflow = 1;
-        } else  if (unlikely(left <= 0)) {
+        } else if (unlikely(left <= 0)) {
                /* left underflowed by less than period. */
                left += period;
                local64_set(&hwc->period_left, left);
@@ -246,8 +273,8 @@ static int arc_pmu_event_set_period(struct perf_event *event)
        write_aux_reg(ARC_REG_PCT_INDEX, idx);
        /* Write value */
-        write_aux_reg(ARC_REG_PCT_COUNTL, (u32)value);
+        write_aux_reg(ARC_REG_PCT_COUNTL, lower_32_bits(value));
-        write_aux_reg(ARC_REG_PCT_COUNTH, (value >> 32));
+        write_aux_reg(ARC_REG_PCT_COUNTH, upper_32_bits(value));
        perf_event_update_userpage(event);
@@ -277,7 +304,7 @@ static void arc_pmu_start(struct perf_event *event, int flags)
        /* Enable interrupt for this counter */
        if (is_sampling_event(event))
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
        /* enable ARC pmu here */
        write_aux_reg(ARC_REG_PCT_INDEX, idx);          /* counter # */
@@ -295,9 +322,9 @@ static void arc_pmu_stop(struct perf_event *event, int flags)
                 * Reset interrupt flag by writing of 1. This is required
                 * to make sure pending interrupt was not left.
                 */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~(1 << idx));
+                              read_aux_reg(ARC_REG_PCT_INT_CTRL) & ~BIT(idx));
        }
        if (!(event->hw.state & PERF_HES_STOPPED)) {
@@ -349,9 +376,10 @@ static int arc_pmu_add(struct perf_event *event, int flags)
        if (is_sampling_event(event)) {
                /* Mimic full counter overflow as other arches do */
-                write_aux_reg(ARC_REG_PCT_INT_CNTL, (u32)arc_pmu->max_period);
+                write_aux_reg(ARC_REG_PCT_INT_CNTL,
+                              lower_32_bits(arc_pmu->max_period));
                write_aux_reg(ARC_REG_PCT_INT_CNTH,
-                              (arc_pmu->max_period >> 32));
+                              upper_32_bits(arc_pmu->max_period));
        }
        write_aux_reg(ARC_REG_PCT_CONFIG, 0);
@@ -392,7 +420,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                idx = __ffs(active_ints);
                /* Reset interrupt flag by writing of 1 */
-                write_aux_reg(ARC_REG_PCT_INT_ACT, 1 << idx);
+                write_aux_reg(ARC_REG_PCT_INT_ACT, BIT(idx));
                /*
                 * On reset of "interrupt active" bit corresponding
@@ -400,7 +428,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                 * Now we need to re-enable interrupt for the counter.
                 */
                write_aux_reg(ARC_REG_PCT_INT_CTRL,
-                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | (1 << idx));
+                        read_aux_reg(ARC_REG_PCT_INT_CTRL) | BIT(idx));
                event = pmu_cpu->act_counter[idx];
                hwc = &event->hw;
@@ -414,7 +442,7 @@ static irqreturn_t arc_pmu_intr(int irq, void *dev)
                                arc_pmu_stop(event, 0);
                }
-                active_ints &= ~(1U << idx);
+                active_ints &= ~BIT(idx);
        } while (active_ints);
 done:
@@ -441,19 +469,108 @@ static void arc_cpu_pmu_irq_init(void *data)
        write_aux_reg(ARC_REG_PCT_INT_ACT, 0xffffffff);
 }
+/* Event field occupies the bottom 15 bits of our config field */
+PMU_FORMAT_ATTR(event, "config:0-14");
+static struct attribute *arc_pmu_format_attrs[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+static struct attribute_group arc_pmu_format_attr_gr = {
+        .name = "format",
+        .attrs = arc_pmu_format_attrs,
+};
+static ssize_t arc_pmu_events_sysfs_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *page)
+{
+        struct perf_pmu_events_attr *pmu_attr;
+        pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
+        return sprintf(page, "event=0x%04llx\n", pmu_attr->id);
+}
+/*
+ * We don't add attrs here as we don't have pre-defined list of perf events.
+ * We will generate and add attrs dynamically in probe() after we read HW
+ * configuration.
+ */
+static struct attribute_group arc_pmu_events_attr_gr = {
+        .name = "events",
+};
+static void arc_pmu_add_raw_event_attr(int j, char *str)
+{
+        memmove(arc_pmu->raw_entry[j].name, str, ARCPMU_EVENT_NAME_LEN - 1);
+        arc_pmu->attr[j].attr.attr.name = arc_pmu->raw_entry[j].name;
+        arc_pmu->attr[j].attr.attr.mode = VERIFY_OCTAL_PERMISSIONS(0444);
+        arc_pmu->attr[j].attr.show = arc_pmu_events_sysfs_show;
+        arc_pmu->attr[j].id = j;
+        arc_pmu->attrs[j] = &(arc_pmu->attr[j].attr.attr);
+}
+static int arc_pmu_raw_alloc(struct device *dev)
+{
+        arc_pmu->attr = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attr), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attr)
+                return -ENOMEM;
+        arc_pmu->attrs = devm_kmalloc_array(dev, arc_pmu->n_events + 1,
+                sizeof(*arc_pmu->attrs), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->attrs)
+                return -ENOMEM;
+        arc_pmu->raw_entry = devm_kmalloc_array(dev, arc_pmu->n_events,
+                sizeof(*arc_pmu->raw_entry), GFP_KERNEL | __GFP_ZERO);
+        if (!arc_pmu->raw_entry)
+                return -ENOMEM;
+        return 0;
+}
+static inline bool event_in_hw_event_map(int i, char *name)
+{
+        if (!arc_pmu_ev_hw_map[i])
+                return false;
+        if (!strlen(arc_pmu_ev_hw_map[i]))
+                return false;
+        if (strcmp(arc_pmu_ev_hw_map[i], name))
+                return false;
+        return true;
+}
+static void arc_pmu_map_hw_event(int j, char *str)
+{
+        int i;
+        /* See if HW condition has been mapped to a perf event_id */
+        for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                if (event_in_hw_event_map(i, str)) {
+                        pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
+                                 i, str, j);
+                        arc_pmu->ev_hw_idx[i] = j;
+                }
+        }
+}
 static int arc_pmu_device_probe(struct platform_device *pdev)
 {
        struct arc_reg_pct_build pct_bcr;
        struct arc_reg_cc_build cc_bcr;
-        int i, j, has_interrupts;
+        int i, has_interrupts;
        int counter_size;       /* in bits */
        union cc_name {
                struct {
-                        uint32_t word0, word1;
+                        u32 word0, word1;
                        char sentinel;
                } indiv;
-                char str[9];
+                char str[ARCPMU_EVENT_NAME_LEN];
        } cc_name;
@@ -463,15 +580,22 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                return -ENODEV;
        }
        BUILD_BUG_ON(ARC_PERF_MAX_COUNTERS > 32);
-        BUG_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS);
+        if (WARN_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS))
+                return -EINVAL;
        READ_BCR(ARC_REG_CC_BUILD, cc_bcr);
-        BUG_ON(!cc_bcr.v); /* Counters exist but No countable conditions ? */
+        if (WARN(!cc_bcr.v, "Counters exist but No countable conditions?"))
+                return -EINVAL;
        arc_pmu = devm_kzalloc(&pdev->dev, sizeof(struct arc_pmu), GFP_KERNEL);
        if (!arc_pmu)
                return -ENOMEM;
+        arc_pmu->n_events = cc_bcr.c;
+        if (arc_pmu_raw_alloc(&pdev->dev))
+                return -ENOMEM;
        has_interrupts = is_isa_arcv2() ? pct_bcr.i : 0;
        arc_pmu->n_counters = pct_bcr.c;
@@ -481,30 +605,26 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
        pr_info("ARC perf\t: %d counters (%d bits), %d conditions%s\n",
                arc_pmu->n_counters, counter_size, cc_bcr.c,
-                has_interrupts ? ", [overflow IRQ support]":"");
+                has_interrupts ? ", [overflow IRQ support]" : "");
-        cc_name.str[8] = 0;
+        cc_name.str[ARCPMU_EVENT_NAME_LEN - 1] = 0;
        for (i = 0; i < PERF_COUNT_ARC_HW_MAX; i++)
                arc_pmu->ev_hw_idx[i] = -1;
        /* loop thru all available h/w condition indexes */
-        for (j = 0; j < cc_bcr.c; j++) {
+        for (i = 0; i < cc_bcr.c; i++) {
-                write_aux_reg(ARC_REG_CC_INDEX, j);
+                write_aux_reg(ARC_REG_CC_INDEX, i);
                cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
                cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
-                /* See if it has been mapped to a perf event_id */
+                arc_pmu_map_hw_event(i, cc_name.str);
-                for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+                arc_pmu_add_raw_event_attr(i, cc_name.str);
-                        if (arc_pmu_ev_hw_map[i] &&
-                            !strcmp(arc_pmu_ev_hw_map[i], cc_name.str) &&
-                            strlen(arc_pmu_ev_hw_map[i])) {
-                                pr_debug("mapping perf event %2d to h/w event \'%8s\' (idx %d)\n",
-                                         i, cc_name.str, j);
-                                arc_pmu->ev_hw_idx[i] = j;
-                        }
-                }
        }
+        arc_pmu_events_attr_gr.attrs = arc_pmu->attrs;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_EVENTS] = &arc_pmu_events_attr_gr;
+        arc_pmu->attr_groups[ARCPMU_ATTR_GR_FORMATS] = &arc_pmu_format_attr_gr;
        arc_pmu->pmu = (struct pmu) {
                .pmu_enable     = arc_pmu_enable,
                .pmu_disable    = arc_pmu_disable,
@@ -514,6 +634,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
                .start          = arc_pmu_start,
                .stop           = arc_pmu_stop,
                .read           = arc_pmu_read,
+                .attr_groups    = arc_pmu->attr_groups,
        };
        if (has_interrupts) {
@@ -535,17 +656,19 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
        } else
                arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
-        return perf_pmu_register(&arc_pmu->pmu, pdev->name, PERF_TYPE_RAW);
+        /*
+         * perf parser doesn't really like '-' symbol in events name, so let's
+         * use '_' in arc pct name as it goes to kernel PMU event prefix.
+         */
+        return perf_pmu_register(&arc_pmu->pmu, "arc_pct", PERF_TYPE_RAW);
 }
-#ifdef CONFIG_OF
 static const struct of_device_id arc_pmu_match[] = {
        { .compatible = "snps,arc700-pct" },
        { .compatible = "snps,archs-pct" },
        {},
 };
 MODULE_DEVICE_TABLE(of, arc_pmu_match);
-#endif
 static struct platform_driver arc_pmu_driver = {
        .driver = {
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 2e018b8c2e19..feb90093e6b1 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -123,6 +123,7 @@ static void read_arc_build_cfg_regs(void)
        struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
        const struct id_to_str *tbl;
        struct bcr_isa_arcv2 isa;
+        struct bcr_actionpoint ap;
        FIX_PTR(cpu);
@@ -195,6 +196,7 @@ static void read_arc_build_cfg_regs(void)
                cpu->bpu.full = bpu.ft;
                cpu->bpu.num_cache = 256 << bpu.bce;
                cpu->bpu.num_pred = 2048 << bpu.pte;
+                cpu->bpu.ret_stk = 4 << bpu.rse;
                if (cpu->core.family >= 0x54) {
                        unsigned int exec_ctrl;
@@ -207,8 +209,11 @@ static void read_arc_build_cfg_regs(void)
                }
        }
-        READ_BCR(ARC_REG_AP_BCR, bcr);
+        READ_BCR(ARC_REG_AP_BCR, ap);
-        cpu->extn.ap = bcr.ver ? 1 : 0;
+        if (ap.ver) {
+                cpu->extn.ap_num = 2 << ap.num;
+                cpu->extn.ap_full = !!ap.min;
+        }
        READ_BCR(ARC_REG_SMART_BCR, bcr);
        cpu->extn.smart = bcr.ver ? 1 : 0;
@@ -216,8 +221,6 @@ static void read_arc_build_cfg_regs(void)
        READ_BCR(ARC_REG_RTT_BCR, bcr);
        cpu->extn.rtt = bcr.ver ? 1 : 0;
-        cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
        READ_BCR(ARC_REG_ISA_CFG_BCR, isa);
        /* some hacks for lack of feature BCR info in old ARC700 cores */
@@ -299,10 +302,10 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
        if (cpu->bpu.ver)
                n += scnprintf(buf + n, len - n,
-                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d",
+                              "BPU\t\t: %s%s match, cache:%d, Predict Table:%d Return stk: %d",
                              IS_AVAIL1(cpu->bpu.full, "full"),
                              IS_AVAIL1(!cpu->bpu.full, "partial"),
-                              cpu->bpu.num_cache, cpu->bpu.num_pred);
+                              cpu->bpu.num_cache, cpu->bpu.num_pred, cpu->bpu.ret_stk);
        if (is_isa_arcv2()) {
                struct bcr_lpb lpb;
@@ -336,11 +339,17 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                               IS_AVAIL1(cpu->extn.fpu_sp, "SP "),
                               IS_AVAIL1(cpu->extn.fpu_dp, "DP "));
-        if (cpu->extn.debug)
+        if (cpu->extn.ap_num | cpu->extn.smart | cpu->extn.rtt) {
-                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s%s\n",
+                n += scnprintf(buf + n, len - n, "DEBUG\t\t: %s%s",
-                               IS_AVAIL1(cpu->extn.ap, "ActionPoint "),
                               IS_AVAIL1(cpu->extn.smart, "smaRT "),
                               IS_AVAIL1(cpu->extn.rtt, "RTT "));
+                if (cpu->extn.ap_num) {
+                        n += scnprintf(buf + n, len - n, "ActionPoint %d/%s",
+                                       cpu->extn.ap_num,
+                                       cpu->extn.ap_full ? "full":"min");
+                }
+                n += scnprintf(buf + n, len - n, "\n");
+        }
        if (cpu->dccm.sz || cpu->iccm.sz)
                n += scnprintf(buf + n, len - n, "Extn [CCM]\t: DCCM @ %x, %d KB / ICCM: @ %x, %d KB\n",
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index e8d9fb452346..215f515442e0 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -18,6 +18,8 @@
 #include <asm/arcregs.h>
 #include <asm/irqflags.h>
+#define ARC_PATH_MAX    256
 /*
 * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
 *   -Prints 3 regs per line and a CR.
@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs)
        print_reg_file(&(cregs->r13), 13);
 }
-static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+static void print_task_path_n_nm(struct task_struct *tsk)
 {
        char *path_nm = NULL;
        struct mm_struct *mm;
        struct file *exe_file;
+        char buf[ARC_PATH_MAX];
        mm = get_task_mm(tsk);
        if (!mm)
@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
        mmput(mm);
        if (exe_file) {
-                path_nm = file_path(exe_file, buf, 255);
+                path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1);
                fput(exe_file);
        }
@@ -80,10 +83,9 @@ done:
        pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?");
 }
-static void show_faulting_vma(unsigned long address, char *buf)
+static void show_faulting_vma(unsigned long address)
 {
        struct vm_area_struct *vma;
-        char *nm = buf;
        struct mm_struct *active_mm = current->active_mm;
        /* can't use print_vma_addr() yet as it doesn't check for
@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf)
         * if the container VMA is not found
         */
        if (vma && (vma->vm_start <= address)) {
+                char buf[ARC_PATH_MAX];
+                char *nm = "?";
                if (vma->vm_file) {
-                        nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
+                        nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1);
                        if (IS_ERR(nm))
                                nm = "?";
                }
@@ -173,13 +178,14 @@ void show_regs(struct pt_regs *regs)
 {
        struct task_struct *tsk = current;
        struct callee_regs *cregs;
-        char *buf;
-        buf = (char *)__get_free_page(GFP_KERNEL);
+        /*
-        if (!buf)
+         * generic code calls us with preemption disabled, but some calls
-                return;
+         * here could sleep, so re-enable to avoid lockdep splat
+         */
+        preempt_enable();
-        print_task_path_n_nm(tsk, buf);
+        print_task_path_n_nm(tsk);
        show_regs_print_info(KERN_INFO);
        show_ecr_verbose(regs);
@@ -189,7 +195,7 @@ void show_regs(struct pt_regs *regs)
                (void *)regs->blink, (void *)regs->ret);
        if (user_mode(regs))
-                show_faulting_vma(regs->ret, buf); /* faulting code, not data */
+                show_faulting_vma(regs->ret); /* faulting code, not data */
        pr_info("[STAT32]: 0x%08lx", regs->status32);
@@ -222,7 +228,7 @@ void show_regs(struct pt_regs *regs)
        if (cregs)
                show_callee_regs(cregs);
-        free_page((unsigned long)buf);
+        preempt_disable();
 }
 void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
diff --git a/arch/arc/lib/memset-archs.S b/arch/arc/lib/memset-archs.S
index 62ad4bcb841a..f230bb7092fd 100644
--- a/arch/arc/lib/memset-archs.S
+++ b/arch/arc/lib/memset-archs.S
@@ -7,11 +7,39 @@
 */
 #include <linux/linkage.h>
+#include <asm/cache.h>
-#undef PREALLOC_NOT_AVAIL
+/*
+ * The memset implementation below is optimized to use prefetchw and prealloc
+ * instruction in case of CPU with 64B L1 data cache line (L1_CACHE_SHIFT == 6)
+ * If you want to implement optimized memset for other possible L1 data cache
+ * line lengths (32B and 128B) you should rewrite code carefully checking
+ * we don't call any prefetchw/prealloc instruction for L1 cache lines which
+ * don't belongs to memset area.
+ */
+#if L1_CACHE_SHIFT == 6
+.macro PREALLOC_INSTR   reg, off
+        prealloc        [\reg, \off]
+.endm
+.macro PREFETCHW_INSTR  reg, off
+        prefetchw       [\reg, \off]
+.endm
+#else
+.macro PREALLOC_INSTR
+.endm
+.macro PREFETCHW_INSTR
+.endm
+#endif
 ENTRY_CFI(memset)
-        prefetchw [r0]          ; Prefetch the write location
+        PREFETCHW_INSTR r0, 0   ; Prefetch the first write location
        mov.f   0, r2
 ;;; if size is zero
        jz.d    [blink]
@@ -48,11 +76,8 @@ ENTRY_CFI(memset)
        lpnz    @.Lset64bytes
        ;; LOOP START
-#ifdef PREALLOC_NOT_AVAIL
+        PREALLOC_INSTR  r3, 64  ; alloc next line w/o fetching
-        prefetchw [r3, 64]      ;Prefetch the next write location
-#else
-        prealloc  [r3, 64]
-#endif
 #ifdef CONFIG_ARC_HAS_LL64
        std.ab  r4, [r3, 8]
        std.ab  r4, [r3, 8]
@@ -85,7 +110,6 @@ ENTRY_CFI(memset)
        lsr.f   lp_count, r2, 5 ;Last remaining  max 124 bytes
        lpnz    .Lset32bytes
        ;; LOOP START
-        prefetchw   [r3, 32]    ;Prefetch the next write location
 #ifdef CONFIG_ARC_HAS_LL64
        std.ab  r4, [r3, 8]
        std.ab  r4, [r3, 8]
diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
index a1d723197084..8df1638259f3 100644
--- a/arch/arc/mm/fault.c
+++ b/arch/arc/mm/fault.c
@@ -141,12 +141,17 @@ good_area:
         */
        fault = handle_mm_fault(vma, address, flags);
-        /* If Pagefault was interrupted by SIGKILL, exit page fault "early" */
        if (fatal_signal_pending(current)) {
-                if ((fault & VM_FAULT_ERROR) && !(fault & VM_FAULT_RETRY))
-                        up_read(&mm->mmap_sem);
+                /*
-                if (user_mode(regs))
+                 * if fault retry, mmap_sem already relinquished by core mm
+                 * so OK to return to user mode (with signal handled first)
+                 */
+                if (fault & VM_FAULT_RETRY) {
+                        if (!user_mode(regs))
+                                goto no_context;
                        return;
+                }
        }
        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
index 43bf4c3a1290..e1ab2d7f1d64 100644
--- a/arch/arc/mm/init.c
+++ b/arch/arc/mm/init.c
@@ -119,7 +119,8 @@ void __init setup_arch_memory(void)
         */
        memblock_add_node(low_mem_start, low_mem_sz, 0);
-        memblock_reserve(low_mem_start, __pa(_end) - low_mem_start);
+        memblock_reserve(CONFIG_LINUX_LINK_BASE,
+                         __pa(_end) - CONFIG_LINUX_LINK_BASE);
 #ifdef CONFIG_BLK_DEV_INITRD
        if (phys_initrd_size) {
diff --git a/arch/arm/include/asm/xen/page-coherent.h b/arch/arm/include/asm/xen/page-coherent.h
index b3ef061d8b74..2c403e7c782d 100644
--- a/arch/arm/include/asm/xen/page-coherent.h
+++ b/arch/arm/include/asm/xen/page-coherent.h
@@ -1 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
+#define _ASM_ARM_XEN_PAGE_COHERENT_H
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
+{
+        if (dev && dev->archdata.dev_dma_ops)
+                return dev->archdata.dev_dma_ops;
+        return get_arch_dma_ops(NULL);
+}
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
+}
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can span across
+         * multiple Xen pages, it's not possible for it to contain a
+         * mix of local and foreign Xen pages. So if the first xen_pfn
+         * == mfn the page is local otherwise it's a foreign page
+         * grant-mapped in dom0. If the page is local we can safely
+         * call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (local)
+                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->unmap_page)
+                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
+        } else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
+                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn)) {
+                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
+                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
+        } else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/include/asm/cache.h b/arch/arm64/include/asm/cache.h
index eb43e09c1980..926434f413fa 100644
--- a/arch/arm64/include/asm/cache.h
+++ b/arch/arm64/include/asm/cache.h
@@ -60,8 +60,6 @@
 #ifdef CONFIG_KASAN_SW_TAGS
 #define ARCH_SLAB_MINALIGN      (1ULL << KASAN_SHADOW_SCALE_SHIFT)
-#else
-#define ARCH_SLAB_MINALIGN      __alignof__(unsigned long long)
 #endif
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/device.h b/arch/arm64/include/asm/device.h
index 3dd3d664c5c5..4658c937e173 100644
--- a/arch/arm64/include/asm/device.h
+++ b/arch/arm64/include/asm/device.h
@@ -20,9 +20,6 @@ struct dev_archdata {
 #ifdef CONFIG_IOMMU_API
        void *iommu;                    /* private IOMMU data */
 #endif
-#ifdef CONFIG_XEN
-        const struct dma_map_ops *dev_dma_ops;
-#endif
 };
 struct pdev_archdata {
diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index ac352accb3d9..3e8063f4f9d3 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -60,8 +60,11 @@ static inline bool arm64_kernel_use_ng_mappings(void)
         * later determine that kpti is required, then
         * kpti_install_ng_mappings() will make them non-global.
         */
+        if (arm64_kernel_unmapped_at_el0())
+                return true;
        if (!IS_ENABLED(CONFIG_RANDOMIZE_BASE))
-                return arm64_kernel_unmapped_at_el0();
+                return false;
        /*
         * KASLR is enabled so we're going to be enabling kpti on non-broken
diff --git a/arch/arm64/include/asm/xen/page-coherent.h b/arch/arm64/include/asm/xen/page-coherent.h
index b3ef061d8b74..d88e56b90b93 100644
--- a/arch/arm64/include/asm/xen/page-coherent.h
+++ b/arch/arm64/include/asm/xen/page-coherent.h
@@ -1 +1,77 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ARM64_XEN_PAGE_COHERENT_H
+#define _ASM_ARM64_XEN_PAGE_COHERENT_H
+#include <linux/dma-mapping.h>
+#include <asm/page.h>
 #include <xen/arm/page-coherent.h>
+static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
+{
+        return dma_direct_alloc(hwdev, size, dma_handle, flags, attrs);
+}
+static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
+                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
+{
+        dma_direct_free(hwdev, size, cpu_addr, dma_handle, attrs);
+}
+static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_cpu(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
+}
+static inline void xen_dma_sync_single_for_device(struct device *hwdev,
+                dma_addr_t handle, size_t size, enum dma_data_direction dir)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        if (pfn_valid(pfn))
+                dma_direct_sync_single_for_device(hwdev, handle, size, dir);
+        else
+                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
+}
+static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
+             dma_addr_t dev_addr, unsigned long offset, size_t size,
+             enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long page_pfn = page_to_xen_pfn(page);
+        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
+        unsigned long compound_pages =
+                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
+        bool local = (page_pfn <= dev_pfn) &&
+                (dev_pfn - page_pfn < compound_pages);
+        if (local)
+                dma_direct_map_page(hwdev, page, offset, size, dir, attrs);
+        else
+                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
+}
+static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
+                size_t size, enum dma_data_direction dir, unsigned long attrs)
+{
+        unsigned long pfn = PFN_DOWN(handle);
+        /*
+         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
+         * multiple Xen page, it's not possible to have a mix of local and
+         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
+         * foreign mfn will always return false. If the page is local we can
+         * safely call the native dma_ops function, otherwise we call the xen
+         * specific function.
+         */
+        if (pfn_valid(pfn))
+                dma_direct_unmap_page(hwdev, handle, size, dir, attrs);
+        else
+                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
+}
+#endif /* _ASM_ARM64_XEN_PAGE_COHERENT_H */
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index f0e6ab8abe9c..ba6b41790fcd 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/types.h>
+#include <asm/cacheflush.h>
 #include <asm/fixmap.h>
 #include <asm/kernel-pgtable.h>
 #include <asm/memory.h>
@@ -43,7 +44,7 @@ static __init u64 get_kaslr_seed(void *fdt)
        return ret;
 }
-static __init const u8 *get_cmdline(void *fdt)
+static __init const u8 *kaslr_get_cmdline(void *fdt)
 {
        static __initconst const u8 default_cmdline[] = CONFIG_CMDLINE;
@@ -109,7 +110,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
         * Check if 'nokaslr' appears on the command line, and
         * return 0 if that is the case.
         */
-        cmdline = get_cmdline(fdt);
+        cmdline = kaslr_get_cmdline(fdt);
        str = strstr(cmdline, "nokaslr");
        if (str == cmdline || (str > cmdline && *(str - 1) == ' '))
                return 0;
@@ -169,5 +170,8 @@ u64 __init kaslr_early_init(u64 dt_phys)
        module_alloc_base += (module_range * (seed & ((1 << 21) - 1))) >> 21;
        module_alloc_base &= PAGE_MASK;
+        __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
+        __flush_dcache_area(&memstart_offset_seed, sizeof(memstart_offset_seed));
        return offset;
 }
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index fb0908456a1f..78c0a72f822c 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -466,9 +466,7 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
        __iommu_setup_dma_ops(dev, dma_base, size, iommu);
 #ifdef CONFIG_XEN
-        if (xen_initial_domain()) {
+        if (xen_initial_domain())
-                dev->archdata.dev_dma_ops = dev->dma_ops;
                dev->dma_ops = xen_dma_ops;
-        }
 #endif
 }
diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
index 4003ddc616e1..f801f3708a89 100644
--- a/arch/h8300/Makefile
+++ b/arch/h8300/Makefile
@@ -37,8 +37,6 @@ libs-y	+= arch/$(ARCH)/lib/
 boot := arch/h8300/boot
-archmrproper:
 archclean:
        $(Q)$(MAKE) $(clean)=$(boot)
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 320d86f192ee..171290f9f1de 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -16,8 +16,6 @@ KBUILD_DEFCONFIG := generic_defconfig
 NM := $(CROSS_COMPILE)nm -B
 READELF := $(CROSS_COMPILE)readelf
-export AWK
 CHECKFLAGS      += -D__ia64=1 -D__ia64__=1 -D_LP64 -D__LP64__
 OBJCOPYFLAGS    := --strip-all
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 787290781b8c..0d14f51d0002 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -3155,6 +3155,7 @@ config MIPS32_O32
 config MIPS32_N32
        bool "Kernel support for n32 binaries"
        depends on 64BIT
+        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        select COMPAT
        select MIPS32_COMPAT
        select SYSVIPC_COMPAT if SYSVIPC
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index 6054d49e608e..fe3773539eff 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -173,6 +173,31 @@ void __init plat_mem_setup(void)
        pm_power_off = bcm47xx_machine_halt;
 }
+#ifdef CONFIG_BCM47XX_BCMA
+static struct device * __init bcm47xx_setup_device(void)
+{
+        struct device *dev;
+        int err;
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return NULL;
+        err = dev_set_name(dev, "bcm47xx_soc");
+        if (err) {
+                pr_err("Failed to set SoC device name: %d\n", err);
+                kfree(dev);
+                return NULL;
+        }
+        err = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
+        if (err)
+                pr_err("Failed to set SoC DMA mask: %d\n", err);
+        return dev;
+}
+#endif
 /*
 * This finishes bus initialization doing things that were not possible without
 * kmalloc. Make sure to call it late enough (after mm_init).
@@ -183,6 +208,10 @@ void __init bcm47xx_bus_setup(void)
        if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
                int err;
+                bcm47xx_bus.bcma.dev = bcm47xx_setup_device();
+                if (!bcm47xx_bus.bcma.dev)
+                        panic("Failed to setup SoC device\n");
                err = bcma_host_soc_init(&bcm47xx_bus.bcma);
                if (err)
                        panic("Failed to initialize BCMA bus (err %d)", err);
@@ -235,6 +264,8 @@ static int __init bcm47xx_register_bus_complete(void)
 #endif
 #ifdef CONFIG_BCM47XX_BCMA
        case BCM47XX_BUS_TYPE_BCMA:
+                if (device_register(bcm47xx_bus.bcma.dev))
+                        pr_err("Failed to register SoC device\n");
                bcma_bus_register(&bcm47xx_bus.bcma.bus);
                break;
 #endif
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index 2c79ab52977a..8bf43c5a7bc7 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -98,7 +98,7 @@ static void octeon_kexec_smp_down(void *ignored)
        "       sync                                            \n"
        "       synci   ($0)                                    \n");
-        relocated_kexec_smp_wait(NULL);
+        kexec_reboot();
 }
 #endif
diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
index 4e4ec779f182..6f981af67826 100644
--- a/arch/mips/configs/ath79_defconfig
+++ b/arch/mips/configs/ath79_defconfig
@@ -66,6 +66,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
 # CONFIG_SERIAL_8250_PCI is not set
 CONFIG_SERIAL_8250_NR_UARTS=1
 CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AR933X=y
 CONFIG_SERIAL_AR933X_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
diff --git a/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h b/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
index c6b63a409641..6dd8ad2409dc 100644
--- a/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
+++ b/arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h
@@ -18,8 +18,6 @@
 #define INT_NUM_EXTRA_START             (INT_NUM_IM4_IRL0 + 32)
 #define INT_NUM_IM_OFFSET               (INT_NUM_IM1_IRL0 - INT_NUM_IM0_IRL0)
-#define MIPS_CPU_TIMER_IRQ                      7
 #define MAX_IM                  5
 #endif /* _FALCON_IRQ__ */
diff --git a/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h b/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
index 141076325307..0b424214a5e9 100644
--- a/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
+++ b/arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h
@@ -19,8 +19,6 @@
 #define LTQ_DMA_CH0_INT         (INT_NUM_IM2_IRL0)
-#define MIPS_CPU_TIMER_IRQ      7
 #define MAX_IM                  5
 #endif
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index 6256d35dbf4d..bedb5047aff3 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -74,14 +74,15 @@ static int __init vdma_init(void)
                                                    get_order(VDMA_PGTBL_SIZE));
        BUG_ON(!pgtbl);
        dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
-        pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+        pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
        /*
         * Clear the R4030 translation table
         */
        vdma_pgtbl_init();
-        r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+        r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
+                          CPHYSADDR((unsigned long)pgtbl));
        r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
        r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index f0bc3312ed11..6549499eb202 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -224,9 +224,11 @@ static struct irq_chip ltq_eiu_type = {
        .irq_set_type = ltq_eiu_settype,
 };
-static void ltq_hw_irqdispatch(int module)
+static void ltq_hw_irq_handler(struct irq_desc *desc)
 {
+        int module = irq_desc_get_irq(desc) - 2;
        u32 irq;
+        int hwirq;
        irq = ltq_icu_r32(module, LTQ_ICU_IM0_IOSR);
        if (irq == 0)
@@ -237,7 +239,8 @@ static void ltq_hw_irqdispatch(int module)
         * other bits might be bogus
         */
        irq = __fls(irq);
-        do_IRQ((int)irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module));
+        hwirq = irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module);
+        generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
        /* if this is a EBU irq, we need to ack it or get a deadlock */
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
@@ -245,49 +248,6 @@ static void ltq_hw_irqdispatch(int module)
                        LTQ_EBU_PCC_ISTAT);
 }
-#define DEFINE_HWx_IRQDISPATCH(x)                                       \
-        static void ltq_hw ## x ## _irqdispatch(void)                   \
-        {                                                               \
-                ltq_hw_irqdispatch(x);                                  \
-        }
-DEFINE_HWx_IRQDISPATCH(0)
-DEFINE_HWx_IRQDISPATCH(1)
-DEFINE_HWx_IRQDISPATCH(2)
-DEFINE_HWx_IRQDISPATCH(3)
-DEFINE_HWx_IRQDISPATCH(4)
-#if MIPS_CPU_TIMER_IRQ == 7
-static void ltq_hw5_irqdispatch(void)
-{
-        do_IRQ(MIPS_CPU_TIMER_IRQ);
-}
-#else
-DEFINE_HWx_IRQDISPATCH(5)
-#endif
-static void ltq_hw_irq_handler(struct irq_desc *desc)
-{
-        ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
-}
-asmlinkage void plat_irq_dispatch(void)
-{
-        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
-        int irq;
-        if (!pending) {
-                spurious_interrupt();
-                return;
-        }
-        pending >>= CAUSEB_IP;
-        while (pending) {
-                irq = fls(pending) - 1;
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
-                pending &= ~BIT(irq);
-        }
-}
 static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
 {
        struct irq_chip *chip = &ltq_irq_type;
@@ -343,38 +303,13 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
        for (i = 0; i < MAX_IM; i++)
                irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
-        if (cpu_has_vint) {
-                pr_info("Setting up vectored interrupts\n");
-                set_vi_handler(2, ltq_hw0_irqdispatch);
-                set_vi_handler(3, ltq_hw1_irqdispatch);
-                set_vi_handler(4, ltq_hw2_irqdispatch);
-                set_vi_handler(5, ltq_hw3_irqdispatch);
-                set_vi_handler(6, ltq_hw4_irqdispatch);
-                set_vi_handler(7, ltq_hw5_irqdispatch);
-        }
        ltq_domain = irq_domain_add_linear(node,
                (MAX_IM * INT_NUM_IM_OFFSET) + MIPS_CPU_IRQ_CASCADE,
                &irq_domain_ops, 0);
-#ifndef CONFIG_MIPS_MT_SMP
-        set_c0_status(IE_IRQ0 | IE_IRQ1 | IE_IRQ2 |
-                IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
-#else
-        set_c0_status(IE_SW0 | IE_SW1 | IE_IRQ0 | IE_IRQ1 |
-                IE_IRQ2 | IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
-#endif
        /* tell oprofile which irq to use */
        ltq_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
-        /*
-         * if the timer irq is not one of the mips irqs we need to
-         * create a mapping
-         */
-        if (MIPS_CPU_TIMER_IRQ != 7)
-                irq_create_mapping(ltq_domain, MIPS_CPU_TIMER_IRQ);
        /* the external interrupts are optional and xway only */
        eiu_node = of_find_compatible_node(NULL, NULL, "lantiq,eiu-xway");
        if (eiu_node && !of_address_to_resource(eiu_node, 0, &res)) {
@@ -411,7 +346,7 @@ EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
 unsigned int get_c0_compare_int(void)
 {
-        return MIPS_CPU_TIMER_IRQ;
+        return CP0_LEGACY_COMPARE_IRQ;
 }
 static struct of_device_id __initdata of_irq_ids[] = {
diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
index 2a5bb849b10e..288b58b00dc8 100644
--- a/arch/mips/pci/msi-octeon.c
+++ b/arch/mips/pci/msi-octeon.c
@@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void)
        int irq;
        struct irq_chip *msi;
-        if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
+        if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) {
+                return 0;
+        } else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
                msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0;
                msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1;
                msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2;
diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile
index 0a935c136ec2..ac3482882cf9 100644
--- a/arch/nds32/Makefile
+++ b/arch/nds32/Makefile
@@ -3,9 +3,6 @@ OBJCOPYFLAGS	:= -O binary -R .note -R .note.gnu.build-id -R .comment -S
 KBUILD_DEFCONFIG := defconfig
-comma = ,
 ifdef CONFIG_FUNCTION_TRACER
 arch-y += -malways-save-lp -mno-relax
 endif
@@ -54,8 +51,6 @@ endif
 boot := arch/nds32/boot
 core-y += $(boot)/dts/
-.PHONY: FORCE
 Image: vmlinux
        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
@@ -68,9 +63,6 @@ prepare: vdso_prepare
 vdso_prepare: prepare0
        $(Q)$(MAKE) $(build)=arch/nds32/kernel/vdso include/generated/vdso-offsets.h
-CLEAN_FILES += include/asm-nds32/constants.h*
-# We use MRPROPER_FILES and CLEAN_FILES now
 archclean:
        $(Q)$(MAKE) $(clean)=$(boot)
diff --git a/arch/openrisc/Makefile b/arch/openrisc/Makefile
index 70e06d34006c..bf10141c7426 100644
--- a/arch/openrisc/Makefile
+++ b/arch/openrisc/Makefile
@@ -20,7 +20,6 @@
 KBUILD_DEFCONFIG := or1ksim_defconfig
 OBJCOPYFLAGS    := -O binary -R .note -R .comment -S
-LDFLAGS_vmlinux :=
 LIBGCC          := $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
 KBUILD_CFLAGS   += -pipe -ffixed-r10 -D__linux__
@@ -50,5 +49,3 @@ else
 BUILTIN_DTB := n
 endif
 core-$(BUILTIN_DTB) += arch/openrisc/boot/dts/
-all: vmlinux
diff --git a/arch/powerpc/include/uapi/asm/perf_regs.h b/arch/powerpc/include/uapi/asm/perf_regs.h
index ff91192407d1..f599064dd8dc 100644
--- a/arch/powerpc/include/uapi/asm/perf_regs.h
+++ b/arch/powerpc/include/uapi/asm/perf_regs.h
@@ -47,6 +47,7 @@ enum perf_event_powerpc_regs {
        PERF_REG_POWERPC_DAR,
        PERF_REG_POWERPC_DSISR,
        PERF_REG_POWERPC_SIER,
+        PERF_REG_POWERPC_MMCRA,
        PERF_REG_POWERPC_MAX,
 };
 #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 57deb1e9ffea..20cc816b3508 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -852,11 +852,12 @@ start_here:
        /* set up the PTE pointers for the Abatron bdiGDB.
        */
-        tovirt(r6,r6)
        lis     r5, abatron_pteptrs@h
        ori     r5, r5, abatron_pteptrs@l
        stw     r5, 0xf0(0)     /* Must match your Abatron config file */
        tophys(r5,r5)
+        lis     r6, swapper_pg_dir@h
+        ori     r6, r6, swapper_pg_dir@l
        stw     r6, 0(r5)
 /* Now turn on the MMU for real! */
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index bd5e6834ca69..6794466f6420 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -755,11 +755,12 @@ SYSCALL_DEFINE0(rt_sigreturn)
                if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
                                           &uc_transact->uc_mcontext))
                        goto badframe;
-        }
+        } else
 #endif
-        /* Fall through, for non-TM restore */
+        {
-        if (!MSR_TM_ACTIVE(msr)) {
                /*
+                 * Fall through, for non-TM restore
+                 *
                 * Unset MSR[TS] on the thread regs since MSR from user
                 * context does not have MSR active, and recheckpoint was
                 * not called since restore_tm_sigcontexts() was not called
diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 29746dc28df5..517662a56bdc 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -967,13 +967,6 @@ out:
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
-#if defined(CONFIG_FTRACE_SYSCALLS) && defined(CONFIG_PPC64)
-unsigned long __init arch_syscall_addr(int nr)
-{
-        return sys_call_table[nr*2];
-}
-#endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_PPC64 */
 #ifdef PPC64_ELF_ABI_v1
 char *arch_ftrace_match_adjust(char *str, const char *search)
 {
diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c
index 5c36b3a8d47a..3349f3f8fe84 100644
--- a/arch/powerpc/perf/perf_regs.c
+++ b/arch/powerpc/perf/perf_regs.c
@@ -70,6 +70,7 @@ static unsigned int pt_regs_offset[PERF_REG_POWERPC_MAX] = {
        PT_REGS_OFFSET(PERF_REG_POWERPC_DAR, dar),
        PT_REGS_OFFSET(PERF_REG_POWERPC_DSISR, dsisr),
        PT_REGS_OFFSET(PERF_REG_POWERPC_SIER, dar),
+        PT_REGS_OFFSET(PERF_REG_POWERPC_MMCRA, dsisr),
 };
 u64 perf_reg_value(struct pt_regs *regs, int idx)
@@ -83,6 +84,11 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
            !is_sier_available()))
                return 0;
+        if (idx == PERF_REG_POWERPC_MMCRA &&
+           (IS_ENABLED(CONFIG_FSL_EMB_PERF_EVENT) ||
+            IS_ENABLED(CONFIG_PPC32)))
+                return 0;
        return regs_get_register(regs, pt_regs_offset[idx]);
 }
diff --git a/arch/powerpc/platforms/4xx/ocm.c b/arch/powerpc/platforms/4xx/ocm.c
index a1aaa1569d7c..f0e488d97567 100644
--- a/arch/powerpc/platforms/4xx/ocm.c
+++ b/arch/powerpc/platforms/4xx/ocm.c
@@ -237,12 +237,12 @@ static int ocm_debugfs_show(struct seq_file *m, void *v)
                        continue;
                seq_printf(m, "PPC4XX OCM   : %d\n", ocm->index);
-                seq_printf(m, "PhysAddr     : %pa[p]\n", &(ocm->phys));
+                seq_printf(m, "PhysAddr     : %pa\n", &(ocm->phys));
                seq_printf(m, "MemTotal     : %d Bytes\n", ocm->memtotal);
                seq_printf(m, "MemTotal(NC) : %d Bytes\n", ocm->nc.memtotal);
                seq_printf(m, "MemTotal(C)  : %d Bytes\n\n", ocm->c.memtotal);
-                seq_printf(m, "NC.PhysAddr  : %pa[p]\n", &(ocm->nc.phys));
+                seq_printf(m, "NC.PhysAddr  : %pa\n", &(ocm->nc.phys));
                seq_printf(m, "NC.VirtAddr  : 0x%p\n", ocm->nc.virt);
                seq_printf(m, "NC.MemTotal  : %d Bytes\n", ocm->nc.memtotal);
                seq_printf(m, "NC.MemFree   : %d Bytes\n", ocm->nc.memfree);
@@ -252,7 +252,7 @@ static int ocm_debugfs_show(struct seq_file *m, void *v)
                                                        blk->size, blk->owner);
                }
-                seq_printf(m, "\nC.PhysAddr   : %pa[p]\n", &(ocm->c.phys));
+                seq_printf(m, "\nC.PhysAddr   : %pa\n", &(ocm->c.phys));
                seq_printf(m, "C.VirtAddr   : 0x%p\n", ocm->c.virt);
                seq_printf(m, "C.MemTotal   : %d Bytes\n", ocm->c.memtotal);
                seq_printf(m, "C.MemFree    : %d Bytes\n", ocm->c.memfree);
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index e66644e0fb40..9438fa0fc355 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -538,8 +538,7 @@ static void __init chrp_init_IRQ(void)
        /* see if there is a keyboard in the device tree
           with a parent of type "adb" */
        for_each_node_by_name(kbd, "keyboard")
-                if (kbd->parent && kbd->parent->type
+                if (of_node_is_type(kbd->parent, "adb"))
-                    && strcmp(kbd->parent->type, "adb") == 0)
                        break;
        of_node_put(kbd);
        if (kbd)
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index d7f742ed48ba..3f58c7dbd581 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -564,7 +564,7 @@ struct iommu_table_group *pnv_try_setup_npu_table_group(struct pnv_ioda_pe *pe)
                }
        } else {
                /* Create a group for 1 GPU and attached NPUs for POWER8 */
-                pe->npucomp = kzalloc(sizeof(pe->npucomp), GFP_KERNEL);
+                pe->npucomp = kzalloc(sizeof(*pe->npucomp), GFP_KERNEL);
                table_group = &pe->npucomp->table_group;
                table_group->ops = &pnv_npu_peers_ops;
                iommu_register_group(table_group, hose->global_number,
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 1d6406a051f1..7db3119f8a5b 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2681,7 +2681,8 @@ static void pnv_pci_ioda_setup_iommu_api(void)
        list_for_each_entry(hose, &hose_list, list_node) {
                phb = hose->private_data;
-                if (phb->type == PNV_PHB_NPU_NVLINK)
+                if (phb->type == PNV_PHB_NPU_NVLINK ||
+                    phb->type == PNV_PHB_NPU_OCAPI)
                        continue;
                list_for_each_entry(pe, &phb->ioda.pe_list, list) {
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index 7725825d887d..37a77e57893e 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -264,7 +264,9 @@ void __init pSeries_final_fixup(void)
                        if (!of_device_is_compatible(nvdn->parent,
                                                "ibm,power9-npu"))
                                continue;
+#ifdef CONFIG_PPC_POWERNV
                        WARN_ON_ONCE(pnv_npu2_init(hose));
+#endif
                        break;
                }
        }
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index ccbb53e22024..8d04e6f3f796 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -25,7 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
        atomic_set(&mm->context.flush_count, 0);
        mm->context.gmap_asce = 0;
        mm->context.flush_mm = 0;
-        mm->context.compat_mm = 0;
+        mm->context.compat_mm = test_thread_flag(TIF_31BIT);
 #ifdef CONFIG_PGSTE
        mm->context.alloc_pgste = page_table_allocate_pgste ||
                test_thread_flag(TIF_PGSTE) ||
@@ -90,8 +90,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
        int cpu = smp_processor_id();
-        if (prev == next)
-                return;
        S390_lowcore.user_asce = next->context.asce;
        cpumask_set_cpu(cpu, &next->context.cpu_attach_mask);
        /* Clear previous user-ASCE from CR1 and CR7 */
@@ -103,7 +101,8 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                __ctl_load(S390_lowcore.vdso_asce, 7, 7);
                clear_cpu_flag(CIF_ASCE_SECONDARY);
        }
-        cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
+        if (prev != next)
+                cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
 }
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index af5c2b3f7065..a8c7789b246b 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -63,10 +63,10 @@ static noinline __init void detect_machine_type(void)
        if (stsi(vmms, 3, 2, 2) || !vmms->count)
                return;
-        /* Running under KVM? If not we assume z/VM */
+        /* Detect known hypervisors */
        if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
                S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
-        else
+        else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4))
                S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
 }
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 72dd23ef771b..7ed90a759135 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -1006,6 +1006,8 @@ void __init setup_arch(char **cmdline_p)
                pr_info("Linux is running under KVM in 64-bit mode\n");
        else if (MACHINE_IS_LPAR)
                pr_info("Linux is running natively in 64-bit mode\n");
+        else
+                pr_info("Linux is running as a guest in 64-bit mode\n");
        /* Have one command line that is parsed and saved in /proc/cmdline */
        /* boot_command_line has been already set up in early.c */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index f82b3d3c36e2..b198ece2aad6 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -381,8 +381,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data)
 */
 void smp_call_ipl_cpu(void (*func)(void *), void *data)
 {
+        struct lowcore *lc = pcpu_devices->lowcore;
+        if (pcpu_devices[0].address == stap())
+                lc = &S390_lowcore;
        pcpu_delegate(&pcpu_devices[0], func, data,
-                      pcpu_devices->lowcore->nodat_stack);
+                      lc->nodat_stack);
 }
 int smp_find_processor_id(u16 address)
@@ -1166,7 +1171,11 @@ static ssize_t __ref rescan_store(struct device *dev,
 {
        int rc;
+        rc = lock_device_hotplug_sysfs();
+        if (rc)
+                return rc;
        rc = smp_rescan_cpus();
+        unlock_device_hotplug();
        return rc ? rc : count;
 }
 static DEVICE_ATTR_WO(rescan);
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index ebe748a9f472..4ff354887db4 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -224,10 +224,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
        vdso_pages = vdso64_pages;
 #ifdef CONFIG_COMPAT
-        if (is_compat_task()) {
+        mm->context.compat_mm = is_compat_task();
+        if (mm->context.compat_mm)
                vdso_pages = vdso32_pages;
-                mm->context.compat_mm = 1;
-        }
 #endif
        /*
         * vDSO has a problem and was disabled, just don't "enable" it for
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 15af091611e2..26387c7bf305 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -198,7 +198,7 @@ config X86
        select IRQ_FORCED_THREADING
        select NEED_SG_DMA_LENGTH
        select PCI_DOMAINS                      if PCI
-        select PCI_LOCKLESS_CONFIG
+        select PCI_LOCKLESS_CONFIG              if PCI
        select PERF_EVENTS
        select RTC_LIB
        select RTC_MC146818_LIB
@@ -617,7 +617,7 @@ config X86_INTEL_QUARK
 config X86_INTEL_LPSS
        bool "Intel Low Power Subsystem Support"
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select COMMON_CLK
        select PINCTRL
        select IOSF_MBI
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 8eaf8952c408..39913770a44d 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -361,7 +361,8 @@ ENTRY(entry_INT80_compat)
        /* Need to switch before accessing the thread stack. */
        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
-        movq    %rsp, %rdi
+        /* In the Xen PV case we already run on the thread stack. */
+        ALTERNATIVE "movq %rsp, %rdi", "jmp .Lint80_keep_stack", X86_FEATURE_XENPV
        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
        pushq   6*8(%rdi)               /* regs->ss */
@@ -370,8 +371,9 @@ ENTRY(entry_INT80_compat)
        pushq   3*8(%rdi)               /* regs->cs */
        pushq   2*8(%rdi)               /* regs->ip */
        pushq   1*8(%rdi)               /* regs->orig_ax */
        pushq   (%rdi)                  /* pt_regs->di */
+.Lint80_keep_stack:
        pushq   %rsi                    /* pt_regs->si */
        xorl    %esi, %esi              /* nospec   si */
        pushq   %rdx                    /* pt_regs->dx */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 0ca50611e8ce..19d18fae6ec6 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -178,6 +178,10 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
 void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
+/*
+ * Init a new mm.  Used on mm copies, like at fork()
+ * and on mm's that are brand-new, like at execve().
+ */
 static inline int init_new_context(struct task_struct *tsk,
                                   struct mm_struct *mm)
 {
@@ -228,8 +232,22 @@ do {						\
 } while (0)
 #endif
+static inline void arch_dup_pkeys(struct mm_struct *oldmm,
+                                  struct mm_struct *mm)
+{
+#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+        if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
+                return;
+        /* Duplicate the oldmm pkey state in mm: */
+        mm->context.pkey_allocation_map = oldmm->context.pkey_allocation_map;
+        mm->context.execute_only_pkey   = oldmm->context.execute_only_pkey;
+#endif
+}
 static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 {
+        arch_dup_pkeys(oldmm, mm);
        paravirt_arch_dup_mmap(oldmm, mm);
        return ldt_dup_context(oldmm, mm);
 }
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a77445d1b034..780f2b42c8ef 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -711,7 +711,7 @@ static __must_check inline bool user_access_begin(const void __user *ptr, size_t
 {
        if (unlikely(!access_ok(ptr,len)))
                return 0;
-        __uaccess_begin();
+        __uaccess_begin_nospec();
        return 1;
 }
 #define user_access_begin(a,b)  user_access_begin(a,b)
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index c8b07d8ea5a2..17ffc869cab8 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -470,6 +470,7 @@ int crash_load_segments(struct kimage *image)
        kbuf.memsz = kbuf.bufsz;
        kbuf.buf_align = ELF_CORE_HEADER_ALIGN;
+        kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
        ret = kexec_add_buffer(&kbuf);
        if (ret) {
                vfree((void *)image->arch.elf_headers);
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b0acb22e5a46..dfd3aca82c61 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -21,10 +21,6 @@
 #define HPET_MASK                       CLOCKSOURCE_MASK(32)
-/* FSEC = 10^-15
-   NSEC = 10^-9 */
-#define FSEC_PER_NSEC                   1000000L
 #define HPET_DEV_USED_BIT               2
 #define HPET_DEV_USED                   (1 << HPET_DEV_USED_BIT)
 #define HPET_DEV_VALID                  0x8
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 278cd07228dd..0d5efa34f359 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -434,6 +434,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
        kbuf.memsz = PAGE_ALIGN(header->init_size);
        kbuf.buf_align = header->kernel_alignment;
        kbuf.buf_min = MIN_KERNEL_LOAD_ADDR;
+        kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
        ret = kexec_add_buffer(&kbuf);
        if (ret)
                goto out_free_params;
@@ -448,6 +449,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
                kbuf.bufsz = kbuf.memsz = initrd_len;
                kbuf.buf_align = PAGE_SIZE;
                kbuf.buf_min = MIN_INITRD_LOAD_ADDR;
+                kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
                ret = kexec_add_buffer(&kbuf);
                if (ret)
                        goto out_free_params;
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index ba4bfb7f6a36..5c93a65ee1e5 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -457,6 +457,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
 #else
        u64 ipi_bitmap = 0;
 #endif
+        long ret;
        if (cpumask_empty(mask))
                return;
@@ -482,8 +483,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
                } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) {
                        max = apic_id < max ? max : apic_id;
                } else {
-                        kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                        ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                                (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                        WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
                        min = max = apic_id;
                        ipi_bitmap = 0;
                }
@@ -491,8 +493,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
        }
        if (ipi_bitmap) {
-                kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+                ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
                        (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
+                WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
        }
        local_irq_restore(flags);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index e9f777bfed40..3fae23834069 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -297,15 +297,16 @@ static int __init tsc_setup(char *str)
 __setup("tsc=", tsc_setup);
-#define MAX_RETRIES     5
+#define MAX_RETRIES             5
-#define SMI_TRESHOLD    50000
+#define TSC_DEFAULT_THRESHOLD   0x20000
 /*
- * Read TSC and the reference counters. Take care of SMI disturbance
+ * Read TSC and the reference counters. Take care of any disturbances
 */
 static u64 tsc_read_refs(u64 *p, int hpet)
 {
        u64 t1, t2;
+        u64 thresh = tsc_khz ? tsc_khz >> 5 : TSC_DEFAULT_THRESHOLD;
        int i;
        for (i = 0; i < MAX_RETRIES; i++) {
@@ -315,7 +316,7 @@ static u64 tsc_read_refs(u64 *p, int hpet)
                else
                        *p = acpi_pm_read_early();
                t2 = get_cycles();
-                if ((t2 - t1) < SMI_TRESHOLD)
+                if ((t2 - t1) < thresh)
                        return t2;
        }
        return ULLONG_MAX;
@@ -703,15 +704,15 @@ static unsigned long pit_hpet_ptimer_calibrate_cpu(void)
         * zero. In each wait loop iteration we read the TSC and check
         * the delta to the previous read. We keep track of the min
         * and max values of that delta. The delta is mostly defined
-         * by the IO time of the PIT access, so we can detect when a
+         * by the IO time of the PIT access, so we can detect when
-         * SMI/SMM disturbance happened between the two reads. If the
+         * any disturbance happened between the two reads. If the
         * maximum time is significantly larger than the minimum time,
         * then we discard the result and have another try.
         *
         * 2) Reference counter. If available we use the HPET or the
         * PMTIMER as a reference to check the sanity of that value.
         * We use separate TSC readouts and check inside of the
-         * reference read for a SMI/SMM disturbance. We dicard
+         * reference read for any possible disturbance. We dicard
         * disturbed values here as well. We do that around the PIT
         * calibration delay loop as we have to wait for a certain
         * amount of time anyway.
@@ -744,7 +745,7 @@ static unsigned long pit_hpet_ptimer_calibrate_cpu(void)
                if (ref1 == ref2)
                        continue;
-                /* Check, whether the sampling was disturbed by an SMI */
+                /* Check, whether the sampling was disturbed */
                if (tsc1 == ULLONG_MAX || tsc2 == ULLONG_MAX)
                        continue;
@@ -1268,7 +1269,7 @@ static DECLARE_DELAYED_WORK(tsc_irqwork, tsc_refine_calibration_work);
 */
 static void tsc_refine_calibration_work(struct work_struct *work)
 {
-        static u64 tsc_start = -1, ref_start;
+        static u64 tsc_start = ULLONG_MAX, ref_start;
        static int hpet;
        u64 tsc_stop, ref_stop, delta;
        unsigned long freq;
@@ -1283,14 +1284,15 @@ static void tsc_refine_calibration_work(struct work_struct *work)
         * delayed the first time we expire. So set the workqueue
         * again once we know timers are working.
         */
-        if (tsc_start == -1) {
+        if (tsc_start == ULLONG_MAX) {
+restart:
                /*
                 * Only set hpet once, to avoid mixing hardware
                 * if the hpet becomes enabled later.
                 */
                hpet = is_hpet_enabled();
-                schedule_delayed_work(&tsc_irqwork, HZ);
                tsc_start = tsc_read_refs(&ref_start, hpet);
+                schedule_delayed_work(&tsc_irqwork, HZ);
                return;
        }
@@ -1300,9 +1302,9 @@ static void tsc_refine_calibration_work(struct work_struct *work)
        if (ref_start == ref_stop)
                goto out;
-        /* Check, whether the sampling was disturbed by an SMI */
+        /* Check, whether the sampling was disturbed */
-        if (tsc_start == ULLONG_MAX || tsc_stop == ULLONG_MAX)
+        if (tsc_stop == ULLONG_MAX)
-                goto out;
+                goto restart;
        delta = tsc_stop - tsc_start;
        delta *= 1000000LL;
diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile
index 69b3a7c30013..31ecf7a76d5a 100644
--- a/arch/x86/kvm/Makefile
+++ b/arch/x86/kvm/Makefile
@@ -2,10 +2,6 @@
 ccflags-y += -Iarch/x86/kvm
-CFLAGS_x86.o := -I.
-CFLAGS_svm.o := -I.
-CFLAGS_vmx.o := -I.
 KVM := ../../../virt/kvm
 kvm-y                   += $(KVM)/kvm_main.o $(KVM)/coalesced_mmio.o \
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index c90a5352d158..89d20ed1d2e8 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -1636,7 +1636,7 @@ int kvm_hv_hypercall(struct kvm_vcpu *vcpu)
                ret = kvm_hvcall_signal_event(vcpu, fast, ingpa);
                if (ret != HV_STATUS_INVALID_PORT_ID)
                        break;
-                /* maybe userspace knows this conn_id: fall through */
+                /* fall through - maybe userspace knows this conn_id. */
        case HVCALL_POST_MESSAGE:
                /* don't bother userspace if it has no way to handle it */
                if (unlikely(rep || !vcpu_to_synic(vcpu)->active)) {
@@ -1832,7 +1832,6 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                        ent->eax |= HV_X64_MSR_VP_INDEX_AVAILABLE;
                        ent->eax |= HV_X64_MSR_RESET_AVAILABLE;
                        ent->eax |= HV_MSR_REFERENCE_TSC_AVAILABLE;
-                        ent->eax |= HV_X64_MSR_GUEST_IDLE_AVAILABLE;
                        ent->eax |= HV_X64_ACCESS_FREQUENCY_MSRS;
                        ent->eax |= HV_X64_ACCESS_REENLIGHTENMENT;
@@ -1848,11 +1847,11 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid,
                case HYPERV_CPUID_ENLIGHTMENT_INFO:
                        ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED;
                        ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED;
-                        ent->eax |= HV_X64_SYSTEM_RESET_RECOMMENDED;
                        ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
                        ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED;
                        ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED;
-                        ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
+                        if (evmcs_ver)
+                                ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;
                        /*
                         * Default number of spinlock retry attempts, matches
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9f089e2e09d0..4b6c2da7265c 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1035,6 +1035,7 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
        switch (delivery_mode) {
        case APIC_DM_LOWEST:
                vcpu->arch.apic_arb_prio++;
+                /* fall through */
        case APIC_DM_FIXED:
                if (unlikely(trig_mode && !level))
                        break;
@@ -1874,6 +1875,7 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
        case APIC_LVT0:
                apic_manage_nmi_watchdog(apic, val);
+                /* fall through */
        case APIC_LVTTHMR:
        case APIC_LVTPC:
        case APIC_LVT1:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index ce770b446238..da9c42349b1f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4371,6 +4371,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
                        rsvd_bits(maxphyaddr, 51);
                rsvd_check->rsvd_bits_mask[1][4] =
                        rsvd_check->rsvd_bits_mask[0][4];
+                /* fall through */
        case PT64_ROOT_4LEVEL:
                rsvd_check->rsvd_bits_mask[0][3] = exb_bit_rsvd |
                        nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index a157ca5b6869..f13a3a24d360 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3414,6 +3414,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
        kvm_mmu_reset_context(&svm->vcpu);
        kvm_mmu_load(&svm->vcpu);
+        /*
+         * Drop what we picked up for L2 via svm_complete_interrupts() so it
+         * doesn't end up in L1.
+         */
+        svm->vcpu.arch.nmi_injected = false;
+        kvm_clear_exception_queue(&svm->vcpu);
+        kvm_clear_interrupt_queue(&svm->vcpu);
        return 0;
 }
@@ -4395,7 +4403,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
        case MSR_IA32_APICBASE:
                if (kvm_vcpu_apicv_active(vcpu))
                        avic_update_vapic_bar(to_svm(vcpu), data);
-                /* Follow through */
+                /* Fall through */
        default:
                return kvm_set_msr_common(vcpu, msr);
        }
@@ -4504,28 +4512,19 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
                break;
        case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
-                int i;
-                struct kvm_vcpu *vcpu;
-                struct kvm *kvm = svm->vcpu.kvm;
                struct kvm_lapic *apic = svm->vcpu.arch.apic;
                /*
-                 * At this point, we expect that the AVIC HW has already
+                 * Update ICR high and low, then emulate sending IPI,
-                 * set the appropriate IRR bits on the valid target
+                 * which is handled when writing APIC_ICR.
-                 * vcpus. So, we just need to kick the appropriate vcpu.
                 */
-                kvm_for_each_vcpu(i, vcpu, kvm) {
+                kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
-                        bool m = kvm_apic_match_dest(vcpu, apic,
+                kvm_lapic_reg_write(apic, APIC_ICR, icrl);
-                                                     icrl & KVM_APIC_SHORT_MASK,
-                                                     GET_APIC_DEST_FIELD(icrh),
-                                                     icrl & KVM_APIC_DEST_MASK);
-                        if (m && !avic_vcpu_is_running(vcpu))
-                                kvm_vcpu_wake_up(vcpu);
-                }
                break;
        }
        case AVIC_IPI_FAILURE_INVALID_TARGET:
+                WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n",
+                          index, svm->vcpu.vcpu_id, icrh, icrl);
                break;
        case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
                WARN_ONCE(1, "Invalid backing page\n");
diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
index 705f40ae2532..6432d08c7de7 100644
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -1465,7 +1465,7 @@ TRACE_EVENT(kvm_hv_send_ipi_ex,
 #endif /* _TRACE_KVM_H */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH arch/x86/kvm
+#define TRACE_INCLUDE_PATH ../../arch/x86/kvm
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
diff --git a/arch/x86/kvm/vmx/evmcs.c b/arch/x86/kvm/vmx/evmcs.c
index 95bc2247478d..5466c6d85cf3 100644
--- a/arch/x86/kvm/vmx/evmcs.c
+++ b/arch/x86/kvm/vmx/evmcs.c
@@ -332,16 +332,17 @@ int nested_enable_evmcs(struct kvm_vcpu *vcpu,
                        uint16_t *vmcs_version)
 {
        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool evmcs_already_enabled = vmx->nested.enlightened_vmcs_enabled;
+        vmx->nested.enlightened_vmcs_enabled = true;
        if (vmcs_version)
                *vmcs_version = nested_get_evmcs_version(vcpu);
        /* We don't support disabling the feature for simplicity. */
-        if (vmx->nested.enlightened_vmcs_enabled)
+        if (evmcs_already_enabled)
                return 0;
-        vmx->nested.enlightened_vmcs_enabled = true;
        vmx->nested.msrs.pinbased_ctls_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
        vmx->nested.msrs.entry_ctls_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
        vmx->nested.msrs.exit_ctls_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 2616bd2c7f2c..8ff20523661b 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -55,7 +55,7 @@ static u16 shadow_read_write_fields[] = {
 static int max_shadow_read_write_fields =
        ARRAY_SIZE(shadow_read_write_fields);
-void init_vmcs_shadow_fields(void)
+static void init_vmcs_shadow_fields(void)
 {
        int i, j;
@@ -4140,11 +4140,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
        if (r < 0)
                goto out_vmcs02;
-        vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
        if (!vmx->nested.cached_vmcs12)
                goto out_cached_vmcs12;
-        vmx->nested.cached_shadow_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
+        vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
        if (!vmx->nested.cached_shadow_vmcs12)
                goto out_cached_shadow_vmcs12;
@@ -5263,13 +5263,17 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
                        copy_shadow_to_vmcs12(vmx);
        }
-        if (copy_to_user(user_kvm_nested_state->data, vmcs12, sizeof(*vmcs12)))
+        /*
+         * Copy over the full allocated size of vmcs12 rather than just the size
+         * of the struct.
+         */
+        if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
                return -EFAULT;
        if (nested_cpu_has_shadow_vmcs(vmcs12) &&
            vmcs12->vmcs_link_pointer != -1ull) {
                if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
-                                 get_shadow_vmcs12(vcpu), sizeof(*vmcs12)))
+                                 get_shadow_vmcs12(vcpu), VMCS12_SIZE))
                        return -EFAULT;
        }
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index f6915f10e584..4341175339f3 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -423,7 +423,7 @@ static void check_ept_pointer_match(struct kvm *kvm)
        to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
 }
-int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
+static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
                void *data)
 {
        struct kvm_tlb_range *range = data;
@@ -1773,7 +1773,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                if (!msr_info->host_initiated &&
                    !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
                        return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
        default:
                msr = find_msr_entry(vmx, msr_info->index);
                if (msr) {
@@ -2014,7 +2014,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                /* Check reserved bit, higher 32 bits should be zero */
                if ((data >> 32) != 0)
                        return 1;
-                /* Otherwise falls through */
+                /* Else, falls through */
        default:
                msr = find_msr_entry(vmx, msr_index);
                if (msr) {
@@ -2344,7 +2344,7 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
                case 37: /* AAT100 */
                case 44: /* BC86,AAY89,BD102 */
                case 46: /* BA97 */
-                        _vmexit_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+                        _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
                        _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
                        pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
                                        "does not work properly. Using workaround\n");
@@ -6362,72 +6362,9 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
        vmx->loaded_vmcs->hv_timer_armed = false;
 }
-static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
 {
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        unsigned long evmcs_rsp;
-        unsigned long cr3, cr4, evmcs_rsp;
-        /* Record the guest's net vcpu time for enforced NMI injections. */
-        if (unlikely(!enable_vnmi &&
-                     vmx->loaded_vmcs->soft_vnmi_blocked))
-                vmx->loaded_vmcs->entry_time = ktime_get();
-        /* Don't enter VMX if guest state is invalid, let the exit handler
-           start emulation until we arrive back to a valid state */
-        if (vmx->emulation_required)
-                return;
-        if (vmx->ple_window_dirty) {
-                vmx->ple_window_dirty = false;
-                vmcs_write32(PLE_WINDOW, vmx->ple_window);
-        }
-        if (vmx->nested.need_vmcs12_sync)
-                nested_sync_from_vmcs12(vcpu);
-        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
-        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
-                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
-        cr3 = __get_current_cr3_fast();
-        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
-                vmcs_writel(HOST_CR3, cr3);
-                vmx->loaded_vmcs->host_state.cr3 = cr3;
-        }
-        cr4 = cr4_read_shadow();
-        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
-                vmcs_writel(HOST_CR4, cr4);
-                vmx->loaded_vmcs->host_state.cr4 = cr4;
-        }
-        /* When single-stepping over STI and MOV SS, we must clear the
-         * corresponding interruptibility bits in the guest state. Otherwise
-         * vmentry fails as it then expects bit 14 (BS) in pending debug
-         * exceptions being set, but that's not correct for the guest debugging
-         * case. */
-        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
-                vmx_set_interrupt_shadow(vcpu, 0);
-        if (static_cpu_has(X86_FEATURE_PKU) &&
-            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
-            vcpu->arch.pkru != vmx->host_pkru)
-                __write_pkru(vcpu->arch.pkru);
-        pt_guest_enter(vmx);
-        atomic_switch_perf_msrs(vmx);
-        vmx_update_hv_timer(vcpu);
-        /*
-         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
-         * it's non-zero. Since vmentry is serialising on affected CPUs, there
-         * is no need to worry about the conditional branch over the wrmsr
-         * being speculatively taken.
-         */
-        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
        vmx->__launched = vmx->loaded_vmcs->launched;
@@ -6567,6 +6504,77 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
                , "eax", "ebx", "edi"
 #endif
              );
+}
+STACK_FRAME_NON_STANDARD(__vmx_vcpu_run);
+static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        unsigned long cr3, cr4;
+        /* Record the guest's net vcpu time for enforced NMI injections. */
+        if (unlikely(!enable_vnmi &&
+                     vmx->loaded_vmcs->soft_vnmi_blocked))
+                vmx->loaded_vmcs->entry_time = ktime_get();
+        /* Don't enter VMX if guest state is invalid, let the exit handler
+           start emulation until we arrive back to a valid state */
+        if (vmx->emulation_required)
+                return;
+        if (vmx->ple_window_dirty) {
+                vmx->ple_window_dirty = false;
+                vmcs_write32(PLE_WINDOW, vmx->ple_window);
+        }
+        if (vmx->nested.need_vmcs12_sync)
+                nested_sync_from_vmcs12(vcpu);
+        if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
+        if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+                vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+        cr3 = __get_current_cr3_fast();
+        if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
+                vmcs_writel(HOST_CR3, cr3);
+                vmx->loaded_vmcs->host_state.cr3 = cr3;
+        }
+        cr4 = cr4_read_shadow();
+        if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
+                vmcs_writel(HOST_CR4, cr4);
+                vmx->loaded_vmcs->host_state.cr4 = cr4;
+        }
+        /* When single-stepping over STI and MOV SS, we must clear the
+         * corresponding interruptibility bits in the guest state. Otherwise
+         * vmentry fails as it then expects bit 14 (BS) in pending debug
+         * exceptions being set, but that's not correct for the guest debugging
+         * case. */
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+                vmx_set_interrupt_shadow(vcpu, 0);
+        if (static_cpu_has(X86_FEATURE_PKU) &&
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+            vcpu->arch.pkru != vmx->host_pkru)
+                __write_pkru(vcpu->arch.pkru);
+        pt_guest_enter(vmx);
+        atomic_switch_perf_msrs(vmx);
+        vmx_update_hv_timer(vcpu);
+        /*
+         * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+         * it's non-zero. Since vmentry is serialising on affected CPUs, there
+         * is no need to worry about the conditional branch over the wrmsr
+         * being speculatively taken.
+         */
+        x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+        __vmx_vcpu_run(vcpu, vmx);
        /*
         * We do not use IBRS in the kernel. If this vCPU has used the
@@ -6648,7 +6656,6 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
        vmx_recover_nmi_blocking(vmx);
        vmx_complete_interrupts(vmx);
 }
-STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
 static struct kvm *vmx_vm_alloc(void)
 {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02c8e095a239..3d27206f6c01 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3834,6 +3834,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
        case KVM_CAP_HYPERV_SYNIC2:
                if (cap->args[0])
                        return -EINVAL;
+                /* fall through */
        case KVM_CAP_HYPERV_SYNIC:
                if (!irqchip_in_kernel(vcpu->kvm))
                        return -EINVAL;
@@ -6480,8 +6482,7 @@ restart:
                toggle_interruptibility(vcpu, ctxt->interruptibility);
                vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE &&
+                if (r == EMULATE_DONE && ctxt->tf)
-                    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
                        kvm_vcpu_do_singlestep(vcpu, &r);
                if (!ctxt->have_exception ||
                    exception_type(ctxt->exception.vector) == EXCPT_TRAP)
@@ -7093,10 +7094,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
        case KVM_HC_CLOCK_PAIRING:
                ret = kvm_pv_clock_pairing(vcpu, a0, a1);
                break;
+#endif
        case KVM_HC_SEND_IPI:
                ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
                break;
-#endif
        default:
                ret = -KVM_ENOSYS;
                break;
@@ -7937,6 +7938,7 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
                vcpu->arch.pv.pv_unhalted = false;
                vcpu->arch.mp_state =
                        KVM_MP_STATE_RUNNABLE;
+                /* fall through */
        case KVM_MP_STATE_RUNNABLE:
                vcpu->arch.apf.halted = false;
                break;
diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c
index 79778ab200e4..a53665116458 100644
--- a/arch/x86/lib/kaslr.c
+++ b/arch/x86/lib/kaslr.c
@@ -36,8 +36,8 @@ static inline u16 i8254(void)
        u16 status, timer;
        do {
-                outb(I8254_PORT_CONTROL,
+                outb(I8254_CMD_READBACK | I8254_SELECT_COUNTER0,
-                     I8254_CMD_READBACK | I8254_SELECT_COUNTER0);
+                     I8254_PORT_CONTROL);
                status = inb(I8254_PORT_COUNTER0);
                timer  = inb(I8254_PORT_COUNTER0);
                timer |= inb(I8254_PORT_COUNTER0) << 8;
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index a19ef1a416ff..4aa9b1480866 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -158,8 +158,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
        pmd = pmd_offset(pud, ppd->vaddr);
        if (pmd_none(*pmd)) {
                pte = ppd->pgtable_area;
-                memset(pte, 0, sizeof(pte) * PTRS_PER_PTE);
+                memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE);
-                ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE;
+                ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE;
                set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte)));
        }
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 2f6787fc7106..c54a493e139a 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -898,10 +898,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
        val = native_read_msr_safe(msr, err);
        switch (msr) {
        case MSR_IA32_APICBASE:
-#ifdef CONFIG_X86_X2APIC
+                val &= ~X2APIC_ENABLE;
-                if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
-#endif
-                        val &= ~X2APIC_ENABLE;
                break;
        }
        return val;
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 72bf446c3fee..6e29794573b7 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -361,8 +361,6 @@ void xen_timer_resume(void)
 {
        int cpu;
-        pvclock_resume();
        if (xen_clockevent != &xen_vcpuop_clockevent)
                return;
@@ -379,12 +377,15 @@ static const struct pv_time_ops xen_time_ops __initconst = {
 };
 static struct pvclock_vsyscall_time_info *xen_clock __read_mostly;
+static u64 xen_clock_value_saved;
 void xen_save_time_memory_area(void)
 {
        struct vcpu_register_time_memory_area t;
        int ret;
+        xen_clock_value_saved = xen_clocksource_read() - xen_sched_clock_offset;
        if (!xen_clock)
                return;
@@ -404,7 +405,7 @@ void xen_restore_time_memory_area(void)
        int ret;
        if (!xen_clock)
-                return;
+                goto out;
        t.addr.v = &xen_clock->pvti;
@@ -421,6 +422,11 @@ void xen_restore_time_memory_area(void)
        if (ret != 0)
                pr_notice("Cannot restore secondary vcpu_time_info (err %d)",
                          ret);
+out:
+        /* Need pvclock_resume() before using xen_clocksource_read(). */
+        pvclock_resume();
+        xen_sched_clock_offset = xen_clocksource_read() - xen_clock_value_saved;
 }
 static void xen_setup_vsyscall_time_info(void)
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 63e0f12be7c9..72adbbe975d5 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1154,15 +1154,14 @@ static void bfq_activate_requeue_entity(struct bfq_entity *entity,
 }
 /**
- * __bfq_deactivate_entity - deactivate an entity from its service tree.
+ * __bfq_deactivate_entity - update sched_data and service trees for
- * @entity: the entity to deactivate.
+ * entity, so as to represent entity as inactive
+ * @entity: the entity being deactivated.
 * @ins_into_idle_tree: if false, the entity will not be put into the
 *                      idle tree.
 *
- * Deactivates an entity, independently of its previous state.  Must
+ * If necessary and allowed, puts entity into the idle tree. NOTE:
- * be invoked only if entity is on a service tree. Extracts the entity
+ * entity may be on no tree if in service.
- * from that tree, and if necessary and allowed, puts it into the idle
- * tree.
 */
 bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
 {
diff --git a/block/blk-mq-debugfs-zoned.c b/block/blk-mq-debugfs-zoned.c
index fb2c82c351e4..038cb627c868 100644
--- a/block/blk-mq-debugfs-zoned.c
+++ b/block/blk-mq-debugfs-zoned.c
@@ -1,8 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
 * Copyright (C) 2017 Western Digital Corporation or its affiliates.
- *
- * This file is released under the GPL.
 */
 #include <linux/blkdev.h>
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 90d68760af08..f8120832ca7b 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -308,8 +308,9 @@ static const char *const cmd_flag_name[] = {
        CMD_FLAG_NAME(PREFLUSH),
        CMD_FLAG_NAME(RAHEAD),
        CMD_FLAG_NAME(BACKGROUND),
-        CMD_FLAG_NAME(NOUNMAP),
        CMD_FLAG_NAME(NOWAIT),
+        CMD_FLAG_NAME(NOUNMAP),
+        CMD_FLAG_NAME(HIPRI),
 };
 #undef CMD_FLAG_NAME
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 3ba37b9e15e9..8f5b533764ca 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1906,7 +1906,7 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 {
        const int is_sync = op_is_sync(bio->bi_opf);
        const int is_flush_fua = op_is_flush(bio->bi_opf);
-        struct blk_mq_alloc_data data = { .flags = 0, .cmd_flags = bio->bi_opf };
+        struct blk_mq_alloc_data data = { .flags = 0};
        struct request *rq;
        struct blk_plug *plug;
        struct request *same_queue_rq = NULL;
@@ -1928,6 +1928,7 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
        rq_qos_throttle(q, bio);
+        data.cmd_flags = bio->bi_opf;
        rq = blk_mq_get_request(q, bio, &data);
        if (unlikely(!rq)) {
                rq_qos_cleanup(q, bio);
diff --git a/block/blk-wbt.c b/block/blk-wbt.c
index f0c56649775f..fd166fbb0f65 100644
--- a/block/blk-wbt.c
+++ b/block/blk-wbt.c
@@ -597,7 +597,7 @@ static void wbt_track(struct rq_qos *rqos, struct request *rq, struct bio *bio)
        rq->wbt_flags |= bio_to_wbt_flags(rwb, bio);
 }
-void wbt_issue(struct rq_qos *rqos, struct request *rq)
+static void wbt_issue(struct rq_qos *rqos, struct request *rq)
 {
        struct rq_wb *rwb = RQWB(rqos);
@@ -617,7 +617,7 @@ void wbt_issue(struct rq_qos *rqos, struct request *rq)
        }
 }
-void wbt_requeue(struct rq_qos *rqos, struct request *rq)
+static void wbt_requeue(struct rq_qos *rqos, struct request *rq)
 {
        struct rq_wb *rwb = RQWB(rqos);
        if (!rwb_enabled(rwb))
diff --git a/crypto/adiantum.c b/crypto/adiantum.c
index 6651e713c45d..5564e73266a6 100644
--- a/crypto/adiantum.c
+++ b/crypto/adiantum.c
@@ -539,6 +539,8 @@ static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
        ictx = skcipher_instance_ctx(inst);
        /* Stream cipher, e.g. "xchacha12" */
+        crypto_set_skcipher_spawn(&ictx->streamcipher_spawn,
+                                  skcipher_crypto_instance(inst));
        err = crypto_grab_skcipher(&ictx->streamcipher_spawn, streamcipher_name,
                                   0, crypto_requires_sync(algt->type,
                                                           algt->mask));
@@ -547,6 +549,8 @@ static int adiantum_create(struct crypto_template *tmpl, struct rtattr **tb)
        streamcipher_alg = crypto_spawn_skcipher_alg(&ictx->streamcipher_spawn);
        /* Block cipher, e.g. "aes" */
+        crypto_set_spawn(&ictx->blockcipher_spawn,
+                         skcipher_crypto_instance(inst));
        err = crypto_grab_spawn(&ictx->blockcipher_spawn, blockcipher_name,
                                CRYPTO_ALG_TYPE_CIPHER, CRYPTO_ALG_TYPE_MASK);
        if (err)
diff --git a/crypto/authenc.c b/crypto/authenc.c
index 37f54d1b2f66..4be293a4b5f0 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -58,14 +58,22 @@ int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
                return -EINVAL;
        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
                return -EINVAL;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
+        /*
+         * RTA_OK() didn't align the rtattr's payload when validating that it
+         * fits in the buffer.  Yet, the keys should start on the next 4-byte
+         * aligned boundary.  To avoid confusion, require that the rtattr
+         * payload be exactly the param struct, which has a 4-byte aligned size.
+         */
+        if (RTA_PAYLOAD(rta) != sizeof(*param))
                return -EINVAL;
+        BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
        param = RTA_DATA(rta);
        keys->enckeylen = be32_to_cpu(param->enckeylen);
-        key += RTA_ALIGN(rta->rta_len);
+        key += rta->rta_len;
-        keylen -= RTA_ALIGN(rta->rta_len);
+        keylen -= rta->rta_len;
        if (keylen < keys->enckeylen)
                return -EINVAL;
diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index 80a25cc04aec..4741fe89ba2c 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -279,7 +279,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq,
        struct aead_request *req = areq->data;
        err = err ?: crypto_authenc_esn_decrypt_tail(req, 0);
-        aead_request_complete(req, err);
+        authenc_esn_request_complete(req, err);
 }
 static int crypto_authenc_esn_decrypt(struct aead_request *req)
diff --git a/crypto/sm3_generic.c b/crypto/sm3_generic.c
index 9a5c60f08aad..c0cf87ae7ef6 100644
--- a/crypto/sm3_generic.c
+++ b/crypto/sm3_generic.c
@@ -100,7 +100,7 @@ static void sm3_compress(u32 *w, u32 *wt, u32 *m)
        for (i = 0; i <= 63; i++) {
-                ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i)), 7);
+                ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i & 31)), 7);
                ss2 = ss1 ^ rol32(a, 12);
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 7c6afc111d76..bb857421c2e8 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -41,7 +41,8 @@ acpi-y				+= ec.o
 acpi-$(CONFIG_ACPI_DOCK)        += dock.o
 acpi-$(CONFIG_PCI)              += pci_root.o pci_link.o pci_irq.o
 obj-$(CONFIG_ACPI_MCFG)         += pci_mcfg.o
-acpi-y                          += acpi_lpss.o acpi_apd.o
+acpi-$(CONFIG_PCI)              += acpi_lpss.o
+acpi-y                          += acpi_apd.o
 acpi-y                          += acpi_platform.o
 acpi-y                          += acpi_pnp.o
 acpi-$(CONFIG_ARM_AMBA) += acpi_amba.o
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 99d820a693a8..5c093ce01bcd 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1054,18 +1054,6 @@ void __init acpi_early_init(void)
                goto error0;
        }
-        /*
-         * ACPI 2.0 requires the EC driver to be loaded and work before
-         * the EC device is found in the namespace (i.e. before
-         * acpi_load_tables() is called).
-         *
-         * This is accomplished by looking for the ECDT table, and getting
-         * the EC parameters out of that.
-         *
-         * Ignore the result. Not having an ECDT is not fatal.
-         */
-        status = acpi_ec_ecdt_probe();
 #ifdef CONFIG_X86
        if (!acpi_ioapic) {
                /* compatible (0) means level (3) */
@@ -1142,6 +1130,18 @@ static int __init acpi_bus_init(void)
                goto error1;
        }
+        /*
+         * ACPI 2.0 requires the EC driver to be loaded and work before the EC
+         * device is found in the namespace.
+         *
+         * This is accomplished by looking for the ECDT table and getting the EC
+         * parameters out of that.
+         *
+         * Do that before calling acpi_initialize_objects() which may trigger EC
+         * address space accesses.
+         */
+        acpi_ec_ecdt_probe();
        status = acpi_enable_subsystem(ACPI_NO_ACPI_ENABLE);
        if (ACPI_FAILURE(status)) {
                printk(KERN_ERR PREFIX
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 7e6952edb5b0..6a9e1fb8913a 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -81,7 +81,11 @@ void acpi_debugfs_init(void);
 #else
 static inline void acpi_debugfs_init(void) { return; }
 #endif
+#ifdef CONFIG_PCI
 void acpi_lpss_init(void);
+#else
+static inline void acpi_lpss_init(void) {}
+#endif
 void acpi_apd_init(void);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index a22e2f2bbb75..c7afb1f223f7 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -26,7 +26,6 @@
 #include <acpi/nfit.h>
 #include "intel.h"
 #include "nfit.h"
-#include "intel.h"
 /*
 * For readq() and writeq() on 32-bit builds, the hi-lo, lo-hi order is
@@ -82,12 +81,6 @@ const guid_t *to_nfit_uuid(enum nfit_uuids id)
 }
 EXPORT_SYMBOL(to_nfit_uuid);
-static struct acpi_nfit_desc *to_acpi_nfit_desc(
-                struct nvdimm_bus_descriptor *nd_desc)
-{
-        return container_of(nd_desc, struct acpi_nfit_desc, nd_desc);
-}
 static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
 {
        struct nvdimm_bus_descriptor *nd_desc = &acpi_desc->nd_desc;
@@ -420,10 +413,40 @@ static bool payload_dumpable(struct nvdimm *nvdimm, unsigned int func)
        return true;
 }
+static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+                struct nd_cmd_pkg *call_pkg)
+{
+        if (call_pkg) {
+                int i;
+                if (nfit_mem && nfit_mem->family != call_pkg->nd_family)
+                        return -ENOTTY;
+                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+                        if (call_pkg->nd_reserved2[i])
+                                return -EINVAL;
+                return call_pkg->nd_command;
+        }
+        /* In the !call_pkg case, bus commands == bus functions */
+        if (!nfit_mem)
+                return cmd;
+        /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+        if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+                return cmd;
+        /*
+         * Force function number validation to fail since 0 is never
+         * published as a valid function in dsm_mask.
+         */
+        return 0;
+}
 int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
        union acpi_object in_obj, in_buf, *out_obj;
        const struct nd_cmd_desc *desc = NULL;
@@ -433,29 +456,23 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
        unsigned long cmd_mask, dsm_mask;
        u32 offset, fw_status = 0;
        acpi_handle handle;
-        unsigned int func;
        const guid_t *guid;
-        int rc, i;
+        int func, rc, i;
        if (cmd_rc)
                *cmd_rc = -EINVAL;
-        func = cmd;
-        if (cmd == ND_CMD_CALL) {
-                call_pkg = buf;
-                func = call_pkg->nd_command;
-                for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+        if (cmd == ND_CMD_CALL)
-                        if (call_pkg->nd_reserved2[i])
+                call_pkg = buf;
-                                return -EINVAL;
+        func = cmd_to_func(nfit_mem, cmd, call_pkg);
-        }
+        if (func < 0)
+                return func;
        if (nvdimm) {
                struct acpi_device *adev = nfit_mem->adev;
                if (!adev)
                        return -ENOTTY;
-                if (call_pkg && nfit_mem->family != call_pkg->nd_family)
-                        return -ENOTTY;
                dimm_name = nvdimm_name(nvdimm);
                cmd_name = nvdimm_cmd_name(cmd);
@@ -469,9 +486,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
                cmd_name = nvdimm_bus_cmd_name(cmd);
                cmd_mask = nd_desc->cmd_mask;
-                dsm_mask = cmd_mask;
+                dsm_mask = nd_desc->bus_dsm_mask;
-                if (cmd == ND_CMD_CALL)
-                        dsm_mask = nd_desc->bus_dsm_mask;
                desc = nd_cmd_bus_desc(cmd);
                guid = to_nfit_uuid(NFIT_DEV_BUS);
                handle = adev->handle;
@@ -481,7 +496,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
        if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
                return -ENOTTY;
-        if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
+        /*
+         * Check for a valid command.  For ND_CMD_CALL, we also have to
+         * make sure that the DSM function is supported.
+         */
+        if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask))
+                return -ENOTTY;
+        else if (!test_bit(cmd, &cmd_mask))
                return -ENOTTY;
        in_obj.type = ACPI_TYPE_PACKAGE;
@@ -725,6 +746,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
        struct acpi_nfit_memory_map *memdev;
        struct acpi_nfit_desc *acpi_desc;
        struct nfit_mem *nfit_mem;
+        u16 physical_id;
        mutex_lock(&acpi_desc_lock);
        list_for_each_entry(acpi_desc, &acpi_descs, list) {
@@ -732,10 +754,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
                list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) {
                        memdev = __to_nfit_memdev(nfit_mem);
                        if (memdev->device_handle == device_handle) {
+                                *flags = memdev->flags;
+                                physical_id = memdev->physical_id;
                                mutex_unlock(&acpi_desc->init_mutex);
                                mutex_unlock(&acpi_desc_lock);
-                                *flags = memdev->flags;
+                                return physical_id;
-                                return memdev->physical_id;
                        }
                }
                mutex_unlock(&acpi_desc->init_mutex);
@@ -1892,6 +1915,13 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                return 0;
        }
+        /*
+         * Function 0 is the command interrogation function, don't
+         * export it to potential userspace use, and enable it to be
+         * used as an error value in acpi_nfit_ctl().
+         */
+        dsm_mask &= ~1UL;
        guid = to_nfit_uuid(nfit_mem->family);
        for_each_set_bit(i, &dsm_mask, BITS_PER_LONG)
                if (acpi_check_dsm(adev_dimm->handle, guid,
@@ -2085,11 +2115,6 @@ static int acpi_nfit_register_dimms(struct acpi_nfit_desc *acpi_desc)
                if (!nvdimm)
                        continue;
-                rc = nvdimm_security_setup_events(nvdimm);
-                if (rc < 0)
-                        dev_warn(acpi_desc->dev,
-                                "security event setup failed: %d\n", rc);
                nfit_kernfs = sysfs_get_dirent(nvdimm_kobj(nvdimm)->sd, "nfit");
                if (nfit_kernfs)
                        nfit_mem->flags_attr = sysfs_get_dirent(nfit_kernfs,
@@ -2269,7 +2294,6 @@ static int acpi_nfit_init_interleave_set(struct acpi_nfit_desc *acpi_desc,
        nd_set = devm_kzalloc(dev, sizeof(*nd_set), GFP_KERNEL);
        if (!nd_set)
                return -ENOMEM;
-        ndr_desc->nd_set = nd_set;
        guid_copy(&nd_set->type_guid, (guid_t *) spa->range_guid);
        info = devm_kzalloc(dev, sizeof_nfit_set_info(nr), GFP_KERNEL);
@@ -3405,7 +3429,7 @@ EXPORT_SYMBOL_GPL(acpi_nfit_init);
 static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        struct device *dev = acpi_desc->dev;
        /* Bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
@@ -3422,7 +3446,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
 static int __acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
                struct nvdimm *nvdimm, unsigned int cmd)
 {
-        struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+        struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
        if (nvdimm)
                return 0;
diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
index 850b2927b4e7..f70de71f79d6 100644
--- a/drivers/acpi/nfit/intel.c
+++ b/drivers/acpi/nfit/intel.c
@@ -146,7 +146,7 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
 static void nvdimm_invalidate_cache(void);
-static int intel_security_unlock(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *key_data)
 {
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
@@ -227,7 +227,7 @@ static int intel_security_disable(struct nvdimm *nvdimm,
        return 0;
 }
-static int intel_security_erase(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_erase(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *key,
                enum nvdimm_passphrase_type ptype)
 {
@@ -276,7 +276,7 @@ static int intel_security_erase(struct nvdimm *nvdimm,
        return 0;
 }
-static int intel_security_query_overwrite(struct nvdimm *nvdimm)
+static int __maybe_unused intel_security_query_overwrite(struct nvdimm *nvdimm)
 {
        int rc;
        struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
@@ -313,7 +313,7 @@ static int intel_security_query_overwrite(struct nvdimm *nvdimm)
        return 0;
 }
-static int intel_security_overwrite(struct nvdimm *nvdimm,
+static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
                const struct nvdimm_key_data *nkey)
 {
        int rc;
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 7496b10532aa..6a2185eb66c5 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -11,6 +11,7 @@
 #include <linux/kdev_t.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/namei.h>
 #include <linux/magic.h>
 #include <linux/major.h>
 #include <linux/miscdevice.h>
@@ -20,6 +21,7 @@
 #include <linux/parser.h>
 #include <linux/radix-tree.h>
 #include <linux/sched.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/spinlock_types.h>
 #include <linux/stddef.h>
@@ -30,7 +32,7 @@
 #include <linux/xarray.h>
 #include <uapi/asm-generic/errno-base.h>
 #include <uapi/linux/android/binder.h>
-#include <uapi/linux/android/binder_ctl.h>
+#include <uapi/linux/android/binderfs.h>
 #include "binder_internal.h"
@@ -39,14 +41,32 @@
 #define INODE_OFFSET 3
 #define INTSTRLEN 21
 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
+/* Ensure that the initial ipc namespace always has devices available. */
-static struct vfsmount *binderfs_mnt;
+#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 static dev_t binderfs_dev;
 static DEFINE_MUTEX(binderfs_minors_mutex);
 static DEFINE_IDA(binderfs_minors);
 /**
+ * binderfs_mount_opts - mount options for binderfs
+ * @max: maximum number of allocatable binderfs binder devices
+ */
+struct binderfs_mount_opts {
+        int max;
+};
+enum {
+        Opt_max,
+        Opt_err
+};
+static const match_table_t tokens = {
+        { Opt_max, "max=%d" },
+        { Opt_err, NULL     }
+};
+/**
 * binderfs_info - information about a binderfs mount
 * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
 * @control_dentry: This records the dentry of this binderfs mount
@@ -55,13 +75,16 @@ static DEFINE_IDA(binderfs_minors);
 *                  created.
 * @root_gid:       gid that needs to be used when a new binder device is
 *                  created.
+ * @mount_opts:     The mount options in use.
+ * @device_count:   The current number of allocated binder devices.
 */
 struct binderfs_info {
        struct ipc_namespace *ipc_ns;
        struct dentry *control_dentry;
        kuid_t root_uid;
        kgid_t root_gid;
+        struct binderfs_mount_opts mount_opts;
+        int device_count;
 };
 static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
@@ -84,7 +107,7 @@ bool is_binderfs_device(const struct inode *inode)
 * @userp:     buffer to copy information about new device for userspace to
 * @req:       struct binderfs_device as copied from userspace
 *
- * This function allocated a new binder_device and reserves a new minor
+ * This function allocates a new binder_device and reserves a new minor
 * number for it.
 * Minor numbers are limited and tracked globally in binderfs_minors. The
 * function will stash a struct binder_device for the specific binder
@@ -100,20 +123,34 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
                                         struct binderfs_device *req)
 {
        int minor, ret;
-        struct dentry *dentry, *dup, *root;
+        struct dentry *dentry, *root;
        struct binder_device *device;
-        size_t name_len = BINDERFS_MAX_NAME + 1;
        char *name = NULL;
+        size_t name_len;
        struct inode *inode = NULL;
        struct super_block *sb = ref_inode->i_sb;
        struct binderfs_info *info = sb->s_fs_info;
+#if defined(CONFIG_IPC_NS)
+        bool use_reserve = (info->ipc_ns == &init_ipc_ns);
+#else
+        bool use_reserve = true;
+#endif
        /* Reserve new minor number for the new device. */
        mutex_lock(&binderfs_minors_mutex);
-        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        if (++info->device_count <= info->mount_opts.max)
-        mutex_unlock(&binderfs_minors_mutex);
+                minor = ida_alloc_max(&binderfs_minors,
-        if (minor < 0)
+                                      use_reserve ? BINDERFS_MAX_MINOR :
+                                                    BINDERFS_MAX_MINOR_CAPPED,
+                                      GFP_KERNEL);
+        else
+                minor = -ENOSPC;
+        if (minor < 0) {
+                --info->device_count;
+                mutex_unlock(&binderfs_minors_mutex);
                return minor;
+        }
+        mutex_unlock(&binderfs_minors_mutex);
        ret = -ENOMEM;
        device = kzalloc(sizeof(*device), GFP_KERNEL);
@@ -132,12 +169,13 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
        inode->i_uid = info->root_uid;
        inode->i_gid = info->root_gid;
-        name = kmalloc(name_len, GFP_KERNEL);
+        req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
+        name_len = strlen(req->name);
+        /* Make sure to include terminating NUL byte */
+        name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
        if (!name)
                goto err;
-        strscpy(name, req->name, name_len);
        device->binderfs_inode = inode;
        device->context.binder_context_mgr_uid = INVALID_UID;
        device->context.name = name;
@@ -156,28 +194,25 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
        root = sb->s_root;
        inode_lock(d_inode(root));
-        dentry = d_alloc_name(root, name);
-        if (!dentry) {
+        /* look it up */
+        dentry = lookup_one_len(name, root, name_len);
+        if (IS_ERR(dentry)) {
                inode_unlock(d_inode(root));
-                ret = -ENOMEM;
+                ret = PTR_ERR(dentry);
                goto err;
        }
-        /* Verify that the name userspace gave us is not already in use. */
+        if (d_really_is_positive(dentry)) {
-        dup = d_lookup(root, &dentry->d_name);
+                /* already exists */
-        if (dup) {
+                dput(dentry);
-                if (d_really_is_positive(dup)) {
+                inode_unlock(d_inode(root));
-                        dput(dup);
+                ret = -EEXIST;
-                        dput(dentry);
+                goto err;
-                        inode_unlock(d_inode(root));
-                        ret = -EEXIST;
-                        goto err;
-                }
-                dput(dup);
        }
        inode->i_private = device;
-        d_add(dentry, inode);
+        d_instantiate(dentry, inode);
        fsnotify_create(root->d_inode, dentry);
        inode_unlock(d_inode(root));
@@ -187,6 +222,7 @@ err:
        kfree(name);
        kfree(device);
        mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
        ida_free(&binderfs_minors, minor);
        mutex_unlock(&binderfs_minors_mutex);
        iput(inode);
@@ -232,6 +268,7 @@ static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
 static void binderfs_evict_inode(struct inode *inode)
 {
        struct binder_device *device = inode->i_private;
+        struct binderfs_info *info = BINDERFS_I(inode);
        clear_inode(inode);
@@ -239,6 +276,7 @@ static void binderfs_evict_inode(struct inode *inode)
                return;
        mutex_lock(&binderfs_minors_mutex);
+        --info->device_count;
        ida_free(&binderfs_minors, device->miscdev.minor);
        mutex_unlock(&binderfs_minors_mutex);
@@ -246,43 +284,87 @@ static void binderfs_evict_inode(struct inode *inode)
        kfree(device);
 }
+/**
+ * binderfs_parse_mount_opts - parse binderfs mount options
+ * @data: options to set (can be NULL in which case defaults are used)
+ */
+static int binderfs_parse_mount_opts(char *data,
+                                     struct binderfs_mount_opts *opts)
+{
+        char *p;
+        opts->max = BINDERFS_MAX_MINOR;
+        while ((p = strsep(&data, ",")) != NULL) {
+                substring_t args[MAX_OPT_ARGS];
+                int token;
+                int max_devices;
+                if (!*p)
+                        continue;
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_max:
+                        if (match_int(&args[0], &max_devices) ||
+                            (max_devices < 0 ||
+                             (max_devices > BINDERFS_MAX_MINOR)))
+                                return -EINVAL;
+                        opts->max = max_devices;
+                        break;
+                default:
+                        pr_err("Invalid mount options\n");
+                        return -EINVAL;
+                }
+        }
+        return 0;
+}
+static int binderfs_remount(struct super_block *sb, int *flags, char *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+        return binderfs_parse_mount_opts(data, &info->mount_opts);
+}
+static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
+{
+        struct binderfs_info *info;
+        info = root->d_sb->s_fs_info;
+        if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
+                seq_printf(seq, ",max=%d", info->mount_opts.max);
+        return 0;
+}
 static const struct super_operations binderfs_super_ops = {
-        .statfs = simple_statfs,
+        .evict_inode    = binderfs_evict_inode,
-        .evict_inode = binderfs_evict_inode,
+        .remount_fs     = binderfs_remount,
+        .show_options   = binderfs_show_mount_opts,
+        .statfs         = simple_statfs,
 };
+static inline bool is_binderfs_control_device(const struct dentry *dentry)
+{
+        struct binderfs_info *info = dentry->d_sb->s_fs_info;
+        return info->control_dentry == dentry;
+}
 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                           struct inode *new_dir, struct dentry *new_dentry,
                           unsigned int flags)
 {
-        struct inode *inode = d_inode(old_dentry);
+        if (is_binderfs_control_device(old_dentry) ||
+            is_binderfs_control_device(new_dentry))
-        /* binderfs doesn't support directories. */
-        if (d_is_dir(old_dentry))
                return -EPERM;
-        if (flags & ~RENAME_NOREPLACE)
+        return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
-                return -EINVAL;
-        if (!simple_empty(new_dentry))
-                return -ENOTEMPTY;
-        if (d_really_is_positive(new_dentry))
-                simple_unlink(new_dir, new_dentry);
-        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
-                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
-        return 0;
 }
 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        /*
+        if (is_binderfs_control_device(dentry))
-         * The control dentry is only ever touched during mount so checking it
-         * here should not require us to take lock.
-         */
-        if (BINDERFS_I(dir)->control_dentry == dentry)
                return -EPERM;
        return simple_unlink(dir, dentry);
@@ -318,8 +400,6 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
        if (!device)
                return -ENOMEM;
-        inode_lock(d_inode(root));
        /* If we have already created a binder-control node, return. */
        if (info->control_dentry) {
                ret = 0;
@@ -358,12 +438,10 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
        inode->i_private = device;
        info->control_dentry = dentry;
        d_add(dentry, inode);
-        inode_unlock(d_inode(root));
        return 0;
 out:
-        inode_unlock(d_inode(root));
        kfree(device);
        iput(inode);
@@ -378,12 +456,9 @@ static const struct inode_operations binderfs_dir_inode_operations = {
 static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
 {
+        int ret;
        struct binderfs_info *info;
-        int ret = -ENOMEM;
        struct inode *inode = NULL;
-        struct ipc_namespace *ipc_ns = sb->s_fs_info;
-        get_ipc_ns(ipc_ns);
        sb->s_blocksize = PAGE_SIZE;
        sb->s_blocksize_bits = PAGE_SHIFT;
@@ -405,11 +480,17 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_op = &binderfs_super_ops;
        sb->s_time_gran = 1;
-        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
-        if (!info)
+        if (!sb->s_fs_info)
-                goto err_without_dentry;
+                return -ENOMEM;
+        info = sb->s_fs_info;
+        info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
+        ret = binderfs_parse_mount_opts(data, &info->mount_opts);
+        if (ret)
+                return ret;
-        info->ipc_ns = ipc_ns;
        info->root_gid = make_kgid(sb->s_user_ns, 0);
        if (!gid_valid(info->root_gid))
                info->root_gid = GLOBAL_ROOT_GID;
@@ -417,11 +498,9 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        if (!uid_valid(info->root_uid))
                info->root_uid = GLOBAL_ROOT_UID;
-        sb->s_fs_info = info;
        inode = new_inode(sb);
        if (!inode)
-                goto err_without_dentry;
+                return -ENOMEM;
        inode->i_ino = FIRST_INODE;
        inode->i_fop = &simple_dir_operations;
@@ -432,79 +511,28 @@ static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_root = d_make_root(inode);
        if (!sb->s_root)
-                goto err_without_dentry;
+                return -ENOMEM;
-        ret = binderfs_binder_ctl_create(sb);
-        if (ret)
-                goto err_with_dentry;
-        return 0;
-err_with_dentry:
-        dput(sb->s_root);
-        sb->s_root = NULL;
-err_without_dentry:
-        put_ipc_ns(ipc_ns);
-        iput(inode);
-        kfree(info);
-        return ret;
-}
-static int binderfs_test_super(struct super_block *sb, void *data)
-{
-        struct binderfs_info *info = sb->s_fs_info;
-        if (info)
-                return info->ipc_ns == data;
-        return 0;
-}
-static int binderfs_set_super(struct super_block *sb, void *data)
+        return binderfs_binder_ctl_create(sb);
-{
-        sb->s_fs_info = data;
-        return set_anon_super(sb, NULL);
 }
 static struct dentry *binderfs_mount(struct file_system_type *fs_type,
                                     int flags, const char *dev_name,
                                     void *data)
 {
-        struct super_block *sb;
+        return mount_nodev(fs_type, flags, data, binderfs_fill_super);
-        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
-        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
-                return ERR_PTR(-EPERM);
-        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
-                         flags, ipc_ns->user_ns, ipc_ns);
-        if (IS_ERR(sb))
-                return ERR_CAST(sb);
-        if (!sb->s_root) {
-                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
-                if (ret) {
-                        deactivate_locked_super(sb);
-                        return ERR_PTR(ret);
-                }
-                sb->s_flags |= SB_ACTIVE;
-        }
-        return dget(sb->s_root);
 }
 static void binderfs_kill_super(struct super_block *sb)
 {
        struct binderfs_info *info = sb->s_fs_info;
+        kill_litter_super(sb);
        if (info && info->ipc_ns)
                put_ipc_ns(info->ipc_ns);
        kfree(info);
-        kill_litter_super(sb);
 }
 static struct file_system_type binder_fs_type = {
@@ -530,14 +558,6 @@ static int __init init_binderfs(void)
                return ret;
        }
-        binderfs_mnt = kern_mount(&binder_fs_type);
-        if (IS_ERR(binderfs_mnt)) {
-                ret = PTR_ERR(binderfs_mnt);
-                binderfs_mnt = NULL;
-                unregister_filesystem(&binder_fs_type);
-                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
-        }
        return ret;
 }
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 4ca7a6b4eaae..8218db17ebdb 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -1091,7 +1091,7 @@ comment "Generic fallback / legacy drivers"
 config PATA_ACPI
        tristate "ACPI firmware driver for PATA"
-        depends on ATA_ACPI && ATA_BMDMA
+        depends on ATA_ACPI && ATA_BMDMA && PCI
        help
          This option enables an ACPI method driver which drives
          motherboard PATA controller interfaces through the ACPI
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
index 8cc9c429ad95..9e7fc302430f 100644
--- a/drivers/ata/pata_macio.c
+++ b/drivers/ata/pata_macio.c
@@ -915,6 +915,10 @@ static struct scsi_host_template pata_macio_sht = {
        .sg_tablesize           = MAX_DCMDS,
        /* We may not need that strict one */
        .dma_boundary           = ATA_DMA_BOUNDARY,
+        /* Not sure what the real max is but we know it's less than 64K, let's
+         * use 64K minus 256
+         */
+        .max_segment_size       = MAX_DBDMA_SEG,
        .slave_configure        = pata_macio_slave_config,
 };
@@ -1044,11 +1048,6 @@ static int pata_macio_common_init(struct pata_macio_priv *priv,
        /* Make sure we have sane initial timings in the cache */
        pata_macio_default_timings(priv);
-        /* Not sure what the real max is but we know it's less than 64K, let's
-         * use 64K minus 256
-         */
-        dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG);
        /* Allocate libata host for 1 port */
        memset(&pinfo, 0, sizeof(struct ata_port_info));
        pmac_macio_calc_timing_masks(priv, &pinfo);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e0bcf9b2dab0..174e84ce4379 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -245,8 +245,15 @@ struct inic_port_priv {
 static struct scsi_host_template inic_sht = {
        ATA_BASE_SHT(DRV_NAME),
-        .sg_tablesize   = LIBATA_MAX_PRD,       /* maybe it can be larger? */
+        .sg_tablesize           = LIBATA_MAX_PRD, /* maybe it can be larger? */
-        .dma_boundary   = INIC_DMA_BOUNDARY,
+        /*
+         * This controller is braindamaged.  dma_boundary is 0xffff like others
+         * but it will lock up the whole machine HARD if 65536 byte PRD entry
+         * is fed.  Reduce maximum segment size.
+         */
+        .dma_boundary           = INIC_DMA_BOUNDARY,
+        .max_segment_size       = 65536 - 512,
 };
 static const int scr_map[] = {
@@ -868,17 +875,6 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                return rc;
        }
-        /*
-         * This controller is braindamaged.  dma_boundary is 0xffff
-         * like others but it will lock up the whole machine HARD if
-         * 65536 byte PRD entry is fed. Reduce maximum segment size.
-         */
-        rc = dma_set_max_seg_size(&pdev->dev, 65536 - 512);
-        if (rc) {
-                dev_err(&pdev->dev, "failed to set the maximum segment size\n");
-                return rc;
-        }
        rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
        if (rc) {
                dev_err(&pdev->dev, "failed to initialize controller\n");
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 2e9d1cfe3aeb..211607986134 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -718,7 +718,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
                        instead of '/ 512', use '>> 9' to prevent a call
                        to divdu3 on x86 platforms
                */
-                rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
+                rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
                if (rate_cps < 10)
                        rate_cps = 10;  /* 2.2.1 minimum payload rate is 10 cps */
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 1bd1145ad8b5..330c1f7e9665 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -108,6 +108,9 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
         * suppress pointless writes.
         */
        for (i = 0; i < d->chip->num_regs; i++) {
+                if (!d->chip->mask_base)
+                        continue;
                reg = d->chip->mask_base +
                        (i * map->reg_stride * d->irq_reg_stride);
                if (d->chip->mask_invert) {
@@ -258,7 +261,7 @@ static int regmap_irq_set_type(struct irq_data *data, unsigned int type)
        const struct regmap_irq_type *t = &irq_data->type;
        if ((t->types_supported & type) != type)
-                return -ENOTSUPP;
+                return 0;
        reg = t->type_reg_offset / map->reg_stride;
@@ -588,6 +591,9 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
        /* Mask all the interrupts by default */
        for (i = 0; i < chip->num_regs; i++) {
                d->mask_buf[i] = d->mask_buf_def[i];
+                if (!chip->mask_base)
+                        continue;
                reg = chip->mask_base +
                        (i * map->reg_stride * d->irq_reg_stride);
                if (chip->mask_invert)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 08696f5f00bb..7c9a949e876b 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -288,9 +288,10 @@ static void nbd_size_update(struct nbd_device *nbd)
        blk_queue_physical_block_size(nbd->disk->queue, config->blksize);
        set_capacity(nbd->disk, config->bytesize >> 9);
        if (bdev) {
-                if (bdev->bd_disk)
+                if (bdev->bd_disk) {
                        bd_set_size(bdev, config->bytesize);
-                else
+                        set_blocksize(bdev, config->blksize);
+                } else
                        bdev->bd_invalidated = 1;
                bdput(bdev);
        }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index a74ce885b541..c518659b4d9f 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -32,6 +32,7 @@
 #include <linux/moduleparam.h>
 #include <linux/workqueue.h>
 #include <linux/uuid.h>
+#include <linux/nospec.h>
 #define IPMI_DRIVER_VERSION "39.2"
@@ -62,7 +63,8 @@ static void ipmi_debug_msg(const char *title, unsigned char *data,
 { }
 #endif
-static int initialized;
+static bool initialized;
+static bool drvregistered;
 enum ipmi_panic_event_op {
        IPMI_SEND_PANIC_EVENT_NONE,
@@ -612,7 +614,7 @@ static DEFINE_MUTEX(ipmidriver_mutex);
 static LIST_HEAD(ipmi_interfaces);
 static DEFINE_MUTEX(ipmi_interfaces_mutex);
-DEFINE_STATIC_SRCU(ipmi_interfaces_srcu);
+struct srcu_struct ipmi_interfaces_srcu;
 /*
 * List of watchers that want to know when smi's are added and deleted.
@@ -720,7 +722,15 @@ struct watcher_entry {
 int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
 {
        struct ipmi_smi *intf;
-        int index;
+        int index, rv;
+        /*
+         * Make sure the driver is actually initialized, this handles
+         * problems with initialization order.
+         */
+        rv = ipmi_init_msghandler();
+        if (rv)
+                return rv;
        mutex_lock(&smi_watchers_mutex);
@@ -884,7 +894,7 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
                if (user) {
                        user->handler->ipmi_recv_hndl(msg, user->handler_data);
-                        release_ipmi_user(msg->user, index);
+                        release_ipmi_user(user, index);
                } else {
                        /* User went away, give up. */
                        ipmi_free_recv_msg(msg);
@@ -1076,7 +1086,7 @@ int ipmi_create_user(unsigned int          if_num,
 {
        unsigned long flags;
        struct ipmi_user *new_user;
-        int           rv = 0, index;
+        int           rv, index;
        struct ipmi_smi *intf;
        /*
@@ -1094,18 +1104,9 @@ int ipmi_create_user(unsigned int          if_num,
         * Make sure the driver is actually initialized, this handles
         * problems with initialization order.
         */
-        if (!initialized) {
+        rv = ipmi_init_msghandler();
-                rv = ipmi_init_msghandler();
+        if (rv)
-                if (rv)
+                return rv;
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
        new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
        if (!new_user)
@@ -1183,6 +1184,7 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
        struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+        cleanup_srcu_struct(&user->release_barrier);
        kfree(user);
 }
@@ -1259,7 +1261,6 @@ int ipmi_destroy_user(struct ipmi_user *user)
 {
        _ipmi_destroy_user(user);
-        cleanup_srcu_struct(&user->release_barrier);
        kref_put(&user->refcount, free_user);
        return 0;
@@ -1298,10 +1299,12 @@ int ipmi_set_my_address(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                user->intf->addrinfo[channel].address = address;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1318,10 +1321,12 @@ int ipmi_get_my_address(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                *address = user->intf->addrinfo[channel].address;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1338,10 +1343,12 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                user->intf->addrinfo[channel].lun = LUN & 0x3;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -1358,10 +1365,12 @@ int ipmi_get_my_LUN(struct ipmi_user *user,
        if (!user)
                return -ENODEV;
-        if (channel >= IPMI_MAX_CHANNELS)
+        if (channel >= IPMI_MAX_CHANNELS) {
                rv = -EINVAL;
-        else
+        } else {
+                channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
                *address = user->intf->addrinfo[channel].lun;
+        }
        release_ipmi_user(user, index);
        return rv;
@@ -2184,6 +2193,7 @@ static int check_addr(struct ipmi_smi  *intf,
 {
        if (addr->channel >= IPMI_MAX_CHANNELS)
                return -EINVAL;
+        addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
        *lun = intf->addrinfo[addr->channel].lun;
        *saddr = intf->addrinfo[addr->channel].address;
        return 0;
@@ -3291,17 +3301,9 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
         * Make sure the driver is actually initialized, this handles
         * problems with initialization order.
         */
-        if (!initialized) {
+        rv = ipmi_init_msghandler();
-                rv = ipmi_init_msghandler();
+        if (rv)
-                if (rv)
+                return rv;
-                        return rv;
-                /*
-                 * The init code doesn't return an error if it was turned
-                 * off, but it won't initialize.  Check that.
-                 */
-                if (!initialized)
-                        return -ENODEV;
-        }
        intf = kzalloc(sizeof(*intf), GFP_KERNEL);
        if (!intf)
@@ -5017,6 +5019,22 @@ static int panic_event(struct notifier_block *this,
        return NOTIFY_DONE;
 }
+/* Must be called with ipmi_interfaces_mutex held. */
+static int ipmi_register_driver(void)
+{
+        int rv;
+        if (drvregistered)
+                return 0;
+        rv = driver_register(&ipmidriver.driver);
+        if (rv)
+                pr_err("Could not register IPMI driver\n");
+        else
+                drvregistered = true;
+        return rv;
+}
 static struct notifier_block panic_block = {
        .notifier_call  = panic_event,
        .next           = NULL,
@@ -5027,66 +5045,75 @@ static int ipmi_init_msghandler(void)
 {
        int rv;
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        if (rv)
+                goto out;
        if (initialized)
-                return 0;
+                goto out;
-        rv = driver_register(&ipmidriver.driver);
-        if (rv) {
-                pr_err("Could not register IPMI driver\n");
-                return rv;
-        }
-        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        init_srcu_struct(&ipmi_interfaces_srcu);
        timer_setup(&ipmi_timer, ipmi_timeout, 0);
        mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
        atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
-        initialized = 1;
+        initialized = true;
-        return 0;
+out:
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 static int __init ipmi_init_msghandler_mod(void)
 {
-        ipmi_init_msghandler();
+        int rv;
-        return 0;
+        pr_info("version " IPMI_DRIVER_VERSION "\n");
+        mutex_lock(&ipmi_interfaces_mutex);
+        rv = ipmi_register_driver();
+        mutex_unlock(&ipmi_interfaces_mutex);
+        return rv;
 }
 static void __exit cleanup_ipmi(void)
 {
        int count;
-        if (!initialized)
+        if (initialized) {
-                return;
+                atomic_notifier_chain_unregister(&panic_notifier_list,
+                                                 &panic_block);
-        atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
-        /*
+                /*
-         * This can't be called if any interfaces exist, so no worry
+                 * This can't be called if any interfaces exist, so no worry
-         * about shutting down the interfaces.
+                 * about shutting down the interfaces.
-         */
+                 */
-        /*
+                /*
-         * Tell the timer to stop, then wait for it to stop.  This
+                 * Tell the timer to stop, then wait for it to stop.  This
-         * avoids problems with race conditions removing the timer
+                 * avoids problems with race conditions removing the timer
-         * here.
+                 * here.
-         */
+                 */
-        atomic_inc(&stop_operation);
+                atomic_inc(&stop_operation);
-        del_timer_sync(&ipmi_timer);
+                del_timer_sync(&ipmi_timer);
-        driver_unregister(&ipmidriver.driver);
+                initialized = false;
-        initialized = 0;
+                /* Check for buffer leaks. */
+                count = atomic_read(&smi_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("SMI message count %d at exit\n", count);
+                count = atomic_read(&recv_msg_inuse_count);
+                if (count != 0)
+                        pr_warn("recv message count %d at exit\n", count);
-        /* Check for buffer leaks. */
+                cleanup_srcu_struct(&ipmi_interfaces_srcu);
-        count = atomic_read(&smi_msg_inuse_count);
+        }
-        if (count != 0)
+        if (drvregistered)
-                pr_warn("SMI message count %d at exit\n", count);
+                driver_unregister(&ipmidriver.driver);
-        count = atomic_read(&recv_msg_inuse_count);
-        if (count != 0)
-                pr_warn("recv message count %d at exit\n", count);
 }
 module_exit(cleanup_ipmi);
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index ca9528c4f183..b7a1ae2afaea 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -632,8 +632,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                /* Remove the multi-part read marker. */
                len -= 2;
+                data += 2;
                for (i = 0; i < len; i++)
-                        ssif_info->data[i] = data[i+2];
+                        ssif_info->data[i] = data[i];
                ssif_info->multi_len = len;
                ssif_info->multi_pos = 1;
@@ -661,8 +662,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                }
                blocknum = data[0];
+                len--;
+                data++;
+                if (blocknum != 0xff && len != 31) {
+                    /* All blocks but the last must have 31 data bytes. */
+                        result = -EIO;
+                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+                                pr_info("Received middle message <31\n");
-                if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) {
+                        goto continue_op;
+                }
+                if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) {
                        /* Received message too big, abort the operation. */
                        result = -E2BIG;
                        if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
@@ -671,16 +683,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                        goto continue_op;
                }
-                /* Remove the blocknum from the data. */
-                len--;
                for (i = 0; i < len; i++)
-                        ssif_info->data[i + ssif_info->multi_len] = data[i + 1];
+                        ssif_info->data[i + ssif_info->multi_len] = data[i];
                ssif_info->multi_len += len;
                if (blocknum == 0xff) {
                        /* End of read */
                        len = ssif_info->multi_len;
                        data = ssif_info->data;
-                } else if (blocknum + 1 != ssif_info->multi_pos) {
+                } else if (blocknum != ssif_info->multi_pos) {
                        /*
                         * Out of sequence block, just abort.  Block
                         * numbers start at zero for the second block,
@@ -707,6 +717,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                }
        }
+ continue_op:
        if (result < 0) {
                ssif_inc_stat(ssif_info, receive_errors);
        } else {
@@ -714,8 +725,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
                ssif_inc_stat(ssif_info, received_message_parts);
        }
- continue_op:
        if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
                pr_info("DONE 1: state = %d, result=%d\n",
                        ssif_info->ssif_state, result);
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index b5e3103c1175..e43c876a9223 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -59,6 +59,7 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/serial_8250.h>
+#include <linux/nospec.h>
 #include "smapi.h"
 #include "mwavedd.h"
 #include "3780i.h"
@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        PRINTK_3(TRACE_MWAVE,
                                "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
                                " ipcnum %x entry usIntCount %x\n",
@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                " Invalid ipcnum %x\n", ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        PRINTK_3(TRACE_MWAVE,
                                "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC"
                                " ipcnum %x, usIntCount %x\n",
@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
                                                ipcnum);
                                return -EINVAL;
                        }
+                        ipcnum = array_index_nospec(ipcnum,
+                                                    ARRAY_SIZE(pDrvData->IPCs));
                        mutex_lock(&mwave_mutex);
                        if (pDrvData->IPCs[ipcnum].bIsEnabled == true) {
                                pDrvData->IPCs[ipcnum].bIsEnabled = false;
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index e5b2fe80eab4..d2f0bb5ba47e 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -293,7 +293,6 @@ config COMMON_CLK_BD718XX
 source "drivers/clk/actions/Kconfig"
 source "drivers/clk/bcm/Kconfig"
 source "drivers/clk/hisilicon/Kconfig"
-source "drivers/clk/imx/Kconfig"
 source "drivers/clk/imgtec/Kconfig"
 source "drivers/clk/imx/Kconfig"
 source "drivers/clk/ingenic/Kconfig"
diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
index 5b393e711e94..7d16ab0784ec 100644
--- a/drivers/clk/clk-versaclock5.c
+++ b/drivers/clk/clk-versaclock5.c
@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
                if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
                        src = VC5_PRIM_SRC_SHDN_EN_XTAL;
-                if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+                else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
                        src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
+                else /* Invalid; should have been caught by vc5_probe() */
+                        return -EINVAL;
        }
        return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 75d13c0eff12..6ccdbedb02f3 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2779,7 +2779,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
        seq_printf(s, "\"protect_count\": %d,", c->protect_count);
        seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
        seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
-        seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
+        seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
        seq_printf(s, "\"duty_cycle\": %u",
                   clk_core_get_scaled_duty_cycle(c, 100000));
 }
diff --git a/drivers/clk/imx/clk-imx8qxp-lpcg.c b/drivers/clk/imx/clk-imx8qxp-lpcg.c
index 99c2508de8e5..fb6edf1b8aa2 100644
--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c
+++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c
@@ -169,6 +169,8 @@ static int imx8qxp_lpcg_clk_probe(struct platform_device *pdev)
                return -ENODEV;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
        base = devm_ioremap(dev, res->start, resource_size(res));
        if (!base)
                return -ENOMEM;
diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index 1b1ba54e33dd..1c04575c118f 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -215,6 +215,7 @@ config MSM_MMCC_8996
 config MSM_GCC_8998
        tristate "MSM8998 Global Clock Controller"
+        select QCOM_GDSC
        help
          Support for the global clock controller on msm8998 devices.
          Say Y if you want to use peripheral devices such as UART, SPI,
diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
index 2d5d8b43727e..c4d0b6f6abf2 100644
--- a/drivers/clk/socfpga/clk-pll-s10.c
+++ b/drivers/clk/socfpga/clk-pll-s10.c
@@ -43,7 +43,7 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
        /* Read mdiv and fdiv from the fdbck register */
        reg = readl(socfpgaclk->hw.reg + 0x4);
        mdiv = (reg & SOCFPGA_PLL_MDIV_MASK) >> SOCFPGA_PLL_MDIV_SHIFT;
-        vco_freq = (unsigned long long)parent_rate * (mdiv + 6);
+        vco_freq = (unsigned long long)vco_freq * (mdiv + 6);
        return (unsigned long)vco_freq;
 }
diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
index 5b238fc314ac..8281dfbf38c2 100644
--- a/drivers/clk/socfpga/clk-s10.c
+++ b/drivers/clk/socfpga/clk-s10.c
@@ -12,17 +12,17 @@
 #include "stratix10-clk.h"
-static const char * const pll_mux[] = { "osc1", "cb_intosc_hs_div2_clk",
+static const char * const pll_mux[] = { "osc1", "cb-intosc-hs-div2-clk",
-                                        "f2s_free_clk",};
+                                        "f2s-free-clk",};
 static const char * const cntr_mux[] = { "main_pll", "periph_pll",
-                                         "osc1", "cb_intosc_hs_div2_clk",
+                                         "osc1", "cb-intosc-hs-div2-clk",
-                                         "f2s_free_clk"};
+                                         "f2s-free-clk"};
-static const char * const boot_mux[] = { "osc1", "cb_intosc_hs_div2_clk",};
+static const char * const boot_mux[] = { "osc1", "cb-intosc-hs-div2-clk",};
 static const char * const noc_free_mux[] = {"main_noc_base_clk",
                                            "peri_noc_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
+                                            "osc1", "cb-intosc-hs-div2-clk",
-                                            "f2s_free_clk"};
+                                            "f2s-free-clk"};
 static const char * const emaca_free_mux[] = {"peri_emaca_clk", "boot_clk"};
 static const char * const emacb_free_mux[] = {"peri_emacb_clk", "boot_clk"};
@@ -33,14 +33,14 @@ static const char * const s2f_usr1_free_mux[] = {"peri_s2f_usr1_clk", "boot_clk"
 static const char * const psi_ref_free_mux[] = {"peri_psi_ref_clk", "boot_clk"};
 static const char * const mpu_mux[] = { "mpu_free_clk", "boot_clk",};
-static const char * const s2f_usr0_mux[] = {"f2s_free_clk", "boot_clk"};
+static const char * const s2f_usr0_mux[] = {"f2s-free-clk", "boot_clk"};
 static const char * const emac_mux[] = {"emaca_free_clk", "emacb_free_clk"};
 static const char * const noc_mux[] = {"noc_free_clk", "boot_clk"};
 static const char * const mpu_free_mux[] = {"main_mpu_base_clk",
                                            "peri_mpu_base_clk",
-                                            "osc1", "cb_intosc_hs_div2_clk",
+                                            "osc1", "cb-intosc-hs-div2-clk",
-                                            "f2s_free_clk"};
+                                            "f2s-free-clk"};
 /* clocks in AO (always on) controller */
 static const struct stratix10_pll_clock s10_pll_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
index 269d3595758b..edc31bb56674 100644
--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
        struct tegra_dfll_soc_data *soc;
        soc = tegra_dfll_unregister(pdev);
-        if (IS_ERR(soc))
+        if (IS_ERR(soc)) {
                dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
                        PTR_ERR(soc));
+                return PTR_ERR(soc);
+        }
        tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
diff --git a/drivers/clk/zynqmp/clkc.c b/drivers/clk/zynqmp/clkc.c
index f65cc0ff76ab..b0908ec62f73 100644
--- a/drivers/clk/zynqmp/clkc.c
+++ b/drivers/clk/zynqmp/clkc.c
@@ -669,8 +669,8 @@ static int zynqmp_clk_setup(struct device_node *np)
        if (ret)
                return ret;
-        zynqmp_data = kzalloc(sizeof(*zynqmp_data) + sizeof(*zynqmp_data) *
+        zynqmp_data = kzalloc(struct_size(zynqmp_data, hws, clock_max_idx),
-                                                clock_max_idx, GFP_KERNEL);
+                              GFP_KERNEL);
        if (!zynqmp_data)
                return -ENOMEM;
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 5a90075f719d..0be55fcc19ba 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -692,6 +692,7 @@ config CRYPTO_DEV_BCM_SPU
        depends on ARCH_BCM_IPROC
        depends on MAILBOX
        default m
+        select CRYPTO_AUTHENC
        select CRYPTO_DES
        select CRYPTO_MD5
        select CRYPTO_SHA1
diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index c9393ffb70ed..5567cbda2798 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -2845,44 +2845,28 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
        struct spu_hw *spu = &iproc_priv.spu;
        struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
        struct crypto_tfm *tfm = crypto_aead_tfm(cipher);
-        struct rtattr *rta = (void *)key;
+        struct crypto_authenc_keys keys;
-        struct crypto_authenc_key_param *param;
+        int ret;
-        const u8 *origkey = key;
-        const unsigned int origkeylen = keylen;
-        int ret = 0;
        flow_log("%s() aead:%p key:%p keylen:%u\n", __func__, cipher, key,
                 keylen);
        flow_dump("  key: ", key, keylen);
-        if (!RTA_OK(rta, keylen))
+        ret = crypto_authenc_extractkeys(&keys, key, keylen);
-                goto badkey;
+        if (ret)
-        if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
-                goto badkey;
-        if (RTA_PAYLOAD(rta) < sizeof(*param))
                goto badkey;
-        param = RTA_DATA(rta);
+        if (keys.enckeylen > MAX_KEY_SIZE ||
-        ctx->enckeylen = be32_to_cpu(param->enckeylen);
+            keys.authkeylen > MAX_KEY_SIZE)
-        key += RTA_ALIGN(rta->rta_len);
-        keylen -= RTA_ALIGN(rta->rta_len);
-        if (keylen < ctx->enckeylen)
-                goto badkey;
-        if (ctx->enckeylen > MAX_KEY_SIZE)
                goto badkey;
-        ctx->authkeylen = keylen - ctx->enckeylen;
+        ctx->enckeylen = keys.enckeylen;
+        ctx->authkeylen = keys.authkeylen;
-        if (ctx->authkeylen > MAX_KEY_SIZE)
-                goto badkey;
-        memcpy(ctx->enckey, key + ctx->authkeylen, ctx->enckeylen);
+        memcpy(ctx->enckey, keys.enckey, keys.enckeylen);
        /* May end up padding auth key. So make sure it's zeroed. */
        memset(ctx->authkey, 0, sizeof(ctx->authkey));
-        memcpy(ctx->authkey, key, ctx->authkeylen);
+        memcpy(ctx->authkey, keys.authkey, keys.authkeylen);
        switch (ctx->alg->cipher_info.alg) {
        case CIPHER_ALG_DES:
@@ -2890,7 +2874,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                        u32 tmp[DES_EXPKEY_WORDS];
                        u32 flags = CRYPTO_TFM_RES_WEAK_KEY;
-                        if (des_ekey(tmp, key) == 0) {
+                        if (des_ekey(tmp, keys.enckey) == 0) {
                                if (crypto_aead_get_flags(cipher) &
                                    CRYPTO_TFM_REQ_WEAK_KEY) {
                                        crypto_aead_set_flags(cipher, flags);
@@ -2905,7 +2889,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                break;
        case CIPHER_ALG_3DES:
                if (ctx->enckeylen == (DES_KEY_SIZE * 3)) {
-                        const u32 *K = (const u32 *)key;
+                        const u32 *K = (const u32 *)keys.enckey;
                        u32 flags = CRYPTO_TFM_RES_BAD_KEY_SCHED;
                        if (!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
@@ -2956,9 +2940,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
                ctx->fallback_cipher->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
                ctx->fallback_cipher->base.crt_flags |=
                    tfm->crt_flags & CRYPTO_TFM_REQ_MASK;
-                ret =
+                ret = crypto_aead_setkey(ctx->fallback_cipher, key, keylen);
-                    crypto_aead_setkey(ctx->fallback_cipher, origkey,
-                                       origkeylen);
                if (ret) {
                        flow_log("  fallback setkey() returned:%d\n", ret);
                        tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 92e593e2069a..80ae69f906fb 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -3476,7 +3476,7 @@ static int __init caam_algapi_init(void)
                 * Skip algorithms requiring message digests
                 * if MD or MD size is not supported by device.
                 */
-                if ((c2_alg_sel & ~OP_ALG_ALGSEL_SUBMASK) == 0x40 &&
+                if (is_mdha(c2_alg_sel) &&
                    (!md_inst || t_alg->aead.maxauthsize > md_limit))
                        continue;
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index 81712aa5d0f2..bb1a2cdf1951 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1072,13 +1072,16 @@ static int ahash_final_no_ctx(struct ahash_request *req)
        desc = edesc->hw_desc;
-        state->buf_dma = dma_map_single(jrdev, buf, buflen, DMA_TO_DEVICE);
+        if (buflen) {
-        if (dma_mapping_error(jrdev, state->buf_dma)) {
+                state->buf_dma = dma_map_single(jrdev, buf, buflen,
-                dev_err(jrdev, "unable to map src\n");
+                                                DMA_TO_DEVICE);
-                goto unmap;
+                if (dma_mapping_error(jrdev, state->buf_dma)) {
-        }
+                        dev_err(jrdev, "unable to map src\n");
+                        goto unmap;
+                }
-        append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
+                append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
+        }
        edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
                                                digestsize);
diff --git a/drivers/crypto/caam/desc.h b/drivers/crypto/caam/desc.h
index ec10230178c5..4b6854bf896a 100644
--- a/drivers/crypto/caam/desc.h
+++ b/drivers/crypto/caam/desc.h
@@ -1155,6 +1155,7 @@
 #define OP_ALG_ALGSEL_DES       (0x20 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_3DES      (0x21 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_ARC4      (0x30 << OP_ALG_ALGSEL_SHIFT)
+#define OP_ALG_CHA_MDHA         (0x40 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_MD5       (0x40 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_SHA1      (0x41 << OP_ALG_ALGSEL_SHIFT)
 #define OP_ALG_ALGSEL_SHA224    (0x42 << OP_ALG_ALGSEL_SHIFT)
diff --git a/drivers/crypto/caam/error.h b/drivers/crypto/caam/error.h
index 67ea94079837..8c6b83e02a70 100644
--- a/drivers/crypto/caam/error.h
+++ b/drivers/crypto/caam/error.h
@@ -7,6 +7,9 @@
 #ifndef CAAM_ERROR_H
 #define CAAM_ERROR_H
+#include "desc.h"
 #define CAAM_ERROR_STR_MAX 302
 void caam_strstatus(struct device *dev, u32 status, bool qi_v2);
@@ -17,4 +20,10 @@ void caam_strstatus(struct device *dev, u32 status, bool qi_v2);
 void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
                  int rowsize, int groupsize, struct scatterlist *sg,
                  size_t tlen, bool ascii);
+static inline bool is_mdha(u32 algtype)
+{
+        return (algtype & OP_ALG_ALGSEL_MASK & ~OP_ALG_ALGSEL_SUBMASK) ==
+               OP_ALG_CHA_MDHA;
+}
 #endif /* CAAM_ERROR_H */
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index e34e4df8fd24..fe070d75c842 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                /* ORH error code */
                err = READ_ONCE(*sr->resp.orh) & 0xff;
-                softreq_destroy(sr);
                if (sr->callback)
                        sr->callback(sr->cb_arg, err);
+                softreq_destroy(sr);
                req_completed++;
        }
diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
index f2643cda45db..a3527c00b29a 100644
--- a/drivers/crypto/ccree/cc_aead.c
+++ b/drivers/crypto/ccree/cc_aead.c
@@ -549,13 +549,12 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
                          unsigned int keylen)
 {
        struct cc_aead_ctx *ctx = crypto_aead_ctx(tfm);
-        struct rtattr *rta = (struct rtattr *)key;
        struct cc_crypto_req cc_req = {};
-        struct crypto_authenc_key_param *param;
        struct cc_hw_desc desc[MAX_AEAD_SETKEY_SEQ];
-        int rc = -EINVAL;
        unsigned int seq_len = 0;
        struct device *dev = drvdata_to_dev(ctx->drvdata);
+        const u8 *enckey, *authkey;
+        int rc;
        dev_dbg(dev, "Setting key in context @%p for %s. key=%p keylen=%u\n",
                ctx, crypto_tfm_alg_name(crypto_aead_tfm(tfm)), key, keylen);
@@ -563,35 +562,33 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
        /* STAT_PHASE_0: Init and sanity checks */
        if (ctx->auth_mode != DRV_HASH_NULL) { /* authenc() alg. */
-                if (!RTA_OK(rta, keylen))
+                struct crypto_authenc_keys keys;
-                        goto badkey;
-                if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+                rc = crypto_authenc_extractkeys(&keys, key, keylen);
-                        goto badkey;
+                if (rc)
-                if (RTA_PAYLOAD(rta) < sizeof(*param))
-                        goto badkey;
-                param = RTA_DATA(rta);
-                ctx->enc_keylen = be32_to_cpu(param->enckeylen);
-                key += RTA_ALIGN(rta->rta_len);
-                keylen -= RTA_ALIGN(rta->rta_len);
-                if (keylen < ctx->enc_keylen)
                        goto badkey;
-                ctx->auth_keylen = keylen - ctx->enc_keylen;
+                enckey = keys.enckey;
+                authkey = keys.authkey;
+                ctx->enc_keylen = keys.enckeylen;
+                ctx->auth_keylen = keys.authkeylen;
                if (ctx->cipher_mode == DRV_CIPHER_CTR) {
                        /* the nonce is stored in bytes at end of key */
+                        rc = -EINVAL;
                        if (ctx->enc_keylen <
                            (AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE))
                                goto badkey;
                        /* Copy nonce from last 4 bytes in CTR key to
                         *  first 4 bytes in CTR IV
                         */
-                        memcpy(ctx->ctr_nonce, key + ctx->auth_keylen +
+                        memcpy(ctx->ctr_nonce, enckey + ctx->enc_keylen -
-                               ctx->enc_keylen - CTR_RFC3686_NONCE_SIZE,
+                               CTR_RFC3686_NONCE_SIZE, CTR_RFC3686_NONCE_SIZE);
-                               CTR_RFC3686_NONCE_SIZE);
                        /* Set CTR key size */
                        ctx->enc_keylen -= CTR_RFC3686_NONCE_SIZE;
                }
        } else { /* non-authenc - has just one key */
+                enckey = key;
+                authkey = NULL;
                ctx->enc_keylen = keylen;
                ctx->auth_keylen = 0;
        }
@@ -603,13 +600,14 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
        /* STAT_PHASE_1: Copy key to ctx */
        /* Get key material */
-        memcpy(ctx->enckey, key + ctx->auth_keylen, ctx->enc_keylen);
+        memcpy(ctx->enckey, enckey, ctx->enc_keylen);
        if (ctx->enc_keylen == 24)
                memset(ctx->enckey + 24, 0, CC_AES_KEY_SIZE_MAX - 24);
        if (ctx->auth_mode == DRV_HASH_XCBC_MAC) {
-                memcpy(ctx->auth_state.xcbc.xcbc_keys, key, ctx->auth_keylen);
+                memcpy(ctx->auth_state.xcbc.xcbc_keys, authkey,
+                       ctx->auth_keylen);
        } else if (ctx->auth_mode != DRV_HASH_NULL) { /* HMAC */
-                rc = cc_get_plain_hmac_key(tfm, key, ctx->auth_keylen);
+                rc = cc_get_plain_hmac_key(tfm, authkey, ctx->auth_keylen);
                if (rc)
                        goto badkey;
        }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 45e20707cef8..f8e2c5c3f4eb 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1361,23 +1361,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
        struct talitos_private *priv = dev_get_drvdata(dev);
        bool is_sec1 = has_ftr_sec1(priv);
        int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN;
-        void *err;
        if (cryptlen + authsize > max_len) {
                dev_err(dev, "length exceeds h/w max limit\n");
                return ERR_PTR(-EINVAL);
        }
-        if (ivsize)
-                iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
        if (!dst || dst == src) {
                src_len = assoclen + cryptlen + authsize;
                src_nents = sg_nents_for_len(src, src_len);
                if (src_nents < 0) {
                        dev_err(dev, "Invalid number of src SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                src_nents = (src_nents == 1) ? 0 : src_nents;
                dst_nents = dst ? src_nents : 0;
@@ -1387,16 +1382,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                src_nents = sg_nents_for_len(src, src_len);
                if (src_nents < 0) {
                        dev_err(dev, "Invalid number of src SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                src_nents = (src_nents == 1) ? 0 : src_nents;
                dst_len = assoclen + cryptlen + (encrypt ? authsize : 0);
                dst_nents = sg_nents_for_len(dst, dst_len);
                if (dst_nents < 0) {
                        dev_err(dev, "Invalid number of dst SG.\n");
-                        err = ERR_PTR(-EINVAL);
+                        return ERR_PTR(-EINVAL);
-                        goto error_sg;
                }
                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
        }
@@ -1423,11 +1416,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
        /* if its a ahash, add space for a second desc next to the first one */
        if (is_sec1 && !dst)
                alloc_len += sizeof(struct talitos_desc);
+        alloc_len += ivsize;
        edesc = kmalloc(alloc_len, GFP_DMA | flags);
-        if (!edesc) {
+        if (!edesc)
-                err = ERR_PTR(-ENOMEM);
+                return ERR_PTR(-ENOMEM);
-                goto error_sg;
+        if (ivsize) {
+                iv = memcpy(((u8 *)edesc) + alloc_len - ivsize, iv, ivsize);
+                iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
        }
        memset(&edesc->desc, 0, sizeof(edesc->desc));
@@ -1445,10 +1441,6 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                     DMA_BIDIRECTIONAL);
        }
        return edesc;
-error_sg:
-        if (iv_dma)
-                dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
-        return err;
 }
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
diff --git a/drivers/edac/altera_edac.h b/drivers/edac/altera_edac.h
index 4213cb0bb2a7..f8664bac9fa8 100644
--- a/drivers/edac/altera_edac.h
+++ b/drivers/edac/altera_edac.h
@@ -295,8 +295,8 @@ struct altr_sdram_mc_data {
 #define S10_SYSMGR_ECC_INTSTAT_DERR_OFST  0xA0
 /* Sticky registers for Uncorrected Errors */
-#define S10_SYSMGR_UE_VAL_OFST            0x120
+#define S10_SYSMGR_UE_VAL_OFST            0x220
-#define S10_SYSMGR_UE_ADDR_OFST           0x124
+#define S10_SYSMGR_UE_ADDR_OFST           0x224
 #define S10_DDR0_IRQ_MASK                 BIT(16)
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 09b845e90114..a785ffd5af89 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1144,10 +1144,6 @@ static int sbp2_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
        if (device->is_local)
                return -ENODEV;
-        if (dma_get_max_seg_size(device->card->device) > SBP2_MAX_SEG_SIZE)
-                WARN_ON(dma_set_max_seg_size(device->card->device,
-                                             SBP2_MAX_SEG_SIZE));
        shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
        if (shost == NULL)
                return -ENOMEM;
@@ -1610,6 +1606,7 @@ static struct scsi_host_template scsi_driver_template = {
        .eh_abort_handler       = sbp2_scsi_abort,
        .this_id                = -1,
        .sg_tablesize           = SG_ALL,
+        .max_segment_size       = SBP2_MAX_SEG_SIZE,
        .can_queue              = 1,
        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
 };
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 83617fdc661d..0dc96419efe3 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -289,7 +289,7 @@ static bool pca953x_volatile_register(struct device *dev, unsigned int reg)
        return pca953x_check_register(chip, reg, bank);
 }
-const struct regmap_config pca953x_i2c_regmap = {
+static const struct regmap_config pca953x_i2c_regmap = {
        .reg_bits = 8,
        .val_bits = 8,
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 48534bda73d3..259cf6ab969b 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -357,8 +357,6 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
        mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
        list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
-                struct gpio_desc *desc;
                if (event->irq_requested) {
                        if (event->irq_is_wake)
                                disable_irq_wake(event->irq);
@@ -366,11 +364,8 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
                        free_irq(event->irq, event);
                }
-                desc = event->desc;
-                if (WARN_ON(IS_ERR(desc)))
-                        continue;
                gpiochip_unlock_as_irq(chip, event->pin);
-                gpiochip_free_own_desc(desc);
+                gpiochip_free_own_desc(event->desc);
                list_del(&event->node);
                kfree(event);
        }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index a028661d9e20..92b11de19581 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -576,6 +576,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
        { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
        { 0, 0, 0, 0, 0 },
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index dafc645b2e4e..b083b219b1a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -531,17 +531,6 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
        struct drm_gem_object *obj;
        struct amdgpu_framebuffer *amdgpu_fb;
        int ret;
-        int height;
-        struct amdgpu_device *adev = dev->dev_private;
-        int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
-        int pitch = mode_cmd->pitches[0] / cpp;
-        pitch = amdgpu_align_pitch(adev, pitch, cpp, false);
-        if (mode_cmd->pitches[0] != pitch) {
-                DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
-                              pitch, mode_cmd->pitches[0]);
-                return ERR_PTR(-EINVAL);
-        }
        obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
        if (obj ==  NULL) {
@@ -556,13 +545,6 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
                return ERR_PTR(-EINVAL);
        }
-        height = ALIGN(mode_cmd->height, 8);
-        if (obj->size < pitch * height) {
-                DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
-                              pitch * height, obj->size);
-                return ERR_PTR(-EINVAL);
-        }
        amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
        if (amdgpu_fb == NULL) {
                drm_gem_object_put_unlocked(obj);
diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig
index fbf0ee5201c3..c3613604a4f8 100644
--- a/drivers/gpu/drm/amd/amdkfd/Kconfig
+++ b/drivers/gpu/drm/amd/amdkfd/Kconfig
@@ -4,8 +4,8 @@
 config HSA_AMD
        bool "HSA kernel driver for AMD GPU devices"
-        depends on DRM_AMDGPU && X86_64
+        depends on DRM_AMDGPU && (X86_64 || ARM64)
-        imply AMD_IOMMU_V2
+        imply AMD_IOMMU_V2 if X86_64
        select MMU_NOTIFIER
        help
          Enable this if you want to use HSA features on AMD GPU devices.
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
index b7bc7d7d048f..5d85ff341385 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
@@ -863,6 +863,7 @@ static int kfd_fill_mem_info_for_cpu(int numa_node_id, int *avail_size,
        return 0;
 }
+#if CONFIG_X86_64
 static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
                                uint32_t *num_entries,
                                struct crat_subtype_iolink *sub_type_hdr)
@@ -905,6 +906,7 @@ static int kfd_fill_iolink_info_for_cpu(int numa_node_id, int *avail_size,
        return 0;
 }
+#endif
 /* kfd_create_vcrat_image_cpu - Create Virtual CRAT for CPU
 *
@@ -920,7 +922,9 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
        struct crat_subtype_generic *sub_type_hdr;
        int avail_size = *size;
        int numa_node_id;
+#ifdef CONFIG_X86_64
        uint32_t entries = 0;
+#endif
        int ret = 0;
        if (!pcrat_image || avail_size < VCRAT_SIZE_FOR_CPU)
@@ -982,6 +986,7 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
                        sub_type_hdr->length);
                /* Fill in Subtype: IO Link */
+#ifdef CONFIG_X86_64
                ret = kfd_fill_iolink_info_for_cpu(numa_node_id, &avail_size,
                                &entries,
                                (struct crat_subtype_iolink *)sub_type_hdr);
@@ -992,6 +997,9 @@ static int kfd_create_vcrat_image_cpu(void *pcrat_image, size_t *size)
                sub_type_hdr = (typeof(sub_type_hdr))((char *)sub_type_hdr +
                                sub_type_hdr->length * entries);
+#else
+                pr_info("IO link not available for non x86 platforms\n");
+#endif
                crat_table->num_domains++;
        }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 5f5b2acedbac..09da91644f9f 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -1093,8 +1093,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu)
 *              the GPU device is not already present in the topology device
 *              list then return NULL. This means a new topology device has to
 *              be created for this GPU.
- * TODO: Rather than assiging @gpu to first topology device withtout
- *              gpu attached, it will better to have more stringent check.
 */
 static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
 {
@@ -1102,12 +1100,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
        struct kfd_topology_device *out_dev = NULL;
        down_write(&topology_lock);
-        list_for_each_entry(dev, &topology_device_list, list)
+        list_for_each_entry(dev, &topology_device_list, list) {
+                /* Discrete GPUs need their own topology device list
+                 * entries. Don't assign them to CPU/APU nodes.
+                 */
+                if (!gpu->device_info->needs_iommu_device &&
+                    dev->node_props.cpu_cores_count)
+                        continue;
                if (!dev->gpu && (dev->node_props.simd_count > 0)) {
                        dev->gpu = gpu;
                        out_dev = dev;
                        break;
                }
+        }
        up_write(&topology_lock);
        return out_dev;
 }
@@ -1392,7 +1398,6 @@ int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_dev **kdev)
 static int kfd_cpumask_to_apic_id(const struct cpumask *cpumask)
 {
-        const struct cpuinfo_x86 *cpuinfo;
        int first_cpu_of_numa_node;
        if (!cpumask || cpumask == cpu_none_mask)
@@ -1400,9 +1405,11 @@ static int kfd_cpumask_to_apic_id(const struct cpumask *cpumask)
        first_cpu_of_numa_node = cpumask_first(cpumask);
        if (first_cpu_of_numa_node >= nr_cpu_ids)
                return -1;
-        cpuinfo = &cpu_data(first_cpu_of_numa_node);
+#ifdef CONFIG_X86_64
+        return cpu_data(first_cpu_of_numa_node).apicid;
-        return cpuinfo->apicid;
+#else
+        return first_cpu_of_numa_node;
+#endif
 }
 /* kfd_numa_node_to_apic_id - Returns the APIC ID of the first logical processor
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 34f35e9a3c46..f4fa40c387d3 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1772,7 +1772,7 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd)
                + caps.min_input_signal * 0x101;
        if (dc_link_set_backlight_level(dm->backlight_link,
-                        brightness, 0, 0))
+                        brightness, 0))
                return 0;
        else
                return 1;
@@ -5933,7 +5933,7 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
        for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
                if (!drm_atomic_crtc_needs_modeset(new_crtc_state) &&
                    !new_crtc_state->color_mgmt_changed &&
-                    !new_crtc_state->vrr_enabled)
+                    old_crtc_state->vrr_enabled == new_crtc_state->vrr_enabled)
                        continue;
                if (!new_crtc_state->enable)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 52deacf39841..b0265dbebd4c 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -2190,8 +2190,7 @@ int dc_link_get_backlight_level(const struct dc_link *link)
 bool dc_link_set_backlight_level(const struct dc_link *link,
                uint32_t backlight_pwm_u16_16,
-                uint32_t frame_ramp,
+                uint32_t frame_ramp)
-                const struct dc_stream_state *stream)
 {
        struct dc  *core_dc = link->ctx->dc;
        struct abm *abm = core_dc->res_pool->abm;
@@ -2206,10 +2205,6 @@ bool dc_link_set_backlight_level(const struct dc_link *link,
                (abm->funcs->set_backlight_level_pwm == NULL))
                return false;
-        if (stream)
-                ((struct dc_stream_state *)stream)->bl_pwm_level =
-                                backlight_pwm_u16_16;
        use_smooth_brightness = dmcu->funcs->is_dmcu_initialized(dmcu);
        DC_LOG_BACKLIGHT("New Backlight level: %d (0x%X)\n",
@@ -2637,11 +2632,6 @@ void core_link_enable_stream(
                if (dc_is_dp_signal(pipe_ctx->stream->signal))
                        enable_stream_features(pipe_ctx);
-                dc_link_set_backlight_level(pipe_ctx->stream->sink->link,
-                                pipe_ctx->stream->bl_pwm_level,
-                                0,
-                                pipe_ctx->stream);
        }
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
index 29f19d57ff7a..b2243e0dad1f 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
@@ -146,8 +146,7 @@ static inline struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_
 */
 bool dc_link_set_backlight_level(const struct dc_link *dc_link,
                uint32_t backlight_pwm_u16_16,
-                uint32_t frame_ramp,
+                uint32_t frame_ramp);
-                const struct dc_stream_state *stream);
 int dc_link_get_backlight_level(const struct dc_link *dc_link);
diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
index be34d638e15d..d70c9e1cda3d 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -91,7 +91,6 @@ struct dc_stream_state {
        /* DMCU info */
        unsigned int abm_level;
-        unsigned int bl_pwm_level;
        /* from core_stream struct */
        struct dc_context *ctx;
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 4bf24758217f..8f09b8625c5d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
                pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio);
-                if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+                if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
                        /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
                        pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
                /* un-mute audio */
@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
        pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
                        pipe_ctx->stream_res.stream_enc, true);
        if (pipe_ctx->stream_res.audio) {
+                struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu;
                if (option != KEEP_ACQUIRED_RESOURCE ||
                                !dc->debug.az_endpoint_mute_only) {
                        /*only disalbe az_endpoint if power down or free*/
@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
                        update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false);
                        pipe_ctx->stream_res.audio = NULL;
                }
+                if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+                        /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
+                        pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
                /* TODO: notify audio driver for if audio modes list changed
                 * add audio mode list change flag */
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
index dcb3c5530236..cd1ebe57ed59 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
@@ -463,7 +463,7 @@ void dpp1_set_cursor_position(
        if (src_y_offset >= (int)param->viewport.height)
                cur_en = 0;  /* not visible beyond bottom edge*/
-        if (src_y_offset < 0)
+        if (src_y_offset + (int)height <= 0)
                cur_en = 0;  /* not visible beyond top edge*/
        REG_UPDATE(CURSOR0_CONTROL,
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
index 345af015d061..d1acd7165bc8 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
@@ -1140,7 +1140,7 @@ void hubp1_cursor_set_position(
        if (src_y_offset >= (int)param->viewport.height)
                cur_en = 0;  /* not visible beyond bottom edge*/
-        if (src_y_offset < 0) //+ (int)hubp->curs_attr.height
+        if (src_y_offset + (int)hubp->curs_attr.height <= 0)
                cur_en = 0;  /* not visible beyond top edge*/
        if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 91e015e14355..58a12ddf12f3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2355,29 +2355,22 @@ static void dcn10_apply_ctx_for_surface(
                        top_pipe_to_program->plane_state->update_flags.bits.full_update)
                for (i = 0; i < dc->res_pool->pipe_count; i++) {
                        struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                        tg = pipe_ctx->stream_res.tg;
                        /* Skip inactive pipes and ones already updated */
                        if (!pipe_ctx->stream || pipe_ctx->stream == stream
-                                        || !pipe_ctx->plane_state)
+                                        || !pipe_ctx->plane_state
+                                        || !tg->funcs->is_tg_enabled(tg))
                                continue;
-                        pipe_ctx->stream_res.tg->funcs->lock(pipe_ctx->stream_res.tg);
+                        tg->funcs->lock(tg);
                        pipe_ctx->plane_res.hubp->funcs->hubp_setup_interdependent(
                                pipe_ctx->plane_res.hubp,
                                &pipe_ctx->dlg_regs,
                                &pipe_ctx->ttu_regs);
-                }
-        for (i = 0; i < dc->res_pool->pipe_count; i++) {
-                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
-                if (!pipe_ctx->stream || pipe_ctx->stream == stream
+                        tg->funcs->unlock(tg);
-                                || !pipe_ctx->plane_state)
+                }
-                        continue;
-                dcn10_pipe_control_lock(dc, pipe_ctx, false);
-        }
        if (num_planes == 0)
                false_optc_underflow_wa(dc, stream, tg);
diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
index 00f63b7dd32f..c11a443dcbc8 100644
--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
@@ -57,6 +57,7 @@ static const unsigned char abm_config[abm_defines_max_config][abm_defines_max_le
 #define NUM_POWER_FN_SEGS 8
 #define NUM_BL_CURVE_SEGS 16
+#pragma pack(push, 1)
 /* NOTE: iRAM is 256B in size */
 struct iram_table_v_2 {
        /* flags                      */
@@ -100,6 +101,7 @@ struct iram_table_v_2 {
        uint8_t dummy8;                                                 /* 0xfe       */
        uint8_t dummy9;                                                 /* 0xff       */
 };
+#pragma pack(pop)
 static uint16_t backlight_8_to_16(unsigned int backlight_8bit)
 {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
index b8747a5c9204..99d596dc0e89 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
@@ -32,6 +32,7 @@
 #include "vega10_pptable.h"
 #define NUM_DSPCLK_LEVELS 8
+#define VEGA10_ENGINECLOCK_HARDMAX 198000
 static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
                enum phm_platform_caps cap)
@@ -258,7 +259,26 @@ static int init_over_drive_limits(
                struct pp_hwmgr *hwmgr,
                const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
 {
-        hwmgr->platform_descriptor.overdriveLimit.engineClock =
+        const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
+                        (const ATOM_Vega10_GFXCLK_Dependency_Table *)
+                        (((unsigned long) powerplay_table) +
+                        le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
+        bool is_acg_enabled = false;
+        ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
+        if (gfxclk_dep_table->ucRevId == 1) {
+                patom_record_v2 =
+                        (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
+                is_acg_enabled =
+                        (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
+        }
+        if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
+                !is_acg_enabled)
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
+                        VEGA10_ENGINECLOCK_HARDMAX;
+        else
+                hwmgr->platform_descriptor.overdriveLimit.engineClock =
                        le32_to_cpu(powerplay_table->ulMaxODEngineClock);
        hwmgr->platform_descriptor.overdriveLimit.memoryClock =
                        le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
index 54364444ecd1..0c8212902275 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c
@@ -753,6 +753,22 @@ static int vega12_init_smc_table(struct pp_hwmgr *hwmgr)
        return 0;
 }
+static int vega12_run_acg_btc(struct pp_hwmgr *hwmgr)
+{
+        uint32_t result;
+        PP_ASSERT_WITH_CODE(
+                smum_send_msg_to_smc(hwmgr, PPSMC_MSG_RunAcgBtc) == 0,
+                "[Run_ACG_BTC] Attempt to run ACG BTC failed!",
+                return -EINVAL);
+        result = smum_get_argument(hwmgr);
+        PP_ASSERT_WITH_CODE(result == 1,
+                        "Failed to run ACG BTC!", return -EINVAL);
+        return 0;
+}
 static int vega12_set_allowed_featuresmask(struct pp_hwmgr *hwmgr)
 {
        struct vega12_hwmgr *data =
@@ -931,6 +947,11 @@ static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
                        "Failed to initialize SMC table!",
                        result = tmp_result);
+        tmp_result = vega12_run_acg_btc(hwmgr);
+        PP_ASSERT_WITH_CODE(!tmp_result,
+                        "Failed to run ACG BTC!",
+                        result = tmp_result);
        result = vega12_enable_all_smu_features(hwmgr);
        PP_ASSERT_WITH_CODE(!result,
                        "Failed to enable all smu features!",
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index b5475c91e2ef..e9f343b124b0 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2799,6 +2799,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
        MMIO_DFH(_MMIO(0xe2a0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        MMIO_DFH(_MMIO(0xe2b0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        MMIO_DFH(_MMIO(0xe2c0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_MMIO(0x21f0), D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/gvt/hypercall.h b/drivers/gpu/drm/i915/gvt/hypercall.h
index 5af11cf1b482..e1675a00df12 100644
--- a/drivers/gpu/drm/i915/gvt/hypercall.h
+++ b/drivers/gpu/drm/i915/gvt/hypercall.h
@@ -41,7 +41,7 @@ struct intel_gvt_mpt {
        int (*host_init)(struct device *dev, void *gvt, const void *ops);
        void (*host_exit)(struct device *dev, void *gvt);
        int (*attach_vgpu)(void *vgpu, unsigned long *handle);
-        void (*detach_vgpu)(unsigned long handle);
+        void (*detach_vgpu)(void *vgpu);
        int (*inject_msi)(unsigned long handle, u32 addr, u16 data);
        unsigned long (*from_virt_to_mfn)(void *p);
        int (*enable_page_track)(unsigned long handle, u64 gfn);
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index c1072143da1d..dd3dfd00f4e6 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -996,7 +996,7 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
 {
        unsigned int index;
        u64 virtaddr;
-        unsigned long req_size, pgoff = 0;
+        unsigned long req_size, pgoff, req_start;
        pgprot_t pg_prot;
        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
@@ -1014,7 +1014,17 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
        pg_prot = vma->vm_page_prot;
        virtaddr = vma->vm_start;
        req_size = vma->vm_end - vma->vm_start;
-        pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
+        pgoff = vma->vm_pgoff &
+                ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
+        req_start = pgoff << PAGE_SHIFT;
+        if (!intel_vgpu_in_aperture(vgpu, req_start))
+                return -EINVAL;
+        if (req_start + req_size >
+            vgpu_aperture_offset(vgpu) + vgpu_aperture_sz(vgpu))
+                return -EINVAL;
+        pgoff = (gvt_aperture_pa_base(vgpu->gvt) >> PAGE_SHIFT) + pgoff;
        return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
 }
@@ -1662,9 +1672,21 @@ static int kvmgt_attach_vgpu(void *vgpu, unsigned long *handle)
        return 0;
 }
-static void kvmgt_detach_vgpu(unsigned long handle)
+static void kvmgt_detach_vgpu(void *p_vgpu)
 {
-        /* nothing to do here */
+        int i;
+        struct intel_vgpu *vgpu = (struct intel_vgpu *)p_vgpu;
+        if (!vgpu->vdev.region)
+                return;
+        for (i = 0; i < vgpu->vdev.num_regions; i++)
+                if (vgpu->vdev.region[i].ops->release)
+                        vgpu->vdev.region[i].ops->release(vgpu,
+                                        &vgpu->vdev.region[i]);
+        vgpu->vdev.num_regions = 0;
+        kfree(vgpu->vdev.region);
+        vgpu->vdev.region = NULL;
 }
 static int kvmgt_inject_msi(unsigned long handle, u32 addr, u16 data)
diff --git a/drivers/gpu/drm/i915/gvt/mpt.h b/drivers/gpu/drm/i915/gvt/mpt.h
index 67f19992b226..3ed34123d8d1 100644
--- a/drivers/gpu/drm/i915/gvt/mpt.h
+++ b/drivers/gpu/drm/i915/gvt/mpt.h
@@ -101,7 +101,7 @@ static inline void intel_gvt_hypervisor_detach_vgpu(struct intel_vgpu *vgpu)
        if (!intel_gvt_host.mpt->detach_vgpu)
                return;
-        intel_gvt_host.mpt->detach_vgpu(vgpu->handle);
+        intel_gvt_host.mpt->detach_vgpu(vgpu);
 }
 #define MSI_CAP_CONTROL(offset) (offset + 2)
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 5567ddc7760f..55bb7885e228 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -332,6 +332,9 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
        i915_gem_object_unpin_map(wa_ctx->indirect_ctx.obj);
        i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+        wa_ctx->indirect_ctx.obj = NULL;
+        wa_ctx->indirect_ctx.shadow_va = NULL;
 }
 static int set_context_ppgtt_from_shadow(struct intel_vgpu_workload *workload,
@@ -911,11 +914,6 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
        list_del_init(&workload->list);
-        if (!workload->status) {
-                release_shadow_batch_buffer(workload);
-                release_shadow_wa_ctx(&workload->wa_ctx);
-        }
        if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
                /* if workload->status is not successful means HW GPU
                 * has occurred GPU hang or something wrong with i915/GVT,
@@ -1283,6 +1281,9 @@ void intel_vgpu_destroy_workload(struct intel_vgpu_workload *workload)
 {
        struct intel_vgpu_submission *s = &workload->vgpu->submission;
+        release_shadow_batch_buffer(workload);
+        release_shadow_wa_ctx(&workload->wa_ctx);
        if (workload->shadow_mm)
                intel_vgpu_mm_put(workload->shadow_mm);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 4796f40a6d4f..eab9341a5152 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -303,6 +303,7 @@ static void __unwind_incomplete_requests(struct intel_engine_cs *engine)
         */
        if (!(prio & I915_PRIORITY_NEWCLIENT)) {
                prio |= I915_PRIORITY_NEWCLIENT;
+                active->sched.attr.priority = prio;
                list_move_tail(&active->sched.link,
                               i915_sched_lookup_priolist(engine, prio));
        }
@@ -645,6 +646,9 @@ static void execlists_dequeue(struct intel_engine_cs *engine)
                int i;
                priolist_for_each_request_consume(rq, rn, p, i) {
+                        GEM_BUG_ON(last &&
+                                   need_preempt(engine, last, rq_prio(rq)));
                        /*
                         * Can we combine this request with the current port?
                         * It has to be the same context/ringbuffer and not
diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
index 75d97f1b2e8f..4f5c67f70c4d 100644
--- a/drivers/gpu/drm/meson/meson_crtc.c
+++ b/drivers/gpu/drm/meson/meson_crtc.c
@@ -46,7 +46,6 @@ struct meson_crtc {
        struct drm_crtc base;
        struct drm_pending_vblank_event *event;
        struct meson_drm *priv;
-        bool enabled;
 };
 #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
@@ -82,7 +81,8 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
 };
-static void meson_crtc_enable(struct drm_crtc *crtc)
+static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+                                     struct drm_crtc_state *old_state)
 {
        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
        struct drm_crtc_state *crtc_state = crtc->state;
@@ -108,20 +108,6 @@ static void meson_crtc_enable(struct drm_crtc *crtc)
        drm_crtc_vblank_on(crtc);
-        meson_crtc->enabled = true;
-}
-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
-                                     struct drm_crtc_state *old_state)
-{
-        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
-        struct meson_drm *priv = meson_crtc->priv;
-        DRM_DEBUG_DRIVER("\n");
-        if (!meson_crtc->enabled)
-                meson_crtc_enable(crtc);
        priv->viu.osd1_enabled = true;
 }
@@ -153,8 +139,6 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
                crtc->state->event = NULL;
        }
-        meson_crtc->enabled = false;
 }
 static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
@@ -163,9 +147,6 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
        struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
        unsigned long flags;
-        if (crtc->state->enable && !meson_crtc->enabled)
-                meson_crtc_enable(crtc);
        if (crtc->state->event) {
                WARN_ON(drm_crtc_vblank_get(crtc) != 0);
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 3ee4d4a4ecba..12ff47b13668 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -75,6 +75,10 @@ static const struct drm_mode_config_funcs meson_mode_config_funcs = {
        .fb_create           = drm_gem_fb_create,
 };
+static const struct drm_mode_config_helper_funcs meson_mode_config_helpers = {
+        .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
+};
 static irqreturn_t meson_irq(int irq, void *arg)
 {
        struct drm_device *dev = arg;
@@ -266,6 +270,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
        drm->mode_config.max_width = 3840;
        drm->mode_config.max_height = 2160;
        drm->mode_config.funcs = &meson_mode_config_funcs;
+        drm->mode_config.helper_private = &meson_mode_config_helpers;
        /* Hardware Initialization */
@@ -388,8 +393,10 @@ static int meson_probe_remote(struct platform_device *pdev,
                remote_node = of_graph_get_remote_port_parent(ep);
                if (!remote_node ||
                    remote_node == parent || /* Ignore parent endpoint */
-                    !of_device_is_available(remote_node))
+                    !of_device_is_available(remote_node)) {
+                        of_node_put(remote_node);
                        continue;
+                }
                count += meson_probe_remote(pdev, match, remote, remote_node);
@@ -408,10 +415,13 @@ static int meson_drv_probe(struct platform_device *pdev)
        for_each_endpoint_of_node(np, ep) {
                remote = of_graph_get_remote_port_parent(ep);
-                if (!remote || !of_device_is_available(remote))
+                if (!remote || !of_device_is_available(remote)) {
+                        of_node_put(remote);
                        continue;
+                }
                count += meson_probe_remote(pdev, &match, np, remote);
+                of_node_put(remote);
        }
        if (count && !match)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 5beb83d1cf87..ce1b3cc4bf6d 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -944,7 +944,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
        np = dev_pm_opp_get_of_node(opp);
        if (np) {
-                of_property_read_u32(np, "qcom,level", &val);
+                of_property_read_u32(np, "opp-level", &val);
                of_node_put(np);
        }
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index 2e4372ef17a3..2cfee1a4fe0b 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -765,7 +765,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
        adreno_gpu->rev = config->rev;
        adreno_gpu_config.ioname = "kgsl_3d0_reg_memory";
-        adreno_gpu_config.irqname = "kgsl_3d0_irq";
        adreno_gpu_config.va_start = SZ_16M;
        adreno_gpu_config.va_end = 0xffffffff;
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index fd75870eb17f..6aefcd6db46b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -365,19 +365,6 @@ static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane,
                        &pdpu->pipe_qos_cfg);
 }
-static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
-{
-        struct dpu_plane *pdpu = to_dpu_plane(plane);
-        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
-        if (!pdpu->is_rt_pipe)
-                return;
-        pm_runtime_get_sync(&dpu_kms->pdev->dev);
-        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
-        pm_runtime_put_sync(&dpu_kms->pdev->dev);
-}
 /**
 * _dpu_plane_set_ot_limit - set OT limit for the given plane
 * @plane:              Pointer to drm plane
@@ -1248,6 +1235,19 @@ static void dpu_plane_reset(struct drm_plane *plane)
 }
 #ifdef CONFIG_DEBUG_FS
+static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable)
+{
+        struct dpu_plane *pdpu = to_dpu_plane(plane);
+        struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
+        if (!pdpu->is_rt_pipe)
+                return;
+        pm_runtime_get_sync(&dpu_kms->pdev->dev);
+        _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL);
+        pm_runtime_put_sync(&dpu_kms->pdev->dev);
+}
 static ssize_t _dpu_plane_danger_read(struct file *file,
                        char __user *buff, size_t count, loff_t *ppos)
 {
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 9cd6a96c6bf2..927e5d86f7c1 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -250,7 +250,8 @@ void msm_gem_purge_vma(struct msm_gem_address_space *aspace,
 void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                struct msm_gem_vma *vma);
 int msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages);
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages);
 void msm_gem_close_vma(struct msm_gem_address_space *aspace,
                struct msm_gem_vma *vma);
@@ -333,6 +334,7 @@ void msm_gem_kernel_put(struct drm_gem_object *bo,
 struct drm_gem_object *msm_gem_import(struct drm_device *dev,
                struct dma_buf *dmabuf, struct sg_table *sgt);
+__printf(2, 3)
 void msm_gem_object_set_name(struct drm_gem_object *bo, const char *fmt, ...);
 int msm_framebuffer_prepare(struct drm_framebuffer *fb,
@@ -396,12 +398,14 @@ void msm_framebuffer_describe(struct drm_framebuffer *fb, struct seq_file *m);
 int msm_debugfs_late_init(struct drm_device *dev);
 int msm_rd_debugfs_init(struct drm_minor *minor);
 void msm_rd_debugfs_cleanup(struct msm_drm_private *priv);
+__printf(3, 4)
 void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                const char *fmt, ...);
 int msm_perf_debugfs_init(struct drm_minor *minor);
 void msm_perf_debugfs_cleanup(struct msm_drm_private *priv);
 #else
 static inline int msm_debugfs_late_init(struct drm_device *dev) { return 0; }
+__printf(3, 4)
 static inline void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
                const char *fmt, ...) {}
 static inline void msm_rd_debugfs_cleanup(struct msm_drm_private *priv) {}
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 51a95da694d8..c8886d3071fa 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -391,6 +391,10 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
        struct msm_gem_object *msm_obj = to_msm_bo(obj);
        struct msm_gem_vma *vma;
        struct page **pages;
+        int prot = IOMMU_READ;
+        if (!(msm_obj->flags & MSM_BO_GPU_READONLY))
+                prot |= IOMMU_WRITE;
        WARN_ON(!mutex_is_locked(&msm_obj->lock));
@@ -405,8 +409,8 @@ static int msm_gem_pin_iova(struct drm_gem_object *obj,
        if (IS_ERR(pages))
                return PTR_ERR(pages);
-        return msm_gem_map_vma(aspace, vma, msm_obj->sgt,
+        return msm_gem_map_vma(aspace, vma, prot,
-                        obj->size >> PAGE_SHIFT);
+                        msm_obj->sgt, obj->size >> PAGE_SHIFT);
 }
 /* get iova and pin it. Should have a matching put */
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index 557360788084..49c04829cf34 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -68,7 +68,8 @@ void msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
 int
 msm_gem_map_vma(struct msm_gem_address_space *aspace,
-                struct msm_gem_vma *vma, struct sg_table *sgt, int npages)
+                struct msm_gem_vma *vma, int prot,
+                struct sg_table *sgt, int npages)
 {
        unsigned size = npages << PAGE_SHIFT;
        int ret = 0;
@@ -86,7 +87,7 @@ msm_gem_map_vma(struct msm_gem_address_space *aspace,
        if (aspace->mmu)
                ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt,
-                                size, IOMMU_READ | IOMMU_WRITE);
+                                size, prot);
        if (ret)
                vma->mapped = false;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 5f3eff304355..10babd18e286 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -900,7 +900,7 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,
        }
        /* Get Interrupt: */
-        gpu->irq = platform_get_irq_byname(pdev, config->irqname);
+        gpu->irq = platform_get_irq(pdev, 0);
        if (gpu->irq < 0) {
                ret = gpu->irq;
                DRM_DEV_ERROR(drm->dev, "failed to get irq: %d\n", ret);
diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
index efb49bb64191..ca17086f72c9 100644
--- a/drivers/gpu/drm/msm/msm_gpu.h
+++ b/drivers/gpu/drm/msm/msm_gpu.h
@@ -31,7 +31,6 @@ struct msm_gpu_state;
 struct msm_gpu_config {
        const char *ioname;
-        const char *irqname;
        uint64_t va_start;
        uint64_t va_end;
        unsigned int nr_rings;
@@ -63,7 +62,7 @@ struct msm_gpu_funcs {
        struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
        void (*recover)(struct msm_gpu *gpu);
        void (*destroy)(struct msm_gpu *gpu);
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
        /* show GPU status in debugfs: */
        void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
                        struct drm_printer *p);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 90e9d0a48dc0..d21172933d92 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
                char *fptr = &fifo->buf[fifo->head];
                int n;
-                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
+                wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
+                if (!rd->open)
+                        return;
                /* Note that smp_load_acquire() is not strictly required
                 * as CIRC_SPACE_TO_END() does not access the tail more
@@ -213,7 +215,10 @@ out:
 static int rd_release(struct inode *inode, struct file *file)
 {
        struct msm_rd_state *rd = inode->i_private;
        rd->open = false;
+        wake_up_all(&rd->fifo_event);
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index bfbc9341e0c2..d9edb5785813 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -2435,6 +2435,38 @@ nv140_chipset = {
 };
 static const struct nvkm_device_chip
+nv162_chipset = {
+        .name = "TU102",
+        .bar = tu104_bar_new,
+        .bios = nvkm_bios_new,
+        .bus = gf100_bus_new,
+        .devinit = tu104_devinit_new,
+        .fault = tu104_fault_new,
+        .fb = gv100_fb_new,
+        .fuse = gm107_fuse_new,
+        .gpio = gk104_gpio_new,
+        .i2c = gm200_i2c_new,
+        .ibus = gm200_ibus_new,
+        .imem = nv50_instmem_new,
+        .ltc = gp102_ltc_new,
+        .mc = tu104_mc_new,
+        .mmu = tu104_mmu_new,
+        .pci = gp100_pci_new,
+        .pmu = gp102_pmu_new,
+        .therm = gp100_therm_new,
+        .timer = gk20a_timer_new,
+        .top = gk104_top_new,
+        .ce[0] = tu104_ce_new,
+        .ce[1] = tu104_ce_new,
+        .ce[2] = tu104_ce_new,
+        .ce[3] = tu104_ce_new,
+        .ce[4] = tu104_ce_new,
+        .disp = tu104_disp_new,
+        .dma = gv100_dma_new,
+        .fifo = tu104_fifo_new,
+};
+static const struct nvkm_device_chip
 nv164_chipset = {
        .name = "TU104",
        .bar = tu104_bar_new,
@@ -2950,6 +2982,7 @@ nvkm_device_ctor(const struct nvkm_device_func *func,
                case 0x138: device->chip = &nv138_chipset; break;
                case 0x13b: device->chip = &nv13b_chipset; break;
                case 0x140: device->chip = &nv140_chipset; break;
+                case 0x162: device->chip = &nv162_chipset; break;
                case 0x164: device->chip = &nv164_chipset; break;
                case 0x166: device->chip = &nv166_chipset; break;
                default:
diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
index 13c8a662f9b4..ccb090f3ab30 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -250,14 +250,10 @@ static struct drm_driver qxl_driver = {
 #if defined(CONFIG_DEBUG_FS)
        .debugfs_init = qxl_debugfs_init,
 #endif
-        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
-        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
        .gem_prime_export = drm_gem_prime_export,
        .gem_prime_import = drm_gem_prime_import,
        .gem_prime_pin = qxl_gem_prime_pin,
        .gem_prime_unpin = qxl_gem_prime_unpin,
-        .gem_prime_get_sg_table = qxl_gem_prime_get_sg_table,
-        .gem_prime_import_sg_table = qxl_gem_prime_import_sg_table,
        .gem_prime_vmap = qxl_gem_prime_vmap,
        .gem_prime_vunmap = qxl_gem_prime_vunmap,
        .gem_prime_mmap = qxl_gem_prime_mmap,
diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c
index a55dece118b2..df65d3c1a7b8 100644
--- a/drivers/gpu/drm/qxl/qxl_prime.c
+++ b/drivers/gpu/drm/qxl/qxl_prime.c
@@ -38,20 +38,6 @@ void qxl_gem_prime_unpin(struct drm_gem_object *obj)
        WARN_ONCE(1, "not implemented");
 }
-struct sg_table *qxl_gem_prime_get_sg_table(struct drm_gem_object *obj)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENOSYS);
-}
-struct drm_gem_object *qxl_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *table)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENOSYS);
-}
 void *qxl_gem_prime_vmap(struct drm_gem_object *obj)
 {
        WARN_ONCE(1, "not implemented");
diff --git a/drivers/gpu/drm/rockchip/rockchip_rgb.c b/drivers/gpu/drm/rockchip/rockchip_rgb.c
index 96ac1458a59c..37f93022a106 100644
--- a/drivers/gpu/drm/rockchip/rockchip_rgb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_rgb.c
@@ -113,8 +113,10 @@ struct rockchip_rgb *rockchip_rgb_init(struct device *dev,
                child_count++;
                ret = drm_of_find_panel_or_bridge(dev->of_node, 0, endpoint_id,
                                                  &panel, &bridge);
-                if (!ret)
+                if (!ret) {
+                        of_node_put(endpoint);
                        break;
+                }
        }
        of_node_put(port);
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 9e9255ee59cd..a021bab11a4f 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -786,17 +786,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv,
                remote = of_graph_get_remote_port_parent(ep);
                if (!remote)
                        continue;
+                of_node_put(remote);
                /* does this node match any registered engines? */
                list_for_each_entry(frontend, &drv->frontend_list, list) {
                        if (remote == frontend->node) {
-                                of_node_put(remote);
                                of_node_put(port);
+                                of_node_put(ep);
                                return frontend;
                        }
                }
        }
+        of_node_put(port);
        return ERR_PTR(-EINVAL);
 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 061d2e0d9011..416da5376701 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
        val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
        val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
        writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+        clk_disable_unprepare(hdmi->tmds_clk);
 }
 static void sun4i_hdmi_enable(struct drm_encoder *encoder)
@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
        DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
+        clk_prepare_enable(hdmi->tmds_clk);
        sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
        val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
        val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c
index f7f32a885af7..2d1aaca49105 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.c
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.c
@@ -127,14 +127,10 @@ static struct drm_driver driver = {
 #if defined(CONFIG_DEBUG_FS)
        .debugfs_init = virtio_gpu_debugfs_init,
 #endif
-        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
-        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
        .gem_prime_export = drm_gem_prime_export,
        .gem_prime_import = drm_gem_prime_import,
        .gem_prime_pin = virtgpu_gem_prime_pin,
        .gem_prime_unpin = virtgpu_gem_prime_unpin,
-        .gem_prime_get_sg_table = virtgpu_gem_prime_get_sg_table,
-        .gem_prime_import_sg_table = virtgpu_gem_prime_import_sg_table,
        .gem_prime_vmap = virtgpu_gem_prime_vmap,
        .gem_prime_vunmap = virtgpu_gem_prime_vunmap,
        .gem_prime_mmap = virtgpu_gem_prime_mmap,
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 1deb41d42ea4..0c15000f926e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -372,10 +372,6 @@ int virtio_gpu_object_wait(struct virtio_gpu_object *bo, bool no_wait);
 /* virtgpu_prime.c */
 int virtgpu_gem_prime_pin(struct drm_gem_object *obj);
 void virtgpu_gem_prime_unpin(struct drm_gem_object *obj);
-struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj);
-struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *sgt);
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj);
 void virtgpu_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int virtgpu_gem_prime_mmap(struct drm_gem_object *obj,
diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c
index 86ce0ae93f59..c59ec34c80a5 100644
--- a/drivers/gpu/drm/virtio/virtgpu_prime.c
+++ b/drivers/gpu/drm/virtio/virtgpu_prime.c
@@ -39,20 +39,6 @@ void virtgpu_gem_prime_unpin(struct drm_gem_object *obj)
        WARN_ONCE(1, "not implemented");
 }
-struct sg_table *virtgpu_gem_prime_get_sg_table(struct drm_gem_object *obj)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENODEV);
-}
-struct drm_gem_object *virtgpu_gem_prime_import_sg_table(
-        struct drm_device *dev, struct dma_buf_attachment *attach,
-        struct sg_table *table)
-{
-        WARN_ONCE(1, "not implemented");
-        return ERR_PTR(-ENODEV);
-}
 void *virtgpu_gem_prime_vmap(struct drm_gem_object *obj)
 {
        struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(obj);
diff --git a/drivers/gpu/vga/Kconfig b/drivers/gpu/vga/Kconfig
index b677e5d524e6..d5f1d8e1c6f8 100644
--- a/drivers/gpu/vga/Kconfig
+++ b/drivers/gpu/vga/Kconfig
@@ -21,6 +21,7 @@ config VGA_SWITCHEROO
        bool "Laptop Hybrid Graphics - GPU switching support"
        depends on X86
        depends on ACPI
+        depends on PCI
        select VGA_ARB
        help
          Many laptops released in 2008/9/10 have two GPUs with a multiplexer
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f41d5fe51abe..9993b692598f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -125,6 +125,7 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 {
        struct hid_collection *collection;
        unsigned usage;
+        int collection_index;
        usage = parser->local.usage[0];
@@ -167,13 +168,13 @@ static int open_collection(struct hid_parser *parser, unsigned type)
        parser->collection_stack[parser->collection_stack_ptr++] =
                parser->device->maxcollection;
-        collection = parser->device->collection +
+        collection_index = parser->device->maxcollection++;
-                parser->device->maxcollection++;
+        collection = parser->device->collection + collection_index;
        collection->type = type;
        collection->usage = usage;
        collection->level = parser->collection_stack_ptr - 1;
-        collection->parent = parser->active_collection;
+        collection->parent_idx = (collection->level == 0) ? -1 :
-        parser->active_collection = collection;
+                parser->collection_stack[collection->level - 1];
        if (type == HID_COLLECTION_APPLICATION)
                parser->device->maxapplication++;
@@ -192,8 +193,6 @@ static int close_collection(struct hid_parser *parser)
                return -EINVAL;
        }
        parser->collection_stack_ptr--;
-        if (parser->active_collection)
-                parser->active_collection = parser->active_collection->parent;
        return 0;
 }
@@ -1006,10 +1005,12 @@ static void hid_apply_multiplier_to_field(struct hid_device *hid,
                usage = &field->usage[i];
                collection = &hid->collection[usage->collection_index];
-                while (collection && collection != multiplier_collection)
+                while (collection->parent_idx != -1 &&
-                        collection = collection->parent;
+                       collection != multiplier_collection)
+                        collection = &hid->collection[collection->parent_idx];
-                if (collection || multiplier_collection == NULL)
+                if (collection->parent_idx != -1 ||
+                    multiplier_collection == NULL)
                        usage->resolution_multiplier = effective_multiplier;
        }
@@ -1044,9 +1045,9 @@ static void hid_apply_multiplier(struct hid_device *hid,
         * applicable fields later.
         */
        multiplier_collection = &hid->collection[multiplier->usage->collection_index];
-        while (multiplier_collection &&
+        while (multiplier_collection->parent_idx != -1 &&
               multiplier_collection->type != HID_COLLECTION_LOGICAL)
-                multiplier_collection = multiplier_collection->parent;
+                multiplier_collection = &hid->collection[multiplier_collection->parent_idx];
        effective_multiplier = hid_calculate_multiplier(hid, multiplier);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 518fa76414f5..24f846d67478 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -461,6 +461,9 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+#define I2C_VENDOR_ID_GOODIX            0x27c6
+#define I2C_DEVICE_ID_GOODIX_01F0       0x01f0
 #define USB_VENDOR_ID_GOODTOUCH         0x1aad
 #define USB_DEVICE_ID_GOODTOUCH_000f    0x000f
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 8555ce7e737b..c5edfa966343 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks {
                I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
        { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
                I2C_HID_QUIRK_NO_RUNTIME_PM },
+        { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0,
+                I2C_HID_QUIRK_NO_RUNTIME_PM },
        { 0, 0 }
 };
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index ce0ba2062723..bea4c9850247 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -701,19 +701,12 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
 int vmbus_disconnect_ring(struct vmbus_channel *channel)
 {
        struct vmbus_channel *cur_channel, *tmp;
-        unsigned long flags;
-        LIST_HEAD(list);
        int ret;
        if (channel->primary_channel != NULL)
                return -EINVAL;
-        /* Snapshot the list of subchannels */
+        list_for_each_entry_safe(cur_channel, tmp, &channel->sc_list, sc_list) {
-        spin_lock_irqsave(&channel->lock, flags);
-        list_splice_init(&channel->sc_list, &list);
-        spin_unlock_irqrestore(&channel->lock, flags);
-        list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
                if (cur_channel->rescind)
                        wait_for_completion(&cur_channel->rescind_event);
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index 5301fef16c31..7c6349a50ef1 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -888,12 +888,14 @@ static unsigned long handle_pg_range(unsigned long pg_start,
                        pfn_cnt -= pgs_ol;
                        /*
                         * Check if the corresponding memory block is already
-                         * online by checking its last previously backed page.
+                         * online. It is possible to observe struct pages still
-                         * In case it is we need to bring rest (which was not
+                         * being uninitialized here so check section instead.
-                         * backed previously) online too.
+                         * In case the section is online we need to bring the
+                         * rest of pfns (which were not backed previously)
+                         * online too.
                         */
                        if (start_pfn > has->start_pfn &&
-                            !PageReserved(pfn_to_page(start_pfn - 1)))
+                            online_section_nr(pfn_to_section_nr(start_pfn)))
                                hv_bring_pgs_online(has, start_pfn, pgs_ol);
                }
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 64d0c85d5161..1f1a55e07733 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -164,26 +164,25 @@ hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
 }
 /* Get various debug metrics for the specified ring buffer. */
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                                 struct hv_ring_buffer_debug_info *debug_info)
+                                struct hv_ring_buffer_debug_info *debug_info)
 {
        u32 bytes_avail_towrite;
        u32 bytes_avail_toread;
-        if (ring_info->ring_buffer) {
+        if (!ring_info->ring_buffer)
-                hv_get_ringbuffer_availbytes(ring_info,
+                return -EINVAL;
-                                        &bytes_avail_toread,
-                                        &bytes_avail_towrite);
+        hv_get_ringbuffer_availbytes(ring_info,
+                                     &bytes_avail_toread,
-                debug_info->bytes_avail_toread = bytes_avail_toread;
+                                     &bytes_avail_towrite);
-                debug_info->bytes_avail_towrite = bytes_avail_towrite;
+        debug_info->bytes_avail_toread = bytes_avail_toread;
-                debug_info->current_read_index =
+        debug_info->bytes_avail_towrite = bytes_avail_towrite;
-                        ring_info->ring_buffer->read_index;
+        debug_info->current_read_index = ring_info->ring_buffer->read_index;
-                debug_info->current_write_index =
+        debug_info->current_write_index = ring_info->ring_buffer->write_index;
-                        ring_info->ring_buffer->write_index;
+        debug_info->current_interrupt_mask
-                debug_info->current_interrupt_mask =
+                = ring_info->ring_buffer->interrupt_mask;
-                        ring_info->ring_buffer->interrupt_mask;
+        return 0;
-        }
 }
 EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo);
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index d0ff65675292..403fee01572c 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -313,12 +313,16 @@ static ssize_t out_intr_mask_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(out_intr_mask);
@@ -328,12 +332,15 @@ static ssize_t out_read_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_read_index);
 }
 static DEVICE_ATTR_RO(out_read_index);
@@ -344,12 +351,15 @@ static ssize_t out_write_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.current_write_index);
 }
 static DEVICE_ATTR_RO(out_write_index);
@@ -360,12 +370,15 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(out_read_bytes_avail);
@@ -376,12 +389,15 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info outbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+                                          &outbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(out_write_bytes_avail);
@@ -391,12 +407,15 @@ static ssize_t in_intr_mask_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
 }
 static DEVICE_ATTR_RO(in_intr_mask);
@@ -406,12 +425,15 @@ static ssize_t in_read_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_read_index);
 }
 static DEVICE_ATTR_RO(in_read_index);
@@ -421,12 +443,15 @@ static ssize_t in_write_index_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.current_write_index);
 }
 static DEVICE_ATTR_RO(in_write_index);
@@ -437,12 +462,15 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
 }
 static DEVICE_ATTR_RO(in_read_bytes_avail);
@@ -453,12 +481,15 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
 {
        struct hv_device *hv_dev = device_to_hv_device(dev);
        struct hv_ring_buffer_debug_info inbound;
+        int ret;
        if (!hv_dev->channel)
                return -ENODEV;
-        if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
-                return -EINVAL;
+        ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
-        hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+        if (ret < 0)
+                return ret;
        return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
 }
 static DEVICE_ATTR_RO(in_write_bytes_avail);
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index 0e30fa00204c..f9b8e3e23a8e 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
        }
        rv = lm80_read_value(client, LM80_REG_FANDIV);
-        if (rv < 0)
+        if (rv < 0) {
+                mutex_unlock(&data->update_lock);
                return rv;
+        }
        reg = (rv & ~(3 << (2 * (nr + 1))))
            | (data->fan_div[nr] << (2 * (nr + 1)));
        lm80_write_value(client, LM80_REG_FANDIV, reg);
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index c3040079b1cb..4adec4ab7d06 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -44,8 +44,8 @@
 * nct6796d    14      7       7       2+6    0xd420 0xc1    0x5ca3
 * nct6797d    14      7       7       2+6    0xd450 0xc1    0x5ca3
 *                                           (0xd451)
- * nct6798d    14      7       7       2+6    0xd458 0xc1    0x5ca3
+ * nct6798d    14      7       7       2+6    0xd428 0xc1    0x5ca3
- *                                           (0xd459)
+ *                                           (0xd429)
 *
 * #temp lists the number of monitored temperature sources (first value) plus
 * the number of directly connectable temperature sensors (second value).
@@ -138,7 +138,7 @@ MODULE_PARM_DESC(fan_debounce, "Enable debouncing for fan RPM signal");
 #define SIO_NCT6795_ID          0xd350
 #define SIO_NCT6796_ID          0xd420
 #define SIO_NCT6797_ID          0xd450
-#define SIO_NCT6798_ID          0xd458
+#define SIO_NCT6798_ID          0xd428
 #define SIO_ID_MASK             0xFFF8
 enum pwm_enable { off, manual, thermal_cruise, speed_cruise, sf3, sf4 };
@@ -4508,7 +4508,8 @@ static int __maybe_unused nct6775_resume(struct device *dev)
        if (data->kind == nct6791 || data->kind == nct6792 ||
            data->kind == nct6793 || data->kind == nct6795 ||
-            data->kind == nct6796)
+            data->kind == nct6796 || data->kind == nct6797 ||
+            data->kind == nct6798)
                nct6791_enable_io_mapping(sioreg);
        superio_exit(sioreg);
@@ -4644,7 +4645,8 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
        if (sio_data->kind == nct6791 || sio_data->kind == nct6792 ||
            sio_data->kind == nct6793 || sio_data->kind == nct6795 ||
-            sio_data->kind == nct6796)
+            sio_data->kind == nct6796 || sio_data->kind == nct6797 ||
+            sio_data->kind == nct6798)
                nct6791_enable_io_mapping(sioaddr);
        superio_exit(sioaddr);
diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
index 423903f87955..391118c8aae8 100644
--- a/drivers/hwmon/occ/common.c
+++ b/drivers/hwmon/occ/common.c
@@ -380,8 +380,8 @@ static ssize_t occ_show_power_1(struct device *dev,
                val *= 1000000ULL;
                break;
        case 2:
-                val = get_unaligned_be32(&power->update_tag) *
+                val = (u64)get_unaligned_be32(&power->update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->value) * 1000000ULL;
@@ -425,8 +425,8 @@ static ssize_t occ_show_power_2(struct device *dev,
                                       &power->update_tag);
                break;
        case 2:
-                val = get_unaligned_be32(&power->update_tag) *
+                val = (u64)get_unaligned_be32(&power->update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->value) * 1000000ULL;
@@ -463,8 +463,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->system.update_tag);
                break;
        case 2:
-                val = get_unaligned_be32(&power->system.update_tag) *
+                val = (u64)get_unaligned_be32(&power->system.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 3:
                val = get_unaligned_be16(&power->system.value) * 1000000ULL;
@@ -477,8 +477,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->proc.update_tag);
                break;
        case 6:
-                val = get_unaligned_be32(&power->proc.update_tag) *
+                val = (u64)get_unaligned_be32(&power->proc.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 7:
                val = get_unaligned_be16(&power->proc.value) * 1000000ULL;
@@ -491,8 +491,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->vdd.update_tag);
                break;
        case 10:
-                val = get_unaligned_be32(&power->vdd.update_tag) *
+                val = (u64)get_unaligned_be32(&power->vdd.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 11:
                val = get_unaligned_be16(&power->vdd.value) * 1000000ULL;
@@ -505,8 +505,8 @@ static ssize_t occ_show_power_a0(struct device *dev,
                                       &power->vdn.update_tag);
                break;
        case 14:
-                val = get_unaligned_be32(&power->vdn.update_tag) *
+                val = (u64)get_unaligned_be32(&power->vdn.update_tag) *
-                        occ->powr_sample_time_us;
+                           occ->powr_sample_time_us;
                break;
        case 15:
                val = get_unaligned_be16(&power->vdn.value) * 1000000ULL;
diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index 8844c9565d2a..7053be59ad2e 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
                .data = (void *)2
        },
        {
-                .compatible = "ti,tmp422",
+                .compatible = "ti,tmp442",
                .data = (void *)3
        },
        { },
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index b532e2c9cf5c..f8c00b94817f 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -901,9 +901,6 @@ static int dw_i3c_master_reattach_i3c_dev(struct i3c_dev_desc *dev,
               master->regs +
               DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
-        if (!old_dyn_addr)
-                return 0;
        master->addrs[data->index] = dev->info.dyn_addr;
        return 0;
@@ -925,11 +922,11 @@ static int dw_i3c_master_attach_i3c_dev(struct i3c_dev_desc *dev)
                return -ENOMEM;
        data->index = pos;
-        master->addrs[pos] = dev->info.dyn_addr;
+        master->addrs[pos] = dev->info.dyn_addr ? : dev->info.static_addr;
        master->free_pos &= ~BIT(pos);
        i3c_dev_set_master_data(dev, data);
-        writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(dev->info.dyn_addr),
+        writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->addrs[pos]),
               master->regs +
               DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
index bbd79b8b1a80..8889a4fdb454 100644
--- a/drivers/i3c/master/i3c-master-cdns.c
+++ b/drivers/i3c/master/i3c-master-cdns.c
@@ -1556,8 +1556,8 @@ static int cdns_i3c_master_probe(struct platform_device *pdev)
                return PTR_ERR(master->pclk);
        master->sysclk = devm_clk_get(&pdev->dev, "sysclk");
-        if (IS_ERR(master->pclk))
+        if (IS_ERR(master->sysclk))
-                return PTR_ERR(master->pclk);
+                return PTR_ERR(master->sysclk);
        irq = platform_get_irq(pdev, 0);
        if (irq < 0)
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 4c8c7a620d08..a5dc13576394 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -544,7 +544,7 @@ void ide_proc_port_register_devices(ide_hwif_t *hwif)
                drive->proc = proc_mkdir(drive->name, parent);
                if (drive->proc) {
                        ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
-                        proc_create_data("setting", S_IFREG|S_IRUSR|S_IWUSR,
+                        proc_create_data("settings", S_IFREG|S_IRUSR|S_IWUSR,
                                        drive->proc, &ide_settings_proc_fops,
                                        drive);
                }
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index cafb1dcadc48..9d984f2a8ba7 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -142,7 +142,10 @@ static void tiadc_step_config(struct iio_dev *indio_dev)
                        stepconfig |= STEPCONFIG_MODE_SWCNT;
                tiadc_writel(adc_dev, REG_STEPCONFIG(steps),
-                                stepconfig | STEPCONFIG_INP(chan));
+                                stepconfig | STEPCONFIG_INP(chan) |
+                                STEPCONFIG_INM_ADCREFM |
+                                STEPCONFIG_RFP_VREFP |
+                                STEPCONFIG_RFM_VREFN);
                if (adc_dev->open_delay[i] > STEPDELAY_OPEN_MASK) {
                        dev_warn(dev, "chan %d open delay truncating to 0x3FFFF\n",
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 63a7cc00bae0..84f077b2b90a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -494,7 +494,10 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv,
        id_priv->id.route.addr.dev_addr.transport =
                rdma_node_get_transport(cma_dev->device->node_type);
        list_add_tail(&id_priv->list, &cma_dev->id_list);
-        rdma_restrack_kadd(&id_priv->res);
+        if (id_priv->res.kern_name)
+                rdma_restrack_kadd(&id_priv->res);
+        else
+                rdma_restrack_uadd(&id_priv->res);
 }
 static void cma_attach_to_dev(struct rdma_id_private *id_priv,
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index e600fc23ae62..3c97a8b6bf1e 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -584,10 +584,6 @@ static int fill_res_pd_entry(struct sk_buff *msg, struct netlink_callback *cb,
        if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_RES_USECNT,
                              atomic_read(&pd->usecnt), RDMA_NLDEV_ATTR_PAD))
                goto err;
-        if ((pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY,
-                        pd->unsafe_global_rkey))
-                goto err;
        if (fill_res_name_pid(msg, res))
                goto err;
diff --git a/drivers/infiniband/core/rdma_core.h b/drivers/infiniband/core/rdma_core.h
index be6b8e1257d0..69f8db66925e 100644
--- a/drivers/infiniband/core/rdma_core.h
+++ b/drivers/infiniband/core/rdma_core.h
@@ -106,6 +106,8 @@ int uverbs_finalize_object(struct ib_uobject *uobj,
                           enum uverbs_obj_access access,
                           bool commit);
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx);
 void setup_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 void release_ufile_idr_uobject(struct ib_uverbs_file *ufile);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6b12cc5f97b2..3317300ab036 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -60,6 +60,10 @@ static int uverbs_response(struct uverbs_attr_bundle *attrs, const void *resp,
 {
        int ret;
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                return uverbs_copy_to_struct_or_zero(
+                        attrs, UVERBS_ATTR_CORE_OUT, resp, resp_len);
        if (copy_to_user(attrs->ucore.outbuf, resp,
                         min(attrs->ucore.outlen, resp_len)))
                return -EFAULT;
@@ -1181,6 +1185,9 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)
                goto out_put;
        }
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                ret = uverbs_output_written(attrs, UVERBS_ATTR_CORE_OUT);
        ret = 0;
 out_put:
@@ -2012,8 +2019,10 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)
                return -ENOMEM;
        qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs);
-        if (!qp)
+        if (!qp) {
+                ret = -EINVAL;
                goto out;
+        }
        is_ud = qp->qp_type == IB_QPT_UD;
        sg_ind = 0;
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c81ff698052..0ca04d224015 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -144,6 +144,21 @@ static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr,
                           0, uattr->len - len);
 }
+static int uverbs_set_output(const struct uverbs_attr_bundle *bundle,
+                             const struct uverbs_attr *attr)
+{
+        struct bundle_priv *pbundle =
+                container_of(bundle, struct bundle_priv, bundle);
+        u16 flags;
+        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+                UVERBS_ATTR_F_VALID_OUTPUT;
+        if (put_user(flags,
+                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
+                return -EFAULT;
+        return 0;
+}
 static int uverbs_process_idrs_array(struct bundle_priv *pbundle,
                                     const struct uverbs_api_attr *attr_uapi,
                                     struct uverbs_objs_arr_attr *attr,
@@ -456,6 +471,19 @@ static int ib_uverbs_run_method(struct bundle_priv *pbundle,
        }
        /*
+         * Until the drivers are revised to use the bundle directly we have to
+         * assume that the driver wrote to its UHW_OUT and flag userspace
+         * appropriately.
+         */
+        if (!ret && pbundle->method_elm->has_udata) {
+                const struct uverbs_attr *attr =
+                        uverbs_attr_get(&pbundle->bundle, UVERBS_ATTR_UHW_OUT);
+                if (!IS_ERR(attr))
+                        ret = uverbs_set_output(&pbundle->bundle, attr);
+        }
+        /*
         * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
         * not invoke the method because the request is not supported.  No
         * other cases should return this code.
@@ -706,10 +734,7 @@ void uverbs_fill_udata(struct uverbs_attr_bundle *bundle,
 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
                   const void *from, size_t size)
 {
-        struct bundle_priv *pbundle =
-                container_of(bundle, struct bundle_priv, bundle);
        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        u16 flags;
        size_t min_size;
        if (IS_ERR(attr))
@@ -719,16 +744,25 @@ int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
        if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
                return -EFAULT;
-        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+        return uverbs_set_output(bundle, attr);
-                UVERBS_ATTR_F_VALID_OUTPUT;
-        if (put_user(flags,
-                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
-                return -EFAULT;
-        return 0;
 }
 EXPORT_SYMBOL(uverbs_copy_to);
+/*
+ * This is only used if the caller has directly used copy_to_use to write the
+ * data.  It signals to user space that the buffer is filled in.
+ */
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx)
+{
+        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
+        if (IS_ERR(attr))
+                return PTR_ERR(attr);
+        return uverbs_set_output(bundle, attr);
+}
 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
                      size_t idx, s64 lower_bound, u64 upper_bound,
                      s64  *def_val)
@@ -757,8 +791,10 @@ int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle,
 {
        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        if (clear_user(u64_to_user_ptr(attr->ptr_attr.data),
+        if (size < attr->ptr_attr.len) {
-                       attr->ptr_attr.len))
+                if (clear_user(u64_to_user_ptr(attr->ptr_attr.data) + size,
-                return -EFAULT;
+                               attr->ptr_attr.len - size))
+                        return -EFAULT;
+        }
        return uverbs_copy_to(bundle, idx, from, size);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb0007aa0c27..2890a77339e1 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -690,6 +690,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
        buf += sizeof(hdr);
+        memset(bundle.attr_present, 0, sizeof(bundle.attr_present));
        bundle.ufile = file;
        if (!method_elm->is_ex) {
                size_t in_len = hdr.in_words * 4 - sizeof(hdr);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 82cb6b71ac7c..e3e9dd54caa2 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -534,7 +534,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
        {
                struct mthca_ucontext *context;
-                qp = kmalloc(sizeof *qp, GFP_KERNEL);
+                qp = kzalloc(sizeof(*qp), GFP_KERNEL);
                if (!qp)
                        return ERR_PTR(-ENOMEM);
@@ -600,7 +600,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                if (udata)
                        return ERR_PTR(-EINVAL);
-                qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
+                qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
                if (!qp)
                        return ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 42b8685c997e..3c633ab58052 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -427,7 +427,40 @@ static inline enum ib_qp_state pvrdma_qp_state_to_ib(enum pvrdma_qp_state state)
 static inline enum pvrdma_wr_opcode ib_wr_opcode_to_pvrdma(enum ib_wr_opcode op)
 {
-        return (enum pvrdma_wr_opcode)op;
+        switch (op) {
+        case IB_WR_RDMA_WRITE:
+                return PVRDMA_WR_RDMA_WRITE;
+        case IB_WR_RDMA_WRITE_WITH_IMM:
+                return PVRDMA_WR_RDMA_WRITE_WITH_IMM;
+        case IB_WR_SEND:
+                return PVRDMA_WR_SEND;
+        case IB_WR_SEND_WITH_IMM:
+                return PVRDMA_WR_SEND_WITH_IMM;
+        case IB_WR_RDMA_READ:
+                return PVRDMA_WR_RDMA_READ;
+        case IB_WR_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_ATOMIC_CMP_AND_SWP;
+        case IB_WR_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_LSO:
+                return PVRDMA_WR_LSO;
+        case IB_WR_SEND_WITH_INV:
+                return PVRDMA_WR_SEND_WITH_INV;
+        case IB_WR_RDMA_READ_WITH_INV:
+                return PVRDMA_WR_RDMA_READ_WITH_INV;
+        case IB_WR_LOCAL_INV:
+                return PVRDMA_WR_LOCAL_INV;
+        case IB_WR_REG_MR:
+                return PVRDMA_WR_FAST_REG_MR;
+        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
+                return PVRDMA_WR_MASKED_ATOMIC_CMP_AND_SWP;
+        case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
+                return PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD;
+        case IB_WR_REG_SIG_MR:
+                return PVRDMA_WR_REG_SIG_MR;
+        default:
+                return PVRDMA_WR_ERROR;
+        }
 }
 static inline enum ib_wc_status pvrdma_wc_status_to_ib(
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index 3acf74cbe266..1ec3646087ba 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -721,6 +721,12 @@ int pvrdma_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
                    wr->opcode == IB_WR_RDMA_WRITE_WITH_IMM)
                        wqe_hdr->ex.imm_data = wr->ex.imm_data;
+                if (unlikely(wqe_hdr->opcode == PVRDMA_WR_ERROR)) {
+                        *bad_wr = wr;
+                        ret = -EINVAL;
+                        goto out;
+                }
                switch (qp->ibqp.qp_type) {
                case IB_QPT_GSI:
                case IB_QPT_UD:
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index cfc8b94527b9..aa4e431cbcd3 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,8 @@ static const struct xpad_device {
        { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
        { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
        { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
+        { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+        { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
        { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
        { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -428,6 +430,7 @@ static const struct usb_device_id xpad_table[] = {
        XPAD_XBOXONE_VENDOR(0x0e6f),            /* 0x0e6f X-Box One controllers */
        XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
        XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
        XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
        XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
        XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 8ec483e8688b..26ec603fe220 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -39,6 +39,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/overflow.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
 static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                                   const struct input_absinfo *abs)
 {
-        int min, max;
+        int min, max, range;
        min = abs->minimum;
        max = abs->maximum;
@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
                return -EINVAL;
        }
-        if (abs->flat > max - min) {
+        if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
                printk(KERN_DEBUG
                       "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
                       UINPUT_NAME, code, abs->flat, min, max);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index b36084710f69..bae08226e3d9 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -195,6 +195,8 @@ static int olpc_apsp_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
+        priv->dev = &pdev->dev;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        priv->base = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(priv->base)) {
@@ -248,7 +250,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
                goto err_irq;
        }
-        priv->dev = &pdev->dev;
        device_init_wakeup(priv->dev, 1);
        platform_set_drvdata(pdev, priv);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index af6027cc7bbf..068dbbc610fc 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -698,7 +698,7 @@ config TOUCHSCREEN_EDT_FT5X06
 config TOUCHSCREEN_RASPBERRYPI_FW
        tristate "Raspberry Pi's firmware base touch screen support"
-        depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
+        depends on RASPBERRYPI_FIRMWARE || (RASPBERRYPI_FIRMWARE=n && COMPILE_TEST)
        help
          Say Y here if you have the official Raspberry Pi 7 inch screen on
          your system.
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index d8947b28db2d..f04a6df65eb8 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -224,7 +224,7 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
         * If we have reason to believe the IOMMU driver missed the initial
         * probe for dev, replay it to get things in order.
         */
-        if (dev->bus && !device_iommu_mapped(dev))
+        if (!err && dev->bus && !device_iommu_mapped(dev))
                err = iommu_probe_device(dev);
        /* Ignore all other errors apart from EPROBE_DEFER */
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index db20e992a40f..7f2a45445b00 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2399,13 +2399,14 @@ static void its_free_device(struct its_device *its_dev)
        kfree(its_dev);
 }
-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
 {
        int idx;
-        idx = find_first_zero_bit(dev->event_map.lpi_map,
+        idx = bitmap_find_free_region(dev->event_map.lpi_map,
-                                  dev->event_map.nr_lpis);
+                                      dev->event_map.nr_lpis,
-        if (idx == dev->event_map.nr_lpis)
+                                      get_count_order(nvecs));
+        if (idx < 0)
                return -ENOSPC;
        *hwirq = dev->event_map.lpi_base + idx;
@@ -2501,21 +2502,21 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        int err;
        int i;
-        for (i = 0; i < nr_irqs; i++) {
+        err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
-                err = its_alloc_device_irq(its_dev, &hwirq);
+        if (err)
-                if (err)
+                return err;
-                        return err;
-                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
+        for (i = 0; i < nr_irqs; i++) {
+                err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
                if (err)
                        return err;
                irq_domain_set_hwirq_and_chip(domain, virq + i,
-                                              hwirq, &its_irq_chip, its_dev);
+                                              hwirq + i, &its_irq_chip, its_dev);
                irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
                pr_debug("ID:%d pID:%d vID:%d\n",
-                         (int)(hwirq - its_dev->event_map.lpi_base),
+                         (int)(hwirq + i - its_dev->event_map.lpi_base),
-                         (int) hwirq, virq + i);
+                         (int)(hwirq + i), virq + i);
        }
        return 0;
diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
index ad70e7c416e3..fbfa7ff6deb1 100644
--- a/drivers/irqchip/irq-gic-v3-mbi.c
+++ b/drivers/irqchip/irq-gic-v3-mbi.c
@@ -24,7 +24,7 @@ struct mbi_range {
        unsigned long           *bm;
 };
-static struct mutex             mbi_lock;
+static DEFINE_MUTEX(mbi_lock);
 static phys_addr_t              mbi_phys_base;
 static struct mbi_range         *mbi_ranges;
 static unsigned int             mbi_range_nr;
diff --git a/drivers/irqchip/irq-madera.c b/drivers/irqchip/irq-madera.c
index e9256dee1a45..8b81271c823c 100644
--- a/drivers/irqchip/irq-madera.c
+++ b/drivers/irqchip/irq-madera.c
@@ -7,7 +7,6 @@
 */
 #include <linux/module.h>
-#include <linux/gpio.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/irqdomain.h>
@@ -16,7 +15,6 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
-#include <linux/of_gpio.h>
 #include <linux/of_irq.h>
 #include <linux/irqchip/irq-madera.h>
 #include <linux/mfd/madera/core.h>
diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 6edfd4bfa169..a93296b9b45d 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -822,6 +822,7 @@ out_unmap:
 static const struct irq_domain_ops stm32_exti_h_domain_ops = {
        .alloc  = stm32_exti_h_domain_alloc,
        .free   = irq_domain_free_irqs_common,
+        .xlate = irq_domain_xlate_twocell,
 };
 static int
diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
index 4ac378e48902..40ca1e8fa09f 100644
--- a/drivers/isdn/hardware/avm/b1.c
+++ b/drivers/isdn/hardware/avm/b1.c
@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
        int i, j;
        for (j = 0; j < AVM_MAXVERSION; j++)
-                cinfo->version[j] = "\0\0" + 1;
+                cinfo->version[j] = "";
        for (i = 0, j = 0;
             j < AVM_MAXVERSION && i < cinfo->versionlen;
             j++, i += cinfo->versionbuf[i] + 1)
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index 6d05946b445e..124ff530da82 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -262,8 +262,7 @@ hfcsusb_ph_info(struct hfcsusb *hw)
        struct dchannel *dch = &hw->dch;
        int i;
-        phi = kzalloc(sizeof(struct ph_info) +
+        phi = kzalloc(struct_size(phi, bch, dch->dev.nrbchan), GFP_ATOMIC);
-                      dch->dev.nrbchan * sizeof(struct ph_info_ch), GFP_ATOMIC);
        phi->dch.ch.protocol = hw->protocol;
        phi->dch.ch.Flags = dch->Flags;
        phi->dch.state = dch->state;
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 1b2239c1d569..dc1cded716c1 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -1437,15 +1437,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
 {
        modem_info *info = (modem_info *) tty->driver_data;
+        mutex_lock(&modem_info_mutex);
        if (!old_termios)
                isdn_tty_change_speed(info);
        else {
                if (tty->termios.c_cflag == old_termios->c_cflag &&
                    tty->termios.c_ispeed == old_termios->c_ispeed &&
-                    tty->termios.c_ospeed == old_termios->c_ospeed)
+                    tty->termios.c_ospeed == old_termios->c_ospeed) {
+                        mutex_unlock(&modem_info_mutex);
                        return;
+                }
                isdn_tty_change_speed(info);
        }
+        mutex_unlock(&modem_info_mutex);
 }
 /*
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index a2e74feee2b2..fd64df5a57a5 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
        /* Let the programs run for couple of ms and check the engine status */
        usleep_range(3000, 6000);
-        lp55xx_read(chip, LP5523_REG_STATUS, &status);
+        ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+        if (ret)
+                return ret;
        status &= LP5523_ENG_STATUS_MASK;
        if (status != LP5523_ENG_STATUS_MASK) {
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 0ff22159a0ca..47d4e0d30bf0 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2414,9 +2414,21 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
         * capi:cipher_api_spec-iv:ivopts
         */
        tmp = &cipher_in[strlen("capi:")];
-        cipher_api = strsep(&tmp, "-");
-        *ivmode = strsep(&tmp, ":");
+        /* Separate IV options if present, it can contain another '-' in hash name */
-        *ivopts = tmp;
+        *ivopts = strrchr(tmp, ':');
+        if (*ivopts) {
+                **ivopts = '\0';
+                (*ivopts)++;
+        }
+        /* Parse IV mode */
+        *ivmode = strrchr(tmp, '-');
+        if (*ivmode) {
+                **ivmode = '\0';
+                (*ivmode)++;
+        }
+        /* The rest is crypto API spec */
+        cipher_api = tmp;
        if (*ivmode && !strcmp(*ivmode, "lmk"))
                cc->tfms_count = 64;
@@ -2486,11 +2498,8 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                goto bad_mem;
        chainmode = strsep(&tmp, "-");
-        *ivopts = strsep(&tmp, "-");
+        *ivmode = strsep(&tmp, ":");
-        *ivmode = strsep(&*ivopts, ":");
+        *ivopts = tmp;
-        if (tmp)
-                DMWARN("Ignoring unexpected additional cipher options");
        /*
         * For compatibility with the original dm-crypt mapping format, if
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 20b0776e39ef..ed3caceaed07 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1678,7 +1678,7 @@ int dm_thin_remove_range(struct dm_thin_device *td,
        return r;
 }
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
 {
        int r;
        uint32_t ref_count;
@@ -1686,7 +1686,7 @@ int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *resu
        down_read(&pmd->root_lock);
        r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
        if (!r)
-                *result = (ref_count != 0);
+                *result = (ref_count > 1);
        up_read(&pmd->root_lock);
        return r;
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 35e954ea20a9..f6be0d733c20 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -195,7 +195,7 @@ int dm_pool_get_metadata_dev_size(struct dm_pool_metadata *pmd,
 int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
+int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
 int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
 int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index dadd9696340c..ca8af21bf644 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1048,7 +1048,7 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
         * passdown we have to check that these blocks are now unused.
         */
        int r = 0;
-        bool used = true;
+        bool shared = true;
        struct thin_c *tc = m->tc;
        struct pool *pool = tc->pool;
        dm_block_t b = m->data_block, e, end = m->data_block + m->virt_end - m->virt_begin;
@@ -1058,11 +1058,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
        while (b != end) {
                /* find start of unmapped run */
                for (; b < end; b++) {
-                        r = dm_pool_block_is_used(pool->pmd, b, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, b, &shared);
                        if (r)
                                goto out;
-                        if (!used)
+                        if (!shared)
                                break;
                }
@@ -1071,11 +1071,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
                /* find end of run */
                for (e = b + 1; e != end; e++) {
-                        r = dm_pool_block_is_used(pool->pmd, e, &used);
+                        r = dm_pool_block_is_shared(pool->pmd, e, &shared);
                        if (r)
                                goto out;
-                        if (used)
+                        if (shared)
                                break;
                }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d67c95ef8d7e..2b53c3841b53 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1320,7 +1320,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
        __bio_clone_fast(clone, bio);
-        if (unlikely(bio_integrity(bio) != NULL)) {
+        if (bio_integrity(bio)) {
                int r;
                if (unlikely(!dm_target_has_integrity(tio->ti->type) &&
@@ -1336,11 +1336,7 @@ static int clone_bio(struct dm_target_io *tio, struct bio *bio,
                        return r;
        }
-        bio_advance(clone, to_bytes(sector - clone->bi_iter.bi_sector));
+        bio_trim(clone, sector - clone->bi_iter.bi_sector, len);
-        clone->bi_iter.bi_size = to_bytes(len);
-        if (unlikely(bio_integrity(bio) != NULL))
-                bio_integrity_trim(clone);
        return 0;
 }
@@ -1588,6 +1584,9 @@ static void init_clone_info(struct clone_info *ci, struct mapped_device *md,
        ci->sector = bio->bi_iter.bi_sector;
 }
+#define __dm_part_stat_sub(part, field, subnd)  \
+        (part_stat_get(part, field) -= (subnd))
 /*
 * Entry point to split a bio into clones and submit them to the targets.
 */
@@ -1642,7 +1641,21 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
                                struct bio *b = bio_split(bio, bio_sectors(bio) - ci.sector_count,
                                                          GFP_NOIO, &md->queue->bio_split);
                                ci.io->orig_bio = b;
+                                /*
+                                 * Adjust IO stats for each split, otherwise upon queue
+                                 * reentry there will be redundant IO accounting.
+                                 * NOTE: this is a stop-gap fix, a proper fix involves
+                                 * significant refactoring of DM core's bio splitting
+                                 * (by eliminating DM's splitting and just using bio_split)
+                                 */
+                                part_stat_lock();
+                                __dm_part_stat_sub(&dm_disk(md)->part0,
+                                                   sectors[op_stat_group(bio_op(bio))], ci.sector_count);
+                                part_stat_unlock();
                                bio_chain(b, bio);
+                                trace_block_split(md->queue, b, bio->bi_iter.bi_sector);
                                ret = generic_make_request(bio);
                                break;
                        }
@@ -1713,6 +1726,15 @@ out:
        return ret;
 }
+static blk_qc_t dm_process_bio(struct mapped_device *md,
+                               struct dm_table *map, struct bio *bio)
+{
+        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+                return __process_bio(md, map, bio);
+        else
+                return __split_and_process_bio(md, map, bio);
+}
 static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
 {
        struct mapped_device *md = q->queuedata;
@@ -1733,10 +1755,7 @@ static blk_qc_t dm_make_request(struct request_queue *q, struct bio *bio)
                return ret;
        }
-        if (dm_get_md_type(md) == DM_TYPE_NVME_BIO_BASED)
+        ret = dm_process_bio(md, map, bio);
-                ret = __process_bio(md, map, bio);
-        else
-                ret = __split_and_process_bio(md, map, bio);
        dm_put_live_table(md, srcu_idx);
        return ret;
@@ -2415,9 +2434,9 @@ static void dm_wq_work(struct work_struct *work)
                        break;
                if (dm_request_based(md))
-                        generic_make_request(c);
+                        (void) generic_make_request(c);
                else
-                        __split_and_process_bio(md, map, c);
+                        (void) dm_process_bio(md, map, c);
        }
        dm_put_live_table(md, srcu_idx);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fd4af4de03b4..05ffffb8b769 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -207,15 +207,10 @@ static bool create_on_open = true;
 struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
                            struct mddev *mddev)
 {
-        struct bio *b;
        if (!mddev || !bioset_initialized(&mddev->bio_set))
                return bio_alloc(gfp_mask, nr_iovecs);
-        b = bio_alloc_bioset(gfp_mask, nr_iovecs, &mddev->bio_set);
+        return bio_alloc_bioset(gfp_mask, nr_iovecs, &mddev->bio_set);
-        if (!b)
-                return NULL;
-        return b;
 }
 EXPORT_SYMBOL_GPL(bio_alloc_mddev);
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index d01821a6906a..89d9c4c21037 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -807,7 +807,9 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
        struct vb2_v4l2_buffer *vbuf;
        unsigned long flags;
-        cancel_delayed_work_sync(&dev->work_run);
+        if (v4l2_m2m_get_curr_priv(dev->m2m_dev) == ctx)
+                cancel_delayed_work_sync(&dev->work_run);
        for (;;) {
                if (V4L2_TYPE_IS_OUTPUT(q->type))
                        vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 1441a73ce64c..90aad465f9ed 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -287,6 +287,7 @@ static void v4l_print_format(const void *arg, bool write_only)
        const struct v4l2_window *win;
        const struct v4l2_sdr_format *sdr;
        const struct v4l2_meta_format *meta;
+        u32 planes;
        unsigned i;
        pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -317,7 +318,8 @@ static void v4l_print_format(const void *arg, bool write_only)
                        prt_names(mp->field, v4l2_field_names),
                        mp->colorspace, mp->num_planes, mp->flags,
                        mp->ycbcr_enc, mp->quantization, mp->xfer_func);
-                for (i = 0; i < mp->num_planes; i++)
+                planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
+                for (i = 0; i < planes; i++)
                        printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
                                        mp->plane_fmt[i].bytesperline,
                                        mp->plane_fmt[i].sizeimage);
@@ -1551,8 +1553,11 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_s_fmt_vid_cap_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_s_fmt_vid_cap_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
                if (unlikely(!ops->vidioc_s_fmt_vid_overlay))
@@ -1581,8 +1586,11 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_s_fmt_vid_out_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_s_fmt_vid_out_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                if (unlikely(!ops->vidioc_s_fmt_vid_out_overlay))
@@ -1648,8 +1656,11 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_try_fmt_vid_cap_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_try_fmt_vid_cap_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
                if (unlikely(!ops->vidioc_try_fmt_vid_overlay))
@@ -1678,8 +1689,11 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!ops->vidioc_try_fmt_vid_out_mplane))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix_mp.xfer_func);
+                if (p->fmt.pix_mp.num_planes > VIDEO_MAX_PLANES)
+                        break;
                for (i = 0; i < p->fmt.pix_mp.num_planes; i++)
-                        CLEAR_AFTER_FIELD(p, fmt.pix_mp.plane_fmt[i].bytesperline);
+                        CLEAR_AFTER_FIELD(&p->fmt.pix_mp.plane_fmt[i],
+                                          bytesperline);
                return ops->vidioc_try_fmt_vid_out_mplane(file, fh, arg);
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                if (unlikely(!ops->vidioc_try_fmt_vid_out_overlay))
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 8c5dfdce4326..f461460a2aeb 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -102,6 +102,7 @@ config MFD_AAT2870_CORE
 config MFD_AT91_USART
        tristate "AT91 USART Driver"
        select MFD_CORE
+        depends on ARCH_AT91 || COMPILE_TEST
        help
          Select this to get support for AT91 USART IP. This is a wrapper
          over at91-usart-serial driver and usart-spi-driver. Only one function
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 30d09d177171..11ab17f64c64 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
        mutex_unlock(&ab8500->lock);
        dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
-        return ret;
+        return (ret < 0) ? ret : 0;
 }
 static int ab8500_get_register(struct device *dev, u8 bank,
diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
index e1450a56fc07..3c97f2c0fdfe 100644
--- a/drivers/mfd/axp20x.c
+++ b/drivers/mfd/axp20x.c
@@ -641,9 +641,9 @@ static const struct mfd_cell axp221_cells[] = {
 static const struct mfd_cell axp223_cells[] = {
        {
-                .name                   = "axp221-pek",
+                .name           = "axp221-pek",
-                .num_resources          = ARRAY_SIZE(axp22x_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp22x_pek_resources),
-                .resources              = axp22x_pek_resources,
+                .resources      = axp22x_pek_resources,
        }, {
                .name           = "axp22x-adc",
                .of_compatible  = "x-powers,axp221-adc",
@@ -651,7 +651,7 @@ static const struct mfd_cell axp223_cells[] = {
                .name           = "axp20x-battery-power-supply",
                .of_compatible  = "x-powers,axp221-battery-power-supply",
        }, {
-                .name                   = "axp20x-regulator",
+                .name           = "axp20x-regulator",
        }, {
                .name           = "axp20x-ac-power-supply",
                .of_compatible  = "x-powers,axp221-ac-power-supply",
@@ -667,9 +667,9 @@ static const struct mfd_cell axp223_cells[] = {
 static const struct mfd_cell axp152_cells[] = {
        {
-                .name                   = "axp20x-pek",
+                .name           = "axp20x-pek",
-                .num_resources          = ARRAY_SIZE(axp152_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp152_pek_resources),
-                .resources              = axp152_pek_resources,
+                .resources      = axp152_pek_resources,
        },
 };
@@ -698,87 +698,101 @@ static const struct resource axp288_charger_resources[] = {
 static const struct mfd_cell axp288_cells[] = {
        {
-                .name = "axp288_adc",
+                .name           = "axp288_adc",
-                .num_resources = ARRAY_SIZE(axp288_adc_resources),
+                .num_resources  = ARRAY_SIZE(axp288_adc_resources),
-                .resources = axp288_adc_resources,
+                .resources      = axp288_adc_resources,
-        },
+        }, {
-        {
+                .name           = "axp288_extcon",
-                .name = "axp288_extcon",
+                .num_resources  = ARRAY_SIZE(axp288_extcon_resources),
-                .num_resources = ARRAY_SIZE(axp288_extcon_resources),
+                .resources      = axp288_extcon_resources,
-                .resources = axp288_extcon_resources,
+        }, {
-        },
+                .name           = "axp288_charger",
-        {
+                .num_resources  = ARRAY_SIZE(axp288_charger_resources),
-                .name = "axp288_charger",
+                .resources      = axp288_charger_resources,
-                .num_resources = ARRAY_SIZE(axp288_charger_resources),
+        }, {
-                .resources = axp288_charger_resources,
+                .name           = "axp288_fuel_gauge",
-        },
+                .num_resources  = ARRAY_SIZE(axp288_fuel_gauge_resources),
-        {
+                .resources      = axp288_fuel_gauge_resources,
-                .name = "axp288_fuel_gauge",
+        }, {
-                .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
+                .name           = "axp221-pek",
-                .resources = axp288_fuel_gauge_resources,
+                .num_resources  = ARRAY_SIZE(axp288_power_button_resources),
-        },
+                .resources      = axp288_power_button_resources,
-        {
+        }, {
-                .name = "axp221-pek",
+                .name           = "axp288_pmic_acpi",
-                .num_resources = ARRAY_SIZE(axp288_power_button_resources),
-                .resources = axp288_power_button_resources,
-        },
-        {
-                .name = "axp288_pmic_acpi",
        },
 };
 static const struct mfd_cell axp803_cells[] = {
        {
-                .name                   = "axp221-pek",
+                .name           = "axp221-pek",
-                .num_resources          = ARRAY_SIZE(axp803_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp803_pek_resources),
-                .resources              = axp803_pek_resources,
+                .resources      = axp803_pek_resources,
+        }, {
+                .name           = "axp20x-gpio",
+                .of_compatible  = "x-powers,axp813-gpio",
+        }, {
+                .name           = "axp813-adc",
+                .of_compatible  = "x-powers,axp813-adc",
+        }, {
+                .name           = "axp20x-battery-power-supply",
+                .of_compatible  = "x-powers,axp813-battery-power-supply",
+        }, {
+                .name           = "axp20x-ac-power-supply",
+                .of_compatible  = "x-powers,axp813-ac-power-supply",
+                .num_resources  = ARRAY_SIZE(axp20x_ac_power_supply_resources),
+                .resources      = axp20x_ac_power_supply_resources,
        },
-        {       .name                   = "axp20x-regulator" },
+        {       .name           = "axp20x-regulator" },
 };
 static const struct mfd_cell axp806_self_working_cells[] = {
        {
-                .name                   = "axp221-pek",
+                .name           = "axp221-pek",
-                .num_resources          = ARRAY_SIZE(axp806_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp806_pek_resources),
-                .resources              = axp806_pek_resources,
+                .resources      = axp806_pek_resources,
        },
-        {       .name                   = "axp20x-regulator" },
+        {       .name           = "axp20x-regulator" },
 };
 static const struct mfd_cell axp806_cells[] = {
        {
-                .id                     = 2,
+                .id             = 2,
-                .name                   = "axp20x-regulator",
+                .name           = "axp20x-regulator",
        },
 };
 static const struct mfd_cell axp809_cells[] = {
        {
-                .name                   = "axp221-pek",
+                .name           = "axp221-pek",
-                .num_resources          = ARRAY_SIZE(axp809_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp809_pek_resources),
-                .resources              = axp809_pek_resources,
+                .resources      = axp809_pek_resources,
        }, {
-                .id                     = 1,
+                .id             = 1,
-                .name                   = "axp20x-regulator",
+                .name           = "axp20x-regulator",
        },
 };
 static const struct mfd_cell axp813_cells[] = {
        {
-                .name                   = "axp221-pek",
+                .name           = "axp221-pek",
-                .num_resources          = ARRAY_SIZE(axp803_pek_resources),
+                .num_resources  = ARRAY_SIZE(axp803_pek_resources),
-                .resources              = axp803_pek_resources,
+                .resources      = axp803_pek_resources,
        }, {
-                .name                   = "axp20x-regulator",
+                .name           = "axp20x-regulator",
        }, {
-                .name                   = "axp20x-gpio",
+                .name           = "axp20x-gpio",
-                .of_compatible          = "x-powers,axp813-gpio",
+                .of_compatible  = "x-powers,axp813-gpio",
        }, {
-                .name                   = "axp813-adc",
+                .name           = "axp813-adc",
-                .of_compatible          = "x-powers,axp813-adc",
+                .of_compatible  = "x-powers,axp813-adc",
        }, {
                .name           = "axp20x-battery-power-supply",
                .of_compatible  = "x-powers,axp813-battery-power-supply",
+        }, {
+                .name           = "axp20x-ac-power-supply",
+                .of_compatible  = "x-powers,axp813-ac-power-supply",
+                .num_resources  = ARRAY_SIZE(axp20x_ac_power_supply_resources),
+                .resources      = axp20x_ac_power_supply_resources,
        },
 };
diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
index 503979c81dae..fab3cdc27ed6 100644
--- a/drivers/mfd/bd9571mwv.c
+++ b/drivers/mfd/bd9571mwv.c
@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
 };
 static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
+        regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
        regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
        regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
        regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
index b99a194ce5a4..2d0fee488c5a 100644
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev)
        cros_ec_debugfs_remove(ec);
+        mfd_remove_devices(ec->dev);
        cdev_del(&ec->cdev);
        device_unregister(&ec->class_dev);
        return 0;
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 5970b8def548..aec20e1c7d3d 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
        .irq_unmask     = prcmu_irq_unmask,
 };
-static __init char *fw_project_name(u32 project)
+static char *fw_project_name(u32 project)
 {
        switch (project) {
        case PRCMU_FW_PROJECT_U8500:
@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
        INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
 }
-static void __init init_prcm_registers(void)
+static void init_prcm_registers(void)
 {
        u32 val;
diff --git a/drivers/mfd/exynos-lpass.c b/drivers/mfd/exynos-lpass.c
index ca829f85672f..2713de989f05 100644
--- a/drivers/mfd/exynos-lpass.c
+++ b/drivers/mfd/exynos-lpass.c
@@ -82,11 +82,13 @@ static void exynos_lpass_enable(struct exynos_lpass *lpass)
                     LPASS_INTR_SFR | LPASS_INTR_DMA | LPASS_INTR_I2S);
        regmap_write(lpass->top, SFR_LPASS_INTR_CPU_MASK,
-                     LPASS_INTR_SFR | LPASS_INTR_DMA | LPASS_INTR_I2S);
+                     LPASS_INTR_SFR | LPASS_INTR_DMA | LPASS_INTR_I2S |
+                     LPASS_INTR_UART);
        exynos_lpass_core_sw_reset(lpass, LPASS_I2S_SW_RESET);
        exynos_lpass_core_sw_reset(lpass, LPASS_DMA_SW_RESET);
        exynos_lpass_core_sw_reset(lpass, LPASS_MEM_SW_RESET);
+        exynos_lpass_core_sw_reset(lpass, LPASS_UART_SW_RESET);
 }
 static void exynos_lpass_disable(struct exynos_lpass *lpass)
diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
index 440030cecbbd..2a77988d0462 100644
--- a/drivers/mfd/madera-core.c
+++ b/drivers/mfd/madera-core.c
@@ -15,6 +15,7 @@
 #include <linux/gpio.h>
 #include <linux/mfd/core.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/notifier.h>
 #include <linux/of.h>
 #include <linux/of_gpio.h>
@@ -155,7 +156,7 @@ static int madera_wait_for_boot(struct madera *madera)
                usleep_range(MADERA_BOOT_POLL_INTERVAL_USEC / 2,
                             MADERA_BOOT_POLL_INTERVAL_USEC);
                regmap_read(madera->regmap, MADERA_IRQ1_RAW_STATUS_1, &val);
-        };
+        }
        if (!(val & MADERA_BOOT_DONE_STS1)) {
                dev_err(madera->dev, "Polling BOOT_DONE_STS timed out\n");
@@ -357,6 +358,8 @@ int madera_dev_init(struct madera *madera)
        dev_set_drvdata(madera->dev, madera);
        BLOCKING_INIT_NOTIFIER_HEAD(&madera->notifier);
+        mutex_init(&madera->dapm_ptr_lock);
        madera_set_micbias_info(madera);
        /*
diff --git a/drivers/mfd/max77620.c b/drivers/mfd/max77620.c
index d8217366ed36..d8ddd1a6f304 100644
--- a/drivers/mfd/max77620.c
+++ b/drivers/mfd/max77620.c
@@ -280,7 +280,7 @@ static int max77620_config_fps(struct max77620_chip *chip,
        for (fps_id = 0; fps_id < MAX77620_FPS_COUNT; fps_id++) {
                sprintf(fps_name, "fps%d", fps_id);
-                if (!strcmp(fps_np->name, fps_name))
+                if (of_node_name_eq(fps_np, fps_name))
                        break;
        }
diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
index f475e848252f..d0bf50e3568d 100644
--- a/drivers/mfd/mc13xxx-core.c
+++ b/drivers/mfd/mc13xxx-core.c
@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
        mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
-        mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
+        ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
+        if (ret)
+                goto out;
        adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 |
               MC13XXX_ADC0_CHRGRAWDIV;
diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
index 77b64bd64df3..ab24e176ef44 100644
--- a/drivers/mfd/mt6397-core.c
+++ b/drivers/mfd/mt6397-core.c
@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev)
        default:
                dev_err(&pdev->dev, "unsupported chip: %d\n", id);
-                ret = -ENODEV;
+                return -ENODEV;
-                break;
        }
        if (ret) {
diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
index 52fafea06067..8d420c37b2a6 100644
--- a/drivers/mfd/qcom_rpm.c
+++ b/drivers/mfd/qcom_rpm.c
@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
                return -EFAULT;
        }
+        writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
+        writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
+        writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
        dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
                                                        fw_version[1],
                                                        fw_version[2]);
diff --git a/drivers/mfd/rave-sp.c b/drivers/mfd/rave-sp.c
index 2a8369657e38..26c7b63e008a 100644
--- a/drivers/mfd/rave-sp.c
+++ b/drivers/mfd/rave-sp.c
@@ -109,7 +109,7 @@ struct rave_sp_reply {
 /**
 * struct rave_sp_checksum - Variant specific checksum implementation details
 *
- * @length:     Caculated checksum length
+ * @length:     Calculated checksum length
 * @subroutine: Utilized checksum algorithm implementation
 */
 struct rave_sp_checksum {
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 566caca4efd8..7569a4be0608 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1302,17 +1302,17 @@ static void stmpe_of_probe(struct stmpe_platform_data *pdata,
        pdata->autosleep = (pdata->autosleep_timeout) ? true : false;
        for_each_child_of_node(np, child) {
-                if (!strcmp(child->name, "stmpe_gpio")) {
+                if (of_node_name_eq(child, "stmpe_gpio")) {
                        pdata->blocks |= STMPE_BLOCK_GPIO;
-                } else if (!strcmp(child->name, "stmpe_keypad")) {
+                } else if (of_node_name_eq(child, "stmpe_keypad")) {
                        pdata->blocks |= STMPE_BLOCK_KEYPAD;
-                } else if (!strcmp(child->name, "stmpe_touchscreen")) {
+                } else if (of_node_name_eq(child, "stmpe_touchscreen")) {
                        pdata->blocks |= STMPE_BLOCK_TOUCHSCREEN;
-                } else if (!strcmp(child->name, "stmpe_adc")) {
+                } else if (of_node_name_eq(child, "stmpe_adc")) {
                        pdata->blocks |= STMPE_BLOCK_ADC;
-                } else if (!strcmp(child->name, "stmpe_pwm")) {
+                } else if (of_node_name_eq(child, "stmpe_pwm")) {
                        pdata->blocks |= STMPE_BLOCK_PWM;
-                } else if (!strcmp(child->name, "stmpe_rotator")) {
+                } else if (of_node_name_eq(child, "stmpe_rotator")) {
                        pdata->blocks |= STMPE_BLOCK_ROTATOR;
                }
        }
diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
index c2d47d78705b..fd111296b959 100644
--- a/drivers/mfd/ti_am335x_tscadc.c
+++ b/drivers/mfd/ti_am335x_tscadc.c
@@ -264,8 +264,9 @@ static	int ti_tscadc_probe(struct platform_device *pdev)
                cell->pdata_size = sizeof(tscadc);
        }
-        err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+        err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
-                        tscadc->used_cells, NULL, 0, NULL);
+                              tscadc->cells, tscadc->used_cells, NULL,
+                              0, NULL);
        if (err < 0)
                goto err_disable_clk;
diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
index 910f569ff77c..8bcdecf494d0 100644
--- a/drivers/mfd/tps65218.c
+++ b/drivers/mfd/tps65218.c
@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client,
        mutex_init(&tps->tps_lock);
-        ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+        ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
-                        IRQF_ONESHOT, 0, &tps65218_irq_chip,
+                                       IRQF_ONESHOT, 0, &tps65218_irq_chip,
-                        &tps->irq_data);
+                                       &tps->irq_data);
        if (ret < 0)
                return ret;
@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client,
                              ARRAY_SIZE(tps65218_cells), NULL, 0,
                              regmap_irq_get_domain(tps->irq_data));
-        if (ret < 0)
-                goto err_irq;
-        return 0;
-err_irq:
-        regmap_del_irq_chip(tps->irq, tps->irq_data);
        return ret;
 }
-static int tps65218_remove(struct i2c_client *client)
-{
-        struct tps65218 *tps = i2c_get_clientdata(client);
-        regmap_del_irq_chip(tps->irq, tps->irq_data);
-        return 0;
-}
 static const struct i2c_device_id tps65218_id_table[] = {
        { "tps65218", TPS65218 },
        { },
@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = {
                .of_match_table = of_tps65218_match_table,
        },
        .probe          = tps65218_probe,
-        .remove         = tps65218_remove,
        .id_table       = tps65218_id_table,
 };
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index b89379782741..9c7925ca13cf 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -592,6 +592,29 @@ static int tps6586x_i2c_remove(struct i2c_client *client)
        return 0;
 }
+static int __maybe_unused tps6586x_i2c_suspend(struct device *dev)
+{
+        struct tps6586x *tps6586x = dev_get_drvdata(dev);
+        if (tps6586x->client->irq)
+                disable_irq(tps6586x->client->irq);
+        return 0;
+}
+static int __maybe_unused tps6586x_i2c_resume(struct device *dev)
+{
+        struct tps6586x *tps6586x = dev_get_drvdata(dev);
+        if (tps6586x->client->irq)
+                enable_irq(tps6586x->client->irq);
+        return 0;
+}
+static SIMPLE_DEV_PM_OPS(tps6586x_pm_ops, tps6586x_i2c_suspend,
+                         tps6586x_i2c_resume);
 static const struct i2c_device_id tps6586x_id_table[] = {
        { "tps6586x", 0 },
        { },
@@ -602,6 +625,7 @@ static struct i2c_driver tps6586x_driver = {
        .driver = {
                .name   = "tps6586x",
                .of_match_table = of_match_ptr(tps6586x_of_match),
+                .pm     = &tps6586x_pm_ops,
        },
        .probe          = tps6586x_i2c_probe,
        .remove         = tps6586x_i2c_remove,
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 4be3d239da9e..299016bc46d9 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
 * letting it generate the right frequencies for USB, MADC, and
 * other purposes.
 */
-static inline int __init protect_pm_master(void)
+static inline int protect_pm_master(void)
 {
        int e = 0;
@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
        return e;
 }
-static inline int __init unprotect_pm_master(void)
+static inline int unprotect_pm_master(void)
 {
        int e = 0;
diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
index 1ee68bd440fb..16c6e2accfaa 100644
--- a/drivers/mfd/wm5110-tables.c
+++ b/drivers/mfd/wm5110-tables.c
@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
        { 0x00000ECD, 0x0000 },    /* R3789  - HPLPF4_2 */
        { 0x00000EE0, 0x0000 },    /* R3808  - ASRC_ENABLE */
        { 0x00000EE2, 0x0000 },    /* R3810  - ASRC_RATE1 */
+        { 0x00000EE3, 0x4000 },    /* R3811  - ASRC_RATE2 */
        { 0x00000EF0, 0x0000 },    /* R3824  - ISRC 1 CTRL 1 */
        { 0x00000EF1, 0x0000 },    /* R3825  - ISRC 1 CTRL 2 */
        { 0x00000EF2, 0x0000 },    /* R3826  - ISRC 1 CTRL 3 */
@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
        case ARIZONA_ASRC_ENABLE:
        case ARIZONA_ASRC_STATUS:
        case ARIZONA_ASRC_RATE1:
+        case ARIZONA_ASRC_RATE2:
        case ARIZONA_ISRC_1_CTRL_1:
        case ARIZONA_ISRC_1_CTRL_2:
        case ARIZONA_ISRC_1_CTRL_3:
diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index b8aaa684c397..2ed23c99f59f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -820,21 +820,24 @@ static int ibmvmc_send_msg(struct crq_server_adapter *adapter,
 *
 * Return:
 *      0 - Success
+ *      Non-zero - Failure
 */
 static int ibmvmc_open(struct inode *inode, struct file *file)
 {
        struct ibmvmc_file_session *session;
-        int rc = 0;
        pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__,
                 (unsigned long)inode, (unsigned long)file,
                 ibmvmc.state);
        session = kzalloc(sizeof(*session), GFP_KERNEL);
+        if (!session)
+                return -ENOMEM;
        session->file = file;
        file->private_data = session;
-        return rc;
+        return 0;
 }
 /**
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 78c26cebf5d4..8f7616557c97 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1187,9 +1187,15 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
                if (dma_setup_res->status) {
-                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                        u8 status = dma_setup_res->status;
-                                 dma_setup_res->status,
-                                 mei_hbm_status_str(dma_setup_res->status));
+                        if (status == MEI_HBMS_NOT_ALLOWED) {
+                                dev_dbg(dev->dev, "hbm: dma setup not allowed\n");
+                        } else {
+                                dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                         status,
+                                         mei_hbm_status_str(status));
+                        }
                        dev->hbm_f_dr_supported = 0;
                        mei_dmam_ring_free(dev);
                }
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index e4b10b2d1a08..23739a60517f 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
+#define MEI_DEV_ID_DNV_IE     0x19E5  /* Denverton IE */
 #define MEI_DEV_ID_GLK        0x319A  /* Gemini Lake */
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 73ace2d59dea..e89497f858ae 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -88,11 +88,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
        {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
index 6b212c8b78e7..2bfa3a903bf9 100644
--- a/drivers/misc/mic/vop/vop_main.c
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -394,16 +394,21 @@ static int vop_find_vqs(struct virtio_device *dev, unsigned nvqs,
        struct _vop_vdev *vdev = to_vopvdev(dev);
        struct vop_device *vpdev = vdev->vpdev;
        struct mic_device_ctrl __iomem *dc = vdev->dc;
-        int i, err, retry;
+        int i, err, retry, queue_idx = 0;
        /* We must have this many virtqueues. */
        if (nvqs > ioread8(&vdev->desc->num_vq))
                return -ENOENT;
        for (i = 0; i < nvqs; ++i) {
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
                dev_dbg(_vop_dev(vdev), "%s: %d: %s\n",
                        __func__, i, names[i]);
-                vqs[i] = vop_find_vq(dev, i, callbacks[i], names[i],
+                vqs[i] = vop_find_vq(dev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        err = PTR_ERR(vqs[i]);
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
index 595ac065b401..95ff7c5a1dfb 100644
--- a/drivers/misc/pvpanic.c
+++ b/drivers/misc/pvpanic.c
@@ -70,8 +70,12 @@ pvpanic_walk_resources(struct acpi_resource *res, void *context)
        struct resource r;
        if (acpi_dev_resource_io(res, &r)) {
+#ifdef CONFIG_HAS_IOPORT_MAP
                base = ioport_map(r.start, resource_size(&r));
                return AE_OK;
+#else
+                return AE_ERROR;
+#endif
        } else if (acpi_dev_resource_memory(res, &r)) {
                base = ioremap(r.start, resource_size(&r));
                return AE_OK;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index f57f5de54206..cf58ccaf22d5 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -234,7 +234,7 @@ int mmc_of_parse(struct mmc_host *host)
                if (device_property_read_bool(dev, "broken-cd"))
                        host->caps |= MMC_CAP_NEEDS_POLL;
-                ret = mmc_gpiod_request_cd(host, "cd", 0, true,
+                ret = mmc_gpiod_request_cd(host, "cd", 0, false,
                                           cd_debounce_delay_ms * 1000,
                                           &cd_gpio_invert);
                if (!ret)
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index e26b8145efb3..a44ec8bb5418 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -116,7 +116,7 @@ config MMC_RICOH_MMC
 config MMC_SDHCI_ACPI
        tristate "SDHCI support for ACPI enumerated SDHCI controllers"
-        depends on MMC_SDHCI && ACPI
+        depends on MMC_SDHCI && ACPI && PCI
        select IOSF_MBI if X86
        help
          This selects support for ACPI enumerated SDHCI controllers,
@@ -978,7 +978,7 @@ config MMC_SDHCI_OMAP
        tristate "TI SDHCI Controller Support"
        depends on MMC_SDHCI_PLTFM && OF
        select THERMAL
-        select TI_SOC_THERMAL
+        imply TI_SOC_THERMAL
        help
          This selects the Secure Digital Host Controller Interface (SDHCI)
          support present in TI's DRA7 SOCs. The controller supports
diff --git a/drivers/mmc/host/dw_mmc-bluefield.c b/drivers/mmc/host/dw_mmc-bluefield.c
index ed8f2254b66a..aa38b1a8017e 100644
--- a/drivers/mmc/host/dw_mmc-bluefield.c
+++ b/drivers/mmc/host/dw_mmc-bluefield.c
@@ -1,11 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
 * Copyright (C) 2018 Mellanox Technologies.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
 */
 #include <linux/bitfield.h>
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c2690c1a50ff..f19ec60bcbdc 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -179,6 +179,8 @@ struct meson_host {
        struct sd_emmc_desc *descs;
        dma_addr_t descs_dma_addr;
+        int irq;
        bool vqmmc_enabled;
 };
@@ -738,6 +740,11 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
        struct meson_host *host = mmc_priv(mmc);
+        int adj = 0;
+        /* enable signal resampling w/o delay */
+        adj = ADJUST_ADJ_EN;
+        writel(adj, host->regs + host->data->adjust);
        return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -768,6 +775,9 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                if (!IS_ERR(mmc->supply.vmmc))
                        mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+                /* disable signal resampling */
+                writel(0, host->regs + host->data->adjust);
                /* Reset rx phase */
                clk_set_phase(host->rx_clk, 0);
@@ -1166,7 +1176,7 @@ static int meson_mmc_get_cd(struct mmc_host *mmc)
 static void meson_mmc_cfg_init(struct meson_host *host)
 {
-        u32 cfg = 0, adj = 0;
+        u32 cfg = 0;
        cfg |= FIELD_PREP(CFG_RESP_TIMEOUT_MASK,
                          ilog2(SD_EMMC_CFG_RESP_TIMEOUT));
@@ -1177,10 +1187,6 @@ static void meson_mmc_cfg_init(struct meson_host *host)
        cfg |= CFG_ERR_ABORT;
        writel(cfg, host->regs + SD_EMMC_CFG);
-        /* enable signal resampling w/o delay */
-        adj = ADJUST_ADJ_EN;
-        writel(adj, host->regs + host->data->adjust);
 }
 static int meson_mmc_card_busy(struct mmc_host *mmc)
@@ -1231,7 +1237,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
        struct resource *res;
        struct meson_host *host;
        struct mmc_host *mmc;
-        int ret, irq;
+        int ret;
        mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev);
        if (!mmc)
@@ -1276,8 +1282,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
                goto free_host;
        }
-        irq = platform_get_irq(pdev, 0);
+        host->irq = platform_get_irq(pdev, 0);
-        if (irq <= 0) {
+        if (host->irq <= 0) {
                dev_err(&pdev->dev, "failed to get interrupt resource.\n");
                ret = -EINVAL;
                goto free_host;
@@ -1331,9 +1337,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
        writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN,
               host->regs + SD_EMMC_IRQ_EN);
-        ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq,
+        ret = request_threaded_irq(host->irq, meson_mmc_irq,
-                                        meson_mmc_irq_thread, IRQF_SHARED,
+                        meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
-                                        NULL, host);
        if (ret)
                goto err_init_clk;
@@ -1351,7 +1356,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
        if (host->bounce_buf == NULL) {
                dev_err(host->dev, "Unable to map allocate DMA bounce buffer.\n");
                ret = -ENOMEM;
-                goto err_init_clk;
+                goto err_free_irq;
        }
        host->descs = dma_alloc_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
@@ -1370,6 +1375,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
 err_bounce_buf:
        dma_free_coherent(host->dev, host->bounce_buf_size,
                          host->bounce_buf, host->bounce_dma_addr);
+err_free_irq:
+        free_irq(host->irq, host);
 err_init_clk:
        clk_disable_unprepare(host->mmc_clk);
 err_core_clk:
@@ -1387,6 +1394,7 @@ static int meson_mmc_remove(struct platform_device *pdev)
        /* disable interrupts */
        writel(0, host->regs + SD_EMMC_IRQ_EN);
+        free_irq(host->irq, host);
        dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
                          host->descs, host->descs_dma_addr);
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 0db99057c44f..9d12c06c7fd6 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -296,7 +296,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
        iproc_host->data = iproc_data;
-        mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                goto err;
        sdhci_get_property(pdev);
        host->mmc->caps |= iproc_host->data->mmc_caps;
diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
index eebac35304c6..6e8edc9375dd 100644
--- a/drivers/mtd/nand/raw/denali.c
+++ b/drivers/mtd/nand/raw/denali.c
@@ -1322,7 +1322,7 @@ int denali_init(struct denali_nand_info *denali)
        }
        /* clk rate info is needed for setup_data_interface */
-        if (denali->clk_rate && denali->clk_x_rate)
+        if (!denali->clk_rate || !denali->clk_x_rate)
                chip->options |= NAND_KEEP_TIMINGS;
        chip->legacy.dummy_controller.ops = &denali_controller_ops;
diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
index 325b4414dccc..c9149a37f8f0 100644
--- a/drivers/mtd/nand/raw/fsmc_nand.c
+++ b/drivers/mtd/nand/raw/fsmc_nand.c
@@ -593,23 +593,6 @@ static void fsmc_write_buf_dma(struct fsmc_nand_data *host, const u8 *buf,
        dma_xfer(host, (void *)buf, len, DMA_TO_DEVICE);
 }
-/* fsmc_select_chip - assert or deassert nCE */
-static void fsmc_ce_ctrl(struct fsmc_nand_data *host, bool assert)
-{
-        u32 pc = readl(host->regs_va + FSMC_PC);
-        if (!assert)
-                writel_relaxed(pc & ~FSMC_ENABLE, host->regs_va + FSMC_PC);
-        else
-                writel_relaxed(pc | FSMC_ENABLE, host->regs_va + FSMC_PC);
-        /*
-         * nCE line changes must be applied before returning from this
-         * function.
-         */
-        mb();
-}
 /*
 * fsmc_exec_op - hook called by the core to execute NAND operations
 *
@@ -627,8 +610,6 @@ static int fsmc_exec_op(struct nand_chip *chip, const struct nand_operation *op,
        pr_debug("Executing operation [%d instructions]:\n", op->ninstrs);
-        fsmc_ce_ctrl(host, true);
        for (op_id = 0; op_id < op->ninstrs; op_id++) {
                instr = &op->instrs[op_id];
@@ -686,8 +667,6 @@ static int fsmc_exec_op(struct nand_chip *chip, const struct nand_operation *op,
                }
        }
-        fsmc_ce_ctrl(host, false);
        return ret;
 }
diff --git a/drivers/mtd/nand/raw/jz4740_nand.c b/drivers/mtd/nand/raw/jz4740_nand.c
index f92ae5aa2a54..9526d5b23c80 100644
--- a/drivers/mtd/nand/raw/jz4740_nand.c
+++ b/drivers/mtd/nand/raw/jz4740_nand.c
@@ -260,7 +260,7 @@ static int jz_nand_correct_ecc_rs(struct nand_chip *chip, uint8_t *dat,
 }
 static int jz_nand_ioremap_resource(struct platform_device *pdev,
-        const char *name, struct resource **res, void *__iomem *base)
+        const char *name, struct resource **res, void __iomem **base)
 {
        int ret;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 6371958dd170..edb1c023a753 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -519,7 +519,7 @@ config NET_FAILOVER
          and destroy a failover master netdev and manages a primary and
          standby slave netdevs that get registered via the generic failover
          infrastructure. This can be used by paravirtual drivers to enable
-          an alternate low latency datapath. It alsoenables live migration of
+          an alternate low latency datapath. It also enables live migration of
          a VM with direct attached VF by failing over to the paravirtual
          datapath when the VF is unplugged.
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a9d597f28023..485462d3087f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1963,6 +1963,9 @@ static int __bond_release_one(struct net_device *bond_dev,
        if (!bond_has_slaves(bond)) {
                bond_set_carrier(bond);
                eth_hw_addr_random(bond_dev);
+                bond->nest_level = SINGLE_DEPTH_NESTING;
+        } else {
+                bond->nest_level = dev_get_nest_level(bond_dev) + 1;
        }
        unblock_netpoll_tx();
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3b3f88ffab53..c05e4d50d43d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
 struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
 {
        struct can_priv *priv = netdev_priv(dev);
-        struct sk_buff *skb = priv->echo_skb[idx];
-        struct canfd_frame *cf;
        if (idx >= priv->echo_skb_max) {
                netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
                return NULL;
        }
-        if (!skb) {
+        if (priv->echo_skb[idx]) {
-                netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+                /* Using "struct canfd_frame::len" for the frame
-                           __func__, idx);
+                 * length is supported on both CAN and CANFD frames.
-                return NULL;
+                 */
-        }
+                struct sk_buff *skb = priv->echo_skb[idx];
+                struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+                u8 len = cf->len;
-        /* Using "struct canfd_frame::len" for the frame
+                *len_ptr = len;
-         * length is supported on both CAN and CANFD frames.
+                priv->echo_skb[idx] = NULL;
-         */
-        cf = (struct canfd_frame *)skb->data;
-        *len_ptr = cf->len;
-        priv->echo_skb[idx] = NULL;
-        return skb;
+                return skb;
+        }
+        return NULL;
 }
 /*
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 0f36eafe3ac1..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev)
                }
        } else {
                /* clear and invalidate unused mailboxes first */
-                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+                for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
                        mb = flexcan_get_mb(priv, i);
                        priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
                                    &mb->can_ctrl);
@@ -1432,7 +1432,7 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
        gpr_np = of_find_node_by_phandle(phandle);
        if (!gpr_np) {
                dev_dbg(&pdev->dev, "could not find gpr node by phandle\n");
-                return PTR_ERR(gpr_np);
+                return -ENODEV;
        }
        priv = netdev_priv(dev);
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 3b12e2dcff31..8a5111f9414c 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -7,7 +7,6 @@
 #include <linux/delay.h>
 #include <linux/export.h>
-#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -15,7 +14,6 @@
 #include <linux/phy.h>
 #include <linux/etherdevice.h>
 #include <linux/if_bridge.h>
-#include <linux/of_gpio.h>
 #include <linux/of_net.h>
 #include <net/dsa.h>
 #include <net/switchdev.h>
diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 74547f43b938..a8a2c728afba 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -18,7 +18,6 @@
 #include <linux/mfd/syscon.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
-#include <linux/of_gpio.h>
 #include <linux/of_mdio.h>
 #include <linux/of_net.h>
 #include <linux/of_platform.h>
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 8a517d8fb9d1..8dca2c949e73 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2403,6 +2403,107 @@ static int mv88e6xxx_stats_setup(struct mv88e6xxx_chip *chip)
        return mv88e6xxx_g1_stats_clear(chip);
 }
+/* The mv88e6390 has some hidden registers used for debug and
+ * development. The errata also makes use of them.
+ */
+static int mv88e6390_hidden_write(struct mv88e6xxx_chip *chip, int port,
+                                  int reg, u16 val)
+{
+        u16 ctrl;
+        int err;
+        err = mv88e6xxx_port_write(chip, PORT_RESERVED_1A_DATA_PORT,
+                                   PORT_RESERVED_1A, val);
+        if (err)
+                return err;
+        ctrl = PORT_RESERVED_1A_BUSY | PORT_RESERVED_1A_WRITE |
+               PORT_RESERVED_1A_BLOCK | port << PORT_RESERVED_1A_PORT_SHIFT |
+               reg;
+        return mv88e6xxx_port_write(chip, PORT_RESERVED_1A_CTRL_PORT,
+                                    PORT_RESERVED_1A, ctrl);
+}
+static int mv88e6390_hidden_wait(struct mv88e6xxx_chip *chip)
+{
+        return mv88e6xxx_wait(chip, PORT_RESERVED_1A_CTRL_PORT,
+                              PORT_RESERVED_1A, PORT_RESERVED_1A_BUSY);
+}
+static int mv88e6390_hidden_read(struct mv88e6xxx_chip *chip, int port,
+                                  int reg, u16 *val)
+{
+        u16 ctrl;
+        int err;
+        ctrl = PORT_RESERVED_1A_BUSY | PORT_RESERVED_1A_READ |
+               PORT_RESERVED_1A_BLOCK | port << PORT_RESERVED_1A_PORT_SHIFT |
+               reg;
+        err = mv88e6xxx_port_write(chip, PORT_RESERVED_1A_CTRL_PORT,
+                                   PORT_RESERVED_1A, ctrl);
+        if (err)
+                return err;
+        err = mv88e6390_hidden_wait(chip);
+        if (err)
+                return err;
+        return  mv88e6xxx_port_read(chip, PORT_RESERVED_1A_DATA_PORT,
+                                    PORT_RESERVED_1A, val);
+}
+/* Check if the errata has already been applied. */
+static bool mv88e6390_setup_errata_applied(struct mv88e6xxx_chip *chip)
+{
+        int port;
+        int err;
+        u16 val;
+        for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
+                err = mv88e6390_hidden_read(chip, port, 0, &val);
+                if (err) {
+                        dev_err(chip->dev,
+                                "Error reading hidden register: %d\n", err);
+                        return false;
+                }
+                if (val != 0x01c0)
+                        return false;
+        }
+        return true;
+}
+/* The 6390 copper ports have an errata which require poking magic
+ * values into undocumented hidden registers and then performing a
+ * software reset.
+ */
+static int mv88e6390_setup_errata(struct mv88e6xxx_chip *chip)
+{
+        int port;
+        int err;
+        if (mv88e6390_setup_errata_applied(chip))
+                return 0;
+        /* Set the ports into blocking mode */
+        for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
+                err = mv88e6xxx_port_set_state(chip, port, BR_STATE_DISABLED);
+                if (err)
+                        return err;
+        }
+        for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
+                err = mv88e6390_hidden_write(chip, port, 0, 0x01c0);
+                if (err)
+                        return err;
+        }
+        return mv88e6xxx_software_reset(chip);
+}
 static int mv88e6xxx_setup(struct dsa_switch *ds)
 {
        struct mv88e6xxx_chip *chip = ds->priv;
@@ -2415,6 +2516,12 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
        mutex_lock(&chip->reg_lock);
+        if (chip->info->ops->setup_errata) {
+                err = chip->info->ops->setup_errata(chip);
+                if (err)
+                        goto unlock;
+        }
        /* Cache the cmode of each port. */
        for (i = 0; i < mv88e6xxx_num_ports(chip); i++) {
                if (chip->info->ops->port_get_cmode) {
@@ -3226,6 +3333,7 @@ static const struct mv88e6xxx_ops mv88e6185_ops = {
 static const struct mv88e6xxx_ops mv88e6190_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
@@ -3269,6 +3377,7 @@ static const struct mv88e6xxx_ops mv88e6190_ops = {
 static const struct mv88e6xxx_ops mv88e6190x_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
@@ -3312,6 +3421,7 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = {
 static const struct mv88e6xxx_ops mv88e6191_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
@@ -3404,6 +3514,7 @@ static const struct mv88e6xxx_ops mv88e6240_ops = {
 static const struct mv88e6xxx_ops mv88e6290_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
@@ -3709,6 +3820,7 @@ static const struct mv88e6xxx_ops mv88e6352_ops = {
 static const struct mv88e6xxx_ops mv88e6390_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
@@ -3756,6 +3868,7 @@ static const struct mv88e6xxx_ops mv88e6390_ops = {
 static const struct mv88e6xxx_ops mv88e6390x_ops = {
        /* MV88E6XXX_FAMILY_6390 */
+        .setup_errata = mv88e6390_setup_errata,
        .irl_init_all = mv88e6390_g2_irl_init_all,
        .get_eeprom = mv88e6xxx_g2_get_eeprom8,
        .set_eeprom = mv88e6xxx_g2_set_eeprom8,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index f9ecb7872d32..546651d8c3e1 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -300,6 +300,11 @@ struct mv88e6xxx_mdio_bus {
 };
 struct mv88e6xxx_ops {
+        /* Switch Setup Errata, called early in the switch setup to
+         * allow any errata actions to be performed
+         */
+        int (*setup_errata)(struct mv88e6xxx_chip *chip);
        int (*ieee_pri_map)(struct mv88e6xxx_chip *chip);
        int (*ip_pri_map)(struct mv88e6xxx_chip *chip);
diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
index 0d81866d0e4a..e583641de758 100644
--- a/drivers/net/dsa/mv88e6xxx/port.h
+++ b/drivers/net/dsa/mv88e6xxx/port.h
@@ -251,6 +251,16 @@
 /* Offset 0x19: Port IEEE Priority Remapping Registers (4-7) */
 #define MV88E6095_PORT_IEEE_PRIO_REMAP_4567     0x19
+/* Offset 0x1a: Magic undocumented errata register */
+#define PORT_RESERVED_1A                        0x1a
+#define PORT_RESERVED_1A_BUSY                   BIT(15)
+#define PORT_RESERVED_1A_WRITE                  BIT(14)
+#define PORT_RESERVED_1A_READ                   0
+#define PORT_RESERVED_1A_PORT_SHIFT             5
+#define PORT_RESERVED_1A_BLOCK                  (0xf << 10)
+#define PORT_RESERVED_1A_CTRL_PORT              4
+#define PORT_RESERVED_1A_DATA_PORT              5
 int mv88e6xxx_port_read(struct mv88e6xxx_chip *chip, int port, int reg,
                        u16 *val);
 int mv88e6xxx_port_write(struct mv88e6xxx_chip *chip, int port, int reg,
diff --git a/drivers/net/dsa/realtek-smi.c b/drivers/net/dsa/realtek-smi.c
index b4b839a1d095..ad41ec63cc9f 100644
--- a/drivers/net/dsa/realtek-smi.c
+++ b/drivers/net/dsa/realtek-smi.c
@@ -347,16 +347,17 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
        struct device_node *mdio_np;
        int ret;
-        mdio_np = of_find_compatible_node(smi->dev->of_node, NULL,
+        mdio_np = of_get_compatible_child(smi->dev->of_node, "realtek,smi-mdio");
-                                          "realtek,smi-mdio");
        if (!mdio_np) {
                dev_err(smi->dev, "no MDIO bus node\n");
                return -ENODEV;
        }
        smi->slave_mii_bus = devm_mdiobus_alloc(smi->dev);
-        if (!smi->slave_mii_bus)
+        if (!smi->slave_mii_bus) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_put_node;
+        }
        smi->slave_mii_bus->priv = smi;
        smi->slave_mii_bus->name = "SMI slave MII";
        smi->slave_mii_bus->read = realtek_smi_mdio_read;
@@ -371,10 +372,15 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
        if (ret) {
                dev_err(smi->dev, "unable to register MDIO bus %s\n",
                        smi->slave_mii_bus->id);
-                of_node_put(mdio_np);
+                goto err_put_node;
        }
        return 0;
+err_put_node:
+        of_node_put(mdio_np);
+        return ret;
 }
 static int realtek_smi_probe(struct platform_device *pdev)
@@ -457,6 +463,8 @@ static int realtek_smi_remove(struct platform_device *pdev)
        struct realtek_smi *smi = dev_get_drvdata(&pdev->dev);
        dsa_unregister_switch(smi->ds);
+        if (smi->slave_mii_bus)
+                of_node_put(smi->slave_mii_bus->dev.of_node);
        gpiod_set_value(smi->reset, 1);
        return 0;
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index 02921d877c08..aa1d1f5339d2 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
                phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
                                     priv->phy_iface);
-                if (IS_ERR(phydev))
+                if (IS_ERR(phydev)) {
                        netdev_err(dev, "Could not attach to PHY\n");
+                        phydev = NULL;
+                }
        } else {
                int ret;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index d272dc6984ac..b40d4377cc71 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -431,8 +431,6 @@
 #define MAC_MDIOSCAR_PA_WIDTH           5
 #define MAC_MDIOSCAR_RA_INDEX           0
 #define MAC_MDIOSCAR_RA_WIDTH           16
-#define MAC_MDIOSCAR_REG_INDEX          0
-#define MAC_MDIOSCAR_REG_WIDTH          21
 #define MAC_MDIOSCCDR_BUSY_INDEX        22
 #define MAC_MDIOSCCDR_BUSY_WIDTH        1
 #define MAC_MDIOSCCDR_CMD_INDEX         16
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 1e929a1e4ca7..4666084eda16 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1284,6 +1284,20 @@ static void xgbe_write_mmd_regs(struct xgbe_prv_data *pdata, int prtad,
        }
 }
+static unsigned int xgbe_create_mdio_sca(int port, int reg)
+{
+        unsigned int mdio_sca, da;
+        da = (reg & MII_ADDR_C45) ? reg >> 16 : 0;
+        mdio_sca = 0;
+        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, RA, reg);
+        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, PA, port);
+        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, da);
+        return mdio_sca;
+}
 static int xgbe_write_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
                                   int reg, u16 val)
 {
@@ -1291,9 +1305,7 @@ static int xgbe_write_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
        reinit_completion(&pdata->mdio_complete);
-        mdio_sca = 0;
+        mdio_sca = xgbe_create_mdio_sca(addr, reg);
-        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, REG, reg);
-        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, addr);
        XGMAC_IOWRITE(pdata, MAC_MDIOSCAR, mdio_sca);
        mdio_sccd = 0;
@@ -1317,9 +1329,7 @@ static int xgbe_read_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
        reinit_completion(&pdata->mdio_complete);
-        mdio_sca = 0;
+        mdio_sca = xgbe_create_mdio_sca(addr, reg);
-        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, REG, reg);
-        XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, addr);
        XGMAC_IOWRITE(pdata, MAC_MDIOSCAR, mdio_sca);
        mdio_sccd = 0;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 4ab6eb3baefc..6a512871176b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5601,7 +5601,8 @@ static int bnxt_hwrm_check_pf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
                         FUNC_CFG_REQ_FLAGS_STAT_CTX_ASSETS_TEST |
                         FUNC_CFG_REQ_FLAGS_VNIC_ASSETS_TEST;
                if (bp->flags & BNXT_FLAG_CHIP_P5)
-                        flags |= FUNC_CFG_REQ_FLAGS_RSSCOS_CTX_ASSETS_TEST;
+                        flags |= FUNC_CFG_REQ_FLAGS_RSSCOS_CTX_ASSETS_TEST |
+                                 FUNC_CFG_REQ_FLAGS_NQ_ASSETS_TEST;
                else
                        flags |= FUNC_CFG_REQ_FLAGS_RING_GRP_ASSETS_TEST;
        }
@@ -6221,9 +6222,12 @@ static int bnxt_alloc_ctx_pg_tbls(struct bnxt *bp,
                        rmem->pg_tbl_map = ctx_pg->ctx_dma_arr[i];
                        rmem->depth = 1;
                        rmem->nr_pages = MAX_CTX_PAGES;
-                        if (i == (nr_tbls - 1))
+                        if (i == (nr_tbls - 1)) {
-                                rmem->nr_pages = ctx_pg->nr_pages %
+                                int rem = ctx_pg->nr_pages % MAX_CTX_PAGES;
-                                                 MAX_CTX_PAGES;
+                                if (rem)
+                                        rmem->nr_pages = rem;
+                        }
                        rc = bnxt_alloc_ctx_mem_blk(bp, pg_tbl);
                        if (rc)
                                break;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
index f1aaac8e6268..0a0995894ddb 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h
@@ -386,8 +386,8 @@ struct hwrm_err_output {
 #define HWRM_VERSION_MAJOR 1
 #define HWRM_VERSION_MINOR 10
 #define HWRM_VERSION_UPDATE 0
-#define HWRM_VERSION_RSVD 33
+#define HWRM_VERSION_RSVD 35
-#define HWRM_VERSION_STR "1.10.0.33"
+#define HWRM_VERSION_STR "1.10.0.35"
 /* hwrm_ver_get_input (size:192b/24B) */
 struct hwrm_ver_get_input {
@@ -1184,6 +1184,7 @@ struct hwrm_func_cfg_input {
        #define FUNC_CFG_REQ_FLAGS_L2_CTX_ASSETS_TEST             0x100000UL
        #define FUNC_CFG_REQ_FLAGS_TRUSTED_VF_ENABLE              0x200000UL
        #define FUNC_CFG_REQ_FLAGS_DYNAMIC_TX_RING_ALLOC          0x400000UL
+        #define FUNC_CFG_REQ_FLAGS_NQ_ASSETS_TEST                 0x800000UL
        __le32  enables;
        #define FUNC_CFG_REQ_ENABLES_MTU                     0x1UL
        #define FUNC_CFG_REQ_ENABLES_MRU                     0x2UL
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index b126926ef7f5..66cc7927061a 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1738,12 +1738,8 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
                *skb = nskb;
        }
-        if (padlen) {
+        if (padlen > ETH_FCS_LEN)
-                if (padlen >= ETH_FCS_LEN)
+                skb_put_zero(*skb, padlen - ETH_FCS_LEN);
-                        skb_put_zero(*skb, padlen - ETH_FCS_LEN);
-                else
-                        skb_trim(*skb, ETH_FCS_LEN - padlen);
-        }
 add_fcs:
        /* set FCS to packet */
diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
index 85f22c286680..89db739b7819 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
@@ -2381,7 +2381,7 @@ no_mem:
                                        lro_add_page(adap, qs, fl,
                                                     G_RSPD_LEN(len),
                                                     flags & F_RSPD_EOP);
-                                         goto next_fl;
+                                        goto next_fl;
                                }
                                skb = get_packet_pg(adap, fl, q,
@@ -3214,11 +3214,13 @@ void t3_start_sge_timers(struct adapter *adap)
        for (i = 0; i < SGE_QSETS; ++i) {
                struct sge_qset *q = &adap->sge.qs[i];
-        if (q->tx_reclaim_timer.function)
+                if (q->tx_reclaim_timer.function)
-                mod_timer(&q->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
+                        mod_timer(&q->tx_reclaim_timer,
+                                  jiffies + TX_RECLAIM_PERIOD);
-        if (q->rx_reclaim_timer.function)
+                if (q->rx_reclaim_timer.function)
-                mod_timer(&q->rx_reclaim_timer, jiffies + RX_RECLAIM_PERIOD);
+                        mod_timer(&q->rx_reclaim_timer,
+                                  jiffies + RX_RECLAIM_PERIOD);
        }
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
index 080918af773c..0a9f2c596624 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
@@ -1082,7 +1082,7 @@ int t3_check_fw_version(struct adapter *adapter)
                CH_WARN(adapter, "found newer FW version(%u.%u), "
                        "driver compiled for version %u.%u\n", major, minor,
                        FW_VERSION_MAJOR, FW_VERSION_MINOR);
-                        return 0;
+                return 0;
        }
        return -EINVAL;
 }
@@ -3619,7 +3619,7 @@ int t3_reset_adapter(struct adapter *adapter)
 static int init_parity(struct adapter *adap)
 {
-                int i, err, addr;
+        int i, err, addr;
        if (t3_read_reg(adap, A_SG_CONTEXT_CMD) & F_CONTEXT_CMD_BUSY)
                return -EBUSY;
@@ -3806,6 +3806,6 @@ int t3_replay_prep_adapter(struct adapter *adapter)
                p->phy.ops->power_down(&p->phy, 1);
        }
-return 0;
+        return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
index 9f9d6cae39d5..58a039c3224a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
@@ -378,10 +378,10 @@ static void cxgb4_init_ptp_timer(struct adapter *adapter)
        int err;
        memset(&c, 0, sizeof(c));
-                c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
+        c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
-                                             FW_CMD_REQUEST_F |
+                                     FW_CMD_REQUEST_F |
-                                             FW_CMD_WRITE_F |
+                                     FW_CMD_WRITE_F |
-                                             FW_PTP_CMD_PORTID_V(0));
+                                     FW_PTP_CMD_PORTID_V(0));
        c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
        c.u.scmd.sc = FW_PTP_SC_INIT_TIMER;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index 9a6065a3fa46..c041f44324db 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -78,7 +78,7 @@ static void free_msix_idx_in_bmap(struct adapter *adap, unsigned int msix_idx)
        unsigned long flags;
        spin_lock_irqsave(&bmap->lock, flags);
-         __clear_bit(msix_idx, bmap->msix_bmap);
+        __clear_bit(msix_idx, bmap->msix_bmap);
        spin_unlock_irqrestore(&bmap->lock, flags);
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index e8c34292a0ec..2b03f6187a24 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3794,7 +3794,7 @@ int t4_load_phy_fw(struct adapter *adap,
        /* If we have version number support, then check to see if the adapter
         * already has up-to-date PHY firmware loaded.
         */
-         if (phy_fw_version) {
+        if (phy_fw_version) {
                new_phy_fw_vers = phy_fw_version(phy_fw_data, phy_fw_size);
                ret = t4_phy_fw_ver(adap, &cur_phy_fw_ver);
                if (ret < 0)
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index f53090cde041..dfebc30c4841 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2051,6 +2051,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
        bool nonlinear = skb_is_nonlinear(skb);
        struct rtnl_link_stats64 *percpu_stats;
        struct dpaa_percpu_priv *percpu_priv;
+        struct netdev_queue *txq;
        struct dpaa_priv *priv;
        struct qm_fd fd;
        int offset = 0;
@@ -2100,6 +2101,11 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
        if (unlikely(err < 0))
                goto skb_to_fd_failed;
+        txq = netdev_get_tx_queue(net_dev, queue_mapping);
+        /* LLTX requires to do our own update of trans_start */
+        txq->trans_start = jiffies;
        if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
                fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD);
                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
diff --git a/drivers/net/ethernet/freescale/dpaa2/Kconfig b/drivers/net/ethernet/freescale/dpaa2/Kconfig
index 809a155eb193..f6d244c663fd 100644
--- a/drivers/net/ethernet/freescale/dpaa2/Kconfig
+++ b/drivers/net/ethernet/freescale/dpaa2/Kconfig
@@ -9,8 +9,9 @@ config FSL_DPAA2_ETH
 config FSL_DPAA2_PTP_CLOCK
        tristate "Freescale DPAA2 PTP Clock"
-        depends on FSL_DPAA2_ETH && POSIX_TIMERS
+        depends on FSL_DPAA2_ETH
-        select PTP_1588_CLOCK
+        imply PTP_1588_CLOCK
+        default y
        help
          This driver adds support for using the DPAA2 1588 timer module
          as a PTP clock.
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ae0f88bce9aa..2370dc204202 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3467,7 +3467,7 @@ fec_probe(struct platform_device *pdev)
        if (ret)
                goto failed_clk_ipg;
-        fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
+        fep->reg_phy = devm_regulator_get_optional(&pdev->dev, "phy");
        if (!IS_ERR(fep->reg_phy)) {
                ret = regulator_enable(fep->reg_phy);
                if (ret) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index ad1779fc410e..a78bfafd212c 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
        struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
        int i;
-        vf_cb->mac_cb    = NULL;
-        kfree(vf_cb);
        for (i = 0; i < handle->q_num; i++)
                hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
+        kfree(vf_cb);
 }
 static int hns_ae_wait_flow_down(struct hnae_handle *handle)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 5748d3f722f6..5b33238c6680 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -1170,6 +1170,13 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
        if (!h->phy_dev)
                return 0;
+        ethtool_convert_legacy_u32_to_link_mode(supported, h->if_support);
+        linkmode_and(phy_dev->supported, phy_dev->supported, supported);
+        linkmode_copy(phy_dev->advertising, phy_dev->supported);
+        if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
+                phy_dev->autoneg = false;
        if (h->phy_if != PHY_INTERFACE_MODE_XGMII) {
                phy_dev->dev_flags = 0;
@@ -1181,16 +1188,6 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
        if (unlikely(ret))
                return -ENODEV;
-        ethtool_convert_legacy_u32_to_link_mode(supported, h->if_support);
-        linkmode_and(phy_dev->supported, phy_dev->supported, supported);
-        linkmode_copy(phy_dev->advertising, phy_dev->supported);
-        if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
-                phy_dev->autoneg = false;
-        if (h->phy_if == PHY_INTERFACE_MODE_SGMII)
-                phy_stop(phy_dev);
        return 0;
 }
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 098d8764c0ea..dd71d5db7274 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1313,7 +1313,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
        unsigned long lpar_rc;
        u16 mss = 0;
-restart_poll:
        while (frames_processed < budget) {
                if (!ibmveth_rxq_pending_buffer(adapter))
                        break;
@@ -1401,7 +1400,6 @@ restart_poll:
                    napi_reschedule(napi)) {
                        lpar_rc = h_vio_signal(adapter->vdev->unit_address,
                                               VIO_IRQ_DISABLE);
-                        goto restart_poll;
                }
        }
diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index 31fb76ee9d82..a1246e89aad4 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -159,7 +159,7 @@ config IXGBE
        tristate "Intel(R) 10GbE PCI Express adapters support"
        depends on PCI
        select MDIO
-        select MDIO_DEVICE
+        select PHYLIB
        imply PTP_1588_CLOCK
        ---help---
          This driver supports Intel(R) 10GbE PCI Express family of
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index fe1592ae8769..ca54e268d157 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -515,7 +515,7 @@ struct igb_adapter {
        /* OS defined structs */
        struct pci_dev *pdev;
-        struct mutex stats64_lock;
+        spinlock_t stats64_lock;
        struct rtnl_link_stats64 stats64;
        /* structs defined in e1000_hw.h */
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 7426060b678f..c57671068245 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2295,7 +2295,7 @@ static void igb_get_ethtool_stats(struct net_device *netdev,
        int i, j;
        char *p;
-        mutex_lock(&adapter->stats64_lock);
+        spin_lock(&adapter->stats64_lock);
        igb_update_stats(adapter);
        for (i = 0; i < IGB_GLOBAL_STATS_LEN; i++) {
@@ -2338,7 +2338,7 @@ static void igb_get_ethtool_stats(struct net_device *netdev,
                } while (u64_stats_fetch_retry_irq(&ring->rx_syncp, start));
                i += IGB_RX_QUEUE_STATS_LEN;
        }
-        mutex_unlock(&adapter->stats64_lock);
+        spin_unlock(&adapter->stats64_lock);
 }
 static void igb_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 87bdf1604ae2..7137e7f9c7f3 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2203,9 +2203,9 @@ void igb_down(struct igb_adapter *adapter)
        del_timer_sync(&adapter->phy_info_timer);
        /* record the stats before reset*/
-        mutex_lock(&adapter->stats64_lock);
+        spin_lock(&adapter->stats64_lock);
        igb_update_stats(adapter);
-        mutex_unlock(&adapter->stats64_lock);
+        spin_unlock(&adapter->stats64_lock);
        adapter->link_speed = 0;
        adapter->link_duplex = 0;
@@ -3840,7 +3840,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
        adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
        spin_lock_init(&adapter->nfc_lock);
-        mutex_init(&adapter->stats64_lock);
+        spin_lock_init(&adapter->stats64_lock);
 #ifdef CONFIG_PCI_IOV
        switch (hw->mac.type) {
        case e1000_82576:
@@ -5406,9 +5406,9 @@ no_wait:
                }
        }
-        mutex_lock(&adapter->stats64_lock);
+        spin_lock(&adapter->stats64_lock);
        igb_update_stats(adapter);
-        mutex_unlock(&adapter->stats64_lock);
+        spin_unlock(&adapter->stats64_lock);
        for (i = 0; i < adapter->num_tx_queues; i++) {
                struct igb_ring *tx_ring = adapter->tx_ring[i];
@@ -6235,10 +6235,10 @@ static void igb_get_stats64(struct net_device *netdev,
 {
        struct igb_adapter *adapter = netdev_priv(netdev);
-        mutex_lock(&adapter->stats64_lock);
+        spin_lock(&adapter->stats64_lock);
        igb_update_stats(adapter);
        memcpy(stats, &adapter->stats64, sizeof(*stats));
-        mutex_unlock(&adapter->stats64_lock);
+        spin_unlock(&adapter->stats64_lock);
 }
 /**
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index 742f0c1f60df..6d55e3d0b7ea 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -825,7 +825,7 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (!cgx->cgx_cmd_workq) {
                dev_err(dev, "alloc workqueue failed for cgx cmd");
                err = -ENOMEM;
-                goto err_release_regions;
+                goto err_free_irq_vectors;
        }
        list_add(&cgx->cgx_list, &cgx_list);
@@ -841,6 +841,8 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 err_release_lmac:
        cgx_lmac_exit(cgx);
        list_del(&cgx->cgx_list);
+err_free_irq_vectors:
+        pci_free_irq_vectors(pdev);
 err_release_regions:
        pci_release_regions(pdev);
 err_disable_device:
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index fe9653fa8aea..49f926b7a91c 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -258,11 +258,6 @@ static void mtk_phy_link_adjust(struct net_device *dev)
        mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
-        if (dev->phydev->link)
-                netif_carrier_on(dev);
-        else
-                netif_carrier_off(dev);
        if (!of_phy_is_fixed_link(mac->of_node))
                phy_print_status(dev->phydev);
 }
@@ -347,17 +342,6 @@ static int mtk_phy_connect(struct net_device *dev)
        if (mtk_phy_connect_node(eth, mac, np))
                goto err_phy;
-        dev->phydev->autoneg = AUTONEG_ENABLE;
-        dev->phydev->speed = 0;
-        dev->phydev->duplex = 0;
-        phy_set_max_speed(dev->phydev, SPEED_1000);
-        phy_support_asym_pause(dev->phydev);
-        linkmode_copy(dev->phydev->advertising, dev->phydev->supported);
-        linkmode_set_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
-                         dev->phydev->advertising);
-        phy_start_aneg(dev->phydev);
        of_node_put(np);
        return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index db909b6069b5..65f8a4b6ed0c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -306,14 +306,16 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size)
        if (entries_per_copy < entries) {
                for (i = 0; i < entries / entries_per_copy; i++) {
-                        err = copy_to_user(buf, init_ents, PAGE_SIZE);
+                        err = copy_to_user((void __user *)buf, init_ents, PAGE_SIZE) ?
+                                -EFAULT : 0;
                        if (err)
                                goto out;
                        buf += PAGE_SIZE;
                }
        } else {
-                err = copy_to_user(buf, init_ents, entries * cqe_size);
+                err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ?
+                        -EFAULT : 0;
        }
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 7df728f1e5b5..6e501af0e532 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2067,9 +2067,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
 {
        struct mlx4_cmd_mailbox *mailbox;
        __be32 *outbox;
+        u64 qword_field;
        u32 dword_field;
-        int err;
+        u16 word_field;
        u8 byte_field;
+        int err;
        static const u8 a0_dmfs_query_hw_steering[] =  {
                [0] = MLX4_STEERING_DMFS_A0_DEFAULT,
                [1] = MLX4_STEERING_DMFS_A0_DYNAMIC,
@@ -2097,19 +2099,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* QPC/EEC/CQC/EQC/RDMARC attributes */
-        MLX4_GET(param->qpc_base,      outbox, INIT_HCA_QPC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET);
-        MLX4_GET(param->log_num_qps,   outbox, INIT_HCA_LOG_QP_OFFSET);
+        param->qpc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->srqc_base,     outbox, INIT_HCA_SRQC_BASE_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET);
-        MLX4_GET(param->log_num_srqs,  outbox, INIT_HCA_LOG_SRQ_OFFSET);
+        param->log_num_qps = byte_field & 0x1f;
-        MLX4_GET(param->cqc_base,      outbox, INIT_HCA_CQC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_cqs,   outbox, INIT_HCA_LOG_CQ_OFFSET);
+        param->srqc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->altc_base,     outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET);
-        MLX4_GET(param->auxc_base,     outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->log_num_srqs = byte_field & 0x1f;
-        MLX4_GET(param->eqc_base,      outbox, INIT_HCA_EQC_BASE_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET);
-        MLX4_GET(param->log_num_eqs,   outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->cqc_base = qword_field & ~((u64)0x1f);
-        MLX4_GET(param->num_sys_eqs,   outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET);
-        MLX4_GET(param->rdmarc_base,   outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->log_num_cqs = byte_field & 0x1f;
-        MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET);
+        MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET);
+        param->altc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET);
+        param->auxc_base = qword_field;
+        MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET);
+        param->eqc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET);
+        param->log_num_eqs = byte_field & 0x1f;
+        MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+        param->num_sys_eqs = word_field & 0xfff;
+        MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+        param->rdmarc_base = qword_field & ~((u64)0x1f);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET);
+        param->log_rd_per_qp = byte_field & 0x7;
        MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET);
        if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) {
@@ -2128,22 +2143,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* steering attributes */
        if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
                MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
-                         INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_table_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
-                         INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
-                MLX4_GET(byte_field, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET);
-                         INIT_HCA_FS_A0_OFFSET);
                param->dmfs_high_steer_mode =
                        a0_dmfs_query_hw_steering[(byte_field >> 6) & 3];
        } else {
                MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET);
-                MLX4_GET(param->log_mc_entry_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
+                param->log_mc_entry_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_hash_sz,  outbox,
+                MLX4_GET(byte_field,  outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
+                param->log_mc_hash_sz = byte_field & 0x1f;
-                MLX4_GET(param->log_mc_table_sz, outbox,
+                MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
-                         INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
+                param->log_mc_table_sz = byte_field & 0x1f;
        }
        /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */
@@ -2167,15 +2181,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
        /* TPT attributes */
        MLX4_GET(param->dmpt_base,  outbox, INIT_HCA_DMPT_BASE_OFFSET);
-        MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET);
-        MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->mw_enabled = byte_field >> 7;
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
+        param->log_mpt_sz = byte_field & 0x3f;
        MLX4_GET(param->mtt_base,   outbox, INIT_HCA_MTT_BASE_OFFSET);
        MLX4_GET(param->cmpt_base,  outbox, INIT_HCA_CMPT_BASE_OFFSET);
        /* UAR attributes */
        MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET);
-        MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
+        param->log_uar_sz = byte_field & 0xf;
        /* phv_check enable */
        MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index 4b4351141b94..d89a3da89e5a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu
        int i;
        if (chunk->nsg > 0)
-                pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages,
+                dma_unmap_sg(&dev->persist->pdev->dev, chunk->sg, chunk->npages,
-                             PCI_DMA_BIDIRECTIONAL);
+                             DMA_BIDIRECTIONAL);
        for (i = 0; i < chunk->npages; ++i)
-                __free_pages(sg_page(&chunk->mem[i]),
+                __free_pages(sg_page(&chunk->sg[i]),
-                             get_order(chunk->mem[i].length));
+                             get_order(chunk->sg[i].length));
 }
 static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk)
@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *
        for (i = 0; i < chunk->npages; ++i)
                dma_free_coherent(&dev->persist->pdev->dev,
-                                  chunk->mem[i].length,
+                                  chunk->buf[i].size,
-                                  lowmem_page_address(sg_page(&chunk->mem[i])),
+                                  chunk->buf[i].addr,
-                                  sg_dma_address(&chunk->mem[i]));
+                                  chunk->buf[i].dma_addr);
 }
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent)
@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order,
        return 0;
 }
-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf,
-                                    int order, gfp_t gfp_mask)
+                                   int order, gfp_t gfp_mask)
 {
-        void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order,
+        buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order,
-                                       &sg_dma_address(mem), gfp_mask);
+                                       &buf->dma_addr, gfp_mask);
-        if (!buf)
+        if (!buf->addr)
                return -ENOMEM;
-        if (offset_in_page(buf)) {
+        if (offset_in_page(buf->addr)) {
-                dma_free_coherent(dev, PAGE_SIZE << order,
+                dma_free_coherent(dev, PAGE_SIZE << order, buf->addr,
-                                  buf, sg_dma_address(mem));
+                                  buf->dma_addr);
                return -ENOMEM;
        }
-        sg_set_buf(mem, buf, PAGE_SIZE << order);
+        buf->size = PAGE_SIZE << order;
-        sg_dma_len(mem) = PAGE_SIZE << order;
        return 0;
 }
@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
        while (npages > 0) {
                if (!chunk) {
-                        chunk = kmalloc_node(sizeof(*chunk),
+                        chunk = kzalloc_node(sizeof(*chunk),
                                             gfp_mask & ~(__GFP_HIGHMEM |
                                                          __GFP_NOWARN),
                                             dev->numa_node);
                        if (!chunk) {
-                                chunk = kmalloc(sizeof(*chunk),
+                                chunk = kzalloc(sizeof(*chunk),
                                                gfp_mask & ~(__GFP_HIGHMEM |
                                                             __GFP_NOWARN));
                                if (!chunk)
                                        goto fail;
                        }
+                        chunk->coherent = coherent;
-                        sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN);
+                        if (!coherent)
-                        chunk->npages = 0;
+                                sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN);
-                        chunk->nsg    = 0;
                        list_add_tail(&chunk->list, &icm->chunk_list);
                }
@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                if (coherent)
                        ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev,
-                                                      &chunk->mem[chunk->npages],
+                                                &chunk->buf[chunk->npages],
-                                                      cur_order, mask);
+                                                cur_order, mask);
                else
-                        ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages],
+                        ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages],
                                                   cur_order, mask,
                                                   dev->numa_node);
@@ -205,9 +204,9 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                if (coherent)
                        ++chunk->nsg;
                else if (chunk->npages == MLX4_ICM_CHUNK_LEN) {
-                        chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
+                        chunk->nsg = dma_map_sg(&dev->persist->pdev->dev,
-                                                chunk->npages,
+                                                chunk->sg, chunk->npages,
-                                                PCI_DMA_BIDIRECTIONAL);
+                                                DMA_BIDIRECTIONAL);
                        if (chunk->nsg <= 0)
                                goto fail;
@@ -220,9 +219,8 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
        }
        if (!coherent && chunk) {
-                chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
+                chunk->nsg = dma_map_sg(&dev->persist->pdev->dev, chunk->sg,
-                                        chunk->npages,
+                                        chunk->npages, DMA_BIDIRECTIONAL);
-                                        PCI_DMA_BIDIRECTIONAL);
                if (chunk->nsg <= 0)
                        goto fail;
@@ -320,7 +318,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
        u64 idx;
        struct mlx4_icm_chunk *chunk;
        struct mlx4_icm *icm;
-        struct page *page = NULL;
+        void *addr = NULL;
        if (!table->lowmem)
                return NULL;
@@ -336,28 +334,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
        list_for_each_entry(chunk, &icm->chunk_list, list) {
                for (i = 0; i < chunk->npages; ++i) {
+                        dma_addr_t dma_addr;
+                        size_t len;
+                        if (table->coherent) {
+                                len = chunk->buf[i].size;
+                                dma_addr = chunk->buf[i].dma_addr;
+                                addr = chunk->buf[i].addr;
+                        } else {
+                                struct page *page;
+                                len = sg_dma_len(&chunk->sg[i]);
+                                dma_addr = sg_dma_address(&chunk->sg[i]);
+                                /* XXX: we should never do this for highmem
+                                 * allocation.  This function either needs
+                                 * to be split, or the kernel virtual address
+                                 * return needs to be made optional.
+                                 */
+                                page = sg_page(&chunk->sg[i]);
+                                addr = lowmem_page_address(page);
+                        }
                        if (dma_handle && dma_offset >= 0) {
-                                if (sg_dma_len(&chunk->mem[i]) > dma_offset)
+                                if (len > dma_offset)
-                                        *dma_handle = sg_dma_address(&chunk->mem[i]) +
+                                        *dma_handle = dma_addr + dma_offset;
-                                                dma_offset;
+                                dma_offset -= len;
-                                dma_offset -= sg_dma_len(&chunk->mem[i]);
                        }
                        /*
                         * DMA mapping can merge pages but not split them,
                         * so if we found the page, dma_handle has already
                         * been assigned to.
                         */
-                        if (chunk->mem[i].length > offset) {
+                        if (len > offset)
-                                page = sg_page(&chunk->mem[i]);
                                goto out;
-                        }
+                        offset -= len;
-                        offset -= chunk->mem[i].length;
                }
        }
+        addr = NULL;
 out:
        mutex_unlock(&table->mutex);
-        return page ? lowmem_page_address(page) + offset : NULL;
+        return addr ? addr + offset : NULL;
 }
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index c9169a490557..d199874b1c07 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -47,11 +47,21 @@ enum {
        MLX4_ICM_PAGE_SIZE      = 1 << MLX4_ICM_PAGE_SHIFT,
 };
+struct mlx4_icm_buf {
+        void                    *addr;
+        size_t                  size;
+        dma_addr_t              dma_addr;
+};
 struct mlx4_icm_chunk {
        struct list_head        list;
        int                     npages;
        int                     nsg;
-        struct scatterlist      mem[MLX4_ICM_CHUNK_LEN];
+        bool                    coherent;
+        union {
+                struct scatterlist      sg[MLX4_ICM_CHUNK_LEN];
+                struct mlx4_icm_buf     buf[MLX4_ICM_CHUNK_LEN];
+        };
 };
 struct mlx4_icm {
@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter)
 static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter)
 {
-        return sg_dma_address(&iter->chunk->mem[iter->page_idx]);
+        if (iter->chunk->coherent)
+                return iter->chunk->buf[iter->page_idx].dma_addr;
+        else
+                return sg_dma_address(&iter->chunk->sg[iter->page_idx]);
 }
 static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter)
 {
-        return sg_dma_len(&iter->chunk->mem[iter->page_idx]);
+        if (iter->chunk->coherent)
+                return iter->chunk->buf[iter->page_idx].size;
+        else
+                return sg_dma_len(&iter->chunk->sg[iter->page_idx]);
 }
 int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index c9df08133718..3bbccead2f63 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -844,9 +844,12 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv,
        ethtool_link_ksettings_add_link_mode(link_ksettings, supported,
                                             Autoneg);
-        if (get_fec_supported_advertised(mdev, link_ksettings))
+        err = get_fec_supported_advertised(mdev, link_ksettings);
+        if (err) {
                netdev_dbg(priv->netdev, "%s: FEC caps query failed: %d\n",
                           __func__, err);
+                err = 0; /* don't fail caps query because of FEC error */
+        }
        if (!an_disable_admin)
                ethtool_link_ksettings_add_link_mode(link_ksettings,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 96cc0c6a4014..04736212a21c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -58,7 +58,8 @@ struct mlx5e_rep_indr_block_priv {
        struct list_head list;
 };
-static void mlx5e_rep_indr_unregister_block(struct net_device *netdev);
+static void mlx5e_rep_indr_unregister_block(struct mlx5e_rep_priv *rpriv,
+                                            struct net_device *netdev);
 static void mlx5e_rep_get_drvinfo(struct net_device *dev,
                                  struct ethtool_drvinfo *drvinfo)
@@ -179,6 +180,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
                        s->tx_packets           += sq_stats->packets;
                        s->tx_bytes             += sq_stats->bytes;
+                        s->tx_queue_dropped     += sq_stats->dropped;
                }
        }
 }
@@ -663,7 +665,7 @@ static void mlx5e_rep_indr_clean_block_privs(struct mlx5e_rep_priv *rpriv)
        struct list_head *head = &rpriv->uplink_priv.tc_indr_block_priv_list;
        list_for_each_entry_safe(cb_priv, temp, head, list) {
-                mlx5e_rep_indr_unregister_block(cb_priv->netdev);
+                mlx5e_rep_indr_unregister_block(rpriv, cb_priv->netdev);
                kfree(cb_priv);
        }
 }
@@ -735,7 +737,7 @@ mlx5e_rep_indr_setup_tc_block(struct net_device *netdev,
                err = tcf_block_cb_register(f->block,
                                            mlx5e_rep_indr_setup_block_cb,
-                                            netdev, indr_priv, f->extack);
+                                            indr_priv, indr_priv, f->extack);
                if (err) {
                        list_del(&indr_priv->list);
                        kfree(indr_priv);
@@ -743,14 +745,15 @@ mlx5e_rep_indr_setup_tc_block(struct net_device *netdev,
                return err;
        case TC_BLOCK_UNBIND:
+                indr_priv = mlx5e_rep_indr_block_priv_lookup(rpriv, netdev);
+                if (!indr_priv)
+                        return -ENOENT;
                tcf_block_cb_unregister(f->block,
                                        mlx5e_rep_indr_setup_block_cb,
-                                        netdev);
+                                        indr_priv);
-                indr_priv = mlx5e_rep_indr_block_priv_lookup(rpriv, netdev);
+                list_del(&indr_priv->list);
-                if (indr_priv) {
+                kfree(indr_priv);
-                        list_del(&indr_priv->list);
-                        kfree(indr_priv);
-                }
                return 0;
        default:
@@ -779,7 +782,7 @@ static int mlx5e_rep_indr_register_block(struct mlx5e_rep_priv *rpriv,
        err = __tc_indr_block_cb_register(netdev, rpriv,
                                          mlx5e_rep_indr_setup_tc_cb,
-                                          netdev);
+                                          rpriv);
        if (err) {
                struct mlx5e_priv *priv = netdev_priv(rpriv->netdev);
@@ -789,10 +792,11 @@ static int mlx5e_rep_indr_register_block(struct mlx5e_rep_priv *rpriv,
        return err;
 }
-static void mlx5e_rep_indr_unregister_block(struct net_device *netdev)
+static void mlx5e_rep_indr_unregister_block(struct mlx5e_rep_priv *rpriv,
+                                            struct net_device *netdev)
 {
        __tc_indr_block_cb_unregister(netdev, mlx5e_rep_indr_setup_tc_cb,
-                                      netdev);
+                                      rpriv);
 }
 static int mlx5e_nic_rep_netdevice_event(struct notifier_block *nb,
@@ -811,7 +815,7 @@ static int mlx5e_nic_rep_netdevice_event(struct notifier_block *nb,
                mlx5e_rep_indr_register_block(rpriv, netdev);
                break;
        case NETDEV_UNREGISTER:
-                mlx5e_rep_indr_unregister_block(netdev);
+                mlx5e_rep_indr_unregister_block(rpriv, netdev);
                break;
        }
        return NOTIFY_OK;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 1d0bb5ff8c26..f86e4804e83e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -732,6 +732,8 @@ static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
                                            ((struct ipv6hdr *)ip_p)->nexthdr;
 }
+#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
 static inline void mlx5e_handle_csum(struct net_device *netdev,
                                     struct mlx5_cqe64 *cqe,
                                     struct mlx5e_rq *rq,
@@ -754,6 +756,17 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
        if (unlikely(test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)))
                goto csum_unnecessary;
+        /* CQE csum doesn't cover padding octets in short ethernet
+         * frames. And the pad field is appended prior to calculating
+         * and appending the FCS field.
+         *
+         * Detecting these padded frames requires to verify and parse
+         * IP headers, so we simply force all those small frames to be
+         * CHECKSUM_UNNECESSARY even if they are not padded.
+         */
+        if (short_frame(skb->len))
+                goto csum_unnecessary;
        if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
                if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
                        goto csum_unnecessary;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/Kconfig b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
index 080ddd1942ec..b9a25aed5d11 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
@@ -78,6 +78,7 @@ config MLXSW_SPECTRUM
        depends on IPV6 || IPV6=n
        depends on NET_IPGRE || NET_IPGRE=n
        depends on IPV6_GRE || IPV6_GRE=n
+        depends on VXLAN || VXLAN=n
        select GENERIC_ALLOCATOR
        select PARMAN
        select OBJAGG
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index 66b8098c6fd2..a2321fe8d6a0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -604,29 +604,31 @@ static void mlxsw_pci_cq_tasklet(unsigned long data)
                u16 wqe_counter = mlxsw_pci_cqe_wqe_counter_get(cqe);
                u8 sendq = mlxsw_pci_cqe_sr_get(q->u.cq.v, cqe);
                u8 dqn = mlxsw_pci_cqe_dqn_get(q->u.cq.v, cqe);
+                char ncqe[MLXSW_PCI_CQE_SIZE_MAX];
+                memcpy(ncqe, cqe, q->elem_size);
+                mlxsw_pci_queue_doorbell_consumer_ring(mlxsw_pci, q);
                if (sendq) {
                        struct mlxsw_pci_queue *sdq;
                        sdq = mlxsw_pci_sdq_get(mlxsw_pci, dqn);
                        mlxsw_pci_cqe_sdq_handle(mlxsw_pci, sdq,
-                                                 wqe_counter, cqe);
+                                                 wqe_counter, ncqe);
                        q->u.cq.comp_sdq_count++;
                } else {
                        struct mlxsw_pci_queue *rdq;
                        rdq = mlxsw_pci_rdq_get(mlxsw_pci, dqn);
                        mlxsw_pci_cqe_rdq_handle(mlxsw_pci, rdq,
-                                                 wqe_counter, q->u.cq.v, cqe);
+                                                 wqe_counter, q->u.cq.v, ncqe);
                        q->u.cq.comp_rdq_count++;
                }
                if (++items == credits)
                        break;
        }
-        if (items) {
+        if (items)
-                mlxsw_pci_queue_doorbell_consumer_ring(mlxsw_pci, q);
                mlxsw_pci_queue_doorbell_arm_consumer_ring(mlxsw_pci, q);
-        }
 }
 static u16 mlxsw_pci_cq_elem_count(const struct mlxsw_pci_queue *q)
@@ -1365,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
                u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
                if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC)
-                        break;
+                        return 0;
                cond_resched();
        } while (time_before(jiffies, end));
-        return 0;
+        return -EBUSY;
 }
 static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
index bb99f6d41fe0..ffee38e36ce8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
@@ -27,7 +27,7 @@
 #define MLXSW_PCI_SW_RESET                      0xF0010
 #define MLXSW_PCI_SW_RESET_RST_BIT              BIT(0)
-#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS        5000
+#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS        13000
 #define MLXSW_PCI_SW_RESET_WAIT_MSECS           100
 #define MLXSW_PCI_FW_READY                      0xA1844
 #define MLXSW_PCI_FW_READY_MASK                 0xFFFF
@@ -53,6 +53,7 @@
 #define MLXSW_PCI_WQE_SIZE      32 /* 32 bytes per element */
 #define MLXSW_PCI_CQE01_SIZE    16 /* 16 bytes per element */
 #define MLXSW_PCI_CQE2_SIZE     32 /* 32 bytes per element */
+#define MLXSW_PCI_CQE_SIZE_MAX  MLXSW_PCI_CQE2_SIZE
 #define MLXSW_PCI_EQE_SIZE      16 /* 16 bytes per element */
 #define MLXSW_PCI_WQE_COUNT     (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_WQE_SIZE)
 #define MLXSW_PCI_CQE01_COUNT   (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_CQE01_SIZE)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index eed1045e4d96..32519c93df17 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -5005,12 +5005,15 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                                                           lower_dev,
                                                           upper_dev);
                } else if (netif_is_lag_master(upper_dev)) {
-                        if (info->linking)
+                        if (info->linking) {
                                err = mlxsw_sp_port_lag_join(mlxsw_sp_port,
                                                             upper_dev);
-                        else
+                        } else {
+                                mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port,
+                                                            false);
                                mlxsw_sp_port_lag_leave(mlxsw_sp_port,
                                                        upper_dev);
+                        }
                } else if (netif_is_ovs_master(upper_dev)) {
                        if (info->linking)
                                err = mlxsw_sp_port_ovs_join(mlxsw_sp_port);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
index b0f2d8e8ded0..ac222833a5cf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
@@ -72,7 +72,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,
        act_set = mlxsw_afa_block_first_set(rulei->act_block);
        mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set);
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
+        if (err)
+                goto err_ptce2_write;
+        return 0;
+err_ptce2_write:
+        cregion->ops->entry_remove(cregion, centry);
+        return err;
 }
 static void
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
index 1c19feefa5f2..2941967e1cc5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
@@ -1022,7 +1022,6 @@ void mlxsw_sp_acl_erp_mask_put(struct mlxsw_sp_acl_atcam_region *aregion,
 {
        struct objagg_obj *objagg_obj = (struct objagg_obj *) erp_mask;
-        ASSERT_RTNL();
        objagg_obj_put(aregion->erp_table->objagg, objagg_obj);
 }
@@ -1054,7 +1053,6 @@ void mlxsw_sp_acl_erp_bf_remove(struct mlxsw_sp *mlxsw_sp,
        const struct mlxsw_sp_acl_erp *erp = objagg_obj_root_priv(objagg_obj);
        unsigned int erp_bank;
-        ASSERT_RTNL();
        if (!mlxsw_sp_acl_erp_table_is_used(erp->erp_table))
                return;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
index 055cc6943b34..9d9aa28684af 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
@@ -997,8 +997,8 @@ static const struct mlxsw_sp_fid_ops mlxsw_sp_fid_dummy_ops = {
 static const struct mlxsw_sp_fid_family mlxsw_sp_fid_dummy_family = {
        .type                   = MLXSW_SP_FID_TYPE_DUMMY,
        .fid_size               = sizeof(struct mlxsw_sp_fid),
-        .start_index            = MLXSW_SP_RFID_BASE - 1,
+        .start_index            = VLAN_N_VID - 1,
-        .end_index              = MLXSW_SP_RFID_BASE - 1,
+        .end_index              = VLAN_N_VID - 1,
        .ops                    = &mlxsw_sp_fid_dummy_ops,
 };
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
index 0a31fff2516e..fb1c48c698f2 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c
@@ -816,14 +816,14 @@ int mlxsw_sp_nve_fid_enable(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_fid *fid,
        ops = nve->nve_ops_arr[params->type];
        if (!ops->can_offload(nve, params->dev, extack))
-                return -EOPNOTSUPP;
+                return -EINVAL;
        memset(&config, 0, sizeof(config));
        ops->nve_config(nve, params->dev, &config);
        if (nve->num_nve_tunnels &&
            memcmp(&config, &nve->config, sizeof(config))) {
                NL_SET_ERR_MSG_MOD(extack, "Conflicting NVE tunnels configuration");
-                return -EOPNOTSUPP;
+                return -EINVAL;
        }
        err = mlxsw_sp_nve_tunnel_init(mlxsw_sp, &config);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 1bd2c6e15f8d..c772109b638d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1078,8 +1078,7 @@ static int
 mlxsw_sp_bridge_port_vlan_add(struct mlxsw_sp_port *mlxsw_sp_port,
                              struct mlxsw_sp_bridge_port *bridge_port,
                              u16 vid, bool is_untagged, bool is_pvid,
-                              struct netlink_ext_ack *extack,
+                              struct netlink_ext_ack *extack)
-                              struct switchdev_trans *trans)
 {
        u16 pvid = mlxsw_sp_port_pvid_determine(mlxsw_sp_port, vid, is_pvid);
        struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
@@ -1095,9 +1094,6 @@ mlxsw_sp_bridge_port_vlan_add(struct mlxsw_sp_port *mlxsw_sp_port,
            mlxsw_sp_port_vlan->bridge_port != bridge_port)
                return -EEXIST;
-        if (switchdev_trans_ph_prepare(trans))
-                return 0;
        if (!mlxsw_sp_port_vlan) {
                mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_create(mlxsw_sp_port,
                                                               vid);
@@ -1188,6 +1184,9 @@ static int mlxsw_sp_port_vlans_add(struct mlxsw_sp_port *mlxsw_sp_port,
                return err;
        }
+        if (switchdev_trans_ph_commit(trans))
+                return 0;
        bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
        if (WARN_ON(!bridge_port))
                return -EINVAL;
@@ -1200,7 +1199,7 @@ static int mlxsw_sp_port_vlans_add(struct mlxsw_sp_port *mlxsw_sp_port,
                err = mlxsw_sp_bridge_port_vlan_add(mlxsw_sp_port, bridge_port,
                                                    vid, flag_untagged,
-                                                    flag_pvid, extack, trans);
+                                                    flag_pvid, extack);
                if (err)
                        return err;
        }
@@ -1234,7 +1233,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
 static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
 {
        return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
-                         MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
+                         MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
 }
 static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
@@ -1291,7 +1290,7 @@ out:
 static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                     const char *mac, u16 fid, bool adding,
                                     enum mlxsw_reg_sfd_rec_action action,
-                                     bool dynamic)
+                                     enum mlxsw_reg_sfd_rec_policy policy)
 {
        char *sfd_pl;
        u8 num_rec;
@@ -1302,8 +1301,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                return -ENOMEM;
        mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
-        mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+        mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
-                              mac, fid, action, local_port);
        num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
        if (err)
@@ -1322,7 +1320,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                   bool dynamic)
 {
        return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
-                                         MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
+                                         MLXSW_REG_SFD_REC_ACTION_NOP,
+                                         mlxsw_sp_sfd_rec_policy(dynamic));
 }
 int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
@@ -1330,7 +1329,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
 {
        return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
                                         MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
-                                         false);
+                                         MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
 }
 static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
@@ -1808,7 +1807,7 @@ static void
 mlxsw_sp_bridge_port_vlan_del(struct mlxsw_sp_port *mlxsw_sp_port,
                              struct mlxsw_sp_bridge_port *bridge_port, u16 vid)
 {
-        u16 pvid = mlxsw_sp_port->pvid == vid ? 0 : vid;
+        u16 pvid = mlxsw_sp_port->pvid == vid ? 0 : mlxsw_sp_port->pvid;
        struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
        mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
@@ -3207,7 +3206,6 @@ mlxsw_sp_switchdev_vxlan_vlan_add(struct mlxsw_sp *mlxsw_sp,
                                  struct mlxsw_sp_bridge_device *bridge_device,
                                  const struct net_device *vxlan_dev, u16 vid,
                                  bool flag_untagged, bool flag_pvid,
-                                  struct switchdev_trans *trans,
                                  struct netlink_ext_ack *extack)
 {
        struct vxlan_dev *vxlan = netdev_priv(vxlan_dev);
@@ -3225,9 +3223,6 @@ mlxsw_sp_switchdev_vxlan_vlan_add(struct mlxsw_sp *mlxsw_sp,
            mlxsw_sp_bridge_8021q_vxlan_dev_find(bridge_device->dev, vid))
                return -EINVAL;
-        if (switchdev_trans_ph_prepare(trans))
-                return 0;
        if (!netif_running(vxlan_dev))
                return 0;
@@ -3345,6 +3340,9 @@ mlxsw_sp_switchdev_vxlan_vlans_add(struct net_device *vxlan_dev,
        port_obj_info->handled = true;
+        if (switchdev_trans_ph_commit(trans))
+                return 0;
        bridge_device = mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
        if (!bridge_device)
                return -EINVAL;
@@ -3358,8 +3356,7 @@ mlxsw_sp_switchdev_vxlan_vlans_add(struct net_device *vxlan_dev,
                err = mlxsw_sp_switchdev_vxlan_vlan_add(mlxsw_sp, bridge_device,
                                                        vxlan_dev, vid,
                                                        flag_untagged,
-                                                        flag_pvid, trans,
+                                                        flag_pvid, extack);
-                                                        extack);
                if (err)
                        return err;
        }
diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 20c9377e99cb..310807ef328b 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -962,13 +962,10 @@ static void lan743x_phy_link_status_change(struct net_device *netdev)
                memset(&ksettings, 0, sizeof(ksettings));
                phy_ethtool_get_link_ksettings(netdev, &ksettings);
-                local_advertisement = phy_read(phydev, MII_ADVERTISE);
+                local_advertisement =
-                if (local_advertisement < 0)
+                        linkmode_adv_to_mii_adv_t(phydev->advertising);
-                        return;
+                remote_advertisement =
+                        linkmode_adv_to_mii_adv_t(phydev->lp_advertising);
-                remote_advertisement = phy_read(phydev, MII_LPA);
-                if (remote_advertisement < 0)
-                        return;
                lan743x_phy_update_flowcontrol(adapter,
                                               ksettings.base.duplex,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 90afd514ffe1..d9237c65a838 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -1619,6 +1619,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
        cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
        rx_prod.bd_prod = cpu_to_le16(bd_prod);
        rx_prod.cqe_prod = cpu_to_le16(cq_prod);
+        /* Make sure chain element is updated before ringing the doorbell */
+        dma_wmb();
        DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
 }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 298930d39b79..abb94c543aa2 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -205,6 +205,8 @@ enum cfg_version {
 };
 static const struct pci_device_id rtl8169_pci_tbl[] = {
+        { PCI_VDEVICE(REALTEK,  0x2502), RTL_CFG_1 },
+        { PCI_VDEVICE(REALTEK,  0x2600), RTL_CFG_1 },
        { PCI_VDEVICE(REALTEK,  0x8129), RTL_CFG_0 },
        { PCI_VDEVICE(REALTEK,  0x8136), RTL_CFG_2 },
        { PCI_VDEVICE(REALTEK,  0x8161), RTL_CFG_1 },
@@ -706,6 +708,7 @@ module_param(use_dac, int, 0);
 MODULE_PARM_DESC(use_dac, "Enable PCI DAC. Unsafe on 32 bit PCI slot.");
 module_param_named(debug, debug.msg_enable, int, 0);
 MODULE_PARM_DESC(debug, "Debug verbosity level (0=none, ..., 16=all)");
+MODULE_SOFTDEP("pre: realtek");
 MODULE_LICENSE("GPL");
 MODULE_FIRMWARE(FIRMWARE_8168D_1);
 MODULE_FIRMWARE(FIRMWARE_8168D_2);
@@ -1679,11 +1682,13 @@ static bool rtl8169_reset_counters(struct rtl8169_private *tp)
 static bool rtl8169_update_counters(struct rtl8169_private *tp)
 {
+        u8 val = RTL_R8(tp, ChipCmd);
        /*
         * Some chips are unable to dump tally counters when the receiver
-         * is disabled.
+         * is disabled. If 0xff chip may be in a PCI power-save state.
         */
-        if ((RTL_R8(tp, ChipCmd) & CmdRxEnb) == 0)
+        if (!(val & CmdRxEnb) || val == 0xff)
                return true;
        return rtl8169_do_counters(tp, CounterDump);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index ffc1ada4e6da..d28c8f9ca55b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -343,7 +343,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
        int i;
        priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
-                ETH_HLEN + VLAN_HLEN;
+                ETH_HLEN + VLAN_HLEN + sizeof(__sum16);
        /* Allocate RX and TX skb rings */
        priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -524,13 +524,15 @@ static void ravb_rx_csum(struct sk_buff *skb)
 {
        u8 *hw_csum;
-        /* The hardware checksum is 2 bytes appended to packet data */
+        /* The hardware checksum is contained in sizeof(__sum16) (2) bytes
-        if (unlikely(skb->len < 2))
+         * appended to packet data
+         */
+        if (unlikely(skb->len < sizeof(__sum16)))
                return;
-        hw_csum = skb_tail_pointer(skb) - 2;
+        hw_csum = skb_tail_pointer(skb) - sizeof(__sum16);
        skb->csum = csum_unfold((__force __sum16)get_unaligned_le16(hw_csum));
        skb->ip_summed = CHECKSUM_COMPLETE;
-        skb_trim(skb, skb->len - 2);
+        skb_trim(skb, skb->len - sizeof(__sum16));
 }
 /* Packet receive function for Ethernet AVB */
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index b6a50058bb8d..2f2bda68d861 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -6046,22 +6046,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
        { NVRAM_PARTITION_TYPE_EXPANSION_UEFI,     0,    0, "sfc_uefi" },
        { NVRAM_PARTITION_TYPE_STATUS,             0,    0, "sfc_status" }
 };
+#define EF10_NVRAM_PARTITION_COUNT      ARRAY_SIZE(efx_ef10_nvram_types)
 static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
                                        struct efx_mcdi_mtd_partition *part,
-                                        unsigned int type)
+                                        unsigned int type,
+                                        unsigned long *found)
 {
        MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
        MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
        const struct efx_ef10_nvram_type_info *info;
        size_t size, erase_size, outlen;
+        int type_idx = 0;
        bool protected;
        int rc;
-        for (info = efx_ef10_nvram_types; ; info++) {
+        for (type_idx = 0; ; type_idx++) {
-                if (info ==
+                if (type_idx == EF10_NVRAM_PARTITION_COUNT)
-                    efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
                        return -ENODEV;
+                info = efx_ef10_nvram_types + type_idx;
                if ((type & ~info->type_mask) == info->type)
                        break;
        }
@@ -6074,6 +6077,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
        if (protected)
                return -ENODEV; /* hide it */
+        /* If we've already exposed a partition of this type, hide this
+         * duplicate.  All operations on MTDs are keyed by the type anyway,
+         * so we can't act on the duplicate.
+         */
+        if (__test_and_set_bit(type_idx, found))
+                return -EEXIST;
        part->nvram_type = type;
        MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
@@ -6105,6 +6115,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
 static int efx_ef10_mtd_probe(struct efx_nic *efx)
 {
        MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+        DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
        struct efx_mcdi_mtd_partition *parts;
        size_t outlen, n_parts_total, i, n_parts;
        unsigned int type;
@@ -6133,11 +6144,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
        for (i = 0; i < n_parts_total; i++) {
                type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
                                        i);
-                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+                rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
-                if (rc == 0)
+                                                  found);
-                        n_parts++;
+                if (rc == -EEXIST || rc == -ENODEV)
-                else if (rc != -ENODEV)
+                        continue;
+                if (rc)
                        goto fail;
+                n_parts++;
        }
        rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index 6c5092e7771c..c5e25580a43f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -263,6 +263,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
                                  struct stmmac_extra_stats *x, u32 chan)
 {
        u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
+        u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
        int ret = 0;
        /* ABNORMAL interrupts */
@@ -282,8 +283,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
                x->normal_irq_n++;
                if (likely(intr_status & XGMAC_RI)) {
-                        u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+                        if (likely(intr_en & XGMAC_RIE)) {
-                        if (likely(value & XGMAC_RIE)) {
                                x->rx_normal_irq_n++;
                                ret |= handle_rx;
                        }
@@ -295,7 +295,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
        }
        /* Clear interrupts */
-        writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+        writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
        return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 0c4ab3444cc3..5afba69981cf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3517,27 +3517,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget)
        struct stmmac_channel *ch =
                container_of(napi, struct stmmac_channel, napi);
        struct stmmac_priv *priv = ch->priv_data;
-        int work_done = 0, work_rem = budget;
+        int work_done, rx_done = 0, tx_done = 0;
        u32 chan = ch->index;
        priv->xstats.napi_poll++;
-        if (ch->has_tx) {
+        if (ch->has_tx)
-                int done = stmmac_tx_clean(priv, work_rem, chan);
+                tx_done = stmmac_tx_clean(priv, budget, chan);
+        if (ch->has_rx)
+                rx_done = stmmac_rx(priv, budget, chan);
-                work_done += done;
+        work_done = max(rx_done, tx_done);
-                work_rem -= done;
+        work_done = min(work_done, budget);
-        }
-        if (ch->has_rx) {
-                int done = stmmac_rx(priv, work_rem, chan);
-                work_done += done;
+        if (work_done < budget && napi_complete_done(napi, work_done)) {
-                work_rem -= done;
+                int stat;
-        }
-        if (work_done < budget && napi_complete_done(napi, work_done))
                stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
+                stat = stmmac_dma_interrupt_status(priv, priv->ioaddr,
+                                                   &priv->xstats, chan);
+                if (stat && napi_reschedule(napi))
+                        stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
+        }
        return work_done;
 }
@@ -4160,6 +4161,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
                        return ret;
        }
+        /* Rx Watchdog is available in the COREs newer than the 3.40.
+         * In some case, for example on bugged HW this feature
+         * has to be disable and this can be done by passing the
+         * riwt_off field from the platform.
+         */
+        if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
+            (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
+                priv->use_riwt = 1;
+                dev_info(priv->device,
+                         "Enable RX Mitigation via HW Watchdog Timer\n");
+        }
        return 0;
 }
@@ -4292,18 +4305,6 @@ int stmmac_dvr_probe(struct device *device,
        if (flow_ctrl)
                priv->flow_ctrl = FLOW_AUTO;    /* RX/TX pause on */
-        /* Rx Watchdog is available in the COREs newer than the 3.40.
-         * In some case, for example on bugged HW this feature
-         * has to be disable and this can be done by passing the
-         * riwt_off field from the platform.
-         */
-        if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
-            (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
-                priv->use_riwt = 1;
-                dev_info(priv->device,
-                         "Enable RX Mitigation via HW Watchdog Timer\n");
-        }
        /* Setup channels NAPI */
        maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index c54a50dbd5ac..d819e8eaba12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
 */
 static void stmmac_pci_remove(struct pci_dev *pdev)
 {
+        int i;
        stmmac_dvr_remove(&pdev->dev);
+        for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
+                if (pci_resource_len(pdev, i) == 0)
+                        continue;
+                pcim_iounmap_regions(pdev, BIT(i));
+                break;
+        }
        pci_disable_device(pdev);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 531294f4978b..58ea18af9813 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
        /* Queue 0 is not AVB capable */
        if (queue <= 0 || queue >= tx_queues_count)
                return -EINVAL;
+        if (!priv->dma_cap.av)
+                return -EOPNOTSUPP;
        if (priv->speed != SPEED_100 && priv->speed != SPEED_1000)
                return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index 9020b084b953..7ec4eb74fe21 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1,22 +1,9 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
 *
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
 * This driver uses the sungem driver (c) David Miller
 * (davem@redhat.com) as its basis.
 *
diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
index 13f3860496a8..ae5f05f03f88 100644
--- a/drivers/net/ethernet/sun/cassini.h
+++ b/drivers/net/ethernet/sun/cassini.h
@@ -1,23 +1,10 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: GPL-2.0+ */
 /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
 * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
 *
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
 * vendor id: 0x108E (Sun Microsystems, Inc.)
 * device id: 0xabba (Cassini)
 * revision ids: 0x01 = Cassini
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index ef6f766f6389..e859ae2e42d5 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
        u32 total_data_buflen;
 };
+#define NETVSC_HASH_KEYLEN 40
 struct netvsc_device_info {
        unsigned char mac_adr[ETH_ALEN];
        u32  num_chn;
@@ -151,6 +153,8 @@ struct netvsc_device_info {
        u32  recv_sections;
        u32  send_section_size;
        u32  recv_section_size;
+        u8 rss_key[NETVSC_HASH_KEYLEN];
 };
 enum rndis_device_state {
@@ -160,8 +164,6 @@ enum rndis_device_state {
        RNDIS_DEV_DATAINITIALIZED,
 };
-#define NETVSC_HASH_KEYLEN 40
 struct rndis_device {
        struct net_device *ndev;
@@ -209,7 +211,9 @@ int netvsc_recv_callback(struct net_device *net,
 void netvsc_channel_cb(void *context);
 int netvsc_poll(struct napi_struct *napi, int budget);
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info);
 int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
@@ -1177,7 +1181,7 @@ enum ndis_per_pkt_info_type {
 enum rndis_per_pkt_info_interal_type {
        RNDIS_PKTINFO_ID = 1,
-        /* Add more memebers here */
+        /* Add more members here */
        RNDIS_PKTINFO_MAX
 };
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 922054c1d544..813d195bbd57 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
        rdev = nvdev->extension;
        if (rdev) {
-                ret = rndis_set_subchannel(rdev->ndev, nvdev);
+                ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
                if (ret == 0) {
                        netif_device_attach(rdev->ndev);
                } else {
@@ -1331,7 +1331,7 @@ void netvsc_channel_cb(void *context)
        prefetch(hv_get_ring_buffer(rbi) + rbi->priv_read_index);
        if (napi_schedule_prep(&nvchan->napi)) {
-                /* disable interupts from host */
+                /* disable interrupts from host */
                hv_begin_read(rbi);
                __napi_schedule_irqoff(&nvchan->napi);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 91ed15ea5883..256adbd044f5 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -370,7 +370,7 @@ static u32 fill_pg_buf(struct page *page, u32 offset, u32 len,
 {
        int j = 0;
-        /* Deal with compund pages by ignoring unused part
+        /* Deal with compound pages by ignoring unused part
         * of the page.
         */
        page += (offset >> PAGE_SHIFT);
@@ -858,6 +858,39 @@ static void netvsc_get_channels(struct net_device *net,
        }
 }
+/* Alloc struct netvsc_device_info, and initialize it from either existing
+ * struct netvsc_device, or from default values.
+ */
+static struct netvsc_device_info *netvsc_devinfo_get
+                        (struct netvsc_device *nvdev)
+{
+        struct netvsc_device_info *dev_info;
+        dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
+        if (!dev_info)
+                return NULL;
+        if (nvdev) {
+                dev_info->num_chn = nvdev->num_chn;
+                dev_info->send_sections = nvdev->send_section_cnt;
+                dev_info->send_section_size = nvdev->send_section_size;
+                dev_info->recv_sections = nvdev->recv_section_cnt;
+                dev_info->recv_section_size = nvdev->recv_section_size;
+                memcpy(dev_info->rss_key, nvdev->extension->rss_key,
+                       NETVSC_HASH_KEYLEN);
+        } else {
+                dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
+                dev_info->send_sections = NETVSC_DEFAULT_TX;
+                dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
+                dev_info->recv_sections = NETVSC_DEFAULT_RX;
+                dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
+        return dev_info;
+}
 static int netvsc_detach(struct net_device *ndev,
                         struct netvsc_device *nvdev)
 {
@@ -909,7 +942,7 @@ static int netvsc_attach(struct net_device *ndev,
                return PTR_ERR(nvdev);
        if (nvdev->num_chn > 1) {
-                ret = rndis_set_subchannel(ndev, nvdev);
+                ret = rndis_set_subchannel(ndev, nvdev, dev_info);
                /* if unavailable, just proceed with one queue */
                if (ret) {
@@ -943,7 +976,7 @@ static int netvsc_set_channels(struct net_device *net,
        struct net_device_context *net_device_ctx = netdev_priv(net);
        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
        unsigned int orig, count = channels->combined_count;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        int ret;
        /* We do not support separate count for rx, tx, or other */
@@ -962,24 +995,26 @@ static int netvsc_set_channels(struct net_device *net,
        orig = nvdev->num_chn;
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(nvdev);
-        device_info.num_chn = count;
-        device_info.send_sections = nvdev->send_section_cnt;
+        if (!device_info)
-        device_info.send_section_size = nvdev->send_section_size;
+                return -ENOMEM;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info->num_chn = count;
        ret = netvsc_detach(net, nvdev);
        if (ret)
-                return ret;
+                goto out;
-        ret = netvsc_attach(net, &device_info);
+        ret = netvsc_attach(net, device_info);
        if (ret) {
-                device_info.num_chn = orig;
+                device_info->num_chn = orig;
-                if (netvsc_attach(net, &device_info))
+                if (netvsc_attach(net, device_info))
                        netdev_err(net, "restoring channel setting failed\n");
        }
+out:
+        kfree(device_info);
        return ret;
 }
@@ -1048,48 +1083,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
        struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
        int orig_mtu = ndev->mtu;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        int ret = 0;
        if (!nvdev || nvdev->destroy)
                return -ENODEV;
+        device_info = netvsc_devinfo_get(nvdev);
+        if (!device_info)
+                return -ENOMEM;
        /* Change MTU of underlying VF netdev first. */
        if (vf_netdev) {
                ret = dev_set_mtu(vf_netdev, mtu);
                if (ret)
-                        return ret;
+                        goto out;
        }
-        memset(&device_info, 0, sizeof(device_info));
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = nvdev->send_section_cnt;
-        device_info.send_section_size = nvdev->send_section_size;
-        device_info.recv_sections = nvdev->recv_section_cnt;
-        device_info.recv_section_size = nvdev->recv_section_size;
        ret = netvsc_detach(ndev, nvdev);
        if (ret)
                goto rollback_vf;
        ndev->mtu = mtu;
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
-        if (ret)
+        if (!ret)
-                goto rollback;
+                goto out;
-        return 0;
-rollback:
        /* Attempt rollback to original MTU */
        ndev->mtu = orig_mtu;
-        if (netvsc_attach(ndev, &device_info))
+        if (netvsc_attach(ndev, device_info))
                netdev_err(ndev, "restoring mtu failed\n");
 rollback_vf:
        if (vf_netdev)
                dev_set_mtu(vf_netdev, orig_mtu);
+out:
+        kfree(device_info);
        return ret;
 }
@@ -1674,7 +1706,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
 {
        struct net_device_context *ndevctx = netdev_priv(ndev);
        struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info;
        struct ethtool_ringparam orig;
        u32 new_tx, new_rx;
        int ret = 0;
@@ -1694,26 +1726,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
            new_rx == orig.rx_pending)
                return 0;        /* no change */
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(nvdev);
-        device_info.num_chn = nvdev->num_chn;
-        device_info.send_sections = new_tx;
+        if (!device_info)
-        device_info.send_section_size = nvdev->send_section_size;
+                return -ENOMEM;
-        device_info.recv_sections = new_rx;
-        device_info.recv_section_size = nvdev->recv_section_size;
+        device_info->send_sections = new_tx;
+        device_info->recv_sections = new_rx;
        ret = netvsc_detach(ndev, nvdev);
        if (ret)
-                return ret;
+                goto out;
-        ret = netvsc_attach(ndev, &device_info);
+        ret = netvsc_attach(ndev, device_info);
        if (ret) {
-                device_info.send_sections = orig.tx_pending;
+                device_info->send_sections = orig.tx_pending;
-                device_info.recv_sections = orig.rx_pending;
+                device_info->recv_sections = orig.rx_pending;
-                if (netvsc_attach(ndev, &device_info))
+                if (netvsc_attach(ndev, device_info))
                        netdev_err(ndev, "restoring ringparam failed");
        }
+out:
+        kfree(device_info);
        return ret;
 }
@@ -2088,7 +2123,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
        if (!netvsc_dev || rtnl_dereference(net_device_ctx->vf_netdev))
                return NOTIFY_DONE;
-        /* if syntihetic interface is a different namespace,
+        /* if synthetic interface is a different namespace,
         * then move the VF to that namespace; join will be
         * done again in that context.
         */
@@ -2167,7 +2202,7 @@ static int netvsc_probe(struct hv_device *dev,
 {
        struct net_device *net = NULL;
        struct net_device_context *net_device_ctx;
-        struct netvsc_device_info device_info;
+        struct netvsc_device_info *device_info = NULL;
        struct netvsc_device *nvdev;
        int ret = -ENOMEM;
@@ -2214,21 +2249,21 @@ static int netvsc_probe(struct hv_device *dev,
        netif_set_real_num_rx_queues(net, 1);
        /* Notify the netvsc driver of the new device */
-        memset(&device_info, 0, sizeof(device_info));
+        device_info = netvsc_devinfo_get(NULL);
-        device_info.num_chn = VRSS_CHANNEL_DEFAULT;
-        device_info.send_sections = NETVSC_DEFAULT_TX;
+        if (!device_info) {
-        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
+                ret = -ENOMEM;
-        device_info.recv_sections = NETVSC_DEFAULT_RX;
+                goto devinfo_failed;
-        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
+        }
-        nvdev = rndis_filter_device_add(dev, &device_info);
+        nvdev = rndis_filter_device_add(dev, device_info);
        if (IS_ERR(nvdev)) {
                ret = PTR_ERR(nvdev);
                netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
                goto rndis_failed;
        }
-        memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
+        memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
        /* We must get rtnl lock before scheduling nvdev->subchan_work,
         * otherwise netvsc_subchan_work() can get rtnl lock first and wait
@@ -2236,7 +2271,7 @@ static int netvsc_probe(struct hv_device *dev,
         * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
         * -> ... -> device_add() -> ... -> __device_attach() can't get
         * the device lock, so all the subchannels can't be processed --
-         * finally netvsc_subchan_work() hangs for ever.
+         * finally netvsc_subchan_work() hangs forever.
         */
        rtnl_lock();
@@ -2266,12 +2301,16 @@ static int netvsc_probe(struct hv_device *dev,
        list_add(&net_device_ctx->list, &netvsc_dev_list);
        rtnl_unlock();
+        kfree(device_info);
        return 0;
 register_failed:
        rtnl_unlock();
        rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
+        kfree(device_info);
+devinfo_failed:
        free_percpu(net_device_ctx->vf_stats);
 no_stats:
        hv_set_drvdata(dev, NULL);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 8b537a049c1e..73b60592de06 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -774,8 +774,8 @@ cleanup:
        return ret;
 }
-int rndis_filter_set_rss_param(struct rndis_device *rdev,
+static int rndis_set_rss_param_msg(struct rndis_device *rdev,
-                               const u8 *rss_key)
+                                   const u8 *rss_key, u16 flag)
 {
        struct net_device *ndev = rdev->ndev;
        struct rndis_request *request;
@@ -804,7 +804,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
        rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
        rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
        rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
-        rssp->flag = 0;
+        rssp->flag = flag;
        rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
                         NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
                         NDIS_HASH_TCP_IPV6;
@@ -829,9 +829,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
        wait_for_completion(&request->wait_event);
        set_complete = &request->response_msg.msg.set_complete;
-        if (set_complete->status == RNDIS_STATUS_SUCCESS)
+        if (set_complete->status == RNDIS_STATUS_SUCCESS) {
-                memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+                if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
-        else {
+                    !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
+                        memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+        } else {
                netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
                           set_complete->status);
                ret = -EINVAL;
@@ -842,6 +845,16 @@ cleanup:
        return ret;
 }
+int rndis_filter_set_rss_param(struct rndis_device *rdev,
+                               const u8 *rss_key)
+{
+        /* Disable RSS before change */
+        rndis_set_rss_param_msg(rdev, rss_key,
+                                NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
+        return rndis_set_rss_param_msg(rdev, rss_key, 0);
+}
 static int rndis_filter_query_device_link_status(struct rndis_device *dev,
                                                 struct netvsc_device *net_device)
 {
@@ -1121,7 +1134,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
 * This breaks overlap of processing the host message for the
 * new primary channel with the initialization of sub-channels.
 */
-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+int rndis_set_subchannel(struct net_device *ndev,
+                         struct netvsc_device *nvdev,
+                         struct netvsc_device_info *dev_info)
 {
        struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
        struct net_device_context *ndev_ctx = netdev_priv(ndev);
@@ -1161,8 +1176,11 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
        wait_event(nvdev->subchan_open,
                   atomic_read(&nvdev->open_chn) == nvdev->num_chn);
-        /* ignore failues from setting rss parameters, still have channels */
+        /* ignore failures from setting rss parameters, still have channels */
-        rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+        if (dev_info)
+                rndis_filter_set_rss_param(rdev, dev_info->rss_key);
+        else
+                rndis_filter_set_rss_param(rdev, netvsc_hash_key);
        netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
        netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index fc726ce4c164..6d067176320f 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -337,7 +337,7 @@ static void macvlan_process_broadcast(struct work_struct *w)
                if (src)
                        dev_put(src->dev);
-                kfree_skb(skb);
+                consume_skb(skb);
        }
 }
diff --git a/drivers/net/phy/asix.c b/drivers/net/phy/asix.c
index 8ebe7f5484ae..f14ba5366b91 100644
--- a/drivers/net/phy/asix.c
+++ b/drivers/net/phy/asix.c
@@ -1,13 +1,7 @@
-// SPDX-License-Identifier: GPL-2.0
+// SPDX-License-Identifier: GPL-2.0+
 /* Driver for Asix PHYs
 *
 * Author: Michael Schmitz <schmitzmic@gmail.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- *
 */
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/drivers/net/phy/bcm87xx.c b/drivers/net/phy/bcm87xx.c
index 1b350183bffb..a271239748f2 100644
--- a/drivers/net/phy/bcm87xx.c
+++ b/drivers/net/phy/bcm87xx.c
@@ -197,6 +197,7 @@ static struct phy_driver bcm87xx_driver[] = {
        .phy_id         = PHY_ID_BCM8706,
        .phy_id_mask    = 0xffffffff,
        .name           = "Broadcom BCM8706",
+        .features       = PHY_10GBIT_FEC_FEATURES,
        .config_init    = bcm87xx_config_init,
        .config_aneg    = bcm87xx_config_aneg,
        .read_status    = bcm87xx_read_status,
@@ -208,6 +209,7 @@ static struct phy_driver bcm87xx_driver[] = {
        .phy_id         = PHY_ID_BCM8727,
        .phy_id_mask    = 0xffffffff,
        .name           = "Broadcom BCM8727",
+        .features       = PHY_10GBIT_FEC_FEATURES,
        .config_init    = bcm87xx_config_init,
        .config_aneg    = bcm87xx_config_aneg,
        .read_status    = bcm87xx_read_status,
diff --git a/drivers/net/phy/cortina.c b/drivers/net/phy/cortina.c
index 8022cd317f62..1a4d04afb7f0 100644
--- a/drivers/net/phy/cortina.c
+++ b/drivers/net/phy/cortina.c
@@ -88,6 +88,7 @@ static struct phy_driver cortina_driver[] = {
        .phy_id         = PHY_ID_CS4340,
        .phy_id_mask    = 0xffffffff,
        .name           = "Cortina CS4340",
+        .features       = PHY_10GBIT_FEATURES,
        .config_init    = gen10g_config_init,
        .config_aneg    = gen10g_config_aneg,
        .read_status    = cortina_read_status,
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index a9c7c7f41b0c..2e12f982534f 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1046,6 +1046,39 @@ static int m88e1145_config_init(struct phy_device *phydev)
        return 0;
 }
+/* The VOD can be out of specification on link up. Poke an
+ * undocumented register, in an undocumented page, with a magic value
+ * to fix this.
+ */
+static int m88e6390_errata(struct phy_device *phydev)
+{
+        int err;
+        err = phy_write(phydev, MII_BMCR,
+                        BMCR_ANENABLE | BMCR_SPEED1000 | BMCR_FULLDPLX);
+        if (err)
+                return err;
+        usleep_range(300, 400);
+        err = phy_write_paged(phydev, 0xf8, 0x08, 0x36);
+        if (err)
+                return err;
+        return genphy_soft_reset(phydev);
+}
+static int m88e6390_config_aneg(struct phy_device *phydev)
+{
+        int err;
+        err = m88e6390_errata(phydev);
+        if (err)
+                return err;
+        return m88e1510_config_aneg(phydev);
+}
 /**
 * fiber_lpa_mod_linkmode_lpa_t
 * @advertising: the linkmode advertisement settings
@@ -1402,7 +1435,7 @@ static int m88e1318_set_wol(struct phy_device *phydev,
                 * before enabling it if !phy_interrupt_is_valid()
                 */
                if (!phy_interrupt_is_valid(phydev))
-                        phy_read(phydev, MII_M1011_IEVENT);
+                        __phy_read(phydev, MII_M1011_IEVENT);
                /* Enable the WOL interrupt */
                err = __phy_modify(phydev, MII_88E1318S_PHY_CSIER, 0,
@@ -2283,7 +2316,7 @@ static struct phy_driver marvell_drivers[] = {
                .features = PHY_GBIT_FEATURES,
                .probe = m88e6390_probe,
                .config_init = &marvell_config_init,
-                .config_aneg = &m88e1510_config_aneg,
+                .config_aneg = &m88e6390_config_aneg,
                .read_status = &marvell_read_status,
                .ack_interrupt = &marvell_ack_interrupt,
                .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio-hisi-femac.c b/drivers/net/phy/mdio-hisi-femac.c
index b03fedd6c1d8..287f3ccf1da1 100644
--- a/drivers/net/phy/mdio-hisi-femac.c
+++ b/drivers/net/phy/mdio-hisi-femac.c
@@ -1,20 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
 * Hisilicon Fast Ethernet MDIO Bus Driver
 *
 * Copyright (c) 2016 HiSilicon Technologies Co., Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
 #include <linux/clk.h>
@@ -163,4 +151,4 @@ module_platform_driver(hisi_femac_mdio_driver);
 MODULE_DESCRIPTION("Hisilicon Fast Ethernet MAC MDIO interface driver");
 MODULE_AUTHOR("Dongpo Li <lidongpo@hisilicon.com>");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2e59a8419b17..66b9cfe692fc 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -390,6 +390,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
        if (IS_ERR(gpiod)) {
                dev_err(&bus->dev, "mii_bus %s couldn't get reset GPIO\n",
                        bus->id);
+                device_del(&bus->dev);
                return PTR_ERR(gpiod);
        } else  if (gpiod) {
                bus->reset_gpiod = gpiod;
diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
index b03bcf2c388a..3ddaf9595697 100644
--- a/drivers/net/phy/meson-gxl.c
+++ b/drivers/net/phy/meson-gxl.c
@@ -233,6 +233,7 @@ static struct phy_driver meson_gxl_phy[] = {
                .name           = "Meson GXL Internal PHY",
                .features       = PHY_BASIC_FEATURES,
                .flags          = PHY_IS_INTERNAL,
+                .soft_reset     = genphy_soft_reset,
                .config_init    = meson_gxl_config_init,
                .aneg_done      = genphy_aneg_done,
                .read_status    = meson_gxl_read_status,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index c33384710d26..b1f959935f50 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -1070,6 +1070,7 @@ static struct phy_driver ksphy_driver[] = {
        .driver_data    = &ksz9021_type,
        .probe          = kszphy_probe,
        .config_init    = ksz9031_config_init,
+        .soft_reset     = genphy_soft_reset,
        .read_status    = ksz9031_read_status,
        .ack_interrupt  = kszphy_ack_interrupt,
        .config_intr    = kszphy_config_intr,
@@ -1098,6 +1099,7 @@ static struct phy_driver ksphy_driver[] = {
        .phy_id         = PHY_ID_KSZ8873MLL,
        .phy_id_mask    = MICREL_PHY_ID_MASK,
        .name           = "Micrel KSZ8873MLL Switch",
+        .features       = PHY_BASIC_FEATURES,
        .config_init    = kszphy_config_init,
        .config_aneg    = ksz8873mll_config_aneg,
        .read_status    = ksz8873mll_read_status,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index d33e7b3caf03..189cd2048c3a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -543,13 +543,6 @@ int phy_start_aneg(struct phy_device *phydev)
        mutex_lock(&phydev->lock);
-        if (!__phy_is_started(phydev)) {
-                WARN(1, "called from state %s\n",
-                     phy_state_to_str(phydev->state));
-                err = -EBUSY;
-                goto out_unlock;
-        }
        if (AUTONEG_DISABLE == phydev->autoneg)
                phy_sanitize_settings(phydev);
@@ -560,11 +553,13 @@ int phy_start_aneg(struct phy_device *phydev)
        if (err < 0)
                goto out_unlock;
-        if (phydev->autoneg == AUTONEG_ENABLE) {
+        if (__phy_is_started(phydev)) {
-                err = phy_check_link_status(phydev);
+                if (phydev->autoneg == AUTONEG_ENABLE) {
-        } else {
+                        err = phy_check_link_status(phydev);
-                phydev->state = PHY_FORCING;
+                } else {
-                phydev->link_timeout = PHY_FORCE_TIMEOUT;
+                        phydev->state = PHY_FORCING;
+                        phydev->link_timeout = PHY_FORCE_TIMEOUT;
+                }
        }
 out_unlock:
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 51990002d495..46c86725a693 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -61,6 +61,9 @@ EXPORT_SYMBOL_GPL(phy_gbit_all_ports_features);
 __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_features) __ro_after_init;
 EXPORT_SYMBOL_GPL(phy_10gbit_features);
+__ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_fec_features) __ro_after_init;
+EXPORT_SYMBOL_GPL(phy_10gbit_fec_features);
 static const int phy_basic_ports_array[] = {
        ETHTOOL_LINK_MODE_Autoneg_BIT,
        ETHTOOL_LINK_MODE_TP_BIT,
@@ -109,6 +112,11 @@ const int phy_10gbit_features_array[1] = {
 };
 EXPORT_SYMBOL_GPL(phy_10gbit_features_array);
+const int phy_10gbit_fec_features_array[1] = {
+        ETHTOOL_LINK_MODE_10000baseR_FEC_BIT,
+};
+EXPORT_SYMBOL_GPL(phy_10gbit_fec_features_array);
 __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_full_features) __ro_after_init;
 EXPORT_SYMBOL_GPL(phy_10gbit_full_features);
@@ -191,6 +199,10 @@ static void features_init(void)
        linkmode_set_bit_array(phy_10gbit_full_features_array,
                               ARRAY_SIZE(phy_10gbit_full_features_array),
                               phy_10gbit_full_features);
+        /* 10G FEC only */
+        linkmode_set_bit_array(phy_10gbit_fec_features_array,
+                               ARRAY_SIZE(phy_10gbit_fec_features_array),
+                               phy_10gbit_fec_features);
 }
 void phy_device_free(struct phy_device *phydev)
@@ -2243,6 +2255,11 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
 {
        int retval;
+        if (WARN_ON(!new_driver->features)) {
+                pr_err("%s: Driver features are missing\n", new_driver->name);
+                return -EINVAL;
+        }
        new_driver->mdiodrv.flags |= MDIO_DEVICE_IS_PHY;
        new_driver->mdiodrv.driver.name = new_driver->name;
        new_driver->mdiodrv.driver.bus = &mdio_bus_type;
diff --git a/drivers/net/phy/rockchip.c b/drivers/net/phy/rockchip.c
index f1da70b9b55f..95abf7072f32 100644
--- a/drivers/net/phy/rockchip.c
+++ b/drivers/net/phy/rockchip.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /**
 * drivers/net/phy/rockchip.c
 *
@@ -6,12 +7,6 @@
 * Copyright (c) 2017, Fuzhou Rockchip Electronics Co., Ltd
 *
 * David Wu <david.wu@rock-chips.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
 */
 #include <linux/ethtool.h>
@@ -229,4 +224,4 @@ MODULE_DEVICE_TABLE(mdio, rockchip_phy_tbl);
 MODULE_AUTHOR("David Wu <david.wu@rock-chips.com>");
 MODULE_DESCRIPTION("Rockchip Ethernet PHY driver");
-MODULE_LICENSE("GPL v2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/teranetics.c b/drivers/net/phy/teranetics.c
index 22f3bdd8206c..91247182bc52 100644
--- a/drivers/net/phy/teranetics.c
+++ b/drivers/net/phy/teranetics.c
@@ -80,6 +80,7 @@ static struct phy_driver teranetics_driver[] = {
        .phy_id         = PHY_ID_TN2020,
        .phy_id_mask    = 0xffffffff,
        .name           = "Teranetics TN2020",
+        .features       = PHY_10GBIT_FEATURES,
        .soft_reset     = gen10g_no_soft_reset,
        .aneg_done      = teranetics_aneg_done,
        .config_init    = gen10g_config_init,
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 62dc564b251d..f22639f0116a 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -445,6 +445,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
        if (pskb_trim_rcsum(skb, len))
                goto drop;
+        ph = pppoe_hdr(skb);
        pn = pppoe_pernet(dev_net(dev));
        /* Note that get_item does a sock_hold(), so sk_pppox(po)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a4fdad475594..18656c4094b3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -856,10 +856,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
                err = 0;
        }
-        rcu_assign_pointer(tfile->tun, tun);
-        rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
-        tun->numqueues++;
        if (tfile->detached) {
                tun_enable_queue(tfile);
        } else {
@@ -876,6 +872,13 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
         * refcnt.
         */
+        /* Publish tfile->tun and tun->tfiles only after we've fully
+         * initialized tfile; otherwise we risk using half-initialized
+         * object.
+         */
+        rcu_assign_pointer(tfile->tun, tun);
+        rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+        tun->numqueues++;
 out:
        return err;
 }
diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index 57f1c94fca0b..820a2fe7d027 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1287,6 +1287,20 @@ static const struct driver_info asix112_info = {
 #undef ASIX112_DESC
+static const struct driver_info trendnet_info = {
+        .description    = "USB-C 3.1 to 5GBASE-T Ethernet Adapter",
+        .bind           = aqc111_bind,
+        .unbind         = aqc111_unbind,
+        .status         = aqc111_status,
+        .link_reset     = aqc111_link_reset,
+        .reset          = aqc111_reset,
+        .stop           = aqc111_stop,
+        .flags          = FLAG_ETHER | FLAG_FRAMING_AX |
+                          FLAG_AVOID_UNLINK_URBS | FLAG_MULTI_PACKET,
+        .rx_fixup       = aqc111_rx_fixup,
+        .tx_fixup       = aqc111_tx_fixup,
+};
 static int aqc111_suspend(struct usb_interface *intf, pm_message_t message)
 {
        struct usbnet *dev = usb_get_intfdata(intf);
@@ -1440,6 +1454,7 @@ static const struct usb_device_id products[] = {
        {AQC111_USB_ETH_DEV(0x2eca, 0xc101, aqc111_info)},
        {AQC111_USB_ETH_DEV(0x0b95, 0x2790, asix111_info)},
        {AQC111_USB_ETH_DEV(0x0b95, 0x2791, asix112_info)},
+        {AQC111_USB_ETH_DEV(0x20f4, 0xe05a, trendnet_info)},
        { },/* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index b654f05b2ccd..3d93993e74da 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
        asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
        chipcode &= AX_CHIPCODE_MASK;
-        (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+        ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
-                                            ax88772a_hw_reset(dev, 0);
+                                                  ax88772a_hw_reset(dev, 0);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
+                return ret;
+        }
        /* Read PHYID register *AFTER* the PHY was reset properly */
        phyid = asix_get_phyid(dev);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index b3b3c05903a1..5512a1038721 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -179,10 +179,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         * probed with) and a slave/data interface; union
         * descriptors sort this all out.
         */
-        info->control = usb_ifnum_to_if(dev->udev,
+        info->control = usb_ifnum_to_if(dev->udev, info->u->bMasterInterface0);
-        info->u->bMasterInterface0);
+        info->data = usb_ifnum_to_if(dev->udev, info->u->bSlaveInterface0);
-        info->data = usb_ifnum_to_if(dev->udev,
-                info->u->bSlaveInterface0);
        if (!info->control || !info->data) {
                dev_dbg(&intf->dev,
                        "master #%u/%p slave #%u/%p\n",
@@ -216,18 +214,16 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
        /* a data interface altsetting does the real i/o */
        d = &info->data->cur_altsetting->desc;
        if (d->bInterfaceClass != USB_CLASS_CDC_DATA) {
-                dev_dbg(&intf->dev, "slave class %u\n",
+                dev_dbg(&intf->dev, "slave class %u\n", d->bInterfaceClass);
-                        d->bInterfaceClass);
                goto bad_desc;
        }
 skip:
-        if (    rndis &&
+        if (rndis && header.usb_cdc_acm_descriptor &&
-                header.usb_cdc_acm_descriptor &&
+            header.usb_cdc_acm_descriptor->bmCapabilities) {
-                header.usb_cdc_acm_descriptor->bmCapabilities) {
+                dev_dbg(&intf->dev,
-                        dev_dbg(&intf->dev,
+                        "ACM capabilities %02x, not really RNDIS?\n",
-                                "ACM capabilities %02x, not really RNDIS?\n",
+                        header.usb_cdc_acm_descriptor->bmCapabilities);
-                                header.usb_cdc_acm_descriptor->bmCapabilities);
+                goto bad_desc;
-                        goto bad_desc;
        }
        if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) {
@@ -238,7 +234,7 @@ skip:
        }
        if (header.usb_cdc_mdlm_desc &&
-                memcmp(header.usb_cdc_mdlm_desc->bGUID, mbm_guid, 16)) {
+            memcmp(header.usb_cdc_mdlm_desc->bGUID, mbm_guid, 16)) {
                dev_dbg(&intf->dev, "GUID doesn't match\n");
                goto bad_desc;
        }
@@ -302,7 +298,7 @@ skip:
        if (info->control->cur_altsetting->desc.bNumEndpoints == 1) {
                struct usb_endpoint_descriptor  *desc;
-                dev->status = &info->control->cur_altsetting->endpoint [0];
+                dev->status = &info->control->cur_altsetting->endpoint[0];
                desc = &dev->status->desc;
                if (!usb_endpoint_is_int_in(desc) ||
                    (le16_to_cpu(desc->wMaxPacketSize)
@@ -847,6 +843,14 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* USB-C 3.1 to 5GBASE-T Ethernet Adapter (based on AQC111U) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0xe05a, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 774e1ff01c9a..735ad838e2ba 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -123,6 +123,7 @@ static void qmimux_setup(struct net_device *dev)
        dev->addr_len        = 0;
        dev->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
        dev->netdev_ops      = &qmimux_netdev_ops;
+        dev->mtu             = 1500;
        dev->needs_free_netdev = true;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 023725086046..8fadd8eaf601 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1330,7 +1330,7 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
        return stats.packets;
 }
-static void free_old_xmit_skbs(struct send_queue *sq)
+static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
 {
        struct sk_buff *skb;
        unsigned int len;
@@ -1343,7 +1343,7 @@ static void free_old_xmit_skbs(struct send_queue *sq)
                bytes += skb->len;
                packets++;
-                dev_consume_skb_any(skb);
+                napi_consume_skb(skb, in_napi);
        }
        /* Avoid overhead when no packets have been processed
@@ -1369,7 +1369,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq)
                return;
        if (__netif_tx_trylock(txq)) {
-                free_old_xmit_skbs(sq);
+                free_old_xmit_skbs(sq, true);
                __netif_tx_unlock(txq);
        }
@@ -1445,7 +1445,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
        struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
        __netif_tx_lock(txq, raw_smp_processor_id());
-        free_old_xmit_skbs(sq);
+        free_old_xmit_skbs(sq, true);
        __netif_tx_unlock(txq);
        virtqueue_napi_complete(napi, sq->vq, 0);
@@ -1514,7 +1514,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
        bool use_napi = sq->napi.weight;
        /* Free up any pending old buffers before queueing new ones. */
-        free_old_xmit_skbs(sq);
+        free_old_xmit_skbs(sq, false);
        if (use_napi && kick)
                virtqueue_enable_cb_delayed(sq->vq);
@@ -1557,7 +1557,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
                if (!use_napi &&
                    unlikely(!virtqueue_enable_cb_delayed(sq->vq))) {
                        /* More just got used, free them then recheck. */
-                        free_old_xmit_skbs(sq);
+                        free_old_xmit_skbs(sq, false);
                        if (sq->vq->num_free >= 2+MAX_SKB_FRAGS) {
                                netif_start_subqueue(dev, qnum);
                                virtqueue_disable_cb(sq->vq);
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index be6485428198..66d889d54e58 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -1056,6 +1056,54 @@ static const struct net_device_ops uhdlc_ops = {
        .ndo_tx_timeout = uhdlc_tx_timeout,
 };
+static int hdlc_map_iomem(char *name, int init_flag, void __iomem **ptr)
+{
+        struct device_node *np;
+        struct platform_device *pdev;
+        struct resource *res;
+        static int siram_init_flag;
+        int ret = 0;
+        np = of_find_compatible_node(NULL, NULL, name);
+        if (!np)
+                return -EINVAL;
+        pdev = of_find_device_by_node(np);
+        if (!pdev) {
+                pr_err("%pOFn: failed to lookup pdev\n", np);
+                of_node_put(np);
+                return -EINVAL;
+        }
+        of_node_put(np);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                ret = -EINVAL;
+                goto error_put_device;
+        }
+        *ptr = ioremap(res->start, resource_size(res));
+        if (!*ptr) {
+                ret = -ENOMEM;
+                goto error_put_device;
+        }
+        /* We've remapped the addresses, and we don't need the device any
+         * more, so we should release it.
+         */
+        put_device(&pdev->dev);
+        if (init_flag && siram_init_flag == 0) {
+                memset_io(*ptr, 0, resource_size(res));
+                siram_init_flag = 1;
+        }
+        return  0;
+error_put_device:
+        put_device(&pdev->dev);
+        return ret;
+}
 static int ucc_hdlc_probe(struct platform_device *pdev)
 {
        struct device_node *np = pdev->dev.of_node;
@@ -1150,6 +1198,15 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
                ret = ucc_of_parse_tdm(np, utdm, ut_info);
                if (ret)
                        goto free_utdm;
+                ret = hdlc_map_iomem("fsl,t1040-qe-si", 0,
+                                     (void __iomem **)&utdm->si_regs);
+                if (ret)
+                        goto free_utdm;
+                ret = hdlc_map_iomem("fsl,t1040-qe-siram", 1,
+                                     (void __iomem **)&utdm->siram);
+                if (ret)
+                        goto unmap_si_regs;
        }
        if (of_property_read_u16(np, "fsl,hmask", &uhdlc_priv->hmask))
@@ -1158,7 +1215,7 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
        ret = uhdlc_init(uhdlc_priv);
        if (ret) {
                dev_err(&pdev->dev, "Failed to init uhdlc\n");
-                goto free_utdm;
+                goto undo_uhdlc_init;
        }
        dev = alloc_hdlcdev(uhdlc_priv);
@@ -1187,6 +1244,9 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
 free_dev:
        free_netdev(dev);
 undo_uhdlc_init:
+        iounmap(utdm->siram);
+unmap_si_regs:
+        iounmap(utdm->si_regs);
 free_utdm:
        if (uhdlc_priv->tsa)
                kfree(utdm);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3a4b8786f7ea..320edcac4699 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2761,6 +2761,11 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
                                        BIT(NL80211_CHAN_WIDTH_160);
        }
+        if (!n_limits) {
+                err = -EINVAL;
+                goto failed_hw;
+        }
        data->if_combination.n_limits = n_limits;
        data->if_combination.max_interfaces = 2048;
        data->if_combination.limits = data->if_limits;
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index 64b218699656..3a93e4d9828b 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -530,8 +530,10 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
        SET_NETDEV_DEV(dev, &priv->lowerdev->dev);
        dev->ieee80211_ptr = kzalloc(sizeof(*dev->ieee80211_ptr), GFP_KERNEL);
-        if (!dev->ieee80211_ptr)
+        if (!dev->ieee80211_ptr) {
+                err = -ENOMEM;
                goto remove_handler;
+        }
        dev->ieee80211_ptr->iftype = NL80211_IFTYPE_STATION;
        dev->ieee80211_ptr->wiphy = common_wiphy;
diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
index 0cf58cabc9ed..3cf50274fadb 100644
--- a/drivers/nvdimm/dimm.c
+++ b/drivers/nvdimm/dimm.c
@@ -26,6 +26,12 @@ static int nvdimm_probe(struct device *dev)
        struct nvdimm_drvdata *ndd;
        int rc;
+        rc = nvdimm_security_setup_events(dev);
+        if (rc < 0) {
+                dev_err(dev, "security event setup failed: %d\n", rc);
+                return rc;
+        }
        rc = nvdimm_check_config_data(dev);
        if (rc) {
                /* not required for non-aliased nvdimm, ex. NVDIMM-N */
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 553aa78abeee..91b9abbf689c 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -585,13 +585,25 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus,
 }
 EXPORT_SYMBOL_GPL(__nvdimm_create);
-int nvdimm_security_setup_events(struct nvdimm *nvdimm)
+static void shutdown_security_notify(void *data)
 {
-        nvdimm->sec.overwrite_state = sysfs_get_dirent(nvdimm->dev.kobj.sd,
+        struct nvdimm *nvdimm = data;
-                        "security");
+        sysfs_put(nvdimm->sec.overwrite_state);
+}
+int nvdimm_security_setup_events(struct device *dev)
+{
+        struct nvdimm *nvdimm = to_nvdimm(dev);
+        if (nvdimm->sec.state < 0 || !nvdimm->sec.ops
+                        || !nvdimm->sec.ops->overwrite)
+                return 0;
+        nvdimm->sec.overwrite_state = sysfs_get_dirent(dev->kobj.sd, "security");
        if (!nvdimm->sec.overwrite_state)
-                return -ENODEV;
+                return -ENOMEM;
-        return 0;
+        return devm_add_action_or_reset(dev, shutdown_security_notify, nvdimm);
 }
 EXPORT_SYMBOL_GPL(nvdimm_security_setup_events);
diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
index 2b2cf4e554d3..e5ffd5733540 100644
--- a/drivers/nvdimm/nd-core.h
+++ b/drivers/nvdimm/nd-core.h
@@ -54,12 +54,12 @@ struct nvdimm {
 };
 static inline enum nvdimm_security_state nvdimm_security_state(
-                struct nvdimm *nvdimm, bool master)
+                struct nvdimm *nvdimm, enum nvdimm_passphrase_type ptype)
 {
        if (!nvdimm->sec.ops)
                return -ENXIO;
-        return nvdimm->sec.ops->state(nvdimm, master);
+        return nvdimm->sec.ops->state(nvdimm, ptype);
 }
 int nvdimm_security_freeze(struct nvdimm *nvdimm);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index cfde992684e7..379bf4305e61 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -250,6 +250,7 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
 void nvdimm_set_aliasing(struct device *dev);
 void nvdimm_set_locked(struct device *dev);
 void nvdimm_clear_locked(struct device *dev);
+int nvdimm_security_setup_events(struct device *dev);
 #if IS_ENABLED(CONFIG_NVDIMM_KEYS)
 int nvdimm_security_unlock(struct device *dev);
 #else
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index df4b3a6db51b..b9fff3b8ed1b 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -545,8 +545,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
        timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
        ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
                ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
-        if (!(ctrl->anacap & (1 << 6)))
+        ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
-                ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
        if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
                dev_err(ctrl->device,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index deb1a66bf117..9bc585415d9b 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2041,14 +2041,18 @@ static int nvme_setup_host_mem(struct nvme_dev *dev)
        return ret;
 }
+/* irq_queues covers admin queue */
 static void nvme_calc_io_queues(struct nvme_dev *dev, unsigned int irq_queues)
 {
        unsigned int this_w_queues = write_queues;
+        WARN_ON(!irq_queues);
        /*
-         * Setup read/write queue split
+         * Setup read/write queue split, assign admin queue one independent
+         * irq vector if irq_queues is > 1.
         */
-        if (irq_queues == 1) {
+        if (irq_queues <= 2) {
                dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
                dev->io_queues[HCTX_TYPE_READ] = 0;
                return;
@@ -2056,21 +2060,21 @@ static void nvme_calc_io_queues(struct nvme_dev *dev, unsigned int irq_queues)
        /*
         * If 'write_queues' is set, ensure it leaves room for at least
-         * one read queue
+         * one read queue and one admin queue
         */
        if (this_w_queues >= irq_queues)
-                this_w_queues = irq_queues - 1;
+                this_w_queues = irq_queues - 2;
        /*
         * If 'write_queues' is set to zero, reads and writes will share
         * a queue set.
         */
        if (!this_w_queues) {
-                dev->io_queues[HCTX_TYPE_DEFAULT] = irq_queues;
+                dev->io_queues[HCTX_TYPE_DEFAULT] = irq_queues - 1;
                dev->io_queues[HCTX_TYPE_READ] = 0;
        } else {
                dev->io_queues[HCTX_TYPE_DEFAULT] = this_w_queues;
-                dev->io_queues[HCTX_TYPE_READ] = irq_queues - this_w_queues;
+                dev->io_queues[HCTX_TYPE_READ] = irq_queues - this_w_queues - 1;
        }
 }
@@ -2095,7 +2099,7 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
                this_p_queues = nr_io_queues - 1;
                irq_queues = 1;
        } else {
-                irq_queues = nr_io_queues - this_p_queues;
+                irq_queues = nr_io_queues - this_p_queues + 1;
        }
        dev->io_queues[HCTX_TYPE_POLL] = this_p_queues;
@@ -2115,8 +2119,9 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
                 * If we got a failure and we're down to asking for just
                 * 1 + 1 queues, just ask for a single vector. We'll share
                 * that between the single IO queue and the admin queue.
+                 * Otherwise, we assign one independent vector to admin queue.
                 */
-                if (result >= 0 && irq_queues > 1)
+                if (irq_queues > 1)
                        irq_queues = irq_sets[0] + irq_sets[1] + 1;
                result = pci_alloc_irq_vectors_affinity(pdev, irq_queues,
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 0a2fd2949ad7..52abc3a6de12 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -119,6 +119,7 @@ struct nvme_rdma_ctrl {
        struct nvme_ctrl        ctrl;
        bool                    use_inline_data;
+        u32                     io_queues[HCTX_MAX_TYPES];
 };
 static inline struct nvme_rdma_ctrl *to_rdma_ctrl(struct nvme_ctrl *ctrl)
@@ -165,8 +166,8 @@ static inline int nvme_rdma_queue_idx(struct nvme_rdma_queue *queue)
 static bool nvme_rdma_poll_queue(struct nvme_rdma_queue *queue)
 {
        return nvme_rdma_queue_idx(queue) >
-                queue->ctrl->ctrl.opts->nr_io_queues +
+                queue->ctrl->io_queues[HCTX_TYPE_DEFAULT] +
-                queue->ctrl->ctrl.opts->nr_write_queues;
+                queue->ctrl->io_queues[HCTX_TYPE_READ];
 }
 static inline size_t nvme_rdma_inline_data_size(struct nvme_rdma_queue *queue)
@@ -661,8 +662,21 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
        nr_io_queues = min_t(unsigned int, nr_io_queues,
                                ibdev->num_comp_vectors);
-        nr_io_queues += min(opts->nr_write_queues, num_online_cpus());
+        if (opts->nr_write_queues) {
-        nr_io_queues += min(opts->nr_poll_queues, num_online_cpus());
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] =
+                                min(opts->nr_write_queues, nr_io_queues);
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        } else {
+                ctrl->io_queues[HCTX_TYPE_DEFAULT] = nr_io_queues;
+        }
+        ctrl->io_queues[HCTX_TYPE_READ] = nr_io_queues;
+        if (opts->nr_poll_queues) {
+                ctrl->io_queues[HCTX_TYPE_POLL] =
+                        min(opts->nr_poll_queues, num_online_cpus());
+                nr_io_queues += ctrl->io_queues[HCTX_TYPE_POLL];
+        }
        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
        if (ret)
@@ -1689,18 +1703,28 @@ static enum blk_eh_timer_return
 nvme_rdma_timeout(struct request *rq, bool reserved)
 {
        struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
+        struct nvme_rdma_queue *queue = req->queue;
+        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        dev_warn(req->queue->ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
-                 "I/O %d QID %d timeout, reset controller\n",
+                 rq->tag, nvme_rdma_queue_idx(queue));
-                 rq->tag, nvme_rdma_queue_idx(req->queue));
-        /* queue error recovery */
+        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-        nvme_rdma_error_recovery(req->queue->ctrl);
+                /*
+                 * Teardown immediately if controller times out while starting
+                 * or we are already started error recovery. all outstanding
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_rdma_teardown_io_queues(ctrl, false);
+                nvme_rdma_teardown_admin_queue(ctrl, false);
+                return BLK_EH_DONE;
+        }
-        /* fail with DNR on cmd timeout */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
-        nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
+        nvme_rdma_error_recovery(ctrl);
-        return BLK_EH_DONE;
+        return BLK_EH_RESET_TIMER;
 }
 static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1779,17 +1803,15 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
        struct nvme_rdma_ctrl *ctrl = set->driver_data;
        set->map[HCTX_TYPE_DEFAULT].queue_offset = 0;
-        set->map[HCTX_TYPE_READ].nr_queues = ctrl->ctrl.opts->nr_io_queues;
+        set->map[HCTX_TYPE_DEFAULT].nr_queues =
+                        ctrl->io_queues[HCTX_TYPE_DEFAULT];
+        set->map[HCTX_TYPE_READ].nr_queues = ctrl->io_queues[HCTX_TYPE_READ];
        if (ctrl->ctrl.opts->nr_write_queues) {
                /* separate read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_write_queues;
                set->map[HCTX_TYPE_READ].queue_offset =
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
        } else {
                /* mixed read/write queues */
-                set->map[HCTX_TYPE_DEFAULT].nr_queues =
-                                ctrl->ctrl.opts->nr_io_queues;
                set->map[HCTX_TYPE_READ].queue_offset = 0;
        }
        blk_mq_rdma_map_queues(&set->map[HCTX_TYPE_DEFAULT],
@@ -1799,12 +1821,12 @@ static int nvme_rdma_map_queues(struct blk_mq_tag_set *set)
        if (ctrl->ctrl.opts->nr_poll_queues) {
                set->map[HCTX_TYPE_POLL].nr_queues =
-                                ctrl->ctrl.opts->nr_poll_queues;
+                                ctrl->io_queues[HCTX_TYPE_POLL];
                set->map[HCTX_TYPE_POLL].queue_offset =
-                                ctrl->ctrl.opts->nr_io_queues;
+                                ctrl->io_queues[HCTX_TYPE_DEFAULT];
                if (ctrl->ctrl.opts->nr_write_queues)
                        set->map[HCTX_TYPE_POLL].queue_offset +=
-                                ctrl->ctrl.opts->nr_write_queues;
+                                ctrl->io_queues[HCTX_TYPE_READ];
                blk_mq_map_queues(&set->map[HCTX_TYPE_POLL]);
        }
        return 0;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 265a0543b381..5f0a00425242 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1948,20 +1948,23 @@ nvme_tcp_timeout(struct request *rq, bool reserved)
        struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
        struct nvme_tcp_cmd_pdu *pdu = req->pdu;
-        dev_dbg(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                "queue %d: timeout request %#x type %d\n",
-                nvme_tcp_queue_id(req->queue), rq->tag,
+                nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
-                pdu->hdr.type);
        if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
-                union nvme_result res = {};
+                /*
+                 * Teardown immediately if controller times out while starting
-                nvme_req(rq)->flags |= NVME_REQ_CANCELLED;
+                 * or we are already started error recovery. all outstanding
-                nvme_end_request(rq, cpu_to_le16(NVME_SC_ABORT_REQ), res);
+                 * requests are completed on shutdown, so we return BLK_EH_DONE.
+                 */
+                flush_work(&ctrl->err_work);
+                nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+                nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
                return BLK_EH_DONE;
        }
-        /* queue error recovery */
+        dev_warn(ctrl->ctrl.device, "starting error recovery\n");
        nvme_tcp_error_recovery(&ctrl->ctrl);
        return BLK_EH_RESET_TIMER;
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index a8d23eb80192..a884e3a0e8af 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -139,6 +139,10 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
 static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
 static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
+static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
+static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
+                                struct nvmet_rdma_rsp *r);
 static const struct nvmet_fabrics_ops nvmet_rdma_ops;
@@ -182,9 +186,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
        spin_unlock_irqrestore(&queue->rsps_lock, flags);
        if (unlikely(!rsp)) {
-                rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
+                int ret;
+                rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
                if (unlikely(!rsp))
                        return NULL;
+                ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
+                if (unlikely(ret)) {
+                        kfree(rsp);
+                        return NULL;
+                }
                rsp->allocated = true;
        }
@@ -197,6 +209,7 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
        unsigned long flags;
        if (unlikely(rsp->allocated)) {
+                nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
                kfree(rsp);
                return;
        }
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 44b37b202e39..ad0df786fe93 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1089,7 +1089,7 @@ out:
 static int nvmet_tcp_try_recv_one(struct nvmet_tcp_queue *queue)
 {
-        int result;
+        int result = 0;
        if (unlikely(queue->rcv_state == NVMET_TCP_RECV_ERR))
                return 0;
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index a09c1c3cf831..49b16f76d78e 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -207,11 +207,8 @@ static void __of_attach_node(struct device_node *np)
        if (!of_node_check_flag(np, OF_OVERLAY)) {
                np->name = __of_get_property(np, "name", NULL);
-                np->type = __of_get_property(np, "device_type", NULL);
                if (!np->name)
                        np->name = "<NULL>";
-                if (!np->type)
-                        np->type = "<NULL>";
                phandle = __of_get_property(np, "phandle", &sz);
                if (!phandle)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 7099c652c6a5..9cc1461aac7d 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -314,12 +314,8 @@ static bool populate_node(const void *blob,
        populate_properties(blob, offset, mem, np, pathp, dryrun);
        if (!dryrun) {
                np->name = of_get_property(np, "name", NULL);
-                np->type = of_get_property(np, "device_type", NULL);
                if (!np->name)
                        np->name = "<NULL>";
-                if (!np->type)
-                        np->type = "<NULL>";
        }
        *pnp = np;
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 2b5ac43a5690..c423e94baf0f 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -423,12 +423,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
                tchild->parent = target->np;
                tchild->name = __of_get_property(node, "name", NULL);
-                tchild->type = __of_get_property(node, "device_type", NULL);
                if (!tchild->name)
                        tchild->name = "<NULL>";
-                if (!tchild->type)
-                        tchild->type = "<NULL>";
                /* ignore obsolete "linux,phandle" */
                phandle = __of_get_property(node, "phandle", &size);
diff --git a/drivers/of/pdt.c b/drivers/of/pdt.c
index d3185063d369..7eda43c66c91 100644
--- a/drivers/of/pdt.c
+++ b/drivers/of/pdt.c
@@ -155,7 +155,6 @@ static struct device_node * __init of_pdt_create_node(phandle node,
        dp->parent = parent;
        dp->name = of_pdt_get_one_property(node, "name");
-        dp->type = of_pdt_get_one_property(node, "device_type");
        dp->phandle = node;
        dp->properties = of_pdt_build_prop_list(node);
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 08430031bd28..8631efa1daa1 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -806,6 +806,7 @@ struct device_node *of_graph_get_remote_node(const struct device_node *node,
        if (!of_device_is_available(remote)) {
                pr_debug("not available for remote node\n");
+                of_node_put(remote);
                return NULL;
        }
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index 4310c7a4212e..2ab92409210a 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -21,13 +21,14 @@ menuconfig PCI
          support for PCI-X and the foundations for PCI Express support.
          Say 'Y' here unless you know what you are doing.
+if PCI
 config PCI_DOMAINS
        bool
        depends on PCI
 config PCI_DOMAINS_GENERIC
        bool
-        depends on PCI
        select PCI_DOMAINS
 config PCI_SYSCALL
@@ -37,7 +38,6 @@ source "drivers/pci/pcie/Kconfig"
 config PCI_MSI
        bool "Message Signaled Interrupts (MSI and MSI-X)"
-        depends on PCI
        select GENERIC_MSI_IRQ
        help
           This allows device drivers to enable MSI (Message Signaled
@@ -59,7 +59,6 @@ config PCI_MSI_IRQ_DOMAIN
 config PCI_QUIRKS
        default y
        bool "Enable PCI quirk workarounds" if EXPERT
-        depends on PCI
        help
          This enables workarounds for various PCI chipset bugs/quirks.
          Disable this only if your target machine is unaffected by PCI
@@ -67,7 +66,7 @@ config PCI_QUIRKS
 config PCI_DEBUG
        bool "PCI Debugging"
-        depends on PCI && DEBUG_KERNEL
+        depends on DEBUG_KERNEL
        help
          Say Y here if you want the PCI core to produce a bunch of debug
          messages to the system log.  Select this if you are having a
@@ -77,7 +76,6 @@ config PCI_DEBUG
 config PCI_REALLOC_ENABLE_AUTO
        bool "Enable PCI resource re-allocation detection"
-        depends on PCI
        depends on PCI_IOV
        help
          Say Y here if you want the PCI core to detect if PCI resource
@@ -90,7 +88,6 @@ config PCI_REALLOC_ENABLE_AUTO
 config PCI_STUB
        tristate "PCI Stub driver"
-        depends on PCI
        help
          Say Y or M here if you want be able to reserve a PCI device
          when it is going to be assigned to a guest operating system.
@@ -99,7 +96,6 @@ config PCI_STUB
 config PCI_PF_STUB
        tristate "PCI PF Stub driver"
-        depends on PCI
        depends on PCI_IOV
        help
          Say Y or M here if you want to enable support for devices that
@@ -111,7 +107,7 @@ config PCI_PF_STUB
 config XEN_PCIDEV_FRONTEND
        tristate "Xen PCI Frontend"
-        depends on PCI && X86 && XEN
+        depends on X86 && XEN
        select PCI_XEN
        select XEN_XENBUS_FRONTEND
        default y
@@ -133,7 +129,6 @@ config PCI_BRIDGE_EMUL
 config PCI_IOV
        bool "PCI IOV support"
-        depends on PCI
        select PCI_ATS
        help
          I/O Virtualization is a PCI feature supported by some devices
@@ -144,7 +139,6 @@ config PCI_IOV
 config PCI_PRI
        bool "PCI PRI support"
-        depends on PCI
        select PCI_ATS
        help
          PRI is the PCI Page Request Interface. It allows PCI devices that are
@@ -154,7 +148,6 @@ config PCI_PRI
 config PCI_PASID
        bool "PCI PASID support"
-        depends on PCI
        select PCI_ATS
        help
          Process Address Space Identifiers (PASIDs) can be used by PCI devices
@@ -167,7 +160,7 @@ config PCI_PASID
 config PCI_P2PDMA
        bool "PCI peer-to-peer transfer support"
-        depends on PCI && ZONE_DEVICE
+        depends on ZONE_DEVICE
        select GENERIC_ALLOCATOR
        help
          Enableѕ drivers to do PCI peer-to-peer transactions to and from
@@ -184,12 +177,11 @@ config PCI_P2PDMA
 config PCI_LABEL
        def_bool y if (DMI || ACPI)
-        depends on PCI
        select NLS
 config PCI_HYPERV
        tristate "Hyper-V PCI Frontend"
-        depends on PCI && X86 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && X86_64
+        depends on X86 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && X86_64
        help
          The PCI device frontend driver allows the kernel to import arbitrary
          PCI devices from a PCI backend to support PCI driver domains.
@@ -198,3 +190,5 @@ source "drivers/pci/hotplug/Kconfig"
 source "drivers/pci/controller/Kconfig"
 source "drivers/pci/endpoint/Kconfig"
 source "drivers/pci/switch/Kconfig"
+endif
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 7a1c8a09efa5..4c0b47867258 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1168,7 +1168,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                   const struct irq_affinity *affd)
 {
        static const struct irq_affinity msi_default_affd;
-        int vecs = -ENOSPC;
+        int msix_vecs = -ENOSPC;
+        int msi_vecs = -ENOSPC;
        if (flags & PCI_IRQ_AFFINITY) {
                if (!affd)
@@ -1179,16 +1180,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
        }
        if (flags & PCI_IRQ_MSIX) {
-                vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+                msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
-                                affd);
+                                                    max_vecs, affd);
-                if (vecs > 0)
+                if (msix_vecs > 0)
-                        return vecs;
+                        return msix_vecs;
        }
        if (flags & PCI_IRQ_MSI) {
-                vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+                msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
-                if (vecs > 0)
+                                                  affd);
-                        return vecs;
+                if (msi_vecs > 0)
+                        return msi_vecs;
        }
        /* use legacy irq if allowed */
@@ -1199,7 +1201,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                }
        }
-        return vecs;
+        if (msix_vecs == -ENOSPC)
+                return -ENOSPC;
+        return msi_vecs;
 }
 EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index c9d8e3c837de..c25acace7d91 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -6195,7 +6195,8 @@ static int __init pci_setup(char *str)
                        } else if (!strncmp(str, "pcie_scan_all", 13)) {
                                pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
                        } else if (!strncmp(str, "disable_acs_redir=", 18)) {
-                                disable_acs_redir_param = str + 18;
+                                disable_acs_redir_param =
+                                        kstrdup(str + 18, GFP_KERNEL);
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
index 6fd6e07ab345..09a77e556ece 100644
--- a/drivers/phy/qualcomm/phy-ath79-usb.c
+++ b/drivers/phy/qualcomm/phy-ath79-usb.c
@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
        err = reset_control_deassert(priv->reset);
        if (err && priv->no_suspend_override)
-                reset_control_assert(priv->no_suspend_override);
+                reset_control_deassert(priv->no_suspend_override);
        return err;
 }
@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
        if (!priv)
                return -ENOMEM;
-        priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
+        priv->reset = devm_reset_control_get(&pdev->dev, "phy");
        if (IS_ERR(priv->reset))
                return PTR_ERR(priv->reset);
diff --git a/drivers/phy/ti/Kconfig b/drivers/phy/ti/Kconfig
index f137e0107764..c4709ed7fb0e 100644
--- a/drivers/phy/ti/Kconfig
+++ b/drivers/phy/ti/Kconfig
@@ -82,6 +82,7 @@ config PHY_TI_GMII_SEL
        default y if TI_CPSW=y
        depends on TI_CPSW || COMPILE_TEST
        select GENERIC_PHY
+        select REGMAP
        default m
        help
          This driver supports configuring of the TI CPSW Port mode depending on
diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
index 77fdaa551977..a52c5bb35033 100644
--- a/drivers/phy/ti/phy-gmii-sel.c
+++ b/drivers/phy/ti/phy-gmii-sel.c
@@ -204,11 +204,11 @@ static struct phy *phy_gmii_sel_of_xlate(struct device *dev,
        if (args->args_count < 1)
                return ERR_PTR(-EINVAL);
+        if (!priv || !priv->if_phys)
+                return ERR_PTR(-ENODEV);
        if (priv->soc_data->features & BIT(PHY_GMII_SEL_RMII_IO_CLK_EN) &&
            args->args_count < 2)
                return ERR_PTR(-EINVAL);
-        if (!priv || !priv->if_phys)
-                return ERR_PTR(-ENODEV);
        if (phy_id > priv->soc_data->num_ports)
                return ERR_PTR(-EINVAL);
        if (phy_id != priv->if_phys[phy_id - 1].id)
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index e3b62c2ee8d1..5e2109c54c7c 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -1009,7 +1009,7 @@ config INTEL_MFLD_THERMAL
 config INTEL_IPS
        tristate "Intel Intelligent Power Sharing"
-        depends on ACPI
+        depends on ACPI && PCI
        ---help---
          Intel Calpella platforms support dynamic power sharing between the
          CPU and GPU, maximizing performance in a given TDP.  This driver,
@@ -1135,7 +1135,7 @@ config SAMSUNG_Q10
 config APPLE_GMUX
        tristate "Apple Gmux Driver"
-        depends on ACPI
+        depends on ACPI && PCI
        depends on PNP
        depends on BACKLIGHT_CLASS_DEVICE
        depends on BACKLIGHT_APPLE=n || BACKLIGHT_APPLE
@@ -1174,7 +1174,7 @@ config INTEL_SMARTCONNECT
 config INTEL_PMC_IPC
        tristate "Intel PMC IPC Driver"
-        depends on ACPI
+        depends on ACPI && PCI
        ---help---
        This driver provides support for PMC control on some Intel platforms.
        The PMC is an ARC processor which defines IPC commands for communication
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 797fab33bb98..7cbea796652a 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -224,7 +224,8 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
                        extoff = NULL;
                        break;
                }
-                if (extoff->n_samples > PTP_MAX_SAMPLES) {
+                if (extoff->n_samples > PTP_MAX_SAMPLES
+                    || extoff->rsv[0] || extoff->rsv[1] || extoff->rsv[2]) {
                        err = -EINVAL;
                        break;
                }
diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c
index 183fc42a510a..2d7cd344f3bf 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -153,10 +153,15 @@ static int rproc_virtio_find_vqs(struct virtio_device *vdev, unsigned int nvqs,
                                 const bool * ctx,
                                 struct irq_affinity *desc)
 {
-        int i, ret;
+        int i, ret, queue_idx = 0;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = rp_find_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = rp_find_vq(vdev, queue_idx++, callbacks[i], names[i],
                                    ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        ret = PTR_ERR(vqs[i]);
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
index 194ffd5c8580..039b2074db7e 100644
--- a/drivers/s390/char/sclp_config.c
+++ b/drivers/s390/char/sclp_config.c
@@ -60,7 +60,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
 static void __ref sclp_cpu_change_notify(struct work_struct *work)
 {
+        lock_device_hotplug();
        smp_rescan_cpus();
+        unlock_device_hotplug();
 }
 static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index fc9dbad476c0..ae1d56da671d 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -635,7 +635,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_ccw_device *vcdev = to_vc_device(vdev);
        unsigned long *indicatorp = NULL;
-        int ret, i;
+        int ret, i, queue_idx = 0;
        struct ccw1 *ccw;
        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
@@ -643,8 +643,14 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
                return -ENOMEM;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = virtio_ccw_setup_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
-                                             ctx ? ctx[i] : false, ccw);
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = virtio_ccw_setup_vq(vdev, queue_idx++, callbacks[i],
+                                             names[i], ctx ? ctx[i] : false,
+                                             ccw);
                if (IS_ERR(vqs[i])) {
                        ret = PTR_ERR(vqs[i]);
                        vqs[i] = NULL;
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 634ddb90e7aa..7e56a11836c1 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1747,11 +1747,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                shost->max_sectors = (shost->sg_tablesize * 8) + 112;
        }
-        error = dma_set_max_seg_size(&pdev->dev,
+        if (aac->adapter_info.options & AAC_OPT_NEW_COMM)
-                (aac->adapter_info.options & AAC_OPT_NEW_COMM) ?
+                shost->max_segment_size = shost->max_sectors << 9;
-                        (shost->max_sectors << 9) : 65536);
+        else
-        if (error)
+                shost->max_segment_size = 65536;
-                goto out_deinit;
        /*
         * Firmware printf works only with older firmware.
diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
index 8a004036e3d7..9bd2bd8dc2be 100644
--- a/drivers/scsi/csiostor/csio_attr.c
+++ b/drivers/scsi/csiostor/csio_attr.c
@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
        }
        fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
+        ln->fc_vport = fc_vport;
        if (csio_fcoe_alloc_vnp(hw, ln))
                goto error;
        *(struct csio_lnode **)fc_vport->dd_data = ln;
-        ln->fc_vport = fc_vport;
        if (!fc_vport->node_name)
                fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
        if (!fc_vport->port_name)
diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
index 8a20411699d9..75e1273a44b3 100644
--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm,
 }
 static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
-                                       unsigned int tid, int pg_idx, bool reply)
+                                unsigned int tid, int pg_idx)
 {
        struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
                                        GFP_KERNEL);
@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
        req = (struct cpl_set_tcb_field *)skb->head;
        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply = V_NO_REPLY(reply ? 0 : 1);
+        req->reply = V_NO_REPLY(1);
        req->cpu_idx = 0;
        req->word = htons(31);
        req->mask = cpu_to_be64(0xF0000000);
@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
 * @tid: connection id
 * @hcrc: header digest enabled
 * @dcrc: data digest enabled
- * @reply: request reply from h/w
 * set up the iscsi digest settings for a connection identified by tid
 */
 static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
-                             int hcrc, int dcrc, int reply)
+                                 int hcrc, int dcrc)
 {
        struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
                                        GFP_KERNEL);
@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply = V_NO_REPLY(reply ? 0 : 1);
+        req->reply = V_NO_REPLY(1);
        req->cpu_idx = 0;
        req->word = htons(31);
        req->mask = cpu_to_be64(0x0F000000);
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 49f8028ac524..d26f50af00ea 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1548,16 +1548,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
        struct cxgbi_sock *csk;
        csk = lookup_tid(t, tid);
-        if (!csk)
+        if (!csk) {
                pr_err("can't find conn. for tid %u.\n", tid);
+                return;
+        }
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p,%u,%lx,%u, status 0x%x.\n",
                csk, csk->state, csk->flags, csk->tid, rpl->status);
-        if (rpl->status != CPL_ERR_NONE)
+        if (rpl->status != CPL_ERR_NONE) {
                pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n",
                        csk, tid, rpl->status);
+                csk->err = -EINVAL;
+        }
+        complete(&csk->cmpl);
        __kfree_skb(skb);
 }
@@ -1983,7 +1989,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk,
 }
 static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
-                                int pg_idx, bool reply)
+                                int pg_idx)
 {
        struct sk_buff *skb;
        struct cpl_set_tcb_field *req;
@@ -1999,7 +2005,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        INIT_TP_WR(req, csk->tid);
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid));
-        req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
+        req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
        req->word_cookie = htons(0);
        req->mask = cpu_to_be64(0x3 << 8);
        req->val = cpu_to_be64(pg_idx << 8);
@@ -2008,12 +2014,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx);
+        reinit_completion(&csk->cmpl);
        cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
-        return 0;
+        wait_for_completion(&csk->cmpl);
+        return csk->err;
 }
 static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
-                                 int hcrc, int dcrc, int reply)
+                                 int hcrc, int dcrc)
 {
        struct sk_buff *skb;
        struct cpl_set_tcb_field *req;
@@ -2031,7 +2040,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        req = (struct cpl_set_tcb_field *)skb->head;
        INIT_TP_WR(req, tid);
        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
-        req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
+        req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
        req->word_cookie = htons(0);
        req->mask = cpu_to_be64(0x3 << 4);
        req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) |
@@ -2041,8 +2050,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
        log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
                "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc);
+        reinit_completion(&csk->cmpl);
        cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
-        return 0;
+        wait_for_completion(&csk->cmpl);
+        return csk->err;
 }
 static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 75f876409fb9..245742557c03 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev)
        skb_queue_head_init(&csk->receive_queue);
        skb_queue_head_init(&csk->write_queue);
        timer_setup(&csk->retry_timer, NULL, 0);
+        init_completion(&csk->cmpl);
        rwlock_init(&csk->callback_lock);
        csk->cdev = cdev;
        csk->flags = 0;
@@ -2251,14 +2252,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn,
                if (!err && conn->hdrdgst_en)
                        err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
                                                        conn->hdrdgst_en,
-                                                        conn->datadgst_en, 0);
+                                                        conn->datadgst_en);
                break;
        case ISCSI_PARAM_DATADGST_EN:
                err = iscsi_set_param(cls_conn, param, buf, buflen);
                if (!err && conn->datadgst_en)
                        err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
                                                        conn->hdrdgst_en,
-                                                        conn->datadgst_en, 0);
+                                                        conn->datadgst_en);
                break;
        case ISCSI_PARAM_MAX_R2T:
                return iscsi_tcp_set_max_r2t(conn, buf);
@@ -2384,7 +2385,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session,
        ppm = csk->cdev->cdev2ppm(csk->cdev);
        err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid,
-                                             ppm->tformat.pgsz_idx_dflt, 0);
+                                             ppm->tformat.pgsz_idx_dflt);
        if (err < 0)
                return err;
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 5d5d8b50d842..1917ff57651d 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -149,6 +149,7 @@ struct cxgbi_sock {
        struct sk_buff_head receive_queue;
        struct sk_buff_head write_queue;
        struct timer_list retry_timer;
+        struct completion cmpl;
        int err;
        rwlock_t callback_lock;
        void *user_data;
@@ -490,9 +491,9 @@ struct cxgbi_device {
                                  struct cxgbi_ppm *,
                                  struct cxgbi_task_tag_info *);
        int (*csk_ddp_setup_digest)(struct cxgbi_sock *,
-                                unsigned int, int, int, int);
+                                    unsigned int, int, int);
        int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *,
-                                unsigned int, int, bool);
+                                   unsigned int, int);
        void (*csk_release_offload_resources)(struct cxgbi_sock *);
        int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *);
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index e2420a810e99..c92b3822c408 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2507,6 +2507,12 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                sha->sas_port[i] = &hisi_hba->port[i].sas_port;
        }
+        if (hisi_hba->prot_mask) {
+                dev_info(dev, "Registering for DIF/DIX prot_mask=0x%x\n",
+                         prot_mask);
+                scsi_host_set_prot(hisi_hba->shost, prot_mask);
+        }
        rc = scsi_add_host(shost, dev);
        if (rc)
                goto err_out_ha;
@@ -2519,12 +2525,6 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (rc)
                goto err_out_register_ha;
-        if (hisi_hba->prot_mask) {
-                dev_info(dev, "Registering for DIF/DIX prot_mask=0x%x\n",
-                         prot_mask);
-                scsi_host_set_prot(hisi_hba->shost, prot_mask);
-        }
        scsi_scan_host(shost);
        return 0;
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index 68b90c4f79a3..1727d0c71b12 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -576,6 +576,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
        shost->max_lun = ~0;
        shost->max_cmd_len = MAX_COMMAND_SIZE;
+        /* turn on DIF support */
+        scsi_host_set_prot(shost,
+                           SHOST_DIF_TYPE1_PROTECTION |
+                           SHOST_DIF_TYPE2_PROTECTION |
+                           SHOST_DIF_TYPE3_PROTECTION);
+        scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
        err = scsi_add_host(shost, &pdev->dev);
        if (err)
                goto err_shost;
@@ -663,13 +670,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                        goto err_host_alloc;
                }
                pci_info->hosts[i] = h;
-                /* turn on DIF support */
-                scsi_host_set_prot(to_shost(h),
-                                   SHOST_DIF_TYPE1_PROTECTION |
-                                   SHOST_DIF_TYPE2_PROTECTION |
-                                   SHOST_DIF_TYPE3_PROTECTION);
-                scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
        }
        err = isci_setup_interrupts(pdev);
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 4c66b19e6199..8c9f79042228 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
                         lport);
        /* release any threads waiting for the unreg to complete */
-        complete(&lport->lport_unreg_done);
+        if (lport->vport->localport)
+                complete(lport->lport_unreg_cmp);
 }
 /* lpfc_nvme_remoteport_delete
@@ -2545,7 +2546,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
 */
 void
 lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
-                           struct lpfc_nvme_lport *lport)
+                           struct lpfc_nvme_lport *lport,
+                           struct completion *lport_unreg_cmp)
 {
 #if (IS_ENABLED(CONFIG_NVME_FC))
        u32 wait_tmo;
@@ -2557,8 +2559,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
         */
        wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
        while (true) {
-                ret = wait_for_completion_timeout(&lport->lport_unreg_done,
+                ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
-                                                  wait_tmo);
                if (unlikely(!ret)) {
                        lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
                                         "6176 Lport %p Localport %p wait "
@@ -2592,12 +2593,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
        struct lpfc_nvme_lport *lport;
        struct lpfc_nvme_ctrl_stat *cstat;
        int ret;
+        DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
        if (vport->nvmei_support == 0)
                return;
        localport = vport->localport;
-        vport->localport = NULL;
        lport = (struct lpfc_nvme_lport *)localport->private;
        cstat = lport->cstat;
@@ -2608,13 +2609,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
        /* lport's rport list is clear.  Unregister
         * lport and release resources.
         */
-        init_completion(&lport->lport_unreg_done);
+        lport->lport_unreg_cmp = &lport_unreg_cmp;
        ret = nvme_fc_unregister_localport(localport);
        /* Wait for completion.  This either blocks
         * indefinitely or succeeds
         */
-        lpfc_nvme_lport_unreg_wait(vport, lport);
+        lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
+        vport->localport = NULL;
        kfree(cstat);
        /* Regardless of the unregister upcall response, clear
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index cfd4719be25c..b234d0298994 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
 /* Declare nvme-based local and remote port definitions. */
 struct lpfc_nvme_lport {
        struct lpfc_vport *vport;
-        struct completion lport_unreg_done;
+        struct completion *lport_unreg_cmp;
        /* Add stats counters here */
        struct lpfc_nvme_ctrl_stat *cstat;
        atomic_t fc4NvmeLsRequests;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 6245f442d784..95fee83090eb 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
        struct lpfc_nvmet_tgtport *tport = targetport->private;
        /* release any threads waiting for the unreg to complete */
-        complete(&tport->tport_unreg_done);
+        if (tport->phba->targetport)
+                complete(tport->tport_unreg_cmp);
 }
 static void
@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
        struct lpfc_nvmet_tgtport *tgtp;
        struct lpfc_queue *wq;
        uint32_t qidx;
+        DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
        if (phba->nvmet_support == 0)
                return;
@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                        wq = phba->sli4_hba.nvme_wq[qidx];
                        lpfc_nvmet_wqfull_flush(phba, wq, NULL);
                }
-                init_completion(&tgtp->tport_unreg_done);
+                tgtp->tport_unreg_cmp = &tport_unreg_cmp;
                nvmet_fc_unregister_targetport(phba->targetport);
-                wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                wait_for_completion_timeout(&tport_unreg_cmp, 5);
                lpfc_nvmet_cleanup_io_context(phba);
        }
        phba->targetport = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 1aaff63f1f41..0ec1082ce7ef 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -34,7 +34,7 @@
 /* Used for NVME Target */
 struct lpfc_nvmet_tgtport {
        struct lpfc_hba *phba;
-        struct completion tport_unreg_done;
+        struct completion *tport_unreg_cmp;
        /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
        atomic_t rcv_ls_req_in;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 12fd74761ae0..2242e9b3ca12 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -9407,6 +9407,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                cmnd = CMD_XMIT_SEQUENCE64_CR;
                if (phba->link_flag & LS_LOOPBACK_MODE)
                        bf_set(wqe_xo, &wqe->xmit_sequence.wge_ctl, 1);
+                /* fall through */
        case CMD_XMIT_SEQUENCE64_CR:
                /* word3 iocb=io_tag32 wqe=reserved */
                wqe->xmit_sequence.rsvd3 = 0;
@@ -13528,6 +13529,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
        case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "2537 Receive Frame Truncated!!\n");
+                /* fall through */
        case FC_STATUS_RQ_SUCCESS:
                spin_lock_irqsave(&phba->hbalock, iflags);
                lpfc_sli4_rq_release(hrq, drq);
@@ -13937,7 +13939,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
        case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "6126 Receive Frame Truncated!!\n");
-                /* Drop thru */
+                /* fall through */
        case FC_STATUS_RQ_SUCCESS:
                spin_lock_irqsave(&phba->hbalock, iflags);
                lpfc_sli4_rq_release(hrq, drq);
@@ -14849,7 +14851,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                                eq->entry_count);
                if (eq->entry_count < 256)
                        return -EINVAL;
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 256:
                bf_set(lpfc_eq_context_count, &eq_create->u.request.context,
                       LPFC_EQ_CNT_256);
@@ -14980,7 +14982,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
                               LPFC_CQ_CNT_WORD7);
                        break;
                }
-                /* Fall Thru */
+                /* fall through */
        default:
                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                "0361 Unsupported CQ count: "
@@ -14991,7 +14993,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
                        status = -EINVAL;
                        goto out;
                }
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 256:
                bf_set(lpfc_cq_context_count, &cq_create->u.request.context,
                       LPFC_CQ_CNT_256);
@@ -15151,7 +15153,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                                               LPFC_CQ_CNT_WORD7);
                                        break;
                                }
-                                /* Fall Thru */
+                                /* fall through */
                        default:
                                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                                "3118 Bad CQ count. (%d)\n",
@@ -15160,7 +15162,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                                        status = -EINVAL;
                                        goto out;
                                }
-                                /* otherwise default to smallest (drop thru) */
+                                /* fall through - otherwise default to smallest */
                        case 256:
                                bf_set(lpfc_mbx_cq_create_set_cqe_cnt,
                                       &cq_set->u.request, LPFC_CQ_CNT_256);
@@ -15432,7 +15434,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
                        status = -EINVAL;
                        goto out;
                }
-                /* otherwise default to smallest count (drop through) */
+                /* fall through - otherwise default to smallest count */
        case 16:
                bf_set(lpfc_mq_context_ring_size,
                       &mq_create_ext->u.request.context,
@@ -15851,7 +15853,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                status = -EINVAL;
                                goto out;
                        }
-                        /* otherwise default to smallest count (drop through) */
+                        /* fall through - otherwise default to smallest count */
                case 512:
                        bf_set(lpfc_rq_context_rqe_count,
                               &rq_create->u.request.context,
@@ -15988,7 +15990,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                status = -EINVAL;
                                goto out;
                        }
-                        /* otherwise default to smallest count (drop through) */
+                        /* fall through - otherwise default to smallest count */
                case 512:
                        bf_set(lpfc_rq_context_rqe_count,
                               &rq_create->u.request.context,
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 7eaa400f6328..fcbff83c0097 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6236,7 +6236,7 @@ megasas_set_dma_mask(struct megasas_instance *instance)
                instance->consistent_mask_64bit = true;
        dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n",
-                 ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"),
+                 ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) ? "63" : "32"),
                 (instance->consistent_mask_64bit ? "63" : "32"));
        return 0;
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index a9a25f0eaf6f..647f48a28f85 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -175,7 +175,8 @@ megasas_clear_intr_fusion(struct megasas_instance *instance)
        /*
         * Check if it is our interrupt
         */
-        status = readl(&regs->outbound_intr_status);
+        status = megasas_readl(instance,
+                               &regs->outbound_intr_status);
        if (status & 1) {
                writel(status, &regs->outbound_intr_status);
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 4c5a3d23e010..084f2fcced0a 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -657,7 +657,7 @@ static int pm8001_dev_found_notify(struct domain_device *dev)
                if (dev->dev_type == SAS_SATA_DEV) {
                        pm8001_device->attached_phy =
                                dev->rphy->identify.phy_identifier;
-                                flag = 1; /* directly sata*/
+                        flag = 1; /* directly sata */
                }
        } /*register this device to HBA*/
        PM8001_DISC_DBG(pm8001_ha, pm8001_printk("Found device\n"));
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 4da660c1c431..6d6d6013e35b 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -953,6 +953,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
        qedi_ep = ep->dd_data;
        if (qedi_ep->state == EP_STATE_IDLE ||
+            qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
            qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
                return -1;
@@ -1035,6 +1036,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
        switch (qedi_ep->state) {
        case EP_STATE_OFLDCONN_START:
+        case EP_STATE_OFLDCONN_NONE:
                goto ep_release_conn;
        case EP_STATE_OFLDCONN_FAILED:
                        break;
@@ -1225,6 +1227,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
        if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
                QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
+                qedi_ep->state = EP_STATE_OFLDCONN_NONE;
                ret = -EIO;
                goto set_path_exit;
        }
diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
index 11260776212f..892d70d54553 100644
--- a/drivers/scsi/qedi/qedi_iscsi.h
+++ b/drivers/scsi/qedi/qedi_iscsi.h
@@ -59,6 +59,7 @@ enum {
        EP_STATE_OFLDCONN_FAILED        = 0x2000,
        EP_STATE_CONNECT_FAILED         = 0x4000,
        EP_STATE_DISCONN_TIMEDOUT       = 0x8000,
+        EP_STATE_OFLDCONN_NONE          = 0x10000,
 };
 struct qedi_conn;
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index a414f51302b7..6856dfdfa473 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -4248,7 +4248,7 @@ qla1280_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        ha->devnum = devnum;    /* specifies microcode load address */
 #ifdef QLA_64BIT_PTR
-        if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(64))) {
+        if (dma_set_mask_and_coherent(&ha->pdev->dev, DMA_BIT_MASK(64))) {
                if (dma_set_mask(&ha->pdev->dev, DMA_BIT_MASK(32))) {
                        printk(KERN_WARNING "scsi(%li): Unable to set a "
                               "suitable DMA mask - aborting\n", ha->host_no);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 26b93c563f92..d1fc4958222a 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4394,6 +4394,8 @@ typedef struct scsi_qla_host {
        uint16_t        n2n_id;
        struct list_head gpnid_list;
        struct fab_scan scan;
+        unsigned int irq_offset;
 } scsi_qla_host_t;
 struct qla27xx_image_status {
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 30d3090842f8..8507c43b918c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3446,6 +3446,7 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                            "Adjusted Max no of queues pairs: %d.\n", ha->max_qpairs);
                }
        }
+        vha->irq_offset = desc.pre_vectors;
        ha->msix_entries = kcalloc(ha->msix_count,
                                   sizeof(struct qla_msix_entry),
                                   GFP_KERNEL);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index ea69dafc9774..c6ef83d0d99b 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6939,7 +6939,7 @@ static int qla2xxx_map_queues(struct Scsi_Host *shost)
        if (USER_CTRL_IRQ(vha->hw))
                rc = blk_mq_map_queues(qmap);
        else
-                rc = blk_mq_pci_map_queues(qmap, vha->hw->pdev, 0);
+                rc = blk_mq_pci_map_queues(qmap, vha->hw->pdev, vha->irq_offset);
        return rc;
 }
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index cfdfcda28072..a77bfb224248 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -7232,6 +7232,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
        rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
                                           fw_ddb_entry);
+        if (rc)
+                goto free_sess;
        ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
                   __func__, fnode_sess->dev.kobj.name);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b13cc9288ba0..6d65ac584eba 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1842,8 +1842,8 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
        blk_queue_segment_boundary(q, shost->dma_boundary);
        dma_set_seg_boundary(dev, shost->dma_boundary);
-        blk_queue_max_segment_size(q,
+        blk_queue_max_segment_size(q, shost->max_segment_size);
-                min(shost->max_segment_size, dma_get_max_seg_size(dev)));
+        dma_set_max_seg_size(dev, shost->max_segment_size);
        /*
         * Set a reasonable default alignment:  The larger of 32-byte (dword),
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index a2b4179bfdf7..7639df91b110 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -80,8 +80,22 @@ static int scsi_dev_type_resume(struct device *dev,
        if (err == 0) {
                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
+                err = pm_runtime_set_active(dev);
                pm_runtime_enable(dev);
+                /*
+                 * Forcibly set runtime PM status of request queue to "active"
+                 * to make sure we can again get requests from the queue
+                 * (see also blk_pm_peek_request()).
+                 *
+                 * The resume hook will correct runtime PM status of the disk.
+                 */
+                if (!err && scsi_is_sdev_device(dev)) {
+                        struct scsi_device *sdev = to_scsi_device(dev);
+                        if (sdev->request_queue->dev)
+                                blk_set_runtime_active(sdev->request_queue);
+                }
        }
        return err;
@@ -140,16 +154,6 @@ static int scsi_bus_resume_common(struct device *dev,
        else
                fn = NULL;
-        /*
-         * Forcibly set runtime PM status of request queue to "active" to
-         * make sure we can again get requests from the queue (see also
-         * blk_pm_peek_request()).
-         *
-         * The resume hook will correct runtime PM status of the disk.
-         */
-        if (scsi_is_sdev_device(dev) && pm_runtime_suspended(dev))
-                blk_set_runtime_active(to_scsi_device(dev)->request_queue);
        if (fn) {
                async_schedule_domain(fn, dev, &scsi_sd_pm_domain);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a1a44f52e0e8..b2da8a00ec33 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -206,6 +206,12 @@ cache_type_store(struct device *dev, struct device_attribute *attr,
        sp = buffer_data[0] & 0x80 ? 1 : 0;
        buffer_data[0] &= ~0x80;
+        /*
+         * Ensure WP, DPOFUA, and RESERVED fields are cleared in
+         * received mode parameter buffer before doing MODE SELECT.
+         */
+        data.device_specific = 0;
        if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT,
                             SD_MAX_RETRIES, &data, &sshdr)) {
                if (scsi_sense_valid(&sshdr))
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 7bde6c809442..f564af8949e8 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -323,7 +323,7 @@ static inline void pqi_device_remove_start(struct pqi_scsi_dev *device)
 static inline bool pqi_device_in_remove(struct pqi_ctrl_info *ctrl_info,
                                        struct pqi_scsi_dev *device)
 {
-        return device->in_remove & !ctrl_info->in_shutdown;
+        return device->in_remove && !ctrl_info->in_shutdown;
 }
 static inline void pqi_schedule_rescan_worker_with_delay(
diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index dd65fea07687..6d176815e6ce 100644
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -195,7 +195,7 @@ enum ufs_desc_def_size {
        QUERY_DESC_CONFIGURATION_DEF_SIZE       = 0x90,
        QUERY_DESC_UNIT_DEF_SIZE                = 0x23,
        QUERY_DESC_INTERCONNECT_DEF_SIZE        = 0x06,
-        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x44,
+        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x48,
        QUERY_DESC_POWER_DEF_SIZE               = 0x62,
        QUERY_DESC_HEALTH_DEF_SIZE              = 0x25,
 };
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 9ba7671b84f8..2ddf24466a62 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -108,13 +108,19 @@
 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
                     const char *prefix)
 {
-        u8 *regs;
+        u32 *regs;
+        size_t pos;
+        if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */
+                return -EINVAL;
        regs = kzalloc(len, GFP_KERNEL);
        if (!regs)
                return -ENOMEM;
-        memcpy_fromio(regs, hba->mmio_base + offset, len);
+        for (pos = 0; pos < len; pos += 4)
+                regs[pos / 4] = ufshcd_readl(hba, offset + pos);
        ufshcd_hex_dump(prefix, regs, len);
        kfree(regs);
@@ -8001,6 +8007,8 @@ out:
        trace_ufshcd_system_resume(dev_name(hba->dev), ret,
                ktime_to_us(ktime_sub(ktime_get(), start)),
                hba->curr_dev_pwr_mode, hba->uic_link_state);
+        if (!ret)
+                hba->is_sys_suspended = false;
        return ret;
 }
 EXPORT_SYMBOL(ufshcd_system_resume);
diff --git a/drivers/soc/fsl/qe/qe_tdm.c b/drivers/soc/fsl/qe/qe_tdm.c
index f78c34647ca2..76480df195a8 100644
--- a/drivers/soc/fsl/qe/qe_tdm.c
+++ b/drivers/soc/fsl/qe/qe_tdm.c
@@ -44,10 +44,6 @@ int ucc_of_parse_tdm(struct device_node *np, struct ucc_tdm *utdm,
        const char *sprop;
        int ret = 0;
        u32 val;
-        struct resource *res;
-        struct device_node *np2;
-        static int siram_init_flag;
-        struct platform_device *pdev;
        sprop = of_get_property(np, "fsl,rx-sync-clock", NULL);
        if (sprop) {
@@ -124,57 +120,6 @@ int ucc_of_parse_tdm(struct device_node *np, struct ucc_tdm *utdm,
        utdm->siram_entry_id = val;
        set_si_param(utdm, ut_info);
-        np2 = of_find_compatible_node(NULL, NULL, "fsl,t1040-qe-si");
-        if (!np2)
-                return -EINVAL;
-        pdev = of_find_device_by_node(np2);
-        if (!pdev) {
-                pr_err("%pOFn: failed to lookup pdev\n", np2);
-                of_node_put(np2);
-                return -EINVAL;
-        }
-        of_node_put(np2);
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        utdm->si_regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(utdm->si_regs)) {
-                ret = PTR_ERR(utdm->si_regs);
-                goto err_miss_siram_property;
-        }
-        np2 = of_find_compatible_node(NULL, NULL, "fsl,t1040-qe-siram");
-        if (!np2) {
-                ret = -EINVAL;
-                goto err_miss_siram_property;
-        }
-        pdev = of_find_device_by_node(np2);
-        if (!pdev) {
-                ret = -EINVAL;
-                pr_err("%pOFn: failed to lookup pdev\n", np2);
-                of_node_put(np2);
-                goto err_miss_siram_property;
-        }
-        of_node_put(np2);
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        utdm->siram = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(utdm->siram)) {
-                ret = PTR_ERR(utdm->siram);
-                goto err_miss_siram_property;
-        }
-        if (siram_init_flag == 0) {
-                memset_io(utdm->siram, 0,  resource_size(res));
-                siram_init_flag = 1;
-        }
-        return ret;
-err_miss_siram_property:
-        devm_iounmap(&pdev->dev, utdm->si_regs);
        return ret;
 }
 EXPORT_SYMBOL(ucc_of_parse_tdm);
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a0802de8c3a1..6f5afab7c1a1 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -248,10 +248,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
        struct ion_dma_buf_attachment *a = attachment->priv;
        struct ion_buffer *buffer = dmabuf->priv;
-        free_duped_table(a->table);
        mutex_lock(&buffer->lock);
        list_del(&a->list);
        mutex_unlock(&buffer->lock);
+        free_duped_table(a->table);
        kfree(a);
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 28cbd6b3d26c..dfee6985efa6 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
        {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
        {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+        {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
        {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
        {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
        {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
index bcc8dfa8e672..9efb4dcb9d3a 100644
--- a/drivers/staging/rtl8723bs/include/ieee80211.h
+++ b/drivers/staging/rtl8723bs/include/ieee80211.h
@@ -850,18 +850,18 @@ enum ieee80211_state {
 #define IP_FMT "%pI4"
 #define IP_ARG(x) (x)
-extern __inline int is_multicast_mac_addr(const u8 *addr)
+static inline int is_multicast_mac_addr(const u8 *addr)
 {
        return ((addr[0] != 0xff) && (0x01 & addr[0]));
 }
-extern __inline int is_broadcast_mac_addr(const u8 *addr)
+static inline int is_broadcast_mac_addr(const u8 *addr)
 {
        return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
                (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
 }
-extern __inline int is_zero_mac_addr(const u8 *addr)
+static inline int is_zero_mac_addr(const u8 *addr)
 {
        return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
                (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
index 9e17ec651bde..53f5a1cb4636 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -446,6 +446,7 @@ remote_event_wait(wait_queue_head_t *wq, struct remote_event *event)
 static inline void
 remote_event_signal_local(wait_queue_head_t *wq, struct remote_event *event)
 {
+        event->fired = 1;
        event->armed = 0;
        wake_up_all(wq);
 }
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 70c854d939ce..3d0badc34825 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -36,7 +36,7 @@ struct wilc_op_mode {
 struct wilc_reg_frame {
        bool reg;
        u8 reg_id;
-        __le32 frame_type;
+        __le16 frame_type;
 } __packed;
 struct wilc_drv_handler {
@@ -1744,7 +1744,6 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                result = wilc_send_config_pkt(vif, WILC_SET_CFG, wid_list,
                                              ARRAY_SIZE(wid_list),
                                              wilc_get_vif_idx(vif));
-                kfree(gtk_key);
        } else if (mode == WILC_STATION_MODE) {
                struct wid wid;
@@ -1754,9 +1753,9 @@ int wilc_add_rx_gtk(struct wilc_vif *vif, const u8 *rx_gtk, u8 gtk_key_len,
                wid.val = (u8 *)gtk_key;
                result = wilc_send_config_pkt(vif, WILC_SET_CFG, &wid, 1,
                                              wilc_get_vif_idx(vif));
-                kfree(gtk_key);
        }
+        kfree(gtk_key);
        return result;
 }
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 3c5e9e030cad..489e5a5038f8 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1252,21 +1252,22 @@ static u32 init_chip(struct net_device *dev)
                ret = wilc->hif_func->hif_read_reg(wilc, 0x1118, &reg);
                if (!ret) {
                        netdev_err(dev, "fail read reg 0x1118\n");
-                        return ret;
+                        goto release;
                }
                reg |= BIT(0);
                ret = wilc->hif_func->hif_write_reg(wilc, 0x1118, reg);
                if (!ret) {
                        netdev_err(dev, "fail write reg 0x1118\n");
-                        return ret;
+                        goto release;
                }
                ret = wilc->hif_func->hif_write_reg(wilc, 0xc0000, 0x71);
                if (!ret) {
                        netdev_err(dev, "fail write reg 0xc0000\n");
-                        return ret;
+                        goto release;
                }
        }
+release:
        release_bus(wilc, WILC_BUS_RELEASE_ONLY);
        return ret;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 984941e036c8..bd15a564fe24 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -714,7 +714,7 @@ static int __init iscsi_target_init_module(void)
                        sizeof(struct iscsi_queue_req),
                        __alignof__(struct iscsi_queue_req), 0, NULL);
        if (!lio_qr_cache) {
-                pr_err("nable to kmem_cache_create() for"
+                pr_err("Unable to kmem_cache_create() for"
                                " lio_qr_cache\n");
                goto bitmap_out;
        }
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 1e6d24943565..5831e0eecea1 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -148,7 +148,7 @@ struct tcmu_dev {
        size_t ring_size;
        struct mutex cmdr_lock;
-        struct list_head cmdr_queue;
+        struct list_head qfull_queue;
        uint32_t dbi_max;
        uint32_t dbi_thresh;
@@ -159,6 +159,7 @@ struct tcmu_dev {
        struct timer_list cmd_timer;
        unsigned int cmd_time_out;
+        struct list_head inflight_queue;
        struct timer_list qfull_timer;
        int qfull_time_out;
@@ -179,7 +180,7 @@ struct tcmu_dev {
 struct tcmu_cmd {
        struct se_cmd *se_cmd;
        struct tcmu_dev *tcmu_dev;
-        struct list_head cmdr_queue_entry;
+        struct list_head queue_entry;
        uint16_t cmd_id;
@@ -192,6 +193,7 @@ struct tcmu_cmd {
        unsigned long deadline;
 #define TCMU_CMD_BIT_EXPIRED 0
+#define TCMU_CMD_BIT_INFLIGHT 1
        unsigned long flags;
 };
 /*
@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
        if (!tcmu_cmd)
                return NULL;
-        INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry);
+        INIT_LIST_HEAD(&tcmu_cmd->queue_entry);
        tcmu_cmd->se_cmd = se_cmd;
        tcmu_cmd->tcmu_dev = udev;
@@ -915,11 +917,13 @@ setup_timer:
                return 0;
        tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
-        mod_timer(timer, tcmu_cmd->deadline);
+        if (!timer_pending(timer))
+                mod_timer(timer, tcmu_cmd->deadline);
        return 0;
 }
-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
+static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
 {
        struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
        unsigned int tmo;
@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
        if (ret)
                return ret;
-        list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue);
+        list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
        pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
                 tcmu_cmd->cmd_id, udev->name);
        return 0;
@@ -999,7 +1003,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
        base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt);
        command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size);
-        if (!list_empty(&udev->cmdr_queue))
+        if (!list_empty(&udev->qfull_queue))
                goto queue;
        mb = udev->mb_addr;
@@ -1096,13 +1100,16 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
        UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
        tcmu_flush_dcache_range(mb, sizeof(*mb));
+        list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue);
+        set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags);
        /* TODO: only if FLUSH and FUA? */
        uio_event_notify(&udev->uio_info);
        return 0;
 queue:
-        if (add_to_cmdr_queue(tcmu_cmd)) {
+        if (add_to_qfull_queue(tcmu_cmd)) {
                *scsi_err = TCM_OUT_OF_RESOURCES;
                return -1;
        }
@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
                goto out;
+        list_del_init(&cmd->queue_entry);
        tcmu_cmd_reset_dbi_cur(cmd);
        if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) {
@@ -1194,9 +1203,29 @@ out:
        tcmu_free_cmd(cmd);
 }
+static void tcmu_set_next_deadline(struct list_head *queue,
+                                   struct timer_list *timer)
+{
+        struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+        unsigned long deadline = 0;
+        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) {
+                if (!time_after(jiffies, tcmu_cmd->deadline)) {
+                        deadline = tcmu_cmd->deadline;
+                        break;
+                }
+        }
+        if (deadline)
+                mod_timer(timer, deadline);
+        else
+                del_timer(timer);
+}
 static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
 {
        struct tcmu_mailbox *mb;
+        struct tcmu_cmd *cmd;
        int handled = 0;
        if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
        while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) {
                struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
-                struct tcmu_cmd *cmd;
                tcmu_flush_dcache_range(entry, sizeof(*entry));
@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
                /* no more pending commands */
                del_timer(&udev->cmd_timer);
-                if (list_empty(&udev->cmdr_queue)) {
+                if (list_empty(&udev->qfull_queue)) {
                        /*
                         * no more pending or waiting commands so try to
                         * reclaim blocks if needed.
@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
                            tcmu_global_max_blocks)
                                schedule_delayed_work(&tcmu_unmap_work, 0);
                }
+        } else if (udev->cmd_time_out) {
+                tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
        }
        return handled;
@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
        if (!time_after(jiffies, cmd->deadline))
                return 0;
-        is_running = list_empty(&cmd->cmdr_queue_entry);
+        is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
        se_cmd = cmd->se_cmd;
        if (is_running) {
@@ -1287,9 +1317,9 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
                 * target_complete_cmd will translate this to LUN COMM FAILURE
                 */
                scsi_status = SAM_STAT_CHECK_CONDITION;
+                list_del_init(&cmd->queue_entry);
        } else {
-                list_del_init(&cmd->cmdr_queue_entry);
+                list_del_init(&cmd->queue_entry);
                idr_remove(&udev->commands, id);
                tcmu_free_cmd(cmd);
                scsi_status = SAM_STAT_TASK_SET_FULL;
@@ -1372,7 +1402,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
        INIT_LIST_HEAD(&udev->node);
        INIT_LIST_HEAD(&udev->timedout_entry);
-        INIT_LIST_HEAD(&udev->cmdr_queue);
+        INIT_LIST_HEAD(&udev->qfull_queue);
+        INIT_LIST_HEAD(&udev->inflight_queue);
        idr_init(&udev->commands);
        timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0);
@@ -1383,7 +1414,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
        return &udev->se_dev;
 }
-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
 {
        struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
        LIST_HEAD(cmds);
@@ -1391,15 +1422,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
        sense_reason_t scsi_ret;
        int ret;
-        if (list_empty(&udev->cmdr_queue))
+        if (list_empty(&udev->qfull_queue))
                return true;
        pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
-        list_splice_init(&udev->cmdr_queue, &cmds);
+        list_splice_init(&udev->qfull_queue, &cmds);
-        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) {
+        list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
-                list_del_init(&tcmu_cmd->cmdr_queue_entry);
+                list_del_init(&tcmu_cmd->queue_entry);
                pr_debug("removing cmd %u on dev %s from queue\n",
                         tcmu_cmd->cmd_id, udev->name);
@@ -1437,14 +1468,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
                         * cmd was requeued, so just put all cmds back in
                         * the queue
                         */
-                        list_splice_tail(&cmds, &udev->cmdr_queue);
+                        list_splice_tail(&cmds, &udev->qfull_queue);
                        drained = false;
-                        goto done;
+                        break;
                }
        }
-        if (list_empty(&udev->cmdr_queue))
-                del_timer(&udev->qfull_timer);
+        tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
-done:
        return drained;
 }
@@ -1454,7 +1484,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
        mutex_lock(&udev->cmdr_lock);
        tcmu_handle_completions(udev);
-        run_cmdr_queue(udev, false);
+        run_qfull_queue(udev, false);
        mutex_unlock(&udev->cmdr_lock);
        return 0;
@@ -1982,7 +2012,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev)
        /* complete IO that has executed successfully */
        tcmu_handle_completions(udev);
        /* fail IO waiting to be queued */
-        run_cmdr_queue(udev, true);
+        run_qfull_queue(udev, true);
 unlock:
        mutex_unlock(&udev->cmdr_lock);
@@ -1997,7 +2027,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
        mutex_lock(&udev->cmdr_lock);
        idr_for_each_entry(&udev->commands, cmd, i) {
-                if (!list_empty(&cmd->cmdr_queue_entry))
+                if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
                        continue;
                pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
@@ -2006,6 +2036,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
                idr_remove(&udev->commands, i);
                if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+                        list_del_init(&cmd->queue_entry);
                        if (err_level == 1) {
                                /*
                                 * Userspace was not able to start the
@@ -2666,6 +2697,10 @@ static void check_timedout_devices(void)
                mutex_lock(&udev->cmdr_lock);
                idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
+                tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
+                tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
                mutex_unlock(&udev->cmdr_lock);
                spin_lock_bh(&timed_out_udevs_lock);
diff --git a/drivers/thermal/intel/int340x_thermal/Kconfig b/drivers/thermal/intel/int340x_thermal/Kconfig
index 0582bd12a239..0ca908d12750 100644
--- a/drivers/thermal/intel/int340x_thermal/Kconfig
+++ b/drivers/thermal/intel/int340x_thermal/Kconfig
@@ -4,7 +4,7 @@
 config INT340X_THERMAL
        tristate "ACPI INT340X thermal drivers"
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select THERMAL_GOV_USER_SPACE
        select ACPI_THERMAL_REL
        select ACPI_FAN
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 284cf2c5a8fd..8e1cf4d789be 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
        struct pci_dev *pci_dev; \
        struct platform_device *pdev; \
        struct proc_thermal_device *proc_dev; \
-\
+        \
+        if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
+                dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
+                return 0; \
+        } \
+        \
        if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
                pdev = to_platform_device(dev); \
                proc_dev = platform_get_drvdata(pdev); \
@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
        *priv = proc_priv;
        ret = proc_thermal_read_ppcc(proc_priv);
-        if (!ret) {
-                ret = sysfs_create_group(&dev->kobj,
-                                         &power_limit_attribute_group);
-        }
        if (ret)
                return ret;
@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
        proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
        if (IS_ERR(proc_priv->int340x_zone)) {
-                ret = PTR_ERR(proc_priv->int340x_zone);
+                return PTR_ERR(proc_priv->int340x_zone);
-                goto remove_group;
        } else
                ret = 0;
@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
 remove_zone:
        int340x_thermal_zone_remove(proc_priv->int340x_zone);
-remove_group:
-        sysfs_remove_group(&proc_priv->dev->kobj,
-                           &power_limit_attribute_group);
        return ret;
 }
@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
        platform_set_drvdata(pdev, proc_priv);
        proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 static int int3401_remove(struct platform_device *pdev)
@@ -423,7 +422,7 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                proc_priv->soc_dts = intel_soc_dts_iosf_init(
                                        INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
-                if (proc_priv->soc_dts && pdev->irq) {
+                if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
                        ret = pci_enable_msi(pdev);
                        if (!ret) {
                                ret = request_threaded_irq(pdev->irq, NULL,
@@ -441,7 +440,10 @@ static int  proc_thermal_pci_probe(struct pci_dev *pdev,
                        dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
        }
-        return 0;
+        dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
+        return sysfs_create_group(&pdev->dev.kobj,
+                                         &power_limit_attribute_group);
 }
 static void  proc_thermal_pci_remove(struct pci_dev *pdev)
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 4164414d4c64..8bdf42bc8fc8 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -597,6 +597,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                                /* too large for caller's buffer */
                                ret = -EOVERFLOW;
                        } else {
+                                __set_current_state(TASK_RUNNING);
                                if (copy_to_user(buf, rbuf->buf, rbuf->count))
                                        ret = -EFAULT;
                                else
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 189ab1212d9a..e441221e04b9 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1070,15 +1070,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                        ret = 0;
                }
-        }
-        /* Initialise interrupt backoff work if required */
+                /* Initialise interrupt backoff work if required */
-        if (up->overrun_backoff_time_ms > 0) {
+                if (up->overrun_backoff_time_ms > 0) {
-                uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
+                        uart->overrun_backoff_time_ms =
-                INIT_DELAYED_WORK(&uart->overrun_backoff,
+                                up->overrun_backoff_time_ms;
-                                  serial_8250_overrun_backoff_work);
+                        INIT_DELAYED_WORK(&uart->overrun_backoff,
-        } else {
+                                        serial_8250_overrun_backoff_work);
-                uart->overrun_backoff_time_ms = 0;
+                } else {
+                        uart->overrun_backoff_time_ms = 0;
+                }
        }
        mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 241a48e5052c..debdd1b9e01a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
        }
        /* ask the core to calculate the divisor */
-        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+        baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
        spin_lock_irqsave(&sport->port.lock, flags);
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index a72d6d9fb983..38016609c7fa 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -225,7 +225,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
        unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
        u32 geni_ios;
-        if (uart_console(uport) || !uart_cts_enabled(uport)) {
+        if (uart_console(uport)) {
                mctrl |= TIOCM_CTS;
        } else {
                geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
@@ -241,7 +241,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
 {
        u32 uart_manual_rfr = 0;
-        if (uart_console(uport) || !uart_cts_enabled(uport))
+        if (uart_console(uport))
                return;
        if (!(mctrl & TIOCM_RTS))
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index d4cca5bdaf1c..5c01bb6d1c24 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -550,10 +550,12 @@ static int uart_put_char(struct tty_struct *tty, unsigned char c)
        int ret = 0;
        circ = &state->xmit;
-        if (!circ->buf)
+        port = uart_port_lock(state, flags);
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                return 0;
+        }
-        port = uart_port_lock(state, flags);
        if (port && uart_circ_chars_free(circ) != 0) {
                circ->buf[circ->head] = c;
                circ->head = (circ->head + 1) & (UART_XMIT_SIZE - 1);
@@ -586,11 +588,13 @@ static int uart_write(struct tty_struct *tty,
                return -EL3HLT;
        }
+        port = uart_port_lock(state, flags);
        circ = &state->xmit;
-        if (!circ->buf)
+        if (!circ->buf) {
+                uart_port_unlock(port, flags);
                return 0;
+        }
-        port = uart_port_lock(state, flags);
        while (port) {
                c = CIRC_SPACE_TO_END(circ->head, circ->tail, UART_XMIT_SIZE);
                if (count < c)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 23c6fd238422..21ffcce16927 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2189,7 +2189,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
        ld = tty_ldisc_ref_wait(tty);
        if (!ld)
                return -EIO;
-        ld->ops->receive_buf(tty, &ch, &mbz, 1);
+        if (ld->ops->receive_buf)
+                ld->ops->receive_buf(tty, &ch, &mbz, 1);
        tty_ldisc_deref(ld);
        return 0;
 }
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 41ec8e5010f3..bba75560d11e 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1272,6 +1272,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
        if (con_is_visible(vc))
                update_screen(vc);
        vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
+        notify_update(vc);
        return err;
 }
@@ -2764,8 +2765,8 @@ rescan_last_byte:
        con_flush(vc, draw_from, draw_to, &draw_x);
        vc_uniscr_debug_check(vc);
        console_conditional_schedule();
-        console_unlock();
        notify_update(vc);
+        console_unlock();
        return n;
 }
@@ -2884,8 +2885,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
        unsigned char c;
        static DEFINE_SPINLOCK(printing_lock);
        const ushort *start;
-        ushort cnt = 0;
+        ushort start_x, cnt;
-        ushort myx;
        int kmsg_console;
        /* console busy or not yet initialized */
@@ -2898,10 +2898,6 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
        if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
                vc = vc_cons[kmsg_console - 1].d;
-        /* read `x' only after setting currcons properly (otherwise
-           the `x' macro will read the x of the foreground console). */
-        myx = vc->vc_x;
        if (!vc_cons_allocated(fg_console)) {
                /* impossible */
                /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
@@ -2916,53 +2912,41 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
                hide_cursor(vc);
        start = (ushort *)vc->vc_pos;
+        start_x = vc->vc_x;
-        /* Contrived structure to try to emulate original need_wrap behaviour
+        cnt = 0;
-         * Problems caused when we have need_wrap set on '\n' character */
        while (count--) {
                c = *b++;
                if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) {
-                        if (cnt > 0) {
+                        if (cnt && con_is_visible(vc))
-                                if (con_is_visible(vc))
+                                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
-                                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
+                        cnt = 0;
-                                vc->vc_x += cnt;
-                                if (vc->vc_need_wrap)
-                                        vc->vc_x--;
-                                cnt = 0;
-                        }
                        if (c == 8) {           /* backspace */
                                bs(vc);
                                start = (ushort *)vc->vc_pos;
-                                myx = vc->vc_x;
+                                start_x = vc->vc_x;
                                continue;
                        }
                        if (c != 13)
                                lf(vc);
                        cr(vc);
                        start = (ushort *)vc->vc_pos;
-                        myx = vc->vc_x;
+                        start_x = vc->vc_x;
                        if (c == 10 || c == 13)
                                continue;
                }
+                vc_uniscr_putc(vc, c);
                scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
                notify_write(vc, c);
                cnt++;
-                if (myx == vc->vc_cols - 1) {
+                if (vc->vc_x == vc->vc_cols - 1) {
-                        vc->vc_need_wrap = 1;
-                        continue;
-                }
-                vc->vc_pos += 2;
-                myx++;
-        }
-        if (cnt > 0) {
-                if (con_is_visible(vc))
-                        vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
-                vc->vc_x += cnt;
-                if (vc->vc_x == vc->vc_cols) {
-                        vc->vc_x--;
                        vc->vc_need_wrap = 1;
+                } else {
+                        vc->vc_pos += 2;
+                        vc->vc_x++;
                }
        }
+        if (cnt && con_is_visible(vc))
+                vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
        set_cursor(vc);
        notify_update(vc);
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index e81de9ca8729..9b45aa422e69 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -316,7 +316,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
        if (IS_ERR(data->usbmisc_data))
                return PTR_ERR(data->usbmisc_data);
-        if (of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC) {
+        if ((of_usb_get_phy_mode(dev->of_node) == USBPHY_INTERFACE_MODE_HSIC)
+                && data->usbmisc_data) {
                pdata.flags |= CI_HDRC_IMX_IS_HSIC;
                data->usbmisc_data->hsic = 1;
                data->pinctrl = devm_pinctrl_get(dev);
diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c
index dc7f7fd71684..c12ac56606c3 100644
--- a/drivers/usb/core/ledtrig-usbport.c
+++ b/drivers/usb/core/ledtrig-usbport.c
@@ -119,11 +119,6 @@ static const struct attribute_group ports_group = {
        .attrs = ports_attrs,
 };
-static const struct attribute_group *ports_groups[] = {
-        &ports_group,
-        NULL
-};
 /***************************************
 * Adding & removing ports
 ***************************************/
@@ -307,6 +302,7 @@ static int usbport_trig_notify(struct notifier_block *nb, unsigned long action,
 static int usbport_trig_activate(struct led_classdev *led_cdev)
 {
        struct usbport_trig_data *usbport_data;
+        int err;
        usbport_data = kzalloc(sizeof(*usbport_data), GFP_KERNEL);
        if (!usbport_data)
@@ -315,6 +311,9 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
        /* List of ports */
        INIT_LIST_HEAD(&usbport_data->ports);
+        err = sysfs_create_group(&led_cdev->dev->kobj, &ports_group);
+        if (err)
+                goto err_free;
        usb_for_each_dev(usbport_data, usbport_trig_add_usb_dev_ports);
        usbport_trig_update_count(usbport_data);
@@ -322,8 +321,11 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
        usbport_data->nb.notifier_call = usbport_trig_notify;
        led_set_trigger_data(led_cdev, usbport_data);
        usb_register_notify(&usbport_data->nb);
        return 0;
+err_free:
+        kfree(usbport_data);
+        return err;
 }
 static void usbport_trig_deactivate(struct led_classdev *led_cdev)
@@ -335,6 +337,8 @@ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
                usbport_trig_remove_port(usbport_data, port);
        }
+        sysfs_remove_group(&led_cdev->dev->kobj, &ports_group);
        usb_unregister_notify(&usbport_data->nb);
        kfree(usbport_data);
@@ -344,7 +348,6 @@ static struct led_trigger usbport_led_trigger = {
        .name     = "usbport",
        .activate = usbport_trig_activate,
        .deactivate = usbport_trig_deactivate,
-        .groups = ports_groups,
 };
 static int __init usbport_trig_init(void)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 68ad75a7460d..55ef3cc2701b 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -261,7 +261,7 @@ static void dwc2_gadget_wkup_alert_handler(struct dwc2_hsotg *hsotg)
        if (gintsts2 & GINTSTS2_WKUP_ALERT_INT) {
                dev_dbg(hsotg->dev, "%s: Wkup_Alert_Int\n", __func__);
-                dwc2_clear_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
+                dwc2_set_bit(hsotg, GINTSTS2, GINTSTS2_WKUP_ALERT_INT);
                dwc2_set_bit(hsotg, DCTL, DCTL_RMTWKUPSIG);
        }
 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 07bd31bb2f8a..bed2ff42780b 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -177,6 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
        req->started = false;
        list_del(&req->list);
        req->remaining = 0;
+        req->needs_extra_trb = false;
        if (req->request.status == -EINPROGRESS)
                req->request.status = status;
@@ -1984,6 +1985,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
        /* begin to receive SETUP packets */
        dwc->ep0state = EP0_SETUP_PHASE;
+        dwc->link_state = DWC3_LINK_STATE_SS_DIS;
        dwc3_ep0_out_start(dwc);
        dwc3_gadget_enable_irq(dwc);
@@ -3379,6 +3381,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
        dwc3_disconnect_gadget(dwc);
        __dwc3_gadget_stop(dwc);
+        synchronize_irq(dwc->irq_gadget);
        return 0;
 }
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index 9cdef108fb1b..ed68a4860b7d 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
        ss = kzalloc(sizeof(*ss), GFP_KERNEL);
        if (!ss)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        ss_opts =  container_of(fi, struct f_ss_opts, func_inst);
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f26109eafdbf..66ec1fdf9fe7 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -302,3 +302,4 @@ MODULE_AUTHOR("Chao Xie <chao.xie@marvell.com>");
 MODULE_AUTHOR("Neil Zhang <zhangwm@marvell.com>");
 MODULE_ALIAS("mv-ehci");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ehci_mv_dt_ids);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ab2a6191013..77ef4c481f3c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1783,6 +1783,10 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
        int result;
        u16 val;
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
        val = (mode << 8) | (priv->gpio_output << 4) | priv->gpio_value;
        result = usb_control_msg(serial->dev,
                                 usb_sndctrlpipe(serial->dev, 0),
@@ -1795,6 +1799,8 @@ static int ftdi_set_bitmode(struct usb_serial_port *port, u8 mode)
                        val, result);
        }
+        usb_autopm_put_interface(serial->interface);
        return result;
 }
@@ -1846,9 +1852,15 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
        unsigned char *buf;
        int result;
+        result = usb_autopm_get_interface(serial->interface);
+        if (result)
+                return result;
        buf = kmalloc(1, GFP_KERNEL);
-        if (!buf)
+        if (!buf) {
+                usb_autopm_put_interface(serial->interface);
                return -ENOMEM;
+        }
        result = usb_control_msg(serial->dev,
                                 usb_rcvctrlpipe(serial->dev, 0),
@@ -1863,6 +1875,7 @@ static int ftdi_read_cbus_pins(struct usb_serial_port *port)
        }
        kfree(buf);
+        usb_autopm_put_interface(serial->interface);
        return result;
 }
diff --git a/drivers/usb/serial/keyspan_usa26msg.h b/drivers/usb/serial/keyspan_usa26msg.h
index 09e21e84fc4e..a68f1fb25b8a 100644
--- a/drivers/usb/serial/keyspan_usa26msg.h
+++ b/drivers/usb/serial/keyspan_usa26msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa26msg.h
diff --git a/drivers/usb/serial/keyspan_usa28msg.h b/drivers/usb/serial/keyspan_usa28msg.h
index dee454c4609a..a19f3fe5d98d 100644
--- a/drivers/usb/serial/keyspan_usa28msg.h
+++ b/drivers/usb/serial/keyspan_usa28msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa28msg.h
diff --git a/drivers/usb/serial/keyspan_usa49msg.h b/drivers/usb/serial/keyspan_usa49msg.h
index 163b2dea2ec5..8c3970fdd868 100644
--- a/drivers/usb/serial/keyspan_usa49msg.h
+++ b/drivers/usb/serial/keyspan_usa49msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa49msg.h
diff --git a/drivers/usb/serial/keyspan_usa67msg.h b/drivers/usb/serial/keyspan_usa67msg.h
index 20fa3e2f7187..dcf502fdbb44 100644
--- a/drivers/usb/serial/keyspan_usa67msg.h
+++ b/drivers/usb/serial/keyspan_usa67msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa67msg.h
diff --git a/drivers/usb/serial/keyspan_usa90msg.h b/drivers/usb/serial/keyspan_usa90msg.h
index 86708ecd8735..c4ca0f631d20 100644
--- a/drivers/usb/serial/keyspan_usa90msg.h
+++ b/drivers/usb/serial/keyspan_usa90msg.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
 /*
        usa90msg.h
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 98e7a5df0f6d..bb3f9aa4a909 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -46,6 +46,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 4e2554d55362..559941ca884d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -8,6 +8,7 @@
 #define PL2303_VENDOR_ID        0x067b
 #define PL2303_PRODUCT_ID       0x2303
+#define PL2303_PRODUCT_ID_TB            0x2304
 #define PL2303_PRODUCT_ID_RSAQ2         0x04bb
 #define PL2303_PRODUCT_ID_DCU11         0x1234
 #define PL2303_PRODUCT_ID_PHAROS        0xaaa0
@@ -20,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 #define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4d0273508043..edbbb13d6de6 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -85,7 +85,8 @@ DEVICE(moto_modem, MOTO_IDS);
 /* Motorola Tetra driver */
 #define MOTOROLA_TETRA_IDS()                    \
        { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
-        { USB_DEVICE(0x0cad, 0x9012) }  /* MTP6550 */
+        { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
+        { USB_DEVICE(0x0cad, 0x9016) }  /* TPG2200 */
 DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
 /* Novatel Wireless GPS driver */
diff --git a/drivers/usb/usbip/README b/drivers/usb/usbip/README
deleted file mode 100644
index 41a2cf2e77a6..000000000000
--- a/drivers/usb/usbip/README
+++ /dev/null
@@ -1,7 +0,0 @@
-TODO:
-        - more discussion about the protocol
-        - testing
-        - review of the userspace interface
-        - document the protocol
-Please send patches for this code to Greg Kroah-Hartman <greg@kroah.com>
diff --git a/drivers/vfio/pci/trace.h b/drivers/vfio/pci/trace.h
index 4d13e510590e..b2aa986ab9ed 100644
--- a/drivers/vfio/pci/trace.h
+++ b/drivers/vfio/pci/trace.h
@@ -1,13 +1,9 @@
-/* SPDX-License-Identifier: GPL-2.0+ */
+/* SPDX-License-Identifier: GPL-2.0-only */
 /*
 * VFIO PCI mmap/mmap_fault tracepoints
 *
 * Copyright (C) 2018 IBM Corp.  All rights reserved.
 *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
 */
 #undef TRACE_SYSTEM
diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
index 054a2cf9dd8e..32f695ffe128 100644
--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
+++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
@@ -1,14 +1,10 @@
-// SPDX-License-Identifier: GPL-2.0+
+// SPDX-License-Identifier: GPL-2.0-only
 /*
 * VFIO PCI NVIDIA Whitherspoon GPU support a.k.a. NVLink2.
 *
 * Copyright (C) 2018 IBM Corp.  All rights reserved.
 *     Author: Alexey Kardashevskiy <aik@ozlabs.ru>
 *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
 * Register an on-GPU RAM region for cacheable access.
 *
 * Derived from original vfio_pci_igd.c:
@@ -178,11 +174,11 @@ static int vfio_pci_nvgpu_add_capability(struct vfio_pci_device *vdev,
                struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
        struct vfio_pci_nvgpu_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt cap = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt cap = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
-        cap.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
+                .header.version = 1,
-        cap.header.version = 1;
+                .tgt = data->gpu_tgt
-        cap.tgt = data->gpu_tgt;
+        };
        return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
 }
@@ -365,18 +361,18 @@ static int vfio_pci_npu2_add_capability(struct vfio_pci_device *vdev,
                struct vfio_pci_region *region, struct vfio_info_cap *caps)
 {
        struct vfio_pci_npu2_data *data = region->data;
-        struct vfio_region_info_cap_nvlink2_ssatgt captgt = { 0 };
+        struct vfio_region_info_cap_nvlink2_ssatgt captgt = {
-        struct vfio_region_info_cap_nvlink2_lnkspd capspd = { 0 };
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT,
+                .header.version = 1,
+                .tgt = data->gpu_tgt
+        };
+        struct vfio_region_info_cap_nvlink2_lnkspd capspd = {
+                .header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD,
+                .header.version = 1,
+                .link_speed = data->link_speed
+        };
        int ret;
-        captgt.header.id = VFIO_REGION_INFO_CAP_NVLINK2_SSATGT;
-        captgt.header.version = 1;
-        captgt.tgt = data->gpu_tgt;
-        capspd.header.id = VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD;
-        capspd.header.version = 1;
-        capspd.link_speed = data->link_speed;
        ret = vfio_info_add_capability(caps, &captgt.header, sizeof(captgt));
        if (ret)
                return ret;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 36f3d0f49e60..bca86bf7189f 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1236,7 +1236,8 @@ static void handle_rx(struct vhost_net *net)
                if (nvq->done_idx > VHOST_NET_BATCH)
                        vhost_net_signal_used(nvq);
                if (unlikely(vq_log))
-                        vhost_log_write(vq, vq_log, log, vhost_len);
+                        vhost_log_write(vq, vq_log, log, vhost_len,
+                                        vq->iov, in);
                total_len += vhost_len;
                if (unlikely(vhost_exceeds_weight(++recv_pkts, total_len))) {
                        vhost_poll_queue(&vq->poll);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8e10ab436d1f..344684f3e2e4 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1127,16 +1127,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs,
                           struct vhost_virtqueue *vq,
                           struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_tmf_resp __user *resp;
        struct virtio_scsi_ctrl_tmf_resp rsp;
+        struct iov_iter iov_iter;
        int ret;
        pr_debug("%s\n", __func__);
        memset(&rsp, 0, sizeof(rsp));
        rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
-        if (!ret)
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
        else
                pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
@@ -1147,16 +1149,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
                        struct vhost_virtqueue *vq,
                        struct vhost_scsi_ctx *vc)
 {
-        struct virtio_scsi_ctrl_an_resp __user *resp;
        struct virtio_scsi_ctrl_an_resp rsp;
+        struct iov_iter iov_iter;
        int ret;
        pr_debug("%s\n", __func__);
        memset(&rsp, 0, sizeof(rsp));   /* event_actual = 0 */
        rsp.response = VIRTIO_SCSI_S_OK;
-        resp = vq->iov[vc->out].iov_base;
-        ret = __copy_to_user(resp, &rsp, sizeof(rsp));
+        iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
-        if (!ret)
+        ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
+        if (likely(ret == sizeof(rsp)))
                vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
        else
                pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 9f7942cbcbb2..15a216cdd507 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1034,8 +1034,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
        int type, ret;
        ret = copy_from_iter(&type, sizeof(type), from);
-        if (ret != sizeof(type))
+        if (ret != sizeof(type)) {
+                ret = -EINVAL;
                goto done;
+        }
        switch (type) {
        case VHOST_IOTLB_MSG:
@@ -1054,8 +1056,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
        iov_iter_advance(from, offset);
        ret = copy_from_iter(&msg, sizeof(msg), from);
-        if (ret != sizeof(msg))
+        if (ret != sizeof(msg)) {
+                ret = -EINVAL;
                goto done;
+        }
        if (vhost_process_iotlb_msg(dev, &msg)) {
                ret = -EFAULT;
                goto done;
@@ -1733,13 +1737,87 @@ static int log_write(void __user *log_base,
        return r;
 }
+static int log_write_hva(struct vhost_virtqueue *vq, u64 hva, u64 len)
+{
+        struct vhost_umem *umem = vq->umem;
+        struct vhost_umem_node *u;
+        u64 start, end, l, min;
+        int r;
+        bool hit = false;
+        while (len) {
+                min = len;
+                /* More than one GPAs can be mapped into a single HVA. So
+                 * iterate all possible umems here to be safe.
+                 */
+                list_for_each_entry(u, &umem->umem_list, link) {
+                        if (u->userspace_addr > hva - 1 + len ||
+                            u->userspace_addr - 1 + u->size < hva)
+                                continue;
+                        start = max(u->userspace_addr, hva);
+                        end = min(u->userspace_addr - 1 + u->size,
+                                  hva - 1 + len);
+                        l = end - start + 1;
+                        r = log_write(vq->log_base,
+                                      u->start + start - u->userspace_addr,
+                                      l);
+                        if (r < 0)
+                                return r;
+                        hit = true;
+                        min = min(l, min);
+                }
+                if (!hit)
+                        return -EFAULT;
+                len -= min;
+                hva += min;
+        }
+        return 0;
+}
+static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
+{
+        struct iovec iov[64];
+        int i, ret;
+        if (!vq->iotlb)
+                return log_write(vq->log_base, vq->log_addr + used_offset, len);
+        ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
+                             len, iov, 64, VHOST_ACCESS_WO);
+        if (ret)
+                return ret;
+        for (i = 0; i < ret; i++) {
+                ret = log_write_hva(vq, (uintptr_t)iov[i].iov_base,
+                                    iov[i].iov_len);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
 int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
-                    unsigned int log_num, u64 len)
+                    unsigned int log_num, u64 len, struct iovec *iov, int count)
 {
        int i, r;
        /* Make sure data written is seen before log. */
        smp_wmb();
+        if (vq->iotlb) {
+                for (i = 0; i < count; i++) {
+                        r = log_write_hva(vq, (uintptr_t)iov[i].iov_base,
+                                          iov[i].iov_len);
+                        if (r < 0)
+                                return r;
+                }
+                return 0;
+        }
        for (i = 0; i < log_num; ++i) {
                u64 l = min(log[i].len, len);
                r = log_write(vq->log_base, log[i].addr, l);
@@ -1769,9 +1847,8 @@ static int vhost_update_used_flags(struct vhost_virtqueue *vq)
                smp_wmb();
                /* Log used flag write. */
                used = &vq->used->flags;
-                log_write(vq->log_base, vq->log_addr +
+                log_used(vq, (used - (void __user *)vq->used),
-                          (used - (void __user *)vq->used),
+                         sizeof vq->used->flags);
-                          sizeof vq->used->flags);
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx, 1);
        }
@@ -1789,9 +1866,8 @@ static int vhost_update_avail_event(struct vhost_virtqueue *vq, u16 avail_event)
                smp_wmb();
                /* Log avail event write */
                used = vhost_avail_event(vq);
-                log_write(vq->log_base, vq->log_addr +
+                log_used(vq, (used - (void __user *)vq->used),
-                          (used - (void __user *)vq->used),
+                         sizeof *vhost_avail_event(vq));
-                          sizeof *vhost_avail_event(vq));
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx, 1);
        }
@@ -2191,10 +2267,8 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
                /* Make sure data is seen before log. */
                smp_wmb();
                /* Log used ring entry write. */
-                log_write(vq->log_base,
+                log_used(vq, ((void __user *)used - (void __user *)vq->used),
-                          vq->log_addr +
+                         count * sizeof *used);
-                           ((void __user *)used - (void __user *)vq->used),
-                          count * sizeof *used);
        }
        old = vq->last_used_idx;
        new = (vq->last_used_idx += count);
@@ -2236,9 +2310,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
                /* Make sure used idx is seen before log. */
                smp_wmb();
                /* Log used index update. */
-                log_write(vq->log_base,
+                log_used(vq, offsetof(struct vring_used, idx),
-                          vq->log_addr + offsetof(struct vring_used, idx),
+                         sizeof vq->used->idx);
-                          sizeof vq->used->idx);
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx, 1);
        }
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 466ef7542291..1b675dad5e05 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -205,7 +205,8 @@ bool vhost_vq_avail_empty(struct vhost_dev *, struct vhost_virtqueue *);
 bool vhost_enable_notify(struct vhost_dev *, struct vhost_virtqueue *);
 int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
-                    unsigned int log_num, u64 len);
+                    unsigned int log_num, u64 len,
+                    struct iovec *iov, int count);
 int vq_iotlb_prefetch(struct vhost_virtqueue *vq);
 struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index bc42d38ae031..3fbc068eaa9b 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
                hash_del_rcu(&vsock->hash);
        vsock->guest_cid = guest_cid;
-        hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
+        hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid);
        mutex_unlock(&vhost_vsock_mutex);
        return 0;
diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
index 6d8dc2c77520..51e0c4be08df 100644
--- a/drivers/video/backlight/88pm860x_bl.c
+++ b/drivers/video/backlight/88pm860x_bl.c
@@ -174,7 +174,7 @@ static int pm860x_backlight_dt_init(struct platform_device *pdev,
                return -ENODEV;
        }
        for_each_child_of_node(nproot, np) {
-                if (!of_node_cmp(np->name, name)) {
+                if (of_node_name_eq(np, name)) {
                        of_property_read_u32(np, "marvell,88pm860x-iset",
                                             &iset);
                        data->iset = PM8606_WLED_CURRENT(iset);
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index f9ef0673a083..feb90764a811 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -30,6 +30,7 @@ struct pwm_bl_data {
        struct device           *dev;
        unsigned int            lth_brightness;
        unsigned int            *levels;
+        bool                    enabled;
        struct regulator        *power_supply;
        struct gpio_desc        *enable_gpio;
        unsigned int            scale;
@@ -50,7 +51,7 @@ static void pwm_backlight_power_on(struct pwm_bl_data *pb)
        int err;
        pwm_get_state(pb->pwm, &state);
-        if (state.enabled)
+        if (pb->enabled)
                return;
        err = regulator_enable(pb->power_supply);
@@ -65,6 +66,8 @@ static void pwm_backlight_power_on(struct pwm_bl_data *pb)
        if (pb->enable_gpio)
                gpiod_set_value_cansleep(pb->enable_gpio, 1);
+        pb->enabled = true;
 }
 static void pwm_backlight_power_off(struct pwm_bl_data *pb)
@@ -72,7 +75,7 @@ static void pwm_backlight_power_off(struct pwm_bl_data *pb)
        struct pwm_state state;
        pwm_get_state(pb->pwm, &state);
-        if (!state.enabled)
+        if (!pb->enabled)
                return;
        if (pb->enable_gpio)
@@ -86,6 +89,7 @@ static void pwm_backlight_power_off(struct pwm_bl_data *pb)
        pwm_apply_state(pb->pwm, &state);
        regulator_disable(pb->power_supply);
+        pb->enabled = false;
 }
 static int compute_duty_cycle(struct pwm_bl_data *pb, int brightness)
@@ -269,6 +273,16 @@ static int pwm_backlight_parse_dt(struct device *dev,
        memset(data, 0, sizeof(*data));
        /*
+         * These values are optional and set as 0 by default, the out values
+         * are modified only if a valid u32 value can be decoded.
+         */
+        of_property_read_u32(node, "post-pwm-on-delay-ms",
+                             &data->post_pwm_on_delay);
+        of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
+        data->enable_gpio = -EINVAL;
+        /*
         * Determine the number of brightness levels, if this property is not
         * set a default table of brightness levels will be used.
         */
@@ -380,15 +394,6 @@ static int pwm_backlight_parse_dt(struct device *dev,
                data->max_brightness--;
        }
-        /*
-         * These values are optional and set as 0 by default, the out values
-         * are modified only if a valid u32 value can be decoded.
-         */
-        of_property_read_u32(node, "post-pwm-on-delay-ms",
-                             &data->post_pwm_on_delay);
-        of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
-        data->enable_gpio = -EINVAL;
        return 0;
 }
@@ -483,6 +488,7 @@ static int pwm_backlight_probe(struct platform_device *pdev)
        pb->check_fb = data->check_fb;
        pb->exit = data->exit;
        pb->dev = &pdev->dev;
+        pb->enabled = false;
        pb->post_pwm_on_delay = data->post_pwm_on_delay;
        pb->pwm_off_delay = data->pwm_off_delay;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 09731b2f6815..c6b3bdbbdbc9 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -271,6 +271,7 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 static void vgacon_restore_screen(struct vc_data *c)
 {
+        c->vc_origin = c->vc_visible_origin;
        vgacon_scrollback_cur->save = 0;
        if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
@@ -287,8 +288,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
        int start, end, count, soff;
        if (!lines) {
-                c->vc_visible_origin = c->vc_origin;
+                vgacon_restore_screen(c);
-                vga_set_mem_top(c);
                return;
        }
@@ -298,6 +298,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
        if (!vgacon_scrollback_cur->save) {
                vgacon_cursor(c, CM_ERASE);
                vgacon_save_screen(c);
+                c->vc_origin = (unsigned long)c->vc_screenbuf;
                vgacon_scrollback_cur->save = 1;
        }
@@ -335,7 +336,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
                int copysize;
                int diff = c->vc_rows - count;
-                void *d = (void *) c->vc_origin;
+                void *d = (void *) c->vc_visible_origin;
                void *s = (void *) c->vc_screenbuf;
                count *= c->vc_size_row;
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8976190b6c1f..bfa1360ec750 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -510,6 +510,13 @@ static int __init fb_console_setup(char *this_opt)
                        continue;
                }
 #endif
+                if (!strncmp(options, "logo-pos:", 9)) {
+                        options += 9;
+                        if (!strcmp(options, "center"))
+                                fb_center_logo = true;
+                        continue;
+                }
        }
        return 1;
 }
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 558ed2ed3124..cb43a2258c51 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL(registered_fb);
 int num_registered_fb __read_mostly;
 EXPORT_SYMBOL(num_registered_fb);
+bool fb_center_logo __read_mostly;
+EXPORT_SYMBOL(fb_center_logo);
 static struct fb_info *get_fb_info(unsigned int idx)
 {
        struct fb_info *fb_info;
@@ -506,8 +509,7 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
                fb_set_logo(info, logo, logo_new, fb_logo.depth);
        }
-#ifdef CONFIG_FB_LOGO_CENTER
+        if (fb_center_logo) {
-        {
                int xres = info->var.xres;
                int yres = info->var.yres;
@@ -520,11 +522,11 @@ static int fb_show_logo_line(struct fb_info *info, int rotate,
                        --n;
                image.dx = (xres - n * (logo->width + 8) - 8) / 2;
                image.dy = y ?: (yres - logo->height) / 2;
+        } else {
+                image.dx = 0;
+                image.dy = y;
        }
-#else
-        image.dx = 0;
-        image.dy = y;
-#endif
        image.width = logo->width;
        image.height = logo->height;
@@ -684,9 +686,8 @@ int fb_prepare_logo(struct fb_info *info, int rotate)
        }
        height = fb_logo.logo->height;
-#ifdef CONFIG_FB_LOGO_CENTER
+        if (fb_center_logo)
-        height += (yres - fb_logo.logo->height) / 2;
+                height += (yres - fb_logo.logo->height) / 2;
-#endif
        return fb_prepare_extra_logos(info, height, yres);
 }
diff --git a/drivers/video/fbdev/offb.c b/drivers/video/fbdev/offb.c
index 31f769d67195..057d3cdef92e 100644
--- a/drivers/video/fbdev/offb.c
+++ b/drivers/video/fbdev/offb.c
@@ -318,28 +318,28 @@ static void __iomem *offb_map_reg(struct device_node *np, int index,
 }
 static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp,
-                                    const char *name, unsigned long address)
+                                    unsigned long address)
 {
        struct offb_par *par = (struct offb_par *) info->par;
-        if (dp && !strncmp(name, "ATY,Rage128", 11)) {
+        if (of_node_name_prefix(dp, "ATY,Rage128")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_r128;
-        } else if (dp && (!strncmp(name, "ATY,RageM3pA", 12)
+        } else if (of_node_name_prefix(dp, "ATY,RageM3pA") ||
-                          || !strncmp(name, "ATY,RageM3p12A", 14))) {
+                   of_node_name_prefix(dp, "ATY,RageM3p12A")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_M3A;
-        } else if (dp && !strncmp(name, "ATY,RageM3pB", 12)) {
+        } else if (of_node_name_prefix(dp, "ATY,RageM3pB")) {
                par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_M3B;
-        } else if (dp && !strncmp(name, "ATY,Rage6", 9)) {
+        } else if (of_node_name_prefix(dp, "ATY,Rage6")) {
                par->cmap_adr = offb_map_reg(dp, 1, 0, 0x1fff);
                if (par->cmap_adr)
                        par->cmap_type = cmap_radeon;
-        } else if (!strncmp(name, "ATY,", 4)) {
+        } else if (of_node_name_prefix(dp, "ATY,")) {
                unsigned long base = address & 0xff000000UL;
                par->cmap_adr =
                        ioremap(base + 0x7ff000, 0x1000) + 0xcc0;
@@ -350,7 +350,7 @@ static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp
                par->cmap_adr = offb_map_reg(dp, 0, 0x6000, 0x1000);
                if (par->cmap_adr)
                        par->cmap_type = cmap_gxt2000;
-        } else if (dp && !strncmp(name, "vga,Display-", 12)) {
+        } else if (of_node_name_prefix(dp, "vga,Display-")) {
                /* Look for AVIVO initialized by SLOF */
                struct device_node *pciparent = of_get_parent(dp);
                const u32 *vid, *did;
@@ -438,7 +438,7 @@ static void __init offb_init_fb(const char *name,
        par->cmap_type = cmap_unknown;
        if (depth == 8)
-                offb_init_palette_hacks(info, dp, name, address);
+                offb_init_palette_hacks(info, dp, address);
        else
                fix->visual = FB_VISUAL_TRUECOLOR;
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
index 53f93616c671..8e23160ec59f 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
@@ -609,6 +609,8 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg)
        int r = 0;
+        memset(&p, 0, sizeof(p));
        switch (cmd) {
        case OMAPFB_SYNC_GFX:
                DBG("ioctl SYNC_GFX\n");
diff --git a/drivers/video/logo/Kconfig b/drivers/video/logo/Kconfig
index 1e972c4e88b1..d1f6196c8b9a 100644
--- a/drivers/video/logo/Kconfig
+++ b/drivers/video/logo/Kconfig
@@ -10,15 +10,6 @@ menuconfig LOGO
 if LOGO
-config FB_LOGO_CENTER
-        bool "Center the logo"
-        depends on FB=y
-        help
-          When this option is selected, the bootup logo is centered both
-          horizontally and vertically. If more than one logo is displayed
-          due to multiple CPUs, the collected line of logos is centered
-          as a whole.
 config FB_LOGO_EXTRA
        bool
        depends on FB=y
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 728ecd1eea30..fb12fe205f86 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -61,6 +61,10 @@ enum virtio_balloon_vq {
        VIRTIO_BALLOON_VQ_MAX
 };
+enum virtio_balloon_config_read {
+        VIRTIO_BALLOON_CONFIG_READ_CMD_ID = 0,
+};
 struct virtio_balloon {
        struct virtio_device *vdev;
        struct virtqueue *inflate_vq, *deflate_vq, *stats_vq, *free_page_vq;
@@ -77,14 +81,20 @@ struct virtio_balloon {
        /* Prevent updating balloon when it is being canceled. */
        spinlock_t stop_update_lock;
        bool stop_update;
+        /* Bitmap to indicate if reading the related config fields are needed */
+        unsigned long config_read_bitmap;
        /* The list of allocated free pages, waiting to be given back to mm */
        struct list_head free_page_list;
        spinlock_t free_page_list_lock;
        /* The number of free page blocks on the above list */
        unsigned long num_free_page_blocks;
-        /* The cmd id received from host */
+        /*
-        u32 cmd_id_received;
+         * The cmd id received from host.
+         * Read it via virtio_balloon_cmd_id_received to get the latest value
+         * sent from host.
+         */
+        u32 cmd_id_received_cache;
        /* The cmd id that is actively in use */
        __virtio32 cmd_id_active;
        /* Buffer to store the stop sign */
@@ -390,37 +400,31 @@ static unsigned long return_free_pages_to_mm(struct virtio_balloon *vb,
        return num_returned;
 }
+static void virtio_balloon_queue_free_page_work(struct virtio_balloon *vb)
+{
+        if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
+                return;
+        /* No need to queue the work if the bit was already set. */
+        if (test_and_set_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
+                             &vb->config_read_bitmap))
+                return;
+        queue_work(vb->balloon_wq, &vb->report_free_page_work);
+}
 static void virtballoon_changed(struct virtio_device *vdev)
 {
        struct virtio_balloon *vb = vdev->priv;
        unsigned long flags;
-        s64 diff = towards_target(vb);
-        if (diff) {
-                spin_lock_irqsave(&vb->stop_update_lock, flags);
-                if (!vb->stop_update)
-                        queue_work(system_freezable_wq,
-                                   &vb->update_balloon_size_work);
-                spin_unlock_irqrestore(&vb->stop_update_lock, flags);
-        }
-        if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
+        spin_lock_irqsave(&vb->stop_update_lock, flags);
-                virtio_cread(vdev, struct virtio_balloon_config,
+        if (!vb->stop_update) {
-                             free_page_report_cmd_id, &vb->cmd_id_received);
+                queue_work(system_freezable_wq,
-                if (vb->cmd_id_received == VIRTIO_BALLOON_CMD_ID_DONE) {
+                           &vb->update_balloon_size_work);
-                        /* Pass ULONG_MAX to give back all the free pages */
+                virtio_balloon_queue_free_page_work(vb);
-                        return_free_pages_to_mm(vb, ULONG_MAX);
-                } else if (vb->cmd_id_received != VIRTIO_BALLOON_CMD_ID_STOP &&
-                           vb->cmd_id_received !=
-                           virtio32_to_cpu(vdev, vb->cmd_id_active)) {
-                        spin_lock_irqsave(&vb->stop_update_lock, flags);
-                        if (!vb->stop_update) {
-                                queue_work(vb->balloon_wq,
-                                           &vb->report_free_page_work);
-                        }
-                        spin_unlock_irqrestore(&vb->stop_update_lock, flags);
-                }
        }
+        spin_unlock_irqrestore(&vb->stop_update_lock, flags);
 }
 static void update_balloon_size(struct virtio_balloon *vb)
@@ -527,6 +531,17 @@ static int init_vqs(struct virtio_balloon *vb)
        return 0;
 }
+static u32 virtio_balloon_cmd_id_received(struct virtio_balloon *vb)
+{
+        if (test_and_clear_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
+                               &vb->config_read_bitmap))
+                virtio_cread(vb->vdev, struct virtio_balloon_config,
+                             free_page_report_cmd_id,
+                             &vb->cmd_id_received_cache);
+        return vb->cmd_id_received_cache;
+}
 static int send_cmd_id_start(struct virtio_balloon *vb)
 {
        struct scatterlist sg;
@@ -537,7 +552,8 @@ static int send_cmd_id_start(struct virtio_balloon *vb)
        while (virtqueue_get_buf(vq, &unused))
                ;
-        vb->cmd_id_active = cpu_to_virtio32(vb->vdev, vb->cmd_id_received);
+        vb->cmd_id_active = virtio32_to_cpu(vb->vdev,
+                                        virtio_balloon_cmd_id_received(vb));
        sg_init_one(&sg, &vb->cmd_id_active, sizeof(vb->cmd_id_active));
        err = virtqueue_add_outbuf(vq, &sg, 1, &vb->cmd_id_active, GFP_KERNEL);
        if (!err)
@@ -620,7 +636,8 @@ static int send_free_pages(struct virtio_balloon *vb)
                 * stop the reporting.
                 */
                cmd_id_active = virtio32_to_cpu(vb->vdev, vb->cmd_id_active);
-                if (cmd_id_active != vb->cmd_id_received)
+                if (unlikely(cmd_id_active !=
+                             virtio_balloon_cmd_id_received(vb)))
                        break;
                /*
@@ -637,11 +654,9 @@ static int send_free_pages(struct virtio_balloon *vb)
        return 0;
 }
-static void report_free_page_func(struct work_struct *work)
+static void virtio_balloon_report_free_page(struct virtio_balloon *vb)
 {
        int err;
-        struct virtio_balloon *vb = container_of(work, struct virtio_balloon,
-                                                 report_free_page_work);
        struct device *dev = &vb->vdev->dev;
        /* Start by sending the received cmd id to host with an outbuf. */
@@ -659,6 +674,23 @@ static void report_free_page_func(struct work_struct *work)
                dev_err(dev, "Failed to send a stop id, err = %d\n", err);
 }
+static void report_free_page_func(struct work_struct *work)
+{
+        struct virtio_balloon *vb = container_of(work, struct virtio_balloon,
+                                                 report_free_page_work);
+        u32 cmd_id_received;
+        cmd_id_received = virtio_balloon_cmd_id_received(vb);
+        if (cmd_id_received == VIRTIO_BALLOON_CMD_ID_DONE) {
+                /* Pass ULONG_MAX to give back all the free pages */
+                return_free_pages_to_mm(vb, ULONG_MAX);
+        } else if (cmd_id_received != VIRTIO_BALLOON_CMD_ID_STOP &&
+                   cmd_id_received !=
+                   virtio32_to_cpu(vb->vdev, vb->cmd_id_active)) {
+                virtio_balloon_report_free_page(vb);
+        }
+}
 #ifdef CONFIG_BALLOON_COMPACTION
 /*
 * virtballoon_migratepage - perform the balloon page migration on behalf of
@@ -885,7 +917,7 @@ static int virtballoon_probe(struct virtio_device *vdev)
                        goto out_del_vqs;
                }
                INIT_WORK(&vb->report_free_page_work, report_free_page_func);
-                vb->cmd_id_received = VIRTIO_BALLOON_CMD_ID_STOP;
+                vb->cmd_id_received_cache = VIRTIO_BALLOON_CMD_ID_STOP;
                vb->cmd_id_active = cpu_to_virtio32(vb->vdev,
                                                  VIRTIO_BALLOON_CMD_ID_STOP);
                vb->cmd_id_stop = cpu_to_virtio32(vb->vdev,
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 4cd9ea5c75be..d9dd0f789279 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -468,7 +468,7 @@ static int vm_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
        unsigned int irq = platform_get_irq(vm_dev->pdev, 0);
-        int i, err;
+        int i, err, queue_idx = 0;
        err = request_irq(irq, vm_interrupt, IRQF_SHARED,
                        dev_name(&vdev->dev), vm_dev);
@@ -476,7 +476,12 @@ static int vm_find_vqs(struct virtio_device *vdev, unsigned nvqs,
                return err;
        for (i = 0; i < nvqs; ++i) {
-                vqs[i] = vm_setup_vq(vdev, i, callbacks[i], names[i],
+                if (!names[i]) {
+                        vqs[i] = NULL;
+                        continue;
+                }
+                vqs[i] = vm_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false);
                if (IS_ERR(vqs[i])) {
                        vm_del_vqs(vdev);
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 465a6f5142cc..d0584c040c60 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -285,7 +285,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
 {
        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
        u16 msix_vec;
-        int i, err, nvectors, allocated_vectors;
+        int i, err, nvectors, allocated_vectors, queue_idx = 0;
        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
        if (!vp_dev->vqs)
@@ -321,7 +321,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                        msix_vec = allocated_vectors++;
                else
                        msix_vec = VP_MSIX_VQ_VECTOR;
-                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                vqs[i] = vp_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false,
                                     msix_vec);
                if (IS_ERR(vqs[i])) {
@@ -356,7 +356,7 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
                const char * const names[], const bool *ctx)
 {
        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        int i, err;
+        int i, err, queue_idx = 0;
        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
        if (!vp_dev->vqs)
@@ -374,7 +374,7 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
                        vqs[i] = NULL;
                        continue;
                }
-                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                vqs[i] = vp_setup_vq(vdev, queue_idx++, callbacks[i], names[i],
                                     ctx ? ctx[i] : false,
                                     VIRTIO_MSI_NO_VECTOR);
                if (IS_ERR(vqs[i])) {
diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
index 5c4a764717c4..81208cd3f4ec 100644
--- a/drivers/watchdog/mt7621_wdt.c
+++ b/drivers/watchdog/mt7621_wdt.c
@@ -17,6 +17,7 @@
 #include <linux/watchdog.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/mach-ralink/ralink_regs.h>
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index 98967f0a7d10..db7c57d82cfd 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -18,6 +18,7 @@
 #include <linux/watchdog.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/mach-ralink/ralink_regs.h>
diff --git a/drivers/watchdog/tqmx86_wdt.c b/drivers/watchdog/tqmx86_wdt.c
index 0d3a0fbbd7a5..52941207a12a 100644
--- a/drivers/watchdog/tqmx86_wdt.c
+++ b/drivers/watchdog/tqmx86_wdt.c
@@ -79,13 +79,13 @@ static int tqmx86_wdt_probe(struct platform_device *pdev)
                return -ENOMEM;
        res = platform_get_resource(pdev, IORESOURCE_IO, 0);
-        if (IS_ERR(res))
+        if (!res)
-                return PTR_ERR(res);
+                return -ENODEV;
        priv->io_base = devm_ioport_map(&pdev->dev, res->start,
                                        resource_size(res));
-        if (IS_ERR(priv->io_base))
+        if (!priv->io_base)
-                return PTR_ERR(priv->io_base);
+                return -ENOMEM;
        watchdog_set_drvdata(&priv->wdd, priv);
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 93194f3e7540..117e76b2f939 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -1650,7 +1650,7 @@ void xen_callback_vector(void)
                        xen_have_vector_callback = 0;
                        return;
                }
-                pr_info("Xen HVM callback vector for event delivery is enabled\n");
+                pr_info_once("Xen HVM callback vector for event delivery is enabled\n");
                alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
                                xen_hvm_callback_vector);
        }
diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index 2e5d845b5091..7aa64d1b119c 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque)
        /* write the data, then modify the indexes */
        virt_wmb();
-        if (ret < 0)
+        if (ret < 0) {
+                atomic_set(&map->read, 0);
                intf->in_error = ret;
-        else
+        } else
                intf->in_prod = prod + ret;
        /* update the indexes, then notify the other end */
        virt_wmb();
@@ -282,13 +283,11 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
 static void pvcalls_sk_state_change(struct sock *sock)
 {
        struct sock_mapping *map = sock->sk_user_data;
-        struct pvcalls_data_intf *intf;
        if (map == NULL)
                return;
-        intf = map->ring;
+        atomic_inc(&map->read);
-        intf->in_error = -ENOTCONN;
        notify_remote_via_irq(map->irq);
 }
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 77224d8f3e6f..8a249c95c193 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -31,6 +31,12 @@
 #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
 #define PVCALLS_FRONT_MAX_SPIN 5000
+static struct proto pvcalls_proto = {
+        .name   = "PVCalls",
+        .owner  = THIS_MODULE,
+        .obj_size = sizeof(struct sock),
+};
 struct pvcalls_bedata {
        struct xen_pvcalls_front_ring ring;
        grant_ref_t ref;
@@ -335,6 +341,42 @@ int pvcalls_front_socket(struct socket *sock)
        return ret;
 }
+static void free_active_ring(struct sock_mapping *map)
+{
+        if (!map->active.ring)
+                return;
+        free_pages((unsigned long)map->active.data.in,
+                        map->active.ring->ring_order);
+        free_page((unsigned long)map->active.ring);
+}
+static int alloc_active_ring(struct sock_mapping *map)
+{
+        void *bytes;
+        map->active.ring = (struct pvcalls_data_intf *)
+                get_zeroed_page(GFP_KERNEL);
+        if (!map->active.ring)
+                goto out;
+        map->active.ring->ring_order = PVCALLS_RING_ORDER;
+        bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                        PVCALLS_RING_ORDER);
+        if (!bytes)
+                goto out;
+        map->active.data.in = bytes;
+        map->active.data.out = bytes +
+                XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+        return 0;
+out:
+        free_active_ring(map);
+        return -ENOMEM;
+}
 static int create_active(struct sock_mapping *map, int *evtchn)
 {
        void *bytes;
@@ -343,15 +385,7 @@ static int create_active(struct sock_mapping *map, int *evtchn)
        *evtchn = -1;
        init_waitqueue_head(&map->active.inflight_conn_req);
-        map->active.ring = (struct pvcalls_data_intf *)
+        bytes = map->active.data.in;
-                __get_free_page(GFP_KERNEL | __GFP_ZERO);
-        if (map->active.ring == NULL)
-                goto out_error;
-        map->active.ring->ring_order = PVCALLS_RING_ORDER;
-        bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
-                                        PVCALLS_RING_ORDER);
-        if (bytes == NULL)
-                goto out_error;
        for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
                map->active.ring->ref[i] = gnttab_grant_foreign_access(
                        pvcalls_front_dev->otherend_id,
@@ -361,10 +395,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
                pvcalls_front_dev->otherend_id,
                pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
-        map->active.data.in = bytes;
-        map->active.data.out = bytes +
-                XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
        ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
        if (ret)
                goto out_error;
@@ -385,8 +415,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
 out_error:
        if (*evtchn >= 0)
                xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
-        free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
-        free_page((unsigned long)map->active.ring);
        return ret;
 }
@@ -406,17 +434,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
                return PTR_ERR(map);
        bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
+        ret = alloc_active_ring(map);
+        if (ret < 0) {
+                pvcalls_exit_sock(sock);
+                return ret;
+        }
        spin_lock(&bedata->socket_lock);
        ret = get_request(bedata, &req_id);
        if (ret < 0) {
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map);
                pvcalls_exit_sock(sock);
                return ret;
        }
        ret = create_active(map, &evtchn);
        if (ret < 0) {
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map);
                pvcalls_exit_sock(sock);
                return ret;
        }
@@ -469,8 +504,10 @@ static int __write_ring(struct pvcalls_data_intf *intf,
        virt_mb();
        size = pvcalls_queued(prod, cons, array_size);
-        if (size >= array_size)
+        if (size > array_size)
                return -EINVAL;
+        if (size == array_size)
+                return 0;
        if (len > array_size - size)
                len = array_size - size;
@@ -560,15 +597,13 @@ static int __read_ring(struct pvcalls_data_intf *intf,
        error = intf->in_error;
        /* get pointers before reading from the ring */
        virt_rmb();
-        if (error < 0)
-                return error;
        size = pvcalls_queued(prod, cons, array_size);
        masked_prod = pvcalls_mask(prod, array_size);
        masked_cons = pvcalls_mask(cons, array_size);
        if (size == 0)
-                return 0;
+                return error ?: size;
        if (len > size)
                len = size;
@@ -780,25 +815,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                }
        }
-        spin_lock(&bedata->socket_lock);
+        map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
-        ret = get_request(bedata, &req_id);
+        if (map2 == NULL) {
-        if (ret < 0) {
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
-                spin_unlock(&bedata->socket_lock);
+                pvcalls_exit_sock(sock);
+                return -ENOMEM;
+        }
+        ret = alloc_active_ring(map2);
+        if (ret < 0) {
+                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+                                (void *)&map->passive.flags);
+                kfree(map2);
                pvcalls_exit_sock(sock);
                return ret;
        }
-        map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
+        spin_lock(&bedata->socket_lock);
-        if (map2 == NULL) {
+        ret = get_request(bedata, &req_id);
+        if (ret < 0) {
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
                spin_unlock(&bedata->socket_lock);
+                free_active_ring(map2);
+                kfree(map2);
                pvcalls_exit_sock(sock);
-                return -ENOMEM;
+                return ret;
        }
        ret = create_active(map2, &evtchn);
        if (ret < 0) {
+                free_active_ring(map2);
                kfree(map2);
                clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                          (void *)&map->passive.flags);
@@ -839,7 +885,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
 received:
        map2->sock = newsock;
-        newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
+        newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
        if (!newsock->sk) {
                bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
                map->passive.inflight_req_id = PVCALLS_INVALID_ID;
@@ -1032,8 +1078,8 @@ int pvcalls_front_release(struct socket *sock)
                spin_lock(&bedata->socket_lock);
                list_del(&map->list);
                spin_unlock(&bedata->socket_lock);
-                if (READ_ONCE(map->passive.inflight_req_id) !=
+                if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
-                    PVCALLS_INVALID_ID) {
+                        READ_ONCE(map->passive.inflight_req_id) != 0) {
                        pvcalls_front_free_map(bedata,
                                               map->passive.accept_map);
                }
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 989cf872b98c..bb7888429be6 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -645,7 +645,7 @@ xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
                     unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
        if (xen_get_dma_ops(dev)->mmap)
                return xen_get_dma_ops(dev)->mmap(dev, vma, cpu_addr,
                                                    dma_addr, size, attrs);
@@ -662,7 +662,7 @@ xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
                        void *cpu_addr, dma_addr_t handle, size_t size,
                        unsigned long attrs)
 {
-#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#ifdef CONFIG_ARM
        if (xen_get_dma_ops(dev)->get_sgtable) {
 #if 0
        /*
diff --git a/fs/afs/flock.c b/fs/afs/flock.c
index 0568fd986821..e432bd27a2e7 100644
--- a/fs/afs/flock.c
+++ b/fs/afs/flock.c
@@ -208,7 +208,7 @@ again:
                /* The new front of the queue now owns the state variables. */
                next = list_entry(vnode->pending_locks.next,
                                  struct file_lock, fl_u.afs.link);
-                vnode->lock_key = afs_file_key(next->fl_file);
+                vnode->lock_key = key_get(afs_file_key(next->fl_file));
                vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
                vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
                goto again;
@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
        /* The new front of the queue now owns the state variables. */
        next = list_entry(vnode->pending_locks.next,
                          struct file_lock, fl_u.afs.link);
-        vnode->lock_key = afs_file_key(next->fl_file);
+        vnode->lock_key = key_get(afs_file_key(next->fl_file));
        vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
        vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
        afs_lock_may_be_available(vnode);
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 6b17d3620414..1a4ce07fb406 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -414,7 +414,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
        } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
                valid = true;
        } else {
-                vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
                vnode->cb_v_break = vnode->volume->cb_v_break;
                valid = false;
        }
@@ -546,6 +545,8 @@ void afs_evict_inode(struct inode *inode)
 #endif
        afs_put_permits(rcu_access_pointer(vnode->permit_cache));
+        key_put(vnode->lock_key);
+        vnode->lock_key = NULL;
        _leave("");
 }
diff --git a/fs/afs/protocol_yfs.h b/fs/afs/protocol_yfs.h
index 07bc10f076aa..d443e2bfa094 100644
--- a/fs/afs/protocol_yfs.h
+++ b/fs/afs/protocol_yfs.h
@@ -161,3 +161,14 @@ struct yfs_xdr_YFSStoreVolumeStatus {
        struct yfs_xdr_u64      max_quota;
        struct yfs_xdr_u64      file_quota;
 } __packed;
+enum yfs_lock_type {
+        yfs_LockNone            = -1,
+        yfs_LockRead            = 0,
+        yfs_LockWrite           = 1,
+        yfs_LockExtend          = 2,
+        yfs_LockRelease         = 3,
+        yfs_LockMandatoryRead   = 0x100,
+        yfs_LockMandatoryWrite  = 0x101,
+        yfs_LockMandatoryExtend = 0x102,
+};
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index a7b44863d502..2c588f9bbbda 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -23,6 +23,7 @@ struct workqueue_struct *afs_async_calls;
 static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
 static long afs_wait_for_call_to_complete(struct afs_call *, struct afs_addr_cursor *);
 static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
+static void afs_delete_async_call(struct work_struct *);
 static void afs_process_async_call(struct work_struct *);
 static void afs_rx_new_call(struct sock *, struct rxrpc_call *, unsigned long);
 static void afs_rx_discard_new_call(struct rxrpc_call *, unsigned long);
@@ -203,20 +204,26 @@ void afs_put_call(struct afs_call *call)
        }
 }
+static struct afs_call *afs_get_call(struct afs_call *call,
+                                     enum afs_call_trace why)
+{
+        int u = atomic_inc_return(&call->usage);
+        trace_afs_call(call, why, u,
+                       atomic_read(&call->net->nr_outstanding_calls),
+                       __builtin_return_address(0));
+        return call;
+}
 /*
 * Queue the call for actual work.
 */
 static void afs_queue_call_work(struct afs_call *call)
 {
        if (call->type->work) {
-                int u = atomic_inc_return(&call->usage);
-                trace_afs_call(call, afs_call_trace_work, u,
-                               atomic_read(&call->net->nr_outstanding_calls),
-                               __builtin_return_address(0));
                INIT_WORK(&call->work, call->type->work);
+                afs_get_call(call, afs_call_trace_work);
                if (!queue_work(afs_wq, &call->work))
                        afs_put_call(call);
        }
@@ -398,6 +405,12 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
                }
        }
+        /* If the call is going to be asynchronous, we need an extra ref for
+         * the call to hold itself so the caller need not hang on to its ref.
+         */
+        if (call->async)
+                afs_get_call(call, afs_call_trace_get);
        /* create a call */
        rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
                                         (unsigned long)call,
@@ -438,15 +451,17 @@ long afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call,
                        goto error_do_abort;
        }
-        /* at this point, an async call may no longer exist as it may have
+        /* Note that at this point, we may have received the reply or an abort
-         * already completed */
+         * - and an asynchronous call may already have completed.
-        if (call->async)
+         */
+        if (call->async) {
+                afs_put_call(call);
                return -EINPROGRESS;
+        }
        return afs_wait_for_call_to_complete(call, ac);
 error_do_abort:
-        call->state = AFS_CALL_COMPLETE;
        if (ret != -ECONNABORTED) {
                rxrpc_kernel_abort_call(call->net->socket, rxcall,
                                        RX_USER_ABORT, ret, "KSD");
@@ -463,8 +478,24 @@ error_do_abort:
 error_kill_call:
        if (call->type->done)
                call->type->done(call);
-        afs_put_call(call);
+        /* We need to dispose of the extra ref we grabbed for an async call.
+         * The call, however, might be queued on afs_async_calls and we need to
+         * make sure we don't get any more notifications that might requeue it.
+         */
+        if (call->rxcall) {
+                rxrpc_kernel_end_call(call->net->socket, call->rxcall);
+                call->rxcall = NULL;
+        }
+        if (call->async) {
+                if (cancel_work_sync(&call->async_work))
+                        afs_put_call(call);
+                afs_put_call(call);
+        }
        ac->error = ret;
+        call->state = AFS_CALL_COMPLETE;
+        afs_put_call(call);
        _leave(" = %d", ret);
        return ret;
 }
diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c
index 95d0761cdb34..155dc14caef9 100644
--- a/fs/afs/server_list.c
+++ b/fs/afs/server_list.c
@@ -42,9 +42,7 @@ struct afs_server_list *afs_alloc_server_list(struct afs_cell *cell,
                if (vldb->fs_mask[i] & type_mask)
                        nr_servers++;
-        slist = kzalloc(sizeof(struct afs_server_list) +
+        slist = kzalloc(struct_size(slist, servers, nr_servers), GFP_KERNEL);
-                        sizeof(struct afs_server_entry) * nr_servers,
-                        GFP_KERNEL);
        if (!slist)
                goto error;
diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
index 12658c1363ae..5aa57929e8c2 100644
--- a/fs/afs/yfsclient.c
+++ b/fs/afs/yfsclient.c
@@ -803,7 +803,7 @@ int yfs_fs_create_file(struct afs_fs_cursor *fc,
        bp = xdr_encode_YFSFid(bp, &vnode->fid);
        bp = xdr_encode_string(bp, name, namesz);
        bp = xdr_encode_YFSStoreStatus_mode(bp, mode);
-        bp = xdr_encode_u32(bp, 0); /* ViceLockType */
+        bp = xdr_encode_u32(bp, yfs_LockNone); /* ViceLockType */
        yfs_check_req(call, bp);
        afs_use_fs_server(call, fc->cbi);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c546cdce77e6..58a4c1217fa8 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -104,6 +104,20 @@ void invalidate_bdev(struct block_device *bdev)
 }
 EXPORT_SYMBOL(invalidate_bdev);
+static void set_init_blocksize(struct block_device *bdev)
+{
+        unsigned bsize = bdev_logical_block_size(bdev);
+        loff_t size = i_size_read(bdev->bd_inode);
+        while (bsize < PAGE_SIZE) {
+                if (size & bsize)
+                        break;
+                bsize <<= 1;
+        }
+        bdev->bd_block_size = bsize;
+        bdev->bd_inode->i_blkbits = blksize_bits(bsize);
+}
 int set_blocksize(struct block_device *bdev, int size)
 {
        /* Size must be a power of two, and between 512 and PAGE_SIZE */
@@ -1431,18 +1445,9 @@ EXPORT_SYMBOL(check_disk_change);
 void bd_set_size(struct block_device *bdev, loff_t size)
 {
-        unsigned bsize = bdev_logical_block_size(bdev);
        inode_lock(bdev->bd_inode);
        i_size_write(bdev->bd_inode, size);
        inode_unlock(bdev->bd_inode);
-        while (bsize < PAGE_SIZE) {
-                if (size & bsize)
-                        break;
-                bsize <<= 1;
-        }
-        bdev->bd_block_size = bsize;
-        bdev->bd_inode->i_blkbits = blksize_bits(bsize);
 }
 EXPORT_SYMBOL(bd_set_size);
@@ -1519,8 +1524,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                }
                        }
-                        if (!ret)
+                        if (!ret) {
                                bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
+                                set_init_blocksize(bdev);
+                        }
                        /*
                         * If the device is invalidated, rescan partition
@@ -1555,6 +1562,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                goto out_clear;
                        }
                        bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
+                        set_init_blocksize(bdev);
                }
                if (bdev->bd_bdi == &noop_backing_dev_info)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0a68cf7032f5..7a2a2621f0d9 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -35,6 +35,7 @@
 struct btrfs_trans_handle;
 struct btrfs_transaction;
 struct btrfs_pending_snapshot;
+struct btrfs_delayed_ref_root;
 extern struct kmem_cache *btrfs_trans_handle_cachep;
 extern struct kmem_cache *btrfs_bit_radix_cachep;
 extern struct kmem_cache *btrfs_path_cachep;
@@ -786,6 +787,9 @@ enum {
         * main phase. The fs_info::balance_ctl is initialized.
         */
        BTRFS_FS_BALANCE_RUNNING,
+        /* Indicate that the cleaner thread is awake and doing something. */
+        BTRFS_FS_CLEANER_RUNNING,
 };
 struct btrfs_fs_info {
@@ -2661,6 +2665,9 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                           unsigned long count);
 int btrfs_async_run_delayed_refs(struct btrfs_fs_info *fs_info,
                                 unsigned long count, u64 transid, int wait);
+void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
+                                  struct btrfs_delayed_ref_root *delayed_refs,
+                                  struct btrfs_delayed_ref_head *head);
 int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len);
 int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                             struct btrfs_fs_info *fs_info, u64 bytenr,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8da2f380d3c0..6a2a2a951705 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1682,6 +1682,8 @@ static int cleaner_kthread(void *arg)
        while (1) {
                again = 0;
+                set_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags);
                /* Make the cleaner go to sleep early. */
                if (btrfs_need_cleaner_sleep(fs_info))
                        goto sleep;
@@ -1728,6 +1730,7 @@ static int cleaner_kthread(void *arg)
                 */
                btrfs_delete_unused_bgs(fs_info);
 sleep:
+                clear_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags);
                if (kthread_should_park())
                        kthread_parkme();
                if (kthread_should_stop())
@@ -4201,6 +4204,14 @@ static void btrfs_destroy_all_ordered_extents(struct btrfs_fs_info *fs_info)
                spin_lock(&fs_info->ordered_root_lock);
        }
        spin_unlock(&fs_info->ordered_root_lock);
+        /*
+         * We need this here because if we've been flipped read-only we won't
+         * get sync() from the umount, so we need to make sure any ordered
+         * extents that haven't had their dirty pages IO start writeout yet
+         * actually get run and error out properly.
+         */
+        btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
 }
 static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
@@ -4265,6 +4276,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
                if (pin_bytes)
                        btrfs_pin_extent(fs_info, head->bytenr,
                                         head->num_bytes, 1);
+                btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
                btrfs_put_delayed_ref_head(head);
                cond_resched();
                spin_lock(&delayed_refs->lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b15afeae16df..d81035b7ea7d 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2456,12 +2456,10 @@ static int run_and_cleanup_extent_op(struct btrfs_trans_handle *trans,
        return ret ? ret : 1;
 }
-static void cleanup_ref_head_accounting(struct btrfs_trans_handle *trans,
+void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
-                                        struct btrfs_delayed_ref_head *head)
+                                  struct btrfs_delayed_ref_root *delayed_refs,
+                                  struct btrfs_delayed_ref_head *head)
 {
-        struct btrfs_fs_info *fs_info = trans->fs_info;
-        struct btrfs_delayed_ref_root *delayed_refs =
-                &trans->transaction->delayed_refs;
        int nr_items = 1;       /* Dropping this ref head update. */
        if (head->total_ref_mod < 0) {
@@ -2544,7 +2542,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
                }
        }
-        cleanup_ref_head_accounting(trans, head);
+        btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
        trace_run_delayed_ref_head(fs_info, head, 0);
        btrfs_delayed_ref_unlock(head);
@@ -4954,6 +4952,15 @@ static void flush_space(struct btrfs_fs_info *fs_info,
                        ret = 0;
                break;
        case COMMIT_TRANS:
+                /*
+                 * If we have pending delayed iputs then we could free up a
+                 * bunch of pinned space, so make sure we run the iputs before
+                 * we do our pinned bytes check below.
+                 */
+                mutex_lock(&fs_info->cleaner_delayed_iput_mutex);
+                btrfs_run_delayed_iputs(fs_info);
+                mutex_unlock(&fs_info->cleaner_delayed_iput_mutex);
                ret = may_commit_transaction(fs_info, space_info);
                break;
        default:
@@ -7188,7 +7195,7 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
        if (head->must_insert_reserved)
                ret = 1;
-        cleanup_ref_head_accounting(trans, head);
+        btrfs_cleanup_ref_head_accounting(trans->fs_info, delayed_refs, head);
        mutex_unlock(&head->mutex);
        btrfs_put_delayed_ref_head(head);
        return ret;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 43eb4535319d..5c349667c761 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3129,9 +3129,6 @@ out:
        /* once for the tree */
        btrfs_put_ordered_extent(ordered_extent);
-        /* Try to release some metadata so we don't get an OOM but don't wait */
-        btrfs_btree_balance_dirty_nodelay(fs_info);
        return ret;
 }
@@ -3254,6 +3251,8 @@ void btrfs_add_delayed_iput(struct inode *inode)
        ASSERT(list_empty(&binode->delayed_iput));
        list_add_tail(&binode->delayed_iput, &fs_info->delayed_iputs);
        spin_unlock(&fs_info->delayed_iput_lock);
+        if (!test_bit(BTRFS_FS_CLEANER_RUNNING, &fs_info->flags))
+                wake_up_process(fs_info->cleaner_kthread);
 }
 void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 94c026bba2c2..bba28a5034ba 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1035,6 +1035,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
        list_del_init(&ci->i_snap_realm_item);
        ci->i_snap_realm_counter++;
        ci->i_snap_realm = NULL;
+        if (realm->ino == ci->i_vino.ino)
+                realm->inode = NULL;
        spin_unlock(&realm->inodes_with_caps_lock);
        ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
                            realm);
diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
index 03f4d24db8fe..9455d3aef0c3 100644
--- a/fs/ceph/quota.c
+++ b/fs/ceph/quota.c
@@ -3,19 +3,6 @@
 * quota.c - CephFS quota
 *
 * Copyright (C) 2017-2018 SUSE
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
 #include <linux/statfs.h>
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 593fb422d0f3..e92a2fee3c57 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -252,6 +252,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
        seq_printf(m, ",ACL");
 #endif
        seq_putc(m, '\n');
+        seq_printf(m, "CIFSMaxBufSize: %d\n", CIFSMaxBufSize);
        seq_printf(m, "Active VFS Requests: %d\n", GlobalTotalActiveXid);
        seq_printf(m, "Servers:");
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index e18915415e13..bb54ccf8481c 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1549,18 +1549,26 @@ cifs_discard_remaining_data(struct TCP_Server_Info *server)
 }
 static int
-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+__cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+                     bool malformed)
 {
        int length;
-        struct cifs_readdata *rdata = mid->callback_data;
        length = cifs_discard_remaining_data(server);
-        dequeue_mid(mid, rdata->result);
+        dequeue_mid(mid, malformed);
        mid->resp_buf = server->smallbuf;
        server->smallbuf = NULL;
        return length;
 }
+static int
+cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+{
+        struct cifs_readdata *rdata = mid->callback_data;
+        return  __cifs_readv_discard(server, mid, rdata->result);
+}
 int
 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 {
@@ -1602,12 +1610,23 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                return -1;
        }
+        /* set up first two iov for signature check and to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len = server->total_read - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
        /* Was the SMB read successful? */
        rdata->result = server->ops->map_error(buf, false);
        if (rdata->result != 0) {
                cifs_dbg(FYI, "%s: server returned error %d\n",
                         __func__, rdata->result);
-                return cifs_readv_discard(server, mid);
+                /* normal error on read response */
+                return __cifs_readv_discard(server, mid, false);
        }
        /* Is there enough to get to the rest of the READ_RSP header? */
@@ -1651,14 +1670,6 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                server->total_read += length;
        }
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->total_read - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%u\n",
-                 rdata->iov[0].iov_base, server->total_read);
        /* how much data is in the response? */
 #ifdef CONFIG_CIFS_SMB_DIRECT
        use_rdma_mr = rdata->mr;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 683310f26171..8463c940e0e5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -720,6 +720,21 @@ server_unresponsive(struct TCP_Server_Info *server)
        return false;
 }
+static inline bool
+zero_credits(struct TCP_Server_Info *server)
+{
+        int val;
+        spin_lock(&server->req_lock);
+        val = server->credits + server->echo_credits + server->oplock_credits;
+        if (server->in_flight == 0 && val == 0) {
+                spin_unlock(&server->req_lock);
+                return true;
+        }
+        spin_unlock(&server->req_lock);
+        return false;
+}
 static int
 cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
 {
@@ -732,6 +747,12 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
        for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
                try_to_freeze();
+                /* reconnect if no credits and no requests in flight */
+                if (zero_credits(server)) {
+                        cifs_reconnect(server);
+                        return -ECONNABORTED;
+                }
                if (server_unresponsive(server))
                        return -ECONNABORTED;
                if (cifs_rdma_enabled(server) && server->smbd_conn)
diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
index f14533da3a93..01a76bccdb8d 100644
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -293,6 +293,8 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
        int rc;
        struct smb2_file_all_info *smb2_data;
        __u32 create_options = 0;
+        struct cifs_fid fid;
+        bool no_cached_open = tcon->nohandlecache;
        *adjust_tz = false;
        *symlink = false;
@@ -301,6 +303,21 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
                            GFP_KERNEL);
        if (smb2_data == NULL)
                return -ENOMEM;
+        /* If it is a root and its handle is cached then use it */
+        if (!strlen(full_path) && !no_cached_open) {
+                rc = open_shroot(xid, tcon, &fid);
+                if (rc)
+                        goto out;
+                rc = SMB2_query_info(xid, tcon, fid.persistent_fid,
+                                     fid.volatile_fid, smb2_data);
+                close_shroot(&tcon->crfid);
+                if (rc)
+                        goto out;
+                move_smb2_info_to_cifs(data, smb2_data);
+                goto out;
+        }
        if (backup_cred(cifs_sb))
                create_options |= CREATE_OPEN_BACKUP_INTENT;
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 6a9c47541c53..7b8b58fb4d3f 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -648,6 +648,13 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
        if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
                return false;
+        if (rsp->sync_hdr.CreditRequest) {
+                spin_lock(&server->req_lock);
+                server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                spin_unlock(&server->req_lock);
+                wake_up(&server->request_q);
+        }
        if (rsp->StructureSize !=
                                smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
                if (le16_to_cpu(rsp->StructureSize) == 44)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index cf7eb891804f..153238fc4fa9 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -34,6 +34,7 @@
 #include "cifs_ioctl.h"
 #include "smbdirect.h"
+/* Change credits for different ops and return the total number of credits */
 static int
 change_conf(struct TCP_Server_Info *server)
 {
@@ -41,17 +42,15 @@ change_conf(struct TCP_Server_Info *server)
        server->oplock_credits = server->echo_credits = 0;
        switch (server->credits) {
        case 0:
-                return -1;
+                return 0;
        case 1:
                server->echoes = false;
                server->oplocks = false;
-                cifs_dbg(VFS, "disabling echoes and oplocks\n");
                break;
        case 2:
                server->echoes = true;
                server->oplocks = false;
                server->echo_credits = 1;
-                cifs_dbg(FYI, "disabling oplocks\n");
                break;
        default:
                server->echoes = true;
@@ -64,14 +63,15 @@ change_conf(struct TCP_Server_Info *server)
                server->echo_credits = 1;
        }
        server->credits -= server->echo_credits + server->oplock_credits;
-        return 0;
+        return server->credits + server->echo_credits + server->oplock_credits;
 }
 static void
 smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
                 const int optype)
 {
-        int *val, rc = 0;
+        int *val, rc = -1;
        spin_lock(&server->req_lock);
        val = server->ops->get_credits_field(server, optype);
@@ -101,8 +101,26 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
        }
        spin_unlock(&server->req_lock);
        wake_up(&server->request_q);
-        if (rc)
-                cifs_reconnect(server);
+        if (server->tcpStatus == CifsNeedReconnect)
+                return;
+        switch (rc) {
+        case -1:
+                /* change_conf hasn't been executed */
+                break;
+        case 0:
+                cifs_dbg(VFS, "Possible client or server bug - zero credits\n");
+                break;
+        case 1:
+                cifs_dbg(VFS, "disabling echoes and oplocks\n");
+                break;
+        case 2:
+                cifs_dbg(FYI, "disabling oplocks\n");
+                break;
+        default:
+                cifs_dbg(FYI, "add %u credits total=%d\n", add, rc);
+        }
 }
 static void
@@ -136,7 +154,11 @@ smb2_get_credits(struct mid_q_entry *mid)
 {
        struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)mid->resp_buf;
-        return le16_to_cpu(shdr->CreditRequest);
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
+                return le16_to_cpu(shdr->CreditRequest);
+        return 0;
 }
 static int
@@ -165,14 +187,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
                        scredits = server->credits;
                        /* can deadlock with reopen */
-                        if (scredits == 1) {
+                        if (scredits <= 8) {
                                *num = SMB2_MAX_BUFFER_SIZE;
                                *credits = 0;
                                break;
                        }
-                        /* leave one credit for a possible reopen */
+                        /* leave some credits for reopen and other ops */
-                        scredits--;
+                        scredits -= 8;
                        *num = min_t(unsigned int, size,
                                     scredits * SMB2_MAX_BUFFER_SIZE);
@@ -3189,11 +3211,23 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                        server->ops->is_status_pending(buf, server, 0))
                return -1;
-        rdata->result = server->ops->map_error(buf, false);
+        /* set up first two iov to get credits */
+        rdata->iov[0].iov_base = buf;
+        rdata->iov[0].iov_len = 4;
+        rdata->iov[1].iov_base = buf + 4;
+        rdata->iov[1].iov_len =
+                min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4;
+        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+        cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+                 rdata->iov[1].iov_base, rdata->iov[1].iov_len);
+        rdata->result = server->ops->map_error(buf, true);
        if (rdata->result != 0) {
                cifs_dbg(FYI, "%s: server returned error %d\n",
                         __func__, rdata->result);
-                dequeue_mid(mid, rdata->result);
+                /* normal error on read response */
+                dequeue_mid(mid, false);
                return 0;
        }
@@ -3266,14 +3300,6 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
                return 0;
        }
-        /* set up first iov for signature check */
-        rdata->iov[0].iov_base = buf;
-        rdata->iov[0].iov_len = 4;
-        rdata->iov[1].iov_base = buf + 4;
-        rdata->iov[1].iov_len = server->vals->read_rsp_size - 4;
-        cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
-                 rdata->iov[0].iov_base, server->vals->read_rsp_size);
        length = rdata->copy_into_pages(server, rdata, &iter);
        kfree(bvec);
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 50811a7dc0e0..2ff209ec4fab 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2816,6 +2816,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
        int resp_buftype = CIFS_NO_BUFFER;
        struct cifs_ses *ses = tcon->ses;
        int flags = 0;
+        bool allocated = false;
        cifs_dbg(FYI, "Query Info\n");
@@ -2855,14 +2856,21 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
                                        "Error %d allocating memory for acl\n",
                                        rc);
                                *dlen = 0;
+                                rc = -ENOMEM;
                                goto qinf_exit;
                        }
+                        allocated = true;
                }
        }
        rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset),
                                        le32_to_cpu(rsp->OutputBufferLength),
                                        &rsp_iov, min_len, *data);
+        if (rc && allocated) {
+                kfree(*data);
+                *data = NULL;
+                *dlen = 0;
+        }
 qinf_exit:
        SMB2_query_info_free(&rqst);
@@ -2916,9 +2924,10 @@ smb2_echo_callback(struct mid_q_entry *mid)
 {
        struct TCP_Server_Info *server = mid->callback_data;
        struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
-        if (mid->mid_state == MID_RESPONSE_RECEIVED)
+        if (mid->mid_state == MID_RESPONSE_RECEIVED
+            || mid->mid_state == MID_RESPONSE_MALFORMED)
                credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
        DeleteMidQEntry(mid);
@@ -3175,7 +3184,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
        struct TCP_Server_Info *server = tcon->ses->server;
        struct smb2_sync_hdr *shdr =
                                (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
        struct smb_rqst rqst = { .rq_iov = rdata->iov,
                                 .rq_nvec = 2,
                                 .rq_pages = rdata->pages,
@@ -3214,6 +3223,9 @@ smb2_readv_callback(struct mid_q_entry *mid)
                task_io_account_read(rdata->got_bytes);
                cifs_stats_bytes_read(tcon, rdata->got_bytes);
                break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(shdr->CreditRequest);
+                /* fall through */
        default:
                if (rdata->result != -ENODATA)
                        rdata->result = -EIO;
@@ -3399,7 +3411,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
        struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
        unsigned int written;
        struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
-        unsigned int credits_received = 1;
+        unsigned int credits_received = 0;
        switch (mid->mid_state) {
        case MID_RESPONSE_RECEIVED:
@@ -3427,6 +3439,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
        case MID_RETRY_NEEDED:
                wdata->result = -EAGAIN;
                break;
+        case MID_RESPONSE_MALFORMED:
+                credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+                /* fall through */
        default:
                wdata->result = -EIO;
                break;
diff --git a/fs/cifs/trace.c b/fs/cifs/trace.c
index bd4a546feec1..465483787193 100644
--- a/fs/cifs/trace.c
+++ b/fs/cifs/trace.c
@@ -3,16 +3,6 @@
 *   Copyright (C) 2018, Microsoft Corporation.
 *
 *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
 */
 #define CREATE_TRACE_POINTS
 #include "trace.h"
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index fb049809555f..59be48206932 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -3,16 +3,6 @@
 *   Copyright (C) 2018, Microsoft Corporation.
 *
 *   Author(s): Steve French <stfrench@microsoft.com>
- *
- *   This program is free software;  you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU General Public License for more details.
 */
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM cifs
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 202e0e84efdd..53532bd3f50d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -786,17 +786,8 @@ static void
 cifs_compound_callback(struct mid_q_entry *mid)
 {
        struct TCP_Server_Info *server = mid->server;
-        unsigned int optype = mid->optype;
-        unsigned int credits_received = 0;
-        if (mid->mid_state == MID_RESPONSE_RECEIVED) {
+        add_credits(server, server->ops->get_credits(mid), mid->optype);
-                if (mid->resp_buf)
-                        credits_received = server->ops->get_credits(mid);
-                else
-                        cifs_dbg(FYI, "Bad state for cancelled MID\n");
-        }
-        add_credits(server, credits_received, optype);
 }
 static void
diff --git a/fs/direct-io.c b/fs/direct-io.c
index dbc1a1f080ce..ec2fb6fe6d37 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
        unsigned long fs_count; /* Number of filesystem-sized blocks */
        int create;
        unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor;
+        loff_t i_size;
        /*
         * If there was a memory error and we've overwritten all the
@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
                 */
                create = dio->op == REQ_OP_WRITE;
                if (dio->flags & DIO_SKIP_HOLES) {
-                        if (fs_startblk <= ((i_size_read(dio->inode) - 1) >>
+                        i_size = i_size_read(dio->inode);
-                                                        i_blkbits))
+                        if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits)
                                create = 0;
                }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index b40168fcc94a..36855c1f8daf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -331,11 +331,22 @@ struct inode_switch_wbs_context {
        struct work_struct      work;
 };
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        down_write(&bdi->wb_switch_rwsem);
+}
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi)
+{
+        up_write(&bdi->wb_switch_rwsem);
+}
 static void inode_switch_wbs_work_fn(struct work_struct *work)
 {
        struct inode_switch_wbs_context *isw =
                container_of(work, struct inode_switch_wbs_context, work);
        struct inode *inode = isw->inode;
+        struct backing_dev_info *bdi = inode_to_bdi(inode);
        struct address_space *mapping = inode->i_mapping;
        struct bdi_writeback *old_wb = inode->i_wb;
        struct bdi_writeback *new_wb = isw->new_wb;
@@ -344,6 +355,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
        bool switched = false;
        /*
+         * If @inode switches cgwb membership while sync_inodes_sb() is
+         * being issued, sync_inodes_sb() might miss it.  Synchronize.
+         */
+        down_read(&bdi->wb_switch_rwsem);
+        /*
         * By the time control reaches here, RCU grace period has passed
         * since I_WB_SWITCH assertion and all wb stat update transactions
         * between unlocked_inode_to_wb_begin/end() are guaranteed to be
@@ -428,6 +445,8 @@ skip_switch:
        spin_unlock(&new_wb->list_lock);
        spin_unlock(&old_wb->list_lock);
+        up_read(&bdi->wb_switch_rwsem);
        if (switched) {
                wb_wakeup(new_wb);
                wb_put(old_wb);
@@ -468,9 +487,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
        if (inode->i_state & I_WB_SWITCH)
                return;
+        /*
+         * Avoid starting new switches while sync_inodes_sb() is in
+         * progress.  Otherwise, if the down_write protected issue path
+         * blocks heavily, we might end up starting a large number of
+         * switches which will block on the rwsem.
+         */
+        if (!down_read_trylock(&bdi->wb_switch_rwsem))
+                return;
        isw = kzalloc(sizeof(*isw), GFP_ATOMIC);
        if (!isw)
-                return;
+                goto out_unlock;
        /* find and pin the new wb */
        rcu_read_lock();
@@ -504,12 +532,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
         * Let's continue after I_WB_SWITCH is guaranteed to be visible.
         */
        call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
-        return;
+        goto out_unlock;
 out_free:
        if (isw->new_wb)
                wb_put(isw->new_wb);
        kfree(isw);
+out_unlock:
+        up_read(&bdi->wb_switch_rwsem);
 }
 /**
@@ -887,6 +917,9 @@ fs_initcall(cgroup_writeback_init);
 #else   /* CONFIG_CGROUP_WRITEBACK */
+static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
+static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
 static struct bdi_writeback *
 locked_inode_to_wb_and_lock_list(struct inode *inode)
        __releases(&inode->i_lock)
@@ -2413,8 +2446,11 @@ void sync_inodes_sb(struct super_block *sb)
                return;
        WARN_ON(!rwsem_is_locked(&sb->s_umount));
+        /* protect against inode wb switch, see inode_switch_wbs_work_fn() */
+        bdi_down_write_wb_switch_rwsem(bdi);
        bdi_split_work_to_wbs(bdi, &work, false);
        wb_wait_for_completion(bdi, &done);
+        bdi_up_write_wb_switch_rwsem(bdi);
        wait_sb_inodes(sb);
 }
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 46d691ba04bc..45b2322e092d 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -133,15 +133,9 @@ static ssize_t nfs4_copy_file_range(struct file *file_in, loff_t pos_in,
                                    struct file *file_out, loff_t pos_out,
                                    size_t count, unsigned int flags)
 {
-        ssize_t ret;
        if (file_inode(file_in) == file_inode(file_out))
                return -EINVAL;
-retry:
+        return nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
-        ret = nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
-        if (ret == -EAGAIN)
-                goto retry;
-        return ret;
 }
 static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence)
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 105576daca4a..798f1253141a 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -724,8 +724,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
                return -EBADF;
        /* IN_MASK_ADD and IN_MASK_CREATE don't make sense together */
-        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE)))
+        if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE))) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto fput_and_out;
+        }
        /* verify that this is indeed an inotify instance */
        if (unlikely(f.file->f_op != &inotify_fops)) {
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index 96f7d32cd184..898c8321b343 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -128,7 +128,6 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], int id,
                     struct pstore_record *record)
 {
        struct persistent_ram_zone *prz;
-        bool update = (record->type == PSTORE_TYPE_DMESG);
        /* Give up if we never existed or have hit the end. */
        if (!przs)
@@ -139,7 +138,7 @@ ramoops_get_next_prz(struct persistent_ram_zone *przs[], int id,
                return NULL;
        /* Update old/shadowed buffer. */
-        if (update)
+        if (prz->type == PSTORE_TYPE_DMESG)
                persistent_ram_save_old(prz);
        if (!persistent_ram_old_size(prz))
@@ -711,18 +710,15 @@ static int ramoops_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
        struct ramoops_platform_data *pdata = dev->platform_data;
+        struct ramoops_platform_data pdata_local;
        struct ramoops_context *cxt = &oops_cxt;
        size_t dump_mem_sz;
        phys_addr_t paddr;
        int err = -EINVAL;
        if (dev_of_node(dev) && !pdata) {
-                pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+                pdata = &pdata_local;
-                if (!pdata) {
+                memset(pdata, 0, sizeof(*pdata));
-                        pr_err("cannot allocate platform data buffer\n");
-                        err = -ENOMEM;
-                        goto fail_out;
-                }
                err = ramoops_parse_dt(pdev, pdata);
                if (err < 0)
diff --git a/include/dt-bindings/reset/amlogic,meson-axg-reset.h b/include/dt-bindings/reset/amlogic,meson-axg-reset.h
index ad6f55dabd6d..0f2e0fe45ca4 100644
--- a/include/dt-bindings/reset/amlogic,meson-axg-reset.h
+++ b/include/dt-bindings/reset/amlogic,meson-axg-reset.h
@@ -1,12 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause */
 /*
- *
 * Copyright (c) 2016 BayLibre, SAS.
 * Author: Neil Armstrong <narmstrong@baylibre.com>
 *
 * Copyright (c) 2017 Amlogic, inc.
 * Author: Yixun Lan <yixun.lan@amlogic.com>
 *
- * SPDX-License-Identifier: (GPL-2.0+ OR BSD)
 */
 #ifndef _DT_BINDINGS_AMLOGIC_MESON_AXG_RESET_H
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index c31157135598..07e02d6df5ad 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -190,6 +190,7 @@ struct backing_dev_info {
        struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
        struct rb_root cgwb_congested_tree; /* their congested states */
        struct mutex cgwb_release_mutex;  /* protect shutdown of wb structs */
+        struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */
 #else
        struct bdi_writeback_congested *wb_congested;
 #endif
diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
index 7cca5f859a90..f3c43519baa7 100644
--- a/include/linux/bcma/bcma_soc.h
+++ b/include/linux/bcma/bcma_soc.h
@@ -6,6 +6,7 @@
 struct bcma_soc {
        struct bcma_bus bus;
+        struct device *dev;
 };
 int __init bcma_host_soc_register(struct bcma_soc *soc);
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 5c7e7f859a24..d66bf5f32610 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -287,7 +287,7 @@ enum req_opf {
        REQ_OP_DISCARD          = 3,
        /* securely erase sectors */
        REQ_OP_SECURE_ERASE     = 5,
-        /* seset a zone write pointer */
+        /* reset a zone write pointer */
        REQ_OP_ZONE_RESET       = 6,
        /* write the same sector many times */
        REQ_OP_WRITE_SAME       = 7,
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 27b74947cd2b..573cca00a0e6 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -172,6 +172,7 @@ struct bpf_verifier_state_list {
 #define BPF_ALU_SANITIZE_SRC            1U
 #define BPF_ALU_SANITIZE_DST            2U
 #define BPF_ALU_NEG_VALUE               (1U << 2)
+#define BPF_ALU_NON_POINTER             (1U << 3)
 #define BPF_ALU_SANITIZE                (BPF_ALU_SANITIZE_SRC | \
                                         BPF_ALU_SANITIZE_DST)
diff --git a/include/linux/bpfilter.h b/include/linux/bpfilter.h
index f02cee0225d4..d815622cd31e 100644
--- a/include/linux/bpfilter.h
+++ b/include/linux/bpfilter.h
@@ -3,13 +3,22 @@
 #define _LINUX_BPFILTER_H
 #include <uapi/linux/bpfilter.h>
+#include <linux/umh.h>
 struct sock;
 int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char __user *optval,
                            unsigned int optlen);
 int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char __user *optval,
                            int __user *optlen);
-extern int (*bpfilter_process_sockopt)(struct sock *sk, int optname,
+struct bpfilter_umh_ops {
-                                       char __user *optval,
+        struct umh_info info;
-                                       unsigned int optlen, bool is_set);
+        /* since ip_getsockopt() can run in parallel, serialize access to umh */
+        struct mutex lock;
+        int (*sockopt)(struct sock *sk, int optname,
+                       char __user *optval,
+                       unsigned int optlen, bool is_set);
+        int (*start)(void);
+        bool stop;
+};
+extern struct bpfilter_umh_ops bpfilter_ops;
 #endif
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 39f668d5066b..333a6695a918 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -3,9 +3,8 @@
 #error "Please don't include <linux/compiler-clang.h> directly, include <linux/compiler.h> instead."
 #endif
-/* Some compiler specific definitions are overwritten here
+/* Compiler specific definitions for Clang compiler */
- * for Clang compiler
- */
 #define uninitialized_var(x) x = *(&(x))
 /* same as gcc, this was present in clang-2.6 so we can assume it works
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index dd8268f5f5f0..e8579412ad21 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -58,10 +58,6 @@
        (typeof(ptr)) (__ptr + (off));                                  \
 })
-/* Make the optimizer believe the variable can be manipulated arbitrarily. */
-#define OPTIMIZER_HIDE_VAR(var)                                         \
-        __asm__ ("" : "=r" (var) : "0" (var))
 /*
 * A trick to suppress uninitialized variable warning without generating any
 * code
diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
index 517bd14e1222..b17f3cd18334 100644
--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -5,9 +5,7 @@
 #ifdef __ECC
-/* Some compiler specific definitions are overwritten here
+/* Compiler specific definitions for Intel ECC compiler */
- * for Intel ECC compiler
- */
 #include <asm/intrinsics.h>
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index fc5004a4b07d..445348facea9 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -161,7 +161,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 #endif
 #ifndef OPTIMIZER_HIDE_VAR
-#define OPTIMIZER_HIDE_VAR(var) barrier()
+/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+#define OPTIMIZER_HIDE_VAR(var)                                         \
+        __asm__ ("" : "=r" (var) : "0" (var))
 #endif
 /* Not-quite-unique ID. */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 7cdd31a69719..f52ef0ad6781 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -653,6 +653,7 @@ extern int fb_new_modelist(struct fb_info *info);
 extern struct fb_info *registered_fb[FB_MAX];
 extern int num_registered_fb;
+extern bool fb_center_logo;
 extern struct class *fb_class;
 #define for_each_registered_fb(i)               \
diff --git a/include/linux/hid.h b/include/linux/hid.h
index d99287327ef2..f9707d1dcb58 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -430,7 +430,7 @@ struct hid_local {
 */
 struct hid_collection {
-        struct hid_collection *parent;
+        int parent_idx; /* device->collection */
        unsigned type;
        unsigned usage;
        unsigned level;
@@ -658,7 +658,6 @@ struct hid_parser {
        unsigned int         *collection_stack;
        unsigned int          collection_stack_ptr;
        unsigned int          collection_stack_size;
-        struct hid_collection *active_collection;
        struct hid_device    *device;
        unsigned int          scan_flags;
 };
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index f0885cc01db6..dcb6977afce9 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1159,8 +1159,9 @@ struct hv_ring_buffer_debug_info {
        u32 bytes_avail_towrite;
 };
-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
-                            struct hv_ring_buffer_debug_info *debug_info);
+int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+                                struct hv_ring_buffer_debug_info *debug_info);
 /* Vmbus interface */
 #define vmbus_driver_register(driver)   \
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index 6756fea18b69..e44746de95cd 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
        case ARPHRD_IPGRE:
        case ARPHRD_VOID:
        case ARPHRD_NONE:
+        case ARPHRD_RAWIP:
                return false;
        default:
                return true;
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index c672f34235e7..4a728dba02e2 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -260,6 +260,7 @@ struct irq_affinity {
 /**
 * struct irq_affinity_desc - Interrupt affinity descriptor
 * @mask:       cpumask to hold the affinity assignment
+ * @is_managed: 1 if the interrupt is managed internally
 */
 struct irq_affinity_desc {
        struct cpumask  mask;
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 7da406ae3a2b..43348303cb4b 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -162,6 +162,7 @@ static inline struct nd_blk_region_desc *to_blk_region_desc(
 }
 enum nvdimm_security_state {
+        NVDIMM_SECURITY_ERROR = -1,
        NVDIMM_SECURITY_DISABLED,
        NVDIMM_SECURITY_UNLOCKED,
        NVDIMM_SECURITY_LOCKED,
@@ -236,7 +237,6 @@ static inline struct nvdimm *nvdimm_create(struct nvdimm_bus *nvdimm_bus,
                        cmd_mask, num_flush, flush_wpq, NULL, NULL);
 }
-int nvdimm_security_setup_events(struct nvdimm *nvdimm);
 const struct nd_cmd_desc *nd_cmd_dimm_desc(int cmd);
 const struct nd_cmd_desc *nd_cmd_bus_desc(int cmd);
 u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
diff --git a/include/linux/mfd/cros_ec_commands.h b/include/linux/mfd/cros_ec_commands.h
index 9a9631f0559e..fc91082d4c35 100644
--- a/include/linux/mfd/cros_ec_commands.h
+++ b/include/linux/mfd/cros_ec_commands.h
@@ -2791,6 +2791,100 @@ struct ec_response_battery_vendor_param {
 } __packed;
 /*****************************************************************************/
+/* Commands for I2S recording on audio codec. */
+#define EC_CMD_CODEC_I2S 0x00BC
+enum ec_codec_i2s_subcmd {
+        EC_CODEC_SET_SAMPLE_DEPTH = 0x0,
+        EC_CODEC_SET_GAIN = 0x1,
+        EC_CODEC_GET_GAIN = 0x2,
+        EC_CODEC_I2S_ENABLE = 0x3,
+        EC_CODEC_I2S_SET_CONFIG = 0x4,
+        EC_CODEC_I2S_SET_TDM_CONFIG = 0x5,
+        EC_CODEC_I2S_SET_BCLK = 0x6,
+};
+enum ec_sample_depth_value {
+        EC_CODEC_SAMPLE_DEPTH_16 = 0,
+        EC_CODEC_SAMPLE_DEPTH_24 = 1,
+};
+enum ec_i2s_config {
+        EC_DAI_FMT_I2S = 0,
+        EC_DAI_FMT_RIGHT_J = 1,
+        EC_DAI_FMT_LEFT_J = 2,
+        EC_DAI_FMT_PCM_A = 3,
+        EC_DAI_FMT_PCM_B = 4,
+        EC_DAI_FMT_PCM_TDM = 5,
+};
+struct ec_param_codec_i2s {
+        /*
+         * enum ec_codec_i2s_subcmd
+         */
+        uint8_t cmd;
+        union {
+                /*
+                 * EC_CODEC_SET_SAMPLE_DEPTH
+                 * Value should be one of ec_sample_depth_value.
+                 */
+                uint8_t depth;
+                /*
+                 * EC_CODEC_SET_GAIN
+                 * Value should be 0~43 for both channels.
+                 */
+                struct ec_param_codec_i2s_set_gain {
+                        uint8_t left;
+                        uint8_t right;
+                } __packed gain;
+                /*
+                 * EC_CODEC_I2S_ENABLE
+                 * 1 to enable, 0 to disable.
+                 */
+                uint8_t i2s_enable;
+                /*
+                 * EC_CODEC_I2S_SET_COFNIG
+                 * Value should be one of ec_i2s_config.
+                 */
+                uint8_t i2s_config;
+                /*
+                 * EC_CODEC_I2S_SET_TDM_CONFIG
+                 * Value should be one of ec_i2s_config.
+                 */
+                struct ec_param_codec_i2s_tdm {
+                        /*
+                         * 0 to 496
+                         */
+                        int16_t ch0_delay;
+                        /*
+                         * -1 to 496
+                         */
+                        int16_t ch1_delay;
+                        uint8_t adjacent_to_ch0;
+                        uint8_t adjacent_to_ch1;
+                } __packed tdm_param;
+                /*
+                 * EC_CODEC_I2S_SET_BCLK
+                 */
+                uint32_t bclk;
+        };
+} __packed;
+/*
+ * For subcommand EC_CODEC_GET_GAIN.
+ */
+struct ec_response_codec_gain {
+        uint8_t left;
+        uint8_t right;
+} __packed;
+/*****************************************************************************/
 /* System commands */
 /*
diff --git a/include/linux/mfd/ingenic-tcu.h b/include/linux/mfd/ingenic-tcu.h
index ab16ad283def..2083fa20821d 100644
--- a/include/linux/mfd/ingenic-tcu.h
+++ b/include/linux/mfd/ingenic-tcu.h
@@ -41,7 +41,7 @@
 #define TCU_TCSR_PRESCALE_LSB           3
 #define TCU_TCSR_PRESCALE_MASK          0x38
-#define TCU_TCSR_PWM_SD         BIT(9)  /* 0: Shutdown abruptly 1: gracefully */
+#define TCU_TCSR_PWM_SD         BIT(9)  /* 0: Shutdown gracefully 1: abruptly */
 #define TCU_TCSR_PWM_INITL_HIGH BIT(8)  /* Sets the initial output level */
 #define TCU_TCSR_PWM_EN         BIT(7)  /* PWM pin output enable */
diff --git a/include/linux/mfd/madera/core.h b/include/linux/mfd/madera/core.h
index fe69c0f4398f..4d5d51a9c8a6 100644
--- a/include/linux/mfd/madera/core.h
+++ b/include/linux/mfd/madera/core.h
@@ -15,6 +15,7 @@
 #include <linux/gpio/consumer.h>
 #include <linux/interrupt.h>
 #include <linux/mfd/madera/pdata.h>
+#include <linux/mutex.h>
 #include <linux/notifier.h>
 #include <linux/regmap.h>
 #include <linux/regulator/consumer.h>
@@ -37,6 +38,8 @@ enum madera_type {
 #define MADERA_MAX_MICBIAS              4
+#define MADERA_MAX_HP_OUTPUT            3
 /* Notifier events */
 #define MADERA_NOTIFY_VOICE_TRIGGER     0x1
 #define MADERA_NOTIFY_HPDET             0x2
@@ -183,6 +186,10 @@ struct madera {
        unsigned int num_childbias[MADERA_MAX_MICBIAS];
        struct snd_soc_dapm_context *dapm;
+        struct mutex dapm_ptr_lock;
+        unsigned int hp_ena;
+        bool out_clamp[MADERA_MAX_HP_OUTPUT];
+        bool out_shorted[MADERA_MAX_HP_OUTPUT];
        struct blocking_notifier_head notifier;
 };
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index b9a53e013bff..483168403ae5 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -78,6 +78,8 @@
 #define STEPCONFIG_YNN          BIT(8)
 #define STEPCONFIG_XNP          BIT(9)
 #define STEPCONFIG_YPN          BIT(10)
+#define STEPCONFIG_RFP(val)     ((val) << 12)
+#define STEPCONFIG_RFP_VREFP    (0x3 << 12)
 #define STEPCONFIG_INM_MASK     (0xF << 15)
 #define STEPCONFIG_INM(val)     ((val) << 15)
 #define STEPCONFIG_INM_ADCREFM  STEPCONFIG_INM(8)
@@ -86,6 +88,8 @@
 #define STEPCONFIG_INP_AN4      STEPCONFIG_INP(4)
 #define STEPCONFIG_INP_ADCREFM  STEPCONFIG_INP(8)
 #define STEPCONFIG_FIFO1        BIT(26)
+#define STEPCONFIG_RFM(val)     ((val) << 23)
+#define STEPCONFIG_RFM_VREFN    (0x3 << 23)
 /* Delay register */
 #define STEPDELAY_OPEN_MASK     (0x3FFFF << 0)
diff --git a/include/linux/mfd/tmio.h b/include/linux/mfd/tmio.h
index e2687a30e5a1..739b7bf37eaa 100644
--- a/include/linux/mfd/tmio.h
+++ b/include/linux/mfd/tmio.h
@@ -79,7 +79,7 @@
 /* Some controllers have a CBSY bit */
 #define TMIO_MMC_HAVE_CBSY              BIT(11)
-/* Some controllers that support HS400 use use 4 taps while others use 8. */
+/* Some controllers that support HS400 use 4 taps while others use 8. */
 #define TMIO_MMC_HAVE_4TAP_HS400        BIT(13)
 int tmio_core_mmc_enable(void __iomem *cnf, int shift, unsigned long base);
diff --git a/include/linux/of.h b/include/linux/of.h
index fe472e5195a9..e240992e5cb6 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -50,7 +50,6 @@ struct of_irq_controller;
 struct device_node {
        const char *name;
-        const char *type;
        phandle phandle;
        const char *full_name;
        struct fwnode_handle fwnode;
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 3b051f761450..ef20aeea10cc 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -48,6 +48,7 @@ extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_gbit_features) __ro_after_init;
 extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_gbit_fibre_features) __ro_after_init;
 extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_gbit_all_ports_features) __ro_after_init;
 extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_features) __ro_after_init;
+extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_fec_features) __ro_after_init;
 extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_full_features) __ro_after_init;
 #define PHY_BASIC_FEATURES ((unsigned long *)&phy_basic_features)
@@ -56,6 +57,7 @@ extern __ETHTOOL_DECLARE_LINK_MODE_MASK(phy_10gbit_full_features) __ro_after_ini
 #define PHY_GBIT_FIBRE_FEATURES ((unsigned long *)&phy_gbit_fibre_features)
 #define PHY_GBIT_ALL_PORTS_FEATURES ((unsigned long *)&phy_gbit_all_ports_features)
 #define PHY_10GBIT_FEATURES ((unsigned long *)&phy_10gbit_features)
+#define PHY_10GBIT_FEC_FEATURES ((unsigned long *)&phy_10gbit_fec_features)
 #define PHY_10GBIT_FULL_FEATURES ((unsigned long *)&phy_10gbit_full_features)
 extern const int phy_10_100_features_array[4];
@@ -467,8 +469,8 @@ struct phy_device {
 *   only works for PHYs with IDs which match this field
 * name: The friendly name of this PHY type
 * phy_id_mask: Defines the important bits of the phy_id
- * features: A list of features (speed, duplex, etc) supported
+ * features: A mandatory list of features (speed, duplex, etc)
- *   by this PHY
+ *   supported by this PHY
 * flags: A bitfield defining certain other features this PHY
 *   supports (like interrupts)
 *
diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
index 59ddf9af909e..2dd0a9ed5b36 100644
--- a/include/linux/qed/qed_chain.h
+++ b/include/linux/qed/qed_chain.h
@@ -663,6 +663,37 @@ out:
 static inline void qed_chain_set_prod(struct qed_chain *p_chain,
                                      u32 prod_idx, void *p_prod_elem)
 {
+        if (p_chain->mode == QED_CHAIN_MODE_PBL) {
+                u32 cur_prod, page_mask, page_cnt, page_diff;
+                cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
+                           p_chain->u.chain32.prod_idx;
+                /* Assume that number of elements in a page is power of 2 */
+                page_mask = ~p_chain->elem_per_page_mask;
+                /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
+                 * reaches the first element of next page before the page index
+                 * is incremented. See qed_chain_produce().
+                 * Index wrap around is not a problem because the difference
+                 * between current and given producer indices is always
+                 * positive and lower than the chain's capacity.
+                 */
+                page_diff = (((cur_prod - 1) & page_mask) -
+                             ((prod_idx - 1) & page_mask)) /
+                            p_chain->elem_per_page;
+                page_cnt = qed_chain_get_page_cnt(p_chain);
+                if (is_chain_u16(p_chain))
+                        p_chain->pbl.c.u16.prod_page_idx =
+                                (p_chain->pbl.c.u16.prod_page_idx -
+                                 page_diff + page_cnt) % page_cnt;
+                else
+                        p_chain->pbl.c.u32.prod_page_idx =
+                                (p_chain->pbl.c.u32.prod_page_idx -
+                                 page_diff + page_cnt) % page_cnt;
+        }
        if (is_chain_u16(p_chain))
                p_chain->u.chain16.prod_idx = (u16) prod_idx;
        else
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 224666226e87..d2f90fa92468 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1406,6 +1406,7 @@ extern struct pid *cad_pid;
 #define PF_RANDOMIZE            0x00400000      /* Randomize virtual address space */
 #define PF_SWAPWRITE            0x00800000      /* Allowed to write to swap */
 #define PF_MEMSTALL             0x01000000      /* Stalled due to lack of memory */
+#define PF_UMH                  0x02000000      /* I'm an Usermodehelper process */
 #define PF_NO_SETAFFINITY       0x04000000      /* Userland is not allowed to meddle with cpus_allowed */
 #define PF_MCE_EARLY            0x08000000      /* Early kill for mce process policy */
 #define PF_MUTEX_TESTER         0x20000000      /* Thread belongs to the rt mutex tester */
@@ -1904,6 +1905,14 @@ static inline void rseq_execve(struct task_struct *t)
 #endif
+void __exit_umh(struct task_struct *tsk);
+static inline void exit_umh(struct task_struct *tsk)
+{
+        if (unlikely(tsk->flags & PF_UMH))
+                __exit_umh(tsk);
+}
 #ifdef CONFIG_DEBUG_RSEQ
 void rseq_syscall(struct pt_regs *regs);
diff --git a/include/linux/sched/wake_q.h b/include/linux/sched/wake_q.h
index 10b19a192b2d..545f37138057 100644
--- a/include/linux/sched/wake_q.h
+++ b/include/linux/sched/wake_q.h
@@ -24,9 +24,13 @@
 * called near the end of a function. Otherwise, the list can be
 * re-initialized for later re-use by wake_q_init().
 *
- * Note that this can cause spurious wakeups. schedule() callers
+ * NOTE that this can cause spurious wakeups. schedule() callers
 * must ensure the call is done inside a loop, confirming that the
 * wakeup condition has in fact occurred.
+ *
+ * NOTE that there is no guarantee the wakeup will happen any later than the
+ * wake_q_add() location. Therefore task must be ready to be woken at the
+ * location of the wake_q_add().
 */
 #include <linux/sched.h>
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 93f56fddd92a..95d25b010a25 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3218,6 +3218,7 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len);
 *
 *      This is exactly the same as pskb_trim except that it ensures the
 *      checksum of received packets are still valid after the operation.
+ *      It can change skb pointers.
 */
 static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
diff --git a/include/linux/umh.h b/include/linux/umh.h
index 235f51b62c71..0c08de356d0d 100644
--- a/include/linux/umh.h
+++ b/include/linux/umh.h
@@ -47,6 +47,8 @@ struct umh_info {
        const char *cmdline;
        struct file *pipe_to_umh;
        struct file *pipe_from_umh;
+        struct list_head list;
+        void (*cleanup)(struct umh_info *info);
        pid_t pid;
 };
 int fork_usermode_blob(void *data, size_t len, struct umh_info *info);
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 32baf8e26735..987b6491b946 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -12,6 +12,11 @@ struct irq_affinity;
 /**
 * virtio_config_ops - operations for configuring a virtio device
+ * Note: Do not assume that a transport implements all of the operations
+ *       getting/setting a value as a simple read/write! Generally speaking,
+ *       any of @get/@set, @get_status/@set_status, or @get_features/
+ *       @finalize_features are NOT safe to be called from an atomic
+ *       context.
 * @get: read the value of a configuration field
 *      vdev: the virtio_device
 *      offset: the offset of the configuration field
@@ -22,7 +27,7 @@ struct irq_affinity;
 *      offset: the offset of the configuration field
 *      buf: the buffer to read the field value from.
 *      len: the length of the buffer
- * @generation: config generation counter
+ * @generation: config generation counter (optional)
 *      vdev: the virtio_device
 *      Returns the config generation counter
 * @get_status: read the status byte
@@ -48,17 +53,17 @@ struct irq_affinity;
 * @del_vqs: free virtqueues found by find_vqs().
 * @get_features: get the array of feature bits for this device.
 *      vdev: the virtio_device
- *      Returns the first 32 feature bits (all we currently need).
+ *      Returns the first 64 feature bits (all we currently need).
 * @finalize_features: confirm what device features we'll be using.
 *      vdev: the virtio_device
 *      This gives the final feature bits for the device: it can change
 *      the dev->feature bits if it wants.
 *      Returns 0 on success or error status
- * @bus_name: return the bus name associated with the device
+ * @bus_name: return the bus name associated with the device (optional)
 *      vdev: the virtio_device
 *      This returns a pointer to the bus name a la pci_name from which
 *      the caller can then copy.
- * @set_vq_affinity: set the affinity for a virtqueue.
+ * @set_vq_affinity: set the affinity for a virtqueue (optional).
 * @get_vq_affinity: get the affinity for a virtqueue (optional).
 */
 typedef void vq_callback_t(struct virtqueue *);
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index f492e21c4aa2..5d9d318bcf7a 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -176,7 +176,8 @@ static inline bool xa_is_internal(const void *entry)
 */
 static inline bool xa_is_err(const void *entry)
 {
-        return unlikely(xa_is_internal(entry));
+        return unlikely(xa_is_internal(entry) &&
+                        entry >= xa_mk_internal(-MAX_ERRNO));
 }
 /**
@@ -286,7 +287,6 @@ struct xarray {
 */
 #define DEFINE_XARRAY_ALLOC(name) DEFINE_XARRAY_FLAGS(name, XA_FLAGS_ALLOC)
-void xa_init_flags(struct xarray *, gfp_t flags);
 void *xa_load(struct xarray *, unsigned long index);
 void *xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *xa_erase(struct xarray *, unsigned long index);
@@ -304,6 +304,24 @@ unsigned int xa_extract(struct xarray *, void **dst, unsigned long start,
 void xa_destroy(struct xarray *);
 /**
+ * xa_init_flags() - Initialise an empty XArray with flags.
+ * @xa: XArray.
+ * @flags: XA_FLAG values.
+ *
+ * If you need to initialise an XArray with special flags (eg you need
+ * to take the lock from interrupt context), use this function instead
+ * of xa_init().
+ *
+ * Context: Any context.
+ */
+static inline void xa_init_flags(struct xarray *xa, gfp_t flags)
+{
+        spin_lock_init(&xa->xa_lock);
+        xa->xa_flags = flags;
+        xa->xa_head = NULL;
+}
+/**
 * xa_init() - Initialise an empty XArray.
 * @xa: XArray.
 *
@@ -342,20 +360,45 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 }
 /**
- * xa_for_each() - Iterate over a portion of an XArray.
+ * xa_for_each_start() - Iterate over a portion of an XArray.
 * @xa: XArray.
+ * @index: Index of @entry.
 * @entry: Entry retrieved from array.
+ * @start: First index to retrieve from array.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  You may modify @index during the iteration if you
+ * want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set
+ * to NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_start() is O(n.log(n)) while xas_for_each() is O(n).  You have
+ * to handle your own locking with xas_for_each(), and if you have to unlock
+ * after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_start() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each() iterator instead.
+ * The xas_for_each() iterator will expand into more inline code than
+ * xa_for_each_start().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_start(xa, index, entry, start)                      \
+        for (index = start,                                             \
+             entry = xa_find(xa, &index, ULONG_MAX, XA_PRESENT);        \
+             entry;                                                     \
+             entry = xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT))
+/**
+ * xa_for_each() - Iterate over present entries in an XArray.
+ * @xa: XArray.
 * @index: Index of @entry.
- * @max: Maximum index to retrieve from array.
+ * @entry: Entry retrieved from array.
- * @filter: Selection criterion.
 *
- * Initialise @index to the lowest index you want to retrieve from the
+ * During the iteration, @entry will have the value of the entry stored
- * array.  During the iteration, @entry will have the value of the entry
+ * in @xa at @index.  You may modify @index during the iteration if you want
- * stored in @xa at @index.  The iteration will skip all entries in the
+ * to skip or reprocess indices.  It is safe to modify the array during the
- * array which do not match @filter.  You may modify @index during the
+ * iteration.  At the end of the iteration, @entry will be set to NULL and
- * iteration if you want to skip or reprocess indices.  It is safe to modify
+ * @index will have a value less than or equal to max.
- * the array during the iteration.  At the end of the iteration, @entry will
- * be set to NULL and @index will have a value less than or equal to max.
 *
 * xa_for_each() is O(n.log(n)) while xas_for_each() is O(n).  You have
 * to handle your own locking with xas_for_each(), and if you have to unlock
@@ -366,9 +409,36 @@ static inline bool xa_marked(const struct xarray *xa, xa_mark_t mark)
 *
 * Context: Any context.  Takes and releases the RCU lock.
 */
-#define xa_for_each(xa, entry, index, max, filter) \
+#define xa_for_each(xa, index, entry) \
-        for (entry = xa_find(xa, &index, max, filter); entry; \
+        xa_for_each_start(xa, index, entry, 0)
-             entry = xa_find_after(xa, &index, max, filter))
+/**
+ * xa_for_each_marked() - Iterate over marked entries in an XArray.
+ * @xa: XArray.
+ * @index: Index of @entry.
+ * @entry: Entry retrieved from array.
+ * @filter: Selection criterion.
+ *
+ * During the iteration, @entry will have the value of the entry stored
+ * in @xa at @index.  The iteration will skip all entries in the array
+ * which do not match @filter.  You may modify @index during the iteration
+ * if you want to skip or reprocess indices.  It is safe to modify the array
+ * during the iteration.  At the end of the iteration, @entry will be set to
+ * NULL and @index will have a value less than or equal to max.
+ *
+ * xa_for_each_marked() is O(n.log(n)) while xas_for_each_marked() is O(n).
+ * You have to handle your own locking with xas_for_each(), and if you have
+ * to unlock after each iteration, it will also end up being O(n.log(n)).
+ * xa_for_each_marked() will spin if it hits a retry entry; if you intend to
+ * see retry entries, you should use the xas_for_each_marked() iterator
+ * instead.  The xas_for_each_marked() iterator will expand into more inline
+ * code than xa_for_each_marked().
+ *
+ * Context: Any context.  Takes and releases the RCU lock.
+ */
+#define xa_for_each_marked(xa, index, entry, filter) \
+        for (index = 0, entry = xa_find(xa, &index, ULONG_MAX, filter); \
+             entry; entry = xa_find_after(xa, &index, ULONG_MAX, filter))
 #define xa_trylock(xa)          spin_trylock(&(xa)->xa_lock)
 #define xa_lock(xa)             spin_lock(&(xa)->xa_lock)
@@ -393,40 +463,13 @@ void *__xa_erase(struct xarray *, unsigned long index);
 void *__xa_store(struct xarray *, unsigned long index, void *entry, gfp_t);
 void *__xa_cmpxchg(struct xarray *, unsigned long index, void *old,
                void *entry, gfp_t);
+int __xa_insert(struct xarray *, unsigned long index, void *entry, gfp_t);
 int __xa_alloc(struct xarray *, u32 *id, u32 max, void *entry, gfp_t);
 int __xa_reserve(struct xarray *, unsigned long index, gfp_t);
 void __xa_set_mark(struct xarray *, unsigned long index, xa_mark_t);
 void __xa_clear_mark(struct xarray *, unsigned long index, xa_mark_t);
 /**
- * __xa_insert() - Store this entry in the XArray unless another entry is
- *                      already present.
- * @xa: XArray.
- * @index: Index into array.
- * @entry: New entry.
- * @gfp: Memory allocation flags.
- *
- * If you would rather see the existing entry in the array, use __xa_cmpxchg().
- * This function is for users who don't care what the entry is, only that
- * one is present.
- *
- * Context: Any context.  Expects xa_lock to be held on entry.  May
- *          release and reacquire xa_lock if the @gfp flags permit.
- * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
- * -ENOMEM if memory could not be allocated.
- */
-static inline int __xa_insert(struct xarray *xa, unsigned long index,
-                void *entry, gfp_t gfp)
-{
-        void *curr = __xa_cmpxchg(xa, index, NULL, entry, gfp);
-        if (!curr)
-                return 0;
-        if (xa_is_err(curr))
-                return xa_err(curr);
-        return -EEXIST;
-}
-/**
 * xa_store_bh() - Store this entry in the XArray.
 * @xa: XArray.
 * @index: Index into array.
@@ -453,7 +496,7 @@ static inline void *xa_store_bh(struct xarray *xa, unsigned long index,
 }
 /**
- * xa_store_irq() - Erase this entry from the XArray.
+ * xa_store_irq() - Store this entry in the XArray.
 * @xa: XArray.
 * @index: Index into array.
 * @entry: New entry.
@@ -615,24 +658,83 @@ static inline void *xa_cmpxchg_irq(struct xarray *xa, unsigned long index,
 * @entry: New entry.
 * @gfp: Memory allocation flags.
 *
- * If you would rather see the existing entry in the array, use xa_cmpxchg().
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
- * This function is for users who don't care what the entry is, only that
+ * if no entry is present.  Inserting will fail if a reserved entry is
- * one is present.
+ * present, even though loading from this index will return NULL.
 *
- * Context: Process context.  Takes and releases the xa_lock.
+ * Context: Any context.  Takes and releases the xa_lock.  May sleep if
- *          May sleep if the @gfp flags permit.
+ * the @gfp flags permit.
 * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
 * -ENOMEM if memory could not be allocated.
 */
 static inline int xa_insert(struct xarray *xa, unsigned long index,
                void *entry, gfp_t gfp)
 {
-        void *curr = xa_cmpxchg(xa, index, NULL, entry, gfp);
+        int err;
-        if (!curr)
-                return 0;
+        xa_lock(xa);
-        if (xa_is_err(curr))
+        err = __xa_insert(xa, index, entry, gfp);
-                return xa_err(curr);
+        xa_unlock(xa);
-        return -EEXIST;
+        return err;
+}
+/**
+ * xa_insert_bh() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Takes and releases the xa_lock while
+ * disabling softirqs.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_bh(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+        xa_lock_bh(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_bh(xa);
+        return err;
+}
+/**
+ * xa_insert_irq() - Store this entry in the XArray unless another entry is
+ *                      already present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Process context.  Takes and releases the xa_lock while
+ * disabling interrupts.  May sleep if the @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+static inline int xa_insert_irq(struct xarray *xa, unsigned long index,
+                void *entry, gfp_t gfp)
+{
+        int err;
+        xa_lock_irq(xa);
+        err = __xa_insert(xa, index, entry, gfp);
+        xa_unlock_irq(xa);
+        return err;
 }
 /**
@@ -970,8 +1072,8 @@ static inline bool xa_is_sibling(const void *entry)
                (entry < xa_mk_sibling(XA_CHUNK_SIZE - 1));
 }
-#define XA_ZERO_ENTRY           xa_mk_internal(256)
+#define XA_RETRY_ENTRY          xa_mk_internal(256)
-#define XA_RETRY_ENTRY          xa_mk_internal(257)
+#define XA_ZERO_ENTRY           xa_mk_internal(257)
 /**
 * xa_is_zero() - Is the entry a zero entry?
@@ -996,6 +1098,17 @@ static inline bool xa_is_retry(const void *entry)
 }
 /**
+ * xa_is_advanced() - Is the entry only permitted for the advanced API?
+ * @entry: Entry to be stored in the XArray.
+ *
+ * Return: %true if the entry cannot be stored by the normal API.
+ */
+static inline bool xa_is_advanced(const void *entry)
+{
+        return xa_is_internal(entry) && (entry <= XA_RETRY_ENTRY);
+}
+/**
 * typedef xa_update_node_t - A callback function from the XArray.
 * @node: The node which is being processed
 *
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 1adefe42c0a6..2bfb87eb98ce 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -21,18 +21,6 @@ struct socket;
 struct rxrpc_call;
 /*
- * Call completion condition (state == RXRPC_CALL_COMPLETE).
- */
-enum rxrpc_call_completion {
-        RXRPC_CALL_SUCCEEDED,           /* - Normal termination */
-        RXRPC_CALL_REMOTELY_ABORTED,    /* - call aborted by peer */
-        RXRPC_CALL_LOCALLY_ABORTED,     /* - call aborted locally on error or close */
-        RXRPC_CALL_LOCAL_ERROR,         /* - call failed due to local error */
-        RXRPC_CALL_NETWORK_ERROR,       /* - call terminated by network error */
-        NR__RXRPC_CALL_COMPLETIONS
-};
-/*
 * Debug ID counter for tracing.
 */
 extern atomic_t rxrpc_debug_id;
@@ -73,10 +61,6 @@ int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t,
                               rxrpc_user_attach_call_t, unsigned long, gfp_t,
                               unsigned int);
 void rxrpc_kernel_set_tx_length(struct socket *, struct rxrpc_call *, s64);
-int rxrpc_kernel_retry_call(struct socket *, struct rxrpc_call *,
-                            struct sockaddr_rxrpc *, struct key *);
-int rxrpc_kernel_check_call(struct socket *, struct rxrpc_call *,
-                            enum rxrpc_call_completion *, u32 *);
 u32 rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
 void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
 u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 3f9aea8087e3..8b7eb46ad72d 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -201,6 +201,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt)
 void __ax25_put_route(ax25_route *ax25_rt);
+extern rwlock_t ax25_route_lock;
+static inline void ax25_route_lock_use(void)
+{
+        read_lock(&ax25_route_lock);
+}
+static inline void ax25_route_lock_unuse(void)
+{
+        read_unlock(&ax25_route_lock);
+}
 static inline void ax25_put_route(ax25_route *ax25_rt)
 {
        if (refcount_dec_and_test(&ax25_rt->refcount))
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index c5969762a8f4..9c8214d2116d 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -241,7 +241,7 @@ int fib_table_delete(struct net *, struct fib_table *, struct fib_config *,
                     struct netlink_ext_ack *extack);
 int fib_table_dump(struct fib_table *table, struct sk_buff *skb,
                   struct netlink_callback *cb, struct fib_dump_filter *filter);
-int fib_table_flush(struct net *net, struct fib_table *table);
+int fib_table_flush(struct net *net, struct fib_table *table, bool flush_all);
 struct fib_table *fib_trie_unmerge(struct fib_table *main_tb);
 void fib_table_flush_external(struct fib_table *table);
 void fib_free_table(struct fib_table *tb);
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 7d5cda7ce32a..3e370cb36263 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -84,7 +84,6 @@ struct flow_offload {
 struct nf_flow_route {
        struct {
                struct dst_entry        *dst;
-                int                     ifindex;
        } tuple[FLOW_OFFLOAD_DIR_MAX];
 };
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 8ec1de856ee7..e665f111b0d2 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -985,6 +985,12 @@ struct snd_soc_dai_link {
        /* Do not create a PCM for this DAI link (Backend link) */
        unsigned int ignore:1;
+        /*
+         * This driver uses legacy platform naming. Set by the core, machine
+         * drivers should not modify this value.
+         */
+        unsigned int legacy_platform:1;
        struct list_head list; /* DAI link list of the soc card */
        struct snd_soc_dobj dobj; /* For topology */
 };
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index 33d291888ba9..e3f005eae1f7 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -25,6 +25,7 @@
 enum afs_call_trace {
        afs_call_trace_alloc,
        afs_call_trace_free,
+        afs_call_trace_get,
        afs_call_trace_put,
        afs_call_trace_wake,
        afs_call_trace_work,
@@ -159,6 +160,7 @@ enum afs_file_error {
 #define afs_call_traces \
        EM(afs_call_trace_alloc,                "ALLOC") \
        EM(afs_call_trace_free,                 "FREE ") \
+        EM(afs_call_trace_get,                  "GET  ") \
        EM(afs_call_trace_put,                  "PUT  ") \
        EM(afs_call_trace_wake,                 "WAKE ") \
        E_(afs_call_trace_work,                 "WORK ")
diff --git a/include/uapi/linux/android/binder_ctl.h b/include/uapi/linux/android/binderfs.h
index 65b2efd1a0a5..87410477aea9 100644
--- a/include/uapi/linux/android/binder_ctl.h
+++ b/include/uapi/linux/android/binderfs.h
@@ -4,8 +4,8 @@
 *
 */
-#ifndef _UAPI_LINUX_BINDER_CTL_H
+#ifndef _UAPI_LINUX_BINDERFS_H
-#define _UAPI_LINUX_BINDER_CTL_H
+#define _UAPI_LINUX_BINDERFS_H
 #include <linux/android/binder.h>
 #include <linux/types.h>
@@ -22,8 +22,8 @@
 */
 struct binderfs_device {
        char name[BINDERFS_MAX_NAME + 1];
-        __u8 major;
+        __u32 major;
-        __u8 minor;
+        __u32 minor;
 };
 /**
@@ -31,5 +31,5 @@ struct binderfs_device {
 */
 #define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device)
-#endif /* _UAPI_LINUX_BINDER_CTL_H */
+#endif /* _UAPI_LINUX_BINDERFS_H */
diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h
index 6fa38d001d84..498eec813494 100644
--- a/include/uapi/linux/blkzoned.h
+++ b/include/uapi/linux/blkzoned.h
@@ -138,6 +138,7 @@ struct blk_zone_range {
 * @BLKRESETZONE: Reset the write pointer of the zones in the specified
 *                sector range. The sector range must be zone aligned.
 * @BLKGETZONESZ: Get the device zone size in number of 512 B sectors.
+ * @BLKGETNRZONES: Get the total number of zones of the device.
 */
 #define BLKREPORTZONE   _IOWR(0x12, 130, struct blk_zone_report)
 #define BLKRESETZONE    _IOW(0x12, 131, struct blk_zone_range)
diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
index f6052e70bf40..a55cb8b10165 100644
--- a/include/uapi/linux/in.h
+++ b/include/uapi/linux/in.h
@@ -268,7 +268,7 @@ struct sockaddr_in {
 #define IN_MULTICAST(a)         IN_CLASSD(a)
 #define IN_MULTICAST_NET        0xe0000000
-#define IN_BADCLASS(a)          ((((long int) (a) ) == 0xffffffff)
+#define IN_BADCLASS(a)          (((long int) (a) ) == (long int)0xffffffff)
 #define IN_EXPERIMENTAL(a)      IN_BADCLASS((a))
 #define IN_CLASSE(a)            ((((long int) (a)) & 0xf0000000) == 0xf0000000)
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index fb78f6f500f3..f056b2a00d5c 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -26,13 +26,17 @@
 */
 struct input_event {
-#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL)
+#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL__)
        struct timeval time;
 #define input_event_sec time.tv_sec
 #define input_event_usec time.tv_usec
 #else
        __kernel_ulong_t __sec;
+#if defined(__sparc__) && defined(__arch64__)
+        unsigned int __usec;
+#else
        __kernel_ulong_t __usec;
+#endif
 #define input_event_sec  __sec
 #define input_event_usec __usec
 #endif
diff --git a/include/uapi/linux/ptp_clock.h b/include/uapi/linux/ptp_clock.h
index d73d83950265..1bc794ad957a 100644
--- a/include/uapi/linux/ptp_clock.h
+++ b/include/uapi/linux/ptp_clock.h
@@ -147,7 +147,7 @@ struct ptp_pin_desc {
 #define PTP_SYS_OFFSET_PRECISE \
        _IOWR(PTP_CLK_MAGIC, 8, struct ptp_sys_offset_precise)
 #define PTP_SYS_OFFSET_EXTENDED \
-        _IOW(PTP_CLK_MAGIC, 9, struct ptp_sys_offset_extended)
+        _IOWR(PTP_CLK_MAGIC, 9, struct ptp_sys_offset_extended)
 struct ptp_extts_event {
        struct ptp_clock_time t; /* Time event occured. */
diff --git a/include/uapi/rdma/vmw_pvrdma-abi.h b/include/uapi/rdma/vmw_pvrdma-abi.h
index d13fd490b66d..6e73f0274e41 100644
--- a/include/uapi/rdma/vmw_pvrdma-abi.h
+++ b/include/uapi/rdma/vmw_pvrdma-abi.h
@@ -78,6 +78,7 @@ enum pvrdma_wr_opcode {
        PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD,
        PVRDMA_WR_BIND_MW,
        PVRDMA_WR_REG_SIG_MR,
+        PVRDMA_WR_ERROR,
 };
 enum pvrdma_wc_status {
diff --git a/include/xen/arm/page-coherent.h b/include/xen/arm/page-coherent.h
index 59a260712a56..2ca9164a79bf 100644
--- a/include/xen/arm/page-coherent.h
+++ b/include/xen/arm/page-coherent.h
@@ -1,17 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _ASM_ARM_XEN_PAGE_COHERENT_H
+#ifndef _XEN_ARM_PAGE_COHERENT_H
-#define _ASM_ARM_XEN_PAGE_COHERENT_H
+#define _XEN_ARM_PAGE_COHERENT_H
-#include <asm/page.h>
-#include <asm/dma-mapping.h>
-#include <linux/dma-mapping.h>
-static inline const struct dma_map_ops *xen_get_dma_ops(struct device *dev)
-{
-        if (dev && dev->archdata.dev_dma_ops)
-                return dev->archdata.dev_dma_ops;
-        return get_arch_dma_ops(NULL);
-}
 void __xen_dma_map_page(struct device *hwdev, struct page *page,
             dma_addr_t dev_addr, unsigned long offset, size_t size,
@@ -21,87 +10,7 @@ void __xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
                unsigned long attrs);
 void __xen_dma_sync_single_for_cpu(struct device *hwdev,
                dma_addr_t handle, size_t size, enum dma_data_direction dir);
 void __xen_dma_sync_single_for_device(struct device *hwdev,
                dma_addr_t handle, size_t size, enum dma_data_direction dir);
-static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
+#endif /* _XEN_ARM_PAGE_COHERENT_H */
-                dma_addr_t *dma_handle, gfp_t flags, unsigned long attrs)
-{
-        return xen_get_dma_ops(hwdev)->alloc(hwdev, size, dma_handle, flags, attrs);
-}
-static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
-                void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
-{
-        xen_get_dma_ops(hwdev)->free(hwdev, size, cpu_addr, dma_handle, attrs);
-}
-static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             dma_addr_t dev_addr, unsigned long offset, size_t size,
-             enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long page_pfn = page_to_xen_pfn(page);
-        unsigned long dev_pfn = XEN_PFN_DOWN(dev_addr);
-        unsigned long compound_pages =
-                (1<<compound_order(page)) * XEN_PFN_PER_PAGE;
-        bool local = (page_pfn <= dev_pfn) &&
-                (dev_pfn - page_pfn < compound_pages);
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can span across
-         * multiple Xen pages, it's not possible for it to contain a
-         * mix of local and foreign Xen pages. So if the first xen_pfn
-         * == mfn the page is local otherwise it's a foreign page
-         * grant-mapped in dom0. If the page is local we can safely
-         * call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (local)
-                xen_get_dma_ops(hwdev)->map_page(hwdev, page, offset, size, dir, attrs);
-        else
-                __xen_dma_map_page(hwdev, page, dev_addr, offset, size, dir, attrs);
-}
-static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir, unsigned long attrs)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        /*
-         * Dom0 is mapped 1:1, while the Linux page can be spanned accross
-         * multiple Xen page, it's not possible to have a mix of local and
-         * foreign Xen page. Dom0 is mapped 1:1, so calling pfn_valid on a
-         * foreign mfn will always return false. If the page is local we can
-         * safely call the native dma_ops function, otherwise we call the xen
-         * specific function.
-         */
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->unmap_page)
-                        xen_get_dma_ops(hwdev)->unmap_page(hwdev, handle, size, dir, attrs);
-        } else
-                __xen_dma_unmap_page(hwdev, handle, size, dir, attrs);
-}
-static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_cpu)
-                        xen_get_dma_ops(hwdev)->sync_single_for_cpu(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_cpu(hwdev, handle, size, dir);
-}
-static inline void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir)
-{
-        unsigned long pfn = PFN_DOWN(handle);
-        if (pfn_valid(pfn)) {
-                if (xen_get_dma_ops(hwdev)->sync_single_for_device)
-                        xen_get_dma_ops(hwdev)->sync_single_for_device(hwdev, handle, size, dir);
-        } else
-                __xen_dma_sync_single_for_device(hwdev, handle, size, dir);
-}
-#endif /* _ASM_ARM_XEN_PAGE_COHERENT_H */
diff --git a/init/Kconfig b/init/Kconfig
index d47cb77a220e..513fa544a134 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1124,6 +1124,7 @@ config LD_DEAD_CODE_DATA_ELIMINATION
        bool "Dead code and data elimination (EXPERIMENTAL)"
        depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
        depends on EXPERT
+        depends on !(FUNCTION_TRACER && CC_IS_GCC && GCC_VERSION < 40800)
        depends on $(cc-option,-ffunction-sections -fdata-sections)
        depends on $(ld-option,--gc-sections)
        help
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 715f9fcf4712..befe570be5ba 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -467,7 +467,7 @@ static const struct btf_kind_operations *btf_type_ops(const struct btf_type *t)
        return kind_ops[BTF_INFO_KIND(t->info)];
 }
-bool btf_name_offset_valid(const struct btf *btf, u32 offset)
+static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
 {
        return BTF_STR_OFFSET_VALID(offset) &&
                offset < btf->hdr.str_len;
@@ -1219,8 +1219,6 @@ static void btf_bitfield_seq_show(void *data, u8 bits_offset,
        u8 nr_copy_bits;
        u64 print_num;
-        data += BITS_ROUNDDOWN_BYTES(bits_offset);
-        bits_offset = BITS_PER_BYTE_MASKED(bits_offset);
        nr_copy_bits = nr_bits + bits_offset;
        nr_copy_bytes = BITS_ROUNDUP_BYTES(nr_copy_bits);
@@ -1255,7 +1253,9 @@ static void btf_int_bits_seq_show(const struct btf *btf,
         * BTF_INT_OFFSET() cannot exceed 64 bits.
         */
        total_bits_offset = bits_offset + BTF_INT_OFFSET(int_data);
-        btf_bitfield_seq_show(data, total_bits_offset, nr_bits, m);
+        data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
+        bits_offset = BITS_PER_BYTE_MASKED(total_bits_offset);
+        btf_bitfield_seq_show(data, bits_offset, nr_bits, m);
 }
 static void btf_int_seq_show(const struct btf *btf, const struct btf_type *t,
@@ -2001,12 +2001,12 @@ static void btf_struct_seq_show(const struct btf *btf, const struct btf_type *t,
                member_offset = btf_member_bit_offset(t, member);
                bitfield_size = btf_member_bitfield_size(t, member);
+                bytes_offset = BITS_ROUNDDOWN_BYTES(member_offset);
+                bits8_offset = BITS_PER_BYTE_MASKED(member_offset);
                if (bitfield_size) {
-                        btf_bitfield_seq_show(data, member_offset,
+                        btf_bitfield_seq_show(data + bytes_offset, bits8_offset,
                                              bitfield_size, m);
                } else {
-                        bytes_offset = BITS_ROUNDDOWN_BYTES(member_offset);
-                        bits8_offset = BITS_PER_BYTE_MASKED(member_offset);
                        ops = btf_type_ops(member_type);
                        ops->seq_show(btf, member_type, member->type,
                                      data + bytes_offset, bits8_offset, m);
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 9425c2fb872f..ab612fe9862f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -718,6 +718,7 @@ cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_trace_printk:
                if (capable(CAP_SYS_ADMIN))
                        return bpf_get_trace_printk_proto();
+                /* fall through */
        default:
                return NULL;
        }
diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index 99d243e1ad6e..52378d3e34b3 100644
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c
@@ -12,6 +12,7 @@
 struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 {
        struct bpf_map *inner_map, *inner_map_meta;
+        u32 inner_map_meta_size;
        struct fd f;
        f = fdget(inner_map_ufd);
@@ -36,7 +37,12 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
                return ERR_PTR(-EINVAL);
        }
-        inner_map_meta = kzalloc(sizeof(*inner_map_meta), GFP_USER);
+        inner_map_meta_size = sizeof(*inner_map_meta);
+        /* In some cases verifier needs to access beyond just base map. */
+        if (inner_map->ops == &array_map_ops)
+                inner_map_meta_size = sizeof(struct bpf_array);
+        inner_map_meta = kzalloc(inner_map_meta_size, GFP_USER);
        if (!inner_map_meta) {
                fdput(f);
                return ERR_PTR(-ENOMEM);
@@ -46,9 +52,16 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
        inner_map_meta->key_size = inner_map->key_size;
        inner_map_meta->value_size = inner_map->value_size;
        inner_map_meta->map_flags = inner_map->map_flags;
-        inner_map_meta->ops = inner_map->ops;
        inner_map_meta->max_entries = inner_map->max_entries;
+        /* Misc members not needed in bpf_map_meta_equal() check. */
+        inner_map_meta->ops = inner_map->ops;
+        if (inner_map->ops == &array_map_ops) {
+                inner_map_meta->unpriv_array = inner_map->unpriv_array;
+                container_of(inner_map_meta, struct bpf_array, map)->index_mask =
+                     container_of(inner_map, struct bpf_array, map)->index_mask;
+        }
        fdput(f);
        return inner_map_meta;
 }
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 90daf285de03..d43b14535827 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr,
                if (nhdr->n_type == BPF_BUILD_ID &&
                    nhdr->n_namesz == sizeof("GNU") &&
-                    nhdr->n_descsz == BPF_BUILD_ID_SIZE) {
+                    nhdr->n_descsz > 0 &&
+                    nhdr->n_descsz <= BPF_BUILD_ID_SIZE) {
                        memcpy(build_id,
                               note_start + note_offs +
                               ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
-                               BPF_BUILD_ID_SIZE);
+                               nhdr->n_descsz);
+                        memset(build_id + nhdr->n_descsz, 0,
+                               BPF_BUILD_ID_SIZE - nhdr->n_descsz);
                        return 0;
                }
                new_offs = note_offs + sizeof(Elf32_Nhdr) +
@@ -260,7 +263,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
                return -EFAULT; /* page not mapped */
        ret = -EINVAL;
-        page_addr = page_address(page);
+        page_addr = kmap_atomic(page);
        ehdr = (Elf32_Ehdr *)page_addr;
        /* compare magic x7f "ELF" */
@@ -276,6 +279,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
        else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64)
                ret = stack_map_get_build_id_64(page_addr, build_id);
 out:
+        kunmap_atomic(page_addr);
        put_page(page);
        return ret;
 }
@@ -310,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
                for (i = 0; i < trace_nr; i++) {
                        id_offs[i].status = BPF_STACK_BUILD_ID_IP;
                        id_offs[i].ip = ips[i];
+                        memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
                }
                return;
        }
@@ -320,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
                        /* per entry fall back to ips */
                        id_offs[i].status = BPF_STACK_BUILD_ID_IP;
                        id_offs[i].ip = ips[i];
+                        memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
                        continue;
                }
                id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f6bc62a9ee8e..56674a7c3778 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3103,6 +3103,40 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
        }
 }
+static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
+                                    const struct bpf_insn *insn)
+{
+        return env->allow_ptr_leaks || BPF_SRC(insn->code) == BPF_K;
+}
+static int update_alu_sanitation_state(struct bpf_insn_aux_data *aux,
+                                       u32 alu_state, u32 alu_limit)
+{
+        /* If we arrived here from different branches with different
+         * state or limits to sanitize, then this won't work.
+         */
+        if (aux->alu_state &&
+            (aux->alu_state != alu_state ||
+             aux->alu_limit != alu_limit))
+                return -EACCES;
+        /* Corresponding fixup done in fixup_bpf_calls(). */
+        aux->alu_state = alu_state;
+        aux->alu_limit = alu_limit;
+        return 0;
+}
+static int sanitize_val_alu(struct bpf_verifier_env *env,
+                            struct bpf_insn *insn)
+{
+        struct bpf_insn_aux_data *aux = cur_aux(env);
+        if (can_skip_alu_sanitation(env, insn))
+                return 0;
+        return update_alu_sanitation_state(aux, BPF_ALU_NON_POINTER, 0);
+}
 static int sanitize_ptr_alu(struct bpf_verifier_env *env,
                            struct bpf_insn *insn,
                            const struct bpf_reg_state *ptr_reg,
@@ -3117,7 +3151,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
        struct bpf_reg_state tmp;
        bool ret;
-        if (env->allow_ptr_leaks || BPF_SRC(insn->code) == BPF_K)
+        if (can_skip_alu_sanitation(env, insn))
                return 0;
        /* We already marked aux for masking from non-speculative
@@ -3133,19 +3167,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
        if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))
                return 0;
+        if (update_alu_sanitation_state(aux, alu_state, alu_limit))
-        /* If we arrived here from different branches with different
-         * limits to sanitize, then this won't work.
-         */
-        if (aux->alu_state &&
-            (aux->alu_state != alu_state ||
-             aux->alu_limit != alu_limit))
                return -EACCES;
-        /* Corresponding fixup done in fixup_bpf_calls(). */
-        aux->alu_state = alu_state;
-        aux->alu_limit = alu_limit;
 do_sim:
        /* Simulate and find potential out-of-bounds access under
         * speculative execution from truncation as a result of
@@ -3418,6 +3441,8 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
        s64 smin_val, smax_val;
        u64 umin_val, umax_val;
        u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
+        u32 dst = insn->dst_reg;
+        int ret;
        if (insn_bitness == 32) {
                /* Relevant for 32-bit RSH: Information can propagate towards
@@ -3452,6 +3477,11 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
        switch (opcode) {
        case BPF_ADD:
+                ret = sanitize_val_alu(env, insn);
+                if (ret < 0) {
+                        verbose(env, "R%d tried to add from different pointers or scalars\n", dst);
+                        return ret;
+                }
                if (signed_add_overflows(dst_reg->smin_value, smin_val) ||
                    signed_add_overflows(dst_reg->smax_value, smax_val)) {
                        dst_reg->smin_value = S64_MIN;
@@ -3471,6 +3501,11 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);
                break;
        case BPF_SUB:
+                ret = sanitize_val_alu(env, insn);
+                if (ret < 0) {
+                        verbose(env, "R%d tried to sub from different pointers or scalars\n", dst);
+                        return ret;
+                }
                if (signed_sub_overflows(dst_reg->smin_value, smax_val) ||
                    signed_sub_overflows(dst_reg->smax_value, smin_val)) {
                        /* Overflow possible, we know nothing */
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
index d6361776dc5c..1fb6fd68b9c7 100644
--- a/kernel/dma/swiotlb.c
+++ b/kernel/dma/swiotlb.c
@@ -378,6 +378,8 @@ void __init swiotlb_exit(void)
                memblock_free_late(io_tlb_start,
                                   PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
        }
+        io_tlb_start = 0;
+        io_tlb_end = 0;
        io_tlb_nslabs = 0;
        max_segment = 0;
 }
diff --git a/kernel/exit.c b/kernel/exit.c
index 2d14979577ee..3fb7be001964 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
         *        MB (A)              MB (B)
         *    [L] cond            [L] tsk
         */
-        smp_rmb(); /* (B) */
+        smp_mb(); /* (B) */
        /*
         * Avoid using task_rcu_dereference() magic as long as we are careful,
@@ -866,6 +866,7 @@ void __noreturn do_exit(long code)
        exit_task_namespaces(tsk);
        exit_task_work(tsk);
        exit_thread(tsk);
+        exit_umh(tsk);
        /*
         * Flush inherited counters to the parent - before the parent
diff --git a/kernel/futex.c b/kernel/futex.c
index be3bff2315ff..fdd312da0992 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1452,11 +1452,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
        if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
                return;
-        /*
+        get_task_struct(p);
-         * Queue the task for later wakeup for after we've released
-         * the hb->lock. wake_q_add() grabs reference to p.
-         */
-        wake_q_add(wake_q, p);
        __unqueue_futex(q);
        /*
         * The waiting task can free the futex_q as soon as q->lock_ptr = NULL
@@ -1466,6 +1462,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
         * plist_del in __unqueue_futex().
         */
        smp_store_release(&q->lock_ptr, NULL);
+        /*
+         * Queue the task for later wakeup for after we've released
+         * the hb->lock. wake_q_add() grabs reference to p.
+         */
+        wake_q_add(wake_q, p);
+        put_task_struct(p);
 }
 /*
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index ee062b7939d3..ef8ad36cadcf 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -457,7 +457,7 @@ static int alloc_descs(unsigned int start, unsigned int cnt, int node,
        /* Validate affinity mask(s) */
        if (affinity) {
-                for (i = 0; i < cnt; i++, i++) {
+                for (i = 0; i < cnt; i++) {
                        if (cpumask_empty(&affinity[i].mask))
                                return -EINVAL;
                }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index a4888ce4667a..84b54a17b95d 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc)
        }
        cpumask_and(&mask, cpu_online_mask, set);
+        if (cpumask_empty(&mask))
+                cpumask_copy(&mask, cpu_online_mask);
        if (node != NUMA_NO_NODE) {
                const struct cpumask *nodemask = cpumask_of_node(node);
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 09b180063ee1..50d9af615dc4 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
                woken++;
                tsk = waiter->task;
-                wake_q_add(wake_q, tsk);
+                get_task_struct(tsk);
                list_del(&waiter->list);
                /*
-                 * Ensure that the last operation is setting the reader
+                 * Ensure calling get_task_struct() before setting the reader
                 * waiter to nil such that rwsem_down_read_failed() cannot
                 * race with do_exit() by always holding a reference count
                 * to the task to wakeup.
                 */
                smp_store_release(&waiter->task, NULL);
+                /*
+                 * Ensure issuing the wakeup (either by us or someone else)
+                 * after setting the reader waiter to nil.
+                 */
+                wake_q_add(wake_q, tsk);
+                /* wake_q_add() already take the task ref */
+                put_task_struct(tsk);
        }
        adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index a674c7db2f29..d8d76a65cfdd 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -396,6 +396,18 @@ static bool set_nr_if_polling(struct task_struct *p)
 #endif
 #endif
+/**
+ * wake_q_add() - queue a wakeup for 'later' waking.
+ * @head: the wake_q_head to add @task to
+ * @task: the task to queue for 'later' wakeup
+ *
+ * Queue a task for later wakeup, most likely by the wake_up_q() call in the
+ * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
+ * instantly.
+ *
+ * This function must be used as-if it were wake_up_process(); IOW the task
+ * must be ready to be woken at this location.
+ */
 void wake_q_add(struct wake_q_head *head, struct task_struct *task)
 {
        struct wake_q_node *node = &task->wake_q;
@@ -405,10 +417,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
         * its already queued (either by us or someone else) and will get the
         * wakeup due to that.
         *
-         * This cmpxchg() executes a full barrier, which pairs with the full
+         * In order to ensure that a pending wakeup will observe our pending
-         * barrier executed by the wakeup in wake_up_q().
+         * state, even in the failed case, an explicit smp_mb() must be used.
         */
-        if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
+        smp_mb__before_atomic();
+        if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
                return;
        get_task_struct(task);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index d7f538847b84..e815781ed751 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -976,6 +976,9 @@ static int seccomp_notify_release(struct inode *inode, struct file *file)
        struct seccomp_filter *filter = file->private_data;
        struct seccomp_knotif *knotif;
+        if (!filter)
+                return 0;
        mutex_lock(&filter->notify_lock);
        /*
@@ -1300,6 +1303,7 @@ out:
 out_put_fd:
        if (flags & SECCOMP_FILTER_FLAG_NEW_LISTENER) {
                if (ret < 0) {
+                        listener_f->private_data = NULL;
                        fput(listener_f);
                        put_unused_fd(listener);
                } else {
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 8f0644af40be..80f955210861 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -685,6 +685,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
         * set up the signal and overrun bookkeeping.
         */
        timer->it.cpu.incr = timespec64_to_ns(&new->it_interval);
+        timer->it_interval = ns_to_ktime(timer->it.cpu.incr);
        /*
         * This acts as a modification timestamp for the timer,
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 5c19b8c41c7e..d5fb09ebba8b 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -607,11 +607,17 @@ static int trace_kprobe_create(int argc, const char *argv[])
        char buf[MAX_EVENT_NAME_LEN];
        unsigned int flags = TPARG_FL_KERNEL;
-        /* argc must be >= 1 */
+        switch (argv[0][0]) {
-        if (argv[0][0] == 'r') {
+        case 'r':
                is_return = true;
                flags |= TPARG_FL_RETURN;
-        } else if (argv[0][0] != 'p' || argc < 2)
+                break;
+        case 'p':
+                break;
+        default:
+                return -ECANCELED;
+        }
+        if (argc < 2)
                return -ECANCELED;
        event = strchr(&argv[0][1], ':');
diff --git a/kernel/umh.c b/kernel/umh.c
index 0baa672e023c..d937cbad903a 100644
--- a/kernel/umh.c
+++ b/kernel/umh.c
@@ -37,6 +37,8 @@ static kernel_cap_t usermodehelper_bset = CAP_FULL_SET;
 static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET;
 static DEFINE_SPINLOCK(umh_sysctl_lock);
 static DECLARE_RWSEM(umhelper_sem);
+static LIST_HEAD(umh_list);
+static DEFINE_MUTEX(umh_list_lock);
 static void call_usermodehelper_freeinfo(struct subprocess_info *info)
 {
@@ -100,10 +102,12 @@ static int call_usermodehelper_exec_async(void *data)
        commit_creds(new);
        sub_info->pid = task_pid_nr(current);
-        if (sub_info->file)
+        if (sub_info->file) {
                retval = do_execve_file(sub_info->file,
                                        sub_info->argv, sub_info->envp);
-        else
+                if (!retval)
+                        current->flags |= PF_UMH;
+        } else
                retval = do_execve(getname_kernel(sub_info->path),
                                   (const char __user *const __user *)sub_info->argv,
                                   (const char __user *const __user *)sub_info->envp);
@@ -517,6 +521,11 @@ int fork_usermode_blob(void *data, size_t len, struct umh_info *info)
                goto out;
        err = call_usermodehelper_exec(sub_info, UMH_WAIT_EXEC);
+        if (!err) {
+                mutex_lock(&umh_list_lock);
+                list_add(&info->list, &umh_list);
+                mutex_unlock(&umh_list_lock);
+        }
 out:
        fput(file);
        return err;
@@ -679,6 +688,26 @@ static int proc_cap_handler(struct ctl_table *table, int write,
        return 0;
 }
+void __exit_umh(struct task_struct *tsk)
+{
+        struct umh_info *info;
+        pid_t pid = tsk->pid;
+        mutex_lock(&umh_list_lock);
+        list_for_each_entry(info, &umh_list, list) {
+                if (info->pid == pid) {
+                        list_del(&info->list);
+                        mutex_unlock(&umh_list_lock);
+                        goto out;
+                }
+        }
+        mutex_unlock(&umh_list_lock);
+        return;
+out:
+        if (info->cleanup)
+                info->cleanup(info);
+}
 struct ctl_table usermodehelper_table[] = {
        {
                .procname       = "bset",
diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
index 14436f4ca6bd..30e0f9770f88 100644
--- a/lib/int_sqrt.c
+++ b/lib/int_sqrt.c
@@ -52,7 +52,7 @@ u32 int_sqrt64(u64 x)
        if (x <= ULONG_MAX)
                return int_sqrt((unsigned long) x);
-        m = 1ULL << (fls64(x) & ~1ULL);
+        m = 1ULL << ((fls64(x) - 1) & ~1ULL);
        while (m != 0) {
                b = y + m;
                y >>= 1;
diff --git a/lib/sbitmap.c b/lib/sbitmap.c
index 65c2d06250a6..5b382c1244ed 100644
--- a/lib/sbitmap.c
+++ b/lib/sbitmap.c
@@ -26,14 +26,10 @@
 static inline bool sbitmap_deferred_clear(struct sbitmap *sb, int index)
 {
        unsigned long mask, val;
-        unsigned long __maybe_unused flags;
        bool ret = false;
+        unsigned long flags;
-        /* Silence bogus lockdep warning */
+        spin_lock_irqsave(&sb->map[index].swap_lock, flags);
-#if defined(CONFIG_LOCKDEP)
-        local_irq_save(flags);
-#endif
-        spin_lock(&sb->map[index].swap_lock);
        if (!sb->map[index].cleared)
                goto out_unlock;
@@ -54,10 +50,7 @@ static inline bool sbitmap_deferred_clear(struct sbitmap *sb, int index)
        ret = true;
 out_unlock:
-        spin_unlock(&sb->map[index].swap_lock);
+        spin_unlock_irqrestore(&sb->map[index].swap_lock, flags);
-#if defined(CONFIG_LOCKDEP)
-        local_irq_restore(flags);
-#endif
        return ret;
 }
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 4676c0a1eeca..c596a957f764 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -199,7 +199,7 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                XA_BUG_ON(xa, xa_store_index(xa, index + 1, GFP_KERNEL));
                xa_set_mark(xa, index + 1, XA_MARK_0);
                XA_BUG_ON(xa, xa_store_index(xa, index + 2, GFP_KERNEL));
-                xa_set_mark(xa, index + 2, XA_MARK_1);
+                xa_set_mark(xa, index + 2, XA_MARK_2);
                XA_BUG_ON(xa, xa_store_index(xa, next, GFP_KERNEL));
                xa_store_order(xa, index, order, xa_mk_index(index),
                                GFP_KERNEL);
@@ -209,8 +209,8 @@ static noinline void check_xa_mark_1(struct xarray *xa, unsigned long index)
                        void *entry;
                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_0));
-                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_1));
+                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_1));
-                        XA_BUG_ON(xa, xa_get_mark(xa, i, XA_MARK_2));
+                        XA_BUG_ON(xa, !xa_get_mark(xa, i, XA_MARK_2));
                        /* We should see two elements in the array */
                        rcu_read_lock();
@@ -357,7 +357,7 @@ static noinline void check_cmpxchg(struct xarray *xa)
 static noinline void check_reserve(struct xarray *xa)
 {
        void *entry;
-        unsigned long index = 0;
+        unsigned long index;
        /* An array with a reserved entry is not empty */
        XA_BUG_ON(xa, !xa_empty(xa));
@@ -382,10 +382,12 @@ static noinline void check_reserve(struct xarray *xa)
        xa_erase_index(xa, 12345678);
        XA_BUG_ON(xa, !xa_empty(xa));
-        /* And so does xa_insert */
+        /* But xa_insert does not */
        xa_reserve(xa, 12345678, GFP_KERNEL);
-        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) != 0);
+        XA_BUG_ON(xa, xa_insert(xa, 12345678, xa_mk_value(12345678), 0) !=
-        xa_erase_index(xa, 12345678);
+                        -EEXIST);
+        XA_BUG_ON(xa, xa_empty(xa));
+        XA_BUG_ON(xa, xa_erase(xa, 12345678) != NULL);
        XA_BUG_ON(xa, !xa_empty(xa));
        /* Can iterate through a reserved entry */
@@ -393,7 +395,7 @@ static noinline void check_reserve(struct xarray *xa)
        xa_reserve(xa, 6, GFP_KERNEL);
        xa_store_index(xa, 7, GFP_KERNEL);
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                XA_BUG_ON(xa, index != 5 && index != 7);
        }
        xa_destroy(xa);
@@ -812,17 +814,16 @@ static noinline void check_find_1(struct xarray *xa)
 static noinline void check_find_2(struct xarray *xa)
 {
        void *entry;
-        unsigned long i, j, index = 0;
+        unsigned long i, j, index;
-        xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
+        xa_for_each(xa, index, entry) {
                XA_BUG_ON(xa, true);
        }
        for (i = 0; i < 1024; i++) {
                xa_store_index(xa, index, GFP_KERNEL);
                j = 0;
-                index = 0;
+                xa_for_each(xa, index, entry) {
-                xa_for_each(xa, entry, index, ULONG_MAX, XA_PRESENT) {
                        XA_BUG_ON(xa, xa_mk_index(index) != entry);
                        XA_BUG_ON(xa, index != j++);
                }
@@ -839,6 +840,7 @@ static noinline void check_find_3(struct xarray *xa)
        for (i = 0; i < 100; i++) {
                for (j = 0; j < 100; j++) {
+                        rcu_read_lock();
                        for (k = 0; k < 100; k++) {
                                xas_set(&xas, j);
                                xas_for_each_marked(&xas, entry, k, XA_MARK_0)
@@ -847,6 +849,7 @@ static noinline void check_find_3(struct xarray *xa)
                                        XA_BUG_ON(xa,
                                                xas.xa_node != XAS_RESTART);
                        }
+                        rcu_read_unlock();
                }
                xa_store_index(xa, i, GFP_KERNEL);
                xa_set_mark(xa, i, XA_MARK_0);
@@ -1183,6 +1186,35 @@ static noinline void check_store_range(struct xarray *xa)
        }
 }
+static void check_align_1(struct xarray *xa, char *name)
+{
+        int i;
+        unsigned int id;
+        unsigned long index;
+        void *entry;
+        for (i = 0; i < 8; i++) {
+                id = 0;
+                XA_BUG_ON(xa, xa_alloc(xa, &id, UINT_MAX, name + i, GFP_KERNEL)
+                                != 0);
+                XA_BUG_ON(xa, id != i);
+        }
+        xa_for_each(xa, index, entry)
+                XA_BUG_ON(xa, xa_is_err(entry));
+        xa_destroy(xa);
+}
+static noinline void check_align(struct xarray *xa)
+{
+        char name[] = "Motorola 68000";
+        check_align_1(xa, name);
+        check_align_1(xa, name + 1);
+        check_align_1(xa, name + 2);
+        check_align_1(xa, name + 3);
+//      check_align_2(xa, name);
+}
 static LIST_HEAD(shadow_nodes);
 static void test_update_node(struct xa_node *node)
@@ -1332,6 +1364,7 @@ static int xarray_checks(void)
        check_create_range(&array);
        check_store_range(&array);
        check_store_iter(&array);
+        check_align(&xa0);
        check_workingset(&array, 0);
        check_workingset(&array, 64);
diff --git a/lib/xarray.c b/lib/xarray.c
index 5f3f9311de89..81c3171ddde9 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -232,6 +232,8 @@ void *xas_load(struct xa_state *xas)
                if (xas->xa_shift > node->shift)
                        break;
                entry = xas_descend(xas, node);
+                if (node->shift == 0)
+                        break;
        }
        return entry;
 }
@@ -506,7 +508,7 @@ static void xas_free_nodes(struct xa_state *xas, struct xa_node *top)
        for (;;) {
                void *entry = xa_entry_locked(xas->xa, node, offset);
-                if (xa_is_node(entry)) {
+                if (node->shift && xa_is_node(entry)) {
                        node = xa_to_node(entry);
                        offset = 0;
                        continue;
@@ -604,6 +606,7 @@ static int xas_expand(struct xa_state *xas, void *head)
 /*
 * xas_create() - Create a slot to store an entry in.
 * @xas: XArray operation state.
+ * @allow_root: %true if we can store the entry in the root directly
 *
 * Most users will not need to call this function directly, as it is called
 * by xas_store().  It is useful for doing conditional store operations
@@ -613,7 +616,7 @@ static int xas_expand(struct xa_state *xas, void *head)
 * If the slot was newly created, returns %NULL.  If it failed to create the
 * slot, returns %NULL and indicates the error in @xas.
 */
-static void *xas_create(struct xa_state *xas)
+static void *xas_create(struct xa_state *xas, bool allow_root)
 {
        struct xarray *xa = xas->xa;
        void *entry;
@@ -628,6 +631,8 @@ static void *xas_create(struct xa_state *xas)
                shift = xas_expand(xas, entry);
                if (shift < 0)
                        return NULL;
+                if (!shift && !allow_root)
+                        shift = XA_CHUNK_SHIFT;
                entry = xa_head_locked(xa);
                slot = &xa->xa_head;
        } else if (xas_error(xas)) {
@@ -687,7 +692,7 @@ void xas_create_range(struct xa_state *xas)
        xas->xa_sibs = 0;
        for (;;) {
-                xas_create(xas);
+                xas_create(xas, true);
                if (xas_error(xas))
                        goto restore;
                if (xas->xa_index <= (index | XA_CHUNK_MASK))
@@ -754,7 +759,7 @@ void *xas_store(struct xa_state *xas, void *entry)
        bool value = xa_is_value(entry);
        if (entry)
-                first = xas_create(xas);
+                first = xas_create(xas, !xa_is_node(entry));
        else
                first = xas_load(xas);
@@ -1251,35 +1256,6 @@ void *xas_find_conflict(struct xa_state *xas)
 EXPORT_SYMBOL_GPL(xas_find_conflict);
 /**
- * xa_init_flags() - Initialise an empty XArray with flags.
- * @xa: XArray.
- * @flags: XA_FLAG values.
- *
- * If you need to initialise an XArray with special flags (eg you need
- * to take the lock from interrupt context), use this function instead
- * of xa_init().
- *
- * Context: Any context.
- */
-void xa_init_flags(struct xarray *xa, gfp_t flags)
-{
-        unsigned int lock_type;
-        static struct lock_class_key xa_lock_irq;
-        static struct lock_class_key xa_lock_bh;
-        spin_lock_init(&xa->xa_lock);
-        xa->xa_flags = flags;
-        xa->xa_head = NULL;
-        lock_type = xa_lock_type(xa);
-        if (lock_type == XA_LOCK_IRQ)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_irq);
-        else if (lock_type == XA_LOCK_BH)
-                lockdep_set_class(&xa->xa_lock, &xa_lock_bh);
-}
-EXPORT_SYMBOL(xa_init_flags);
-/**
 * xa_load() - Load an entry from an XArray.
 * @xa: XArray.
 * @index: index into array.
@@ -1308,7 +1284,6 @@ static void *xas_result(struct xa_state *xas, void *curr)
 {
        if (xa_is_zero(curr))
                return NULL;
-        XA_NODE_BUG_ON(xas->xa_node, xa_is_internal(curr));
        if (xas_error(xas))
                curr = xas->xa_node;
        return curr;
@@ -1378,7 +1353,7 @@ void *__xa_store(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
        XA_STATE(xas, xa, index);
        void *curr;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return XA_ERROR(-EINVAL);
        if (xa_track_free(xa) && !entry)
                entry = XA_ZERO_ENTRY;
@@ -1444,7 +1419,7 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
        XA_STATE(xas, xa, index);
        void *curr;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return XA_ERROR(-EINVAL);
        if (xa_track_free(xa) && !entry)
                entry = XA_ZERO_ENTRY;
@@ -1465,6 +1440,47 @@ void *__xa_cmpxchg(struct xarray *xa, unsigned long index,
 EXPORT_SYMBOL(__xa_cmpxchg);
 /**
+ * __xa_insert() - Store this entry in the XArray if no entry is present.
+ * @xa: XArray.
+ * @index: Index into array.
+ * @entry: New entry.
+ * @gfp: Memory allocation flags.
+ *
+ * Inserting a NULL entry will store a reserved entry (like xa_reserve())
+ * if no entry is present.  Inserting will fail if a reserved entry is
+ * present, even though loading from this index will return NULL.
+ *
+ * Context: Any context.  Expects xa_lock to be held on entry.  May
+ * release and reacquire xa_lock if @gfp flags permit.
+ * Return: 0 if the store succeeded.  -EEXIST if another entry was present.
+ * -ENOMEM if memory could not be allocated.
+ */
+int __xa_insert(struct xarray *xa, unsigned long index, void *entry, gfp_t gfp)
+{
+        XA_STATE(xas, xa, index);
+        void *curr;
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
+                return -EINVAL;
+        if (!entry)
+                entry = XA_ZERO_ENTRY;
+        do {
+                curr = xas_load(&xas);
+                if (!curr) {
+                        xas_store(&xas, entry);
+                        if (xa_track_free(xa))
+                                xas_clear_mark(&xas, XA_FREE_MARK);
+                } else {
+                        xas_set_err(&xas, -EEXIST);
+                }
+        } while (__xas_nomem(&xas, gfp));
+        return xas_error(&xas);
+}
+EXPORT_SYMBOL(__xa_insert);
+/**
 * __xa_reserve() - Reserve this index in the XArray.
 * @xa: XArray.
 * @index: Index into array.
@@ -1567,7 +1583,7 @@ void *xa_store_range(struct xarray *xa, unsigned long first,
                        if (last + 1)
                                order = __ffs(last + 1);
                        xas_set_order(&xas, last, order);
-                        xas_create(&xas);
+                        xas_create(&xas, true);
                        if (xas_error(&xas))
                                goto unlock;
                }
@@ -1609,7 +1625,7 @@ int __xa_alloc(struct xarray *xa, u32 *id, u32 max, void *entry, gfp_t gfp)
        XA_STATE(xas, xa, 0);
        int err;
-        if (WARN_ON_ONCE(xa_is_internal(entry)))
+        if (WARN_ON_ONCE(xa_is_advanced(entry)))
                return -EINVAL;
        if (WARN_ON_ONCE(!xa_track_free(xa)))
                return -EINVAL;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 8a8bb8796c6c..72e6d0c55cfa 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
        INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
        bdi->cgwb_congested_tree = RB_ROOT;
        mutex_init(&bdi->cgwb_release_mutex);
+        init_rwsem(&bdi->wb_switch_rwsem);
        ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
        if (!ret) {
diff --git a/mm/mincore.c b/mm/mincore.c
index f0f91461a9f4..218099b5ed31 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -42,14 +42,72 @@ static int mincore_hugetlb(pte_t *pte, unsigned long hmask, unsigned long addr,
        return 0;
 }
-static int mincore_unmapped_range(unsigned long addr, unsigned long end,
+/*
-                                   struct mm_walk *walk)
+ * Later we can get more picky about what "in core" means precisely.
+ * For now, simply check to see if the page is in the page cache,
+ * and is up to date; i.e. that no page-in operation would be required
+ * at this time if an application were to map and access this page.
+ */
+static unsigned char mincore_page(struct address_space *mapping, pgoff_t pgoff)
+{
+        unsigned char present = 0;
+        struct page *page;
+        /*
+         * When tmpfs swaps out a page from a file, any process mapping that
+         * file will not get a swp_entry_t in its pte, but rather it is like
+         * any other file mapping (ie. marked !present and faulted in with
+         * tmpfs's .fault). So swapped out tmpfs mappings are tested here.
+         */
+#ifdef CONFIG_SWAP
+        if (shmem_mapping(mapping)) {
+                page = find_get_entry(mapping, pgoff);
+                /*
+                 * shmem/tmpfs may return swap: account for swapcache
+                 * page too.
+                 */
+                if (xa_is_value(page)) {
+                        swp_entry_t swp = radix_to_swp_entry(page);
+                        page = find_get_page(swap_address_space(swp),
+                                             swp_offset(swp));
+                }
+        } else
+                page = find_get_page(mapping, pgoff);
+#else
+        page = find_get_page(mapping, pgoff);
+#endif
+        if (page) {
+                present = PageUptodate(page);
+                put_page(page);
+        }
+        return present;
+}
+static int __mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                struct vm_area_struct *vma, unsigned char *vec)
 {
-        unsigned char *vec = walk->private;
        unsigned long nr = (end - addr) >> PAGE_SHIFT;
+        int i;
-        memset(vec, 0, nr);
+        if (vma->vm_file) {
-        walk->private += nr;
+                pgoff_t pgoff;
+                pgoff = linear_page_index(vma, addr);
+                for (i = 0; i < nr; i++, pgoff++)
+                        vec[i] = mincore_page(vma->vm_file->f_mapping, pgoff);
+        } else {
+                for (i = 0; i < nr; i++)
+                        vec[i] = 0;
+        }
+        return nr;
+}
+static int mincore_unmapped_range(unsigned long addr, unsigned long end,
+                                   struct mm_walk *walk)
+{
+        walk->private += __mincore_unmapped_range(addr, end,
+                                                  walk->vma, walk->private);
        return 0;
 }
@@ -69,9 +127,8 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                goto out;
        }
-        /* We'll consider a THP page under construction to be there */
        if (pmd_trans_unstable(pmd)) {
-                memset(vec, 1, nr);
+                __mincore_unmapped_range(addr, end, vma, vec);
                goto out;
        }
@@ -80,17 +137,28 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                pte_t pte = *ptep;
                if (pte_none(pte))
-                        *vec = 0;
+                        __mincore_unmapped_range(addr, addr + PAGE_SIZE,
+                                                 vma, vec);
                else if (pte_present(pte))
                        *vec = 1;
                else { /* pte is a swap entry */
                        swp_entry_t entry = pte_to_swp_entry(pte);
-                        /*
+                        if (non_swap_entry(entry)) {
-                         * migration or hwpoison entries are always
+                                /*
-                         * uptodate
+                                 * migration or hwpoison entries are always
-                         */
+                                 * uptodate
-                        *vec = !!non_swap_entry(entry);
+                                 */
+                                *vec = 1;
+                        } else {
+#ifdef CONFIG_SWAP
+                                *vec = mincore_page(swap_address_space(entry),
+                                                    swp_offset(entry));
+#else
+                                WARN_ON(1);
+                                *vec = 1;
+#endif
+                        }
                }
                vec++;
        }
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index 70417e9b932d..314bbc8010fb 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
        dst = (ax25_address *)(bp + 1);
        src = (ax25_address *)(bp + 8);
+        ax25_route_lock_use();
        route = ax25_get_route(dst, NULL);
        if (route) {
                digipeat = route->digipeat;
@@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
        ax25_queue_xmit(skb, dev);
 put:
-        if (route)
-                ax25_put_route(route);
+        ax25_route_lock_unuse();
        return NETDEV_TX_OK;
 }
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index a0eff323af12..66f74c85cf6b 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -40,7 +40,7 @@
 #include <linux/export.h>
 static ax25_route *ax25_route_list;
-static DEFINE_RWLOCK(ax25_route_lock);
+DEFINE_RWLOCK(ax25_route_lock);
 void ax25_rt_device_down(struct net_device *dev)
 {
@@ -335,6 +335,7 @@ const struct seq_operations ax25_rt_seqops = {
 *      Find AX.25 route
 *
 *      Only routes with a reference count of zero can be destroyed.
+ *      Must be called with ax25_route_lock read locked.
 */
 ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
 {
@@ -342,7 +343,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
        ax25_route *ax25_def_rt = NULL;
        ax25_route *ax25_rt;
-        read_lock(&ax25_route_lock);
        /*
         *      Bind to the physical interface we heard them on, or the default
         *      route if none is found;
@@ -365,11 +365,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
        if (ax25_spe_rt != NULL)
                ax25_rt = ax25_spe_rt;
-        if (ax25_rt != NULL)
-                ax25_hold_route(ax25_rt);
-        read_unlock(&ax25_route_lock);
        return ax25_rt;
 }
@@ -400,9 +395,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
        ax25_route *ax25_rt;
        int err = 0;
-        if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
+        ax25_route_lock_use();
+        ax25_rt = ax25_get_route(addr, NULL);
+        if (!ax25_rt) {
+                ax25_route_lock_unuse();
                return -EHOSTUNREACH;
+        }
        if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
                err = -EHOSTUNREACH;
                goto put;
@@ -437,8 +435,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
        }
 put:
-        ax25_put_route(ax25_rt);
+        ax25_route_lock_unuse();
        return err;
 }
diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
index 7acfc83087d5..7ee4fea93637 100644
--- a/net/bpfilter/bpfilter_kern.c
+++ b/net/bpfilter/bpfilter_kern.c
@@ -13,39 +13,24 @@
 extern char bpfilter_umh_start;
 extern char bpfilter_umh_end;
-static struct umh_info info;
+static void shutdown_umh(void)
-/* since ip_getsockopt() can run in parallel, serialize access to umh */
-static DEFINE_MUTEX(bpfilter_lock);
-static void shutdown_umh(struct umh_info *info)
 {
        struct task_struct *tsk;
-        if (!info->pid)
+        if (bpfilter_ops.stop)
                return;
-        tsk = get_pid_task(find_vpid(info->pid), PIDTYPE_PID);
+        tsk = get_pid_task(find_vpid(bpfilter_ops.info.pid), PIDTYPE_PID);
        if (tsk) {
                force_sig(SIGKILL, tsk);
                put_task_struct(tsk);
        }
-        fput(info->pipe_to_umh);
-        fput(info->pipe_from_umh);
-        info->pid = 0;
 }
 static void __stop_umh(void)
 {
-        if (IS_ENABLED(CONFIG_INET)) {
+        if (IS_ENABLED(CONFIG_INET))
-                bpfilter_process_sockopt = NULL;
+                shutdown_umh();
-                shutdown_umh(&info);
-        }
-}
-static void stop_umh(void)
-{
-        mutex_lock(&bpfilter_lock);
-        __stop_umh();
-        mutex_unlock(&bpfilter_lock);
 }
 static int __bpfilter_process_sockopt(struct sock *sk, int optname,
@@ -63,10 +48,10 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
        req.cmd = optname;
        req.addr = (long __force __user)optval;
        req.len = optlen;
-        mutex_lock(&bpfilter_lock);
+        if (!bpfilter_ops.info.pid)
-        if (!info.pid)
                goto out;
-        n = __kernel_write(info.pipe_to_umh, &req, sizeof(req), &pos);
+        n = __kernel_write(bpfilter_ops.info.pipe_to_umh, &req, sizeof(req),
+                           &pos);
        if (n != sizeof(req)) {
                pr_err("write fail %zd\n", n);
                __stop_umh();
@@ -74,7 +59,8 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
                goto out;
        }
        pos = 0;
-        n = kernel_read(info.pipe_from_umh, &reply, sizeof(reply), &pos);
+        n = kernel_read(bpfilter_ops.info.pipe_from_umh, &reply, sizeof(reply),
+                        &pos);
        if (n != sizeof(reply)) {
                pr_err("read fail %zd\n", n);
                __stop_umh();
@@ -83,37 +69,59 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
        }
        ret = reply.status;
 out:
-        mutex_unlock(&bpfilter_lock);
        return ret;
 }
-static int __init load_umh(void)
+static int start_umh(void)
 {
        int err;
        /* fork usermode process */
-        info.cmdline = "bpfilter_umh";
        err = fork_usermode_blob(&bpfilter_umh_start,
                                 &bpfilter_umh_end - &bpfilter_umh_start,
-                                 &info);
+                                 &bpfilter_ops.info);
        if (err)
                return err;
-        pr_info("Loaded bpfilter_umh pid %d\n", info.pid);
+        bpfilter_ops.stop = false;
+        pr_info("Loaded bpfilter_umh pid %d\n", bpfilter_ops.info.pid);
        /* health check that usermode process started correctly */
        if (__bpfilter_process_sockopt(NULL, 0, NULL, 0, 0) != 0) {
-                stop_umh();
+                shutdown_umh();
                return -EFAULT;
        }
-        if (IS_ENABLED(CONFIG_INET))
-                bpfilter_process_sockopt = &__bpfilter_process_sockopt;
        return 0;
 }
+static int __init load_umh(void)
+{
+        int err;
+        mutex_lock(&bpfilter_ops.lock);
+        if (!bpfilter_ops.stop) {
+                err = -EFAULT;
+                goto out;
+        }
+        err = start_umh();
+        if (!err && IS_ENABLED(CONFIG_INET)) {
+                bpfilter_ops.sockopt = &__bpfilter_process_sockopt;
+                bpfilter_ops.start = &start_umh;
+        }
+out:
+        mutex_unlock(&bpfilter_ops.lock);
+        return err;
+}
 static void __exit fini_umh(void)
 {
-        stop_umh();
+        mutex_lock(&bpfilter_ops.lock);
+        if (IS_ENABLED(CONFIG_INET)) {
+                shutdown_umh();
+                bpfilter_ops.start = NULL;
+                bpfilter_ops.sockopt = NULL;
+        }
+        mutex_unlock(&bpfilter_ops.lock);
 }
 module_init(load_umh);
 module_exit(fini_umh);
diff --git a/net/bpfilter/bpfilter_umh_blob.S b/net/bpfilter/bpfilter_umh_blob.S
index 40311d10d2f2..9ea6100dca87 100644
--- a/net/bpfilter/bpfilter_umh_blob.S
+++ b/net/bpfilter/bpfilter_umh_blob.S
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-        .section .init.rodata, "a"
+        .section .rodata, "a"
        .global bpfilter_umh_start
 bpfilter_umh_start:
        .incbin "net/bpfilter/bpfilter_umh"
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index fe3c758791ca..9e14767500ea 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -1128,6 +1128,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                        err = -ENOMEM;
                        goto err_unlock;
                }
+                if (swdev_notify)
+                        fdb->added_by_user = 1;
                fdb->added_by_external_learn = 1;
                fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
        } else {
@@ -1147,6 +1149,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                        modified = true;
                }
+                if (swdev_notify)
+                        fdb->added_by_user = 1;
                if (modified)
                        fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
        }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 5372e2042adf..48ddc60b4fbd 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -36,10 +36,10 @@ static inline int should_deliver(const struct net_bridge_port *p,
 int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        skb_push(skb, ETH_HLEN);
        if (!is_skb_forwardable(skb->dev, skb))
                goto drop;
-        skb_push(skb, ETH_HLEN);
        br_drop_fake_rtable(skb);
        if (skb->ip_summed == CHECKSUM_PARTIAL &&
@@ -65,6 +65,7 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        skb->tstamp = 0;
        return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,
                       net, sk, skb, NULL, skb->dev,
                       br_dev_queue_push_xmit);
@@ -97,12 +98,11 @@ static void __br_forward(const struct net_bridge_port *to,
                net = dev_net(indev);
        } else {
                if (unlikely(netpoll_tx_running(to->br->dev))) {
-                        if (!is_skb_forwardable(skb->dev, skb)) {
+                        skb_push(skb, ETH_HLEN);
+                        if (!is_skb_forwardable(skb->dev, skb))
                                kfree_skb(skb);
-                        } else {
+                        else
-                                skb_push(skb, ETH_HLEN);
                                br_netpoll_send_skb(to, skb);
-                        }
                        return;
                }
                br_hook = NF_BR_LOCAL_OUT;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index d21a23698410..c93c35bb73dd 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -265,7 +265,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_
                struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
                int ret;
-                if (neigh->hh.hh_len) {
+                if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
                        neigh_hh_bridge(&neigh->hh, skb);
                        skb->dev = nf_bridge->physindev;
                        ret = br_handle_frame_finish(net, sk, skb);
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 94039f588f1d..564710f88f93 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, struct sk_buff *skb)
                                        IPSTATS_MIB_INDISCARDS);
                        goto drop;
                }
+                hdr = ipv6_hdr(skb);
        }
        if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
                goto drop;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index d240b3e7919f..eabf8bf28a3f 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -107,6 +107,7 @@ struct br_tunnel_info {
 /* private vlan flags */
 enum {
        BR_VLFLAG_PER_PORT_STATS = BIT(0),
+        BR_VLFLAG_ADDED_BY_SWITCHDEV = BIT(1),
 };
 /**
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 4a2f31157ef5..96abf8feb9dc 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -80,16 +80,18 @@ static bool __vlan_add_flags(struct net_bridge_vlan *v, u16 flags)
 }
 static int __vlan_vid_add(struct net_device *dev, struct net_bridge *br,
-                          u16 vid, u16 flags, struct netlink_ext_ack *extack)
+                          struct net_bridge_vlan *v, u16 flags,
+                          struct netlink_ext_ack *extack)
 {
        int err;
        /* Try switchdev op first. In case it is not supported, fallback to
         * 8021q add.
         */
-        err = br_switchdev_port_vlan_add(dev, vid, flags, extack);
+        err = br_switchdev_port_vlan_add(dev, v->vid, flags, extack);
        if (err == -EOPNOTSUPP)
-                return vlan_vid_add(dev, br->vlan_proto, vid);
+                return vlan_vid_add(dev, br->vlan_proto, v->vid);
+        v->priv_flags |= BR_VLFLAG_ADDED_BY_SWITCHDEV;
        return err;
 }
@@ -121,19 +123,17 @@ static void __vlan_del_list(struct net_bridge_vlan *v)
 }
 static int __vlan_vid_del(struct net_device *dev, struct net_bridge *br,
-                          u16 vid)
+                          const struct net_bridge_vlan *v)
 {
        int err;
        /* Try switchdev op first. In case it is not supported, fallback to
         * 8021q del.
         */
-        err = br_switchdev_port_vlan_del(dev, vid);
+        err = br_switchdev_port_vlan_del(dev, v->vid);
-        if (err == -EOPNOTSUPP) {
+        if (!(v->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV))
-                vlan_vid_del(dev, br->vlan_proto, vid);
+                vlan_vid_del(dev, br->vlan_proto, v->vid);
-                return 0;
+        return err == -EOPNOTSUPP ? 0 : err;
-        }
-        return err;
 }
 /* Returns a master vlan, if it didn't exist it gets created. In all cases a
@@ -242,7 +242,7 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags,
                 * This ensures tagged traffic enters the bridge when
                 * promiscuous mode is disabled by br_manage_promisc().
                 */
-                err = __vlan_vid_add(dev, br, v->vid, flags, extack);
+                err = __vlan_vid_add(dev, br, v, flags, extack);
                if (err)
                        goto out;
@@ -305,7 +305,7 @@ out_fdb_insert:
 out_filt:
        if (p) {
-                __vlan_vid_del(dev, br, v->vid);
+                __vlan_vid_del(dev, br, v);
                if (masterv) {
                        if (v->stats && masterv->stats != v->stats)
                                free_percpu(v->stats);
@@ -338,7 +338,7 @@ static int __vlan_del(struct net_bridge_vlan *v)
        __vlan_delete_pvid(vg, v->vid);
        if (p) {
-                err = __vlan_vid_del(p->dev, p->br, v->vid);
+                err = __vlan_vid_del(p->dev, p->br, v);
                if (err)
                        goto out;
        } else {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 491828713e0b..5e55cef0cec3 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user,
        tmp.name[sizeof(tmp.name) - 1] = 0;
        countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
-        newinfo = vmalloc(sizeof(*newinfo) + countersize);
+        newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT,
+                            PAGE_KERNEL);
        if (!newinfo)
                return -ENOMEM;
        if (countersize)
                memset(newinfo->counters, 0, countersize);
-        newinfo->entries = vmalloc(tmp.entries_size);
+        newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT,
+                                     PAGE_KERNEL);
        if (!newinfo->entries) {
                ret = -ENOMEM;
                goto free_newinfo;
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 08cbed7d940e..419e8edf23ba 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -229,6 +229,7 @@ static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
            pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
                return false;
+        ip6h = ipv6_hdr(skb);
        thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
        if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
                return false;
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..79bb8afa9c0c 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
 */
 #define MAX_NFRAMES 256
+/* limit timers to 400 days for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
 /* use of last_frames[index].flags */
 #define RX_RECV    0x40 /* received data for this element */
 #define RX_THR     0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
        return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
 }
+/* check limitations for timeval provided by user */
+static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+        if ((msg_head->ival1.tv_sec < 0) ||
+            (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival1.tv_usec < 0) ||
+            (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+            (msg_head->ival2.tv_sec < 0) ||
+            (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+            (msg_head->ival2.tv_usec < 0) ||
+            (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+                return true;
+        return false;
+}
 #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
 #define OPSIZ sizeof(struct bcm_op)
 #define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
        if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
                return -EINVAL;
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
        /* check the given can_id */
        op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
        if (op) {
@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
             (!(msg_head->can_id & CAN_RTR_FLAG))))
                return -EINVAL;
+        /* check timeval limitations */
+        if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+                return -EINVAL;
        /* check the given can_id */
        op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
        if (op) {
diff --git a/net/can/gw.c b/net/can/gw.c
index faa3da88a127..53859346dc9a 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -416,13 +416,29 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
        while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
                (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
-        /* check for checksum updates when the CAN frame has been modified */
+        /* Has the CAN frame been modified? */
        if (modidx) {
-                if (gwj->mod.csumfunc.crc8)
+                /* get available space for the processed CAN frame type */
+                int max_len = nskb->len - offsetof(struct can_frame, data);
+                /* dlc may have changed, make sure it fits to the CAN frame */
+                if (cf->can_dlc > max_len)
+                        goto out_delete;
+                /* check for checksum updates in classic CAN length only */
+                if (gwj->mod.csumfunc.crc8) {
+                        if (cf->can_dlc > 8)
+                                goto out_delete;
                        (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
+                }
+                if (gwj->mod.csumfunc.xor) {
+                        if (cf->can_dlc > 8)
+                                goto out_delete;
-                if (gwj->mod.csumfunc.xor)
                        (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
+                }
        }
        /* clear the skb timestamp if not configured the other way */
@@ -434,6 +450,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
                gwj->dropped_frames++;
        else
                gwj->handled_frames++;
+        return;
+ out_delete:
+        /* delete frame due to misconfiguration */
+        gwj->deleted_frames++;
+        kfree_skb(nskb);
+        return;
 }
 static inline int cgw_register_filter(struct net *net, struct cgw_job *gwj)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index d5718284db57..3661cdd927f1 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3206,9 +3206,10 @@ void ceph_con_keepalive(struct ceph_connection *con)
        dout("con_keepalive %p\n", con);
        mutex_lock(&con->mutex);
        clear_standby(con);
+        con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
        mutex_unlock(&con->mutex);
-        if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
-            con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+        if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
                queue_con(con);
 }
 EXPORT_SYMBOL(ceph_con_keepalive);
diff --git a/net/core/filter.c b/net/core/filter.c
index 447dd1bad31f..7559d6835ecb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2020,18 +2020,19 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
 static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
                                 u32 flags)
 {
-        /* skb->mac_len is not set on normal egress */
+        unsigned int mlen = skb_network_offset(skb);
-        unsigned int mlen = skb->network_header - skb->mac_header;
-        __skb_pull(skb, mlen);
+        if (mlen) {
+                __skb_pull(skb, mlen);
-        /* At ingress, the mac header has already been pulled once.
+                /* At ingress, the mac header has already been pulled once.
-         * At egress, skb_pospull_rcsum has to be done in case that
+                 * At egress, skb_pospull_rcsum has to be done in case that
-         * the skb is originated from ingress (i.e. a forwarded skb)
+                 * the skb is originated from ingress (i.e. a forwarded skb)
-         * to ensure that rcsum starts at net header.
+                 * to ensure that rcsum starts at net header.
-         */
+                 */
-        if (!skb_at_tc_ingress(skb))
+                if (!skb_at_tc_ingress(skb))
-                skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+                        skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+        }
        skb_pop_mac_header(skb);
        skb_reset_mac_len(skb);
        return flags & BPF_F_INGRESS ?
@@ -4119,6 +4120,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                        sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                        break;
                case SO_MAX_PACING_RATE: /* 32bit version */
+                        if (val != ~0U)
+                                cmpxchg(&sk->sk_pacing_status,
+                                        SK_PACING_NONE,
+                                        SK_PACING_NEEDED);
                        sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
                        sk->sk_pacing_rate = min(sk->sk_pacing_rate,
                                                 sk->sk_max_pacing_rate);
@@ -4132,7 +4137,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                        sk->sk_rcvlowat = val ? : 1;
                        break;
                case SO_MARK:
-                        sk->sk_mark = val;
+                        if (sk->sk_mark != val) {
+                                sk->sk_mark = val;
+                                sk_dst_reset(sk);
+                        }
                        break;
                default:
                        ret = -EINVAL;
@@ -4203,7 +4211,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                        /* Only some options are supported */
                        switch (optname) {
                        case TCP_BPF_IW:
-                                if (val <= 0 || tp->data_segs_out > 0)
+                                if (val <= 0 || tp->data_segs_out > tp->syn_data)
                                        ret = -EINVAL;
                                else
                                        tp->snd_cwnd = val;
@@ -5309,7 +5317,7 @@ bpf_base_func_proto(enum bpf_func_id func_id)
        case BPF_FUNC_trace_printk:
                if (capable(CAP_SYS_ADMIN))
                        return bpf_get_trace_printk_proto();
-                /* else: fall through */
+                /* else, fall through */
        default:
                return NULL;
        }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 3e85437f7106..a648568c5e8f 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -63,6 +63,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
                                     lwt->name ? : "<unknown>");
                        ret = BPF_OK;
                } else {
+                        skb_reset_mac_header(skb);
                        ret = skb_do_redirect(skb);
                        if (ret == 0)
                                ret = BPF_REDIRECT;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 763a7b08df67..4230400b9a30 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -18,6 +18,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/slab.h>
+#include <linux/kmemleak.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -443,12 +444,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
        ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
        if (!ret)
                return NULL;
-        if (size <= PAGE_SIZE)
+        if (size <= PAGE_SIZE) {
                buckets = kzalloc(size, GFP_ATOMIC);
-        else
+        } else {
                buckets = (struct neighbour __rcu **)
                          __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
                                           get_order(size));
+                kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+        }
        if (!buckets) {
                kfree(ret);
                return NULL;
@@ -468,10 +471,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
        size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
        struct neighbour __rcu **buckets = nht->hash_buckets;
-        if (size <= PAGE_SIZE)
+        if (size <= PAGE_SIZE) {
                kfree(buckets);
-        else
+        } else {
+                kmemleak_free(buckets);
                free_pages((unsigned long)buckets, get_order(size));
+        }
        kfree(nht);
 }
@@ -1002,7 +1007,7 @@ static void neigh_probe(struct neighbour *neigh)
        if (neigh->ops->solicit)
                neigh->ops->solicit(neigh, skb);
        atomic_inc(&neigh->probes);
-        kfree_skb(skb);
+        consume_skb(skb);
 }
 /* Called when a timer expires for a neighbour entry. */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 37317ffec146..26d848484912 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5270,7 +5270,6 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
        unsigned long chunk;
        struct sk_buff *skb;
        struct page *page;
-        gfp_t gfp_head;
        int i;
        *errcode = -EMSGSIZE;
@@ -5280,12 +5279,8 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
        if (npages > MAX_SKB_FRAGS)
                return NULL;
-        gfp_head = gfp_mask;
-        if (gfp_head & __GFP_DIRECT_RECLAIM)
-                gfp_head |= __GFP_RETRY_MAYFAIL;
        *errcode = -ENOBUFS;
-        skb = alloc_skb(header_len, gfp_head);
+        skb = alloc_skb(header_len, gfp_mask);
        if (!skb)
                return NULL;
diff --git a/net/ipv4/bpfilter/sockopt.c b/net/ipv4/bpfilter/sockopt.c
index 5e04ed25bc0e..1e976bb93d99 100644
--- a/net/ipv4/bpfilter/sockopt.c
+++ b/net/ipv4/bpfilter/sockopt.c
@@ -1,28 +1,54 @@
 // SPDX-License-Identifier: GPL-2.0
+#include <linux/init.h>
+#include <linux/module.h>
 #include <linux/uaccess.h>
 #include <linux/bpfilter.h>
 #include <uapi/linux/bpf.h>
 #include <linux/wait.h>
 #include <linux/kmod.h>
+#include <linux/fs.h>
+#include <linux/file.h>
-int (*bpfilter_process_sockopt)(struct sock *sk, int optname,
+struct bpfilter_umh_ops bpfilter_ops;
-                                char __user *optval,
+EXPORT_SYMBOL_GPL(bpfilter_ops);
-                                unsigned int optlen, bool is_set);
-EXPORT_SYMBOL_GPL(bpfilter_process_sockopt);
+static void bpfilter_umh_cleanup(struct umh_info *info)
+{
+        mutex_lock(&bpfilter_ops.lock);
+        bpfilter_ops.stop = true;
+        fput(info->pipe_to_umh);
+        fput(info->pipe_from_umh);
+        info->pid = 0;
+        mutex_unlock(&bpfilter_ops.lock);
+}
 static int bpfilter_mbox_request(struct sock *sk, int optname,
                                 char __user *optval,
                                 unsigned int optlen, bool is_set)
 {
-        if (!bpfilter_process_sockopt) {
+        int err;
-                int err = request_module("bpfilter");
+        mutex_lock(&bpfilter_ops.lock);
+        if (!bpfilter_ops.sockopt) {
+                mutex_unlock(&bpfilter_ops.lock);
+                err = request_module("bpfilter");
+                mutex_lock(&bpfilter_ops.lock);
                if (err)
-                        return err;
+                        goto out;
-                if (!bpfilter_process_sockopt)
+                if (!bpfilter_ops.sockopt) {
-                        return -ECHILD;
+                        err = -ECHILD;
+                        goto out;
+                }
+        }
+        if (bpfilter_ops.stop) {
+                err = bpfilter_ops.start();
+                if (err)
+                        goto out;
        }
-        return bpfilter_process_sockopt(sk, optname, optval, optlen, is_set);
+        err = bpfilter_ops.sockopt(sk, optname, optval, optlen, is_set);
+out:
+        mutex_unlock(&bpfilter_ops.lock);
+        return err;
 }
 int bpfilter_ip_set_sockopt(struct sock *sk, int optname, char __user *optval,
@@ -41,3 +67,15 @@ int bpfilter_ip_get_sockopt(struct sock *sk, int optname, char __user *optval,
        return bpfilter_mbox_request(sk, optname, optval, len, false);
 }
+static int __init bpfilter_sockopt_init(void)
+{
+        mutex_init(&bpfilter_ops.lock);
+        bpfilter_ops.stop = true;
+        bpfilter_ops.info.cmdline = "bpfilter_umh";
+        bpfilter_ops.info.cleanup = &bpfilter_umh_cleanup;
+        return 0;
+}
+module_init(bpfilter_sockopt_init);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 04ba321ae5ce..e258a00b4a3d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1826,7 +1826,7 @@ put_tgt_net:
        if (fillargs.netnsid >= 0)
                put_net(tgt_net);
-        return err < 0 ? err : skb->len;
+        return skb->len ? : err;
 }
 static void rtmsg_ifa(int event, struct in_ifaddr *ifa, struct nlmsghdr *nlh,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 6df95be96311..fe4f6a624238 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -203,7 +203,7 @@ static void fib_flush(struct net *net)
                struct fib_table *tb;
                hlist_for_each_entry_safe(tb, tmp, head, tb_hlist)
-                        flushed += fib_table_flush(net, tb);
+                        flushed += fib_table_flush(net, tb, false);
        }
        if (flushed)
@@ -1463,7 +1463,7 @@ static void ip_fib_net_exit(struct net *net)
                hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
                        hlist_del(&tb->tb_hlist);
-                        fib_table_flush(net, tb);
+                        fib_table_flush(net, tb, true);
                        fib_free_table(tb);
                }
        }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 237c9f72b265..a573e37e0615 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1856,7 +1856,7 @@ void fib_table_flush_external(struct fib_table *tb)
 }
 /* Caller must hold RTNL. */
-int fib_table_flush(struct net *net, struct fib_table *tb)
+int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
 {
        struct trie *t = (struct trie *)tb->tb_data;
        struct key_vector *pn = t->kv;
@@ -1904,8 +1904,17 @@ int fib_table_flush(struct net *net, struct fib_table *tb)
                hlist_for_each_entry_safe(fa, tmp, &n->leaf, fa_list) {
                        struct fib_info *fi = fa->fa_info;
-                        if (!fi || !(fi->fib_flags & RTNH_F_DEAD) ||
+                        if (!fi || tb->tb_id != fa->tb_id ||
-                            tb->tb_id != fa->tb_id) {
+                            (!(fi->fib_flags & RTNH_F_DEAD) &&
+                             !fib_props[fa->fa_type].error)) {
+                                slen = fa->fa_slen;
+                                continue;
+                        }
+                        /* Do not flush error routes if network namespace is
+                         * not being dismantled
+                         */
+                        if (!flush_all && fib_props[fa->fa_type].error) {
                                slen = fa->fa_slen;
                                continue;
                        }
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 0c9f171fb085..437070d1ffb1 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -1020,10 +1020,11 @@ static int gue_err(struct sk_buff *skb, u32 info)
 {
        int transport_offset = skb_transport_offset(skb);
        struct guehdr *guehdr;
-        size_t optlen;
+        size_t len, optlen;
        int ret;
-        if (skb->len < sizeof(struct udphdr) + sizeof(struct guehdr))
+        len = sizeof(struct udphdr) + sizeof(struct guehdr);
+        if (!pskb_may_pull(skb, len))
                return -EINVAL;
        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -1058,6 +1059,10 @@ static int gue_err(struct sk_buff *skb, u32 info)
        optlen = guehdr->hlen << 2;
+        if (!pskb_may_pull(skb, len + optlen))
+                return -EINVAL;
+        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
        if (validate_gue_flags(guehdr, optlen))
                return -EINVAL;
@@ -1065,7 +1070,8 @@ static int gue_err(struct sk_buff *skb, u32 info)
         * recursion. Besides, this kind of encapsulation can't even be
         * configured currently. Discard this.
         */
-        if (guehdr->proto_ctype == IPPROTO_UDP)
+        if (guehdr->proto_ctype == IPPROTO_UDP ||
+            guehdr->proto_ctype == IPPROTO_UDPLITE)
                return -EOPNOTSUPP;
        skb_set_transport_header(skb, -(int)sizeof(struct icmphdr));
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index a4bf22ee3aed..7c4a41dc04bb 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -25,6 +25,7 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 #include <net/gre.h>
+#include <net/erspan.h>
 #include <net/icmp.h>
 #include <net/route.h>
@@ -119,6 +120,22 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                        hdr_len += 4;
        }
        tpi->hdr_len = hdr_len;
+        /* ERSPAN ver 1 and 2 protocol sets GRE key field
+         * to 0 and sets the configured key in the
+         * inner erspan header field
+         */
+        if (greh->protocol == htons(ETH_P_ERSPAN) ||
+            greh->protocol == htons(ETH_P_ERSPAN2)) {
+                struct erspan_base_hdr *ershdr;
+                if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
+                        return -EINVAL;
+                ershdr = (struct erspan_base_hdr *)options;
+                tpi->key = cpu_to_be32(get_session_id(ershdr));
+        }
        return hdr_len;
 }
 EXPORT_SYMBOL(gre_parse_header);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d1d09f3e5f9e..20a64fe6254b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -268,20 +268,11 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
        int len;
        itn = net_generic(net, erspan_net_id);
-        len = gre_hdr_len + sizeof(*ershdr);
-        /* Check based hdr len */
-        if (unlikely(!pskb_may_pull(skb, len)))
-                return PACKET_REJECT;
        iph = ip_hdr(skb);
        ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
        ver = ershdr->ver;
-        /* The original GRE header does not have key field,
-         * Use ERSPAN 10-bit session ID as key.
-         */
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                  tpi->flags | TUNNEL_KEY,
                                  iph->saddr, iph->daddr, tpi->key);
@@ -569,8 +560,7 @@ err_free_skb:
        dev->stats.tx_dropped++;
 }
-static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
-                           __be16 proto)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        struct ip_tunnel_info *tun_info;
@@ -578,10 +568,10 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
        struct erspan_metadata *md;
        struct rtable *rt = NULL;
        bool truncate = false;
+        __be16 df, proto;
        struct flowi4 fl;
        int tunnel_hlen;
        int version;
-        __be16 df;
        int nhoff;
        int thoff;
@@ -626,18 +616,20 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
        if (version == 1) {
                erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
                                    ntohl(md->u.index), truncate, true);
+                proto = htons(ETH_P_ERSPAN);
        } else if (version == 2) {
                erspan_build_header_v2(skb,
                                       ntohl(tunnel_id_to_key32(key->tun_id)),
                                       md->u.md2.dir,
                                       get_hwid(&md->u.md2),
                                       truncate, true);
+                proto = htons(ETH_P_ERSPAN2);
        } else {
                goto err_free_rt;
        }
        gre_build_header(skb, 8, TUNNEL_SEQ,
-                         htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++));
+                         proto, 0, htonl(tunnel->o_seqno++));
        df = key->tun_flags & TUNNEL_DONT_FRAGMENT ?  htons(IP_DF) : 0;
@@ -721,12 +713,13 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        bool truncate = false;
+        __be16 proto;
        if (!pskb_inet_may_pull(skb))
                goto free_skb;
        if (tunnel->collect_md) {
-                erspan_fb_xmit(skb, dev, skb->protocol);
+                erspan_fb_xmit(skb, dev);
                return NETDEV_TX_OK;
        }
@@ -742,19 +735,22 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
        }
        /* Push ERSPAN header */
-        if (tunnel->erspan_ver == 1)
+        if (tunnel->erspan_ver == 1) {
                erspan_build_header(skb, ntohl(tunnel->parms.o_key),
                                    tunnel->index,
                                    truncate, true);
-        else if (tunnel->erspan_ver == 2)
+                proto = htons(ETH_P_ERSPAN);
+        } else if (tunnel->erspan_ver == 2) {
                erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key),
                                       tunnel->dir, tunnel->hwid,
                                       truncate, true);
-        else
+                proto = htons(ETH_P_ERSPAN2);
+        } else {
                goto free_skb;
+        }
        tunnel->parms.o_flags &= ~TUNNEL_KEY;
-        __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN));
+        __gre_xmit(skb, dev, &tunnel->parms.iph, proto);
        return NETDEV_TX_OK;
 free_skb:
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 26921f6b3b92..51d8efba6de2 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -488,6 +488,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
                goto drop;
        }
+        iph = ip_hdr(skb);
        skb->transport_header = skb->network_header + iph->ihl*4;
        /* Remove any debris in the socket control block */
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fffcc130900e..82f341e84fae 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -148,19 +148,17 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
+        __be16 _ports[2], *ports;
        struct sockaddr_in sin;
-        __be16 *ports;
-        int end;
-        end = skb_transport_offset(skb) + 4;
-        if (end > 0 && !pskb_may_pull(skb, end))
-                return;
        /* All current transport protocols have the port numbers in the
         * first four bytes of the transport header and this function is
         * written with this assumption in mind.
         */
-        ports = (__be16 *)skb_transport_header(skb);
+        ports = skb_header_pointer(skb, skb_transport_offset(skb),
+                                   sizeof(_ports), &_ports);
+        if (!ports)
+                return;
        sin.sin_family = AF_INET;
        sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index c4f5602308ed..054d01c16dc6 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -644,13 +644,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        dst = tnl_params->daddr;
        if (dst == 0) {
                /* NBMA tunnel */
+                struct ip_tunnel_info *tun_info;
                if (!skb_dst(skb)) {
                        dev->stats.tx_fifo_errors++;
                        goto tx_error;
                }
-                if (skb->protocol == htons(ETH_P_IP)) {
+                tun_info = skb_tunnel_info(skb);
+                if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
+                    ip_tunnel_info_af(tun_info) == AF_INET &&
+                    tun_info->key.u.ipv4.dst)
+                        dst = tun_info->key.u.ipv4.dst;
+                else if (skb->protocol == htons(ETH_P_IP)) {
                        rt = skb_rtable(skb);
                        dst = rt_nexthop(rt, inner_iph->daddr);
                }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 27e2f6837062..2079145a3b7c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1186,7 +1186,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
        flags = msg->msg_flags;
        if (flags & MSG_ZEROCOPY && size && sock_flag(sk, SOCK_ZEROCOPY)) {
-                if (sk->sk_state != TCP_ESTABLISHED) {
+                if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
                        err = -EINVAL;
                        goto out_err;
                }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index f87dbc78b6bc..71a29e9c0620 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -226,7 +226,7 @@ static int tcp_write_timeout(struct sock *sk)
        if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                if (icsk->icsk_retransmits) {
                        dst_negative_advice(sk);
-                } else if (!tp->syn_data && !tp->syn_fastopen) {
+                } else {
                        sk_rethink_txhash(sk);
                }
                retry_until = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 3fb0ed5e4789..5c3cd5d84a6f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -847,15 +847,23 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
                const int hlen = skb_network_header_len(skb) +
                                 sizeof(struct udphdr);
-                if (hlen + cork->gso_size > cork->fragsize)
+                if (hlen + cork->gso_size > cork->fragsize) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
+                }
+                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (sk->sk_no_check_tx)
+                }
+                if (sk->sk_no_check_tx) {
+                        kfree_skb(skb);
                        return -EINVAL;
+                }
                if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
-                    dst_xfrm(skb_dst(skb)))
+                    dst_xfrm(skb_dst(skb))) {
+                        kfree_skb(skb);
                        return -EIO;
+                }
                skb_shinfo(skb)->gso_size = cork->gso_size;
                skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
@@ -1918,7 +1926,7 @@ void udp_lib_rehash(struct sock *sk, u16 newhash)
 }
 EXPORT_SYMBOL(udp_lib_rehash);
-static void udp_v4_rehash(struct sock *sk)
+void udp_v4_rehash(struct sock *sk)
 {
        u16 new_hash = ipv4_portaddr_hash(sock_net(sk),
                                          inet_sk(sk)->inet_rcv_saddr,
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 322672655419..6b2fa77eeb1c 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -10,6 +10,7 @@ int __udp4_lib_rcv(struct sk_buff *, struct udp_table *, int);
 int __udp4_lib_err(struct sk_buff *, u32, struct udp_table *);
 int udp_v4_get_port(struct sock *sk, unsigned short snum);
+void udp_v4_rehash(struct sock *sk);
 int udp_setsockopt(struct sock *sk, int level, int optname,
                   char __user *optval, unsigned int optlen);
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 39c7f17d916f..3c94b8f0ff27 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -53,6 +53,7 @@ struct proto 	udplite_prot = {
        .sendpage          = udp_sendpage,
        .hash              = udp_lib_hash,
        .unhash            = udp_lib_unhash,
+        .rehash            = udp_v4_rehash,
        .get_port          = udp_v4_get_port,
        .memory_allocated  = &udp_memory_allocated,
        .sysctl_mem        = sysctl_udp_mem,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8eeec6eb2bd3..84c358804355 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3495,8 +3495,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        if (!addrconf_link_ready(dev)) {
                                /* device is not ready yet. */
-                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+                                pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
-                                        dev->name);
+                                         dev->name);
                                break;
                        }
@@ -5120,6 +5120,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                        if (idev) {
                                err = in6_dump_addrs(idev, skb, cb, s_ip_idx,
                                                     &fillargs);
+                                if (err > 0)
+                                        err = 0;
                        }
                        goto put_tgt_net;
                }
@@ -5154,7 +5156,7 @@ put_tgt_net:
        if (fillargs.netnsid >= 0)
                put_net(tgt_net);
-        return err < 0 ? err : skb->len;
+        return skb->len ? : err;
 }
 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0bfb6cc0a30a..d99753b5e39b 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -310,6 +310,7 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
        /* Check if the address belongs to the host. */
        if (addr_type == IPV6_ADDR_MAPPED) {
+                struct net_device *dev = NULL;
                int chk_addr_ret;
                /* Binding to v4-mapped address on a v6-only socket
@@ -320,9 +321,20 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
                        goto out;
                }
+                rcu_read_lock();
+                if (sk->sk_bound_dev_if) {
+                        dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+                        if (!dev) {
+                                err = -ENODEV;
+                                goto out_unlock;
+                        }
+                }
                /* Reproduce AF_INET checks to make the bindings consistent */
                v4addr = addr->sin6_addr.s6_addr32[3];
-                chk_addr_ret = inet_addr_type(net, v4addr);
+                chk_addr_ret = inet_addr_type_dev_table(net, dev, v4addr);
+                rcu_read_unlock();
                if (!inet_can_nonlocal_bind(net, inet) &&
                    v4addr != htonl(INADDR_ANY) &&
                    chk_addr_ret != RTN_LOCAL &&
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index bde08aa549f3..ee4a4e54d016 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -341,6 +341,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
        iph->daddr = fl6->daddr;
+        ip6_flow_hdr(iph, 0, 0);
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
@@ -700,17 +701,15 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg,
        }
        if (np->rxopt.bits.rxorigdstaddr) {
                struct sockaddr_in6 sin6;
-                __be16 *ports;
+                __be16 _ports[2], *ports;
-                int end;
-                end = skb_transport_offset(skb) + 4;
+                ports = skb_header_pointer(skb, skb_transport_offset(skb),
-                if (end <= 0 || pskb_may_pull(skb, end)) {
+                                           sizeof(_ports), &_ports);
+                if (ports) {
                        /* All current transport protocols have the port numbers in the
                         * first four bytes of the transport header and this function is
                         * written with this assumption in mind.
                         */
-                        ports = (__be16 *)skb_transport_header(skb);
                        sin6.sin6_family = AF_INET6;
                        sin6.sin6_addr = ipv6_hdr(skb)->daddr;
                        sin6.sin6_port = ports[1];
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index bd675c61deb1..b858bd5280bf 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -90,10 +90,11 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
        int transport_offset = skb_transport_offset(skb);
        struct guehdr *guehdr;
-        size_t optlen;
+        size_t len, optlen;
        int ret;
-        if (skb->len < sizeof(struct udphdr) + sizeof(struct guehdr))
+        len = sizeof(struct udphdr) + sizeof(struct guehdr);
+        if (!pskb_may_pull(skb, len))
                return -EINVAL;
        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -128,9 +129,21 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        optlen = guehdr->hlen << 2;
+        if (!pskb_may_pull(skb, len + optlen))
+                return -EINVAL;
+        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
        if (validate_gue_flags(guehdr, optlen))
                return -EINVAL;
+        /* Handling exceptions for direct UDP encapsulation in GUE would lead to
+         * recursion. Besides, this kind of encapsulation can't even be
+         * configured currently. Discard this.
+         */
+        if (guehdr->proto_ctype == IPPROTO_UDP ||
+            guehdr->proto_ctype == IPPROTO_UDPLITE)
+                return -EOPNOTSUPP;
        skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
        ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
                                     opt, type, code, offset, info);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 5d7aa2c2770c..bbcdfd299692 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -423,10 +423,10 @@ static int icmp6_iif(const struct sk_buff *skb)
 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
                       const struct in6_addr *force_saddr)
 {
-        struct net *net = dev_net(skb->dev);
        struct inet6_dev *idev = NULL;
        struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct sock *sk;
+        struct net *net;
        struct ipv6_pinfo *np;
        const struct in6_addr *saddr = NULL;
        struct dst_entry *dst;
@@ -437,12 +437,16 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
        int iif = 0;
        int addr_type = 0;
        int len;
-        u32 mark = IP6_REPLY_MARK(net, skb->mark);
+        u32 mark;
        if ((u8 *)hdr < skb->head ||
            (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
                return;
+        if (!skb->dev)
+                return;
+        net = dev_net(skb->dev);
+        mark = IP6_REPLY_MARK(net, skb->mark);
        /*
         *      Make sure we respect the rules
         *      i.e. RFC 1885 2.4(e)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 09d0826742f8..4416368dbd49 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -534,13 +534,9 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
        struct ip6_tnl *tunnel;
        u8 ver;
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
-                return PACKET_REJECT;
        ipv6h = ipv6_hdr(skb);
        ershdr = (struct erspan_base_hdr *)skb->data;
        ver = ershdr->ver;
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
        tunnel = ip6gre_tunnel_lookup(skb->dev,
                                      &ipv6h->saddr, &ipv6h->daddr, tpi->key,
@@ -922,6 +918,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
        __u8 dsfield = false;
        struct flowi6 fl6;
        int err = -EINVAL;
+        __be16 proto;
        __u32 mtu;
        int nhoff;
        int thoff;
@@ -1035,8 +1032,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
        }
        /* Push GRE header. */
-        gre_build_header(skb, 8, TUNNEL_SEQ,
+        proto = (t->parms.erspan_ver == 1) ? htons(ETH_P_ERSPAN)
-                         htons(ETH_P_ERSPAN), 0, htonl(t->o_seqno++));
+                                           : htons(ETH_P_ERSPAN2);
+        gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(t->o_seqno++));
        /* TooBig packet may have updated dst->dev's mtu */
        if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
@@ -1169,6 +1167,10 @@ static void ip6gre_tnl_copy_tnl_parm(struct ip6_tnl *t,
        t->parms.i_flags = p->i_flags;
        t->parms.o_flags = p->o_flags;
        t->parms.fwmark = p->fwmark;
+        t->parms.erspan_ver = p->erspan_ver;
+        t->parms.index = p->index;
+        t->parms.dir = p->dir;
+        t->parms.hwid = p->hwid;
        dst_cache_reset(&t->dst_cache);
 }
@@ -2025,9 +2027,9 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct nlattr *data[],
                             struct netlink_ext_ack *extack)
 {
-        struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
        struct __ip6_tnl_parm p;
-        struct ip6_tnl *t;
        t = ip6gre_changelink_common(dev, tb, data, &p, extack);
        if (IS_ERR(t))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 40b225f87d5e..964491cf3672 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4251,17 +4251,6 @@ struct rt6_nh {
        struct list_head next;
 };
-static void ip6_print_replace_route_err(struct list_head *rt6_nh_list)
-{
-        struct rt6_nh *nh;
-        list_for_each_entry(nh, rt6_nh_list, next) {
-                pr_warn("IPV6: multipath route replace failed (check consistency of installed routes): %pI6c nexthop %pI6c ifi %d\n",
-                        &nh->r_cfg.fc_dst, &nh->r_cfg.fc_gateway,
-                        nh->r_cfg.fc_ifindex);
-        }
-}
 static int ip6_route_info_append(struct net *net,
                                 struct list_head *rt6_nh_list,
                                 struct fib6_info *rt,
@@ -4407,7 +4396,8 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                nh->fib6_info = NULL;
                if (err) {
                        if (replace && nhn)
-                                ip6_print_replace_route_err(&rt6_nh_list);
+                                NL_SET_ERR_MSG_MOD(extack,
+                                                   "multipath route replace failed (check consistency of installed routes)");
                        err_nh = nh;
                        goto add_errout;
                }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9cbf363172bd..2596ffdeebea 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -102,7 +102,7 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
        return udp_lib_get_port(sk, snum, hash2_nulladdr);
 }
-static void udp_v6_rehash(struct sock *sk)
+void udp_v6_rehash(struct sock *sk)
 {
        u16 new_hash = ipv6_portaddr_hash(sock_net(sk),
                                          &sk->sk_v6_rcv_saddr,
@@ -1132,15 +1132,23 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                const int hlen = skb_network_header_len(skb) +
                                 sizeof(struct udphdr);
-                if (hlen + cork->gso_size > cork->fragsize)
+                if (hlen + cork->gso_size > cork->fragsize) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
+                }
+                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (udp_sk(sk)->no_check6_tx)
+                }
+                if (udp_sk(sk)->no_check6_tx) {
+                        kfree_skb(skb);
                        return -EINVAL;
+                }
                if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
-                    dst_xfrm(skb_dst(skb)))
+                    dst_xfrm(skb_dst(skb))) {
+                        kfree_skb(skb);
                        return -EIO;
+                }
                skb_shinfo(skb)->gso_size = cork->gso_size;
                skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
@@ -1390,10 +1398,7 @@ do_udp_sendmsg:
        ipc6.opt = opt;
        fl6.flowi6_proto = sk->sk_protocol;
-        if (!ipv6_addr_any(daddr))
+        fl6.daddr = *daddr;
-                fl6.daddr = *daddr;
-        else
-                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
                fl6.saddr = np->saddr;
        fl6.fl6_sport = inet->inet_sport;
@@ -1421,6 +1426,9 @@ do_udp_sendmsg:
                }
        }
+        if (ipv6_addr_any(&fl6.daddr))
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        final_p = fl6_update_dst(&fl6, opt, &final);
        if (final_p)
                connected = false;
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 5730e6503cb4..20e324b6f358 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -13,6 +13,7 @@ int __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *, u8, u8, int,
                   __be32, struct udp_table *);
 int udp_v6_get_port(struct sock *sk, unsigned short snum);
+void udp_v6_rehash(struct sock *sk);
 int udpv6_getsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user *optlen);
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index a125aebc29e5..f35907836444 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -49,6 +49,7 @@ struct proto udplitev6_prot = {
        .recvmsg           = udpv6_recvmsg,
        .hash              = udp_lib_hash,
        .unhash            = udp_lib_unhash,
+        .rehash            = udp_v6_rehash,
        .get_port          = udp_v6_get_port,
        .memory_allocated  = &udp_memory_allocated,
        .sysctl_mem        = sysctl_udp_mem,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index de65fe3ed9cc..2493c74c2d37 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1490,6 +1490,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                sta->sta.tdls = true;
+        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
        err = sta_apply_parameters(local, sta, params);
        if (err) {
                sta_info_free(local, sta);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 45aad3d3108c..bb4d71efb6fb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -231,7 +231,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
                struct ieee80211_hdr_3addr hdr;
                u8 category;
                u8 action_code;
-        } __packed action;
+        } __packed __aligned(2) action;
        if (!sdata)
                return;
@@ -2723,7 +2723,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        skb_set_queue_mapping(skb, q);
        if (!--mesh_hdr->ttl) {
-                IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
+                if (!is_multicast_ether_addr(hdr->addr1))
+                        IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+                                                     dropped_frames_ttl);
                goto out;
        }
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index fa0844e2a68d..c0c72ae9df42 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
 {
        struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
        struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
+        struct dst_entry *other_dst = route->tuple[!dir].dst;
        struct dst_entry *dst = route->tuple[dir].dst;
        ft->dir = dir;
@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
        ft->src_port = ctt->src.u.tcp.port;
        ft->dst_port = ctt->dst.u.tcp.port;
-        ft->iifidx = route->tuple[dir].ifindex;
+        ft->iifidx = other_dst->dev->ifindex;
-        ft->oifidx = route->tuple[!dir].ifindex;
+        ft->oifidx = dst->dev->ifindex;
        ft->dst_cache = dst;
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2b0a93300dd7..fb07f6cfc719 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2304,7 +2304,6 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,
        struct net *net = sock_net(skb->sk);
        unsigned int s_idx = cb->args[0];
        const struct nft_rule *rule;
-        int rc = 1;
        list_for_each_entry_rcu(rule, &chain->rules, list) {
                if (!nft_is_active(net, rule))
@@ -2321,16 +2320,13 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,
                                        NLM_F_MULTI | NLM_F_APPEND,
                                        table->family,
                                        table, chain, rule) < 0)
-                        goto out_unfinished;
+                        return 1;
                nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                (*idx)++;
        }
-        rc = 0;
+        return 0;
-out_unfinished:
-        cb->args[0] = *idx;
-        return rc;
 }
 static int nf_tables_dump_rules(struct sk_buff *skb,
@@ -2354,7 +2350,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
                if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
                        continue;
-                if (ctx && ctx->chain) {
+                if (ctx && ctx->table && ctx->chain) {
                        struct rhlist_head *list, *tmp;
                        list = rhltable_lookup(&table->chains_ht, ctx->chain,
@@ -2382,6 +2378,8 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
        }
 done:
        rcu_read_unlock();
+        cb->args[0] = idx;
        return skb->len;
 }
@@ -4508,6 +4506,8 @@ err6:
 err5:
        kfree(trans);
 err4:
+        if (obj)
+                obj->use--;
        kfree(elem.priv);
 err3:
        if (nla[NFTA_SET_ELEM_DATA] != NULL)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 974525eb92df..6e6b9adf7d38 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -12,6 +12,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <linux/netfilter/nf_conntrack_common.h>
 #include <net/netfilter/nf_flow_table.h>
+#include <net/netfilter/nf_conntrack_helper.h>
 struct nft_flow_offload {
        struct nft_flowtable    *flowtable;
@@ -29,10 +30,12 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
        memset(&fl, 0, sizeof(fl));
        switch (nft_pf(pkt)) {
        case NFPROTO_IPV4:
-                fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
+                fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
+                fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;
                break;
        case NFPROTO_IPV6:
-                fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
+                fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
+                fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex;
                break;
        }
@@ -41,9 +44,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
                return -ENOENT;
        route->tuple[dir].dst           = this_dst;
-        route->tuple[dir].ifindex       = nft_in(pkt)->ifindex;
        route->tuple[!dir].dst          = other_dst;
-        route->tuple[!dir].ifindex      = nft_out(pkt)->ifindex;
        return 0;
 }
@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 {
        struct nft_flow_offload *priv = nft_expr_priv(expr);
        struct nf_flowtable *flowtable = &priv->flowtable->data;
+        const struct nf_conn_help *help;
        enum ip_conntrack_info ctinfo;
        struct nf_flow_route route;
        struct flow_offload *flow;
@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
                goto out;
        }
-        if (test_bit(IPS_HELPER_BIT, &ct->status))
+        help = nfct_help(ct);
+        if (help)
                goto out;
        if (ctinfo == IP_CT_NEW ||
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 57e07768c9d1..f54cf17ef7a8 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -276,10 +276,12 @@ static int parse_ipv6hdr(struct sk_buff *skb, struct sw_flow_key *key)
        nexthdr = ipv6_find_hdr(skb, &payload_ofs, -1, &frag_off, &flags);
        if (flags & IP6_FH_F_FRAG) {
-                if (frag_off)
+                if (frag_off) {
                        key->ip.frag = OVS_FRAG_TYPE_LATER;
-                else
+                        key->ip.proto = nexthdr;
-                        key->ip.frag = OVS_FRAG_TYPE_FIRST;
+                        return 0;
+                }
+                key->ip.frag = OVS_FRAG_TYPE_FIRST;
        } else {
                key->ip.frag = OVS_FRAG_TYPE_NONE;
        }
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 435a4bdf8f89..691da853bef5 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -500,7 +500,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
                        return -EINVAL;
                }
-                if (!nz || !is_all_zero(nla_data(nla), expected_len)) {
+                if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
                        attrs |= 1 << type;
                        a[type] = nla;
                }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index eedacdebcd4c..3b1a78906bc0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2628,7 +2628,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                addr    = saddr->sll_halen ? saddr->sll_addr : NULL;
                dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
                if (addr && dev && saddr->sll_halen < dev->addr_len)
-                        goto out;
+                        goto out_put;
        }
        err = -ENXIO;
@@ -2828,7 +2828,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                addr    = saddr->sll_halen ? saddr->sll_addr : NULL;
                dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
                if (addr && dev && saddr->sll_halen < dev->addr_len)
-                        goto out;
+                        goto out_unlock;
        }
        err = -ENXIO;
@@ -2887,7 +2887,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                        goto out_free;
        } else if (reserve) {
                skb_reserve(skb, -reserve);
-                if (len < reserve)
+                if (len < reserve + sizeof(struct ipv6hdr) &&
+                    dev->min_header_len != dev->hard_header_len)
                        skb_reset_network_header(skb);
        }
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 2dcb555e6350..4e0c36acf866 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -522,7 +522,7 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
        if (be32_to_cpu(rm->m_inc.i_hdr.h_len) == 0)
                i = 1;
        else
-                i = ceil(be32_to_cpu(rm->m_inc.i_hdr.h_len), RDS_FRAG_SIZE);
+                i = DIV_ROUND_UP(be32_to_cpu(rm->m_inc.i_hdr.h_len), RDS_FRAG_SIZE);
        work_alloc = rds_ib_ring_alloc(&ic->i_send_ring, i, &pos);
        if (work_alloc == 0) {
@@ -879,7 +879,7 @@ int rds_ib_xmit_rdma(struct rds_connection *conn, struct rm_rdma_op *op)
         * Instead of knowing how to return a partial rdma read/write we insist that there
         * be enough work requests to send the entire message.
         */
-        i = ceil(op->op_count, max_sge);
+        i = DIV_ROUND_UP(op->op_count, max_sge);
        work_alloc = rds_ib_ring_alloc(&ic->i_send_ring, i, &pos);
        if (work_alloc != i) {
diff --git a/net/rds/message.c b/net/rds/message.c
index f139420ba1f6..50f13f1d4ae0 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -341,7 +341,7 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
 {
        struct rds_message *rm;
        unsigned int i;
-        int num_sgs = ceil(total_len, PAGE_SIZE);
+        int num_sgs = DIV_ROUND_UP(total_len, PAGE_SIZE);
        int extra_bytes = num_sgs * sizeof(struct scatterlist);
        int ret;
@@ -351,7 +351,7 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
        set_bit(RDS_MSG_PAGEVEC, &rm->m_flags);
        rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
-        rm->data.op_nents = ceil(total_len, PAGE_SIZE);
+        rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
        rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret);
        if (!rm->data.op_sg) {
                rds_message_put(rm);
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 02ec4a3b2799..4ffe100ff5e6 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -48,10 +48,6 @@ void rdsdebug(char *fmt, ...)
 }
 #endif
-/* XXX is there one of these somewhere? */
-#define ceil(x, y) \
-        ({ unsigned long __x = (x), __y = (y); (__x + __y - 1) / __y; })
 #define RDS_FRAG_SHIFT  12
 #define RDS_FRAG_SIZE   ((unsigned int)(1 << RDS_FRAG_SHIFT))
diff --git a/net/rds/send.c b/net/rds/send.c
index 3d822bad7de9..fd8b687d5c05 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1107,7 +1107,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
        size_t total_payload_len = payload_len, rdma_payload_len = 0;
        bool zcopy = ((msg->msg_flags & MSG_ZEROCOPY) &&
                      sock_flag(rds_rs_to_sk(rs), SOCK_ZEROCOPY));
-        int num_sgs = ceil(payload_len, PAGE_SIZE);
+        int num_sgs = DIV_ROUND_UP(payload_len, PAGE_SIZE);
        int namelen;
        struct rds_iov_vector_arr vct;
        int ind;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index a2522f9d71e2..96f2952bbdfd 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -419,76 +419,6 @@ u32 rxrpc_kernel_get_epoch(struct socket *sock, struct rxrpc_call *call)
 EXPORT_SYMBOL(rxrpc_kernel_get_epoch);
 /**
- * rxrpc_kernel_check_call - Check a call's state
- * @sock: The socket the call is on
- * @call: The call to check
- * @_compl: Where to store the completion state
- * @_abort_code: Where to store any abort code
- *
- * Allow a kernel service to query the state of a call and find out the manner
- * of its termination if it has completed.  Returns -EINPROGRESS if the call is
- * still going, 0 if the call finished successfully, -ECONNABORTED if the call
- * was aborted and an appropriate error if the call failed in some other way.
- */
-int rxrpc_kernel_check_call(struct socket *sock, struct rxrpc_call *call,
-                            enum rxrpc_call_completion *_compl, u32 *_abort_code)
-{
-        if (call->state != RXRPC_CALL_COMPLETE)
-                return -EINPROGRESS;
-        smp_rmb();
-        *_compl = call->completion;
-        *_abort_code = call->abort_code;
-        return call->error;
-}
-EXPORT_SYMBOL(rxrpc_kernel_check_call);
-/**
- * rxrpc_kernel_retry_call - Allow a kernel service to retry a call
- * @sock: The socket the call is on
- * @call: The call to retry
- * @srx: The address of the peer to contact
- * @key: The security context to use (defaults to socket setting)
- *
- * Allow a kernel service to try resending a client call that failed due to a
- * network error to a new address.  The Tx queue is maintained intact, thereby
- * relieving the need to re-encrypt any request data that has already been
- * buffered.
- */
-int rxrpc_kernel_retry_call(struct socket *sock, struct rxrpc_call *call,
-                            struct sockaddr_rxrpc *srx, struct key *key)
-{
-        struct rxrpc_conn_parameters cp;
-        struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-        int ret;
-        _enter("%d{%d}", call->debug_id, atomic_read(&call->usage));
-        if (!key)
-                key = rx->key;
-        if (key && !key->payload.data[0])
-                key = NULL; /* a no-security key */
-        memset(&cp, 0, sizeof(cp));
-        cp.local                = rx->local;
-        cp.key                  = key;
-        cp.security_level       = 0;
-        cp.exclusive            = false;
-        cp.service_id           = srx->srx_service;
-        mutex_lock(&call->user_mutex);
-        ret = rxrpc_prepare_call_for_retry(rx, call);
-        if (ret == 0)
-                ret = rxrpc_retry_client_call(rx, call, &cp, srx, GFP_KERNEL);
-        mutex_unlock(&call->user_mutex);
-        rxrpc_put_peer(cp.peer);
-        _leave(" = %d", ret);
-        return ret;
-}
-EXPORT_SYMBOL(rxrpc_kernel_retry_call);
-/**
 * rxrpc_kernel_new_call_notification - Get notifications of new calls
 * @sock: The socket to intercept received messages on
 * @notify_new_call: Function to be called when new calls appear
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index bc628acf4f4f..4b1a534d290a 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -476,7 +476,6 @@ enum rxrpc_call_flag {
        RXRPC_CALL_EXPOSED,             /* The call was exposed to the world */
        RXRPC_CALL_RX_LAST,             /* Received the last packet (at rxtx_top) */
        RXRPC_CALL_TX_LAST,             /* Last packet in Tx buffer (at rxtx_top) */
-        RXRPC_CALL_TX_LASTQ,            /* Last packet has been queued */
        RXRPC_CALL_SEND_PING,           /* A ping will need to be sent */
        RXRPC_CALL_PINGING,             /* Ping in process */
        RXRPC_CALL_RETRANS_TIMEOUT,     /* Retransmission due to timeout occurred */
@@ -518,6 +517,18 @@ enum rxrpc_call_state {
 };
 /*
+ * Call completion condition (state == RXRPC_CALL_COMPLETE).
+ */
+enum rxrpc_call_completion {
+        RXRPC_CALL_SUCCEEDED,           /* - Normal termination */
+        RXRPC_CALL_REMOTELY_ABORTED,    /* - call aborted by peer */
+        RXRPC_CALL_LOCALLY_ABORTED,     /* - call aborted locally on error or close */
+        RXRPC_CALL_LOCAL_ERROR,         /* - call failed due to local error */
+        RXRPC_CALL_NETWORK_ERROR,       /* - call terminated by network error */
+        NR__RXRPC_CALL_COMPLETIONS
+};
+/*
 * Call Tx congestion management modes.
 */
 enum rxrpc_congest_mode {
@@ -761,15 +772,9 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *,
                                         struct sockaddr_rxrpc *,
                                         struct rxrpc_call_params *, gfp_t,
                                         unsigned int);
-int rxrpc_retry_client_call(struct rxrpc_sock *,
-                            struct rxrpc_call *,
-                            struct rxrpc_conn_parameters *,
-                            struct sockaddr_rxrpc *,
-                            gfp_t);
 void rxrpc_incoming_call(struct rxrpc_sock *, struct rxrpc_call *,
                         struct sk_buff *);
 void rxrpc_release_call(struct rxrpc_sock *, struct rxrpc_call *);
-int rxrpc_prepare_call_for_retry(struct rxrpc_sock *, struct rxrpc_call *);
 void rxrpc_release_calls_on_socket(struct rxrpc_sock *);
 bool __rxrpc_queue_call(struct rxrpc_call *);
 bool rxrpc_queue_call(struct rxrpc_call *);
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 8f1a8f85b1f9..8aa2937b069f 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -325,48 +325,6 @@ error:
 }
 /*
- * Retry a call to a new address.  It is expected that the Tx queue of the call
- * will contain data previously packaged for an old call.
- */
-int rxrpc_retry_client_call(struct rxrpc_sock *rx,
-                            struct rxrpc_call *call,
-                            struct rxrpc_conn_parameters *cp,
-                            struct sockaddr_rxrpc *srx,
-                            gfp_t gfp)
-{
-        const void *here = __builtin_return_address(0);
-        int ret;
-        /* Set up or get a connection record and set the protocol parameters,
-         * including channel number and call ID.
-         */
-        ret = rxrpc_connect_call(rx, call, cp, srx, gfp);
-        if (ret < 0)
-                goto error;
-        trace_rxrpc_call(call, rxrpc_call_connected, atomic_read(&call->usage),
-                         here, NULL);
-        rxrpc_start_call_timer(call);
-        _net("CALL new %d on CONN %d", call->debug_id, call->conn->debug_id);
-        if (!test_and_set_bit(RXRPC_CALL_EV_RESEND, &call->events))
-                rxrpc_queue_call(call);
-        _leave(" = 0");
-        return 0;
-error:
-        rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
-                                  RX_CALL_DEAD, ret);
-        trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage),
-                         here, ERR_PTR(ret));
-        _leave(" = %d", ret);
-        return ret;
-}
-/*
 * Set up an incoming call.  call->conn points to the connection.
 * This is called in BH context and isn't allowed to fail.
 */
@@ -534,61 +492,6 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
 }
 /*
- * Prepare a kernel service call for retry.
- */
-int rxrpc_prepare_call_for_retry(struct rxrpc_sock *rx, struct rxrpc_call *call)
-{
-        const void *here = __builtin_return_address(0);
-        int i;
-        u8 last = 0;
-        _enter("{%d,%d}", call->debug_id, atomic_read(&call->usage));
-        trace_rxrpc_call(call, rxrpc_call_release, atomic_read(&call->usage),
-                         here, (const void *)call->flags);
-        ASSERTCMP(call->state, ==, RXRPC_CALL_COMPLETE);
-        ASSERTCMP(call->completion, !=, RXRPC_CALL_REMOTELY_ABORTED);
-        ASSERTCMP(call->completion, !=, RXRPC_CALL_LOCALLY_ABORTED);
-        ASSERT(list_empty(&call->recvmsg_link));
-        del_timer_sync(&call->timer);
-        _debug("RELEASE CALL %p (%d CONN %p)", call, call->debug_id, call->conn);
-        if (call->conn)
-                rxrpc_disconnect_call(call);
-        if (rxrpc_is_service_call(call) ||
-            !call->tx_phase ||
-            call->tx_hard_ack != 0 ||
-            call->rx_hard_ack != 0 ||
-            call->rx_top != 0)
-                return -EINVAL;
-        call->state = RXRPC_CALL_UNINITIALISED;
-        call->completion = RXRPC_CALL_SUCCEEDED;
-        call->call_id = 0;
-        call->cid = 0;
-        call->cong_cwnd = 0;
-        call->cong_extra = 0;
-        call->cong_ssthresh = 0;
-        call->cong_mode = 0;
-        call->cong_dup_acks = 0;
-        call->cong_cumul_acks = 0;
-        call->acks_lowest_nak = 0;
-        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
-                last |= call->rxtx_annotations[i];
-                call->rxtx_annotations[i] &= RXRPC_TX_ANNO_LAST;
-                call->rxtx_annotations[i] |= RXRPC_TX_ANNO_RETRANS;
-        }
-        _leave(" = 0");
-        return 0;
-}
-/*
 * release all the calls associated with a socket
 */
 void rxrpc_release_calls_on_socket(struct rxrpc_sock *rx)
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 521189f4b666..b2adfa825363 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -562,10 +562,7 @@ static void rxrpc_activate_one_channel(struct rxrpc_connection *conn,
        clear_bit(RXRPC_CONN_FINAL_ACK_0 + channel, &conn->flags);
        write_lock_bh(&call->state_lock);
-        if (!test_bit(RXRPC_CALL_TX_LASTQ, &call->flags))
+        call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
-                call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
-        else
-                call->state = RXRPC_CALL_CLIENT_AWAIT_REPLY;
        write_unlock_bh(&call->state_lock);
        rxrpc_see_call(call);
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index be01f9c5d963..46c9312085b1 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -169,10 +169,8 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        ASSERTCMP(seq, ==, call->tx_top + 1);
-        if (last) {
+        if (last)
                annotation |= RXRPC_TX_ANNO_LAST;
-                set_bit(RXRPC_CALL_TX_LASTQ, &call->flags);
-        }
        /* We have to set the timestamp before queueing as the retransmit
         * algorithm can see the packet as soon as we queue it.
@@ -386,6 +384,11 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                                call->tx_total_len -= copy;
                }
+                /* check for the far side aborting the call or a network error
+                 * occurring */
+                if (call->state == RXRPC_CALL_COMPLETE)
+                        goto call_terminated;
                /* add the packet to the send queue if it's now full */
                if (sp->remain <= 0 ||
                    (msg_data_left(msg) == 0 && !more)) {
@@ -425,16 +428,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                                           notify_end_tx);
                        skb = NULL;
                }
-                /* Check for the far side aborting the call or a network error
-                 * occurring.  If this happens, save any packet that was under
-                 * construction so that in the case of a network error, the
-                 * call can be retried or redirected.
-                 */
-                if (call->state == RXRPC_CALL_COMPLETE) {
-                        ret = call->error;
-                        goto out;
-                }
        } while (msg_data_left(msg) > 0);
 success:
@@ -444,6 +437,11 @@ out:
        _leave(" = %d", ret);
        return ret;
+call_terminated:
+        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+        _leave(" = %d", call->error);
+        return call->error;
 maybe_error:
        if (copied)
                goto success;
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index c3b90fadaff6..8b43fe0130f7 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -197,6 +197,15 @@ static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = {
        [TCA_TUNNEL_KEY_ENC_TTL]      = { .type = NLA_U8 },
 };
+static void tunnel_key_release_params(struct tcf_tunnel_key_params *p)
+{
+        if (!p)
+                return;
+        if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+                dst_release(&p->tcft_enc_metadata->dst);
+        kfree_rcu(p, rcu);
+}
 static int tunnel_key_init(struct net *net, struct nlattr *nla,
                           struct nlattr *est, struct tc_action **a,
                           int ovr, int bind, bool rtnl_held,
@@ -360,8 +369,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
        rcu_swap_protected(t->params, params_new,
                           lockdep_is_held(&t->tcf_lock));
        spin_unlock_bh(&t->tcf_lock);
-        if (params_new)
+        tunnel_key_release_params(params_new);
-                kfree_rcu(params_new, rcu);
        if (ret == ACT_P_CREATED)
                tcf_idr_insert(tn, *a);
@@ -385,12 +393,7 @@ static void tunnel_key_release(struct tc_action *a)
        struct tcf_tunnel_key_params *params;
        params = rcu_dereference_protected(t->params, 1);
-        if (params) {
+        tunnel_key_release_params(params);
-                if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
-                        dst_release(&params->tcft_enc_metadata->dst);
-                kfree_rcu(params, rcu);
-        }
 }
 static int tunnel_key_geneve_opts_dump(struct sk_buff *skb,
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8ce2a0507970..e2b5cb2eb34e 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1277,7 +1277,6 @@ EXPORT_SYMBOL(tcf_block_cb_unregister);
 int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 struct tcf_result *res, bool compat_mode)
 {
-        __be16 protocol = tc_skb_protocol(skb);
 #ifdef CONFIG_NET_CLS_ACT
        const int max_reclassify_loop = 4;
        const struct tcf_proto *orig_tp = tp;
@@ -1287,6 +1286,7 @@ int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 reclassify:
 #endif
        for (; tp; tp = rcu_dereference_bh(tp->next)) {
+                __be16 protocol = tc_skb_protocol(skb);
                int err;
                if (tp->protocol != protocol &&
@@ -1319,7 +1319,6 @@ reset:
        }
        tp = first_tp;
-        protocol = tc_skb_protocol(skb);
        goto reclassify;
 #endif
 }
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index dad04e710493..f6aa57fbbbaf 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1290,17 +1290,23 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
        struct cls_fl_head *head = rtnl_dereference(tp->root);
        struct cls_fl_filter *fold = *arg;
        struct cls_fl_filter *fnew;
+        struct fl_flow_mask *mask;
        struct nlattr **tb;
-        struct fl_flow_mask mask = {};
        int err;
        if (!tca[TCA_OPTIONS])
                return -EINVAL;
-        tb = kcalloc(TCA_FLOWER_MAX + 1, sizeof(struct nlattr *), GFP_KERNEL);
+        mask = kzalloc(sizeof(struct fl_flow_mask), GFP_KERNEL);
-        if (!tb)
+        if (!mask)
                return -ENOBUFS;
+        tb = kcalloc(TCA_FLOWER_MAX + 1, sizeof(struct nlattr *), GFP_KERNEL);
+        if (!tb) {
+                err = -ENOBUFS;
+                goto errout_mask_alloc;
+        }
        err = nla_parse_nested(tb, TCA_FLOWER_MAX, tca[TCA_OPTIONS],
                               fl_policy, NULL);
        if (err < 0)
@@ -1343,12 +1349,12 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                }
        }
-        err = fl_set_parms(net, tp, fnew, &mask, base, tb, tca[TCA_RATE], ovr,
+        err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], ovr,
                           tp->chain->tmplt_priv, extack);
        if (err)
                goto errout_idr;
-        err = fl_check_assign_mask(head, fnew, fold, &mask);
+        err = fl_check_assign_mask(head, fnew, fold, mask);
        if (err)
                goto errout_idr;
@@ -1392,6 +1398,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
        }
        kfree(tb);
+        kfree(mask);
        return 0;
 errout_mask:
@@ -1405,6 +1412,8 @@ errout:
        kfree(fnew);
 errout_tb:
        kfree(tb);
+errout_mask_alloc:
+        kfree(mask);
        return err;
 }
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index b910cd5c56f7..73940293700d 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1667,7 +1667,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
        if (skb_is_gso(skb) && q->rate_flags & CAKE_FLAG_SPLIT_GSO) {
                struct sk_buff *segs, *nskb;
                netdev_features_t features = netif_skb_features(skb);
-                unsigned int slen = 0;
+                unsigned int slen = 0, numsegs = 0;
                segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
                if (IS_ERR_OR_NULL(segs))
@@ -1683,6 +1683,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                        flow_queue_add(flow, segs);
                        sch->q.qlen++;
+                        numsegs++;
                        slen += segs->len;
                        q->buffer_used += segs->truesize;
                        b->packets++;
@@ -1696,7 +1697,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                sch->qstats.backlog += slen;
                q->avg_window_bytes += slen;
-                qdisc_tree_reduce_backlog(sch, 1, len);
+                qdisc_tree_reduce_backlog(sch, 1-numsegs, len-slen);
                consume_skb(skb);
        } else {
                /* not splitting */
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index e689e11b6d0f..c6a502933fe7 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -88,13 +88,14 @@ static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                             struct Qdisc *child,
                             struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb);
        int err;
        err = child->ops->enqueue(skb, child, to_free);
        if (err != NET_XMIT_SUCCESS)
                return err;
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index cdebaed0f8cf..09b800991065 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -350,9 +350,11 @@ static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch,
 static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                       struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb);
        struct drr_sched *q = qdisc_priv(sch);
        struct drr_class *cl;
        int err = 0;
+        bool first;
        cl = drr_classify(skb, sch, &err);
        if (cl == NULL) {
@@ -362,6 +364,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                return err;
        }
+        first = !cl->qdisc->q.qlen;
        err = qdisc_enqueue(skb, cl->qdisc, to_free);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
                if (net_xmit_drop_count(err)) {
@@ -371,12 +374,12 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                return err;
        }
-        if (cl->qdisc->q.qlen == 1) {
+        if (first) {
                list_add_tail(&cl->alist, &q->active);
                cl->deficit = cl->quantum;
        }
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return err;
 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index f6f480784bc6..42471464ded3 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -199,6 +199,7 @@ static struct tcf_block *dsmark_tcf_block(struct Qdisc *sch, unsigned long cl,
 static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                          struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb);
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
        int err;
@@ -271,7 +272,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                return err;
        }
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b18ec1f6de60..24cc220a3218 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1539,8 +1539,10 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
 static int
 hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb);
        struct hfsc_class *cl;
        int uninitialized_var(err);
+        bool first;
        cl = hfsc_classify(skb, sch, &err);
        if (cl == NULL) {
@@ -1550,6 +1552,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
                return err;
        }
+        first = !cl->qdisc->q.qlen;
        err = qdisc_enqueue(skb, cl->qdisc, to_free);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
                if (net_xmit_drop_count(err)) {
@@ -1559,9 +1562,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
                return err;
        }
-        if (cl->qdisc->q.qlen == 1) {
+        if (first) {
-                unsigned int len = qdisc_pkt_len(skb);
                if (cl->cl_flags & HFSC_RSC)
                        init_ed(cl, len);
                if (cl->cl_flags & HFSC_FSC)
@@ -1576,7 +1577,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
        }
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 58b449490757..30f9da7e1076 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -581,6 +581,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                       struct sk_buff **to_free)
 {
        int uninitialized_var(ret);
+        unsigned int len = qdisc_pkt_len(skb);
        struct htb_sched *q = qdisc_priv(sch);
        struct htb_class *cl = htb_classify(skb, sch, &ret);
@@ -610,7 +611,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                htb_activate(q, cl);
        }
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
 }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index cdf68706e40f..847141cd900f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -72,6 +72,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
 static int
 prio_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb);
        struct Qdisc *qdisc;
        int ret;
@@ -88,7 +89,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
        ret = qdisc_enqueue(skb, qdisc, to_free);
        if (ret == NET_XMIT_SUCCESS) {
-                qdisc_qstats_backlog_inc(sch, skb);
+                sch->qstats.backlog += len;
                sch->q.qlen++;
                return NET_XMIT_SUCCESS;
        }
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index dc37c4ead439..29f5c4a24688 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1210,10 +1210,12 @@ static struct qfq_aggregate *qfq_choose_next_agg(struct qfq_sched *q)
 static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                       struct sk_buff **to_free)
 {
+        unsigned int len = qdisc_pkt_len(skb), gso_segs;
        struct qfq_sched *q = qdisc_priv(sch);
        struct qfq_class *cl;
        struct qfq_aggregate *agg;
        int err = 0;
+        bool first;
        cl = qfq_classify(skb, sch, &err);
        if (cl == NULL) {
@@ -1224,17 +1226,18 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
        }
        pr_debug("qfq_enqueue: cl = %x\n", cl->common.classid);
-        if (unlikely(cl->agg->lmax < qdisc_pkt_len(skb))) {
+        if (unlikely(cl->agg->lmax < len)) {
                pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
-                         cl->agg->lmax, qdisc_pkt_len(skb), cl->common.classid);
+                         cl->agg->lmax, len, cl->common.classid);
-                err = qfq_change_agg(sch, cl, cl->agg->class_weight,
+                err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
-                                     qdisc_pkt_len(skb));
                if (err) {
                        cl->qstats.drops++;
                        return qdisc_drop(skb, sch, to_free);
                }
        }
+        gso_segs = skb_is_gso(skb) ? skb_shinfo(skb)->gso_segs : 1;
+        first = !cl->qdisc->q.qlen;
        err = qdisc_enqueue(skb, cl->qdisc, to_free);
        if (unlikely(err != NET_XMIT_SUCCESS)) {
                pr_debug("qfq_enqueue: enqueue failed %d\n", err);
@@ -1245,16 +1248,17 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                return err;
        }
-        bstats_update(&cl->bstats, skb);
+        cl->bstats.bytes += len;
-        qdisc_qstats_backlog_inc(sch, skb);
+        cl->bstats.packets += gso_segs;
+        sch->qstats.backlog += len;
        ++sch->q.qlen;
        agg = cl->agg;
        /* if the queue was not empty, then done here */
-        if (cl->qdisc->q.qlen != 1) {
+        if (!first) {
                if (unlikely(skb == cl->qdisc->ops->peek(cl->qdisc)) &&
                    list_first_entry(&agg->active, struct qfq_class, alist)
-                    == cl && cl->deficit < qdisc_pkt_len(skb))
+                    == cl && cl->deficit < len)
                        list_move_tail(&cl->alist, &agg->active);
                return err;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 942dcca09cf2..7f272a9070c5 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -185,6 +185,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                       struct sk_buff **to_free)
 {
        struct tbf_sched_data *q = qdisc_priv(sch);
+        unsigned int len = qdisc_pkt_len(skb);
        int ret;
        if (qdisc_pkt_len(skb) > q->max_size) {
@@ -200,7 +201,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                return ret;
        }
-        qdisc_qstats_backlog_inc(sch, skb);
+        sch->qstats.backlog += len;
        sch->q.qlen++;
        return NET_XMIT_SUCCESS;
 }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index b9ed271b7ef7..6200cd2b4b99 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
        switch (ev) {
        case NETDEV_UP:
-                addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
+                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                if (addr) {
                        addr->a.v6.sin6_family = AF_INET6;
-                        addr->a.v6.sin6_port = 0;
-                        addr->a.v6.sin6_flowinfo = 0;
                        addr->a.v6.sin6_addr = ifa->addr;
                        addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
                        addr->valid = 1;
@@ -282,7 +280,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        if (saddr) {
                fl6->saddr = saddr->v6.sin6_addr;
-                fl6->fl6_sport = saddr->v6.sin6_port;
+                if (!fl6->fl6_sport)
+                        fl6->fl6_sport = saddr->v6.sin6_port;
                pr_debug("src=%pI6 - ", &fl6->saddr);
        }
@@ -434,7 +433,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                if (addr) {
                        addr->a.v6.sin6_family = AF_INET6;
-                        addr->a.v6.sin6_port = 0;
                        addr->a.v6.sin6_addr = ifp->addr;
                        addr->a.v6.sin6_scope_id = dev->ifindex;
                        addr->valid = 1;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index d5878ae55840..6abc8b274270 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -101,7 +101,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                if (addr) {
                        addr->a.v4.sin_family = AF_INET;
-                        addr->a.v4.sin_port = 0;
                        addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
                        addr->valid = 1;
                        INIT_LIST_HEAD(&addr->list);
@@ -441,7 +440,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        }
        if (saddr) {
                fl4->saddr = saddr->v4.sin_addr.s_addr;
-                fl4->fl4_sport = saddr->v4.sin_port;
+                if (!fl4->fl4_sport)
+                        fl4->fl4_sport = saddr->v4.sin_port;
        }
        pr_debug("%s: dst:%pI4, src:%pI4 - ", __func__, &fl4->daddr,
@@ -776,10 +776,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
        switch (ev) {
        case NETDEV_UP:
-                addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
+                addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
                if (addr) {
                        addr->a.v4.sin_family = AF_INET;
-                        addr->a.v4.sin_port = 0;
                        addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
                        addr->valid = 1;
                        spin_lock_bh(&net->sctp.local_addr_lock);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f4ac6c592e13..d05c57664e36 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -495,7 +495,10 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         *
         * [INIT ACK back to where the INIT came from.]
         */
-        retval->transport = chunk->transport;
+        if (chunk->transport)
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
        retval->subh.init_hdr =
                sctp_addto_chunk(retval, sizeof(initack), &initack);
@@ -642,8 +645,10 @@ struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
         *
         * [COOKIE ACK back to where the COOKIE ECHO came from.]
         */
-        if (retval && chunk)
+        if (retval && chunk && chunk->transport)
-                retval->transport = chunk->transport;
+                retval->transport =
+                        sctp_assoc_lookup_paddr(asoc,
+                                                &chunk->transport->ipaddr);
        return retval;
 }
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 3892e7630f3a..80e0ae5534ec 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -585,9 +585,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
        struct sctp_strreset_outreq *outreq = param.v;
        struct sctp_stream *stream = &asoc->stream;
        __u32 result = SCTP_STRRESET_DENIED;
-        __u16 i, nums, flags = 0;
        __be16 *str_p = NULL;
        __u32 request_seq;
+        __u16 i, nums;
        request_seq = ntohl(outreq->request_seq);
@@ -615,6 +615,15 @@ struct sctp_chunk *sctp_process_strreset_outreq(
        if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_STREAM_REQ))
                goto out;
+        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        str_p = outreq->list_of_streams;
+        for (i = 0; i < nums; i++) {
+                if (ntohs(str_p[i]) >= stream->incnt) {
+                        result = SCTP_STRRESET_ERR_WRONG_SSN;
+                        goto out;
+                }
+        }
        if (asoc->strreset_chunk) {
                if (!sctp_chunk_lookup_strreset_param(
                                asoc, outreq->response_seq,
@@ -637,32 +646,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
                        sctp_chunk_put(asoc->strreset_chunk);
                        asoc->strreset_chunk = NULL;
                }
-                flags = SCTP_STREAM_RESET_INCOMING_SSN;
        }
-        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        if (nums)
-        if (nums) {
-                str_p = outreq->list_of_streams;
-                for (i = 0; i < nums; i++) {
-                        if (ntohs(str_p[i]) >= stream->incnt) {
-                                result = SCTP_STRRESET_ERR_WRONG_SSN;
-                                goto out;
-                        }
-                }
                for (i = 0; i < nums; i++)
                        SCTP_SI(stream, ntohs(str_p[i]))->mid = 0;
-        } else {
+        else
                for (i = 0; i < stream->incnt; i++)
                        SCTP_SI(stream, i)->mid = 0;
-        }
        result = SCTP_STRRESET_PERFORMED;
        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                flags | SCTP_STREAM_RESET_OUTGOING_SSN, nums, str_p,
+                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
-                GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
@@ -738,9 +734,6 @@ struct sctp_chunk *sctp_process_strreset_inreq(
        result = SCTP_STRRESET_PERFORMED;
-        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
 err:
@@ -873,6 +866,14 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
        if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
                goto out;
+        in = ntohs(addstrm->number_of_streams);
+        incnt = stream->incnt + in;
+        if (!in || incnt > SCTP_MAX_STREAM)
+                goto out;
+        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
+                goto out;
        if (asoc->strreset_chunk) {
                if (!sctp_chunk_lookup_strreset_param(
                        asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
@@ -896,14 +897,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
                }
        }
-        in = ntohs(addstrm->number_of_streams);
-        incnt = stream->incnt + in;
-        if (!in || incnt > SCTP_MAX_STREAM)
-                goto out;
-        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
-                goto out;
        stream->incnt = incnt;
        result = SCTP_STRRESET_PERFORMED;
@@ -973,9 +966,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
        result = SCTP_STRRESET_PERFORMED;
-        *evp = sctp_ulpevent_make_stream_change_event(asoc,
-                0, 0, ntohs(addstrm->number_of_streams), GFP_ATOMIC);
 out:
        sctp_update_strreset_result(asoc, result);
 err:
@@ -1036,10 +1026,10 @@ struct sctp_chunk *sctp_process_strreset_resp(
                                        sout->mid_uo = 0;
                                }
                        }
-                        flags = SCTP_STREAM_RESET_OUTGOING_SSN;
                }
+                flags |= SCTP_STREAM_RESET_OUTGOING_SSN;
                for (i = 0; i < stream->outcnt; i++)
                        SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
@@ -1058,6 +1048,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
                nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
                       sizeof(__u16);
+                flags |= SCTP_STREAM_RESET_INCOMING_SSN;
                *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
                        nums, str_p, GFP_ATOMIC);
        } else if (req->type == SCTP_PARAM_RESET_TSN_REQUEST) {
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index c4da4a78d369..c4e56602e0c6 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -146,6 +146,9 @@ static int smc_release(struct socket *sock)
                sock_set_flag(sk, SOCK_DEAD);
                sk->sk_shutdown |= SHUTDOWN_MASK;
        }
+        sk->sk_prot->unhash(sk);
        if (smc->clcsock) {
                if (smc->use_fallback && sk->sk_state == SMC_LISTEN) {
                        /* wake up clcsock accept */
@@ -170,7 +173,6 @@ static int smc_release(struct socket *sock)
                smc_conn_free(&smc->conn);
        release_sock(sk);
-        sk->sk_prot->unhash(sk);
        sock_put(sk); /* final sock_put */
 out:
        return rc;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 1ff9768f5456..f3023bbc0b7f 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -41,6 +41,9 @@ static unsigned long number_cred_unused;
 static struct cred machine_cred = {
        .usage = ATOMIC_INIT(1),
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        .magic = CRED_MAGIC,
+#endif
 };
 /*
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dc86713b32b6..1531b0219344 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1549,8 +1549,10 @@ gss_marshal(struct rpc_task *task, __be32 *p)
        cred_len = p++;
        spin_lock(&ctx->gc_seq_lock);
-        req->rq_seqno = ctx->gc_seq++;
+        req->rq_seqno = (ctx->gc_seq < MAXSEQ) ? ctx->gc_seq++ : MAXSEQ;
        spin_unlock(&ctx->gc_seq_lock);
+        if (req->rq_seqno == MAXSEQ)
+                goto out_expired;
        *p++ = htonl((u32) RPC_GSS_VERSION);
        *p++ = htonl((u32) ctx->gc_proc);
@@ -1572,14 +1574,18 @@ gss_marshal(struct rpc_task *task, __be32 *p)
        mic.data = (u8 *)(p + 1);
        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
        if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
-                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+                goto out_expired;
        } else if (maj_stat != 0) {
-                printk("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
+                pr_warn("gss_marshal: gss_get_mic FAILED (%d)\n", maj_stat);
+                task->tk_status = -EIO;
                goto out_put_ctx;
        }
        p = xdr_encode_opaque(p, NULL, mic.len);
        gss_put_ctx(ctx);
        return p;
+out_expired:
+        clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+        task->tk_status = -EKEYEXPIRED;
 out_put_ctx:
        gss_put_ctx(ctx);
        return NULL;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 71d9599b5816..d7ec6132c046 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1739,14 +1739,10 @@ rpc_xdr_encode(struct rpc_task *task)
        xdr_buf_init(&req->rq_rcv_buf,
                     req->rq_rbuffer,
                     req->rq_rcvsize);
-        req->rq_bytes_sent = 0;
        p = rpc_encode_header(task);
-        if (p == NULL) {
+        if (p == NULL)
-                printk(KERN_INFO "RPC: couldn't encode RPC header, exit EIO\n");
-                rpc_exit(task, -EIO);
                return;
-        }
        encode = task->tk_msg.rpc_proc->p_encode;
        if (encode == NULL)
@@ -1771,10 +1767,17 @@ call_encode(struct rpc_task *task)
        /* Did the encode result in an error condition? */
        if (task->tk_status != 0) {
                /* Was the error nonfatal? */
-                if (task->tk_status == -EAGAIN || task->tk_status == -ENOMEM)
+                switch (task->tk_status) {
+                case -EAGAIN:
+                case -ENOMEM:
                        rpc_delay(task, HZ >> 4);
-                else
+                        break;
+                case -EKEYEXPIRED:
+                        task->tk_action = call_refresh;
+                        break;
+                default:
                        rpc_exit(task, task->tk_status);
+                }
                return;
        }
@@ -2336,7 +2339,8 @@ rpc_encode_header(struct rpc_task *task)
        *p++ = htonl(clnt->cl_vers);    /* program version */
        *p++ = htonl(task->tk_msg.rpc_proc->p_proc);    /* procedure */
        p = rpcauth_marshcred(task, p);
-        req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
+        if (p)
+                req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
        return p;
 }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 73547d17d3c6..f1ec2110efeb 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1151,6 +1151,7 @@ xprt_request_enqueue_transmit(struct rpc_task *task)
        struct rpc_xprt *xprt = req->rq_xprt;
        if (xprt_request_need_enqueue_transmit(task, req)) {
+                req->rq_bytes_sent = 0;
                spin_lock(&xprt->queue_lock);
                /*
                 * Requests that carry congestion control credits are added
@@ -1177,7 +1178,7 @@ xprt_request_enqueue_transmit(struct rpc_task *task)
                                INIT_LIST_HEAD(&req->rq_xmit2);
                                goto out;
                        }
-                } else {
+                } else if (!req->rq_seqno) {
                        list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) {
                                if (pos->rq_task->tk_owner != task->tk_owner)
                                        continue;
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 7749a2bf6887..4994e75945b8 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -845,17 +845,13 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
        for (i = 0; i <= buf->rb_sc_last; i++) {
                sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
                if (!sc)
-                        goto out_destroy;
+                        return -ENOMEM;
                sc->sc_xprt = r_xprt;
                buf->rb_sc_ctxs[i] = sc;
        }
        return 0;
-out_destroy:
-        rpcrdma_sendctxs_destroy(buf);
-        return -ENOMEM;
 }
 /* The sendctx queue is not guaranteed to have a size that is a
@@ -1113,8 +1109,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
                                                WQ_MEM_RECLAIM | WQ_HIGHPRI,
                                                0,
                        r_xprt->rx_xprt.address_strings[RPC_DISPLAY_ADDR]);
-        if (!buf->rb_completion_wq)
+        if (!buf->rb_completion_wq) {
+                rc = -ENOMEM;
                goto out;
+        }
        return 0;
 out:
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 13559e6a460b..7754aa3e434f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -48,6 +48,7 @@
 #include <net/udp.h>
 #include <net/tcp.h>
 #include <linux/bvec.h>
+#include <linux/highmem.h>
 #include <linux/uio.h>
 #include <trace/events/sunrpc.h>
@@ -376,6 +377,26 @@ xs_read_discard(struct socket *sock, struct msghdr *msg, int flags,
        return sock_recvmsg(sock, msg, flags);
 }
+#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE
+static void
+xs_flush_bvec(const struct bio_vec *bvec, size_t count, size_t seek)
+{
+        struct bvec_iter bi = {
+                .bi_size = count,
+        };
+        struct bio_vec bv;
+        bvec_iter_advance(bvec, &bi, seek & PAGE_MASK);
+        for_each_bvec(bv, bvec, bi, bi)
+                flush_dcache_page(bv.bv_page);
+}
+#else
+static inline void
+xs_flush_bvec(const struct bio_vec *bvec, size_t count, size_t seek)
+{
+}
+#endif
 static ssize_t
 xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                struct xdr_buf *buf, size_t count, size_t seek, size_t *read)
@@ -409,6 +430,7 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags,
                                seek + buf->page_base);
                if (ret <= 0)
                        goto sock_err;
+                xs_flush_bvec(buf->bvec, ret, seek + buf->page_base);
                offset += ret - buf->page_base;
                if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC))
                        goto out;
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 40f5cae623a7..4ad3586da8f0 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -87,6 +87,11 @@ static int tipc_skb_tailroom(struct sk_buff *skb)
        return limit;
 }
+static inline int TLV_GET_DATA_LEN(struct tlv_desc *tlv)
+{
+        return TLV_GET_LEN(tlv) - TLV_SPACE(0);
+}
 static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len)
 {
        struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(skb);
@@ -166,6 +171,11 @@ static struct sk_buff *tipc_get_err_tlv(char *str)
        return buf;
 }
+static inline bool string_is_valid(char *s, int len)
+{
+        return memchr(s, '\0', len) ? true : false;
+}
 static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
                                   struct tipc_nl_compat_msg *msg,
                                   struct sk_buff *arg)
@@ -379,6 +389,7 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
        struct nlattr *prop;
        struct nlattr *bearer;
        struct tipc_bearer_config *b;
+        int len;
        b = (struct tipc_bearer_config *)TLV_DATA(msg->req);
@@ -386,6 +397,10 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
        if (!bearer)
                return -EMSGSIZE;
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        if (!string_is_valid(b->name, len))
+                return -EINVAL;
        if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, b->name))
                return -EMSGSIZE;
@@ -411,6 +426,7 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
 {
        char *name;
        struct nlattr *bearer;
+        int len;
        name = (char *)TLV_DATA(msg->req);
@@ -418,6 +434,10 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
        if (!bearer)
                return -EMSGSIZE;
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
        if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, name))
                return -EMSGSIZE;
@@ -478,6 +498,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
        struct nlattr *prop[TIPC_NLA_PROP_MAX + 1];
        struct nlattr *stats[TIPC_NLA_STATS_MAX + 1];
        int err;
+        int len;
        if (!attrs[TIPC_NLA_LINK])
                return -EINVAL;
@@ -504,6 +525,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
                return err;
        name = (char *)TLV_DATA(msg->req);
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
        if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0)
                return 0;
@@ -644,6 +670,7 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
        struct nlattr *prop;
        struct nlattr *media;
        struct tipc_link_config *lc;
+        int len;
        lc = (struct tipc_link_config *)TLV_DATA(msg->req);
@@ -651,6 +678,10 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
        if (!media)
                return -EMSGSIZE;
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
        if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name))
                return -EMSGSIZE;
@@ -671,6 +702,7 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
        struct nlattr *prop;
        struct nlattr *bearer;
        struct tipc_link_config *lc;
+        int len;
        lc = (struct tipc_link_config *)TLV_DATA(msg->req);
@@ -678,6 +710,10 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
        if (!bearer)
                return -EMSGSIZE;
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
        if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name))
                return -EMSGSIZE;
@@ -726,9 +762,14 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
        struct tipc_link_config *lc;
        struct tipc_bearer *bearer;
        struct tipc_media *media;
+        int len;
        lc = (struct tipc_link_config *)TLV_DATA(msg->req);
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
        media = tipc_media_find(lc->name);
        if (media) {
                cmd->doit = &__tipc_nl_media_set;
@@ -750,6 +791,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
 {
        char *name;
        struct nlattr *link;
+        int len;
        name = (char *)TLV_DATA(msg->req);
@@ -757,6 +799,10 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
        if (!link)
                return -EMSGSIZE;
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
        if (nla_put_string(skb, TIPC_NLA_LINK_NAME, name))
                return -EMSGSIZE;
@@ -778,6 +824,8 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg)
        };
        ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req);
+        if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query))
+                return -EINVAL;
        depth = ntohl(ntq->depth);
@@ -904,8 +952,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
        hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
                          TIPC_NL_PUBL_GET);
-        if (!hdr)
+        if (!hdr) {
+                kfree_skb(args);
                return -EMSGSIZE;
+        }
        nest = nla_nest_start(args, TIPC_NLA_SOCK);
        if (!nest) {
@@ -1206,7 +1256,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
        }
        len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-        if (len && !TLV_OK(msg.req, len)) {
+        if (!len || !TLV_OK(msg.req, len)) {
                msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
                err = -EOPNOTSUPP;
                goto send;
diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index efb16f69bd2c..a457c0fbbef1 100644
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -398,7 +398,7 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
        ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
        if (ret == -EWOULDBLOCK)
                return -EWOULDBLOCK;
-        if (ret > 0) {
+        if (ret == sizeof(s)) {
                read_lock_bh(&sk->sk_callback_lock);
                ret = tipc_conn_rcv_sub(srv, con, &s);
                read_unlock_bh(&sk->sk_callback_lock);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5e49492d5911..74150ad95823 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -555,7 +555,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        },
        [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
        [NL80211_ATTR_PEER_MEASUREMENTS] =
-                NLA_POLICY_NESTED(NL80211_PMSR_FTM_REQ_ATTR_MAX,
+                NLA_POLICY_NESTED(NL80211_PMSR_ATTR_MAX,
                                  nl80211_pmsr_attr_policy),
 };
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ecfb1a06dbb2..dd58b9909ac9 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1024,8 +1024,13 @@ static void regdb_fw_cb(const struct firmware *fw, void *context)
        }
        rtnl_lock();
-        if (WARN_ON(regdb && !IS_ERR(regdb))) {
+        if (regdb && !IS_ERR(regdb)) {
-                /* just restore and free new db */
+                /* negative case - a bug
+                 * positive case - can happen due to race in case of multiple cb's in
+                 * queue, due to usage of asynchronous callback
+                 *
+                 * Either case, just restore and free new db.
+                 */
        } else if (set_error) {
                regdb = ERR_PTR(set_error);
        } else if (fw) {
@@ -1255,7 +1260,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
 * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
 * however it is safe for now to assume that a frequency rule should not be
 * part of a frequency's band if the start freq or end freq are off by more
- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the
+ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
 * 60 GHz band.
 * This resolution can be lowered and should be considered as we add
 * regulatory rule support for other "bands".
@@ -1270,7 +1275,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
         * with the Channel starting frequency above 45 GHz.
         */
        u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
-                        10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
+                        20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
        if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
                return true;
        if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index a264cf2accd0..d4de871e7d4d 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -41,13 +41,20 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 * not know if the device has more tx queues than rx, or the opposite.
 * This might also change during run time.
 */
-static void xdp_reg_umem_at_qid(struct net_device *dev, struct xdp_umem *umem,
+static int xdp_reg_umem_at_qid(struct net_device *dev, struct xdp_umem *umem,
-                                u16 queue_id)
+                               u16 queue_id)
 {
+        if (queue_id >= max_t(unsigned int,
+                              dev->real_num_rx_queues,
+                              dev->real_num_tx_queues))
+                return -EINVAL;
        if (queue_id < dev->real_num_rx_queues)
                dev->_rx[queue_id].umem = umem;
        if (queue_id < dev->real_num_tx_queues)
                dev->_tx[queue_id].umem = umem;
+        return 0;
 }
 struct xdp_umem *xdp_get_umem_from_qid(struct net_device *dev,
@@ -88,7 +95,10 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
                goto out_rtnl_unlock;
        }
-        xdp_reg_umem_at_qid(dev, umem, queue_id);
+        err = xdp_reg_umem_at_qid(dev, umem, queue_id);
+        if (err)
+                goto out_rtnl_unlock;
        umem->dev = dev;
        umem->queue_id = queue_id;
        if (force_copy)
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 66ae15f27c70..db1a91dfa702 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -279,6 +279,7 @@ $(obj)/%.o: $(src)/%.c
                -Wno-gnu-variable-sized-type-not-at-end \
                -Wno-address-of-packed-member -Wno-tautological-compare \
                -Wno-unknown-warning-option $(CLANG_ARCH_ARGS) \
+                -I$(srctree)/samples/bpf/ -include asm_goto_workaround.h \
                -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf $(LLC_FLAGS) -filetype=obj -o $@
 ifeq ($(DWARF2BTF),y)
        $(BTF_PAHOLE) -J $@
diff --git a/samples/bpf/asm_goto_workaround.h b/samples/bpf/asm_goto_workaround.h
new file mode 100644
index 000000000000..5cd7c1d1a5d5
--- /dev/null
+++ b/samples/bpf/asm_goto_workaround.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (c) 2019 Facebook */
+#ifndef __ASM_GOTO_WORKAROUND_H
+#define __ASM_GOTO_WORKAROUND_H
+/* this will bring in asm_volatile_goto macro definition
+ * if enabled by compiler and config options.
+ */
+#include <linux/types.h>
+#ifdef asm_volatile_goto
+#undef asm_volatile_goto
+#define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto")
+#endif
+#endif
diff --git a/samples/bpf/test_cgrp2_attach2.c b/samples/bpf/test_cgrp2_attach2.c
index d7b68ef5ba79..0bb6507256b7 100644
--- a/samples/bpf/test_cgrp2_attach2.c
+++ b/samples/bpf/test_cgrp2_attach2.c
@@ -77,7 +77,7 @@ static int test_foo_bar(void)
        /* Create cgroup /foo, get fd, and join it */
        foo = create_and_get_cgroup(FOO);
-        if (!foo)
+        if (foo < 0)
                goto err;
        if (join_cgroup(FOO))
@@ -94,7 +94,7 @@ static int test_foo_bar(void)
        /* Create cgroup /foo/bar, get fd, and join it */
        bar = create_and_get_cgroup(BAR);
-        if (!bar)
+        if (bar < 0)
                goto err;
        if (join_cgroup(BAR))
@@ -298,19 +298,19 @@ static int test_multiprog(void)
                goto err;
        cg1 = create_and_get_cgroup("/cg1");
-        if (!cg1)
+        if (cg1 < 0)
                goto err;
        cg2 = create_and_get_cgroup("/cg1/cg2");
-        if (!cg2)
+        if (cg2 < 0)
                goto err;
        cg3 = create_and_get_cgroup("/cg1/cg2/cg3");
-        if (!cg3)
+        if (cg3 < 0)
                goto err;
        cg4 = create_and_get_cgroup("/cg1/cg2/cg3/cg4");
-        if (!cg4)
+        if (cg4 < 0)
                goto err;
        cg5 = create_and_get_cgroup("/cg1/cg2/cg3/cg4/cg5");
-        if (!cg5)
+        if (cg5 < 0)
                goto err;
        if (join_cgroup("/cg1/cg2/cg3/cg4/cg5"))
diff --git a/samples/bpf/test_current_task_under_cgroup_user.c b/samples/bpf/test_current_task_under_cgroup_user.c
index 2259f997a26c..f082d6ac59f0 100644
--- a/samples/bpf/test_current_task_under_cgroup_user.c
+++ b/samples/bpf/test_current_task_under_cgroup_user.c
@@ -32,7 +32,7 @@ int main(int argc, char **argv)
        cg2 = create_and_get_cgroup(CGROUP_PATH);
-        if (!cg2)
+        if (cg2 < 0)
                goto err;
        if (bpf_map_update_elem(map_fd[0], &idx, &cg2, BPF_ANY)) {
diff --git a/samples/bpf/xdp1_user.c b/samples/bpf/xdp1_user.c
index 0a197f86ac43..8bfda95c77ad 100644
--- a/samples/bpf/xdp1_user.c
+++ b/samples/bpf/xdp1_user.c
@@ -103,7 +103,7 @@ int main(int argc, char **argv)
                return 1;
        }
-        ifindex = if_nametoindex(argv[1]);
+        ifindex = if_nametoindex(argv[optind]);
        if (!ifindex) {
                perror("if_nametoindex");
                return 1;
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 525bff667a52..30816037036e 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -24,10 +24,6 @@ depfile = $(subst $(comma),_,$(dot-target).d)
 basetarget = $(basename $(notdir $@))
 ###
-# filename of first prerequisite with directory and extension stripped
-baseprereq = $(basename $(notdir $<))
-###
 # Escape single quote for use in echo statements
 escsq = $(subst $(squote),'\$(squote)',$1)
diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
index de70b8470971..89c47f57d1ce 100644
--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
@@ -13,7 +13,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
        for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
                const char *sym;
                rtx body;
-                rtx masked_sp;
+                rtx mask, masked_sp;
                /*
                 * Find a SET insn involving a SYMBOL_REF to __stack_chk_guard
@@ -33,12 +33,13 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
                 * produces the address of the copy of the stack canary value
                 * stored in struct thread_info
                 */
+                mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
                masked_sp = gen_reg_rtx(Pmode);
                emit_insn_before(gen_rtx_SET(masked_sp,
                                             gen_rtx_AND(Pmode,
                                                         stack_pointer_rtx,
-                                                         GEN_INT(sp_mask))),
+                                                         mask)),
                                 insn);
                SET_SRC(body) = gen_rtx_PLUS(Pmode, masked_sp,
@@ -52,6 +53,19 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
 #define NO_GATE
 #include "gcc-generate-rtl-pass.h"
+#if BUILDING_GCC_VERSION >= 9000
+static bool no(void)
+{
+        return false;
+}
+static void arm_pertask_ssp_start_unit(void *gcc_data, void *user_data)
+{
+        targetm.have_stack_protect_combined_set = no;
+        targetm.have_stack_protect_combined_test = no;
+}
+#endif
 __visible int plugin_init(struct plugin_name_args *plugin_info,
                          struct plugin_gcc_version *version)
 {
@@ -99,5 +113,10 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
        register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP,
                          NULL, &arm_pertask_ssp_rtl_pass_info);
+#if BUILDING_GCC_VERSION >= 9000
+        register_callback(plugin_info->base_name, PLUGIN_START_UNIT,
+                          arm_pertask_ssp_start_unit, NULL);
+#endif
        return 0;
 }
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index c05ab001b54c..181973509a05 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -206,4 +206,4 @@ filechk_conf_cfg = $(CONFIG_SHELL) $<
 $(obj)/%conf-cfg: $(src)/%conf-cfg.sh FORCE
        $(call filechk,conf_cfg)
-clean-files += conf-cfg
+clean-files += *conf-cfg
diff --git a/security/security.c b/security/security.c
index f1b8d2587639..55bc49027ba9 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1027,6 +1027,13 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 void security_cred_free(struct cred *cred)
 {
+        /*
+         * There is a failure case in prepare_creds() that
+         * may result in a call here with ->security being NULL.
+         */
+        if (unlikely(cred->security == NULL))
+                return;
        call_void_hook(cred_free, cred);
 }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index a50d625e7946..c1c31e33657a 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -732,7 +732,8 @@ static int sens_destroy(void *key, void *datum, void *p)
        kfree(key);
        if (datum) {
                levdatum = datum;
-                ebitmap_destroy(&levdatum->level->cat);
+                if (levdatum->level)
+                        ebitmap_destroy(&levdatum->level->cat);
                kfree(levdatum->level);
        }
        kfree(datum);
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index ffda91a4a1aa..02514fe558b4 100644
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,
                        break;
                case YAMA_SCOPE_RELATIONAL:
                        rcu_read_lock();
-                        if (!task_is_descendant(current, child) &&
+                        if (!pid_alive(child))
+                                rc = -EPERM;
+                        if (!rc && !task_is_descendant(current, child) &&
                            !ptracer_exception_found(current, child) &&
                            !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
                                rc = -EPERM;
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index a5b09e75e787..f7d2b373da0a 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -541,7 +541,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
 {
        /* first let's check the buffer parameter's */
        if (params->buffer.fragment_size == 0 ||
-            params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
+            params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
+            params->buffer.fragments == 0)
                return -EINVAL;
        /* now codec parameters */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 51cc6589443f..152f54137082 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -931,6 +931,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+        SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
        SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0b3e7a18ca78..b4f472157ebd 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6926,7 +6926,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
        {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
        {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
-        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc255-dell1"},
+        {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
        {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
        {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
        {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
index 022a8912c8a2..3d58338fa3cf 100644
--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
+++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
@@ -611,14 +611,16 @@ static int acp3x_audio_probe(struct platform_device *pdev)
        }
        irqflags = *((unsigned int *)(pdev->dev.platform_data));
-        adata = devm_kzalloc(&pdev->dev, sizeof(struct i2s_dev_data),
-                             GFP_KERNEL);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                dev_err(&pdev->dev, "IORESOURCE_IRQ FAILED\n");
                        return -ENODEV;
        }
+        adata = devm_kzalloc(&pdev->dev, sizeof(*adata), GFP_KERNEL);
+        if (!adata)
+                return -ENOMEM;
        adata->acp3x_base = devm_ioremap(&pdev->dev, res->start,
                                         resource_size(res));
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 3ab2949c1dfa..b19d7a3e7a2c 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -1890,51 +1890,31 @@ static void hdmi_codec_remove(struct snd_soc_component *component)
        pm_runtime_disable(&hdev->dev);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int hdmi_codec_prepare(struct device *dev)
+static int hdmi_codec_resume(struct device *dev)
-{
-        struct hdac_device *hdev = dev_to_hdac_dev(dev);
-        pm_runtime_get_sync(&hdev->dev);
-        /*
-         * Power down afg.
-         * codec_read is preferred over codec_write to set the power state.
-         * This way verb is send to set the power state and response
-         * is received. So setting power state is ensured without using loop
-         * to read the state.
-         */
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
-                                                        AC_PWRST_D3);
-        return 0;
-}
-static void hdmi_codec_complete(struct device *dev)
 {
        struct hdac_device *hdev = dev_to_hdac_dev(dev);
        struct hdac_hdmi_priv *hdmi = hdev_to_hdmi_priv(hdev);
+        int ret;
-        /* Power up afg */
+        ret = pm_runtime_force_resume(dev);
-        snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
+        if (ret < 0)
-                                                        AC_PWRST_D0);
+                return ret;
-        hdac_hdmi_skl_enable_all_pins(hdev);
-        hdac_hdmi_skl_enable_dp12(hdev);
        /*
         * As the ELD notify callback request is not entertained while the
         * device is in suspend state. Need to manually check detection of
         * all pins here. pin capablity change is not support, so use the
         * already set pin caps.
+         *
+         * NOTE: this is safe to call even if the codec doesn't actually resume.
+         * The pin check involves only with DRM audio component hooks, so it
+         * works even if the HD-audio side is still dreaming peacefully.
         */
        hdac_hdmi_present_sense_all_pins(hdev, hdmi, false);
+        return 0;
-        pm_runtime_put_sync(&hdev->dev);
 }
 #else
-#define hdmi_codec_prepare NULL
+#define hdmi_codec_resume NULL
-#define hdmi_codec_complete NULL
 #endif
 static const struct snd_soc_component_driver hdmi_hda_codec = {
@@ -2135,75 +2115,6 @@ static int hdac_hdmi_dev_remove(struct hdac_device *hdev)
 }
 #ifdef CONFIG_PM
-/*
- * Power management sequences
- * ==========================
- *
- * The following explains the PM handling of HDAC HDMI with its parent
- * device SKL and display power usage
- *
- * Probe
- * -----
- * In SKL probe,
- * 1. skl_probe_work() powers up the display (refcount++ -> 1)
- * 2. enumerates the codecs on the link
- * 3. powers down the display  (refcount-- -> 0)
- *
- * In HDAC HDMI probe,
- * 1. hdac_hdmi_dev_probe() powers up the display (refcount++ -> 1)
- * 2. probe the codec
- * 3. put the HDAC HDMI device to runtime suspend
- * 4. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- *
- * Once children are runtime suspended, SKL device also goes to runtime
- * suspend
- *
- * HDMI Playback
- * -------------
- * Open HDMI device,
- * 1. skl_runtime_resume() invoked
- * 2. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- *
- * Close HDMI device,
- * 1. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 2. skl_runtime_suspend() invoked
- *
- * S0/S3 Cycle with playback in progress
- * -------------------------------------
- * When the device is opened for playback, the device is runtime active
- * already and the display refcount is 1 as explained above.
- *
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec which just
- *    increments the PM runtime usage count of the codec since the device
- *    is in use already
- * 2. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec which just
- *    decrements the PM runtime usage count of the codec since the device
- *    is in use already
- *
- * Once playback is stopped, the display refcount is set to 0 as explained
- * above in the HDMI playback sequence. The PM handlings are designed in
- * such way that to balance the refcount of display power when the codec
- * device put to S3 while playback is going on.
- *
- * S0/S3 Cycle without playback in progress
- * ----------------------------------------
- * Entering to S3,
- * 1. hdmi_codec_prepare() invoke the runtime resume of codec
- * 2. skl_runtime_resume() invoked
- * 3. hdac_hdmi_runtime_resume() powers up the display (refcount++ -> 1)
- * 4. skl_suspend() powers down the display (refcount-- -> 0)
- *
- * Wakeup from S3,
- * 1. skl_resume() powers up the display (refcount++ -> 1)
- * 2. hdmi_codec_complete() invokes the runtime suspend of codec
- * 3. hdac_hdmi_runtime_suspend() powers down the display (refcount-- -> 0)
- * 4. skl_runtime_suspend() invoked
- */
 static int hdac_hdmi_runtime_suspend(struct device *dev)
 {
        struct hdac_device *hdev = dev_to_hdac_dev(dev);
@@ -2277,8 +2188,7 @@ static int hdac_hdmi_runtime_resume(struct device *dev)
 static const struct dev_pm_ops hdac_hdmi_pm = {
        SET_RUNTIME_PM_OPS(hdac_hdmi_runtime_suspend, hdac_hdmi_runtime_resume, NULL)
-        .prepare = hdmi_codec_prepare,
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, hdmi_codec_resume)
-        .complete = hdmi_codec_complete,
 };
 static const struct hda_device_id hdmi_list[] = {
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 6cb1653be804..4cc24a5d5c31 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1400,24 +1400,20 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                if (ret != 0) {
                        dev_err(component->dev,
                                "Failed to set digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
+                        goto unlock;
-                        return ret;
                }
                regmap_read_poll_timeout(pcm512x->regmap,
                                         PCM512x_ANALOG_MUTE_DET,
                                         mute_det, (mute_det & 0x3) == 0,
                                         200, 10000);
-                mutex_unlock(&pcm512x->mutex);
        } else {
                pcm512x->mute &= ~0x1;
                ret = pcm512x_update_mute(pcm512x);
                if (ret != 0) {
                        dev_err(component->dev,
                                "Failed to update digital mute: %d\n", ret);
-                        mutex_unlock(&pcm512x->mutex);
+                        goto unlock;
-                        return ret;
                }
                regmap_read_poll_timeout(pcm512x->regmap,
@@ -1428,9 +1424,10 @@ static int pcm512x_digital_mute(struct snd_soc_dai *dai, int mute)
                                         200, 10000);
        }
+unlock:
        mutex_unlock(&pcm512x->mutex);
-        return 0;
+        return ret;
 }
 static const struct snd_soc_dai_ops pcm512x_dai_ops = {
diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
index 0ef966d56bac..e2855ab9a2c6 100644
--- a/sound/soc/codecs/rt274.c
+++ b/sound/soc/codecs/rt274.c
@@ -1128,8 +1128,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c,
                return ret;
        }
-        regmap_read(rt274->regmap,
+        ret = regmap_read(rt274->regmap,
                RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
+        if (ret)
+                return ret;
        if (val != RT274_VENDOR_ID) {
                dev_err(&i2c->dev,
                        "Device with ID register %#x is not rt274\n", val);
diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
index 4d46f4567c3a..bec2eefa8b0f 100644
--- a/sound/soc/codecs/rt5514-spi.c
+++ b/sound/soc/codecs/rt5514-spi.c
@@ -280,6 +280,8 @@ static int rt5514_spi_pcm_probe(struct snd_soc_component *component)
        rt5514_dsp = devm_kzalloc(component->dev, sizeof(*rt5514_dsp),
                        GFP_KERNEL);
+        if (!rt5514_dsp)
+                return -ENOMEM;
        rt5514_dsp->dev = &rt5514_spi->dev;
        mutex_init(&rt5514_dsp->dma_lock);
diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
index 34cfaf8f6f34..89c43b26c379 100644
--- a/sound/soc/codecs/rt5682.c
+++ b/sound/soc/codecs/rt5682.c
@@ -2512,6 +2512,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682)
        regmap_write(rt5682->regmap, RT5682_PWR_DIG_1, 0x0000);
        regmap_write(rt5682->regmap, RT5682_CHOP_DAC, 0x2000);
        regmap_write(rt5682->regmap, RT5682_CALIB_ADC_CTRL, 0x2005);
+        regmap_write(rt5682->regmap, RT5682_STO1_ADC_MIXER, 0xc0c4);
        mutex_unlock(&rt5682->calibrate_mutex);
diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h
index d82a8301fd74..96944cff0ed7 100644
--- a/sound/soc/codecs/rt5682.h
+++ b/sound/soc/codecs/rt5682.h
@@ -849,18 +849,18 @@
 #define RT5682_SCLK_SRC_PLL2                    (0x2 << 13)
 #define RT5682_SCLK_SRC_SDW                     (0x3 << 13)
 #define RT5682_SCLK_SRC_RCCLK                   (0x4 << 13)
-#define RT5682_PLL1_SRC_MASK                    (0x3 << 10)
+#define RT5682_PLL2_SRC_MASK                    (0x3 << 10)
-#define RT5682_PLL1_SRC_SFT                     10
+#define RT5682_PLL2_SRC_SFT                     10
-#define RT5682_PLL1_SRC_MCLK                    (0x0 << 10)
+#define RT5682_PLL2_SRC_MCLK                    (0x0 << 10)
-#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 10)
+#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 10)
-#define RT5682_PLL1_SRC_SDW                     (0x2 << 10)
+#define RT5682_PLL2_SRC_SDW                     (0x2 << 10)
-#define RT5682_PLL1_SRC_RC                      (0x3 << 10)
+#define RT5682_PLL2_SRC_RC                      (0x3 << 10)
-#define RT5682_PLL2_SRC_MASK                    (0x3 << 8)
+#define RT5682_PLL1_SRC_MASK                    (0x3 << 8)
-#define RT5682_PLL2_SRC_SFT                     8
+#define RT5682_PLL1_SRC_SFT                     8
-#define RT5682_PLL2_SRC_MCLK                    (0x0 << 8)
+#define RT5682_PLL1_SRC_MCLK                    (0x0 << 8)
-#define RT5682_PLL2_SRC_BCLK1                   (0x1 << 8)
+#define RT5682_PLL1_SRC_BCLK1                   (0x1 << 8)
-#define RT5682_PLL2_SRC_SDW                     (0x2 << 8)
+#define RT5682_PLL1_SRC_SDW                     (0x2 << 8)
-#define RT5682_PLL2_SRC_RC                      (0x3 << 8)
+#define RT5682_PLL1_SRC_RC                      (0x3 << 8)
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index e2b5a11b16d1..f03195d2ab2e 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -822,6 +822,10 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
        case SND_SOC_BIAS_PREPARE:
                break;
        case SND_SOC_BIAS_STANDBY:
+                /* Initial cold start */
+                if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
+                        break;
                /* Switch off BCLK_N Divider */
                snd_soc_component_update_bits(component, AIC32X4_BCLKN,
                                    AIC32X4_BCLKEN, 0);
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index 392d5eef356d..99e07b01a2ce 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
-        ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+        ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
                       pdcr, ptcr);
        if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxFS output from %s, ",
                                audmux_port_string((ptcr >> 27) & 0x7));
        else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxFS input, ");
        if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxClk output from %s",
                                audmux_port_string((ptcr >> 22) & 0x7));
        else
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "TxClk input");
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
        if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) {
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                "Port is symmetric");
        } else {
                if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxFS output from %s, ",
                                        audmux_port_string((ptcr >> 17) & 0x7));
                else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxFS input, ");
                if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR)
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxClk output from %s",
                                        audmux_port_string((ptcr >> 12) & 0x7));
                else
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        "RxClk input");
        }
-        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                        "\nData received from %s\n",
                        audmux_port_string((pdcr >> 13) & 0x7));
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 99a62ba409df..bd9fd2035c55 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -91,7 +91,7 @@ config SND_SST_ATOM_HIFI2_PLATFORM_PCI
 config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
        tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms"
        default ACPI
-        depends on X86 && ACPI
+        depends on X86 && ACPI && PCI
        select SND_SST_IPC_ACPI
        select SND_SST_ATOM_HIFI2_PLATFORM
        select SND_SOC_ACPI_INTEL_MATCH
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index afc559866095..91a2436ce952 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -399,7 +399,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream,
                                struct snd_pcm_hw_params *params,
                                struct snd_soc_dai *dai)
 {
-        snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
+        int ret;
+        ret =
+                snd_pcm_lib_malloc_pages(substream,
+                                params_buffer_bytes(params));
+        if (ret)
+                return ret;
        memset(substream->runtime->dma_area, 0, params_buffer_bytes(params));
        return 0;
 }
diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
index 68e6543e6cb0..99f2a0156ae8 100644
--- a/sound/soc/intel/boards/broadwell.c
+++ b/sound/soc/intel/boards/broadwell.c
@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = {
                .stream_name = "Loopback",
                .cpu_dai_name = "Loopback Pin",
                .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                .codec_name = "snd-soc-dummy",
                .codec_dai_name = "snd-soc-dummy-dai",
                .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c
index c74c4f17316f..8f83b182c4f9 100644
--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c
+++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c
@@ -55,39 +55,6 @@ enum {
        GLK_DPCM_AUDIO_HDMI3_PB,
 };
-static int platform_clock_control(struct snd_soc_dapm_widget *w,
-                                        struct snd_kcontrol *k, int  event)
-{
-        struct snd_soc_dapm_context *dapm = w->dapm;
-        struct snd_soc_card *card = dapm->card;
-        struct snd_soc_dai *codec_dai;
-        int ret = 0;
-        codec_dai = snd_soc_card_get_codec_dai(card, GLK_REALTEK_CODEC_DAI);
-        if (!codec_dai) {
-                dev_err(card->dev, "Codec dai not found; Unable to set/unset codec pll\n");
-                return -EIO;
-        }
-        if (SND_SOC_DAPM_EVENT_OFF(event)) {
-                ret = snd_soc_dai_set_sysclk(codec_dai, 0, 0, 0);
-                if (ret)
-                        dev_err(card->dev, "failed to stop sysclk: %d\n", ret);
-        } else if (SND_SOC_DAPM_EVENT_ON(event)) {
-                ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
-                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
-                if (ret < 0) {
-                        dev_err(card->dev, "can't set codec pll: %d\n", ret);
-                        return ret;
-                }
-        }
-        if (ret)
-                dev_err(card->dev, "failed to start internal clk: %d\n", ret);
-        return ret;
-}
 static const struct snd_kcontrol_new geminilake_controls[] = {
        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
        SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -102,14 +69,10 @@ static const struct snd_soc_dapm_widget geminilake_widgets[] = {
        SND_SOC_DAPM_SPK("HDMI1", NULL),
        SND_SOC_DAPM_SPK("HDMI2", NULL),
        SND_SOC_DAPM_SPK("HDMI3", NULL),
-        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
-                        platform_clock_control, SND_SOC_DAPM_PRE_PMU |
-                        SND_SOC_DAPM_POST_PMD),
 };
 static const struct snd_soc_dapm_route geminilake_map[] = {
        /* HP jack connectors - unknown if we have jack detection */
-        { "Headphone Jack", NULL, "Platform Clock" },
        { "Headphone Jack", NULL, "HPOL" },
        { "Headphone Jack", NULL, "HPOR" },
@@ -117,7 +80,6 @@ static const struct snd_soc_dapm_route geminilake_map[] = {
        { "Spk", NULL, "Speaker" },
        /* other jacks */
-        { "Headset Mic", NULL, "Platform Clock" },
        { "IN1P", NULL, "Headset Mic" },
        /* digital mics */
@@ -177,6 +139,13 @@ static int geminilake_rt5682_codec_init(struct snd_soc_pcm_runtime *rtd)
        struct snd_soc_jack *jack;
        int ret;
+        ret = snd_soc_dai_set_pll(codec_dai, 0, RT5682_PLL1_S_MCLK,
+                                        GLK_PLAT_CLK_FREQ, RT5682_PLL_FREQ);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set codec pll: %d\n", ret);
+                return ret;
+        }
        /* Configure sysclk for codec */
        ret = snd_soc_dai_set_sysclk(codec_dai, RT5682_SCLK_S_PLL1,
                                        RT5682_PLL_FREQ, SND_SOC_CLOCK_IN);
diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
index eab1f439dd3f..a4022983a7ce 100644
--- a/sound/soc/intel/boards/haswell.c
+++ b/sound/soc/intel/boards/haswell.c
@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = {
                .stream_name = "Loopback",
                .cpu_dai_name = "Loopback Pin",
                .platform_name = "haswell-pcm-audio",
-                .dynamic = 0,
+                .dynamic = 1,
                .codec_name = "snd-soc-dummy",
                .codec_dai_name = "snd-soc-dummy-dai",
                .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 60c94836bf5b..4ed5b7e17d44 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -336,9 +336,6 @@ static int skl_suspend(struct device *dev)
                skl->skl_sst->fw_loaded = false;
        }
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
        return 0;
 }
@@ -350,10 +347,6 @@ static int skl_resume(struct device *dev)
        struct hdac_ext_link *hlink = NULL;
        int ret;
-        /* Turned OFF in HDMI codec driver after codec reconfiguration */
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, true);
        /*
         * resume only when we are not in suspend active, otherwise need to
         * restore the device
@@ -446,8 +439,10 @@ static int skl_free(struct hdac_bus *bus)
        snd_hdac_ext_bus_exit(bus);
        cancel_work_sync(&skl->probe_work);
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                snd_hdac_display_power(bus, HDA_CODEC_IDX_CONTROLLER, false);
                snd_hdac_i915_exit(bus);
+        }
        return 0;
 }
@@ -814,7 +809,7 @@ static void skl_probe_work(struct work_struct *work)
        err = skl_platform_register(bus->dev);
        if (err < 0) {
                dev_err(bus->dev, "platform register failed: %d\n", err);
-                return;
+                goto out_err;
        }
        err = skl_machine_device_register(skl);
diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
index 5b986b74dd36..548eb4fa2da6 100644
--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
+++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
@@ -570,10 +570,10 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
        prtd->audio_client = q6asm_audio_client_alloc(dev,
                                        (q6asm_cb)compress_event_handler,
                                        prtd, stream_id, LEGACY_PCM_MODE);
-        if (!prtd->audio_client) {
+        if (IS_ERR(prtd->audio_client)) {
                dev_err(dev, "Could not allocate memory\n");
-                kfree(prtd);
+                ret = PTR_ERR(prtd->audio_client);
-                return -ENOMEM;
+                goto free_prtd;
        }
        size = COMPR_PLAYBACK_MAX_FRAGMENT_SIZE *
@@ -582,7 +582,7 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
                                  &prtd->dma_buffer);
        if (ret) {
                dev_err(dev, "Cannot allocate buffer(s)\n");
-                return ret;
+                goto free_client;
        }
        if (pdata->sid < 0)
@@ -595,6 +595,13 @@ static int q6asm_dai_compr_open(struct snd_compr_stream *stream)
        runtime->private_data = prtd;
        return 0;
+free_client:
+        q6asm_audio_client_free(prtd->audio_client);
+free_prtd:
+        kfree(prtd);
+        return ret;
 }
 static int q6asm_dai_compr_free(struct snd_compr_stream *stream)
@@ -874,7 +881,7 @@ static int of_q6asm_parse_dai_data(struct device *dev,
        for_each_child_of_node(dev->of_node, node) {
                ret = of_property_read_u32(node, "reg", &id);
-                if (ret || id > MAX_SESSIONS || id < 0) {
+                if (ret || id >= MAX_SESSIONS || id < 0) {
                        dev_err(dev, "valid dai id not found:%d\n", ret);
                        continue;
                }
diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
index 1db8ef668223..6f66a58e23ca 100644
--- a/sound/soc/qcom/sdm845.c
+++ b/sound/soc/qcom/sdm845.c
@@ -158,17 +158,24 @@ static int sdm845_snd_hw_params(struct snd_pcm_substream *substream,
        return ret;
 }
+static void sdm845_jack_free(struct snd_jack *jack)
+{
+        struct snd_soc_component *component = jack->private_data;
+        snd_soc_component_set_jack(component, NULL, NULL);
+}
 static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
        struct snd_soc_component *component;
-        struct snd_soc_dai_link *dai_link = rtd->dai_link;
        struct snd_soc_card *card = rtd->card;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
        struct sdm845_snd_data *pdata = snd_soc_card_get_drvdata(card);
-        int i, rval;
+        struct snd_jack *jack;
+        int rval;
        if (!pdata->jack_setup) {
-                struct snd_jack *jack;
                rval = snd_soc_card_jack_new(card, "Headset Jack",
                                SND_JACK_HEADSET |
                                SND_JACK_HEADPHONE |
@@ -190,16 +197,22 @@ static int sdm845_dai_init(struct snd_soc_pcm_runtime *rtd)
                pdata->jack_setup = true;
        }
-        for (i = 0 ; i < dai_link->num_codecs; i++) {
+        switch (cpu_dai->id) {
-                struct snd_soc_dai *dai = rtd->codec_dais[i];
+        case PRIMARY_MI2S_RX:
+                jack  = pdata->jack.jack;
+                component = codec_dai->component;
-                component = dai->component;
+                jack->private_data = component;
-                rval = snd_soc_component_set_jack(
+                jack->private_free = sdm845_jack_free;
-                                component, &pdata->jack, NULL);
+                rval = snd_soc_component_set_jack(component,
+                                                  &pdata->jack, NULL);
                if (rval != 0 && rval != -ENOTSUPP) {
                        dev_warn(card->dev, "Failed to set jack: %d\n", rval);
                        return rval;
                }
+                break;
+        default:
+                break;
        }
        return 0;
diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
index 922fb6aa3ed1..5aee11c94f2a 100644
--- a/sound/soc/sh/dma-sh7760.c
+++ b/sound/soc/sh/dma-sh7760.c
@@ -202,7 +202,7 @@ static int camelot_prepare(struct snd_pcm_substream *substream)
        struct snd_soc_pcm_runtime *rtd = substream->private_data;
        struct camelot_pcm *cam = &cam_pcm_data[rtd->cpu_dai->id];
-        pr_debug("PCM data: addr 0x%08ulx len %d\n",
+        pr_debug("PCM data: addr 0x%08lx len %d\n",
                 (u32)runtime->dma_addr, runtime->dma_bytes);
 
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 0462b3ec977a..aae450ba4f08 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -742,7 +742,7 @@ static struct snd_soc_component *soc_find_component(
                if (of_node) {
                        if (component->dev->of_node == of_node)
                                return component;
-                } else if (strcmp(component->name, name) == 0) {
+                } else if (name && strcmp(component->name, name) == 0) {
                        return component;
                }
        }
@@ -1034,17 +1034,18 @@ static int snd_soc_init_platform(struct snd_soc_card *card,
         * this function should be removed in the future
         */
        /* convert Legacy platform link */
-        if (!platform) {
+        if (!platform || dai_link->legacy_platform) {
                platform = devm_kzalloc(card->dev,
                                sizeof(struct snd_soc_dai_link_component),
                                GFP_KERNEL);
                if (!platform)
                        return -ENOMEM;
-                dai_link->platform      = platform;
+                dai_link->platform        = platform;
-                platform->name          = dai_link->platform_name;
+                dai_link->legacy_platform = 1;
-                platform->of_node       = dai_link->platform_of_node;
+                platform->name            = dai_link->platform_name;
-                platform->dai_name      = NULL;
+                platform->of_node         = dai_link->platform_of_node;
+                platform->dai_name        = NULL;
        }
        /* if there's no platform we match on the empty platform */
@@ -1129,6 +1130,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                        link->name);
                return -EINVAL;
        }
+        /*
+         * Defer card registartion if platform dai component is not added to
+         * component list.
+         */
+        if ((link->platform->of_node || link->platform->name) &&
+            !soc_find_component(link->platform->of_node, link->platform->name))
+                return -EPROBE_DEFER;
        /*
         * CPU device may be specified by either name or OF node, but
         * can be left unspecified, and will be matched based on DAI
@@ -1140,6 +1150,15 @@ static int soc_init_dai_link(struct snd_soc_card *card,
                        link->name);
                return -EINVAL;
        }
+        /*
+         * Defer card registartion if cpu dai component is not added to
+         * component list.
+         */
+        if ((link->cpu_of_node || link->cpu_name) &&
+            !soc_find_component(link->cpu_of_node, link->cpu_name))
+                return -EPROBE_DEFER;
        /*
         * At least one of CPU DAI name or CPU device name/node must be
         * specified
@@ -2739,15 +2758,18 @@ int snd_soc_register_card(struct snd_soc_card *card)
        if (!card->name || !card->dev)
                return -EINVAL;
+        mutex_lock(&client_mutex);
        for_each_card_prelinks(card, i, link) {
                ret = soc_init_dai_link(card, link);
                if (ret) {
                        dev_err(card->dev, "ASoC: failed to init link %s\n",
                                link->name);
+                        mutex_unlock(&client_mutex);
                        return ret;
                }
        }
+        mutex_unlock(&client_mutex);
        dev_set_drvdata(card->dev, card);
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index a5178845065b..2c4c13419539 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2019,19 +2019,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                out = is_connected_output_ep(w, NULL, NULL);
        }
-        ret = snprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
+        ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s  in %d out %d",
                       w->name, w->power ? "On" : "Off",
                       w->force ? " (forced)" : "", in, out);
        if (w->reg >= 0)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                " - R%d(0x%x) mask 0x%x",
                                w->reg, w->reg, w->mask << w->shift);
-        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
        if (w->sname)
-                ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
+                ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
                                w->sname,
                                w->active ? "active" : "inactive");
@@ -2044,7 +2044,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
                        if (!p->connect)
                                continue;
-                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        ret += scnprintf(buf + ret, PAGE_SIZE - ret,
                                        " %s  \"%s\" \"%s\"\n",
                                        (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out",
                                        p->name ? p->name : "static",
diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
index eeda6d5565bc..a10fcb5963c6 100644
--- a/sound/soc/ti/davinci-mcasp.c
+++ b/sound/soc/ti/davinci-mcasp.c
@@ -108,7 +108,7 @@ struct davinci_mcasp {
        /* Used for comstraint setting on the second stream */
        u32     channels;
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        struct davinci_mcasp_context context;
 #endif
@@ -1486,74 +1486,6 @@ static int davinci_mcasp_dai_probe(struct snd_soc_dai *dai)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
-static int davinci_mcasp_suspend(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-        context->pm_state = pm_runtime_active(mcasp->dev);
-        if (!context->pm_state)
-                pm_runtime_get_sync(mcasp->dev);
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
-        }
-        for (i = 0; i < mcasp->num_serializer; i++)
-                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
-                                                DAVINCI_MCASP_XRSRCTL_REG(i));
-        pm_runtime_put_sync(mcasp->dev);
-        return 0;
-}
-static int davinci_mcasp_resume(struct snd_soc_dai *dai)
-{
-        struct davinci_mcasp *mcasp = snd_soc_dai_get_drvdata(dai);
-        struct davinci_mcasp_context *context = &mcasp->context;
-        u32 reg;
-        int i;
-        pm_runtime_get_sync(mcasp->dev);
-        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
-                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
-        if (mcasp->txnumevt) {
-                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
-        }
-        if (mcasp->rxnumevt) {
-                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
-                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
-        }
-        for (i = 0; i < mcasp->num_serializer; i++)
-                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
-                              context->xrsr_regs[i]);
-        if (!context->pm_state)
-                pm_runtime_put_sync(mcasp->dev);
-        return 0;
-}
-#else
-#define davinci_mcasp_suspend NULL
-#define davinci_mcasp_resume NULL
-#endif
 #define DAVINCI_MCASP_RATES     SNDRV_PCM_RATE_8000_192000
 #define DAVINCI_MCASP_PCM_FMTS (SNDRV_PCM_FMTBIT_S8 | \
@@ -1571,8 +1503,6 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
        {
                .name           = "davinci-mcasp.0",
                .probe          = davinci_mcasp_dai_probe,
-                .suspend        = davinci_mcasp_suspend,
-                .resume         = davinci_mcasp_resume,
                .playback       = {
                        .channels_min   = 1,
                        .channels_max   = 32 * 16,
@@ -1976,7 +1906,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
        }
        mcasp->num_serializer = pdata->num_serializer;
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        mcasp->context.xrsr_regs = devm_kcalloc(&pdev->dev,
                                        mcasp->num_serializer, sizeof(u32),
                                        GFP_KERNEL);
@@ -2196,11 +2126,73 @@ static int davinci_mcasp_remove(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM
+static int davinci_mcasp_runtime_suspend(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                context->config_regs[i] = mcasp_get_reg(mcasp, context_regs[i]);
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                context->afifo_regs[0] = mcasp_get_reg(mcasp, reg);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                context->afifo_regs[1] = mcasp_get_reg(mcasp, reg);
+        }
+        for (i = 0; i < mcasp->num_serializer; i++)
+                context->xrsr_regs[i] = mcasp_get_reg(mcasp,
+                                                DAVINCI_MCASP_XRSRCTL_REG(i));
+        return 0;
+}
+static int davinci_mcasp_runtime_resume(struct device *dev)
+{
+        struct davinci_mcasp *mcasp = dev_get_drvdata(dev);
+        struct davinci_mcasp_context *context = &mcasp->context;
+        u32 reg;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(context_regs); i++)
+                mcasp_set_reg(mcasp, context_regs[i], context->config_regs[i]);
+        if (mcasp->txnumevt) {
+                reg = mcasp->fifo_base + MCASP_WFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[0]);
+        }
+        if (mcasp->rxnumevt) {
+                reg = mcasp->fifo_base + MCASP_RFIFOCTL_OFFSET;
+                mcasp_set_reg(mcasp, reg, context->afifo_regs[1]);
+        }
+        for (i = 0; i < mcasp->num_serializer; i++)
+                mcasp_set_reg(mcasp, DAVINCI_MCASP_XRSRCTL_REG(i),
+                              context->xrsr_regs[i]);
+        return 0;
+}
+#endif
+static const struct dev_pm_ops davinci_mcasp_pm_ops = {
+        SET_RUNTIME_PM_OPS(davinci_mcasp_runtime_suspend,
+                           davinci_mcasp_runtime_resume,
+                           NULL)
+};
 static struct platform_driver davinci_mcasp_driver = {
        .probe          = davinci_mcasp_probe,
        .remove         = davinci_mcasp_remove,
        .driver         = {
                .name   = "davinci-mcasp",
+                .pm     = &davinci_mcasp_pm_ops,
                .of_match_table = mcasp_dt_ids,
        },
 };
diff --git a/sound/soc/xilinx/Kconfig b/sound/soc/xilinx/Kconfig
index 25e287feb58c..723a583a8d57 100644
--- a/sound/soc/xilinx/Kconfig
+++ b/sound/soc/xilinx/Kconfig
@@ -1,5 +1,5 @@
 config SND_SOC_XILINX_I2S
-        tristate "Audio support for the the Xilinx I2S"
+        tristate "Audio support for the Xilinx I2S"
        help
          Select this option to enable Xilinx I2S Audio. This enables
          I2S playback and capture using xilinx soft IP. In transmitter
diff --git a/sound/soc/xilinx/xlnx_i2s.c b/sound/soc/xilinx/xlnx_i2s.c
index d4ae9eff41ce..8b353166ad44 100644
--- a/sound/soc/xilinx/xlnx_i2s.c
+++ b/sound/soc/xilinx/xlnx_i2s.c
@@ -1,12 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0
-/*
+//
- * Xilinx ASoC I2S audio support
+// Xilinx ASoC I2S audio support
- *
+//
- * Copyright (C) 2018 Xilinx, Inc.
+// Copyright (C) 2018 Xilinx, Inc.
- *
+//
- * Author: Praveen Vuppala <praveenv@xilinx.com>
+// Author: Praveen Vuppala <praveenv@xilinx.com>
- * Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
+// Author: Maruthi Srinivas Bayyavarapu <maruthis@xilinx.com>
- */
 #include <linux/io.h>
 #include <linux/module.h>
diff --git a/tools/arch/powerpc/include/uapi/asm/perf_regs.h b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
index ff91192407d1..f599064dd8dc 100644
--- a/tools/arch/powerpc/include/uapi/asm/perf_regs.h
+++ b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
@@ -47,6 +47,7 @@ enum perf_event_powerpc_regs {
        PERF_REG_POWERPC_DAR,
        PERF_REG_POWERPC_DSISR,
        PERF_REG_POWERPC_SIER,
+        PERF_REG_POWERPC_MMCRA,
        PERF_REG_POWERPC_MAX,
 };
 #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 492f0f24e2d3..4ad1f0894d53 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -93,9 +93,16 @@ BFD_SRCS = jit_disasm.c
 SRCS = $(filter-out $(BFD_SRCS),$(wildcard *.c))
 ifeq ($(feature-libbfd),1)
+  LIBS += -lbfd -ldl -lopcodes
+else ifeq ($(feature-libbfd-liberty),1)
+  LIBS += -lbfd -ldl -lopcodes -liberty
+else ifeq ($(feature-libbfd-liberty-z),1)
+  LIBS += -lbfd -ldl -lopcodes -liberty -lz
+endif
+ifneq ($(filter -lbfd,$(LIBS)),)
 CFLAGS += -DHAVE_LIBBFD_SUPPORT
 SRCS += $(BFD_SRCS)
-LIBS += -lbfd -lopcodes
 endif
 OBJS = $(patsubst %.c,$(OUTPUT)%.o,$(SRCS)) $(OUTPUT)disasm.o
diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
index 3f0629edbca5..6ba5f567a9d8 100644
--- a/tools/bpf/bpftool/btf_dumper.c
+++ b/tools/bpf/bpftool/btf_dumper.c
@@ -82,8 +82,6 @@ static void btf_dumper_bitfield(__u32 nr_bits, __u8 bit_offset,
        int bits_to_copy;
        __u64 print_num;
-        data += BITS_ROUNDDOWN_BYTES(bit_offset);
-        bit_offset = BITS_PER_BYTE_MASKED(bit_offset);
        bits_to_copy = bit_offset + nr_bits;
        bytes_to_copy = BITS_ROUNDUP_BYTES(bits_to_copy);
@@ -118,7 +116,9 @@ static void btf_dumper_int_bits(__u32 int_type, __u8 bit_offset,
         * BTF_INT_OFFSET() cannot exceed 64 bits.
         */
        total_bits_offset = bit_offset + BTF_INT_OFFSET(int_type);
-        btf_dumper_bitfield(nr_bits, total_bits_offset, data, jw,
+        data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
+        bit_offset = BITS_PER_BYTE_MASKED(total_bits_offset);
+        btf_dumper_bitfield(nr_bits, bit_offset, data, jw,
                            is_plain_text);
 }
@@ -216,11 +216,12 @@ static int btf_dumper_struct(const struct btf_dumper *d, __u32 type_id,
                }
                jsonw_name(d->jw, btf__name_by_offset(d->btf, m[i].name_off));
+                data_off = data + BITS_ROUNDDOWN_BYTES(bit_offset);
                if (bitfield_size) {
-                        btf_dumper_bitfield(bitfield_size, bit_offset,
+                        btf_dumper_bitfield(bitfield_size,
-                                            data, d->jw, d->is_plain_text);
+                                            BITS_PER_BYTE_MASKED(bit_offset),
+                                            data_off, d->jw, d->is_plain_text);
                } else {
-                        data_off = data + BITS_ROUNDDOWN_BYTES(bit_offset);
                        ret = btf_dumper_do_type(d, m[i].type,
                                                 BITS_PER_BYTE_MASKED(bit_offset),
                                                 data_off);
diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
index bff7ee026680..6046dcab51cc 100644
--- a/tools/bpf/bpftool/json_writer.c
+++ b/tools/bpf/bpftool/json_writer.c
@@ -1,15 +1,10 @@
-// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+// SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-Clause)
 /*
 * Simple streaming JSON writer
 *
 * This takes care of the annoying bits of JSON syntax like the commas
 * after elements
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- *
 * Authors:     Stephen Hemminger <stephen@networkplumber.org>
 */
diff --git a/tools/bpf/bpftool/json_writer.h b/tools/bpf/bpftool/json_writer.h
index c1ab51aed99c..cb9a1993681c 100644
--- a/tools/bpf/bpftool/json_writer.h
+++ b/tools/bpf/bpftool/json_writer.h
@@ -5,11 +5,6 @@
 * This takes care of the annoying bits of JSON syntax like the commas
 * after elements
 *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- *
 * Authors:     Stephen Hemminger <stephen@networkplumber.org>
 */
diff --git a/tools/include/uapi/linux/pkt_sched.h b/tools/include/uapi/linux/pkt_sched.h
new file mode 100644
index 000000000000..0d18b1d1fbbc
--- /dev/null
+++ b/tools/include/uapi/linux/pkt_sched.h
@@ -0,0 +1,1163 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __LINUX_PKT_SCHED_H
+#define __LINUX_PKT_SCHED_H
+#include <linux/types.h>
+/* Logical priority bands not depending on specific packet scheduler.
+   Every scheduler will map them to real traffic classes, if it has
+   no more precise mechanism to classify packets.
+   These numbers have no special meaning, though their coincidence
+   with obsolete IPv6 values is not occasional :-). New IPv6 drafts
+   preferred full anarchy inspired by diffserv group.
+   Note: TC_PRIO_BESTEFFORT does not mean that it is the most unhappy
+   class, actually, as rule it will be handled with more care than
+   filler or even bulk.
+ */
+#define TC_PRIO_BESTEFFORT              0
+#define TC_PRIO_FILLER                  1
+#define TC_PRIO_BULK                    2
+#define TC_PRIO_INTERACTIVE_BULK        4
+#define TC_PRIO_INTERACTIVE             6
+#define TC_PRIO_CONTROL                 7
+#define TC_PRIO_MAX                     15
+/* Generic queue statistics, available for all the elements.
+   Particular schedulers may have also their private records.
+ */
+struct tc_stats {
+        __u64   bytes;                  /* Number of enqueued bytes */
+        __u32   packets;                /* Number of enqueued packets   */
+        __u32   drops;                  /* Packets dropped because of lack of resources */
+        __u32   overlimits;             /* Number of throttle events when this
+                                         * flow goes out of allocated bandwidth */
+        __u32   bps;                    /* Current flow byte rate */
+        __u32   pps;                    /* Current flow packet rate */
+        __u32   qlen;
+        __u32   backlog;
+};
+struct tc_estimator {
+        signed char     interval;
+        unsigned char   ewma_log;
+};
+/* "Handles"
+   ---------
+    All the traffic control objects have 32bit identifiers, or "handles".
+    They can be considered as opaque numbers from user API viewpoint,
+    but actually they always consist of two fields: major and
+    minor numbers, which are interpreted by kernel specially,
+    that may be used by applications, though not recommended.
+    F.e. qdisc handles always have minor number equal to zero,
+    classes (or flows) have major equal to parent qdisc major, and
+    minor uniquely identifying class inside qdisc.
+    Macros to manipulate handles:
+ */
+#define TC_H_MAJ_MASK (0xFFFF0000U)
+#define TC_H_MIN_MASK (0x0000FFFFU)
+#define TC_H_MAJ(h) ((h)&TC_H_MAJ_MASK)
+#define TC_H_MIN(h) ((h)&TC_H_MIN_MASK)
+#define TC_H_MAKE(maj,min) (((maj)&TC_H_MAJ_MASK)|((min)&TC_H_MIN_MASK))
+#define TC_H_UNSPEC     (0U)
+#define TC_H_ROOT       (0xFFFFFFFFU)
+#define TC_H_INGRESS    (0xFFFFFFF1U)
+#define TC_H_CLSACT     TC_H_INGRESS
+#define TC_H_MIN_PRIORITY       0xFFE0U
+#define TC_H_MIN_INGRESS        0xFFF2U
+#define TC_H_MIN_EGRESS         0xFFF3U
+/* Need to corrospond to iproute2 tc/tc_core.h "enum link_layer" */
+enum tc_link_layer {
+        TC_LINKLAYER_UNAWARE, /* Indicate unaware old iproute2 util */
+        TC_LINKLAYER_ETHERNET,
+        TC_LINKLAYER_ATM,
+};
+#define TC_LINKLAYER_MASK 0x0F /* limit use to lower 4 bits */
+struct tc_ratespec {
+        unsigned char   cell_log;
+        __u8            linklayer; /* lower 4 bits */
+        unsigned short  overhead;
+        short           cell_align;
+        unsigned short  mpu;
+        __u32           rate;
+};
+#define TC_RTAB_SIZE    1024
+struct tc_sizespec {
+        unsigned char   cell_log;
+        unsigned char   size_log;
+        short           cell_align;
+        int             overhead;
+        unsigned int    linklayer;
+        unsigned int    mpu;
+        unsigned int    mtu;
+        unsigned int    tsize;
+};
+enum {
+        TCA_STAB_UNSPEC,
+        TCA_STAB_BASE,
+        TCA_STAB_DATA,
+        __TCA_STAB_MAX
+};
+#define TCA_STAB_MAX (__TCA_STAB_MAX - 1)
+/* FIFO section */
+struct tc_fifo_qopt {
+        __u32   limit;  /* Queue length: bytes for bfifo, packets for pfifo */
+};
+/* SKBPRIO section */
+/*
+ * Priorities go from zero to (SKBPRIO_MAX_PRIORITY - 1).
+ * SKBPRIO_MAX_PRIORITY should be at least 64 in order for skbprio to be able
+ * to map one to one the DS field of IPV4 and IPV6 headers.
+ * Memory allocation grows linearly with SKBPRIO_MAX_PRIORITY.
+ */
+#define SKBPRIO_MAX_PRIORITY 64
+struct tc_skbprio_qopt {
+        __u32   limit;          /* Queue length in packets. */
+};
+/* PRIO section */
+#define TCQ_PRIO_BANDS  16
+#define TCQ_MIN_PRIO_BANDS 2
+struct tc_prio_qopt {
+        int     bands;                  /* Number of bands */
+        __u8    priomap[TC_PRIO_MAX+1]; /* Map: logical priority -> PRIO band */
+};
+/* MULTIQ section */
+struct tc_multiq_qopt {
+        __u16   bands;                  /* Number of bands */
+        __u16   max_bands;              /* Maximum number of queues */
+};
+/* PLUG section */
+#define TCQ_PLUG_BUFFER                0
+#define TCQ_PLUG_RELEASE_ONE           1
+#define TCQ_PLUG_RELEASE_INDEFINITE    2
+#define TCQ_PLUG_LIMIT                 3
+struct tc_plug_qopt {
+        /* TCQ_PLUG_BUFFER: Inset a plug into the queue and
+         *  buffer any incoming packets
+         * TCQ_PLUG_RELEASE_ONE: Dequeue packets from queue head
+         *   to beginning of the next plug.
+         * TCQ_PLUG_RELEASE_INDEFINITE: Dequeue all packets from queue.
+         *   Stop buffering packets until the next TCQ_PLUG_BUFFER
+         *   command is received (just act as a pass-thru queue).
+         * TCQ_PLUG_LIMIT: Increase/decrease queue size
+         */
+        int             action;
+        __u32           limit;
+};
+/* TBF section */
+struct tc_tbf_qopt {
+        struct tc_ratespec rate;
+        struct tc_ratespec peakrate;
+        __u32           limit;
+        __u32           buffer;
+        __u32           mtu;
+};
+enum {
+        TCA_TBF_UNSPEC,
+        TCA_TBF_PARMS,
+        TCA_TBF_RTAB,
+        TCA_TBF_PTAB,
+        TCA_TBF_RATE64,
+        TCA_TBF_PRATE64,
+        TCA_TBF_BURST,
+        TCA_TBF_PBURST,
+        TCA_TBF_PAD,
+        __TCA_TBF_MAX,
+};
+#define TCA_TBF_MAX (__TCA_TBF_MAX - 1)
+/* TEQL section */
+/* TEQL does not require any parameters */
+/* SFQ section */
+struct tc_sfq_qopt {
+        unsigned        quantum;        /* Bytes per round allocated to flow */
+        int             perturb_period; /* Period of hash perturbation */
+        __u32           limit;          /* Maximal packets in queue */
+        unsigned        divisor;        /* Hash divisor  */
+        unsigned        flows;          /* Maximal number of flows  */
+};
+struct tc_sfqred_stats {
+        __u32           prob_drop;      /* Early drops, below max threshold */
+        __u32           forced_drop;    /* Early drops, after max threshold */
+        __u32           prob_mark;      /* Marked packets, below max threshold */
+        __u32           forced_mark;    /* Marked packets, after max threshold */
+        __u32           prob_mark_head; /* Marked packets, below max threshold */
+        __u32           forced_mark_head;/* Marked packets, after max threshold */
+};
+struct tc_sfq_qopt_v1 {
+        struct tc_sfq_qopt v0;
+        unsigned int    depth;          /* max number of packets per flow */
+        unsigned int    headdrop;
+/* SFQRED parameters */
+        __u32           limit;          /* HARD maximal flow queue length (bytes) */
+        __u32           qth_min;        /* Min average length threshold (bytes) */
+        __u32           qth_max;        /* Max average length threshold (bytes) */
+        unsigned char   Wlog;           /* log(W)               */
+        unsigned char   Plog;           /* log(P_max/(qth_max-qth_min)) */
+        unsigned char   Scell_log;      /* cell size for idle damping */
+        unsigned char   flags;
+        __u32           max_P;          /* probability, high resolution */
+/* SFQRED stats */
+        struct tc_sfqred_stats stats;
+};
+struct tc_sfq_xstats {
+        __s32           allot;
+};
+/* RED section */
+enum {
+        TCA_RED_UNSPEC,
+        TCA_RED_PARMS,
+        TCA_RED_STAB,
+        TCA_RED_MAX_P,
+        __TCA_RED_MAX,
+};
+#define TCA_RED_MAX (__TCA_RED_MAX - 1)
+struct tc_red_qopt {
+        __u32           limit;          /* HARD maximal queue length (bytes)    */
+        __u32           qth_min;        /* Min average length threshold (bytes) */
+        __u32           qth_max;        /* Max average length threshold (bytes) */
+        unsigned char   Wlog;           /* log(W)               */
+        unsigned char   Plog;           /* log(P_max/(qth_max-qth_min)) */
+        unsigned char   Scell_log;      /* cell size for idle damping */
+        unsigned char   flags;
+#define TC_RED_ECN              1
+#define TC_RED_HARDDROP         2
+#define TC_RED_ADAPTATIVE       4
+};
+struct tc_red_xstats {
+        __u32           early;          /* Early drops */
+        __u32           pdrop;          /* Drops due to queue limits */
+        __u32           other;          /* Drops due to drop() calls */
+        __u32           marked;         /* Marked packets */
+};
+/* GRED section */
+#define MAX_DPs 16
+enum {
+       TCA_GRED_UNSPEC,
+       TCA_GRED_PARMS,
+       TCA_GRED_STAB,
+       TCA_GRED_DPS,
+       TCA_GRED_MAX_P,
+       TCA_GRED_LIMIT,
+       TCA_GRED_VQ_LIST,        /* nested TCA_GRED_VQ_ENTRY */
+       __TCA_GRED_MAX,
+};
+#define TCA_GRED_MAX (__TCA_GRED_MAX - 1)
+enum {
+        TCA_GRED_VQ_ENTRY_UNSPEC,
+        TCA_GRED_VQ_ENTRY,      /* nested TCA_GRED_VQ_* */
+        __TCA_GRED_VQ_ENTRY_MAX,
+};
+#define TCA_GRED_VQ_ENTRY_MAX (__TCA_GRED_VQ_ENTRY_MAX - 1)
+enum {
+        TCA_GRED_VQ_UNSPEC,
+        TCA_GRED_VQ_PAD,
+        TCA_GRED_VQ_DP,                 /* u32 */
+        TCA_GRED_VQ_STAT_BYTES,         /* u64 */
+        TCA_GRED_VQ_STAT_PACKETS,       /* u32 */
+        TCA_GRED_VQ_STAT_BACKLOG,       /* u32 */
+        TCA_GRED_VQ_STAT_PROB_DROP,     /* u32 */
+        TCA_GRED_VQ_STAT_PROB_MARK,     /* u32 */
+        TCA_GRED_VQ_STAT_FORCED_DROP,   /* u32 */
+        TCA_GRED_VQ_STAT_FORCED_MARK,   /* u32 */
+        TCA_GRED_VQ_STAT_PDROP,         /* u32 */
+        TCA_GRED_VQ_STAT_OTHER,         /* u32 */
+        TCA_GRED_VQ_FLAGS,              /* u32 */
+        __TCA_GRED_VQ_MAX
+};
+#define TCA_GRED_VQ_MAX (__TCA_GRED_VQ_MAX - 1)
+struct tc_gred_qopt {
+        __u32           limit;        /* HARD maximal queue length (bytes)    */
+        __u32           qth_min;      /* Min average length threshold (bytes) */
+        __u32           qth_max;      /* Max average length threshold (bytes) */
+        __u32           DP;           /* up to 2^32 DPs */
+        __u32           backlog;
+        __u32           qave;
+        __u32           forced;
+        __u32           early;
+        __u32           other;
+        __u32           pdrop;
+        __u8            Wlog;         /* log(W)               */
+        __u8            Plog;         /* log(P_max/(qth_max-qth_min)) */
+        __u8            Scell_log;    /* cell size for idle damping */
+        __u8            prio;         /* prio of this VQ */
+        __u32           packets;
+        __u32           bytesin;
+};
+/* gred setup */
+struct tc_gred_sopt {
+        __u32           DPs;
+        __u32           def_DP;
+        __u8            grio;
+        __u8            flags;
+        __u16           pad1;
+};
+/* CHOKe section */
+enum {
+        TCA_CHOKE_UNSPEC,
+        TCA_CHOKE_PARMS,
+        TCA_CHOKE_STAB,
+        TCA_CHOKE_MAX_P,
+        __TCA_CHOKE_MAX,
+};
+#define TCA_CHOKE_MAX (__TCA_CHOKE_MAX - 1)
+struct tc_choke_qopt {
+        __u32           limit;          /* Hard queue length (packets)  */
+        __u32           qth_min;        /* Min average threshold (packets) */
+        __u32           qth_max;        /* Max average threshold (packets) */
+        unsigned char   Wlog;           /* log(W)               */
+        unsigned char   Plog;           /* log(P_max/(qth_max-qth_min)) */
+        unsigned char   Scell_log;      /* cell size for idle damping */
+        unsigned char   flags;          /* see RED flags */
+};
+struct tc_choke_xstats {
+        __u32           early;          /* Early drops */
+        __u32           pdrop;          /* Drops due to queue limits */
+        __u32           other;          /* Drops due to drop() calls */
+        __u32           marked;         /* Marked packets */
+        __u32           matched;        /* Drops due to flow match */
+};
+/* HTB section */
+#define TC_HTB_NUMPRIO          8
+#define TC_HTB_MAXDEPTH         8
+#define TC_HTB_PROTOVER         3 /* the same as HTB and TC's major */
+struct tc_htb_opt {
+        struct tc_ratespec      rate;
+        struct tc_ratespec      ceil;
+        __u32   buffer;
+        __u32   cbuffer;
+        __u32   quantum;
+        __u32   level;          /* out only */
+        __u32   prio;
+};
+struct tc_htb_glob {
+        __u32 version;          /* to match HTB/TC */
+        __u32 rate2quantum;     /* bps->quantum divisor */
+        __u32 defcls;           /* default class number */
+        __u32 debug;            /* debug flags */
+        /* stats */
+        __u32 direct_pkts; /* count of non shaped packets */
+};
+enum {
+        TCA_HTB_UNSPEC,
+        TCA_HTB_PARMS,
+        TCA_HTB_INIT,
+        TCA_HTB_CTAB,
+        TCA_HTB_RTAB,
+        TCA_HTB_DIRECT_QLEN,
+        TCA_HTB_RATE64,
+        TCA_HTB_CEIL64,
+        TCA_HTB_PAD,
+        __TCA_HTB_MAX,
+};
+#define TCA_HTB_MAX (__TCA_HTB_MAX - 1)
+struct tc_htb_xstats {
+        __u32 lends;
+        __u32 borrows;
+        __u32 giants;   /* unused since 'Make HTB scheduler work with TSO.' */
+        __s32 tokens;
+        __s32 ctokens;
+};
+/* HFSC section */
+struct tc_hfsc_qopt {
+        __u16   defcls;         /* default class */
+};
+struct tc_service_curve {
+        __u32   m1;             /* slope of the first segment in bps */
+        __u32   d;              /* x-projection of the first segment in us */
+        __u32   m2;             /* slope of the second segment in bps */
+};
+struct tc_hfsc_stats {
+        __u64   work;           /* total work done */
+        __u64   rtwork;         /* work done by real-time criteria */
+        __u32   period;         /* current period */
+        __u32   level;          /* class level in hierarchy */
+};
+enum {
+        TCA_HFSC_UNSPEC,
+        TCA_HFSC_RSC,
+        TCA_HFSC_FSC,
+        TCA_HFSC_USC,
+        __TCA_HFSC_MAX,
+};
+#define TCA_HFSC_MAX (__TCA_HFSC_MAX - 1)
+/* CBQ section */
+#define TC_CBQ_MAXPRIO          8
+#define TC_CBQ_MAXLEVEL         8
+#define TC_CBQ_DEF_EWMA         5
+struct tc_cbq_lssopt {
+        unsigned char   change;
+        unsigned char   flags;
+#define TCF_CBQ_LSS_BOUNDED     1
+#define TCF_CBQ_LSS_ISOLATED    2
+        unsigned char   ewma_log;
+        unsigned char   level;
+#define TCF_CBQ_LSS_FLAGS       1
+#define TCF_CBQ_LSS_EWMA        2
+#define TCF_CBQ_LSS_MAXIDLE     4
+#define TCF_CBQ_LSS_MINIDLE     8
+#define TCF_CBQ_LSS_OFFTIME     0x10
+#define TCF_CBQ_LSS_AVPKT       0x20
+        __u32           maxidle;
+        __u32           minidle;
+        __u32           offtime;
+        __u32           avpkt;
+};
+struct tc_cbq_wrropt {
+        unsigned char   flags;
+        unsigned char   priority;
+        unsigned char   cpriority;
+        unsigned char   __reserved;
+        __u32           allot;
+        __u32           weight;
+};
+struct tc_cbq_ovl {
+        unsigned char   strategy;
+#define TC_CBQ_OVL_CLASSIC      0
+#define TC_CBQ_OVL_DELAY        1
+#define TC_CBQ_OVL_LOWPRIO      2
+#define TC_CBQ_OVL_DROP         3
+#define TC_CBQ_OVL_RCLASSIC     4
+        unsigned char   priority2;
+        __u16           pad;
+        __u32           penalty;
+};
+struct tc_cbq_police {
+        unsigned char   police;
+        unsigned char   __res1;
+        unsigned short  __res2;
+};
+struct tc_cbq_fopt {
+        __u32           split;
+        __u32           defmap;
+        __u32           defchange;
+};
+struct tc_cbq_xstats {
+        __u32           borrows;
+        __u32           overactions;
+        __s32           avgidle;
+        __s32           undertime;
+};
+enum {
+        TCA_CBQ_UNSPEC,
+        TCA_CBQ_LSSOPT,
+        TCA_CBQ_WRROPT,
+        TCA_CBQ_FOPT,
+        TCA_CBQ_OVL_STRATEGY,
+        TCA_CBQ_RATE,
+        TCA_CBQ_RTAB,
+        TCA_CBQ_POLICE,
+        __TCA_CBQ_MAX,
+};
+#define TCA_CBQ_MAX     (__TCA_CBQ_MAX - 1)
+/* dsmark section */
+enum {
+        TCA_DSMARK_UNSPEC,
+        TCA_DSMARK_INDICES,
+        TCA_DSMARK_DEFAULT_INDEX,
+        TCA_DSMARK_SET_TC_INDEX,
+        TCA_DSMARK_MASK,
+        TCA_DSMARK_VALUE,
+        __TCA_DSMARK_MAX,
+};
+#define TCA_DSMARK_MAX (__TCA_DSMARK_MAX - 1)
+/* ATM  section */
+enum {
+        TCA_ATM_UNSPEC,
+        TCA_ATM_FD,             /* file/socket descriptor */
+        TCA_ATM_PTR,            /* pointer to descriptor - later */
+        TCA_ATM_HDR,            /* LL header */
+        TCA_ATM_EXCESS,         /* excess traffic class (0 for CLP)  */
+        TCA_ATM_ADDR,           /* PVC address (for output only) */
+        TCA_ATM_STATE,          /* VC state (ATM_VS_*; for output only) */
+        __TCA_ATM_MAX,
+};
+#define TCA_ATM_MAX     (__TCA_ATM_MAX - 1)
+/* Network emulator */
+enum {
+        TCA_NETEM_UNSPEC,
+        TCA_NETEM_CORR,
+        TCA_NETEM_DELAY_DIST,
+        TCA_NETEM_REORDER,
+        TCA_NETEM_CORRUPT,
+        TCA_NETEM_LOSS,
+        TCA_NETEM_RATE,
+        TCA_NETEM_ECN,
+        TCA_NETEM_RATE64,
+        TCA_NETEM_PAD,
+        TCA_NETEM_LATENCY64,
+        TCA_NETEM_JITTER64,
+        TCA_NETEM_SLOT,
+        TCA_NETEM_SLOT_DIST,
+        __TCA_NETEM_MAX,
+};
+#define TCA_NETEM_MAX (__TCA_NETEM_MAX - 1)
+struct tc_netem_qopt {
+        __u32   latency;        /* added delay (us) */
+        __u32   limit;          /* fifo limit (packets) */
+        __u32   loss;           /* random packet loss (0=none ~0=100%) */
+        __u32   gap;            /* re-ordering gap (0 for none) */
+        __u32   duplicate;      /* random packet dup  (0=none ~0=100%) */
+        __u32   jitter;         /* random jitter in latency (us) */
+};
+struct tc_netem_corr {
+        __u32   delay_corr;     /* delay correlation */
+        __u32   loss_corr;      /* packet loss correlation */
+        __u32   dup_corr;       /* duplicate correlation  */
+};
+struct tc_netem_reorder {
+        __u32   probability;
+        __u32   correlation;
+};
+struct tc_netem_corrupt {
+        __u32   probability;
+        __u32   correlation;
+};
+struct tc_netem_rate {
+        __u32   rate;   /* byte/s */
+        __s32   packet_overhead;
+        __u32   cell_size;
+        __s32   cell_overhead;
+};
+struct tc_netem_slot {
+        __s64   min_delay; /* nsec */
+        __s64   max_delay;
+        __s32   max_packets;
+        __s32   max_bytes;
+        __s64   dist_delay; /* nsec */
+        __s64   dist_jitter; /* nsec */
+};
+enum {
+        NETEM_LOSS_UNSPEC,
+        NETEM_LOSS_GI,          /* General Intuitive - 4 state model */
+        NETEM_LOSS_GE,          /* Gilbert Elliot models */
+        __NETEM_LOSS_MAX
+};
+#define NETEM_LOSS_MAX (__NETEM_LOSS_MAX - 1)
+/* State transition probabilities for 4 state model */
+struct tc_netem_gimodel {
+        __u32   p13;
+        __u32   p31;
+        __u32   p32;
+        __u32   p14;
+        __u32   p23;
+};
+/* Gilbert-Elliot models */
+struct tc_netem_gemodel {
+        __u32 p;
+        __u32 r;
+        __u32 h;
+        __u32 k1;
+};
+#define NETEM_DIST_SCALE        8192
+#define NETEM_DIST_MAX          16384
+/* DRR */
+enum {
+        TCA_DRR_UNSPEC,
+        TCA_DRR_QUANTUM,
+        __TCA_DRR_MAX
+};
+#define TCA_DRR_MAX     (__TCA_DRR_MAX - 1)
+struct tc_drr_stats {
+        __u32   deficit;
+};
+/* MQPRIO */
+#define TC_QOPT_BITMASK 15
+#define TC_QOPT_MAX_QUEUE 16
+enum {
+        TC_MQPRIO_HW_OFFLOAD_NONE,      /* no offload requested */
+        TC_MQPRIO_HW_OFFLOAD_TCS,       /* offload TCs, no queue counts */
+        __TC_MQPRIO_HW_OFFLOAD_MAX
+};
+#define TC_MQPRIO_HW_OFFLOAD_MAX (__TC_MQPRIO_HW_OFFLOAD_MAX - 1)
+enum {
+        TC_MQPRIO_MODE_DCB,
+        TC_MQPRIO_MODE_CHANNEL,
+        __TC_MQPRIO_MODE_MAX
+};
+#define __TC_MQPRIO_MODE_MAX (__TC_MQPRIO_MODE_MAX - 1)
+enum {
+        TC_MQPRIO_SHAPER_DCB,
+        TC_MQPRIO_SHAPER_BW_RATE,       /* Add new shapers below */
+        __TC_MQPRIO_SHAPER_MAX
+};
+#define __TC_MQPRIO_SHAPER_MAX (__TC_MQPRIO_SHAPER_MAX - 1)
+struct tc_mqprio_qopt {
+        __u8    num_tc;
+        __u8    prio_tc_map[TC_QOPT_BITMASK + 1];
+        __u8    hw;
+        __u16   count[TC_QOPT_MAX_QUEUE];
+        __u16   offset[TC_QOPT_MAX_QUEUE];
+};
+#define TC_MQPRIO_F_MODE                0x1
+#define TC_MQPRIO_F_SHAPER              0x2
+#define TC_MQPRIO_F_MIN_RATE            0x4
+#define TC_MQPRIO_F_MAX_RATE            0x8
+enum {
+        TCA_MQPRIO_UNSPEC,
+        TCA_MQPRIO_MODE,
+        TCA_MQPRIO_SHAPER,
+        TCA_MQPRIO_MIN_RATE64,
+        TCA_MQPRIO_MAX_RATE64,
+        __TCA_MQPRIO_MAX,
+};
+#define TCA_MQPRIO_MAX (__TCA_MQPRIO_MAX - 1)
+/* SFB */
+enum {
+        TCA_SFB_UNSPEC,
+        TCA_SFB_PARMS,
+        __TCA_SFB_MAX,
+};
+#define TCA_SFB_MAX (__TCA_SFB_MAX - 1)
+/*
+ * Note: increment, decrement are Q0.16 fixed-point values.
+ */
+struct tc_sfb_qopt {
+        __u32 rehash_interval;  /* delay between hash move, in ms */
+        __u32 warmup_time;      /* double buffering warmup time in ms (warmup_time < rehash_interval) */
+        __u32 max;              /* max len of qlen_min */
+        __u32 bin_size;         /* maximum queue length per bin */
+        __u32 increment;        /* probability increment, (d1 in Blue) */
+        __u32 decrement;        /* probability decrement, (d2 in Blue) */
+        __u32 limit;            /* max SFB queue length */
+        __u32 penalty_rate;     /* inelastic flows are rate limited to 'rate' pps */
+        __u32 penalty_burst;
+};
+struct tc_sfb_xstats {
+        __u32 earlydrop;
+        __u32 penaltydrop;
+        __u32 bucketdrop;
+        __u32 queuedrop;
+        __u32 childdrop; /* drops in child qdisc */
+        __u32 marked;
+        __u32 maxqlen;
+        __u32 maxprob;
+        __u32 avgprob;
+};
+#define SFB_MAX_PROB 0xFFFF
+/* QFQ */
+enum {
+        TCA_QFQ_UNSPEC,
+        TCA_QFQ_WEIGHT,
+        TCA_QFQ_LMAX,
+        __TCA_QFQ_MAX
+};
+#define TCA_QFQ_MAX     (__TCA_QFQ_MAX - 1)
+struct tc_qfq_stats {
+        __u32 weight;
+        __u32 lmax;
+};
+/* CODEL */
+enum {
+        TCA_CODEL_UNSPEC,
+        TCA_CODEL_TARGET,
+        TCA_CODEL_LIMIT,
+        TCA_CODEL_INTERVAL,
+        TCA_CODEL_ECN,
+        TCA_CODEL_CE_THRESHOLD,
+        __TCA_CODEL_MAX
+};
+#define TCA_CODEL_MAX   (__TCA_CODEL_MAX - 1)
+struct tc_codel_xstats {
+        __u32   maxpacket; /* largest packet we've seen so far */
+        __u32   count;     /* how many drops we've done since the last time we
+                            * entered dropping state
+                            */
+        __u32   lastcount; /* count at entry to dropping state */
+        __u32   ldelay;    /* in-queue delay seen by most recently dequeued packet */
+        __s32   drop_next; /* time to drop next packet */
+        __u32   drop_overlimit; /* number of time max qdisc packet limit was hit */
+        __u32   ecn_mark;  /* number of packets we ECN marked instead of dropped */
+        __u32   dropping;  /* are we in dropping state ? */
+        __u32   ce_mark;   /* number of CE marked packets because of ce_threshold */
+};
+/* FQ_CODEL */
+enum {
+        TCA_FQ_CODEL_UNSPEC,
+        TCA_FQ_CODEL_TARGET,
+        TCA_FQ_CODEL_LIMIT,
+        TCA_FQ_CODEL_INTERVAL,
+        TCA_FQ_CODEL_ECN,
+        TCA_FQ_CODEL_FLOWS,
+        TCA_FQ_CODEL_QUANTUM,
+        TCA_FQ_CODEL_CE_THRESHOLD,
+        TCA_FQ_CODEL_DROP_BATCH_SIZE,
+        TCA_FQ_CODEL_MEMORY_LIMIT,
+        __TCA_FQ_CODEL_MAX
+};
+#define TCA_FQ_CODEL_MAX        (__TCA_FQ_CODEL_MAX - 1)
+enum {
+        TCA_FQ_CODEL_XSTATS_QDISC,
+        TCA_FQ_CODEL_XSTATS_CLASS,
+};
+struct tc_fq_codel_qd_stats {
+        __u32   maxpacket;      /* largest packet we've seen so far */
+        __u32   drop_overlimit; /* number of time max qdisc
+                                 * packet limit was hit
+                                 */
+        __u32   ecn_mark;       /* number of packets we ECN marked
+                                 * instead of being dropped
+                                 */
+        __u32   new_flow_count; /* number of time packets
+                                 * created a 'new flow'
+                                 */
+        __u32   new_flows_len;  /* count of flows in new list */
+        __u32   old_flows_len;  /* count of flows in old list */
+        __u32   ce_mark;        /* packets above ce_threshold */
+        __u32   memory_usage;   /* in bytes */
+        __u32   drop_overmemory;
+};
+struct tc_fq_codel_cl_stats {
+        __s32   deficit;
+        __u32   ldelay;         /* in-queue delay seen by most recently
+                                 * dequeued packet
+                                 */
+        __u32   count;
+        __u32   lastcount;
+        __u32   dropping;
+        __s32   drop_next;
+};
+struct tc_fq_codel_xstats {
+        __u32   type;
+        union {
+                struct tc_fq_codel_qd_stats qdisc_stats;
+                struct tc_fq_codel_cl_stats class_stats;
+        };
+};
+/* FQ */
+enum {
+        TCA_FQ_UNSPEC,
+        TCA_FQ_PLIMIT,          /* limit of total number of packets in queue */
+        TCA_FQ_FLOW_PLIMIT,     /* limit of packets per flow */
+        TCA_FQ_QUANTUM,         /* RR quantum */
+        TCA_FQ_INITIAL_QUANTUM,         /* RR quantum for new flow */
+        TCA_FQ_RATE_ENABLE,     /* enable/disable rate limiting */
+        TCA_FQ_FLOW_DEFAULT_RATE,/* obsolete, do not use */
+        TCA_FQ_FLOW_MAX_RATE,   /* per flow max rate */
+        TCA_FQ_BUCKETS_LOG,     /* log2(number of buckets) */
+        TCA_FQ_FLOW_REFILL_DELAY,       /* flow credit refill delay in usec */
+        TCA_FQ_ORPHAN_MASK,     /* mask applied to orphaned skb hashes */
+        TCA_FQ_LOW_RATE_THRESHOLD, /* per packet delay under this rate */
+        TCA_FQ_CE_THRESHOLD,    /* DCTCP-like CE-marking threshold */
+        __TCA_FQ_MAX
+};
+#define TCA_FQ_MAX      (__TCA_FQ_MAX - 1)
+struct tc_fq_qd_stats {
+        __u64   gc_flows;
+        __u64   highprio_packets;
+        __u64   tcp_retrans;
+        __u64   throttled;
+        __u64   flows_plimit;
+        __u64   pkts_too_long;
+        __u64   allocation_errors;
+        __s64   time_next_delayed_flow;
+        __u32   flows;
+        __u32   inactive_flows;
+        __u32   throttled_flows;
+        __u32   unthrottle_latency_ns;
+        __u64   ce_mark;                /* packets above ce_threshold */
+};
+/* Heavy-Hitter Filter */
+enum {
+        TCA_HHF_UNSPEC,
+        TCA_HHF_BACKLOG_LIMIT,
+        TCA_HHF_QUANTUM,
+        TCA_HHF_HH_FLOWS_LIMIT,
+        TCA_HHF_RESET_TIMEOUT,
+        TCA_HHF_ADMIT_BYTES,
+        TCA_HHF_EVICT_TIMEOUT,
+        TCA_HHF_NON_HH_WEIGHT,
+        __TCA_HHF_MAX
+};
+#define TCA_HHF_MAX     (__TCA_HHF_MAX - 1)
+struct tc_hhf_xstats {
+        __u32   drop_overlimit; /* number of times max qdisc packet limit
+                                 * was hit
+                                 */
+        __u32   hh_overlimit;   /* number of times max heavy-hitters was hit */
+        __u32   hh_tot_count;   /* number of captured heavy-hitters so far */
+        __u32   hh_cur_count;   /* number of current heavy-hitters */
+};
+/* PIE */
+enum {
+        TCA_PIE_UNSPEC,
+        TCA_PIE_TARGET,
+        TCA_PIE_LIMIT,
+        TCA_PIE_TUPDATE,
+        TCA_PIE_ALPHA,
+        TCA_PIE_BETA,
+        TCA_PIE_ECN,
+        TCA_PIE_BYTEMODE,
+        __TCA_PIE_MAX
+};
+#define TCA_PIE_MAX   (__TCA_PIE_MAX - 1)
+struct tc_pie_xstats {
+        __u32 prob;             /* current probability */
+        __u32 delay;            /* current delay in ms */
+        __u32 avg_dq_rate;      /* current average dq_rate in bits/pie_time */
+        __u32 packets_in;       /* total number of packets enqueued */
+        __u32 dropped;          /* packets dropped due to pie_action */
+        __u32 overlimit;        /* dropped due to lack of space in queue */
+        __u32 maxq;             /* maximum queue size */
+        __u32 ecn_mark;         /* packets marked with ecn*/
+};
+/* CBS */
+struct tc_cbs_qopt {
+        __u8 offload;
+        __u8 _pad[3];
+        __s32 hicredit;
+        __s32 locredit;
+        __s32 idleslope;
+        __s32 sendslope;
+};
+enum {
+        TCA_CBS_UNSPEC,
+        TCA_CBS_PARMS,
+        __TCA_CBS_MAX,
+};
+#define TCA_CBS_MAX (__TCA_CBS_MAX - 1)
+/* ETF */
+struct tc_etf_qopt {
+        __s32 delta;
+        __s32 clockid;
+        __u32 flags;
+#define TC_ETF_DEADLINE_MODE_ON BIT(0)
+#define TC_ETF_OFFLOAD_ON       BIT(1)
+};
+enum {
+        TCA_ETF_UNSPEC,
+        TCA_ETF_PARMS,
+        __TCA_ETF_MAX,
+};
+#define TCA_ETF_MAX (__TCA_ETF_MAX - 1)
+/* CAKE */
+enum {
+        TCA_CAKE_UNSPEC,
+        TCA_CAKE_PAD,
+        TCA_CAKE_BASE_RATE64,
+        TCA_CAKE_DIFFSERV_MODE,
+        TCA_CAKE_ATM,
+        TCA_CAKE_FLOW_MODE,
+        TCA_CAKE_OVERHEAD,
+        TCA_CAKE_RTT,
+        TCA_CAKE_TARGET,
+        TCA_CAKE_AUTORATE,
+        TCA_CAKE_MEMORY,
+        TCA_CAKE_NAT,
+        TCA_CAKE_RAW,
+        TCA_CAKE_WASH,
+        TCA_CAKE_MPU,
+        TCA_CAKE_INGRESS,
+        TCA_CAKE_ACK_FILTER,
+        TCA_CAKE_SPLIT_GSO,
+        __TCA_CAKE_MAX
+};
+#define TCA_CAKE_MAX    (__TCA_CAKE_MAX - 1)
+enum {
+        __TCA_CAKE_STATS_INVALID,
+        TCA_CAKE_STATS_PAD,
+        TCA_CAKE_STATS_CAPACITY_ESTIMATE64,
+        TCA_CAKE_STATS_MEMORY_LIMIT,
+        TCA_CAKE_STATS_MEMORY_USED,
+        TCA_CAKE_STATS_AVG_NETOFF,
+        TCA_CAKE_STATS_MIN_NETLEN,
+        TCA_CAKE_STATS_MAX_NETLEN,
+        TCA_CAKE_STATS_MIN_ADJLEN,
+        TCA_CAKE_STATS_MAX_ADJLEN,
+        TCA_CAKE_STATS_TIN_STATS,
+        TCA_CAKE_STATS_DEFICIT,
+        TCA_CAKE_STATS_COBALT_COUNT,
+        TCA_CAKE_STATS_DROPPING,
+        TCA_CAKE_STATS_DROP_NEXT_US,
+        TCA_CAKE_STATS_P_DROP,
+        TCA_CAKE_STATS_BLUE_TIMER_US,
+        __TCA_CAKE_STATS_MAX
+};
+#define TCA_CAKE_STATS_MAX (__TCA_CAKE_STATS_MAX - 1)
+enum {
+        __TCA_CAKE_TIN_STATS_INVALID,
+        TCA_CAKE_TIN_STATS_PAD,
+        TCA_CAKE_TIN_STATS_SENT_PACKETS,
+        TCA_CAKE_TIN_STATS_SENT_BYTES64,
+        TCA_CAKE_TIN_STATS_DROPPED_PACKETS,
+        TCA_CAKE_TIN_STATS_DROPPED_BYTES64,
+        TCA_CAKE_TIN_STATS_ACKS_DROPPED_PACKETS,
+        TCA_CAKE_TIN_STATS_ACKS_DROPPED_BYTES64,
+        TCA_CAKE_TIN_STATS_ECN_MARKED_PACKETS,
+        TCA_CAKE_TIN_STATS_ECN_MARKED_BYTES64,
+        TCA_CAKE_TIN_STATS_BACKLOG_PACKETS,
+        TCA_CAKE_TIN_STATS_BACKLOG_BYTES,
+        TCA_CAKE_TIN_STATS_THRESHOLD_RATE64,
+        TCA_CAKE_TIN_STATS_TARGET_US,
+        TCA_CAKE_TIN_STATS_INTERVAL_US,
+        TCA_CAKE_TIN_STATS_WAY_INDIRECT_HITS,
+        TCA_CAKE_TIN_STATS_WAY_MISSES,
+        TCA_CAKE_TIN_STATS_WAY_COLLISIONS,
+        TCA_CAKE_TIN_STATS_PEAK_DELAY_US,
+        TCA_CAKE_TIN_STATS_AVG_DELAY_US,
+        TCA_CAKE_TIN_STATS_BASE_DELAY_US,
+        TCA_CAKE_TIN_STATS_SPARSE_FLOWS,
+        TCA_CAKE_TIN_STATS_BULK_FLOWS,
+        TCA_CAKE_TIN_STATS_UNRESPONSIVE_FLOWS,
+        TCA_CAKE_TIN_STATS_MAX_SKBLEN,
+        TCA_CAKE_TIN_STATS_FLOW_QUANTUM,
+        __TCA_CAKE_TIN_STATS_MAX
+};
+#define TCA_CAKE_TIN_STATS_MAX (__TCA_CAKE_TIN_STATS_MAX - 1)
+#define TC_CAKE_MAX_TINS (8)
+enum {
+        CAKE_FLOW_NONE = 0,
+        CAKE_FLOW_SRC_IP,
+        CAKE_FLOW_DST_IP,
+        CAKE_FLOW_HOSTS,    /* = CAKE_FLOW_SRC_IP | CAKE_FLOW_DST_IP */
+        CAKE_FLOW_FLOWS,
+        CAKE_FLOW_DUAL_SRC, /* = CAKE_FLOW_SRC_IP | CAKE_FLOW_FLOWS */
+        CAKE_FLOW_DUAL_DST, /* = CAKE_FLOW_DST_IP | CAKE_FLOW_FLOWS */
+        CAKE_FLOW_TRIPLE,   /* = CAKE_FLOW_HOSTS  | CAKE_FLOW_FLOWS */
+        CAKE_FLOW_MAX,
+};
+enum {
+        CAKE_DIFFSERV_DIFFSERV3 = 0,
+        CAKE_DIFFSERV_DIFFSERV4,
+        CAKE_DIFFSERV_DIFFSERV8,
+        CAKE_DIFFSERV_BESTEFFORT,
+        CAKE_DIFFSERV_PRECEDENCE,
+        CAKE_DIFFSERV_MAX
+};
+enum {
+        CAKE_ACK_NONE = 0,
+        CAKE_ACK_FILTER,
+        CAKE_ACK_AGGRESSIVE,
+        CAKE_ACK_MAX
+};
+enum {
+        CAKE_ATM_NONE = 0,
+        CAKE_ATM_ATM,
+        CAKE_ATM_PTM,
+        CAKE_ATM_MAX
+};
+/* TAPRIO */
+enum {
+        TC_TAPRIO_CMD_SET_GATES = 0x00,
+        TC_TAPRIO_CMD_SET_AND_HOLD = 0x01,
+        TC_TAPRIO_CMD_SET_AND_RELEASE = 0x02,
+};
+enum {
+        TCA_TAPRIO_SCHED_ENTRY_UNSPEC,
+        TCA_TAPRIO_SCHED_ENTRY_INDEX, /* u32 */
+        TCA_TAPRIO_SCHED_ENTRY_CMD, /* u8 */
+        TCA_TAPRIO_SCHED_ENTRY_GATE_MASK, /* u32 */
+        TCA_TAPRIO_SCHED_ENTRY_INTERVAL, /* u32 */
+        __TCA_TAPRIO_SCHED_ENTRY_MAX,
+};
+#define TCA_TAPRIO_SCHED_ENTRY_MAX (__TCA_TAPRIO_SCHED_ENTRY_MAX - 1)
+/* The format for schedule entry list is:
+ * [TCA_TAPRIO_SCHED_ENTRY_LIST]
+ *   [TCA_TAPRIO_SCHED_ENTRY]
+ *     [TCA_TAPRIO_SCHED_ENTRY_CMD]
+ *     [TCA_TAPRIO_SCHED_ENTRY_GATES]
+ *     [TCA_TAPRIO_SCHED_ENTRY_INTERVAL]
+ */
+enum {
+        TCA_TAPRIO_SCHED_UNSPEC,
+        TCA_TAPRIO_SCHED_ENTRY,
+        __TCA_TAPRIO_SCHED_MAX,
+};
+#define TCA_TAPRIO_SCHED_MAX (__TCA_TAPRIO_SCHED_MAX - 1)
+enum {
+        TCA_TAPRIO_ATTR_UNSPEC,
+        TCA_TAPRIO_ATTR_PRIOMAP, /* struct tc_mqprio_qopt */
+        TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST, /* nested of entry */
+        TCA_TAPRIO_ATTR_SCHED_BASE_TIME, /* s64 */
+        TCA_TAPRIO_ATTR_SCHED_SINGLE_ENTRY, /* single entry */
+        TCA_TAPRIO_ATTR_SCHED_CLOCKID, /* s32 */
+        TCA_TAPRIO_PAD,
+        __TCA_TAPRIO_ATTR_MAX,
+};
+#define TCA_TAPRIO_ATTR_MAX (__TCA_TAPRIO_ATTR_MAX - 1)
+#endif
diff --git a/tools/lib/bpf/.gitignore b/tools/lib/bpf/.gitignore
index f81e549ddfdb..4db74758c674 100644
--- a/tools/lib/bpf/.gitignore
+++ b/tools/lib/bpf/.gitignore
@@ -1,2 +1,3 @@
 libbpf_version.h
 FEATURE-DUMP.libbpf
+test_libbpf
diff --git a/tools/lib/bpf/README.rst b/tools/lib/bpf/README.rst
index 056f38310722..607aae40f4ed 100644
--- a/tools/lib/bpf/README.rst
+++ b/tools/lib/bpf/README.rst
@@ -132,6 +132,20 @@ For example, if current state of ``libbpf.map`` is:
 Format of version script and ways to handle ABI changes, including
 incompatible ones, described in details in [1].
+Stand-alone build
+=================
+Under https://github.com/libbpf/libbpf there is a (semi-)automated
+mirror of the mainline's version of libbpf for a stand-alone build.
+However, all changes to libbpf's code base must be upstreamed through
+the mainline kernel tree.
+License
+=======
+libbpf is dual-licensed under LGPL 2.1 and BSD 2-Clause.
 Links
 =====
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 3caaa3428774..88cbd110ae58 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -65,6 +65,17 @@ static inline int sys_bpf(enum bpf_cmd cmd, union bpf_attr *attr,
        return syscall(__NR_bpf, cmd, attr, size);
 }
+static inline int sys_bpf_prog_load(union bpf_attr *attr, unsigned int size)
+{
+        int fd;
+        do {
+                fd = sys_bpf(BPF_PROG_LOAD, attr, size);
+        } while (fd < 0 && errno == EAGAIN);
+        return fd;
+}
 int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
 {
        __u32 name_len = create_attr->name ? strlen(create_attr->name) : 0;
@@ -232,7 +243,7 @@ int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
        memcpy(attr.prog_name, load_attr->name,
               min(name_len, BPF_OBJ_NAME_LEN - 1));
-        fd = sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+        fd = sys_bpf_prog_load(&attr, sizeof(attr));
        if (fd >= 0)
                return fd;
@@ -269,7 +280,7 @@ int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
                        break;
                }
-                fd = sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+                fd = sys_bpf_prog_load(&attr, sizeof(attr));
                if (fd >= 0)
                        goto done;
@@ -283,7 +294,7 @@ int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
        attr.log_size = log_buf_sz;
        attr.log_level = 1;
        log_buf[0] = 0;
-        fd = sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+        fd = sys_bpf_prog_load(&attr, sizeof(attr));
 done:
        free(finfo);
        free(linfo);
@@ -328,7 +339,7 @@ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
        attr.kern_version = kern_version;
        attr.prog_flags = prog_flags;
-        return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+        return sys_bpf_prog_load(&attr, sizeof(attr));
 }
 int bpf_map_update_elem(int fd, const void *key, const void *value,
diff --git a/tools/perf/arch/powerpc/include/perf_regs.h b/tools/perf/arch/powerpc/include/perf_regs.h
index 1076393e6f43..e18a3556f5e3 100644
--- a/tools/perf/arch/powerpc/include/perf_regs.h
+++ b/tools/perf/arch/powerpc/include/perf_regs.h
@@ -63,7 +63,8 @@ static const char *reg_names[] = {
        [PERF_REG_POWERPC_TRAP] = "trap",
        [PERF_REG_POWERPC_DAR] = "dar",
        [PERF_REG_POWERPC_DSISR] = "dsisr",
-        [PERF_REG_POWERPC_SIER] = "sier"
+        [PERF_REG_POWERPC_SIER] = "sier",
+        [PERF_REG_POWERPC_MMCRA] = "mmcra"
 };
 static inline const char *perf_reg_name(int id)
diff --git a/tools/perf/arch/powerpc/util/perf_regs.c b/tools/perf/arch/powerpc/util/perf_regs.c
index 07fcd977d93e..34d5134681d9 100644
--- a/tools/perf/arch/powerpc/util/perf_regs.c
+++ b/tools/perf/arch/powerpc/util/perf_regs.c
@@ -53,6 +53,7 @@ const struct sample_reg sample_reg_masks[] = {
        SMPL_REG(dar, PERF_REG_POWERPC_DAR),
        SMPL_REG(dsisr, PERF_REG_POWERPC_DSISR),
        SMPL_REG(sier, PERF_REG_POWERPC_SIER),
+        SMPL_REG(mmcra, PERF_REG_POWERPC_MMCRA),
        SMPL_REG_END
 };
diff --git a/tools/testing/nvdimm/dimm_devs.c b/tools/testing/nvdimm/dimm_devs.c
index e75238404555..2d4baf57822f 100644
--- a/tools/testing/nvdimm/dimm_devs.c
+++ b/tools/testing/nvdimm/dimm_devs.c
@@ -18,8 +18,8 @@ ssize_t security_show(struct device *dev,
         * For the test version we need to poll the "hardware" in order
         * to get the updated status for unlock testing.
         */
-        nvdimm->sec.state = nvdimm_security_state(nvdimm, false);
+        nvdimm->sec.state = nvdimm_security_state(nvdimm, NVDIMM_USER);
-        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, true);
+        nvdimm->sec.ext_state = nvdimm_security_state(nvdimm, NVDIMM_MASTER);
        switch (nvdimm->sec.state) {
        case NVDIMM_SECURITY_DISABLED:
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index 4a9785043a39..dd093bd91aa9 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -28,3 +28,4 @@ flow_dissector_load
 test_netcnt
 test_section_names
 test_tcpnotify_user
+test_libbpf
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 73aa6d8f4a2f..41ab7a3668b3 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -55,7 +55,10 @@ TEST_PROGS := test_kmod.sh \
        test_flow_dissector.sh \
        test_xdp_vlan.sh
-TEST_PROGS_EXTENDED := with_addr.sh
+TEST_PROGS_EXTENDED := with_addr.sh \
+        with_tunnels.sh \
+        tcp_client.py \
+        tcp_server.py
 # Compile but not part of 'make run_tests'
 TEST_GEN_PROGS_EXTENDED = test_libbpf_open test_sock_addr test_skb_cgroup_id_user \
diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c
index cf16948aad4a..6692a40a6979 100644
--- a/tools/testing/selftests/bpf/cgroup_helpers.c
+++ b/tools/testing/selftests/bpf/cgroup_helpers.c
@@ -155,7 +155,7 @@ void cleanup_cgroup_environment(void)
 * This function creates a cgroup under the top level workdir and returns the
 * file descriptor. It is idempotent.
 *
- * On success, it returns the file descriptor. On failure it returns 0.
+ * On success, it returns the file descriptor. On failure it returns -1.
 * If there is a failure, it prints the error to stderr.
 */
 int create_and_get_cgroup(const char *path)
@@ -166,13 +166,13 @@ int create_and_get_cgroup(const char *path)
        format_cgroup_path(cgroup_path, path);
        if (mkdir(cgroup_path, 0777) && errno != EEXIST) {
                log_err("mkdiring cgroup %s .. %s", path, cgroup_path);
-                return 0;
+                return -1;
        }
        fd = open(cgroup_path, O_RDONLY);
        if (fd < 0) {
                log_err("Opening Cgroup");
-                return 0;
+                return -1;
        }
        return fd;
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 8bcd38010582..a0bd04befe87 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -3526,6 +3526,8 @@ struct pprint_mapv {
                ENUM_TWO,
                ENUM_THREE,
        } aenum;
+        uint32_t ui32b;
+        uint32_t bits2c:2;
 };
 static struct btf_raw_test pprint_test_template[] = {
@@ -3568,7 +3570,7 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_ENUM_ENC(NAME_TBD, 2),
                BTF_ENUM_ENC(NAME_TBD, 3),
                /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 10), 40),
                BTF_MEMBER_ENC(NAME_TBD, 11, 0),        /* uint32_t ui32 */
                BTF_MEMBER_ENC(NAME_TBD, 10, 32),       /* uint16_t ui16 */
                BTF_MEMBER_ENC(NAME_TBD, 12, 64),       /* int32_t si32 */
@@ -3577,9 +3579,11 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_MEMBER_ENC(NAME_TBD, 6, 126),       /* unused_bits2b */
                BTF_MEMBER_ENC(0, 14, 128),             /* union (anon) */
                BTF_MEMBER_ENC(NAME_TBD, 15, 192),      /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, 224),      /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 6, 256),       /* bits2c */
                BTF_END_RAW,
        },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c"),
        .key_size = sizeof(unsigned int),
        .value_size = sizeof(struct pprint_mapv),
        .key_type_id = 3,       /* unsigned int */
@@ -3628,7 +3632,7 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_ENUM_ENC(NAME_TBD, 2),
                BTF_ENUM_ENC(NAME_TBD, 3),
                /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 10), 40),
                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 0)),  /* uint32_t ui32 */
                BTF_MEMBER_ENC(NAME_TBD, 10, BTF_MEMBER_OFFSET(0, 32)), /* uint16_t ui16 */
                BTF_MEMBER_ENC(NAME_TBD, 12, BTF_MEMBER_OFFSET(0, 64)), /* int32_t si32 */
@@ -3637,9 +3641,11 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_MEMBER_ENC(NAME_TBD, 6, BTF_MEMBER_OFFSET(2, 126)), /* unused_bits2b */
                BTF_MEMBER_ENC(0, 14, BTF_MEMBER_OFFSET(0, 128)),       /* union (anon) */
                BTF_MEMBER_ENC(NAME_TBD, 15, BTF_MEMBER_OFFSET(0, 192)),        /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 224)),        /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 6, BTF_MEMBER_OFFSET(2, 256)), /* bits2c */
                BTF_END_RAW,
        },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c"),
        .key_size = sizeof(unsigned int),
        .value_size = sizeof(struct pprint_mapv),
        .key_type_id = 3,       /* unsigned int */
@@ -3690,7 +3696,7 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_ENUM_ENC(NAME_TBD, 2),
                BTF_ENUM_ENC(NAME_TBD, 3),
                /* struct pprint_mapv */                /* [16] */
-                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 8), 32),
+                BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 1, 10), 40),
                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 0)),  /* uint32_t ui32 */
                BTF_MEMBER_ENC(NAME_TBD, 10, BTF_MEMBER_OFFSET(0, 32)), /* uint16_t ui16 */
                BTF_MEMBER_ENC(NAME_TBD, 12, BTF_MEMBER_OFFSET(0, 64)), /* int32_t si32 */
@@ -3699,13 +3705,15 @@ static struct btf_raw_test pprint_test_template[] = {
                BTF_MEMBER_ENC(NAME_TBD, 19, BTF_MEMBER_OFFSET(2, 126)),/* unused_bits2b */
                BTF_MEMBER_ENC(0, 14, BTF_MEMBER_OFFSET(0, 128)),       /* union (anon) */
                BTF_MEMBER_ENC(NAME_TBD, 15, BTF_MEMBER_OFFSET(0, 192)),        /* aenum */
+                BTF_MEMBER_ENC(NAME_TBD, 11, BTF_MEMBER_OFFSET(0, 224)),        /* uint32_t ui32b */
+                BTF_MEMBER_ENC(NAME_TBD, 17, BTF_MEMBER_OFFSET(2, 256)),        /* bits2c */
                /* typedef unsigned int ___int */       /* [17] */
                BTF_TYPEDEF_ENC(NAME_TBD, 18),
                BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 6),      /* [18] */
                BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 15),        /* [19] */
                BTF_END_RAW,
        },
-        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0___int"),
+        BTF_STR_SEC("\0unsigned char\0unsigned short\0unsigned int\0int\0unsigned long long\0uint8_t\0uint16_t\0uint32_t\0int32_t\0uint64_t\0ui64\0ui8a\0ENUM_ZERO\0ENUM_ONE\0ENUM_TWO\0ENUM_THREE\0pprint_mapv\0ui32\0ui16\0si32\0unused_bits2a\0bits28\0unused_bits2b\0aenum\0ui32b\0bits2c\0___int"),
        .key_size = sizeof(unsigned int),
        .value_size = sizeof(struct pprint_mapv),
        .key_type_id = 3,       /* unsigned int */
@@ -3793,6 +3801,8 @@ static void set_pprint_mapv(struct pprint_mapv *v, uint32_t i,
                v->unused_bits2b = 3;
                v->ui64 = i;
                v->aenum = i & 0x03;
+                v->ui32b = 4;
+                v->bits2c = 1;
                v = (void *)v + rounded_value_size;
        }
 }
@@ -3955,7 +3965,8 @@ static int do_test_pprint(int test_num)
                        nexpected_line = snprintf(expected_line, sizeof(expected_line),
                                                  "%s%u: {%u,0,%d,0x%x,0x%x,0x%x,"
-                                                  "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s}\n",
+                                                  "{%lu|[%u,%u,%u,%u,%u,%u,%u,%u]},%s,"
+                                                  "%u,0x%x}\n",
                                                  percpu_map ? "\tcpu" : "",
                                                  percpu_map ? cpu : next_key,
                                                  cmapv->ui32, cmapv->si32,
@@ -3967,7 +3978,9 @@ static int do_test_pprint(int test_num)
                                                  cmapv->ui8a[2], cmapv->ui8a[3],
                                                  cmapv->ui8a[4], cmapv->ui8a[5],
                                                  cmapv->ui8a[6], cmapv->ui8a[7],
-                                                  pprint_enum_str[cmapv->aenum]);
+                                                  pprint_enum_str[cmapv->aenum],
+                                                  cmapv->ui32b,
+                                                  cmapv->bits2c);
                        err = check_line(expected_line, nexpected_line,
                                         sizeof(expected_line), line);
diff --git a/tools/testing/selftests/bpf/test_cgroup_storage.c b/tools/testing/selftests/bpf/test_cgroup_storage.c
index f44834155f25..2fc4625c1a15 100644
--- a/tools/testing/selftests/bpf/test_cgroup_storage.c
+++ b/tools/testing/selftests/bpf/test_cgroup_storage.c
@@ -81,7 +81,7 @@ int main(int argc, char **argv)
        /* Create a cgroup, get fd, and join it */
        cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                printf("Failed to create test cgroup\n");
                goto err;
        }
diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c
index 9c8b50bac7e0..76e4993b7c16 100644
--- a/tools/testing/selftests/bpf/test_dev_cgroup.c
+++ b/tools/testing/selftests/bpf/test_dev_cgroup.c
@@ -43,7 +43,7 @@ int main(int argc, char **argv)
        /* Create a cgroup, get fd, and join it */
        cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                printf("Failed to create test cgroup\n");
                goto err;
        }
diff --git a/tools/testing/selftests/bpf/test_netcnt.c b/tools/testing/selftests/bpf/test_netcnt.c
index 44ed7f29f8ab..c1da5404454a 100644
--- a/tools/testing/selftests/bpf/test_netcnt.c
+++ b/tools/testing/selftests/bpf/test_netcnt.c
@@ -65,7 +65,7 @@ int main(int argc, char **argv)
        /* Create a cgroup, get fd, and join it */
        cgroup_fd = create_and_get_cgroup(TEST_CGROUP);
-        if (!cgroup_fd) {
+        if (cgroup_fd < 0) {
                printf("Failed to create test cgroup\n");
                goto err;
        }
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 126fc624290d..25f0083a9b2e 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1188,7 +1188,9 @@ static void test_stacktrace_build_id(void)
        int i, j;
        struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
        int build_id_matches = 0;
+        int retry = 1;
+retry:
        err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
        if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
                goto out;
@@ -1301,6 +1303,19 @@ static void test_stacktrace_build_id(void)
                previous_key = key;
        } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+        /* stack_map_get_build_id_offset() is racy and sometimes can return
+         * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
+         * try it one more time.
+         */
+        if (build_id_matches < 1 && retry--) {
+                ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+                close(pmu_fd);
+                bpf_object__close(obj);
+                printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
+                       __func__);
+                goto retry;
+        }
        if (CHECK(build_id_matches < 1, "build id match",
                  "Didn't find expected build ID from the map\n"))
                goto disable_pmu;
@@ -1341,7 +1356,9 @@ static void test_stacktrace_build_id_nmi(void)
        int i, j;
        struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
        int build_id_matches = 0;
+        int retry = 1;
+retry:
        err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd);
        if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
                return;
@@ -1436,6 +1453,19 @@ static void test_stacktrace_build_id_nmi(void)
                previous_key = key;
        } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+        /* stack_map_get_build_id_offset() is racy and sometimes can return
+         * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
+         * try it one more time.
+         */
+        if (build_id_matches < 1 && retry--) {
+                ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
+                close(pmu_fd);
+                bpf_object__close(obj);
+                printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
+                       __func__);
+                goto retry;
+        }
        if (CHECK(build_id_matches < 1, "build id match",
                  "Didn't find expected build ID from the map\n"))
                goto disable_pmu;
diff --git a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
index c121cc59f314..9220747c069d 100644
--- a/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
+++ b/tools/testing/selftests/bpf/test_skb_cgroup_id_user.c
@@ -164,7 +164,7 @@ int main(int argc, char **argv)
                goto err;
        cgfd = create_and_get_cgroup(CGROUP_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                goto err;
        if (join_cgroup(CGROUP_PATH))
diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
index b8ebe2f58074..561ffb6d6433 100644
--- a/tools/testing/selftests/bpf/test_sock.c
+++ b/tools/testing/selftests/bpf/test_sock.c
@@ -458,7 +458,7 @@ int main(int argc, char **argv)
                goto err;
        cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                goto err;
        if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
index 73b7493d4120..3f110eaaf29c 100644
--- a/tools/testing/selftests/bpf/test_sock_addr.c
+++ b/tools/testing/selftests/bpf/test_sock_addr.c
@@ -44,6 +44,7 @@
 #define SERV6_V4MAPPED_IP       "::ffff:192.168.0.4"
 #define SRC6_IP                 "::1"
 #define SRC6_REWRITE_IP         "::6"
+#define WILDCARD6_IP            "::"
 #define SERV6_PORT              6060
 #define SERV6_REWRITE_PORT      6666
@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test);
 static int bind6_prog_load(const struct sock_addr_test *test);
 static int connect4_prog_load(const struct sock_addr_test *test);
 static int connect6_prog_load(const struct sock_addr_test *test);
+static int sendmsg_allow_prog_load(const struct sock_addr_test *test);
 static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
 static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
 static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
+static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test);
 static struct sock_addr_test tests[] = {
        /* bind */
@@ -463,6 +466,34 @@ static struct sock_addr_test tests[] = {
                SYSCALL_ENOTSUPP,
        },
        {
+                "sendmsg6: set dst IP = [::] (BSD'ism)",
+                sendmsg6_rw_wildcard_prog_load,
+                BPF_CGROUP_UDP6_SENDMSG,
+                BPF_CGROUP_UDP6_SENDMSG,
+                AF_INET6,
+                SOCK_DGRAM,
+                SERV6_IP,
+                SERV6_PORT,
+                SERV6_REWRITE_IP,
+                SERV6_REWRITE_PORT,
+                SRC6_REWRITE_IP,
+                SUCCESS,
+        },
+        {
+                "sendmsg6: preserve dst IP = [::] (BSD'ism)",
+                sendmsg_allow_prog_load,
+                BPF_CGROUP_UDP6_SENDMSG,
+                BPF_CGROUP_UDP6_SENDMSG,
+                AF_INET6,
+                SOCK_DGRAM,
+                WILDCARD6_IP,
+                SERV6_PORT,
+                SERV6_REWRITE_IP,
+                SERV6_PORT,
+                SRC6_IP,
+                SUCCESS,
+        },
+        {
                "sendmsg6: deny call",
                sendmsg_deny_prog_load,
                BPF_CGROUP_UDP6_SENDMSG,
@@ -734,16 +765,27 @@ static int connect6_prog_load(const struct sock_addr_test *test)
        return load_path(test, CONNECT6_PROG_PATH);
 }
-static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
+static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test,
+                                      int32_t rc)
 {
        struct bpf_insn insns[] = {
-                /* return 0 */
+                /* return rc */
-                BPF_MOV64_IMM(BPF_REG_0, 0),
+                BPF_MOV64_IMM(BPF_REG_0, rc),
                BPF_EXIT_INSN(),
        };
        return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
 }
+static int sendmsg_allow_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg_ret_only_prog_load(test, /*rc*/ 1);
+}
+static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg_ret_only_prog_load(test, /*rc*/ 0);
+}
 static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
 {
        struct sockaddr_in dst4_rw_addr;
@@ -864,6 +906,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
        return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
 }
+static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
+{
+        return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP);
+}
 static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
 {
        return load_path(test, SENDMSG6_PROG_PATH);
@@ -1395,7 +1442,7 @@ int main(int argc, char **argv)
                goto err;
        cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                goto err;
        if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_socket_cookie.c b/tools/testing/selftests/bpf/test_socket_cookie.c
index b6c2c605d8c0..fc7832ee566b 100644
--- a/tools/testing/selftests/bpf/test_socket_cookie.c
+++ b/tools/testing/selftests/bpf/test_socket_cookie.c
@@ -202,7 +202,7 @@ int main(int argc, char **argv)
                goto err;
        cgfd = create_and_get_cgroup(CG_PATH);
-        if (!cgfd)
+        if (cgfd < 0)
                goto err;
        if (join_cgroup(CG_PATH))
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_user.c b/tools/testing/selftests/bpf/test_tcpbpf_user.c
index e6eebda7d112..716b4e3be581 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_user.c
@@ -103,7 +103,7 @@ int main(int argc, char **argv)
                goto err;
        cg_fd = create_and_get_cgroup(cg_path);
-        if (!cg_fd)
+        if (cg_fd < 0)
                goto err;
        if (join_cgroup(cg_path))
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index ff3c4522aed6..4e4353711a86 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -115,7 +115,7 @@ int main(int argc, char **argv)
                goto err;
        cg_fd = create_and_get_cgroup(cg_path);
-        if (!cg_fd)
+        if (cg_fd < 0)
                goto err;
        if (join_cgroup(cg_path))
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 10d44446e801..2fd90d456892 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6934,6 +6934,126 @@ static struct bpf_test tests[] = {
                .retval = 1,
        },
        {
+                "map access: mixing value pointer and scalar, 1",
+                .insns = {
+                        // load map value pointer into r0 and r2
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        // load some number from the map into r1
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 3),
+                        // branch A
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_JMP_A(2),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        // common instruction
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+                        // branch A
+                        BPF_JMP_A(4),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+                        // verifier follows fall-through
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        // fake-dead code; targeted from branch A to
+                        // prevent dead code sanitization
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R2 tried to add from different pointers or scalars",
+                .retval = 0,
+        },
+        {
+                "map access: mixing value pointer and scalar, 2",
+                .insns = {
+                        // load map value pointer into r0 and r2
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        // load some number from the map into r1
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+                        // branch A
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        BPF_JMP_A(2),
+                        // branch B
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        // common instruction
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        // depending on r1, branch:
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+                        // branch A
+                        BPF_JMP_A(4),
+                        // branch B
+                        BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+                        // verifier follows fall-through
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        // fake-dead code; targeted from branch A to
+                        // prevent dead code sanitization
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R2 tried to add from different maps or paths",
+                .retval = 0,
+        },
+        {
+                "sanitation: alu with different scalars",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+                        BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+                        BPF_JMP_A(2),
+                        BPF_MOV64_IMM(BPF_REG_2, 42),
+                        BPF_MOV64_IMM(BPF_REG_3, 0x100001),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map_array_48b = { 1 },
+                .result = ACCEPT,
+                .retval = 0x100000,
+        },
+        {
                "map access: value_ptr += known scalar, upper oob arith, test 1",
                .insns = {
                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
diff --git a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
index 94fdbf215c14..c4cf6e6d800e 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh
@@ -25,6 +25,7 @@ ALL_TESTS="
        lag_unlink_slaves_test
        lag_dev_deletion_test
        vlan_interface_uppers_test
+        bridge_extern_learn_test
        devlink_reload_test
 "
 NUM_NETIFS=2
@@ -541,6 +542,25 @@ vlan_interface_uppers_test()
        ip link del dev br0
 }
+bridge_extern_learn_test()
+{
+        # Test that externally learned entries added from user space are
+        # marked as offloaded
+        RET=0
+        ip link add name br0 type bridge
+        ip link set dev $swp1 master br0
+        bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn
+        bridge fdb show brport $swp1 | grep de:ad:be:ef:13:37 | grep -q offload
+        check_err $? "fdb entry not marked as offloaded when should"
+        log_test "externally learned fdb entry"
+        ip link del dev br0
+}
 devlink_reload_test()
 {
        # Test that after executing all the above configuration tests, a
diff --git a/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh b/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
index dcf9f4e913e0..ae6146ec5afd 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/vxlan.sh
@@ -847,6 +847,24 @@ sanitization_vlan_aware_test()
        log_test "vlan-aware - failed enslavement to vlan-aware bridge"
+        bridge vlan del vid 10 dev vxlan20
+        bridge vlan add vid 20 dev vxlan20 pvid untagged
+        # Test that offloading of an unsupported tunnel fails when it is
+        # triggered by addition of VLAN to a local port
+        RET=0
+        # TOS must be set to inherit
+        ip link set dev vxlan10 type vxlan tos 42
+        ip link set dev $swp1 master br0
+        bridge vlan add vid 10 dev $swp1 &> /dev/null
+        check_fail $?
+        log_test "vlan-aware - failed vlan addition to a local port"
+        ip link set dev vxlan10 type vxlan tos inherit
        ip link del dev vxlan20
        ip link del dev vxlan10
        ip link del dev br0
diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
index f8d468f54e98..aaa1e9f083c3 100644
--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
        struct libmnt_table *tb;
        struct libmnt_iter *itr = NULL;
        struct libmnt_fs *fs;
-        int found = 0;
+        int found = 0, ret;
        cxt = mnt_new_context();
        if (!cxt)
@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
                        break;
                }
        }
-        if (found)
+        if (found) {
-                asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+                if (ret < 0)
+                        err(EXIT_FAILURE, "failed to format string");
+        }
        mnt_free_iter(itr);
        mnt_free_context(cxt);
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 23022e9d32eb..b52cfdefecbf 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -571,7 +571,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
         * already exist.
         */
        region = (struct userspace_mem_region *) userspace_mem_region_find(
-                vm, guest_paddr, guest_paddr + npages * vm->page_size);
+                vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
        if (region != NULL)
                TEST_ASSERT(false, "overlapping userspace_mem_region already "
                        "exists\n"
@@ -587,15 +587,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
                region = region->next) {
                if (region->region.slot == slot)
                        break;
-                if ((guest_paddr <= (region->region.guest_phys_addr
-                                + region->region.memory_size))
-                        && ((guest_paddr + npages * vm->page_size)
-                                >= region->region.guest_phys_addr))
-                        break;
        }
        if (region != NULL)
                TEST_ASSERT(false, "A mem region with the requested slot "
-                        "or overlapping physical memory range already exists.\n"
+                        "already exists.\n"
                        "  requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
                        "  existing slot: %u paddr: 0x%lx size: 0x%lx",
                        slot, guest_paddr, npages,
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index ea3c73e8f4f6..c49c2a28b0eb 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -103,6 +103,12 @@ int main(int argc, char *argv[])
        vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
+        /* KVM should return supported EVMCS version range */
+        TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) &&
+                    (evmcs_ver & 0xff) > 0,
+                    "Incorrect EVMCS version range: %x:%x\n",
+                    evmcs_ver & 0xff, evmcs_ver >> 8);
        run = vcpu_state(vm, VCPU_ID);
        vcpu_regs_get(vm, VCPU_ID, &regs1);
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
index d8313d0438b7..b90dff8d3a94 100755
--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
+ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn"
 NUM_NETIFS=4
 CHECK_TC="yes"
 source lib.sh
@@ -96,6 +96,51 @@ flooding()
        flood_test $swp2 $h1 $h2
 }
+vlan_deletion()
+{
+        # Test that the deletion of a VLAN on a bridge port does not affect
+        # the PVID VLAN
+        log_info "Add and delete a VLAN on bridge port $swp1"
+        bridge vlan add vid 10 dev $swp1
+        bridge vlan del vid 10 dev $swp1
+        ping_ipv4
+        ping_ipv6
+}
+extern_learn()
+{
+        local mac=de:ad:be:ef:13:37
+        local ageing_time
+        # Test that externally learned FDB entries can roam, but not age out
+        RET=0
+        bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1
+        bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
+        check_err $? "Did not find FDB entry when should"
+        # Wait for 10 seconds after the ageing time to make sure the FDB entry
+        # was not aged out
+        ageing_time=$(bridge_ageing_time_get br0)
+        sleep $((ageing_time + 10))
+        bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
+        check_err $? "FDB entry was aged out when should not"
+        $MZ $h2 -c 1 -p 64 -a $mac -t ip -q
+        bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37
+        check_err $? "FDB entry did not roam when should"
+        log_test "Externally learned FDB entry - ageing & roaming"
+        bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null
+        bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null
+}
 trap cleanup EXIT
 setup_prepare
diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
index 56cef3b1c194..bb10e33690b2 100755
--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
@@ -629,7 +629,7 @@ __test_ecn_decap()
        RET=0
        tc filter add dev $h1 ingress pref 77 prot ip \
-                flower ip_tos $decapped_tos action pass
+                flower ip_tos $decapped_tos action drop
        sleep 1
        vxlan_encapped_ping_test v2 v1 192.0.2.17 \
                                 $orig_inner_tos $orig_outer_tos \
diff --git a/tools/testing/selftests/net/ip_defrag.c b/tools/testing/selftests/net/ip_defrag.c
index 61ae2782388e..5d56cc0838f6 100644
--- a/tools/testing/selftests/net/ip_defrag.c
+++ b/tools/testing/selftests/net/ip_defrag.c
@@ -203,6 +203,7 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
 {
        struct ip *iphdr = (struct ip *)ip_frame;
        struct ip6_hdr *ip6hdr = (struct ip6_hdr *)ip_frame;
+        const bool ipv4 = !ipv6;
        int res;
        int offset;
        int frag_len;
@@ -239,19 +240,53 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
                iphdr->ip_sum = 0;
        }
+        /* Occasionally test in-order fragments. */
+        if (!cfg_overlap && (rand() % 100 < 15)) {
+                offset = 0;
+                while (offset < (UDP_HLEN + payload_len)) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                return;
+        }
+        /* Occasionally test IPv4 "runs" (see net/ipv4/ip_fragment.c) */
+        if (ipv4 && !cfg_overlap && (rand() % 100 < 20) &&
+                        (payload_len > 9 * max_frag_len)) {
+                offset = 6 * max_frag_len;
+                while (offset < (UDP_HLEN + payload_len)) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                offset = 3 * max_frag_len;
+                while (offset < 6 * max_frag_len) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                offset = 0;
+                while (offset < 3 * max_frag_len) {
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
+                        offset += max_frag_len;
+                }
+                return;
+        }
        /* Odd fragments. */
        offset = max_frag_len;
        while (offset < (UDP_HLEN + payload_len)) {
                send_fragment(fd_raw, addr, alen, offset, ipv6);
+                /* IPv4 ignores duplicates, so randomly send a duplicate. */
+                if (ipv4 && (1 == rand() % 100))
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                offset += 2 * max_frag_len;
        }
        if (cfg_overlap) {
                /* Send an extra random fragment. */
-                offset = rand() % (UDP_HLEN + payload_len - 1);
-                /* sendto() returns EINVAL if offset + frag_len is too small. */
                if (ipv6) {
                        struct ip6_frag *fraghdr = (struct ip6_frag *)(ip_frame + IP6_HLEN);
+                        /* sendto() returns EINVAL if offset + frag_len is too small. */
+                        offset = rand() % (UDP_HLEN + payload_len - 1);
                        frag_len = max_frag_len + rand() % 256;
                        /* In IPv6 if !!(frag_len % 8), the fragment is dropped. */
                        frag_len &= ~0x7;
@@ -259,13 +294,29 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
                        ip6hdr->ip6_plen = htons(frag_len);
                        frag_len += IP6_HLEN;
                } else {
-                        frag_len = IP4_HLEN + UDP_HLEN + rand() % 256;
+                        /* In IPv4, duplicates and some fragments completely inside
+                         * previously sent fragments are dropped/ignored. So
+                         * random offset and frag_len can result in a dropped
+                         * fragment instead of a dropped queue/packet. So we
+                         * hard-code offset and frag_len.
+                         *
+                         * See ade446403bfb ("net: ipv4: do not handle duplicate
+                         * fragments as overlapping").
+                         */
+                        if (max_frag_len * 4 < payload_len || max_frag_len < 16) {
+                                /* not enough payload to play with random offset and frag_len. */
+                                offset = 8;
+                                frag_len = IP4_HLEN + UDP_HLEN + max_frag_len;
+                        } else {
+                                offset = rand() % (payload_len / 2);
+                                frag_len = 2 * max_frag_len + 1 + rand() % 256;
+                        }
                        iphdr->ip_off = htons(offset / 8 | IP4_MF);
                        iphdr->ip_len = htons(frag_len);
                }
                res = sendto(fd_raw, ip_frame, frag_len, 0, addr, alen);
                if (res < 0)
-                        error(1, errno, "sendto overlap");
+                        error(1, errno, "sendto overlap: %d", frag_len);
                if (res != frag_len)
                        error(1, 0, "sendto overlap: %d vs %d", (int)res, frag_len);
                frag_counter++;
@@ -275,6 +326,9 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
        offset = 0;
        while (offset < (UDP_HLEN + payload_len)) {
                send_fragment(fd_raw, addr, alen, offset, ipv6);
+                /* IPv4 ignores duplicates, so randomly send a duplicate. */
+                if (ipv4 && (1 == rand() % 100))
+                        send_fragment(fd_raw, addr, alen, offset, ipv6);
                offset += 2 * max_frag_len;
        }
 }
@@ -282,7 +336,11 @@ static void send_udp_frags(int fd_raw, struct sockaddr *addr,
 static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
 {
        int fd_tx_raw, fd_rx_udp;
-        struct timeval tv = { .tv_sec = 0, .tv_usec = 10 * 1000 };
+        /* Frag queue timeout is set to one second in the calling script;
+         * socket timeout should be just a bit longer to avoid tests interfering
+         * with each other.
+         */
+        struct timeval tv = { .tv_sec = 1, .tv_usec = 10 };
        int idx;
        int min_frag_len = ipv6 ? 1280 : 8;
@@ -308,12 +366,32 @@ static void run_test(struct sockaddr *addr, socklen_t alen, bool ipv6)
                        payload_len += (rand() % 4096)) {
                if (cfg_verbose)
                        printf("payload_len: %d\n", payload_len);
-                max_frag_len = min_frag_len;
-                do {
+                if (cfg_overlap) {
+                        /* With overlaps, one send/receive pair below takes
+                         * at least one second (== timeout) to run, so there
+                         * is not enough test time to run a nested loop:
+                         * the full overlap test takes 20-30 seconds.
+                         */
+                        max_frag_len = min_frag_len +
+                                rand() % (1500 - FRAG_HLEN - min_frag_len);
                        send_udp_frags(fd_tx_raw, addr, alen, ipv6);
                        recv_validate_udp(fd_rx_udp);
-                        max_frag_len += 8 * (rand() % 8);
+                } else {
-                } while (max_frag_len < (1500 - FRAG_HLEN) && max_frag_len <= payload_len);
+                        /* Without overlaps, each packet reassembly (== one
+                         * send/receive pair below) takes very little time to
+                         * run, so we can easily afford more thourough testing
+                         * with a nested loop: the full non-overlap test takes
+                         * less than one second).
+                         */
+                        max_frag_len = min_frag_len;
+                        do {
+                                send_udp_frags(fd_tx_raw, addr, alen, ipv6);
+                                recv_validate_udp(fd_rx_udp);
+                                max_frag_len += 8 * (rand() % 8);
+                        } while (max_frag_len < (1500 - FRAG_HLEN) &&
+                                 max_frag_len <= payload_len);
+                }
        }
        /* Cleanup. */
diff --git a/tools/testing/selftests/net/ip_defrag.sh b/tools/testing/selftests/net/ip_defrag.sh
index f34672796044..7dd79a9efb17 100755
--- a/tools/testing/selftests/net/ip_defrag.sh
+++ b/tools/testing/selftests/net/ip_defrag.sh
@@ -11,10 +11,17 @@ readonly NETNS="ns-$(mktemp -u XXXXXX)"
 setup() {
        ip netns add "${NETNS}"
        ip -netns "${NETNS}" link set lo up
        ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_high_thresh=9000000 >/dev/null 2>&1
        ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_low_thresh=7000000 >/dev/null 2>&1
+        ip netns exec "${NETNS}" sysctl -w net.ipv4.ipfrag_time=1 >/dev/null 2>&1
        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_high_thresh=9000000 >/dev/null 2>&1
        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_low_thresh=7000000 >/dev/null 2>&1
+        ip netns exec "${NETNS}" sysctl -w net.ipv6.ip6frag_time=1 >/dev/null 2>&1
+        # DST cache can get full with a lot of frags, with GC not keeping up with the test.
+        ip netns exec "${NETNS}" sysctl -w net.ipv6.route.max_size=65536 >/dev/null 2>&1
 }
 cleanup() {
@@ -27,7 +34,6 @@ setup
 echo "ipv4 defrag"
 ip netns exec "${NETNS}" ./ip_defrag -4
 echo "ipv4 defrag with overlaps"
 ip netns exec "${NETNS}" ./ip_defrag -4o
@@ -37,3 +43,4 @@ ip netns exec "${NETNS}" ./ip_defrag -6
 echo "ipv6 defrag with overlaps"
 ip netns exec "${NETNS}" ./ip_defrag -6o
+echo "all tests done"
diff --git a/tools/testing/selftests/networking/timestamping/txtimestamp.c b/tools/testing/selftests/networking/timestamping/txtimestamp.c
index 2e563d17cf0c..d1bbafb16f47 100644
--- a/tools/testing/selftests/networking/timestamping/txtimestamp.c
+++ b/tools/testing/selftests/networking/timestamping/txtimestamp.c
@@ -240,7 +240,7 @@ static void __recv_errmsg_cmsg(struct msghdr *msg, int payload_len)
                            cm->cmsg_type == IP_RECVERR) ||
                           (cm->cmsg_level == SOL_IPV6 &&
                            cm->cmsg_type == IPV6_RECVERR) ||
-                           (cm->cmsg_level = SOL_PACKET &&
+                           (cm->cmsg_level == SOL_PACKET &&
                            cm->cmsg_type == PACKET_TX_TIMESTAMP)) {
                        serr = (void *) CMSG_DATA(cm);
                        if (serr->ee_errno != ENOMSG ||
diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
index e20b017e7073..b2065536d407 100644
--- a/tools/testing/selftests/rtc/rtctest.c
+++ b/tools/testing/selftests/rtc/rtctest.c
@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
        ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
        /* Disable alarm interrupts */
        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
        ASSERT_NE(-1, rc);
-        if (rc == 0)
-                return;
        rc = read(self->fd, &data, sizeof(unsigned long));
        ASSERT_NE(-1, rc);
        TH_LOG("data: %lx", data);
@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) {
        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
        ASSERT_NE(-1, rc);
-        EXPECT_NE(0, rc);
+        ASSERT_NE(0, rc);
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+TEST_F(rtc, alarm_alm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        unsigned long data;
+        struct rtc_time tm;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
+        gmtime_r(&secs, (struct tm *)&tm);
+        rc = ioctl(self->fd, RTC_ALM_SET, &tm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+        rc = ioctl(self->fd, RTC_ALM_READ, &tm);
+        ASSERT_NE(-1, rc);
+        TH_LOG("Alarm time now set to %02d:%02d:%02d.",
+               tm.tm_hour, tm.tm_min, tm.tm_sec);
+        /* Enable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_ON, 0);
+        ASSERT_NE(-1, rc);
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
+        /* Disable alarm interrupts */
+        rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+        ASSERT_NE(-1, rc);
+        rc = read(self->fd, &data, sizeof(unsigned long));
+        ASSERT_NE(-1, rc);
+        TH_LOG("data: %lx", data);
+        rc = ioctl(self->fd, RTC_RD_TIME, &tm);
+        ASSERT_NE(-1, rc);
+        new = timegm((struct tm *)&tm);
+        ASSERT_EQ(new, secs);
+}
+TEST_F(rtc, alarm_wkalm_set_minute) {
+        struct timeval tv = { .tv_sec = 62 };
+        struct rtc_wkalrm alarm = { 0 };
+        struct rtc_time tm;
+        unsigned long data;
+        fd_set readfds;
+        time_t secs, new;
+        int rc;
+        rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
+        ASSERT_NE(-1, rc);
+        secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
+        gmtime_r(&secs, (struct tm *)&alarm.time);
+        alarm.enabled = 1;
+        rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
+        if (rc == -1) {
+                ASSERT_EQ(EINVAL, errno);
+                TH_LOG("skip alarms are not supported.");
+                return;
+        }
+        rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
+        ASSERT_NE(-1, rc);
+        TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
+               alarm.time.tm_mday, alarm.time.tm_mon + 1,
+               alarm.time.tm_year + 1900, alarm.time.tm_hour,
+               alarm.time.tm_min, alarm.time.tm_sec);
+        FD_ZERO(&readfds);
+        FD_SET(self->fd, &readfds);
+        rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+        ASSERT_NE(-1, rc);
+        ASSERT_NE(0, rc);
        rc = read(self->fd, &data, sizeof(unsigned long));
        ASSERT_NE(-1, rc);
diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index fce7f4ce0692..1760b3e39730 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
 CFLAGS += -Wl,-no-as-needed -Wall
 seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
-        $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+        $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
 TEST_PROGS += $(BINARIES)
 EXTRA_CLEAN := $(BINARIES)
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 067cb4607d6c..496a9a8c773a 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -3044,7 +3044,7 @@ TEST(user_notification_basic)
        /* Check that the basic notification machinery works */
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /* Installing a second listener in the chain should EBUSY */
        EXPECT_EQ(user_trap_syscall(__NR_getpid,
@@ -3103,7 +3103,7 @@ TEST(user_notification_kill_in_middle)
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /*
         * Check that nothing bad happens when we kill the task in the middle
@@ -3152,7 +3152,7 @@ TEST(user_notification_signal)
        listener = user_trap_syscall(__NR_gettid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        pid = fork();
        ASSERT_GE(pid, 0);
@@ -3215,7 +3215,7 @@ TEST(user_notification_closed_listener)
        listener = user_trap_syscall(__NR_getpid,
                                     SECCOMP_FILTER_FLAG_NEW_LISTENER);
-        EXPECT_GE(listener, 0);
+        ASSERT_GE(listener, 0);
        /*
         * Check that we get an ENOSYS when the listener is closed.
@@ -3376,7 +3376,7 @@ TEST(seccomp_get_notif_sizes)
 {
        struct seccomp_notif_sizes sizes;
-        EXPECT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
+        ASSERT_EQ(seccomp(SECCOMP_GET_NOTIF_SIZES, 0, &sizes), 0);
        EXPECT_EQ(sizes.seccomp_notif, sizeof(struct seccomp_notif));
        EXPECT_EQ(sizes.seccomp_notif_resp, sizeof(struct seccomp_notif_resp));
 }
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
index 637ea0219617..0da3545cabdb 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
@@ -17,7 +17,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -41,7 +41,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -65,7 +65,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -89,7 +89,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -113,7 +113,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -137,7 +137,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 2",
-        "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2",
+        "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -161,7 +161,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 90",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -185,7 +185,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 90",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90",
        "matchCount": "0",
        "teardown": []
    },
@@ -207,7 +207,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -231,7 +231,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -255,7 +255,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -279,7 +279,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -303,7 +303,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -327,7 +327,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 9",
-        "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9",
+        "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -351,7 +351,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 99",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -375,7 +375,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 99",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99",
        "matchCount": "0",
        "teardown": []
    },
@@ -397,7 +397,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -421,7 +421,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -445,7 +445,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -469,7 +469,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -493,7 +493,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -517,7 +517,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -541,7 +541,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 77",
-        "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77",
+        "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -565,7 +565,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -589,7 +589,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1",
        "matchCount": "0",
        "teardown": []
    },
@@ -611,7 +611,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -635,7 +635,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -659,7 +659,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 11",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -683,7 +683,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -707,7 +707,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 21",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -731,7 +731,7 @@
        "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 21",
-        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21",
+        "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -739,7 +739,7 @@
    },
    {
        "id": "fac3",
-        "name": "Create valid ife encode action with index at 32-bit maximnum",
+        "name": "Create valid ife encode action with index at 32-bit maximum",
        "category": [
            "actions",
            "ife"
@@ -755,7 +755,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 4294967295",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -779,7 +779,7 @@
        "cmdUnderTest": "$TC actions add action ife decode pass index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -803,7 +803,7 @@
        "cmdUnderTest": "$TC actions add action ife decode pipe index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -827,7 +827,7 @@
        "cmdUnderTest": "$TC actions add action ife decode continue index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -851,7 +851,7 @@
        "cmdUnderTest": "$TC actions add action ife decode drop index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -875,7 +875,7 @@
        "cmdUnderTest": "$TC actions add action ife decode reclassify index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -899,7 +899,7 @@
        "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 1",
-        "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
+        "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action ife"
@@ -923,7 +923,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 4294967295999",
-        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999",
+        "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999",
        "matchCount": "0",
        "teardown": []
    },
@@ -945,7 +945,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4",
        "matchCount": "0",
        "teardown": []
    },
@@ -967,7 +967,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
        "matchCount": "1",
        "teardown": [
           "$TC actions flush action ife"
@@ -991,7 +991,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4",
        "matchCount": "0",
        "teardown": []
    },
@@ -1013,7 +1013,7 @@
        "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4",
        "expExitCode": "255",
        "verifyCmd": "$TC actions get action ife index 4",
-        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4",
+        "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4",
        "matchCount": "0",
        "teardown": []
    },
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
index 10b2d894e436..e7e15a7336b6 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
@@ -82,35 +82,6 @@
        ]
    },
    {
-        "id": "ba4e",
-        "name": "Add tunnel_key set action with missing mandatory id parameter",
-        "category": [
-            "actions",
-            "tunnel_key"
-        ],
-        "setup": [
-            [
-                "$TC actions flush action tunnel_key",
-                0,
-                1,
-                255
-            ]
-        ],
-        "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2",
-        "expExitCode": "255",
-        "verifyCmd": "$TC actions list action tunnel_key",
-        "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2",
-        "matchCount": "0",
-        "teardown": [
-            [
-                "$TC actions flush action tunnel_key",
-                0,
-                1,
-                255
-            ]
-        ]
-    },
-    {
        "id": "a5e0",
        "name": "Add tunnel_key set action with invalid src_ip parameter",
        "category": [
@@ -634,7 +605,7 @@
        "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
        "expExitCode": "0",
        "verifyCmd": "$TC actions get action tunnel_key index 4",
-        "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+        "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
        "matchCount": "1",
        "teardown": [
            "$TC actions flush action tunnel_key"
diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
index 880b96fc80d4..c0534e298b51 100644
--- a/tools/testing/selftests/vm/gup_benchmark.c
+++ b/tools/testing/selftests/vm/gup_benchmark.c
@@ -25,6 +25,7 @@ struct gup_benchmark {
        __u64 size;
        __u32 nr_pages_per_call;
        __u32 flags;
+        __u64 expansion[10];    /* For future use */
 };
 int main(int argc, char **argv)
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index 50f7e9272481..bf1bb15b6fbe 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -1503,7 +1503,7 @@ exit:
                exit(20);
        }
        if (successes != total_nr_tests) {
-                eprintf("ERROR: succeded fewer than number of tries (%d != %d)\n",
+                eprintf("ERROR: succeeded fewer than number of tries (%d != %d)\n",
                                successes, total_nr_tests);
                exit(21);
        }
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index 460b4bdf4c1e..5d546dcdbc80 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -1133,6 +1133,21 @@ void test_pkey_syscalls_bad_args(int *ptr, u16 pkey)
        pkey_assert(err);
 }
+void become_child(void)
+{
+        pid_t forkret;
+        forkret = fork();
+        pkey_assert(forkret >= 0);
+        dprintf3("[%d] fork() ret: %d\n", getpid(), forkret);
+        if (!forkret) {
+                /* in the child */
+                return;
+        }
+        exit(0);
+}
 /* Assumes that all pkeys other than 'pkey' are unallocated */
 void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
 {
@@ -1141,7 +1156,7 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
        int nr_allocated_pkeys = 0;
        int i;
-        for (i = 0; i < NR_PKEYS*2; i++) {
+        for (i = 0; i < NR_PKEYS*3; i++) {
                int new_pkey;
                dprintf1("%s() alloc loop: %d\n", __func__, i);
                new_pkey = alloc_pkey();
@@ -1152,21 +1167,27 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
                if ((new_pkey == -1) && (errno == ENOSPC)) {
                        dprintf2("%s() failed to allocate pkey after %d tries\n",
                                __func__, nr_allocated_pkeys);
-                        break;
+                } else {
+                        /*
+                         * Ensure the number of successes never
+                         * exceeds the number of keys supported
+                         * in the hardware.
+                         */
+                        pkey_assert(nr_allocated_pkeys < NR_PKEYS);
+                        allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
                }
-                pkey_assert(nr_allocated_pkeys < NR_PKEYS);
-                allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
+                /*
+                 * Make sure that allocation state is properly
+                 * preserved across fork().
+                 */
+                if (i == NR_PKEYS*2)
+                        become_child();
        }
        dprintf3("%s()::%d\n", __func__, __LINE__);
        /*
-         * ensure it did not reach the end of the loop without
-         * failure:
-         */
-        pkey_assert(i < NR_PKEYS*2);
-        /*
         * There are 16 pkeys supported in hardware.  Three are
         * allocated by the time we get here:
         *   1. The default key (0)
diff --git a/tools/testing/selftests/x86/unwind_vdso.c b/tools/testing/selftests/x86/unwind_vdso.c
index 00a26a82fa98..97311333700e 100644
--- a/tools/testing/selftests/x86/unwind_vdso.c
+++ b/tools/testing/selftests/x86/unwind_vdso.c
@@ -44,7 +44,6 @@ int main()
 #include <stdbool.h>
 #include <sys/ptrace.h>
 #include <sys/user.h>
-#include <sys/ucontext.h>
 #include <link.h>
 #include <sys/auxv.h>
 #include <dlfcn.h>